From 60eaf3d90650086dedb6fd94d6169dc5ab1f8d1e Mon Sep 17 00:00:00 2001
From: GitLab Bot <gitlab-bot@gitlab.com>
Date: Fri, 12 Aug 2022 18:11:09 +0000
Subject: [PATCH] Add latest changes from gitlab-org/gitlab@master

---
 GITLAB_KAS_VERSION                            |   2 +-
 Gemfile                                       |   6 +-
 Gemfile.lock                                  |  20 +-
 .../components/work_item_actions.vue          |  55 +++++-
 .../components/work_item_detail.vue           |  79 +++++++-
 .../work_item_links/work_item_links.vue       |  15 +-
 .../graphql/work_item.fragment.graphql        |   2 +
 .../graphql/work_item_links.query.graphql     |   1 +
 app/graphql/mutations/ci/job/retry.rb         |  11 +-
 app/graphql/types/ci/job_type.rb              |   2 +-
 app/graphql/types/ci/variable_input_type.rb   |  13 ++
 app/models/ci/build.rb                        |  11 ++
 app/models/ci/job_artifact.rb                 |   3 +-
 app/models/ci/processable.rb                  |   2 +-
 app/models/container_repository.rb            |  42 +++++
 app/services/ci/retry_job_service.rb          |  12 +-
 doc/.vale/gitlab/Admin.yml                    |   2 +-
 doc/.vale/gitlab/BadPlurals.yml               |   2 +-
 doc/.vale/gitlab/EOLWhitespace.yml            |   2 +-
 doc/.vale/gitlab/FutureTense.yml              |   2 +-
 doc/.vale/gitlab/HeadingContent.yml           |   2 +-
 doc/.vale/gitlab/OutdatedVersions.yml         |   2 +-
 doc/.vale/gitlab/Possessive.yml               |   2 +-
 doc/api/graphql/reference/index.md            |  32 ++--
 doc/ci/cloud_services/aws/index.md            |   6 +-
 doc/ci/runners/configure_runners.md           |  20 ++
 doc/ci/runners/img/build_isolation.png        | Bin 0 -> 35301 bytes
 doc/ci/runners/index.md                       |  24 ++-
 lib/container_registry/gitlab_api_client.rb   |  23 +++
 lib/container_registry/tag.rb                 |  15 +-
 lib/gitlab/ci/parsers.rb                      |   3 +-
 lib/gitlab/ci/parsers/sbom/cyclonedx.rb       |  10 +-
 lib/gitlab/ci/reports/sbom/reports.rb         |  21 +++
 lib/gitlab/utils/link_header_parser.rb        |  46 +++++
 locale/gitlab.pot                             |  17 +-
 results.txt                                   |   0
 spec/features/issues/issue_sidebar_spec.rb    |   6 +-
 spec/features/issues/user_edits_issue_spec.rb |   2 +-
 .../components/work_item_actions_spec.js      |  87 +++++++--
 .../work_item_links/work_item_links_spec.js   |   8 +
 spec/frontend/work_items/mock_data.js         |  36 +++-
 .../work_items/pages/work_item_detail_spec.js | 169 ++++++++++++++++-
 .../types/ci/variable_input_type_spec.rb      |  11 ++
 .../gitlab_api_client_spec.rb                 | 125 ++++++++++++
 spec/lib/container_registry/tag_spec.rb       |  35 ++++
 .../gitlab/ci/parsers/sbom/cyclonedx_spec.rb  |   2 +-
 .../gitlab/ci/reports/sbom/reports_spec.rb    |  21 +++
 .../gitlab/utils/link_header_parser_spec.rb   |  75 ++++++++
 spec/models/ci/build_spec.rb                  |  54 ++++++
 spec/models/container_repository_spec.rb      | 178 ++++++++++++++++++
 .../api/graphql/ci/manual_variables_spec.rb   |   8 +-
 .../graphql/mutations/ci/job_retry_spec.rb    |  32 ++++
 spec/services/ci/retry_job_service_spec.rb    |  61 ++++++
 53 files changed, 1300 insertions(+), 117 deletions(-)
 create mode 100644 app/graphql/types/ci/variable_input_type.rb
 create mode 100644 doc/ci/runners/img/build_isolation.png
 create mode 100644 lib/gitlab/ci/reports/sbom/reports.rb
 create mode 100644 lib/gitlab/utils/link_header_parser.rb
 create mode 100644 results.txt
 create mode 100644 spec/graphql/types/ci/variable_input_type_spec.rb
 create mode 100644 spec/lib/gitlab/ci/reports/sbom/reports_spec.rb
 create mode 100644 spec/lib/gitlab/utils/link_header_parser_spec.rb

diff --git a/GITLAB_KAS_VERSION b/GITLAB_KAS_VERSION
index 6c43fc8aefc..5ff58dbcd68 100644
--- a/GITLAB_KAS_VERSION
+++ b/GITLAB_KAS_VERSION
@@ -1 +1 @@
-15.2.0
+15.3.0
diff --git a/Gemfile b/Gemfile
index eb1018cc70c..e8cdf812b9c 100644
--- a/Gemfile
+++ b/Gemfile
@@ -495,9 +495,9 @@ gem 'google-protobuf', '~> 3.21'
 gem 'toml-rb', '~> 2.0'
 
 # Feature toggles
-gem 'flipper', '~> 0.21.0'
-gem 'flipper-active_record', '~> 0.21.0'
-gem 'flipper-active_support_cache_store', '~> 0.21.0'
+gem 'flipper', '~> 0.25.0'
+gem 'flipper-active_record', '~> 0.25.0'
+gem 'flipper-active_support_cache_store', '~> 0.25.0'
 gem 'unleash', '~> 3.2.2'
 gem 'gitlab-experiment', '~> 0.7.1'
 
diff --git a/Gemfile.lock b/Gemfile.lock
index 1190dd4bf8c..3b8bdd23647 100644
--- a/Gemfile.lock
+++ b/Gemfile.lock
@@ -438,13 +438,13 @@ GEM
       libyajl2 (~> 1.2)
     filelock (1.1.1)
     find_a_port (1.0.1)
-    flipper (0.21.0)
-    flipper-active_record (0.21.0)
-      activerecord (>= 5.0, < 7)
-      flipper (~> 0.21.0)
-    flipper-active_support_cache_store (0.21.0)
-      activesupport (>= 5.0, < 7)
-      flipper (~> 0.21.0)
+    flipper (0.25.0)
+    flipper-active_record (0.25.0)
+      activerecord (>= 4.2, < 8)
+      flipper (~> 0.25.0)
+    flipper-active_support_cache_store (0.25.0)
+      activesupport (>= 4.2, < 8)
+      flipper (~> 0.25.0)
     flowdock (0.7.1)
       httparty (~> 0.7)
       multi_json
@@ -1557,9 +1557,9 @@ DEPENDENCIES
   faraday_middleware-aws-sigv4 (~> 0.3.0)
   fast_blank
   ffaker (~> 2.10)
-  flipper (~> 0.21.0)
-  flipper-active_record (~> 0.21.0)
-  flipper-active_support_cache_store (~> 0.21.0)
+  flipper (~> 0.25.0)
+  flipper-active_record (~> 0.25.0)
+  flipper-active_support_cache_store (~> 0.25.0)
   flowdock (~> 0.7)
   fog-aliyun (~> 0.3)
   fog-aws (~> 3.14)
diff --git a/app/assets/javascripts/work_items/components/work_item_actions.vue b/app/assets/javascripts/work_items/components/work_item_actions.vue
index 77002eeaf55..2130eb4b729 100644
--- a/app/assets/javascripts/work_items/components/work_item_actions.vue
+++ b/app/assets/javascripts/work_items/components/work_item_actions.vue
@@ -1,15 +1,24 @@
 <script>
-import { GlDropdown, GlDropdownItem, GlModal, GlModalDirective } from '@gitlab/ui';
+import {
+  GlDropdown,
+  GlDropdownItem,
+  GlDropdownDivider,
+  GlModal,
+  GlModalDirective,
+} from '@gitlab/ui';
 import { s__ } from '~/locale';
 import Tracking from '~/tracking';
 
 export default {
   i18n: {
     deleteTask: s__('WorkItem|Delete task'),
+    enableTaskConfidentiality: s__('WorkItem|Turn on confidentiality'),
+    disableTaskConfidentiality: s__('WorkItem|Turn off confidentiality'),
   },
   components: {
     GlDropdown,
     GlDropdownItem,
+    GlDropdownDivider,
     GlModal,
   },
   directives: {
@@ -22,14 +31,33 @@ export default {
       required: false,
       default: null,
     },
+    canUpdate: {
+      type: Boolean,
+      required: false,
+      default: false,
+    },
     canDelete: {
       type: Boolean,
       required: false,
       default: false,
     },
+    isConfidential: {
+      type: Boolean,
+      required: false,
+      default: false,
+    },
+    isParentConfidential: {
+      type: Boolean,
+      required: false,
+      default: false,
+    },
   },
-  emits: ['deleteWorkItem'],
+  emits: ['deleteWorkItem', 'toggleWorkItemConfidentiality'],
   methods: {
+    handleToggleWorkItemConfidentiality() {
+      this.track('click_toggle_work_item_confidentiality');
+      this.$emit('toggleWorkItemConfidentiality', !this.isConfidential);
+    },
     handleDeleteWorkItem() {
       this.track('click_delete_work_item');
       this.$emit('deleteWorkItem');
@@ -44,7 +72,7 @@ export default {
 </script>
 
 <template>
-  <div v-if="canDelete">
+  <div>
     <gl-dropdown
       icon="ellipsis_v"
       text-sr-only
@@ -53,9 +81,24 @@ export default {
       no-caret
       right
     >
-      <gl-dropdown-item v-gl-modal="'work-item-confirm-delete'">{{
-        $options.i18n.deleteTask
-      }}</gl-dropdown-item>
+      <template v-if="canUpdate && !isParentConfidential">
+        <gl-dropdown-item
+          data-testid="confidentiality-toggle-action"
+          @click="handleToggleWorkItemConfidentiality"
+          >{{
+            isConfidential
+              ? $options.i18n.disableTaskConfidentiality
+              : $options.i18n.enableTaskConfidentiality
+          }}</gl-dropdown-item
+        >
+        <gl-dropdown-divider />
+      </template>
+      <gl-dropdown-item
+        v-if="canDelete"
+        v-gl-modal="'work-item-confirm-delete'"
+        data-testid="delete-action"
+        >{{ $options.i18n.deleteTask }}</gl-dropdown-item
+      >
     </gl-dropdown>
     <gl-modal
       modal-id="work-item-confirm-delete"
diff --git a/app/assets/javascripts/work_items/components/work_item_detail.vue b/app/assets/javascripts/work_items/components/work_item_detail.vue
index 23e2842743a..44c9ef9e44b 100644
--- a/app/assets/javascripts/work_items/components/work_item_detail.vue
+++ b/app/assets/javascripts/work_items/components/work_item_detail.vue
@@ -1,5 +1,13 @@
 <script>
-import { GlAlert, GlSkeletonLoader, GlIcon, GlButton, GlTooltipDirective } from '@gitlab/ui';
+import {
+  GlAlert,
+  GlSkeletonLoader,
+  GlLoadingIcon,
+  GlIcon,
+  GlBadge,
+  GlButton,
+  GlTooltipDirective,
+} from '@gitlab/ui';
 import glFeatureFlagMixin from '~/vue_shared/mixins/gl_feature_flags_mixin';
 import LocalStorageSync from '~/vue_shared/components/local_storage_sync.vue';
 import {
@@ -11,8 +19,12 @@ import {
   WIDGET_TYPE_HIERARCHY,
   WORK_ITEM_VIEWED_STORAGE_KEY,
 } from '../constants';
+
 import workItemQuery from '../graphql/work_item.query.graphql';
 import workItemTitleSubscription from '../graphql/work_item_title.subscription.graphql';
+import updateWorkItemMutation from '../graphql/update_work_item.mutation.graphql';
+import updateWorkItemTaskMutation from '../graphql/update_work_item_task.mutation.graphql';
+
 import WorkItemActions from './work_item_actions.vue';
 import WorkItemState from './work_item_state.vue';
 import WorkItemTitle from './work_item_title.vue';
@@ -29,7 +41,9 @@ export default {
   },
   components: {
     GlAlert,
+    GlBadge,
     GlButton,
+    GlLoadingIcon,
     GlSkeletonLoader,
     GlIcon,
     WorkItemAssignees,
@@ -65,6 +79,7 @@ export default {
       error: undefined,
       workItem: {},
       showInfoBanner: true,
+      updateInProgress: false,
     };
   },
   apollo: {
@@ -125,6 +140,9 @@ export default {
     parentWorkItem() {
       return this.workItemHierarchy?.parent;
     },
+    parentWorkItemConfidentiality() {
+      return this.parentWorkItem?.confidential;
+    },
     parentUrl() {
       return `../../issues/${this.parentWorkItem?.iid}`;
     },
@@ -138,6 +156,54 @@ export default {
     dismissBanner() {
       this.showInfoBanner = false;
     },
+    toggleConfidentiality(confidentialStatus) {
+      this.updateInProgress = true;
+      let updateMutation = updateWorkItemMutation;
+      let inputVariables = {
+        id: this.workItemId,
+        confidential: confidentialStatus,
+      };
+
+      if (this.parentWorkItem) {
+        updateMutation = updateWorkItemTaskMutation;
+        inputVariables = {
+          id: this.parentWorkItem.id,
+          taskData: {
+            id: this.workItemId,
+            confidential: confidentialStatus,
+          },
+        };
+      }
+
+      this.$apollo
+        .mutate({
+          mutation: updateMutation,
+          variables: {
+            input: inputVariables,
+          },
+        })
+        .then(
+          ({
+            data: {
+              workItemUpdate: { errors, workItem, task },
+            },
+          }) => {
+            if (errors?.length) {
+              throw new Error(errors[0]);
+            }
+
+            this.$emit('workItemUpdated', {
+              confidential: workItem?.confidential || task?.confidential,
+            });
+          },
+        )
+        .catch((error) => {
+          this.error = error.message;
+        })
+        .finally(() => {
+          this.updateInProgress = false;
+        });
+    },
   },
   WORK_ITEM_VIEWED_STORAGE_KEY,
 };
@@ -156,7 +222,7 @@ export default {
       </gl-skeleton-loader>
     </div>
     <template v-else>
-      <div class="gl-display-flex gl-align-items-center">
+      <div class="gl-display-flex gl-align-items-center" data-testid="work-item-body">
         <ul
           v-if="parentWorkItem"
           class="list-unstyled gl-display-flex gl-mr-auto gl-max-w-26 gl-md-max-w-50p gl-min-w-0 gl-mb-0"
@@ -187,10 +253,19 @@ export default {
           data-testid="work-item-type"
           >{{ workItemType }}</span
         >
+        <gl-loading-icon v-if="updateInProgress" :inline="true" class="gl-mr-3" />
+        <gl-badge v-if="workItem.confidential" variant="warning" icon="eye-slash" class="gl-mr-3">{{
+          __('Confidential')
+        }}</gl-badge>
         <work-item-actions
+          v-if="canUpdate || canDelete"
           :work-item-id="workItem.id"
           :can-delete="canDelete"
+          :can-update="canUpdate"
+          :is-confidential="workItem.confidential"
+          :is-parent-confidential="parentWorkItemConfidentiality"
           @deleteWorkItem="$emit('deleteWorkItem')"
+          @toggleWorkItemConfidentiality="toggleConfidentiality"
           @error="error = $event"
         />
         <gl-button
diff --git a/app/assets/javascripts/work_items/components/work_item_links/work_item_links.vue b/app/assets/javascripts/work_items/components/work_item_links/work_item_links.vue
index aa9cd2bbe4b..372bf7ec749 100644
--- a/app/assets/javascripts/work_items/components/work_item_links/work_item_links.vue
+++ b/app/assets/javascripts/work_items/components/work_item_links/work_item_links.vue
@@ -1,5 +1,5 @@
 <script>
-import { GlButton, GlBadge, GlIcon, GlLoadingIcon } from '@gitlab/ui';
+import { GlButton, GlBadge, GlIcon, GlLoadingIcon, GlTooltipDirective } from '@gitlab/ui';
 import { produce } from 'immer';
 import { s__ } from '~/locale';
 import { convertToGraphQLId, getIdFromGraphQLId } from '~/graphql_shared/utils';
@@ -30,6 +30,9 @@ export default {
     WorkItemLinksMenu,
     WorkItemDetailModal,
   },
+  directives: {
+    GlTooltip: GlTooltipDirective,
+  },
   inject: ['projectPath'],
   props: {
     workItemId: {
@@ -284,7 +287,15 @@ export default {
           class="gl-relative gl-display-flex gl-flex-direction-column gl-sm-flex-direction-row gl-overflow-break-word gl-min-w-0 gl-bg-white gl-mb-3 gl-py-3 gl-px-4 gl-border gl-border-gray-100 gl-rounded-base gl-line-height-32"
           data-testid="links-child"
         >
-          <div class="gl-overflow-hidden">
+          <div class="gl-overflow-hidden gl-display-flex gl-align-items-center">
+            <gl-icon
+              v-if="child.confidential"
+              v-gl-tooltip.top
+              name="eye-slash"
+              class="gl-mr-3 gl-text-orange-500"
+              data-testid="confidential-icon"
+              :title="__('Confidential')"
+            />
             <gl-icon :name="$options.WIDGET_TYPE_TASK_ICON" class="gl-mr-3 gl-text-gray-700" />
             <gl-button
               :href="childPath(child.id)"
diff --git a/app/assets/javascripts/work_items/graphql/work_item.fragment.graphql b/app/assets/javascripts/work_items/graphql/work_item.fragment.graphql
index 7d08cbaca48..dacc1527a43 100644
--- a/app/assets/javascripts/work_items/graphql/work_item.fragment.graphql
+++ b/app/assets/javascripts/work_items/graphql/work_item.fragment.graphql
@@ -5,6 +5,7 @@ fragment WorkItem on WorkItem {
   title
   state
   description
+  confidential
   workItemType {
     id
     name
@@ -34,6 +35,7 @@ fragment WorkItem on WorkItem {
         id
         iid
         title
+        confidential
       }
       children {
         nodes {
diff --git a/app/assets/javascripts/work_items/graphql/work_item_links.query.graphql b/app/assets/javascripts/work_items/graphql/work_item_links.query.graphql
index c30c907baeb..df62ca1c143 100644
--- a/app/assets/javascripts/work_items/graphql/work_item_links.query.graphql
+++ b/app/assets/javascripts/work_items/graphql/work_item_links.query.graphql
@@ -20,6 +20,7 @@ query workItemQuery($id: WorkItemID!) {
         children {
           nodes {
             id
+            confidential
             workItemType {
               id
             }
diff --git a/app/graphql/mutations/ci/job/retry.rb b/app/graphql/mutations/ci/job/retry.rb
index 50e9c51c9e7..bfb9b902cc5 100644
--- a/app/graphql/mutations/ci/job/retry.rb
+++ b/app/graphql/mutations/ci/job/retry.rb
@@ -11,13 +11,20 @@ module Mutations
               null: true,
               description: 'Job after the mutation.'
 
+        argument :variables, [::Types::Ci::VariableInputType],
+                 required: false,
+                 default_value: [],
+                 replace_null_with_default: true,
+                 description: 'Variables to use when retrying a manual job.'
+
         authorize :update_build
 
-        def resolve(id:)
+        def resolve(id:, variables:)
           job = authorized_find!(id: id)
           project = job.project
+          variables = variables.map(&:to_h)
 
-          response = ::Ci::RetryJobService.new(project, current_user).execute(job)
+          response = ::Ci::RetryJobService.new(project, current_user).execute(job, variables: variables)
 
           if response.success?
             {
diff --git a/app/graphql/types/ci/job_type.rb b/app/graphql/types/ci/job_type.rb
index 3444c76da08..4ea9a016e74 100644
--- a/app/graphql/types/ci/job_type.rb
+++ b/app/graphql/types/ci/job_type.rb
@@ -194,7 +194,7 @@ module Types
       end
 
       def manual_variables
-        if object.manual? && object.respond_to?(:job_variables)
+        if object.action? && object.respond_to?(:job_variables)
           object.job_variables
         else
           []
diff --git a/app/graphql/types/ci/variable_input_type.rb b/app/graphql/types/ci/variable_input_type.rb
new file mode 100644
index 00000000000..193ca6ffe4e
--- /dev/null
+++ b/app/graphql/types/ci/variable_input_type.rb
@@ -0,0 +1,13 @@
+# frozen_string_literal: true
+
+module Types
+  module Ci
+    class VariableInputType < BaseInputObject
+      graphql_name 'CiVariableInput'
+      description 'Attributes for defining a CI/CD variable.'
+
+      argument :key, GraphQL::Types::String, description: 'Name of the variable.'
+      argument :value, GraphQL::Types::String, description: 'Value of the variable.'
+    end
+  end
+end
diff --git a/app/models/ci/build.rb b/app/models/ci/build.rb
index b267ea8f93f..b5dcb863e5b 100644
--- a/app/models/ci/build.rb
+++ b/app/models/ci/build.rb
@@ -1161,6 +1161,17 @@ module Ci
       end
     end
 
+    def clone(current_user:, new_job_variables_attributes: [])
+      new_build = super
+
+      if action? && new_job_variables_attributes.any?
+        new_build.job_variables = []
+        new_build.job_variables_attributes = new_job_variables_attributes
+      end
+
+      new_build
+    end
+
     protected
 
     def run_status_commit_hooks!
diff --git a/app/models/ci/job_artifact.rb b/app/models/ci/job_artifact.rb
index 8b41ade90df..71d33f0bb63 100644
--- a/app/models/ci/job_artifact.rb
+++ b/app/models/ci/job_artifact.rb
@@ -22,7 +22,8 @@ module Ci
       accessibility: %w[accessibility],
       coverage: %w[cobertura],
       codequality: %w[codequality],
-      terraform: %w[terraform]
+      terraform: %w[terraform],
+      sbom: %w[cyclonedx]
     }.freeze
 
     DEFAULT_FILE_NAMES = {
diff --git a/app/models/ci/processable.rb b/app/models/ci/processable.rb
index f666629c8fd..a2ff49077be 100644
--- a/app/models/ci/processable.rb
+++ b/app/models/ci/processable.rb
@@ -101,7 +101,7 @@ module Ci
       :merge_train_pipeline?,
       to: :pipeline
 
-    def clone(current_user:)
+    def clone(current_user:, new_job_variables_attributes: [])
       new_attributes = self.class.clone_accessors.to_h do |attribute|
         [attribute, public_send(attribute)] # rubocop:disable GitlabSecurity/PublicSend
       end
diff --git a/app/models/container_repository.rb b/app/models/container_repository.rb
index 1aca763d57f..e10452c1081 100644
--- a/app/models/container_repository.rb
+++ b/app/models/container_repository.rb
@@ -19,6 +19,8 @@ class ContainerRepository < ApplicationRecord
   MIGRATION_PHASE_1_STARTED_AT = Date.new(2021, 11, 4).freeze
   MIGRATION_PHASE_1_ENDED_AT = Date.new(2022, 01, 23).freeze
 
+  MAX_TAGS_PAGES = 2000
+
   TooManyImportsError = Class.new(StandardError)
 
   belongs_to :project
@@ -377,6 +379,10 @@ class ContainerRepository < ApplicationRecord
     migration_retries_count >= ContainerRegistry::Migration.max_retries - 1
   end
 
+  def migrated?
+    MIGRATION_PHASE_1_ENDED_AT < self.created_at || import_done?
+  end
+
   def last_import_step_done_at
     [migration_pre_import_done_at, migration_import_done_at, migration_aborted_at, migration_skipped_at].compact.max
   end
@@ -427,6 +433,32 @@ class ContainerRepository < ApplicationRecord
     end
   end
 
+  def each_tags_page(page_size: 100, &block)
+    raise ArgumentError, 'not a migrated repository' unless migrated?
+    raise ArgumentError, 'block not given' unless block
+
+    # dummy uri to initialize the loop
+    next_page_uri = URI('')
+    page_count = 0
+
+    while next_page_uri && page_count < MAX_TAGS_PAGES
+      last = Rack::Utils.parse_nested_query(next_page_uri.query)['last']
+      current_page = gitlab_api_client.tags(self.path, page_size: page_size, last: last)
+
+      if current_page&.key?(:response_body)
+        yield transform_tags_page(current_page[:response_body])
+        next_page_uri = current_page.dig(:pagination, :next, :uri)
+      else
+        # no current page. Break the loop
+        next_page_uri = nil
+      end
+
+      page_count += 1
+    end
+
+    raise 'too many pages requested' if page_count >= MAX_TAGS_PAGES
+  end
+
   def tags_count
     return 0 unless manifest && manifest['tags']
 
@@ -559,6 +591,16 @@ class ContainerRepository < ApplicationRecord
     self.migration_skipped_reason = reason
     finish_import
   end
+
+  def transform_tags_page(tags_response_body)
+    return [] unless tags_response_body
+
+    tags_response_body.map do |raw_tag|
+      tag = ContainerRegistry::Tag.new(self, raw_tag['name'])
+      tag.force_created_at_from_iso8601(raw_tag['created_at'])
+      tag
+    end
+  end
 end
 
 ContainerRepository.prepend_mod_with('ContainerRepository')
diff --git a/app/services/ci/retry_job_service.rb b/app/services/ci/retry_job_service.rb
index e0ced3d0197..25bda8a6380 100644
--- a/app/services/ci/retry_job_service.rb
+++ b/app/services/ci/retry_job_service.rb
@@ -4,10 +4,10 @@ module Ci
   class RetryJobService < ::BaseService
     include Gitlab::Utils::StrongMemoize
 
-    def execute(job)
+    def execute(job, variables: [])
       if job.retryable?
         job.ensure_scheduling_type!
-        new_job = retry_job(job)
+        new_job = retry_job(job, variables: variables)
 
         ServiceResponse.success(payload: { job: new_job })
       else
@@ -19,7 +19,7 @@ module Ci
     end
 
     # rubocop: disable CodeReuse/ActiveRecord
-    def clone!(job)
+    def clone!(job, variables: [])
       # Cloning a job requires a strict type check to ensure
       # the attributes being used for the clone are taken straight
       # from the model and not overridden by other abstractions.
@@ -27,7 +27,7 @@ module Ci
 
       check_access!(job)
 
-      new_job = job.clone(current_user: current_user)
+      new_job = job.clone(current_user: current_user, new_job_variables_attributes: variables)
 
       new_job.run_after_commit do
         ::Ci::CopyCrossDatabaseAssociationsService.new.execute(job, new_job)
@@ -55,8 +55,8 @@ module Ci
 
     def check_assignable_runners!(job); end
 
-    def retry_job(job)
-      clone!(job).tap do |new_job|
+    def retry_job(job, variables: [])
+      clone!(job, variables: variables).tap do |new_job|
         check_assignable_runners!(new_job) if new_job.is_a?(Ci::Build)
 
         next if new_job.failed?
diff --git a/doc/.vale/gitlab/Admin.yml b/doc/.vale/gitlab/Admin.yml
index f6b0a988499..78a86e27456 100644
--- a/doc/.vale/gitlab/Admin.yml
+++ b/doc/.vale/gitlab/Admin.yml
@@ -1,5 +1,5 @@
 ---
-# Warning: gitlab.Admin
+# Suggestion: gitlab.Admin
 #
 # Checks for "admin" and recommends using the full word instead. "Admin Area" is OK.
 #
diff --git a/doc/.vale/gitlab/BadPlurals.yml b/doc/.vale/gitlab/BadPlurals.yml
index 63f002fec94..533805c67b0 100644
--- a/doc/.vale/gitlab/BadPlurals.yml
+++ b/doc/.vale/gitlab/BadPlurals.yml
@@ -1,5 +1,5 @@
 ---
-# Suggestion: gitlab.BadPlurals
+# Warning: gitlab.BadPlurals
 #
 # Don't write plural words with the '(s)' construction. "HTTP(S)" is acceptable.
 #
diff --git a/doc/.vale/gitlab/EOLWhitespace.yml b/doc/.vale/gitlab/EOLWhitespace.yml
index 483db0cafe6..e160b706014 100644
--- a/doc/.vale/gitlab/EOLWhitespace.yml
+++ b/doc/.vale/gitlab/EOLWhitespace.yml
@@ -1,5 +1,5 @@
 ---
-# Error: gitlab.EOLWhitespace
+# Warning: gitlab.EOLWhitespace
 #
 # Checks that there is no useless whitespace at the end of lines.
 #
diff --git a/doc/.vale/gitlab/FutureTense.yml b/doc/.vale/gitlab/FutureTense.yml
index fc414a9c0fd..64e79612fff 100644
--- a/doc/.vale/gitlab/FutureTense.yml
+++ b/doc/.vale/gitlab/FutureTense.yml
@@ -1,5 +1,5 @@
 ---
-# Suggestion: gitlab.FutureTense
+# Warning: gitlab.FutureTense
 #
 # Checks for use of future tense in sentences. Present tense is strongly preferred.
 #
diff --git a/doc/.vale/gitlab/HeadingContent.yml b/doc/.vale/gitlab/HeadingContent.yml
index a8dc596f2a2..c2dd2a5c6c2 100644
--- a/doc/.vale/gitlab/HeadingContent.yml
+++ b/doc/.vale/gitlab/HeadingContent.yml
@@ -1,5 +1,5 @@
 ---
-# Error: gitlab.HeadingContent
+# Warning: gitlab.HeadingContent
 #
 # Checks for generic, unhelpful subheadings.
 #
diff --git a/doc/.vale/gitlab/OutdatedVersions.yml b/doc/.vale/gitlab/OutdatedVersions.yml
index c78c045a1fd..f25de44ad17 100644
--- a/doc/.vale/gitlab/OutdatedVersions.yml
+++ b/doc/.vale/gitlab/OutdatedVersions.yml
@@ -1,5 +1,5 @@
 ---
-# Warning: gitlab.OutdatedVersions
+# Suggestion: gitlab.OutdatedVersions
 #
 # Checks for references to versions of GitLab that are no longer supported.
 #
diff --git a/doc/.vale/gitlab/Possessive.yml b/doc/.vale/gitlab/Possessive.yml
index 158c689cac1..92ae66543a2 100644
--- a/doc/.vale/gitlab/Possessive.yml
+++ b/doc/.vale/gitlab/Possessive.yml
@@ -1,5 +1,5 @@
 ---
-# Warning: gitlab.Possessive
+# Error: gitlab.Possessive
 #
 # The word GitLab should not be used in the possessive form.
 #
diff --git a/doc/api/graphql/reference/index.md b/doc/api/graphql/reference/index.md
index 019546702b2..84f9191978f 100644
--- a/doc/api/graphql/reference/index.md
+++ b/doc/api/graphql/reference/index.md
@@ -1549,7 +1549,7 @@ Input type: `CreateIssueInput`
 
 WARNING:
 **Deprecated** in 14.0.
-Manual iteration management is deprecated. Only automatic iteration cadences will be supported in the future.
+Use iterationCreate.
 
 Input type: `CreateIterationInput`
 
@@ -1561,7 +1561,7 @@ Input type: `CreateIterationInput`
 | <a id="mutationcreateiterationdescription"></a>`description` | [`String`](#string) | Description of the iteration. |
 | <a id="mutationcreateiterationduedate"></a>`dueDate` | [`String`](#string) | End date of the iteration. |
 | <a id="mutationcreateiterationgrouppath"></a>`groupPath` | [`ID`](#id) | Full path of the group with which the resource is associated. |
-| <a id="mutationcreateiterationiterationscadenceid"></a>`iterationsCadenceId` **{warning-solid}** | [`IterationsCadenceID`](#iterationscadenceid) | **Deprecated:** `iterationCadenceId` is deprecated and will be removed in the future. This argument is ignored, because you can't create an iteration in a specific cadence. In the future only automatic iteration cadences will be allowed. Deprecated in 14.10. |
+| <a id="mutationcreateiterationiterationscadenceid"></a>`iterationsCadenceId` | [`IterationsCadenceID`](#iterationscadenceid) | Global ID of the iteration cadence to be assigned to the new iteration. |
 | <a id="mutationcreateiterationprojectpath"></a>`projectPath` | [`ID`](#id) | Full path of the project with which the resource is associated. |
 | <a id="mutationcreateiterationstartdate"></a>`startDate` | [`String`](#string) | Start date of the iteration. |
 | <a id="mutationcreateiterationtitle"></a>`title` | [`String`](#string) | Title of the iteration. |
@@ -3370,10 +3370,6 @@ Input type: `IterationCadenceUpdateInput`
 
 ### `Mutation.iterationCreate`
 
-WARNING:
-**Deprecated** in 14.10.
-Manual iteration management is deprecated. Only automatic iteration cadences will be supported in the future.
-
 Input type: `iterationCreateInput`
 
 #### Arguments
@@ -3384,7 +3380,7 @@ Input type: `iterationCreateInput`
 | <a id="mutationiterationcreatedescription"></a>`description` | [`String`](#string) | Description of the iteration. |
 | <a id="mutationiterationcreateduedate"></a>`dueDate` | [`String`](#string) | End date of the iteration. |
 | <a id="mutationiterationcreategrouppath"></a>`groupPath` | [`ID`](#id) | Full path of the group with which the resource is associated. |
-| <a id="mutationiterationcreateiterationscadenceid"></a>`iterationsCadenceId` **{warning-solid}** | [`IterationsCadenceID`](#iterationscadenceid) | **Deprecated:** `iterationCadenceId` is deprecated and will be removed in the future. This argument is ignored, because you can't create an iteration in a specific cadence. In the future only automatic iteration cadences will be allowed. Deprecated in 14.10. |
+| <a id="mutationiterationcreateiterationscadenceid"></a>`iterationsCadenceId` | [`IterationsCadenceID`](#iterationscadenceid) | Global ID of the iteration cadence to be assigned to the new iteration. |
 | <a id="mutationiterationcreateprojectpath"></a>`projectPath` | [`ID`](#id) | Full path of the project with which the resource is associated. |
 | <a id="mutationiterationcreatestartdate"></a>`startDate` | [`String`](#string) | Start date of the iteration. |
 | <a id="mutationiterationcreatetitle"></a>`title` | [`String`](#string) | Title of the iteration. |
@@ -3399,10 +3395,6 @@ Input type: `iterationCreateInput`
 
 ### `Mutation.iterationDelete`
 
-WARNING:
-**Deprecated** in 14.10.
-Manual iteration management is deprecated. Only automatic iteration cadences will be supported in the future.
-
 Input type: `IterationDeleteInput`
 
 #### Arguments
@@ -3510,6 +3502,7 @@ Input type: `JobRetryInput`
 | ---- | ---- | ----------- |
 | <a id="mutationjobretryclientmutationid"></a>`clientMutationId` | [`String`](#string) | A unique identifier for the client performing the mutation. |
 | <a id="mutationjobretryid"></a>`id` | [`CiBuildID!`](#cibuildid) | ID of the job to mutate. |
+| <a id="mutationjobretryvariables"></a>`variables` | [`[CiVariableInput!]`](#civariableinput) | Variables to use when retrying a manual job. |
 
 #### Fields
 
@@ -5218,11 +5211,11 @@ Input type: `UpdateIterationInput`
 | ---- | ---- | ----------- |
 | <a id="mutationupdateiterationclientmutationid"></a>`clientMutationId` | [`String`](#string) | A unique identifier for the client performing the mutation. |
 | <a id="mutationupdateiterationdescription"></a>`description` | [`String`](#string) | Description of the iteration. |
-| <a id="mutationupdateiterationduedate"></a>`dueDate` **{warning-solid}** | [`String`](#string) | **Deprecated:** Manual iteration updates are deprecated, only `description` updates will be allowed in the future. Deprecated in 14.10. |
+| <a id="mutationupdateiterationduedate"></a>`dueDate` | [`String`](#string) | End date of the iteration. |
 | <a id="mutationupdateiterationgrouppath"></a>`groupPath` | [`ID!`](#id) | Group of the iteration. |
 | <a id="mutationupdateiterationid"></a>`id` | [`ID!`](#id) | Global ID of the iteration. |
-| <a id="mutationupdateiterationstartdate"></a>`startDate` **{warning-solid}** | [`String`](#string) | **Deprecated:** Manual iteration updates are deprecated, only `description` updates will be allowed in the future. Deprecated in 14.10. |
-| <a id="mutationupdateiterationtitle"></a>`title` **{warning-solid}** | [`String`](#string) | **Deprecated:** Manual iteration updates are deprecated, only `description` updates will be allowed in the future. Deprecated in 14.10. |
+| <a id="mutationupdateiterationstartdate"></a>`startDate` | [`String`](#string) | Start date of the iteration. |
+| <a id="mutationupdateiterationtitle"></a>`title` | [`String`](#string) | Title of the iteration. |
 
 #### Fields
 
@@ -22103,6 +22096,17 @@ Field that are available while modifying the custom mapping attributes for an HT
 | <a id="boardissueinputweight"></a>`weight` | [`String`](#string) | Filter by weight. |
 | <a id="boardissueinputweightwildcardid"></a>`weightWildcardId` | [`WeightWildcardId`](#weightwildcardid) | Filter by weight ID wildcard. Incompatible with weight. |
 
+### `CiVariableInput`
+
+Attributes for defining a CI/CD variable.
+
+#### Arguments
+
+| Name | Type | Description |
+| ---- | ---- | ----------- |
+| <a id="civariableinputkey"></a>`key` | [`String!`](#string) | Name of the variable. |
+| <a id="civariableinputvalue"></a>`value` | [`String!`](#string) | Value of the variable. |
+
 ### `CommitAction`
 
 #### Arguments
diff --git a/doc/ci/cloud_services/aws/index.md b/doc/ci/cloud_services/aws/index.md
index dc8dfd95899..2e1abf83a11 100644
--- a/doc/ci/cloud_services/aws/index.md
+++ b/doc/ci/cloud_services/aws/index.md
@@ -62,16 +62,14 @@ After you configure the OIDC and role, the GitLab CI/CD job can retrieve a tempo
 assume role:
   script:
     - >
-      STS=($(aws sts assume-role-with-web-identity
+      export $(printf "AWS_ACCESS_KEY_ID=%s AWS_SECRET_ACCESS_KEY=%s AWS_SESSION_TOKEN=%s"
+      $(aws sts assume-role-with-web-identity
       --role-arn ${ROLE_ARN}
       --role-session-name "GitLabRunner-${CI_PROJECT_ID}-${CI_PIPELINE_ID}"
       --web-identity-token $CI_JOB_JWT_V2
       --duration-seconds 3600
       --query 'Credentials.[AccessKeyId,SecretAccessKey,SessionToken]'
       --output text))
-    - export AWS_ACCESS_KEY_ID="${STS[0]}"
-    - export AWS_SECRET_ACCESS_KEY="${STS[1]}"
-    - export AWS_SESSION_TOKEN="${STS[2]}"
     - aws sts get-caller-identity
 ```
 
diff --git a/doc/ci/runners/configure_runners.md b/doc/ci/runners/configure_runners.md
index b5d78f633bf..bd8cb6627e0 100644
--- a/doc/ci/runners/configure_runners.md
+++ b/doc/ci/runners/configure_runners.md
@@ -889,3 +889,23 @@ Filter entries where stale runners were removed:
   }
 }
 ```
+
+## Determine which runners need to be upgraded **(ULTIMATE)**
+
+> [Introduced](https://gitlab.com/gitlab-org/gitlab/-/issues/365078) in GitLab 15.3.
+
+The version of GitLab Runner used by your runners should be
+[kept up-to-date](https://docs.gitlab.com/runner/index.html#gitlab-runner-versions).
+
+To determine which runners need to be upgraded:
+
+1. View the list of runners:
+   - For a group, on the top bar, select **Menu > Groups** and on the left sidebar, select **CI/CD > Runners**.
+   - For the instance, select **Menu > Admin** and on the left sidebar, select **Runners**.
+
+1. Above the list of runners, view the status:
+   - **Outdated - recommended**: The runner does not have the latest `PATCH` version, which may make it vulnerable
+     to security or high severity bugs. Or, the runner is one or more `MAJOR` versions behind your GitLab instance, so some features may not be available or work properly.
+   - **Outdated - available**: Newer versions are available but upgrading is not critical.
+
+1. Filter the list by status to view which individual runners need to be upgraded.
diff --git a/doc/ci/runners/img/build_isolation.png b/doc/ci/runners/img/build_isolation.png
new file mode 100644
index 0000000000000000000000000000000000000000..a363ef4709b6a6fd0d51918c52516e944915ec27
GIT binary patch
literal 35301
zcmcG!V{j%;@GhE-ZQHhO+qT}=wzIL5jct2l+qUgw<K#_pf4A!Y@!WgPmormcQ$6!^
zS50+w)pS1-rK~800E-I?0s?{{BQ3590s?jq0s<-s4ffv-Jvxf~e+xK3L_q`uq%i>w
zXaez{{>xQWN))7S7XRWuG>Ediy2Q`V&;9+qt6tCJ<Kx%Y*MFFomzU?~XE(jx@9&?d
zr>FDt^Ucl8?d|RE?w*#`_K%N`ukUXl@SB8=7X*at^z`)h?#|O-$lrX-O0#5qa%6jZ
z2Lu&_A3ovk?&0|O`0VTq_ys&XJiNKN`2+%QZ*NadP97c}dVBl+{rmU+{?XR{_wDWd
z?(XjA=X-yDe|2^B_4V!Q>dM`q&rPpyeSQ7n;=<Y4xxc^v;NakIM+XQ9c4}%`Mn(n*
z2tiM8KL`wUR#sMVaq-yLn5&!H^78Wh{5(j!_R!GK#Kc5HLqmCaMP7dX?Ch+MkI&-b
zVpLRgLPDaowT-K8_vGYMb91w~xp_`bZed~J-rk<EiK(Zj=f=i{y-N4a&W^KYPia|M
za&mH4R~G;P@G=;wsi`qEG#olw^)~HyaB!%ss)~t?-P+pX;^GPj2vAc~4-O8Fi;s_t
zjI_12tF5aO7Z+z^WAilb)6~-b{`t0OND&qh2@ekk$#vA#)n#O4^7r>285!B$+L~Km
zk(QC6rKOdZm!F=VUSGVjk?&GcR$&+51Bp@Jy}#i9ZwLy5fFJ^-J9&9||NVQsdU*&5
z33&s46eca`>Kp1SC7(RrJbk=s%O(*L5=tnFE?n$UW!ZgxeBq>++`T<nh<1{blgr4d
z^tJB$Sq|FD^n`_liAl<zpFRS=znIwg)^CoH;&ehoL%H)^i<kPav9U}3EV$_OdiE7H
zZcca@_4e*Bf~A^Bl?7C-4$n=TrA)V=qN0*eF{9v7d;11d=dVx~dGb^Q8FKsu50i^@
z9fgO7SE!G6?#|O`jK98kX|LVVrfmBH{^ZPcf<r*W`Hmm$Jsch$h1!i6x2E3Tyaf%G
zTmJp?@8NCobTchIGjg<MXZ@yqXV!$b11nNFJ9aK+tbV-z=;irSt2PQV$3dks6atyZ
z&fdAPbUis_G9zO8?CjjWJtHJEVrzRREc|ysU`S9%m|sA!9B7LOb{Z&%k*Z7}8%T_}
zqVUgs&%NHGcO8)}2naEVjJSxp*XH%6g3_Tr9@IT&OY%LZ+kh^q1ihN6wW&7@y_Z6{
z@Gr0sQRoq4P;PkQEE)1S;lc6SUNp1}`n#EH$_KCp58J~tZ$x5dMe(r_f_$ou02bBh
z3m*E}AN@0Q7Wn^C>;KXK?iE0X<gpYHnR|$!E%$M3x-^_z^>JW=IA&%o+YzcZPa#Mu
z)YwX|=X!(~Yv3NvfGPJG)e?kqqB`EbJbX>HtA;I9HhxLAnv_>&L~484?#AI&m7B5P
zvSW%9c5|_F<a%_WDEPsud8%0u`UYsK`cY;#9!5m$$@Z|^v-i+9)o)h?{O0{`(aZ8e
zb$Yf83oPWh5&tz@j?dOChcB@!-O~W1@3BuRR^HBBF;4i;aeBl%<nD$wN8Z#~sKG;U
zX&5fgvdM7w=1&_`0ryFD(OxpunZ$>)kg&iGdCfo;tBMKd(z}(q7Y}s^HnmA$Q=T&R
zBaP`hM?}b<v(;VM1-!==ve=pEt@JymIDdmbGzoYp5-4AX*K<$yE%&sC8$F4mFMnLN
zPaEnW)f(BCz3zLfj<+=m#vLNZv^qH|Nkjq1I)h|^Kd2^q>_H0M@77N8Y`E4Xl1%N-
z>O&Jk@IXzW{skomhOpH;NcNa{9xtSf*z>kGi$jeU4lq=(4&unyR|AL+9Swn{Aebnh
zkB*Nzou?Vc%jAWkjn3afM`5A-UT6J#JKz3J%s>GDOXdp6#Edcf=02W|M?iNebe8+(
zLV7y%O$q=<Pxap>^q@oeLO$RbmZO1B=jdZG95itIG{*`n(aw!E=1d1XT)@>^+moVk
ztlV~aD)@Cg7`o^Dm-|6wB-HY?;HAu1^B1tH7f!!s&8Dr3VytSkeq%)qsYtH|3zkO(
z|GIIxNGiIBh^gIGupP1|kQduRoe2}G`$@%mw?rbvOydaVkITLRSfEnGh)Aic2w`}Q
zD&J@|T1S<L>gIc}g%A5~N~&akSB%P1e*!%u1%QM*aQEuD6u5g4?CVOkE4@Zmg#{X@
z4ozq}+%gDYp8O`Zq!_CCijbPN^n6;9J6k2D)7WM~_v(6A)0_-IJ<kB!%ZJ?U!1*B7
zK-IOweM6c+O6DpQiAm8tOCtv>&&wBpPS+7nTo_XotjxNNLYnH|;#^HN!1Sz;<PxH-
zh|4;lU5reG;wWjwd3q4l{b-<%#M@9SPuWT$cRYSDp_HK4!iv<9r#ab2>a)_hp)yuO
z+U*!j5u{SEP^3KDF~H(ketdX1nYd2}1{f<Z%&MHh8U#dTZ_KlFB(yypcjV0^@Ac)y
z%KVcH;mk6l+Pl4*{Va5EouX`mrP;78RSB00ZqI0{wCu}}b3lGEb@$Ox+=SUAEB*K)
z`gUW8g25==NM6F2g3JE&4(D3z+VJT6S!zEjP}xuOlDqw6MU0ID*Q>Q;sxt!wmt#?2
zLF7H22*HT9DW9d|xK*qQ{1wZFs7pazpc9<jVb?>Du_d3+iWD^bEVgh{<8$R;^`qIf
z=J@QWIDJLvNsE~<oHOi6TdUK=qT>Gxc8BlPmqLjONSSI1$nR!^?cJInc=z{{>SVp#
zLH7<6z)v~z7Gy*4tMu?RaPydWIDRqZCpof|dX2_Ms=u2^k2l16v+SRjjpVcpE~j^Y
zFQa`o@Q%l*I#6ug^ng&PX(i=)+|Ymgo6auj+w-B=yTM;-1lPTD$N;1U9J!bk_*8Vw
z;_lR_o>Q>!6Kc{L8XXi{ucm7-JVy9#%b+<{wwR&-Gf<W42`uYVa0@6xZPEQUJ`|b<
zx5z59KNK4%u(+DPLgso5CL_KgqDi4znjxZ{Sf~190w`>jDDk4lI`QSef}!s4-#{X)
zAF+<HLeKtmucM{%{bOZJN21&V`n}kwGK+T)eKLIv53t_@j?apkqoaLSas{O#KWdLY
zr+iee<s&T49x*m3U(7xn=-MSDRC8n578Mh~a~_`s4>LVzC-tH$A`Wx<_IFSTCtGz<
zxyDZnvT2SuaEy3{TxTnkb~lcZLK*TK2;ho`ScN9n;InSrriht4bAP+P+}pc{j1d5b
z%BV;`K5tjj33CsP;JbgLq(|$o=y^Mq*P3mA`At|VdbO|k#^K2@Q-WEEM=Ij4p9ULY
zdToCc=B}~CD;UuZG6{vuK)WJ#1NLS9{UwwO>><mhcpRX=M`HyB>0F+VEcFsiZ76$4
z$4h1E?7tF${Vd5+4IbZ{9picH5US%I@n!1#7swser*?9vjLX>jTuUEy{^=515jBn+
z+zYu0MeYiWK=!8!`-(H!s_iBv`YZ?$g+5F#_mlENk@8EC;)ZZgrU&%VFq>!lls+RO
zdus^47k|*wcZ#jQN6PSR*{}c|f!3kSHBckk$gU){p5+<}c2hN!SNV{FLV4M-e$!6B
zT6~&Jh$*14F!NM=?T&h@c{9wnp>!8853zkH2kZ{_ZQ|OtW6NZ9oM?s)7``WIvcUIG
zSc{knD<dN?VM4Fn3n;gL_eI~hLRoK??=Z2|$2j+cn=<yc*+0haAx4KUQ_v5WO#kWk
zEqOz&ts1Xy-Dd=I_sK~&vyI71>*}nPyx96Wbm1^)T4D&-U9|<9rLzC((z+-{PmfCz
zve@Oq+pXu+3d+~@7>MVG>jkHkVZik)K=||6za-OFefIkPG1iJ=p!za&bNRd7Y)iJh
zDfpqNn+XcOyvmyjyt(TBIbOZ#K(v4=3mcmMjR*#~^Y-|@BEmat7SkU%%Yu%HlS1Wd
z(t->;JHC1ijF-GM0uzG4hDi}M%z*l_xC;naI=$l#GBb$<CmDg76&WzLGsV!0hJhw}
z>j(=o(ttiC5ly7c3}S~!23&G}u-hpSm0WszRG?dDSVdN5Y?DfCTB|DY$!}UD{S_D^
z@Yoe%77GBODY+_PSNRN(Nz+H~^_Y3hox|GNbDV=8oAdP8?GD&t-$C_~e0lqKP=@)Y
z>+GnYAyzxBNz#R;q3&LrhA^Jj)0+44qOg*&dI12Pw0=;2Q0fCHr0DKr)Cc(1+pU83
zRcm^lwf3j5*V4VU6!!8oZOUV8p_qt<XM8m}ygeB|sDb9!yk%8YS?Y-}nKgl@rYxJ3
ziW`CFIlI|Do6@GZ8p2;lf#z4N(f{Z3CSL%k8Qec4fONrS12fkov3yZ7Me?OHRd|#U
zkMLQFHuRukN{2jI_c2Bb{OnF^(}JI~nedFbo6^&ZvYVe#>al9KA-ym-p?3FLboWwC
zbKoT~GNQ@UFrq}2D<`{x__|h^uRoz6Tn2T-xVb33(QFlyhvz5LA=I<BZ2XhYa)L{e
z{UWO$h1mkzXF=-jH;u)3AFHejL;Y#Hix-Sl^8ROPm?wiZ4dVq3^lnB9?ZT}S??M*7
z**Kno$h=Cfrh0J~)x9K*uEsZ2y+?eJE8;2GE+EO3zit^o4o*loEx~7T?^dZvP!H<(
zHfw*;(z=~JG&g%GvvnlQO;W#IaUa@GB`buz`}geh@Z_fMIlX_0w=H{P-O){92hBoj
zuDMh@A$LZdei^j=s#Rsj&MdbWT4^%l^sL(zeXm+W;3euNYBw}YfxXM$0&B&(?Z{^#
z$+q3TZRI>G0}U?fOG?qybF`6IGCFgh*|Q{x08-H4c0G4cwxM-8U{Hcjs|Y)B1me+B
zUb}(eCARyjAgg&RwKz<e*8_`U^ly%}S1lLQri5r_-O`FRP2B+mn0`y>CjxN8V&6Tq
zUuX$5FdzUJde`N7=7@Sdi8fSi)$p)-@7MnM<R_%FDMYlL&ev6O?}+Adwek?-V|n)G
zo7QO|t#oD8rddN+%O+6z=T4V&11%wdGL@DJK>B=&x>b#lcCxPeV$H$e&3f{*?L)np
z$)8|3fM?@tDwjq@IH{}6aLU(MDsQ&MqZK2$Vt#ErhlL_n=+mz{F7enXvLD%g0#34l
z=zjXu5s_>zbkLT=;<7&L&4si%g99Kg9`)VncFatiiX7lhQpY9yITA0{z?P>WuDoLD
zQI;)1-8KI<*Q0dOLnMsI8c^;)1QH>P88Y10|J;A{4BX4M>g0A{0q*vCxcHf-uJ*7w
zlS>hXx+GM5mHGw&2=%t6AIHz{519uB0-U98C{vY9GE<;xs$4It?q%*2E0b-}CQS8r
z;CPvqS5B=B!lh!7<ue|ZcQX3&nuu%zn!Yo0@;HlUh_9D%rWBGXqh99~20|Np&yU|L
zHpQy-<u5Lby0SU97Id{904KfpwydzLNCSqg%yd+{m5kHKBR_`^AWrUUOHWO)j9y*q
z+H{#>n>j7PG9uFwA_g|2>Z?X)OrCnNs`WBh#@>PVk`w<zZA;V4kkfWBl;eKz?-EW>
zt!5#GLMn#rTGKcCMuQ#d(@(Uu>)_Rt-15q>VeRFL4{gnADNf3!d>6JB<O)mD7LH1E
zE)Tzf^%fe}(V0-ipD3>6sBkn20-0gk_xa6%X;1~ZtF8CM4=YJI&LsZv$ie1ji$2BQ
z%l~Allgi2zjy7h(X$M@|^DQ}ZwU>0)mjiTamn{LUH$k~;0qu5`h05NVWlTi11e&fJ
z*=n={twBcE@lBPLN^kSLTC>fS_V<jQ+^JeSh!LkPp{s~Y4$C?>x2;b44c;xel@4no
zOx+7n-r|lt`Y=@n-hY{TFcMY={SP5zy7OKKWaxS7fnRznCs`SgubJ3Mf9Rgcqf2m7
zmWC54p$5*qA{*ud%cckZ@n)^bl_pOseA!e{?3)VW+H<^&&6cbjyFrI0vS=2Ib&lgr
z;6cbRF=A&1#G#vu=H$UkIx@{The~<N&{1$hrfjxCibuO6n+946HTO>__IPRh%}jE9
zK<v=U@|;jSJX$(|bi{z7=-4Y-ns}k=TF`~bi27!<mOR$ZGZ$Yaan@opx<~@p!jxar
zYTGR`-{t(CV7qU43ypBplB%ZrS`d^C_#ov@!OidHVTs^pTU^(c>2)wUK3RZAr9VLb
zy&(6*|K3OVygY;_1ZgPbgEub|Yrr5J9Qnzysq-nrPGu+#pxId;RDXJo#?s0rbNo8T
zRep*ySQyIPUGE0!d`N~l*rpQNzI?d*umisaMjA$qzB@Waf0AITpT<XrL%)pyW^l&P
z#e7HN#{`7B-_N@@!WS`JO~cqc>2Jb;r5${~3pg+H8@MzR;5_a@&>Ty9`{TVEYmVcf
zFXMnasrp&RasTCr(E?(OHmG0QIGg4-B%P~P#=O<P&>kI@oXE(ZTEhSDLVDli<8iL9
z+g9j+9*iHlZ}scKk?C%=&*&TN3};`Yz+I>h_<-ekH5Pcl55}Je`?F*e;5zpGum%G+
z{;MA_grMch`hE85X}<sp@(Or;a59ly`046u;{*FoZ8q;g?AB<?{<SYhi9p9shWl$D
zP7<dw>4!RM5a!q0AX!2`81X$wP(K(5C=v)XKgj=D`QM%Yzn1@h_W$D<njaJ?sDE$J
z?IM&?qLw5Y*V_J?$p~o)nRoMNDP^<^BRs@y4<oOW`TM}RZNwXj>h=111&Vszm-Ut7
z#XCC7En+^ZJg-78z`RCkKmdH#`f6sw&SQh+o8^2auL3t^=U^M(^Ii2KX*21`$Y5hp
zu8q#}?3l;|=E<aZ*ShVQFPXeyDTcrFxk74909Md<pT>i8$qJt!mvhR%o0+-`I~%71
z=R`~6)$cw#BBKYtrk2ZNd3WtaN2R9E&&!A1N!1fi3bIx!o07Bx-xIs<c060WxxC1|
zq<C7Fkp_NtK5&C4dv$q*0fg)qSY_vH$&qXi?hbBM@F*>>a<R7kO0<y%On|b8ZHoq4
z*l!hP6nt@LyK{3Sz6-mdcZM$kE}OaCvmD=70{y>++&XjAz2=9PKD({E!z=lP9}8Dz
zy}}hA&r*_K0c&Fd1rI;^UenTHBU%=%sHq1P!Uci}fcERhx5OBAhL&EViW|Klhk>I9
zhArSu&uthL<DQoya$ir?piS1U)L^r3XE3gR9+QzrhM*p|tJzo0<73y^VbbR)te%CM
zkD~5^SP)|2BBP&f!%L$nrp-55@e5p6j6Zv;p2(3IG?B`(d`HezgAGNHEfl?dzC;Zm
z6^^SF_4rG8;hVp!?ga=O-mrA1<`2;Hvx~2ym)hf)VqrkNJ40M7#h}aKh0Eci-nN+2
zd<Sky8h>C4I#Id0F-j?guXtIn`G{vf`(Y8GlPTh(pFnr3L5iaV<f||)eh@lY!9ibe
zx88J;kKw>jd{Ylr14A=AYUI=Of!&SJNrKBLI8U>RJ2A3A;_f8aT?<w&6ah^y28_MW
zvMUs!>*pDGiH<u~w^{#SJcQ|?0=WcAtkh=8-=I6=xUsxg0UYvsFU_;ln$Q+1*Yr5E
z^9g7vC>=eS3WSnRYGk&L*L3{Bx;r!Bf$R^PyP?gNs1gPn+iD9A;3o+r-RJD2<#C0Z
z=F>QB=FbK48UCznD8Y(^VV>Gn@n@&GaV260o^yGP!oTzNTG}4F&-ccg`0JQQKb74%
zw#VPCin!G!JRbFl-I##g7SDy|jkO;P;}hkZ>gimi(NR|K;i|r+u(|s9J8%hXmA4T`
znk$xv{(~?m;I8N=CaK^D32Fz$QKF4)J0;M~M%Ot$^8tD_D>DjhSKDw2W0+N}&vP2z
z8X1GOfE-_iH_Qm^6bh40ud52N^4k9B+<8}DF)A~qoM8l2!;1UI{Yn&9@9ax{i5e^*
z^P{>dp8zYjrFTc}Uc>cpC)O@uO%>jc@hsdzkn8i-{xF84iy4>t+Y$6!)u5*FiObH=
zTWQZdMWrPx*ZYHr*N`}JpV1zcWRXL7A2+lT=di*uiga9uQ&H<l9vD^QZb`haQOOH~
z$@~{i026;SH*S?KPe&$VvEfzI<SKq`H|-v?d}*;C!*!TZzJyonzkr8{zS4R$jy65w
z6oV6%_|UPj%6r$oJ_fj*)Z%)WJ8o#BA7sO=go)_!a)b*1!KhA5LigwF`a$F5fGz6G
ztI|o$p-ST>MIU?(>uI3a9?YB6!BW=!9h?P6j3R0FTKq(=meoy8Z(gH)3?=YyBEds$
z^&B?ZVWdbI>6~vodb@%ew3i?LL3XX?r8lETMn=oi;eBD55KNzkxH#h*jtGOA;ojiU
zRVI0z>`Gii6^49fWdTQRnr-!6H|@zMA$XV&^qlze40+;NxMJn<!JA(<_wKHRL0t^1
z5W{U)0t1$8*}jM!LX=$YaMkv!mqZqCVWCj+eNlGH2BRZ*9ZGrWdk0Dvu=yU4b?<-_
z(i+i;^{sGN-LcTGB-O;}=s16%UD(18{R07Z@CxuUeJ_b;2xjS<jCC>EdT)?H`{oI@
z#v6#dUuz6kT?(V(IH0O~#T8;YebWJ@7fip$tmV#}3ek-M3}4jl5MKQbw7w{<K%nxi
zDtS!Lvz8rl;Z(80FngtX-qLmvZMK0$Qa6%&W>P-jI3SP=<solw-fHGDS*J5!yPZgT
zUeYeCM+SaG&G5Z4^l**M<r0QgPR#94<7_}XzH2anU=mfAGGW0^Oln^ZF#@(U#=YIC
z9ywBYo{nhzRWL8qSv8iv#Q1!(_QKG1&DjrY>cvhp{RNKRqpoTg5Y+tri9}w7x|4=P
z0JQvPku*>%f9gf$9O-ehln3~`e0pVf5jONgHqsK8@Z5c|Vl-qY4{<qKfQN}!`e^eD
zL{eT73<!{BnJ2x5P(@5t*YyY(FJrbHwUj`gHq;0=_tq89@G)j1);R^N1T%-Faa~P2
zj%7QzM>-^qqcG>8m@8oGc5}D?M25M9w{=$R%b=&oEdMIEi5u?p<7CTL+J?qus*V+o
zg!aGfd7(d!XFa~lD@Zckx@LaFK<6+lBZ@q%w0CNm%|jkT^m3eAJbP9yBToi_y<QIG
z#@PEwkIf;+4~%d3%|+CIPtm7d;kleg5dmJbw9%?Qf4NXa`o@`(I|Jgn(E^^c$!((4
zZT~={lho&N>S-k1t#W!A5+v}X=SN;iS{7QMA2hr{sAyDix#Nr7M-3}Yl@kL|!lYEz
zK1g=v|Fk&Jpp&d3ah)u)ru7z8h|UcrPDG{;g(o-4l>VE*xgL==c&UZfIq&%FYN5<P
zN|PQTX!nJ7Y*6i$;bVfQcFDWupog!!O5c^jRMjOcrK+`s+)(Jvt&2%>Y57Cp^s4<=
z?%4sCf$5<51t&b0oGQ&_)0))d=utwZD1*~WIuQM!)lRS>`*B(D0A0cu+XY*HTOpLl
z63e*@;YWLwsxQ!e+M;<=aL}w=dT7k994<0rT({}^A2gr&Y(RdA9V5JZ$D?S8lJd(C
z_qCK{$Mv$H*NczKaJ9*wB%!SPpX807S(~>XMIo|apfm9|z>k={ZyZ;vVJdAVaHd-9
zz2EP2JXNbp5&ZBq5S0+*+jbz(*@k{j_imj@5mcT`jLVD)nID<(E!z$Z5M{CV5(Dc{
zvWf}7d=(CcItcDlvHi*a4B$o%{*T5C`X3qmkIei(6lf$6kpDv==Kl{!%>N(n^S>5g
zia(u~J)YbViqbmq#(sN2Gy2s<<)UosSHEMn$=Q5n=dG$LKrY=L+ia0Rj5<uf?lsxu
zb$-e4FnbK@%s6EmQ?z@6gu;5f(xhOb6beOEcD!(YqV{Kie<M9*QpQ6yb^YHH-$pb;
z&EDr%@7=5a-HDvvf1S`bRHMTWaHbY8=-%@Vr%|I{_ktdmOCV3(;NL<mjKN9{kcvAH
zIiGO6Yjqe$t}MTL&;EkYJ6%E`2aI@z!L5Pi6d*Bv$b9v~=-(FhhtGKp?C9=6^g#a*
zO}2TT7vDI_+y|*uRv2%<NQ`S2im%kWhleSXEF;oKrLK>*x-2xnXp|@q44;#$rh)Zg
z48TDiv0_L_sFXB>75$E#!UgEZoc|L0t&CN0PrNKTF(lK6$qFY7utCB~;<a-zDXOv$
zD#YSvW5-81DG_%gF(Va(4^G5E;SNcOm*#d_(TpWAM_X_n3{!?G55wSKUyzYiXRF(8
zgzcZF_ApP<fu%zs%|Vtm$Ic~>T==gi8u%9i$*xU$84@R@7KOiKP8iBAhLD-n%x7gb
zkA!?`*<*x|Fl>`qBx71r9bm3m*A2$19!@cmzK)|vW->HkUgXHYj%_n=h2H$cME;g^
z4{@v@QjA*Ntrf*^MrsaciH&l(AI8dy(pX_oct{pfW}I}613na^Mry;xtKwh<F}KY>
zqCM5$z=&#|Ajhl*)Oc@T6eTM}<PL$KL=UuJs4}*SrpL7ckHDj}vPLc2?%(>DL+duK
zK-C;dOEIBSG}u=O8(+kDXO2J~9fmbo`F8}KWc{1<q%LA2MA2eIIt;0t?L5^)t`2t)
z8P<@wqS%R&=;d-muk8@|NcKsQKm|!aH18OK^oVZ57u7Bu6M`L|`Js%FvXaFw1Ynm=
zVL2#@){W!-inO&QKX}oUJ#Uc-o}aqYi9s9I9d9tt;pth^+PbZvRr@lQ)UuC(#GdX%
z<~M%L?<gs3+nk1~2UYIR$l4(9ZZZzegiTH%p<?xqF(28gO8Zau*x}ZLn~Z5%yPi)H
zaXF|~cR@-j>WP?Ue&Wc1ssm6Da_MnGltrRAicxWXS+?dA29xU7x~eRjSeZvVn*1ni
z%AB6t<cP%<?}qL^*&;fQmDUeV2oyO@$oyaCHh#4ZQBI1+%eqQ&nb}iV78T*0Dog5#
zAUvjY6ark%{4C~FZ4xXcTJct$v@x{}QN~is?ivV&m4RPGgTHdft2M{}6_rxp<d&Js
zs!LKWM4iD(*pYWys}-1;CsKLllXz(i60<w3ERULQY_KH7v;?p={lPvOF^%#VJCh!Z
z#<V+8rGN>Wnj4~K7>TCH1c7U9&*Wyopqr(<VN6q)+_q`hx<g+|yfGyf;L(dMMd!;3
zVsJ%*w(K8K0^&0n%MefwzzGik+{;~8WbI3DM`b(O)Cm&HmdP7MHSOvnxHQAdbZJYR
zm+1yz5SNJMx(nz4FLzELD3`Zd;}?VKTLzxxbJVn@ccW2jlS9x+U>2<N4O@M$!*`fA
zCya`4#b7JXR;69m9l6t8Zn935qKq*7MhPH#0VZDHj>-}@&eg6{#d6QB&ujI#^d2v(
z?U!=JQ(%b+5IG8R#0PlkVwR6b9jQAPgoQGx#8S_^8ZCrj`>a*nd?M%l640{<&`ApR
zRmfB*dkGPKgNZKI6Sj(P71-x6_zERKcO#X$yIwyYV<Q(Uvs*WDF7DpS@*vUFBOx`P
zNU9>{)}^BV!HE}3f@+n8AdvpMvL78YSCjsR*U!-9p`T!1N9NodQ!miua|iX>R}@mQ
zQ=Aomj*_01vXPwe_YHc)Ls=d(=n{w<CWr_kN{C&On*KbjQ<`rvT60Z9h@%Z}2hM<9
zw0#tMDp_?>`+OuB(2Jnf>)hR|Q5O#{Zh2g+$|*VbkDQTJXAQ1(PiL6KSR33?ZS0)K
zu)U$F?bWsS;os2KPH5=P7ZMZJqfnq5R#hJy`Mz5e-zPnB7!D8LNMRezkv+b?;;FbF
zrl{i!rXF-{JF>2YBetj&@zb5ke`Wsv`~`3rYmRq+S;Y=5OHC`f5uM)j!pBa5&_MNt
zdP>V2%AGmAd=MP6{<_(HunBlPIgqzNHV(njjZJw})Fdx4?QT8*@fN|nF+t%Us9IUd
zUPZ#Ku_SOvwZ*_}{kJeMdkDPzOtTS^!)AAO#?0}2!4jRCDC2F7X)V`|fmH8WuLVL7
z7Ga9kD<S(d-jcQ$5Q20?$ExBMyE=s=t^s25Sd&O-MJObRX*z}W7?^t2r?~JwZJ#;i
zTR*bDB-#32O)G!CNTxg*NyqZ#s7lP`IBk$b<T21psKJ@eqmP=$r^9DzxK2HH`{<aw
z*3u{Opz2SxkS@PUTtkjc3%aV^K5DE!1!BqJTuL6#`(dmc#*mZ!Q_eb2*qf)2Hv_aD
zkwX|oh32>rufC|7_R-0&;Qw^L{-(p!SeDTrhB<#jXc&Y3cciYz=WzPk{vYi}Dct(8
z8qoW0QoZ=v%p*-#X7Bb(G5wERuwufWfyDyCzK)#zU|N+x-MZB^ylh|F6N}f5Gwl{_
z)j-!ANBp{{ndZ(kn%W#*u(au~i`BTZBhRrSgB{mq>rIl}QtE-}V(`V7c~O7Q#tCFx
zixLMi_OrpZFV;O{#)`cN!-?4tG#;GhqgRLREc`i?<AJaex9zDMALU2tT+`XTeyz6n
z?6~K+N$E%#1|1E~RlJ#_;(#t6!#}c9QFZf$$$8!GN4sxcFm4HCl9_7%YLL?)TVwi4
z_9blIA~2`upyE!i;vl>p)p{6u)~)Lt);`kym`KtZJN6GsJuM13{#;!&L!qJVow*I`
z`IK?g(5CXrE1tt5NZv=E<4K5|leVxmHvlKjFHX-FSLv_{zZFXoQIx6)lTe6L5(tI7
zUY-Kc5**3d_))os(^*+Hk@*OT#Y%){>Ba5jNqaH$xIgBBuOc&CMWHMIJ}h1DDmM2}
z9T&G#xw^yBlYn10Q9}Hm4u?d0v1r5DKFh5_9=xN4h>7a#5yJN<LxsHxFxne7(|vh5
z|G2oET3lM#`Z^nt=ZBA*ej?#+R977WVdAxaI=*&N#`cty0>54(k*L1Qq+FLg^=f_j
z%UXz_bWjmTtK#2LbPaX&fY$Y%<U;NGJU-88V${Tx?Pm!Y4t}YoRZAiLC?6}sOMD5p
zN<trxxm2Fty37}~)-(1;GHvE=|3dS~gXiPr-=&^b(h?ruZ(QyoEL;8l<nJNafL{+j
z;ruKksBXmLnWs~I&4fmxy_T0d{=9Ca5d9R1AHLqTb^;seIk!|<E7{;fpt6cTURwY!
zXIg9N4lkl^&22rK+qHp%BB;fyI2w|1Gg;CTE`$)Ir6sqvolH0Cxh<&=n6|(xqMtVn
zlPdPKJYaa2>!%Fa9@rZ)wD~WF$9*<*NJwPOoUj8_Z{d@o?d9Jg$uhxKp{nBccsr_?
zs9-W=XXJ5Nl0?jZdf8cY{pY=+l(yI#{T~Lfv&*bGvs*q_fA-<03)qT%lVy0Qwoa08
zEKgr^@6LSlMF=LR|AMWic6ykSqmsy?5{E_pL2!D|kJlggyWItKhqZUTds=XsAz15p
zmv-SX>5}F;ziDP#45ExH@k}9t-x$6@1o{q3@F}g4qrMvInc2#;bb%Q;q+M{O$bR#T
zAvV=i_4G~~S!1}H%2~8da$J<|VHx~wSMH*+o6`re@QJm>2WVk8B!!J}D2pL3ftIFF
z#_p1Bdl=T8+m4wF=tR;&8tZ5XkQY0139LsN8cZtMTFS6S_@jnoJ2;#RZ!#*JC;GwV
z|ARocZz2w{MDegRI$?66cCqSQkyhJtQ$Cix40=`2Bj@ZY6|k^dx!+|kDLBzSjfSq~
zST2kU-EzN9<FY71NmMXzJ%_+|HJ0*v`q9(2fvw^_l2hUk6dhr1z`Qt^i2V0q%;cox
zX~|xzLuc33U!ZIgG_SC|{iG~>X;RE1_N<{pMOD<VxLr$*FYb1`95D+)7G?_5uiquj
zbMzxUl-5PAYc9PllC`+%azwZRjSL{=j)2pPLaUOQuHs6Q-x)9HxSh3c=eO&e>!31H
z<ebp)&UFm#5|g4?YJ8m+x(!MCZVhJ7RX0-3iACn)fy8*E6W1&#zmj(?FXelwiPLKN
z5fKT+AI4s)sIJH40d(9ed;0lh$Rrv*9lg^&QXJY9+ttz}`e)=TcSNp=1!S!3cEXXG
z07NO)vz?|Jf<r#QguTbZ2n-1(<|`aP$bhGm@OewQxO3s>(YIDeMrxQ?J~HY87FCGt
zOlut!3nq*ZZPWXc&&|z6-lF+E@_b5mv^jt=h+=p9bJ|(raYW)yi_y`cEYj#pTyJl9
zZ(0(@eww5udKs`;c2RjY7f1jTtqma#S}7)8@Qb#FEwdmtM;?SkAz>!<_or<?*v)83
z2)zfj1j0Et3<`R%LrFwrhTQbIRk#zD+#TZDD_2EfQ9B>_UW-vtq#A+!$HE4-ylf%E
zQ@=chwC|ey!N8H!1NQW6;CVLuvHyvLD9=_wB0Acv7c*P77mLW@T_RdnFzA!xW;6hz
zyD1!pz3zrkL(rZD#PA)M1g+x?^>QXi@d_#cM>56m4X4({^ZQFCR;*<jM2sKMdmHqd
zvJ);mJTX3w(pJNi#u+>cxZA|#Btde=Pn5$s5}9?y133zDS?l%I6?{gg0V`S2+0xbg
z9c7rA4Yi6m`4|?q+tKS+w#-woeqM2KDoQeJkNImga3jSXZ-YOh=oeAjm|C83Apfl;
zMuSa5NmJgd{0qcf{UKPe*iNQmY+}FMu_=a5{33f%Ck=WOw!&Nfl<yY1K_x?Ti<0`8
zR(wJmQ>9JBCaMSaUzOH<Gfk>|GhCaK#J$K!qbi!N7ARJ-l)OeO&b1l~h;C|`GGc!A
zKTXe0b%;?fEgrFm<}&*{3JT_TBIQ;p-*5eNCHOGXOWUPAle1?CouNjbZ&O{Lwyjnk
zeNEriH@X`GQ6W3mZCM1=;ODuJ;6j+mN;c$0MG5uz0n5|Bh`p6u=?mh^>-hOA5ZtJM
z&8{SxgocqO=6BlMe=;8oqym+9F%38o;>M)IGw`^Nty5iQU%~1VUCEzzU99U}hUpFJ
z2>jNoWuUcr>uU0q54EXJU%5VOW<oJx3Q|r|ys#%6=}Z%i8|1*W^Y{Bhomd??&O&u)
z?}_*28OBn1&Bl%rW8>~raZkbqz|?yv=iZ;IsS_g!QaXa2NlV5M6j8~7vBu32KzhU9
zJA>Xsg$y#L8E-FdGn#8R-{pK`%AwTvZ_2Dt)=EHB8N`k;{tjv2M$6{OGn@{TdC|dJ
zsg(1cdTd$uyY8?p2|}##WW~X1L&UnU;8e?j5_|*Q#Zchai!*QEaw6GNXu(7=aky1S
z5|H>^5XIc~wH}6J()EAsZ+;<RtbM9J_XG%g?>w7?!UBt*s^6L))<h_br`_M~KlP>~
zm<xFXqMWXkvN%xXtc-1Jyjiom5HBF&1KM4E!U*nfP-6XrH5_N$Z0Z7G-6fVP^(XV|
zvD|ZDo9Krc*+IO9MFSZ<2-kTHfK4Bd{05>}X+ucWt@owf0e_`vq(mBT#f|Ei0kAsc
zKCj~ff=I%?U1Q+sEqzh<_uGE#hS+n@SXTX^f5sR>z3y|z+L-b7QJ`ewAvoR3I;o==
z{xvYA$-b8_Y|40Tmjr8LDN)&4gWRj0YBP8NSKKA*?L_4OQd>%%wh33W`Q2ZgN{{!=
z#r}UOOS3q1J3RS=sxA60UCyVE2>*nF&HXCrsl09uo?zb@qKZlKfF5KOBe)J4BQ+N<
za#wmSMjzn2u6N>b-y;E&BPXtE=bK9k1i5!%Odxcv?RD-kqFC*N5m`Cim>g)IysJ|K
zeXHe)DaS*9kOy`$|EnU)i1UQO2g~GV90ERCh1n_`i!&20!l``5T(>ZAJ>T8h?vosJ
z-1ASOdi55^shj)PEGfLxK+6rSAeHYDV~b0h?>F@R>W_pVHV{4Gs*9l*Jhd0~tbQb?
zgCcT*F-Wz^Zoi+YM&Hkd!Yl*6Ocd5gRmEal|0S}!z(;aU*=Zidz2_CPnOtVcrS6tr
z3OXxp03Qo@8wd+QxUXpb22b*uUJ|!oE5y{7UGGSzzoh_sHsQ-``PDxqF)j7zfrR84
zrGw~%wh4abyff(i^L3$v;8oC>2?^XD9B*MTxbHe>I~Q%d<h302_qz(w(t$9nZ|wC-
zYU?5N76l_bgxjJ3O>>`Jo~$bTwbI2Cw7R_^o2dpGR@GLOBi%Q9^rmi(plbC_1>%UZ
zsQc$lVZgvk!{{tH?vn~oiovft;%x*}rE5RrS-&_$0eg!#EjfE`MvO7B>VWP3bnZ*q
z;=QW>RnIaVw+?oweaQpyb{WZW4+{8esBSM8UC`$+>C!o0?be3UZ{{b7tNT6k94{@-
zg{bHuhfGuW+B)suOIygqzJG+2zM>F(@GxAk+o=pDnEHI!KZc;OpPjgi1!Frr&-d!0
zGmZ|e#LUT_40tZfO(*540ijOD1{$4Wj*Rf$Gn^rS><-HF_cxE!k8w0Zr^o+ruY&|F
z-p;;k)n}Z{WML;D835S#vGTnACxBLMM&x&a?7xk+jV))#9R1ZH0xC3UZjF8;QpWhZ
z?N`(Fn)zDDf~#n<6(kM`pEh|pF{J@pd7YsqirA^GJ|BY5$m~HQc#rz~^lEt?7sGA8
z%xy2e+b6dsF9dmtlzrwvzP*bg$3k!6M{*@;@4>+D&jbJR<>#|+GQ=Y}gLeF$q}P_S
z=#NHD1Xm`7Lq~1|vT~nj{gxgs&>SFgJlCsB6DMJr=dv!bb}M|C+4=8jr!Q?6=V>Ok
z*y(JN#i{T(`e*(2gJ>II4ha}-gK6L9>X;oxPV3J+d(8Q73IOO6s8XpHHwBfz2!pe#
zA$Q9vV$HfpnuRMcK;``HgYS$%`!?E*W|{8xF(+$7ya?NoW$_=Bu=|k&aW8^QTwP?!
zi$Locz=)nk$zFxsywm+q%|H@_?R!S8m0UG+e1fy(9YuteI7yJ_6t<DIoklAm?#B`K
z6JoUb_ju@oZk+6Io)j+pTm#Q&xkU>OGw2E4FzmsI4z(LMjIj{jKDGK|=r^61V9DYR
zEFkYw9>y12`c(8a(h1$ERl<rKKMq_DpFERT%3d`==DvU3Z_STZKR(tLiy_zE2H=PV
zf&=~VnRuVa7JGitNAQv1-iuuQYrqb&kz2#`DpN)hkx3$7&idF2A{t_F>wI;7^?RKW
zdH?%Cu-__(=jDC+Zl+kIx0urZD80Y(a*oVhQvtaszi-m3+LdfqSLb_x>vhcM5u);T
z2TE86k`Ta{o1uu9U<jBq>d_->LFWqM63-!yO}7Nj5g-(1_g8N=@*CbT^Ii0ZCeE7U
z{ARGuHeUfn`m*CmB1+j(O3&Sh-a=la<DO3Z{_6)05xLObRk~>TE8z@jl?2txQo66i
z5roNpR*3$WQ67w6v5%iOVm|+g^jjc?SMwoNVJ&3}3hEtwy}R_@!%$+tQB%D-?LMXt
zpJXZ{;h|1^3Wv|)tg}Y6AM5-|z{vqc9yo+o$|^VL?8;%`1&yV&qX(k`ch&MH3?0eW
zYdX)|4fPrqve)8EAHqeu(&x7h;>F#yeY&h(_{`2?b&P%~TR6@l-XIAN_=AF4lspI&
zVd1ZOH61cEeq$+juB9O|yY$J^ocO4puEcNOjP2{&D(b-5ag2(;wK84RKz!~YEG3YK
z(#2c71{ERlfF9SJo)TZLa#Y}TzU=Ei=1+r$2wrQ#04s0owOdQg01U6T2|0QE!z{af
z7wWgvcD0Dx%yCf92<gp%8eEDSW6MRx&t7=o<$=Y9Xof_XTXnyvKarL-p<syb8{=Ft
z&%n5<G<cEc5c|x~9OAEii6MEUIiyRpmv0-X6Ps!ClqzH{wGMUJ0JlmGb}A;og+*Ek
zfe~@#uY16r!lpr`-F|M&AddqTe_lOE-`be;rbG_ued*5kZ!&Bj^Iu5-o21(Vvo~3`
zx%nV~5+wURhE{tJhZfpWaWIIpk&62${I$5u3UT6LZ*RsMUx$vctbm@wulpiAi;k5P
zSsg?M!`qNQ&u{ykk;ot5qyf4*w-*HxlNmZJwZ$aSaW3<kbQoS5cVOimp-c`wPt_#;
zP)zHZig!M7DDZHfzIAHV%!@dA4JdTN`^ac;I)*8{ep-0V^q$FIS#(59t4Mv8_4MHO
zTFEB)z4KEpaiL0X`s$bQ3~?>)b;I&@+L=neb-`L;q>xGIh^P6BK~l!S0VFvl2T1>F
zA-&RMq-#L>K_Vo~dQxA}$65(hIuQ3bD=8;k2skQ-<icVfmZcxKeZ`+pP6QqE@<YA8
zHyO7)<7LO5n)G>b&xKElwOdLJf2{O_CL;!y+59FGbj<y9_#}T328Y$HC*n&;#A$1*
z%xpj*K-P`Ek}B`W8J9P#5*Oy6vTptfulQ#pANGc0--F=pl_bts3ifjrIWu@bTj|w%
zJ=H7lmO`7ePK&<~#+7iEOY>|Hxam|jUS7UE;BmAhn;sAlhNmq(JY!?~G=Z?+NE^--
z4Jq1n@octPGO!eo>u{V6zu-Ya;;jiTeGqqE!#Ri-5oUWcq#3LnPFg+EzHxoU5)BWy
zajSNc#n@$!$j8nO;ndR279ofl_IEe-x~MF-U*xVB4(CEREQ97OcY7+a*6{&Hg%=uw
z|Dr7YsHw%JnuB#i@ptMRFA%!DaMoWUxoqLHKXKuxs%*TM97o?JhRX22<5Vt!IWld2
zx^%tmgag}oOBcW?2Fs7{!n-wHBEbN>1*>4SFbIP5U)|I9uxv9TMx-aF3)?(!f%sX#
z!j@b<SmR+Nr}|sV8fp-H$7(S#P)VlrTFKuv+E8Z?IJu=lUvvO$iiD}s_8|91L@~s;
zI}L%IT}n2DT0fh6Osa1Yg8tKa`12*LQ&9sWB_0EgN6}mUbT66Rj^3g=Yv?a<Iv?e{
zbzXiRCYPlI*<2orQ!aJmJyk&&u-*)QsBatV!jn@}kFeK4XQctj>wnpQLC^$f!q|}1
zVlbDs24WgH-kklO>(%vZH`=cAONyK?fA#NEV+f0fuX_Ws#lWpA3y}Y&%A?91y?}b%
z^iq+BY5gh7KjsSaJIL^^y)#l{UkIT5$88_mGff4Ry7IS<mq|$+lxTG{dz#ktg*B{#
zz7B}IpiBO&2n(}s%gP;8Z6a$+bnCb4(<5aUzQrfC$H++?aI#@-az!fj0FreZezBpg
znyqNb?PTLYap`xEtpwn{QGz$sTwWtT^ROWsE%A5y*o#~4pJPE`Q5?RBsvNCKM}z0&
z=ltbozIxjz?=pTu{v1C$Oc0i*qqxeMgqXCCX?3B4t3a?L58Up$&OYRQILW^`ZmS0{
zkzM&_Z^UreQ02~g?O_<)&#*U<sGny-eDk9do*$M_c53KXug*wlxQ<Gjo(4?sJ783f
z%f;G^rif{@1{WTJ)cc`zf9v!Kq*k?TO)d+>kZ>IkBw@O=fGz48#f*V~!m(_{c=SFK
zpvia}7sj;)&eK1Y-m$HSS_QVt5y{cNNe!4}<-)w9Y8yHd9p-dcb}Q4`*aw?i4qb!3
znD*D#+peg~58sZECP6s8>$lki0pR3A{&|a?v3-~gr8LQQNdv5$*`>APYV8uy2GLaP
zvjCSkGi=6Y^xZxgWX(IacvtAe2iu>$gGS2(zYck{sL^v@W}akCDtafr{YWld7^*C2
zid$=EIZ~=Z)ybIr=87YH1-Wz^lVz9FFA%B98nJp-1fby^5VG#aVL*OJuV2UT=q&vD
zeFb-Es7}kQ#|y2Y*B7;ae)`)h$>}Y()^<-<zem}0(XcPR#sqIeLb0BSbSX&Vv~bW@
z2j2Wz3bLr?TYi@^YZZ%{bcDf?Rdmz!r&NHG2HRV?-Cp9h?$$<*Jl9-);P4=nHF>Ji
zk4pKPlEmmk&bIprt}UCbbwzC<G~?lim5ZpOswixlWoM>juO@JM3MKmQy1@zHefHcb
zB(2*1eof*yQt}h29|b@uh!o29hrHt=tFCf1zj<XOh~m^_aM=!fj-CCUx~#ZUrS9xs
zDKa6`u#cs5)DbI-@saE*hg`P9A%gH&bQ^s<GA~2J$ey6VVJ$3!MC<8ri3?jGguCh9
zqrFDS5<j11vvK#euWxu}kus3^Ik@!+*j#O5PO7)-xhgSZ>TYwk1LOdd@Z~y2l-xx0
zl6zlTz3C;XZOjEQF>LVStjh6dEm^7^k_}cQw1WogR3R8*G%0>#*cISmYOcT*GA6?E
zeTRDH4wJYqaxEFB5^0Hoh9UdC=J@uy&i3pj-A_bcr!pwFu66lMHXt7+)2q9|5aWWr
zrYQ|K$S*~o<gwFVO!OGx6Pz@qa7uk?JEtf_>!di#)ea9%`L+}O1jsne$e1Q4`MRo^
zb$Z@t%V)cfug@#<CxmyNYZ3ajwq)oC(uTgjOzD)ir?n2Pyg<zs45fv?1T3Tk?)2#!
zc>-dShzx3mOU1Q3t%kkd`kBAII_|e-8r^t(Zw7`sG6B13tWmR4mt0OdQKzAa1Ysl#
z_2%%1FVSOqbT=p#gsHEz-|Z3hgc}dsw)#RqPq4zNwIAzvw^r>*#^vIb^+E09&FSss
z+WdNpr3*Q<dLzMcZ$TIdFpktJ8Yl=Bo;YEcy@98tNz2y1Y;=wGlfUW>{WfSc_iBNq
znAqojMinnUhn-MMUt`vGXsG9dIn(N*wH%v(vgYt?I3}t*;FkyI=k@9G_A)|!Gf8GR
zXwAWKmH(yFJwcu-!7*B`g;uXR8{gFlC&9tO;;P5#vGIcEYs1N|=+qgYQ*8Hj8c(ZU
zetFID&-nM>VGVk~^0N0+qucLkA#cB**`bGrsHhI9*F0}WYwbTs#ggse$A5)6e>)}i
zeaBANG<I&(4UVU`r5l8;$0NV@Rs^;PgOj^0iCLK*X3@KM@;vroh5mE5j~Of#SMBBW
zKl^u8`9Qa%=8D!QULv_mMnWdymCzsJjV3C|&?nuh{-Hi`J<~>~V^a2KgPUIN2TA@W
z9UR+iQ|w}rA^RG#<ReoH?JH{UZDqM8pU9x^^K<%b_-XJ+=-bxkG<CZ4d~^#8;bDl_
zIULE7_jrq{t^1j>xku;wr4+48dsE1;y3Uh<6P8_?9h1CkzSn|-SFei$gdGw9d%hO+
zAmw?-D8DzYmUoJuExsWhy2aw6Oq$+8MB-6$O!_n%IbS`pxEg2!?M`Dl0h(-8=he=p
z{i`KzGn7XrMO%0y5U=mw$472uwVCweUwma(oo1A48a3z=Oo_{!3p$T|@Uxbt2XE^W
zyf$v3PM3S<;wDd!&T#86Yh6?kcY(zW7KAN<B5j8F85*C@%d||swKK}w(z${$Ayk!~
zMN49g!d*W8RG!&8f7Ofgna!7j#p>0R)s-qE-)5uR4Qk=^@Q#`#{z-}uwP9)UvCPd(
z3h}sx?fpGmDsZs@W>HZ-(a0%AQB^w8m}cK8TfWaZUw(R&l(`0!M{JgA32zFm1_lzh
z)v4qfnHal$^g}RN1&wL%ufWN}>#^3!Tg!JmN^QfvT6ICfC!ZI}Y&S|*g-jdag=jRI
zbztTbqvD-f-Ymr|28K7ac~zk-U+P|-lvaDy$jQ=7s3kWOQH@Y7di5v8i$3EPfsB1;
zW}Z^!qES)+R~tuwCW0OEh$pg-n*Q#VKChUS$B#9IngLVpqdFgvxVs!CrNH1f!J?x$
zZb^7twum*`VB+shN(F(yKwX+Ve1Gfc=RWN(7i|X3mtCej0I~!!^9tnCd>};%SguU(
zfdU9^3om*o^|pxYw<d60NPo67ePa~TfHrNabaC<H><Hen`XnzNZh&9VE@uYvpFI!d
zFwc;TPbu{<1h>uPQ?+~}q3B%}v_C&%U2e^5KtVKKt@sdcHQyV5Xxg#*diAm_2?=wD
zyC^bnqmZxYzYw>n2xJ+IaHq*uH%qO=wNCERpYzDpkva@p(dc|SM?XeLuoK2vQ*x0P
zmu*LpM7_Mn7S93p2(e-^<8E?yc5-jx<QxC`d(B@38{6UI&@>-)#P>zHY9;-H1WM-a
zpGs7ZM+JL??Y0xU#iC5w5fMBMjI*!BnG80h5R7c<fFvey^^ip2mV;CF!n-Rj@LJ6~
z-Z~iniD!}T+G141BjS`}`Y@ShoDv_30O4H(PmeQ$Uy0}o{j=WpSQNN?P<UH_s4zWJ
zI-_KiVW8w$`!N$a<XIilvqzfz|8VxzQE@%pmbkmS1b0nv3GNy!xVu~9F2REa4;~<R
z<JPzZ2oT&FcW5j$KK$mJx8|EQGjG<szk1cKea`ArRk!NieXGvJiXoIb9<=<LkJlXo
z3o~oPT+cJAF_OK0hcga95fk%YJYmu1P<5WDUzIajRHhCTR|$X*-0lef10HsulXa~a
z74$hR)Mb00$D6Hm>lM->x<buuUV?fc+pL{ADs%Qp%0=|YK;YNpesgy~9JkP)qe>d)
zpyicE$nEa#$w;f=#Y7O#1BD&4D9hWu=L&mlwUI+AlW53d3JzxdV6lbNVrIcqXLIL^
z^p8HbPqw@aKN9K+nZIhXk$*^|!hR=6uzSWsiQ4eD>i$WcP5Goy-13`RPw)${9XKn%
zZQjXq<}`Ja^#CjV-EASx?_~;Hs#X>~yv3s6E1WIAG(#NEHtpzWeL2Lu%2ZA<Va=4E
z!l(#xG*!kZy*?7P=<=x{($V;i%o~O({djo&BJ-n9fizv67$-qF(MKF4Xiw|Nn-7`A
zCz32hsOrMtF%LbXnhs}F;Z&=8KxKj%a{55a)F2dAE~Lqv`T=2b=OJNg2I0L7mikz@
zdQC@RmJEu|II|!lZq}M1N&3`sG_HHj^vhD)IYQ7GDIGx?5@ONAtQC_5Ny~R_43N#w
z%5wY<S1mANNa(5j)NWuc)dI${uy9ljFHWaO4g%$E95@oK3eTmk!KO%*CWem{(c@dF
z*#|djR1z2768n$#@!PbVspG5dkqmLV?`#q8tw;W2F95NYdDfnQGEZaisLXd<D!lUk
zC?uq!=pu_3DmB8>JnJu+8TEAcpJZa+e?g=9Dvd09O)-p<Jc>mK^~0{Xe;N3qX)ltI
zyz~W0Z7GkvX*t%q3@0W6oq{!{BKF6R!R-jVKK;D-aU;&cplCfZWM6#V$yqURED9c|
z2wvn7GmlNZg(&(qLch6qqIpOD<bj|VOTMwuyGaB}w3Q_DgccQ#`Zk;oOsd3q_ort$
zLWDA<|2UZVq4cgwYk+Xe5jP<Vd3dLRMfs8*^<>d2&Aq(LzI?105A#Jb+9CbGk&Go`
z?@C2fv0d<E+@Eb#U)y!@=-BWOOgM9tFDT)#5nnP$YKHPYW3f|+yKTV7Ol}zm?7tl_
zsZTtXyeq0i`25{f3}0x7e)+4pzLTh&C$kT(Pl8whzSJ)bP$cE(Zre-Jg|To~?#Nu6
zqTMXbMRIASLXkA_Crt*gFwcpNh>LR!7W8r1A&wswOf$#{3n3NA3D|xg8NnLDqJy*v
ztvG%?k7M2ZmRaSW<1n@mopD}<$|Lwbfv_4mI^n-ccgc=$;xOioiU^Kk3#*l~bnFQW
z=3!lY(6JgcFRs9(Z$MVe*F`8bwHx@9I7?FWo95lF^#$Hw<rlMI&e=HgU!{aoPA$90
zzc1ZqcZ4I>4!m9hvDCK{w<%UIa9y_GFh)N#fNI)sI#?iUQCWK2QfSGz;SrH3df!sN
z(G#ZOz98Sk_sB~f#_AdQy6-h3p)=7aUeaS^^Vb=jHY^3i)Ky%KDnb;JK5E7D!Pjq-
ziC4T>UA%lGSG?d(>SepAW$65Z5q|+^p5-|eAC<ND_kDEdpD=nI5X<$Ilmd@&6}LAH
zs{b<McAWW^APEitW6r^hj4(#>2dTX|Q0luB3aw7+O7~OP(}pj-VWTy^;PRLB14F2j
zq6y@2O8(-PU8%^@Gvs05s5+*N!r|bMhO~%Is+Wi^9YgyZ@OU_%YirsQ{Fgho!9>&~
z<UT<+`E2Kwl##50%O?pKHtmDGVCMb01@>)8G6{a!zZu%vikV(0#g2*TtZ)?%@w(x*
z)#H>uykAMs;8mH%E<7us67|2AWGeDWGU@U6?09rqA3nOLr6d(!+rQaFDm-2875-ki
z64XGIU(h22@CH8Lz{UWCrMMO<*R{JzUB!ah-2FScZ(|F{7M=2b?aPR?t)9$cBPHXk
zAORwAKy;BXRI~^X6xvXE6j)Iy6fmw7O!EH?hWmF5SWyt&|7Q3<88;G0!M5nMH`G8}
zuy29QjImg70*_<|wX-t}G@py=`Do-YDfn7B0k$~!a&^Qow_f@6q&MUh-zz|!TRisR
zrEv54sbCQr1M_;bXDa@Tus%c0Bd)OMf5qkld;#~qoCrMHvH-i9{w%Nhl2FSShCerL
zS__y(y*{kE28U$IwR)xcKVt1f*eTb){3Qgzi^2gykpT!07;Fd%7?ui*`v!sN-k?zV
zHwY#fhUyJ{i|HTYTUc*}orpK=f2Fk&MURDKZlJx@FQRrit2W(pBx@+m>e=_05HS<N
zJdJOU5iI#m!oxucKRK(gjo&n?a?~SR%a=!J`gt+r#kYyZGJxt>%WS`|oangbBO^en
z^$iBU=c-qYgy}byDJC~~5{`48n83EiGYnJo!3N7VY0NbJF1ry`K%9dKQ6D)VKAVs@
zZCf^#()XWnH+Ijqy_bb>g6dA|tGLbdDCLt79721UAmWa>h&>`!zf=cJh4=SGXzd<5
z;ig$IgR#MSE&aq(d_S{K?Yu>RiHT@ilYZQ$w};c4!gtp<75AOQ=LmpM0q`~TB&=1Q
z?a$>V)HXbHrhOvNHBied1Qx7^UeGWm?<rg+P<|o8A-0=!O(XNYmvv0KC}va5Mjk=5
zECj3k+Dy6ZLN(=NY==Js76kwF9>SDqYhc1f)u`aX>A3T`G2h^FspO1-sx_Pxz&Y2j
zGiU-2*2C;674<APA<W%>Qjokh0~YwXt6YQZsY)GGmC`=*{AuD#;=uirH#?|hB*D$z
zG8|-UgwKmH8zzt>hI=>S0|SBSMG+5kyylGmtF1e4YaE15jO83P1k8HRbcO*i)b|rZ
z((J{CR3n-4qx-IC5oT7hRqNTz$o{~FC}*oEUh3vz`deqoh3FTF1?S}ZIL^*D%_K~!
z7$y9=|7O07zyB>>HBXFap8jpf^tSY$=!M4PXUU4K)~Xf4p>#QdIuXQ$>_@EQbqn{u
zuZ?BEz7&8~5yX|j)z<q=V9G^rl)ynG>jg@?outO7w8@2-iwXF`nZPLEh3xBay-+O4
zwWaw~)nEI@mAB!z*e6gm?@$NMASGuJ#}0lw$zQK;?u286vO;P`8fwY`g%dlQ#jiV^
zQTt?iNEnP8nA<**L{KGewO1tzCOz?=J@w3p)BXB)WF^QD5JADl1THaWNs>ODg@1Yn
z=&cpGsQ<xf_t*iq*^4Ef;nJAIajF5qnt*#!>boPalGN!I9=i?CWfMKC*Q*l62=Mwf
z)Q+?%RK#TW-e=O_ne*fZ-CktAy2*(G2kKNliz8@{42cJqOi29Xv;Td*$p8f=80%&u
zQ;&X@3sLVapK4I<wSYv7+woT=jDPhrNJ{E=4R`ftDOg}KI2<*)2+3y?Mnka+N0M3~
z5pn(fz!i{o_mdON3*&;Aql+CGBA^R38sRSu0tJUnht=Ui``-bc3CvFL`w2r$c>tN&
zE@mzP^fy?#FT*^62Fcw$N+YhM5F1W<RSj_*;MAgHgNq8j{vUAXToc?|)1r?+WIwW8
z1de(nU7f?!`Cd)R*}y-I_dPz0uec<&XP`enbW&ZCgKw?z9{L6vQuZ+>Fakg8?AOj)
zYO3Qxui^gbepHj_2e=xDWmHREF)WuWtgCJY4)|h^<i)Z<?@7>NEa_nlt*#cNSF_s}
z5Y&wFBJ+x_>6v4yix`RwT?MIceeSmn=9qU>bHz;~2QzW%LIXsU>qJ*uVukGY(b)p+
zlR*`?ClEe}W}~uc&T3f&wS0fBP4?o}+q`vwV0vR9g5@vn=nuQ-x;4%z6it0p6H6=y
z)9V1)&;FF?`KwjildWr>q`s&`O1Ta)XZ&!a*r^PGr=9e47v?U5!xVqZYSv58)eaeM
zL2t&=#E$n{DS*ojnCI-o>dCOSwk~Vu=l~d;i-Rg^3dGITM~=q~{Np{J!$red(O%BL
z(>mWP<d*VQThdu43B_PxL_u7Ln}<hiu8}%6>>=irn$bdu8oKs11_)fYgtzT&<JQf|
z=&t9;qR-hqev8EhOH4W<c7h2roZa5;Oi+#VY?1RatzsUJ&YJX}vTr@4+{Z+`@duew
z&hT5kb=OGF^YhA&orBsi0lgL3Bpq_fo&MbU@abQmxs|7a_Zi||zS$DXuJa{!u1Gxs
z*c<uC>LYNZ3$=j9ori{Y6f!VuFbmY~d_J#S`#XoijMD3dYm*I!BWG83z_rTvJGgH>
zb>Zq=?G=RLpWs(2xmH?w1{ca2rtUUv^TNG(d^3A$`kF`qd>@P44oO9>V)zraRvH(O
z0HLOEJwn~*<w8I1{ARkcuPnGJY@R#jkJ}hNZ>`q84CY>`Pw-A!7g1r}2}kHoR&<B)
zgX)mFs(g)X(F)>q`3_F*y7c|2iaXY?M1nqVb?z^jNC+<eR9r56iBn;WEkJRINb2-m
z6T17Ao0lsT#P&9eT3BRiv1T}VgryefX{5$iV}rg0J8-C@Tl*;?_6>vp`x!%G%Z%C%
zjZv?SSarZ>#CAW^M21d1Blb?=dBT?oazt(pO!NMz*%bq?&HVrI*u1w_HIX~}F(pt+
z>nijpaW1AJ^^qz#N8sM`h?vvA@LBRYC5QZ^{oVkY(e4VD-4VF7AN-dC^lBRUii`NR
zp#JYm=l^4kh5ct4{x4Xqm_go_doM#<*G=<49BWq;Xh`>?74`atVFLE7UoPy+;q)t%
zV14GT$Sbyt0^xdvtoJSpb!L5N;Rxk&&+I#_Y+9}6;#kzG2p*mz;|^}sv8?|>WvTcS
z`)=6c<5~Ociirng_T7z^hTzxnsII(`v@A(*|2@1~szgzW{44A=P4n@IaR8&K!>nOZ
z_(-j6ew|p8?PS5Tp(*~uC6TiGm%$X|u)T$v%~~YLzWm01M{g5B8W|NektO3(&7KlW
z?>Z{GX$sXFU`*Bg1RxB(ut!j>C&1O9f<WsJ`L?QHUU3LoHe_XSAfn>z{P-jQq=Kk0
zTQDhr2&v%h*We!@%+~x3_|GfM|DF1OwC(KxO}xr}2N=5C6ISp+*fE~&w%&42ydtI<
z0B^JE#I6lD@5y^rG*5?#&#6eD*Kv1?Vg0RmW=8=Bux?$~h90gr^SN1wQ@WDx4M?Ed
z9%C7VLeG(mzC(I2Y*(C9CbWxjsrEQb9X4Ptct{$w&;pceQi5+r!ZhvydUV%jgX~|h
zKfho{g-M8Uwm4!5ectOOa5)Pu$W<O#SKZ`P!!z4h;wHYhAQ*X<Z1SMp#2?Sq@p$!1
zXwTa3$&mes@?NjX#O-DTRH%pK7WJz!wE%9Jz__-#XloTFV#yq)j{G$E#@^N@%T8u6
zbQn}f^-b+2`?hFJ|MK%}=<a6$H+tm=qLEtHm}t1U*f~=X8MqZ9J*2tZ<~kn<)#g8k
zKhxITG$UvxbGvssgL`{@181wM4X|?NIC2s6vqtbcCj@R!>ag!9sgn6yjxZTGw0(SE
zpV1i#!X)ZcipYW6*|~CaTF53mza*)}Mc{pwLoTN^!gfN;!9xbUS$zJ>XI-NLO)OVW
z6`^Pq@+CSaoEEGnZgY#M5U@v!Hb-dl1Lf@phS!aw@gsw}yg504gRd1RUpwl}#NE|`
zP3s}MgNKviAM^M>Q+ymmDehL2@Lh>nQm5nie#7#&D{-j!(v4S4aNvsUIB+D!u!s4t
z*F*$IEN#cIOIiGRB+llL`{R@>-ZZF?8kz;;dyqQ$;Ar2NaU`!}h|h7ckV}gxYH+$j
zeGZq0Xaag4=rirPaQ)gW)&&h2861;!VNf&m!WopgS@JrzLhWKZ*cuRq6hmsz1388K
zTrG`*<y2uS2-EL0lDT`U5fj8|bxPA^AVVpQUqPfoy@uT1Kz@_}L${z>U};g271O%1
zH+u_HF2BH(<L@q<5&uRCv7$$qN0zlRCbXiEpFjQaY(M>lWT8QO@Iqih3Q03uo=hcr
zXH5?tZwc}F>%eYg0L19E*I|Jj?*Us7(eFcn83R33Xd@%xc+F&S<>V4aw_5uV7Dquc
z;~u_a86$5}iDk_Z_xI9u^Y;X73=syiIf=<WD+=l&{(mh|wO9CBC=-NJ?XfRrMXD*w
zxDDXcldU|~7D2q9&@+)rKCvp1?>dD1^-~oeKgKfmn%1ni_@<cKf@Y8HfF(Lll<&}F
zAh-Q}KEUNO?@XM<hl$iY1vwJ|p!MTyeaS=_yn0KgZFSh6dfDyLVoZ_a4?jM_xhBe~
zt>g@zkTxQcQLHWfOo@Ahh=r1O&$4%qgrb$i@;-1S4muGZZj(Z<;d@&m!z!pX`fF;6
zH)HRAFT#{F7;%RZYkYyO&T1P`GUId@5@a8lQi2fy?m&^Y4Tm6++R;eBZWuDC)BDvO
zK;G(eBxF0#-IBpP+>a&HdtwsFg4Kep$O)Hb`4<{kPCZgyh!NUE^ivE8BI9=mYXQ-p
zbp`-VR0tx}E2L)!9JQ;V%!fHc2owlXO|xMS5hkI>8B2eCxZU{<s;m8}0>a%f?zHI3
zYs$(c5YNc?6SVoM?l6^+^OSTZ+8*sOs3XhAz2ss9=)V3=M<pt8E!j$WKWEUSjR+4w
z+;`V2+x>Vu5#*>tD(i{_X(9h;kf2NqMiiB)03wokAujqbD{3aW!<$7iepMQ=`Z%&r
zl4ksc1;`7@LV@Bc0a?d#e8JPKcH&CQUKNSTsv0&U!@!uu;mdXY_OFG^@^ff}Uuy9n
zXa;>U^n0A0iIl<+HUQ>0G6Y3Co~uM3F(u*tbm;=kJQmQ|8CMj>D)LUYiBOOaS2XZj
zp9hXD#)t{-VpxS&fyI92J<7@$%L!G_a12WwpSNXxXp9~S=}|!iOs90onY2zY9V#%K
zBUIkxz&3A`;HoSde};G}jF}1-(r}xtZ-GWu0FG?3=9OEK@^Fj~ym>Fvx=1M7$_U!-
zPuhForm}D9q>hN!xt9(63fn_%XjdsIkTe0CiQfm)Lli{Nq0c*?D1_nocG<P)P^9fa
z7xgi%1lAfmt%Hb2rN7sLWz{f{UY@9^kju7$lR^X~1EPcM!G$R?trL~fpxnctIZ?e)
z%4ba+fcsD=_0oV|j+A=-?=b2SHKA<R6t+m?C#!HPm^05^Km^_utkG&k{boEW>|-CG
z)TFKh)gvJCrlGIhnG5rY^RJfYqVQCCSV$~ox`2^Hk|mzcg2qZ*?y9@U{om;&%!SEh
zFAJvN1!vDSX;-C%Jul3ob&#E?4>@pjRiA<KdOIgO$<JT+goYH0smLWm%1LW3ri7pf
z%(F+|RCi?H)RtWfPsY$g-9!}(BViEwbD$BnD-$`eYEHtP|7wGIm<iIb^|V*Xmv~0*
zf`)kmd*q8D6w#n`U(fpmW_5)4$>7`rmb$HGr0m2hbKU~<8v4qg`ll>>9?FI+dTwCf
zvbe2+1+_k{4@E2Jj>YVNBj`+(RlrRn>O9~6ekSKt7@7qu=@Tb9JctU0{p@&4&0M31
zAeN3G(EA;oA9JN-Nw(d!>XT1EB!cLlk>Y0UHWh!2lIPkk>4;3q3%@m|VxmU0`0rYO
zB#~8PI<%yqzhTD|=oO#6ORGJ)HJVoVSRbjpy!*s31PXt`*mywu0C{jiKd`rpLIc5_
zIF|#t-ZEK8vp|gn3w}+UMpfsf8e+l|Jdc3MOiINwXjn$|O%^(|(25p0C(};%M^88?
z3wQeC&Z_aNFKm~JwY^T^#a5QPUU2VEC{7K{D`{RDMFJScE2?C1|GafNsk{ZbEWWw|
zX~K*6%RM{frmmyW<J6oPzDp>K_b#S|8+OwkI`5Ii&yVI#^@ZuvecH%-pvd{rrn-v%
z^knH)DI=<3srVmmL^3jcy3%Y43W=~fc+;pafB!E3Rl4wzsvcHo$<$Yd6<Ve`J~q+X
zg~jHrK=<_(Gl{>WP^!5S4eVd9l+5+iE<c`I4J+q|5Uj7xY`hBfEGrskwm8W@__J^U
z%aLcD1gMh3dSyU$hps?-Ow;fOPRzgq7I5dKUc^Dq1sovjNs7}<cynOFlE0U&7!O*L
z{^X2GNgmqJ-3pcPnL4OQq>taRZZE`5fnDTw+e%?};U*F3%j};<K-#7mk>tje2&bfl
ze>a<BTtv@p5e1|xwfh<iOiGXE@}!_98heeHEUec`dV+V8jHF)-s$2QsY#B3lDh0jl
z!87aZsE+pt*$B|Nt!hGxHLMim_!tse7#6LB9UnR}Cx3i6%0Fq34@t5b&oa(D8K&_w
z3L=K>a491wGJ$@d@=pi7B?=Wn5Iz$REj-4Bep5=KIXF`)&bZg4xTz&q7^ycwcq!LE
zo@{2{>P9qN{)EPX9!O9xSVIiMWpk)h-&=ehCkk0Y?I4@oNug(Ts@t6W5kMb}*aJ1m
z(pg&Fl%mt&OQQ4JM1v;k40bw_JiC>zM;XQ}Vqi;f8dV#B-39ew0`;(<VJC=BQ^}0j
z)M7~Dd#wkdA?bc1v)b`!NGC&mn_83rspsQ4$R~?p5&(-)A<bp|#*yH-A7Imv0%a5q
zjF_Xhx0Oo-v+~Cyr~aAynSf>+S9&bU4N$a#@B{<<3TvusyWR7)4G11;9Q%j026!|N
z8P0fY!~jQ3Xlrx*jSnTxoE%ybbAl?+LbTR2TU_D$r#_?1`)=M2frGvIf^mv>>XAev
z`U!y;NnUFo&o)MHrt&U(Sdm^<!;+Vdbb;)@NvNd#y(79KdkJ8AQD3!M;{&}_L+fbU
zT>A-@r51@l*Tj<II$;5_U;{t#yV8CZGOzTT7owikV*|gRDOfHj3y)<fm8aHc`RR%S
z4c*ck0>-ibo-*?a6fj-aK!dwiA>(}?k~M7F*${o9|1z(zKpuliS6V28;@PhezHk(&
zJPjM-ff4f4K0&gS6tIOi4*Js{to@GsLl>e#6%Qiji7O}*`VH&x(4_I)?Dgv+=z|@`
zlPtV=aF$J?Fif~qVX-}xF;I;V07bj;?v-F#b$%^FfTZ76hDx+{U)f>@W@(uH{CsH~
zP$de1HBSav3hPq=;zP5LAoQCXNsFWMVg$aWkeWFSebtr3fp@p7GL&!<GHE{g+9Xe8
zWh?R!=%O97u-trYldS&uxnZe6G=lZ$Qu22R<Ss{4hf3BU%$OTAs64P#YM5fj$$62R
znC(T=oxH`$9=z%6tikDqtWw!NB(mIQJeo5=<qg83SUFd9a&b`;B@5M)wzPvyVy)a@
zK8=UZ$@$)#=jESPj@EiI{i0?D?hT?0PI*BB3t$XTfw*)(Uh~K{-Sp^;gNC^4Z-hnf
z8|&MYs7zotan%=<Ca+O{P<w!S8NfS2;Fw4|_>dT!4C$k36V_Wo_`1&Szu4Id5$le`
ziI+8Uv>abe0}dLqecu2664thZ$T4A1ZkI$YF%I?C?Cubd-td>zfBr3}=-DaP-`SA#
zTlsq1;-|nK!2=P)nH|c3_|VPsZv$(XO&}5*Kdk~M^{Nzc2X0JqG5JCv^$2ap;u%%s
z$JW(EO*qNUKh;=aEnSBjXr(?HOKZX{Ec3M|gnfcH2UDvs<Kt_Qg8em*cu=)RIP5C!
zcR4XSF@Qpu5}Sd~mz!_TJ*hFKF^8v46Bi0V8S3j*-NjS-r-;y27Vx}_&<!WI@6HAv
zz<qY$Bssw0vsAsXDc|P2zj$)L;G@9<QFDnM!mP*~xFYxm#fM=Ca%G3ZO#ZPKsY{~E
zU+Gw`ztl5-`B^!xAi6v)6j)pp+F#u8>|Zb()8^dxk+O{s7&%<-iOe|uvQrw!foFV9
zDO<eznIOuKN#kLcWxvZ2V0=D5_%b)kPqcEUuN@`ZFxxF|;y|>P_Gw5@gtbT|(EvPh
zOv9=5ky}wg#4SX=kE5f2R2-_iJ&zNnv@ID?e06#}X;zM%IRIM0*TOp0=z-OMlcfiq
zEzBb9r7~+Fj8jD)AgpF%+#G~+*0W6>7de_hLjX?&&LE0RA*NwU1`q&dZ+b@xb^XKN
z<)BH|h;sI2PWt%P46{oT`!!w55xzbYq$jG07!Rwz5FdR(Se>Hxc+dZMs_h8xz&LmB
zfj!$<<DBk8Q7U?=v}LFU<@R}&kueihj#oQZq?mWX4lEU2-is`OfpY0m1TeLxDLz%A
zzl%Mj!;g2-4ERRjIQTK0Q8<$qfO#UwudT$_pGrd6A2uHyw^?>L4PCcT;c&g!U2ly0
zX!93#A)LRN=-g444{>9K8)Oozi!ooC&uAk}Dq1(9^xluS;p!6y2Ny<-GimPikFRXr
za*r*G?z`WoEeS=W$MX;?&Co-%>`=RmgGEL7{hbKm|IkXcIWE*YkNtS)U7gXFWaJI2
zK^x9$RUG?80Uu%>nq_hGLZ`WTZN+JJYM#l#_3V6G{9=G(Idk8BAhnivUc_Q~w?CQ&
zcAk0qUbYnDcpcHOWydc}5s#Fw*Eg`E>f}z|T_Qqp*w%Hk;22om{JBA7L(e){TL`27
z_)_1x=hHW_z>NCV;=G#@Ij~wX*+Qpthl}Qpe`iGz;bgfi>Fffdaui7v<<YIx$O#eC
z*_!>;x|3iqB&EC@-8i#c*Zcl1a}DW$HF>0X-%NsjW?;v(bI8(2mh!;9o`mp|km0q@
zYQCdsHLt}2V~l&an+Q6Zld3Aw;ukgEDrYyFx}qJ&WTkaI+v+Md!P4H8Y2budS*cTz
zed-ju`-^ZLve_v9Yrt5^I2BQ(#!Ol-|8?{|{v!8>W;zI66yZK)KwrQ47cR!fuZ-s(
zw`p3}KlEaXzdisDG9C7O4l@tE?Kc9ezwpZQK!{NR*J2ufgHtM&BdZa*`0FGIoCC6k
zeB19Y32ZW}hlTB>fTR3M22W7t+c9?*Ib#{mK6q}{qidx(c4-xBGz9~%nN#_{!$L|k
zS;des(tVq8JS5S(+D4-=_GQIJC|Tnu7dIs9p|aWk?(|oKjcX7xz8fi(yX>0O#eQpR
zTKR>%TCOeyj~La76(Xfzl}S5JdA8V-HFAM&1^Uf{2=K-OCdAXM^jSR*Apff?F!1ww
za#oLzf{qsrO>Gnjv?=TCGEx!yq9Nurj&&L^>b^b%3c=PJ24%UF{bjmVD&u?|k>*#m
z1d~Ev(|}T_NCiV6Q)=vKP}9FuA|42aDEzd=f7gnJ{sD>pDH;4b$oEEx|Chc5KMi_Q
zf&Qg3{X_ZByu8&x-vn{f#NY3AN!MrEL-dF9-DE>Uh|PAM-`{$?)~CPeUkhHqdpWx5
z1e@2Ktrzo|{NGE9jCC-OsrP0<s;d`m*!oIwVikV>u@^v04;ETg$h4k>q)Tc*u_nRp
z&BXug#ULu0yyb^6-63ZQt=b?eQr0C!tx0~2DLY3ni8=5F5Y-L*S3~$8!Tzs}^zY6>
z5JM{}P|~?XUY?P$-lR8-r)CJmU;+d(C9zL^Ycu7WEIaA~X8Ec>K~XvxdAEU2FM)dv
z?3(evPlW@Z6OL3#XA$KmjFv@5yuLEJ3~?&93hOs=C3r|L;eJqDsPB=oqB**BG7dT9
zkB<}H`M_t?Mpxwhr=l$^q?h8+XX)EY*z9GKgML01wWqHY?HHO5H`k~<Bv99RK9r2k
zbn)kDRJfiwgeQ2ELWJNYfD|+&@PKfh4^knygvs^d_G%}!X?LPwnm?G;-1pk(%PD5>
zZA`HleLXVR^WcV*^xmJ~qe|3Z#0Npi85)zSQktRYSQ)%7+IP`1I}DmCB)<nszocR1
z3p#EiA1+mXDLgQCEQAklRxhaVJ8>ja{5);FDH!m&@KD#Rev)qDEQcv~dL`$%sze^5
zJLSknk#LB#u=Dk|Qa^&|r5-aLFsDl$81=3cYhDj*N(Q0t`Xv3Gr5s6nPrZ7eav`(=
zj{fjT!7+Ie{j%VERUxzf*(hx16&G+Dq9^<8JNbI;RmtjqvH!w2NLFBXD8Gpm{v@iy
zlWs9#d??@oSO~-2H(ApQIU6XjQS(O-#I1UF!{8S*F|~s}wsXo&9gsj?(!03W3-`(f
zLSN2)_|rJ20@k^9xZ;6S*=>$ACnkLeT|U6`=p_eiByhj{QM31+xL#R6q-J(7cGv7I
z`q1*JTKjoA<HY|*-IWILvwm#H6xoP;J?T364sX)2+|7@)4x;zP^)7_Hy?u;*%5tWM
z3<MQ=U5u~VAkuRNNWNZF_R-ttSsDljxMHXH%<^2APrel@JrNEOcL+wt&o3<BillHm
zq3(FJPn-6SyXIHwfnUWSLhiiX^<ArKVytYA2YB0q4uytG(UvvkrFxNPZ<$1oMGSWv
zO7#W@5gGOA1-AuXwL@QX58K4|XQ-S?7R;E)sUjYkRND(7hm-0eK`jWAnba1w)E%G5
zqKg(1m4n(A5*s>>0<cwFvO#t4j&b{25(sYJf9dW4qCU~|w>;q5dn({V&<I%}GI=|8
z3T?GKldY`{tb-y1{zq+?$_tzA%qC&4h~P(z2D$5!GsTd)xZu1GU-sWUsDh)ObJ@L~
z&PPa09LZAHrZc4<3t_uh8RMSU`R>Q2K$l`76JG{mS>Ht&IJ4tV#y~|}t&xzhXR{@<
zZpsdjXHI7i$%`k_UiXjD2dhfx>U=3Vt@as@6p~}KD?j}qUpg)psS&wP_06ww^5p$q
zNb$HPMOmPn)z$7J6t2Gd$?K<f+>TNCx13YX=;mWcPEh3?x#!VgAC32Y5Afu3yt*c+
znT*+{yPD(Ae(nGw5@1_6?{@zKebe@ne}FwuPk&*8*{HTt6`eNR-FTP8q<<-f-moE)
zPwUEp;d^{KY9O@-=cEl^(|MP8V9D%2vZb;%fj5l`V+m7Iq!OboF|saC7pVo8S@#!V
zldup2g9o}@BoW=|lw$9^a8tEI?k+5IV<}TYC=P3N{sWqeTjetXo;>M8A>0$H&nyV}
z8Hrq_A2k(CmhYO>YV0^lpU{$!IW^k}m)ENs<2R4yY*Oy~KUd#nOb{y;pV+Wj-eDbF
z-@BE=(K9C?iBB7EJ$}bYVrQnoYLmr5@dQ79&B;S59+4kiVHvCi?+YSQ_bi6`5;P==
zT~H={K+rMFfn_<^7cxsauIPw5l+sPhPtS5OL#e}Y={9x$u&cDOz3tJblh3NQaY_Ob
z(X!eSGRC*nbkT-_V8mnfyVpoQ+S4$KJsGC!%L0pkpvy=1FuqTdDg7WazHB|m2H`>n
zOjSd+p)0gNps0B~RZILn%nChZvR@lioHBcc3br=;k<y_4Lc8j5+LknqZ`_i3c!$8X
z#R4VdQG%+xUmp>4FEd`VxT#^#w|KY+v#zeWgV_xiagQ3}?C#(z`$cC)OsQxU5UIpD
z%hJKcQ;wRybUJfGKd#zeFmi`jH4A^^xZ*@%`pLXqs!;VX_?KsIc5A<!`pY&fR21CQ
zDcn6Oh%!tLTwfiNvx<paX&B=3PW~Y`jLe5s<BJ<WKQfX+IwSln=z&iCq*g<#&gTlV
z8K`1W7!svNBDbOzp98wHY@h=Yp?2(Mi^%Q;;Q_F@#b{PM1v8gdrBf;T&}<x$ToJ|=
z*`LwVZZZNEOxAasg0Y_Dje?39imECktd6RG1#lKj_DLW^C}QFUm$MOq*ANPxcxby9
zIf1IB1ooW1k&TieGb0{fSY|#_=>{xiwx~QB6eX|ekZQCv$Ux8DUF>QvXu$gsFnbW4
z#XB0&#|Gto>w<SJHI(p1QC?Cg8X^mOOWtZbLTK-bhcsd2ljd2Dw!C{veg)CYh0rlo
zV!AO&vf1u&Zo3{m=u2No@`PrY9(?2S+8|N;jwb3lMPQ{se7;wiWcKlQnY;LlI%!Op
zHZ*scKxKzDZN#SdK`9Bx^helY>G}j*uo~y@a?wgZ!zV>>jRg^5Hc-=39Zr4Ps{Y1_
zrPCHRcy3Cm85gRGZ9I2}B54>!Q|#7^dD5>tTt75d(&>BXjtk+bOr0mwE~x!_&2Bp+
zC{JZsSj%eiYpH!)w0wEsu?>yT_vA~G`Ke>SjvW71$~=C6l`VlRJ+$L3ail0$J)7>h
z7uRSf-G>=>&xOgojyW&ke$WNY_TL)-`viTruEtxYGpLHI%Ae$Vv@R*7eY?BF?h~@)
zushiHOYEX|tQ=ApMUw9A2qv*qg+K&a^n5{E*ZXg!k;}D{Bkx}42YS1RT|dn<$~eX@
zoX>&oiY!#N54AyabVnn6S1%MGYF-!}Y%Ydw>Js)y4pNKtmSoP^!yBW8C{O%7_K?5z
zZ2s<Z<EX-~QnS7|^j0fAf~UP1_HMF)Al!<-Ks?sQDN+Li`ENhWHUcb03abOw>3LEL
z3redm+z-w5{HF^f8h4Z#)36*#9C??LQZI!*4!_G~^i$tkGwJwC<gRMmAKa41L44Ps
zn#pqUW0(}9tG=d&obKlxWE?BN-E0g6Ohq3w5~CjYf_k&Q?xeXia4oV-kMWwL@T-<i
zI@63a`*M(GNJx8)Oe~5cZa?Ir7=ZYq7uE{!J3G$>wTi(758Xi2y8v{4$qj4ImM@nW
z@ajDEv&=`T3@U*wJdisK(Ez{!6_&Q<gH<DLTyCA<b<bt~*e&`54=g{vAtx_{VkXs~
zG|Z8Zptw<qXApB-Kqq><ZJjEYDs9&IjD!u=bVpe1H8kGU*L;(urA%brn1w9jtFa}x
z+r{CJ<Yz)%uJ`hwYAZq|52LLC*&IoDfb1LwxJJ{(z5x~xw@o*s)ps{D!Zj}n<63%5
zkjkw1(8E)8?j<abTiWuFNMja?TwJ)0c{xUwv=__7DR{*8Hb0w#Lef6ug;HB9_A={%
z-d$mWk}WrvQVgKD01sAl!88A<#7kQk@hMQNNq$4G&B0WvxDA}dGE7%ZWNWjE9Mgfg
zB7*M;Rk90iMB8=%Cl_uhs(KVb7Xk}seyL^@+35~AfO7Fkt7>XCe@K7_dlsX{R9!^%
zO?n!f^g&mq@;FdePJ`t!O(&7@2i-t+W(VTo!|NYxrrC>|o!-VFhMP7=B2`b-6_-Kp
zA6QqU-KSt<waM-4kY$n9xA)pyNv`g?a1L)<eIP=``1qFLWZaBm{*s=w&8k{MKwSpA
z2&tMy|Dx}QsCJPQ^~fKg-8T(f&wbcv&+vigC$O&tn<fFgWAu!=s}9aarVja2D*>F2
z`%QN%tw)`EX=&4L@02oIQ>>~i@OfTE<3Uy710Frr%Wl|x2C?fm4i0cH4<N45@<L1H
zPi8G*P-RiR+Q^AefhLBfi}b|bff-~Q>7n^lmrI0Ei=>bPA=vWRookdQ3s@)yFaur!
zvE-0ETjvkNNBRdJT<16Ta9Xhw^a1U>LUy<+b?%8>BOzMUu5eESsbA5SflO6B5A=vJ
z1qJ<G<&zc_`5V#1&Is&|7AtE9Nz#xV8h<x~(ky4FF>KL`3Yo<BjAgiz130L`z?H#N
zLzZ~8w<t6a$_ca#O==E>=`r@%v?V?Rh`VAfEQ0|6Njq{~J*FiQ_D=-tHAJ#IJD}+0
z0Jq?RSeE*d)J+I70Sfd49=nlt5zbcgRC;6hQTfGiMtKu;JIn%mb~(yi$O)gSu*q=#
z42El9C*}|<lr}H-JG?6wyh+!Jt9y9f^-)~my~l4BHl;IF>Zr*28`YAudz8RG(>PI<
zTnpc&cb<QKgfFQ3-s%o=*&LMfXq#k*^n77(J50{@t#>y4Mzz`ud;g(<4{LSu!2%ig
zy^}=&GLCLTmWegC`Ersibua@b3$6UhEX?F7Dn?tp9`o&IU`IBEiz)uc=m$;y>GyZy
z5xVyxbeMvyxfYB~sPB<sv3)RVx7P-)#kPLX1ZLLFQk+7U?qhP34^W}5Z)p|wd%UQw
z!mWrY%0G7>u}Fed@t`RQB#X2XTelo%AFVO#%ml9LgNEPz!TWTK1b|Ht93r9MDn~Yl
zk5&dHqnFNeU;>Df0=>^9-{qgbBDfOBG|X`)&STjw{N0GC)FyGk0>wzWu{bME3w~pP
z&sN|TLkhtBb+3eebYRZvf(^>WNXXHGDG?JJ6Qw8U<M6usl|W2fYZryJ8!%0$&HW`k
z`jOj<XlT|Z;5P%hn-EqV2FT$`_M$$IXcf-v%>B%K>+O6XLw;2Cr=40!I|?M}T77)R
z&x&$tve3|xrePyw?n2B#GM)*L4F3~idAv(VQkth5tn52-ubTcCwS9w#=X<Z$-?W*j
z*k*l%=m>B;Sy7?A${>jt2#FOQ4LtWk>_AOG3P~7?=71|mnSz*#II8m*hbAkcTTv)#
zf+q0jb$(In?3-)F!TE4l@<%l+-4=6V5%y@ehgd>eT917r!k?=>U|!yzGK-POIRd-u
zz4lf)^V}8Iy0zlh+3uek&lw`8+^Z5D<I#YQ>TL#A_TLtCvxX#L7Hi4|qXkBI4ZxNZ
zG1H)*qH8&M*F7{9)ofvRyx1LbaMK;)<CLV4xyZX8rgHedSdhm&>=uz_#%D3~15-|&
z)^03dftvg`C<8rfWao1c7~&PTIHC{in6F2~!4QX_IPMdhmUWABZMYZCpv&@r<tlL@
zXdsT-c*sL}Ym0}vC|`i3>aPz#N{gSq-dMR!XYkdl?d?f7eJNU+12I@gCgvqBG<l?2
zC&kgkqG~|9G==WV5d&&R6z^^EWj9U3BvF+wYTp`&ZfrRkOMdck&#s2e{Vtscn+#>0
zxe&qjPH&n^#L1`4*zx;C*4WP%<cnRsw>O~pY#J-^ex`^wd2^G2*NTZrz;L&NoXTsm
zS0ne<9l$X@+GuucUTxUcmv+kWGwJA1wd{dX1-XFF@MOkf)|OMB?z%G8FezWYBskZE
z-e7yi&ge;o4zM+~Yc<Z4)!zhkQ7A6z!%O`8fQj!TENyb%NoOCl{h4<{Q@&YDM1)Li
zWOl@ZV4mQD9(=JOaMq#ZTDdY*#cn=qV~^iCd9m>P35?kqgvjz<`}%V<tHHQ9v8Dc+
z?h*!B*k;PvbKKJqJTv>dML|+5i~8W_V82Q7$_EPq*I3hOXM`v9=U9ebh_C9k7|cdJ
zK{raixgMg#ij<EDCXos7s__<bYC#mV9AJ+c#KNMxVmM4@BK&<jJt{D--FFXR^J@Nn
z5B(a`_j8ZRCXDaU!*d+g9qTza`%9f5C+sVFNVBf@s**>wH|moye$qhJ3Zy{Wd0RCR
zK*zbVw|+Osh47Tv>-Q3o<~!2SV)o2rbQFZJVe$~jY#R?b!~>VK+YTfq;6o6ek^$Gk
z<;~*4H6<?QsiD1u?WTEICSn)p)7JL66sN%uHPB{sve?QmbX6Pds2g96yCD&Tr)R*g
zJ6yodpmnWL<;2%eCU8h(8kdg{K7<~wzySbPAOm`HE&AoH0u_J<tNsqGh#(64_AG$=
z@8}!njsC{@@0Fl5lsCgrrhh2^SfKv98{B`GGXJ9dhwt8N(5t<5%cjD7nMcNx^z25Y
zFf7%ph`W~a^T!uj#d%~%Vu(a@IaP|okH@}?U241@)b&@<U2m8!&s*PF>xYZiQDpie
zUkzfAWd&u0TTROg{cFlGb7_UiL*4CcT8M)82lhL1u}S5ay-^8zvX~0@e?s~H_|yLu
z`&&!=-$D-zf}ifS+0j!|dkYWxs4?J~B#{^T8Z2P4_QZos|K@}xX2^7I!O5N1CV0kX
zX-`#P5ett1?j<W)eydDXw$cK$t~IYZe2S!!@Ja&?`2b0S03Rv^`J(#9^@)%kl)|2H
z*nbeuwfz0u*~AglN_4Tv1gRRR6iE^3KE`&_)*E=Q#a33Fo0YMn=U26+v8^YB^46cQ
z;B{e0c^!-dw$>K^JY;h&YxcoK@~-B=q5U?1W$V|SlTo+7!@jc5sAn9te8@sEQK#F}
zS1gXN-L2M@vUZB|e1xh~0Gee6?Rbg4(-N}=k|wLBBXa42&{ra`j;u~|y|QLIRoa(c
zkyBL$uq>H*7mBEDGHg-|)xqXKQda0ImiVf9FUk{EUWf$5+06qLlJvo3IDj3QlX0%o
zRu5L(RUf@Yl8Ujp+CQM2@XU-W9V4kb-2O)LbTV0}eicMLOuwV67{X51vWZ<SAR`L<
z$^kOPYp)cBM1`Bx;{l?|?#ye{s}BxbkE&d808Z&~S-P&d<C`lzQrdsoCV`Vuq7#Xf
zS?`k5wS+VK(G7<pJkL-XC$!BE>dPE#hF4F|EhgH&Rd{g@G!x+;R&W`o9=q=C$$zzR
z)>dQ}#MJDxR13Yw3p;SaF!R6Ski<CKFgGXpV-hW`Pa41hJZIY#$zY5c0z=xp1(D~r
ztDNi1{5^v)!CwV)eqi89Q^RT@JW;}l+noiIrhXbRbue$=B-6?ENO$0xhs<QHFA!bA
zu!ZVnqnjaZ`bdCIOsS!4z)y9SKWq-(w@jPMzdzm5lhA3VyQ&hwI6HYx=u9s)N89(2
zMOPE`CW>m(oa(xUe2hF9r}|X`s{h+hEiG+ea1riI(%&+`qY_K`98;WNR+1ulB7FL{
z;U+*6mHY1@I{zldCBoBf7<IxZv$LeA@_Vic56*&JDPlgch!{jLDfQPcjF#LwqzpM{
z;y*j}=lHwsZ^N*k=jU(&T(E+3Mjm%_9g7iEYL+s7uZ`T2Zjm0Gyf(T1OT084yj~pC
z-Nm4=++{Z5X8uBhfP_NE8khA0V4tACuPGym&eI1_9Av}_#7kwIjx55rWqgLA^j#U8
zzOHS?Hd%S-QbhjH@-<9r+NN+){IT^P@lx0&pecXaP_?-O7}V4$$N-yiU}Y52>Elm~
z=Bz$V0L@_i*^wHcY=I*-*SEA0&B-&fVS$}I7yc35K5dM=I&J$ScFc|S)?}JWR~fiA
zM!szU{Y!VL@i~D(cCmuF@62=T>D(a2(BCU}iC$lXoez&6uI0`XPcqD$QfxhtB65D=
z<th^Fuc`)}HP((C<WqnS9G7$JM~rIaq|5xsG(qIRq#um6FL;)L^tBIm#aMx_JRLu>
z%JOYCdeLpk0~H5H+l%axSkk@@3X&oPAz&xbuFz>yem^6GX2AuL9=Ws0yT?3vWi6ZK
zf?S0v?W1J#;Y<#s-Mqy_^Q6wl*t`9`jc8vE;He{TQ4SN#K5mn>gjUG-C0wusw8~hG
z^dsK}ODXDU&ocVOJPD$}L_Kr>fgNs$KrIr~uk~}Ib=%{^@K9~fggz|JM}|Poou9WP
zu6{_DkV(x_j2*Ub7KuY{QMN}reII|(|4F}~8bzf`Lzp<mi)fGV(BF0xgXq`{28(Et
zgYbm`nXaI{Ql(#IeTzKf)A@_K-rD)=HpwbXpc7zX`qP5X*Il|9&g{?EpO)NzzX~#i
zgtzk`29hhO_TQpLf05{624N2@N~WT1_YE@v-=tpN&_WoOUnP&r*Cf!O18IX=#dkgG
zyj6tIJ0`FJK3QUc5Or-{NboFYWW?H$NE{6-$WdG-_S@go+aUHB>BQ4!_P@hO3m}<U
zoDtFBkniJ}N$^)_{nXFC2P>VszMY-CKU%&{#9+&K{`iZ{X%<6Iu>E_?Y=3wxuKL@~
z4q|<!XjftaoC`oAzKsD5%seYTj<&>hBK3Zo%B*Z1I;vkn;fek8`*u<O4y%pYdSj_>
zt1W++ak0<S0CxPD%%J!n^)Af1X|%UDb5d%nQ1sfT&Pzc_^@XravrgJx3A06h<gJHF
zyAj<T2b#tbUN^G3pyb{R7}qiL@Cq`y89E6rz*&U&2k*PNEVhC-$vrN{7I6w`xrAbD
zUkuW8x<ws&w=*HXtuUn<G(O-61OQ>Y1WrQWA*a&Ryu`GyFE}LN-rFJvx<^8(F8HZb
zgj&={Yf>Hx?<*o&B^#cBAB)0vRl_~$(g3*yAG71tHaEdUIBX#+iNYQGSYh?j<s#|S
zW0q54oy?vH=37~*n?804T7#^gMNP~t#lgw4e;5^OtP?&r3R>P(2k{QL`W{`w#H<-a
zY{2u5e(NJ6H9YpIMbup|`PD(iq1Ov<BK2T^ivUc3=c{l#*g|#~GC(!->E?ansKVN)
zs5c@N8PR183H-o1zlJka!DnBZb8HVk^AKk1Z&C+(ecR*5nNdb~;9~fK4VKr`Ns{gL
zBZG2?BOjz;-Uz^im>;$TfCtKBlCgMEf(e!f^tcBvknf<S0&(Tme504sEbSSq3+E+N
znLuL(Ecf?&=oLFZVM}*;RR4rGkov3?Tzke;_iryGgyfPy-widqyE4hx`^34qyy?g2
zh*Gq~HJAK{Z-2jOHADPEQt8f3Po!U8bDR#ZSHxo16fIyu&T*9d*L%Y<M-PgLGyS!I
zQpOaY4cFoq@D_u847TcS0{Glu6INmxTL?(<vuJ!_R3rQ%AGIsEYB#!BFJmw8O8lU=
z&>zik#WC|`2&T6p&PB}d8|~^$8c5(OS-FIhyb#8uqG+@eB%~zLTe)~{5LWoLYsD92
zOF~tCLA0!P33<y3j4OU*Oh^$eU8GU<YhyLhp=q~n7(OWM5=#gg(RBJrr~Ib?w$Tk_
z<aFfdBhm!l7Y3WXlr`R5&en<L<?nf_G^=$obp|mZB84i{ly3?5%n80R@?etY<X!9p
z=%4453+`g2+NLEYeVjDNpql%WLkK~9BFBgdA7lQD8F2Pd*_U>GKq?|@b+Jk-)*GzT
z0!!>jEC`yp18w^F#z#{x5x7fCNqFG{Jj&`RzMbqFx+zT44q4DQYVuY4cO<B+nv%Pk
zU_rE$=VbNOv|aBdLiJ{T-k*lRnba}4Z^(T8{R+UQ&cqMI?lM8{$?ax@4_W)z`W_!D
zOC`WC#_dPAoYu*(S00!Cl!`@kCKt|RoWWV6@ma4zonlANBhmS1A>7YX*AozSVD;OF
zVkM;GHa}AWGVnwNKQm{8MhG)>Kj0T0lMW8~Q}Pd{-8}$o27vOsoP)#Vn9C*|x=nBy
z<8d|BSY5*=8wkO#J<0pHkV(2SHmie}hGH?eo`T;8W<|-1^>NndA&lWTxh)J<WxShh
z{d`O1lO}mC=^R({38=dq)B7lIuUovqb@Pf&5JiRFN{kkSq{mHI>H&$BxkQ26niNm&
z1f#_Z_si+yE$LD$k56XvC5#YVd}yQl#TFtID~;2qiz1`CT3E=UVNU;7pY-;-D(~ie
zvD_blE?@I*KSVo|(5gF6WSEPA>#{-eZtZjiq3bw3UJzswKrcZ9)6y?8bVf+3Fir%o
zv~pnloD2GZD_o&W9MT-cgyWx2vRTEgZ`Y>w&qZ&(cF9c3X0zwMfn==0g5iCm<WwKD
zQ<FOB*)v^#jIPQJfC9p!KT?kyD`DP{tj$`>FgjS(4BfjVK=U$AiD#-*EFy0aWwqdf
z`)wLO0ab9|h4}32Tk%3-awtGutP^5(P}p>esw~HQCUD}pN;S|G6*82$*>rk<EFQh5
zCcc6>@`?@UabT+1uy$yf6b-$^Ej)W-nP141Y9pLT#GBiZP8fhSJgz!9X;;fkt=w9s
zM1zbFb$m_8hPl|6kPBcyOyPU~6ei0)JS-N77jvfgSWqz1c8CnSG0KWrSDD%d7YvvE
z*rR)v0FTV01}g&JyLnyzCDlX2TIkmM7iTXz3+8c7?PY=8tk4qfSB%i9bDHt6i2Db$
zUw_vWp8A>0;B7HoHLhY|8uJzTrfRSipIyk`lt@y82cEGbFEF{IBz2sJ{`x$1s*lf@
z!dOVvk0+F_sRNm^uu5OVrtXmV80sGii>NW{oA9my2!UFu8+28)49&IK&U{uawZ~E)
z%FmYyrDqhGlzuxlAHqdjZDTrJH=`$=ePK5oRif;%(>Op3P{xOP=lyYfUT0PA9ef4r
zn}7RNYmAF#ZJ*#}TpUHF3ce+sqXDM(^awQFh@?bHNR0eSA~0WsI$y(v(1x6~6&`D6
zt2=8RqZH2s`F%b1oOSrlNiW-!#y_nXp0yI^WJlrJMU~vzgpF7i)vKzTQ@yN?Fcx6#
zGH#VfJa|k8?PA&@gqk9YuMgXP2-B)Nll^=K1B0ZkDD&~tpJn9|%-vsLWX#QPpr6J9
z6kiIDA!LbgGqA}`HQ29?7l9$O3jKoOrJ^Zz)hb#h$|yrx@0V0vWDNt>KV<1!A#&1~
zr6npjSUl_8@H0Bc(K{=g54~?!P7Cnl3i7<jx#2pT=;<DO-QC#y<wX4Pqcgci`^7<2
zpRrN&^7HAhDbZ<Ws*Tz}aH2W3$foi4|JK;KzcZnLah$WBjOA`g?yZPoE=iipQq1MJ
z%q7XSWNsbLIUEefrds4OMPV~6at*DFP1%I#Cc-Ez)|Bhg#Kc_BJm>dw&M)ux`+VQ`
zdB1<c2hY29oEednrfe(2jKh)hzbrIW@GjjLMC2}>41ozcY?NfuW#g)LbojUCW!e*w
zLj~dXE@R%;U(O{^pF4StHdicKo6&<ptw$@B>EpS^R<5xpW(qqgeiwstKa?b*EwJ{L
z*B^l+pq-ZNoeMu-mmkeT^}b=-!=>Jr4lYT%^wh8$$>A@tEe@mv!nSgET3Sh}U!ga!
zA{<Gtzf^^-m<xuheS%8W_}v{a7|XN=85SHi`LOByJWnn7ac!;G;U8sls#_gl66MGl
zi?N<Pf-4!*l#Fo+`qp_bBOG$QM*;0wbbk}tQ&Hs<N1VP_!_Z?fMChCS7&avA{OqzI
zrM%oUhTY%Q^KB%~Vx5YenRn{}SL*5i>VH!~IkaM&V^Vi+?;VY`F4?JTNzv0~@*Yoq
zR}IuzP0N|TlBqU5LMsV2ae$h6=lXRHzm8II{eo&s$@e`;-Kcg3VuK}~W$aB3IBnJ-
zW34F9?_a)GBxf#}X#P285g>@n(LbkY=Q;0NWwwG-r)CM9VsQx>txcO}^O-0&a;^J~
zyt@VvSumy0N1&ror%ZAb0)Mo%L5_t)DkY<s5YNi;Z`y>F)t1o)^1?^n+4{1BNB3}{
zHy5b_2SsJg1(}C;EMlt<RlA##=>hMk+K?lrO;8_NO`9St{=>_N$u43niNaBL57lKG
zaA10WHTYBWUD}{i(MG0bZ${eF{{Zg`>H~Sk3Zoj!O=^pd+Zt_L#yr+K=CIHJ3NqRU
z(REM?p=TrH!T1Bv?ZeMl!a3d&z0zyAbOM-TNwsyfU{P|kIE9&`teA=5=+G*%G4F|r
zQ-AF3r_FiN8q%de?lR+iDIpJe^*eeZ^!6)tRM0(*BU5mqLZGD!>8Z!lY5LB*(e|IA
z$f@e6_xMU<-2x1Q;Py4!|B#Kk5@{Xb#P)_E8c`!K1xb}|N_SV?12m{l$MfMcLP0>l
z2%&k1);hhFFBD`KPnokM?IsAeAgl$>hsb|m)<g7H#iJOm)(m!^^p=A9Ba*zC8fX5f
z;a2)DVOF%s-ce2())zX-Yn&?5H>_WJe;JXHHs4?kMzc0+a!<vp=`jY348|6b@dfpA
zf%a}Ke&F@`!I+82?nYV^ahR9-(S`x@0pR%G?E2is$C{5QwrXz*4Sg}zH^)ri`Mh$z
zmF~I+URZxEK<f0|LVP3Rj4;G5uXCn2v8lk$>7gO>Zak-DHJjSaPN}5@(Ic$t_zg-x
zjxY)KDyddF3wFYTGt@iz^L3_qv5+%(CNZv%mLjd1&H^n-lFeoC2Y-$vc!IEgKz?*`
zxB=5~nb|g^i{o#aoxZBX|44L|4s7>Wv7&Z?!_w=Z87Em6LjV+P)rzjmus&oaMi)m`
z2w0CF{)`%sS^ytNUzFS4FdV={Uf%h|X$%%MmQknY|F|i{ZH8Nf+5D~Jg5b)k)_zO7
z+5St@7bzPu+*Y^)OI4-y7V8r%>q1Oe8H0szUZdkpK5HW3Yo(`pnN5)fHp1Hn(OIhS
z*$PGjtpuY4l;u9JL`E7%N^r$-2#~C3ih4ERXwgC(C-ILH6J=tZXGNKo<^QvQ-BVZ7
z-3Of_&(*d}T`crplK{M%+1nubLvCJT#K)Eb4C?OPIPtv<lRC*#;)`=3t8Y!60r%CN
z$?i7rB}ljL*S8>!`TEz67o_`E$^7qS3hlk=0zRRd{}#kw$&ROyVy1+E6@V9eR(+wK
zKQ2GPo)H%-#?xQ4B{-tR+ADW?WL$AEIT3{R-({C!CgP0!hrrQZ5@I{D+#NuxB@v-1
Suw(DSZ5{1g&pomYzWz5o_!<iU

literal 0
HcmV?d00001

diff --git a/doc/ci/runners/index.md b/doc/ci/runners/index.md
index 038bda4ab09..f69d1f0f730 100644
--- a/doc/ci/runners/index.md
+++ b/doc/ci/runners/index.md
@@ -18,5 +18,25 @@ The number of minutes you can use on these runners depends on the
 [maximum number of CI/CD minutes](../pipelines/cicd_minutes.md)
 in your [subscription plan](https://about.gitlab.com/pricing/).
 
-If you use self-managed GitLab or you use GitLab.com but want to use your own runners, you can
-[install and configure your own runners](https://docs.gitlab.com/runner/install/).
+## Security for GitLab SaaS runners
+
+GitLab SaaS runners on Linux and Windows run on Google Compute Platform. The [Google Infrastructure Security Design Overview whitepaper](https://cloud.google.com/docs/security/infrastructure/design/resources/google_infrastructure_whitepaper_fa.pdf) provides an overview of how Google designs security into its technical infrastructure. The GitLab [Trust Center](https://about.gitlab.com/security/) and [GitLab Security Compliance Controls](https://about.staging.gitlab.com/handbook/engineering/security/security-assurance/security-compliance/sec-controls.html) pages provide an overview of the Security and Compliance controls that govern the GitLab SaaS runners.
+
+The runner that serves as a Runner Manager automatically initiates the creation and deletion of the virtual machines (VMs) used for CI jobs. When the Runner Manager picks up a GitLab SaaS CI job, it automatically executes that job on a new VM. There is no human or manual intervention in this process. The following section provides an overview of the additional built-in layers that harden the security of the GitLab Runner SaaS CI build environment.
+
+### Security of CI job execution on GitLab Runner SaaS (Linux, Windows)
+
+A dedicated temporary runner VM hosts and runs each CI job. On GitLab SaaS, two CI jobs never run on the same VM.
+
+![Job isolation](img/build_isolation.png)
+
+In this example, there are three jobs in the project's pipeline. Therefore, there are three temporary VMs used to run that pipeline, or one VM per job.
+
+GitLab sends the command to remove the temporary runner VM to the Google Compute API immediately after the CI job completes. The [Google Compute Engine hypervisor](https://cloud.google.com/blog/products/gcp/7-ways-we-harden-our-kvm-hypervisor-at-google-cloud-security-in-plaintext) takes over the task of securely deleting the virtual machine and associated data.
+
+### Network security of CI job virtual machines on GitLab Runner SaaS (Linux, Windows)
+
+- Firewall rules only allow outbound communication from the temporary VM to the public internet.
+- Inbound communication from the public internet to the temporary VM is not allowed.
+- Firewall rules do not permit communication between VMs.
+- The only internal communication allowed to the temporary VMs is from the Runner Manager.
diff --git a/lib/container_registry/gitlab_api_client.rb b/lib/container_registry/gitlab_api_client.rb
index c68b222af97..be99fa75ffe 100644
--- a/lib/container_registry/gitlab_api_client.rb
+++ b/lib/container_registry/gitlab_api_client.rb
@@ -21,6 +21,8 @@ module ContainerRegistry
 
     REGISTRY_GITLAB_V1_API_FEATURE = 'gitlab_v1_api'
 
+    MAX_TAGS_PAGE_SIZE = 1000
+
     def self.supports_gitlab_api?
       with_dummy_client(return_value_if_disabled: false) do |client|
         client.supports_gitlab_api?
@@ -86,6 +88,7 @@ module ContainerRegistry
       end
     end
 
+    # https://gitlab.com/gitlab-org/container-registry/-/blob/master/docs-gitlab/api.md#get-repository-details
     def repository_details(path, sizing: nil)
       with_token_faraday do |faraday_client|
         req = faraday_client.get("/gitlab/v1/repositories/#{path}/") do |req|
@@ -98,6 +101,26 @@ module ContainerRegistry
       end
     end
 
+    # https://gitlab.com/gitlab-org/container-registry/-/blob/master/docs-gitlab/api.md#list-repository-tags
+    def tags(path, page_size: 100, last: nil)
+      limited_page_size = [page_size, MAX_TAGS_PAGE_SIZE].min
+      with_token_faraday do |faraday_client|
+        response = faraday_client.get("/gitlab/v1/repositories/#{path}/tags/list/") do |req|
+          req.params['n'] = limited_page_size
+          req.params['last'] = last if last
+        end
+
+        break {} unless response.success?
+
+        link_parser = Gitlab::Utils::LinkHeaderParser.new(response.headers['link'])
+
+        {
+          pagination: link_parser.parse,
+          response_body: response_body(response)
+        }
+      end
+    end
+
     private
 
     def start_import_for(path, pre:)
diff --git a/lib/container_registry/tag.rb b/lib/container_registry/tag.rb
index 04a8e1d2e8f..76188a937c0 100644
--- a/lib/container_registry/tag.rb
+++ b/lib/container_registry/tag.rb
@@ -75,15 +75,28 @@ module ContainerRegistry
 
     def created_at
       return @created_at if @created_at
-      return unless config
 
       strong_memoize(:memoized_created_at) do
+        next unless config
+
         DateTime.rfc3339(config['created'])
       rescue ArgumentError
         nil
       end
     end
 
+    # this function will set and memoize a created_at
+    # to avoid a #config_blob call.
+    def force_created_at_from_iso8601(string_value)
+      date =
+        begin
+          DateTime.iso8601(string_value)
+        rescue ArgumentError
+          nil
+        end
+      instance_variable_set(ivar(:memoized_created_at), date)
+    end
+
     def layers
       return unless manifest
 
diff --git a/lib/gitlab/ci/parsers.rb b/lib/gitlab/ci/parsers.rb
index 1223d664214..b52e2d8f613 100644
--- a/lib/gitlab/ci/parsers.rb
+++ b/lib/gitlab/ci/parsers.rb
@@ -13,7 +13,8 @@ module Gitlab
           accessibility: ::Gitlab::Ci::Parsers::Accessibility::Pa11y,
           codequality: ::Gitlab::Ci::Parsers::Codequality::CodeClimate,
           sast: ::Gitlab::Ci::Parsers::Security::Sast,
-          secret_detection: ::Gitlab::Ci::Parsers::Security::SecretDetection
+          secret_detection: ::Gitlab::Ci::Parsers::Security::SecretDetection,
+          cyclonedx: ::Gitlab::Ci::Parsers::Sbom::Cyclonedx
         }
       end
 
diff --git a/lib/gitlab/ci/parsers/sbom/cyclonedx.rb b/lib/gitlab/ci/parsers/sbom/cyclonedx.rb
index 0e2ca97b9cc..deb20a2138c 100644
--- a/lib/gitlab/ci/parsers/sbom/cyclonedx.rb
+++ b/lib/gitlab/ci/parsers/sbom/cyclonedx.rb
@@ -8,13 +8,9 @@ module Gitlab
           SUPPORTED_SPEC_VERSIONS = %w[1.4].freeze
           COMPONENT_ATTRIBUTES = %w[type name version].freeze
 
-          def initialize(json_data, report)
-            @json_data = json_data
-            @report = report
-          end
-
-          def parse!
-            @data = Gitlab::Json.parse(json_data)
+          def parse!(blob, sbom_report)
+            @report = sbom_report
+            @data = Gitlab::Json.parse(blob)
 
             return unless valid?
 
diff --git a/lib/gitlab/ci/reports/sbom/reports.rb b/lib/gitlab/ci/reports/sbom/reports.rb
new file mode 100644
index 00000000000..efb772cb818
--- /dev/null
+++ b/lib/gitlab/ci/reports/sbom/reports.rb
@@ -0,0 +1,21 @@
+# frozen_string_literal: true
+
+module Gitlab
+  module Ci
+    module Reports
+      module Sbom
+        class Reports
+          attr_reader :reports
+
+          def initialize
+            @reports = []
+          end
+
+          def add_report(report)
+            @reports << report
+          end
+        end
+      end
+    end
+  end
+end
diff --git a/lib/gitlab/utils/link_header_parser.rb b/lib/gitlab/utils/link_header_parser.rb
new file mode 100644
index 00000000000..d98c237baf3
--- /dev/null
+++ b/lib/gitlab/utils/link_header_parser.rb
@@ -0,0 +1,46 @@
+# frozen_string_literal: true
+
+module Gitlab
+  module Utils
+    # Parses Link http headers (as defined in https://www.rfc-editor.org/rfc/rfc5988.txt)
+    #
+    # The URI-references with their relation type are extracted and returned as a hash
+    # Example:
+    #
+    # header = '<http://test.org/TheBook/chapter2>; rel="previous", <http://test.org/TheBook/chapter4>; rel="next"'
+    #
+    # Gitlab::Utils::LinkHeaderParser.new(header).parse
+    # {
+    #   previous: {
+    #     uri: #<URI::HTTP http://test.org/TheBook/chapter2>
+    #   },
+    #   next: {
+    #     uri: #<URI::HTTP http://test.org/TheBook/chapter4>
+    #   }
+    # }
+    class LinkHeaderParser
+      REL_PATTERN = %r{rel="(\w+)"}.freeze
+      # to avoid parse really long URIs we limit the amount of characters allowed
+      URI_PATTERN = %r{<(.{1,500})>}.freeze
+
+      def initialize(header)
+        @header = header
+      end
+
+      def parse
+        return {} if @header.blank?
+
+        links = @header.split(',')
+        result = {}
+        links.each do |link|
+          direction = link[REL_PATTERN, 1]&.to_sym
+          uri = link[URI_PATTERN, 1]
+
+          result[direction] = { uri: URI(uri) } if direction && uri
+        end
+
+        result
+      end
+    end
+  end
+end
diff --git a/locale/gitlab.pot b/locale/gitlab.pot
index f109bfd7db6..c0b5cabf983 100644
--- a/locale/gitlab.pot
+++ b/locale/gitlab.pot
@@ -22006,6 +22006,9 @@ msgstr ""
 msgid "Iteration"
 msgstr ""
 
+msgid "Iteration cannot be created for cadence"
+msgstr ""
+
 msgid "Iteration changed to"
 msgstr ""
 
@@ -22021,7 +22024,10 @@ msgstr ""
 msgid "Iterations"
 msgstr ""
 
-msgid "IterationsCadence|Manual iteration cadences are deprecated. Only automatic iteration cadences are allowed."
+msgid "Iterations cadence not found"
+msgstr ""
+
+msgid "Iterations cannot be manually added to cadences that use automatic scheduling"
 msgstr ""
 
 msgid "IterationsCadence|The automation start date must come after the active iteration %{iteration_dates}."
@@ -23999,9 +24005,6 @@ msgstr ""
 msgid "Manual"
 msgstr ""
 
-msgid "Manual iteration cadences are deprecated. Only automatic iteration cadences are allowed."
-msgstr ""
-
 msgid "ManualOrdering|Couldn't save the order of the issues"
 msgstr ""
 
@@ -44398,6 +44401,12 @@ msgstr ""
 msgid "WorkItem|Task deleted"
 msgstr ""
 
+msgid "WorkItem|Turn off confidentiality"
+msgstr ""
+
+msgid "WorkItem|Turn on confidentiality"
+msgstr ""
+
 msgid "WorkItem|Type"
 msgstr ""
 
diff --git a/results.txt b/results.txt
new file mode 100644
index 00000000000..e69de29bb2d
diff --git a/spec/features/issues/issue_sidebar_spec.rb b/spec/features/issues/issue_sidebar_spec.rb
index 9a512fe8fd2..8819f085a5f 100644
--- a/spec/features/issues/issue_sidebar_spec.rb
+++ b/spec/features/issues/issue_sidebar_spec.rb
@@ -84,8 +84,10 @@ RSpec.describe 'Issue Sidebar' do
               click_link user2.name
             end
 
-            find('.js-right-sidebar').click
-            find('.block.assignee .edit-link').click
+            within '.js-right-sidebar' do
+              find('.block.assignee').click(x: 0, y: 0)
+              find('.block.assignee .edit-link').click
+            end
 
             expect(page.all('.dropdown-menu-user li').length).to eq(1)
             expect(find('.dropdown-input-field').value).to eq(user2.name)
diff --git a/spec/features/issues/user_edits_issue_spec.rb b/spec/features/issues/user_edits_issue_spec.rb
index dac600c98bf..4eecb63c47e 100644
--- a/spec/features/issues/user_edits_issue_spec.rb
+++ b/spec/features/issues/user_edits_issue_spec.rb
@@ -155,7 +155,7 @@ RSpec.describe "Issues > User edits issue", :js do
 
           page.within '.block.labels' do
             # Remove `verisimilitude` label
-            within '.gl-label' do
+            within '.gl-label', text: 'verisimilitude' do
               click_button 'Remove label'
             end
 
diff --git a/spec/frontend/work_items/components/work_item_actions_spec.js b/spec/frontend/work_items/components/work_item_actions_spec.js
index 137a0a7326d..a1f1d47ab90 100644
--- a/spec/frontend/work_items/components/work_item_actions_spec.js
+++ b/spec/frontend/work_items/components/work_item_actions_spec.js
@@ -1,5 +1,5 @@
-import { GlDropdownItem, GlModal } from '@gitlab/ui';
-import { shallowMount } from '@vue/test-utils';
+import { GlModal } from '@gitlab/ui';
+import { shallowMountExtended } from 'helpers/vue_test_utils_helper';
 import WorkItemActions from '~/work_items/components/work_item_actions.vue';
 
 describe('WorkItemActions component', () => {
@@ -7,12 +7,19 @@ describe('WorkItemActions component', () => {
   let glModalDirective;
 
   const findModal = () => wrapper.findComponent(GlModal);
-  const findDeleteButton = () => wrapper.findComponent(GlDropdownItem);
+  const findConfidentialityToggleButton = () =>
+    wrapper.findByTestId('confidentiality-toggle-action');
+  const findDeleteButton = () => wrapper.findByTestId('delete-action');
 
-  const createComponent = ({ canDelete = true } = {}) => {
+  const createComponent = ({
+    canUpdate = true,
+    canDelete = true,
+    isConfidential = false,
+    isParentConfidential = false,
+  } = {}) => {
     glModalDirective = jest.fn();
-    wrapper = shallowMount(WorkItemActions, {
-      propsData: { workItemId: '123', canDelete },
+    wrapper = shallowMountExtended(WorkItemActions, {
+      propsData: { workItemId: '123', canUpdate, canDelete, isConfidential, isParentConfidential },
       directives: {
         glModal: {
           bind(_, { value }) {
@@ -34,27 +41,69 @@ describe('WorkItemActions component', () => {
     expect(findModal().props('visible')).toBe(false);
   });
 
-  it('shows confirm modal when clicking Delete work item', () => {
+  it('renders dropdown actions', () => {
     createComponent();
 
-    findDeleteButton().vm.$emit('click');
-
-    expect(glModalDirective).toHaveBeenCalled();
+    expect(findConfidentialityToggleButton().exists()).toBe(true);
+    expect(findDeleteButton().exists()).toBe(true);
   });
 
-  it('emits event when clicking OK button', () => {
-    createComponent();
+  describe('toggle confidentiality action', () => {
+    it.each`
+      isConfidential | buttonText
+      ${true}        | ${'Turn off confidentiality'}
+      ${false}       | ${'Turn on confidentiality'}
+    `(
+      'renders confidentiality toggle button with text "$buttonText"',
+      ({ isConfidential, buttonText }) => {
+        createComponent({ isConfidential });
 
-    findModal().vm.$emit('ok');
+        expect(findConfidentialityToggleButton().text()).toBe(buttonText);
+      },
+    );
 
-    expect(wrapper.emitted('deleteWorkItem')).toEqual([[]]);
-  });
+    it('emits `toggleWorkItemConfidentiality` event when clicked', () => {
+      createComponent();
 
-  it('does not render when canDelete is false', () => {
-    createComponent({
-      canDelete: false,
+      findConfidentialityToggleButton().vm.$emit('click');
+
+      expect(wrapper.emitted('toggleWorkItemConfidentiality')[0]).toEqual([true]);
     });
 
-    expect(wrapper.html()).toBe('');
+    it.each`
+      props                             | propName                  | value
+      ${{ isParentConfidential: true }} | ${'isParentConfidential'} | ${true}
+      ${{ canUpdate: false }}           | ${'canUpdate'}            | ${false}
+    `('does not render when $propName is $value', ({ props }) => {
+      createComponent(props);
+
+      expect(findConfidentialityToggleButton().exists()).toBe(false);
+    });
+  });
+
+  describe('delete action', () => {
+    it('shows confirm modal when clicked', () => {
+      createComponent();
+
+      findDeleteButton().vm.$emit('click');
+
+      expect(glModalDirective).toHaveBeenCalled();
+    });
+
+    it('emits event when clicking OK button', () => {
+      createComponent();
+
+      findModal().vm.$emit('ok');
+
+      expect(wrapper.emitted('deleteWorkItem')).toEqual([[]]);
+    });
+
+    it('does not render when canDelete is false', () => {
+      createComponent({
+        canDelete: false,
+      });
+
+      expect(wrapper.findByTestId('delete-action').exists()).toBe(false);
+    });
   });
 });
diff --git a/spec/frontend/work_items/components/work_item_links/work_item_links_spec.js b/spec/frontend/work_items/components/work_item_links/work_item_links_spec.js
index 0f6e31316bd..2b56cc3ca46 100644
--- a/spec/frontend/work_items/components/work_item_links/work_item_links_spec.js
+++ b/spec/frontend/work_items/components/work_item_links/work_item_links_spec.js
@@ -132,6 +132,14 @@ describe('WorkItemLinks', () => {
     expect(findFirstLinksMenu().exists()).toBe(true);
   });
 
+  it('renders confidentiality icon when child item is confidential', () => {
+    const children = wrapper.findAll('[data-testid="links-child"]');
+    const confidentialIcon = children.at(0).find('[data-testid="confidential-icon"]');
+
+    expect(confidentialIcon.exists()).toBe(true);
+    expect(confidentialIcon.props('name')).toBe('eye-slash');
+  });
+
   describe('when no permission to update', () => {
     beforeEach(async () => {
       await createComponent({ response: workItemHierarchyNoUpdatePermissionResponse });
diff --git a/spec/frontend/work_items/mock_data.js b/spec/frontend/work_items/mock_data.js
index 5e142a9e47e..0949e838b6b 100644
--- a/spec/frontend/work_items/mock_data.js
+++ b/spec/frontend/work_items/mock_data.js
@@ -25,6 +25,7 @@ export const workItemQueryResponse = {
       title: 'Test',
       state: 'OPEN',
       description: 'description',
+      confidential: false,
       workItemType: {
         __typename: 'WorkItemType',
         id: 'gid://gitlab/WorkItems::Type/5',
@@ -57,6 +58,7 @@ export const workItemQueryResponse = {
             id: 'gid://gitlab/Issue/1',
             iid: '5',
             title: 'Parent title',
+            confidential: false,
           },
           children: {
             nodes: [
@@ -82,6 +84,7 @@ export const updateWorkItemMutationResponse = {
         title: 'Updated title',
         state: 'OPEN',
         description: 'description',
+        confidential: false,
         workItemType: {
           __typename: 'WorkItemType',
           id: 'gid://gitlab/WorkItems::Type/5',
@@ -115,12 +118,23 @@ export const updateWorkItemMutationResponse = {
   },
 };
 
+export const mockParent = {
+  parent: {
+    id: 'gid://gitlab/Issue/1',
+    iid: '5',
+    title: 'Parent title',
+    confidential: false,
+  },
+};
+
 export const workItemResponseFactory = ({
   canUpdate = false,
+  canDelete = false,
   allowsMultipleAssignees = true,
   assigneesWidgetPresent = true,
   weightWidgetPresent = true,
-  parent = null,
+  confidential = false,
+  parent = mockParent.parent,
 } = {}) => ({
   data: {
     workItem: {
@@ -129,13 +143,14 @@ export const workItemResponseFactory = ({
       title: 'Updated title',
       state: 'OPEN',
       description: 'description',
+      confidential,
       workItemType: {
         __typename: 'WorkItemType',
         id: 'gid://gitlab/WorkItems::Type/5',
         name: 'Task',
       },
       userPermissions: {
-        deleteWorkItem: false,
+        deleteWorkItem: canDelete,
         updateWorkItem: canUpdate,
       },
       widgets: [
@@ -216,6 +231,7 @@ export const createWorkItemMutationResponse = {
         title: 'Updated title',
         state: 'OPEN',
         description: 'description',
+        confidential: false,
         workItemType: {
           __typename: 'WorkItemType',
           id: 'gid://gitlab/WorkItems::Type/5',
@@ -243,6 +259,7 @@ export const createWorkItemFromTaskMutationResponse = {
         id: 'gid://gitlab/WorkItem/1',
         title: 'Updated title',
         state: 'OPEN',
+        confidential: false,
         workItemType: {
           __typename: 'WorkItemType',
           id: 'gid://gitlab/WorkItems::Type/5',
@@ -267,6 +284,7 @@ export const createWorkItemFromTaskMutationResponse = {
         title: 'Updated title',
         state: 'OPEN',
         description: '',
+        confidential: false,
         workItemType: {
           __typename: 'WorkItemType',
           id: 'gid://gitlab/WorkItems::Type/5',
@@ -399,6 +417,7 @@ export const workItemHierarchyNoUpdatePermissionResponse = {
                 },
                 title: 'xyz',
                 state: 'OPEN',
+                confidential: false,
                 __typename: 'WorkItem',
               },
             ],
@@ -444,6 +463,7 @@ export const workItemHierarchyResponse = {
                 },
                 title: 'xyz',
                 state: 'OPEN',
+                confidential: true,
                 __typename: 'WorkItem',
               },
               {
@@ -454,6 +474,7 @@ export const workItemHierarchyResponse = {
                 },
                 title: 'abc',
                 state: 'CLOSED',
+                confidential: false,
                 __typename: 'WorkItem',
               },
               {
@@ -464,6 +485,7 @@ export const workItemHierarchyResponse = {
                 },
                 title: 'bar',
                 state: 'OPEN',
+                confidential: false,
                 __typename: 'WorkItem',
               },
               {
@@ -474,6 +496,7 @@ export const workItemHierarchyResponse = {
                 },
                 title: 'foobar',
                 state: 'OPEN',
+                confidential: false,
                 __typename: 'WorkItem',
               },
             ],
@@ -505,6 +528,7 @@ export const changeWorkItemParentMutationResponse = {
         id: 'gid://gitlab/WorkItem/2',
         state: 'OPEN',
         title: 'Foo',
+        confidential: false,
         widgets: [
           {
             __typename: 'WorkItemWidgetHierarchy',
@@ -662,11 +686,3 @@ export const projectLabelsResponse = {
     },
   },
 };
-
-export const mockParent = {
-  parent: {
-    id: 'gid://gitlab/Issue/1',
-    iid: '5',
-    title: 'Parent title',
-  },
-};
diff --git a/spec/frontend/work_items/pages/work_item_detail_spec.js b/spec/frontend/work_items/pages/work_item_detail_spec.js
index b85fc469c23..6d2d478eb8e 100644
--- a/spec/frontend/work_items/pages/work_item_detail_spec.js
+++ b/spec/frontend/work_items/pages/work_item_detail_spec.js
@@ -1,11 +1,12 @@
-import { GlAlert, GlSkeletonLoader, GlButton } from '@gitlab/ui';
+import { GlAlert, GlBadge, GlLoadingIcon, GlSkeletonLoader, GlButton } from '@gitlab/ui';
 import { shallowMount } from '@vue/test-utils';
-import Vue from 'vue';
+import Vue, { nextTick } from 'vue';
 import VueApollo from 'vue-apollo';
 import createMockApollo from 'helpers/mock_apollo_helper';
 import waitForPromises from 'helpers/wait_for_promises';
 import LocalStorageSync from '~/vue_shared/components/local_storage_sync.vue';
 import WorkItemDetail from '~/work_items/components/work_item_detail.vue';
+import WorkItemActions from '~/work_items/components/work_item_actions.vue';
 import WorkItemDescription from '~/work_items/components/work_item_description.vue';
 import WorkItemState from '~/work_items/components/work_item_state.vue';
 import WorkItemTitle from '~/work_items/components/work_item_title.vue';
@@ -16,6 +17,8 @@ import WorkItemInformation from '~/work_items/components/work_item_information.v
 import { i18n } from '~/work_items/constants';
 import workItemQuery from '~/work_items/graphql/work_item.query.graphql';
 import workItemTitleSubscription from '~/work_items/graphql/work_item_title.subscription.graphql';
+import updateWorkItemMutation from '~/work_items/graphql/update_work_item.mutation.graphql';
+import updateWorkItemTaskMutation from '~/work_items/graphql/update_work_item_task.mutation.graphql';
 import { temporaryConfig } from '~/work_items/graphql/provider';
 import { useLocalStorageSpy } from 'helpers/local_storage_helper';
 import {
@@ -30,12 +33,19 @@ describe('WorkItemDetail component', () => {
 
   Vue.use(VueApollo);
 
-  const workItemQueryResponse = workItemResponseFactory();
+  const workItemQueryResponse = workItemResponseFactory({ canUpdate: true, canDelete: true });
+  const workItemQueryResponseWithoutParent = workItemResponseFactory({
+    parent: null,
+    canUpdate: true,
+    canDelete: true,
+  });
   const successHandler = jest.fn().mockResolvedValue(workItemQueryResponse);
   const initialSubscriptionHandler = jest.fn().mockResolvedValue(workItemTitleSubscriptionResponse);
 
   const findAlert = () => wrapper.findComponent(GlAlert);
   const findSkeleton = () => wrapper.findComponent(GlSkeletonLoader);
+  const findLoadingIcon = () => wrapper.findComponent(GlLoadingIcon);
+  const findWorkItemActions = () => wrapper.findComponent(WorkItemActions);
   const findWorkItemTitle = () => wrapper.findComponent(WorkItemTitle);
   const findWorkItemState = () => wrapper.findComponent(WorkItemState);
   const findWorkItemDescription = () => wrapper.findComponent(WorkItemDescription);
@@ -51,17 +61,21 @@ describe('WorkItemDetail component', () => {
 
   const createComponent = ({
     isModal = false,
+    updateInProgress = false,
     workItemId = workItemQueryResponse.data.workItem.id,
     handler = successHandler,
     subscriptionHandler = initialSubscriptionHandler,
+    confidentialityMock = [updateWorkItemMutation, jest.fn()],
     workItemsMvc2Enabled = false,
     includeWidgets = false,
+    error = undefined,
   } = {}) => {
     wrapper = shallowMount(WorkItemDetail, {
       apolloProvider: createMockApollo(
         [
           [workItemQuery, handler],
           [workItemTitleSubscription, subscriptionHandler],
+          confidentialityMock,
         ],
         {},
         {
@@ -69,6 +83,12 @@ describe('WorkItemDetail component', () => {
         },
       ),
       propsData: { isModal, workItemId },
+      data() {
+        return {
+          updateInProgress,
+          error,
+        };
+      },
       provide: {
         glFeatures: {
           workItemsMvc2: workItemsMvc2Enabled,
@@ -146,6 +166,145 @@ describe('WorkItemDetail component', () => {
     });
   });
 
+  describe('confidentiality', () => {
+    const errorMessage = 'Mutation failed';
+    const confidentialWorkItem = workItemResponseFactory({
+      confidential: true,
+    });
+
+    // Mocks for work item without parent
+    const withoutParentExpectedInputVars = {
+      id: workItemQueryResponse.data.workItem.id,
+      confidential: true,
+    };
+    const toggleConfidentialityWithoutParentHandler = jest.fn().mockResolvedValue({
+      data: {
+        workItemUpdate: {
+          workItem: confidentialWorkItem.data.workItem,
+          errors: [],
+        },
+      },
+    });
+    const withoutParentHandlerMock = jest
+      .fn()
+      .mockResolvedValue(workItemQueryResponseWithoutParent);
+    const confidentialityWithoutParentMock = [
+      updateWorkItemMutation,
+      toggleConfidentialityWithoutParentHandler,
+    ];
+    const confidentialityWithoutParentFailureMock = [
+      updateWorkItemMutation,
+      jest.fn().mockRejectedValue(new Error(errorMessage)),
+    ];
+
+    // Mocks for work item with parent
+    const withParentExpectedInputVars = {
+      id: mockParent.parent.id,
+      taskData: { id: workItemQueryResponse.data.workItem.id, confidential: true },
+    };
+    const toggleConfidentialityWithParentHandler = jest.fn().mockResolvedValue({
+      data: {
+        workItemUpdate: {
+          workItem: {
+            id: confidentialWorkItem.data.workItem.id,
+            descriptionHtml: confidentialWorkItem.data.workItem.description,
+          },
+          task: {
+            workItem: confidentialWorkItem.data.workItem,
+            confidential: true,
+          },
+          errors: [],
+        },
+      },
+    });
+    const confidentialityWithParentMock = [
+      updateWorkItemTaskMutation,
+      toggleConfidentialityWithParentHandler,
+    ];
+    const confidentialityWithParentFailureMock = [
+      updateWorkItemTaskMutation,
+      jest.fn().mockRejectedValue(new Error(errorMessage)),
+    ];
+
+    describe.each`
+      context        | handlerMock                 | confidentialityMock                 | confidentialityFailureMock                 | inputVariables
+      ${'no parent'} | ${withoutParentHandlerMock} | ${confidentialityWithoutParentMock} | ${confidentialityWithoutParentFailureMock} | ${withoutParentExpectedInputVars}
+      ${'parent'}    | ${successHandler}           | ${confidentialityWithParentMock}    | ${confidentialityWithParentFailureMock}    | ${withParentExpectedInputVars}
+    `(
+      'when work item has $context',
+      ({ handlerMock, confidentialityMock, confidentialityFailureMock, inputVariables }) => {
+        it('renders confidential badge when work item is confidential', async () => {
+          createComponent({
+            handler: jest.fn().mockResolvedValue(confidentialWorkItem),
+            confidentialityMock,
+          });
+
+          await waitForPromises();
+
+          const confidentialBadge = wrapper.findComponent(GlBadge);
+          expect(confidentialBadge.exists()).toBe(true);
+          expect(confidentialBadge.props()).toMatchObject({
+            variant: 'warning',
+            icon: 'eye-slash',
+          });
+          expect(confidentialBadge.text()).toBe('Confidential');
+        });
+
+        it('renders gl-loading-icon while update mutation is in progress', async () => {
+          createComponent({
+            handler: handlerMock,
+            confidentialityMock,
+          });
+
+          await waitForPromises();
+
+          findWorkItemActions().vm.$emit('toggleWorkItemConfidentiality', true);
+
+          await nextTick();
+
+          expect(findLoadingIcon().exists()).toBe(true);
+        });
+
+        it('emits workItemUpdated and shows confidentiality badge when mutation is successful', async () => {
+          createComponent({
+            handler: handlerMock,
+            confidentialityMock,
+          });
+
+          await waitForPromises();
+
+          findWorkItemActions().vm.$emit('toggleWorkItemConfidentiality', true);
+          await waitForPromises();
+
+          expect(wrapper.emitted('workItemUpdated')).toEqual([[{ confidential: true }]]);
+          expect(confidentialityMock[1]).toHaveBeenCalledWith({
+            input: inputVariables,
+          });
+          expect(findLoadingIcon().exists()).toBe(false);
+        });
+
+        it('shows alert message when mutation fails', async () => {
+          createComponent({
+            handler: handlerMock,
+            confidentialityMock: confidentialityFailureMock,
+          });
+
+          await waitForPromises();
+          findWorkItemActions().vm.$emit('toggleWorkItemConfidentiality', true);
+          await waitForPromises();
+
+          expect(wrapper.emitted('workItemUpdated')).toBeFalsy();
+
+          await nextTick();
+
+          expect(findAlert().exists()).toBe(true);
+          expect(findAlert().text()).toBe(errorMessage);
+          expect(findLoadingIcon().exists()).toBe(false);
+        });
+      },
+    );
+  });
+
   describe('description', () => {
     it('does not show description widget if loading description fails', () => {
       createComponent();
@@ -169,7 +328,7 @@ describe('WorkItemDetail component', () => {
     });
 
     it('does not show secondary breadcrumbs if there is not a parent', async () => {
-      createComponent();
+      createComponent({ handler: jest.fn().mockResolvedValue(workItemQueryResponseWithoutParent) });
 
       await waitForPromises();
 
@@ -177,7 +336,7 @@ describe('WorkItemDetail component', () => {
     });
 
     it('shows work item type if there is not a parent', async () => {
-      createComponent();
+      createComponent({ handler: jest.fn().mockResolvedValue(workItemQueryResponseWithoutParent) });
 
       await waitForPromises();
       expect(findWorkItemType().exists()).toBe(true);
diff --git a/spec/graphql/types/ci/variable_input_type_spec.rb b/spec/graphql/types/ci/variable_input_type_spec.rb
new file mode 100644
index 00000000000..a56b6287dee
--- /dev/null
+++ b/spec/graphql/types/ci/variable_input_type_spec.rb
@@ -0,0 +1,11 @@
+# frozen_string_literal: true
+
+require 'spec_helper'
+
+RSpec.describe GitlabSchema.types['CiVariableInput'] do
+  include GraphqlHelpers
+
+  it 'has the correct arguments' do
+    expect(described_class.arguments.keys).to match_array(%w[key value])
+  end
+end
diff --git a/spec/lib/container_registry/gitlab_api_client_spec.rb b/spec/lib/container_registry/gitlab_api_client_spec.rb
index f2c627734a3..7836d8706f6 100644
--- a/spec/lib/container_registry/gitlab_api_client_spec.rb
+++ b/spec/lib/container_registry/gitlab_api_client_spec.rb
@@ -212,6 +212,105 @@ RSpec.describe ContainerRegistry::GitlabApiClient do
     end
   end
 
+  describe '#tags' do
+    let(:path) { 'namespace/path/to/repository' }
+    let(:page_size) { 100 }
+    let(:last) { nil }
+    let(:response) do
+      [
+        {
+          name: '0.1.0',
+          digest: 'sha256:1234567890',
+          media_type: 'application/vnd.oci.image.manifest.v1+json',
+          size_bytes: 1234567890,
+          created_at: 5.minutes.ago
+        },
+        {
+          name: 'latest',
+          digest: 'sha256:1234567892',
+          media_type: 'application/vnd.oci.image.manifest.v1+json',
+          size_bytes: 1234567892,
+          created_at: 10.minutes.ago
+        }
+      ]
+    end
+
+    subject { client.tags(path, page_size: page_size, last: last) }
+
+    context 'with valid parameters' do
+      let(:expected) do
+        {
+          pagination: {},
+          response_body: ::Gitlab::Json.parse(response.to_json)
+        }
+      end
+
+      before do
+        stub_tags(path, page_size: page_size, respond_with: response)
+      end
+
+      it { is_expected.to eq(expected) }
+    end
+
+    context 'with a response with a link header' do
+      let(:next_page_url) { 'http://sandbox.org/test?last=b' }
+      let(:expected) do
+        {
+          pagination: { next: { uri: URI(next_page_url) } },
+          response_body: ::Gitlab::Json.parse(response.to_json)
+        }
+      end
+
+      before do
+        stub_tags(path, page_size: page_size, next_page_url: next_page_url, respond_with: response)
+      end
+
+      it { is_expected.to eq(expected) }
+    end
+
+    context 'with a large page size set' do
+      let(:page_size) { described_class::MAX_TAGS_PAGE_SIZE + 1000 }
+
+      let(:expected) do
+        {
+          pagination: {},
+          response_body: ::Gitlab::Json.parse(response.to_json)
+        }
+      end
+
+      before do
+        stub_tags(path, page_size: described_class::MAX_TAGS_PAGE_SIZE, respond_with: response)
+      end
+
+      it { is_expected.to eq(expected) }
+    end
+
+    context 'with a last parameter set' do
+      let(:last) { 'test' }
+
+      let(:expected) do
+        {
+          pagination: {},
+          response_body: ::Gitlab::Json.parse(response.to_json)
+        }
+      end
+
+      before do
+        stub_tags(path, page_size: page_size, last: last, respond_with: response)
+      end
+
+      it { is_expected.to eq(expected) }
+    end
+
+    context 'with non successful response' do
+      before do
+        stub_tags(path, page_size: page_size, status_code: 404)
+      end
+
+      it { is_expected.to eq({}) }
+    end
+  end
+
   describe '.supports_gitlab_api?' do
     subject { described_class.supports_gitlab_api? }
 
@@ -389,4 +488,30 @@ RSpec.describe ContainerRegistry::GitlabApiClient do
       .with(headers: headers)
       .to_return(status: status_code, body: respond_with.to_json, headers: { 'Content-Type' => described_class::JSON_TYPE })
   end
+
+  def stub_tags(path, page_size: nil, last: nil, next_page_url: nil, status_code: 200, respond_with: {})
+    params = { n: page_size, last: last }.compact
+
+    url = "#{registry_api_url}/gitlab/v1/repositories/#{path}/tags/list/"
+
+    if params.present?
+      url += "?#{params.map { |param, val| "#{param}=#{val}" }.join('&')}"
+    end
+
+    request_headers = { 'Accept' => described_class::JSON_TYPE }
+    request_headers['Authorization'] = "bearer #{token}" if token
+
+    response_headers = { 'Content-Type' => described_class::JSON_TYPE }
+    if next_page_url
+      response_headers['Link'] = "<#{next_page_url}>; rel=\"next\""
+    end
+
+    stub_request(:get, url)
+      .with(headers: request_headers)
+      .to_return(
+        status: status_code,
+        body: respond_with.to_json,
+        headers: response_headers
+      )
+  end
 end
diff --git a/spec/lib/container_registry/tag_spec.rb b/spec/lib/container_registry/tag_spec.rb
index 9b931ab6dbc..190ddef0cd5 100644
--- a/spec/lib/container_registry/tag_spec.rb
+++ b/spec/lib/container_registry/tag_spec.rb
@@ -205,6 +205,41 @@ RSpec.describe ContainerRegistry::Tag do
 
           it_behaves_like 'a processable'
         end
+
+        describe '#force_created_at_from_iso8601' do
+          subject { tag.force_created_at_from_iso8601(input) }
+
+          shared_examples 'setting and caching the created_at value' do
+            it 'sets and caches the created_at value' do
+              expect(tag).not_to receive(:config)
+
+              subject
+
+              expect(tag.created_at).to eq(expected_value)
+            end
+          end
+
+          context 'with a valid input' do
+            let(:input) { 2.days.ago.iso8601 }
+            let(:expected_value) { DateTime.iso8601(input) }
+
+            it_behaves_like 'setting and caching the created_at value'
+          end
+
+          context 'with a nil input' do
+            let(:input) { nil }
+            let(:expected_value) { nil }
+
+            it_behaves_like 'setting and caching the created_at value'
+          end
+
+          context 'with an invalid input' do
+            let(:input) { 'not a timestamp' }
+            let(:expected_value) { nil }
+
+            it_behaves_like 'setting and caching the created_at value'
+          end
+        end
       end
     end
   end
diff --git a/spec/lib/gitlab/ci/parsers/sbom/cyclonedx_spec.rb b/spec/lib/gitlab/ci/parsers/sbom/cyclonedx_spec.rb
index cb6d8b62f94..431fe9f3591 100644
--- a/spec/lib/gitlab/ci/parsers/sbom/cyclonedx_spec.rb
+++ b/spec/lib/gitlab/ci/parsers/sbom/cyclonedx_spec.rb
@@ -18,7 +18,7 @@ RSpec.describe Gitlab::Ci::Parsers::Sbom::Cyclonedx do
     }
   end
 
-  subject(:parse!) { described_class.new(raw_report_data, report).parse! }
+  subject(:parse!) { described_class.new.parse!(raw_report_data, report) }
 
   before do
     allow_next_instance_of(Gitlab::Ci::Parsers::Sbom::Validators::CyclonedxSchemaValidator) do |validator|
diff --git a/spec/lib/gitlab/ci/reports/sbom/reports_spec.rb b/spec/lib/gitlab/ci/reports/sbom/reports_spec.rb
new file mode 100644
index 00000000000..97d8d7abb33
--- /dev/null
+++ b/spec/lib/gitlab/ci/reports/sbom/reports_spec.rb
@@ -0,0 +1,21 @@
+# frozen_string_literal: true
+
+require 'spec_helper'
+
+RSpec.describe Gitlab::Ci::Reports::Sbom::Reports do
+  subject(:reports_list) { described_class.new }
+
+  describe '#add_report' do
+    let(:rep1) { Gitlab::Ci::Reports::Sbom::Report.new }
+    let(:rep2) { Gitlab::Ci::Reports::Sbom::Report.new }
+
+    it 'appends the report to the report list' do
+      reports_list.add_report(rep1)
+      reports_list.add_report(rep2)
+
+      expect(reports_list.reports.length).to eq(2)
+      expect(reports_list.reports.first).to eq(rep1)
+      expect(reports_list.reports.last).to eq(rep2)
+    end
+  end
+end
diff --git a/spec/lib/gitlab/utils/link_header_parser_spec.rb b/spec/lib/gitlab/utils/link_header_parser_spec.rb
new file mode 100644
index 00000000000..e15ef930271
--- /dev/null
+++ b/spec/lib/gitlab/utils/link_header_parser_spec.rb
@@ -0,0 +1,75 @@
+# frozen_string_literal: true
+
+require 'fast_spec_helper'
+
+RSpec.describe Gitlab::Utils::LinkHeaderParser do
+  let(:parser) { described_class.new(header) }
+
+  describe '#parse' do
+    subject { parser.parse }
+
+    context 'with a valid header' do
+      let(:header) { generate_header(next: 'http://sandbox.org/next') }
+      let(:expected) { { next: { uri: URI('http://sandbox.org/next') } } }
+
+      it { is_expected.to eq(expected) }
+
+      context 'with multiple links' do
+        let(:header) { generate_header(next: 'http://sandbox.org/next', previous: 'http://sandbox.org/previous') }
+        let(:expected) do
+          {
+            next: { uri: URI('http://sandbox.org/next') },
+            previous: { uri: URI('http://sandbox.org/previous') }
+          }
+        end
+
+        it { is_expected.to eq(expected) }
+      end
+
+      context 'with an incomplete uri' do
+        let(:header) { '<http://sandbox.org/next; rel="next"' }
+
+        it { is_expected.to eq({}) }
+      end
+
+      context 'with no rel' do
+        let(:header) { '<http://sandbox.org/next>; direction="next"' }
+
+        it { is_expected.to eq({}) }
+      end
+
+      context 'with multiple rel elements' do
+        # check https://datatracker.ietf.org/doc/html/rfc5988#section-5.3:
+        # occurrences after the first MUST be ignored by parsers
+        let(:header) { '<http://sandbox.org/next>; rel="next"; rel="dummy"' }
+
+        it { is_expected.to eq(expected) }
+      end
+
+      context 'when the url is too long' do
+        let(:header) { "<http://sandbox.org/#{'a' * 500}>; rel=\"next\"" }
+
+        it { is_expected.to eq({}) }
+      end
+    end
+
+    context 'with nil header' do
+      let(:header) { nil }
+
+      it { is_expected.to eq({}) }
+    end
+
+    context 'with empty header' do
+      let(:header) { '' }
+
+      it { is_expected.to eq({}) }
+    end
+
+    def generate_header(links)
+      stringified_links = links.map do |rel, url|
+        "<#{url}>; rel=\"#{rel}\""
+      end
+      stringified_links.join(', ')
+    end
+  end
+end
diff --git a/spec/models/ci/build_spec.rb b/spec/models/ci/build_spec.rb
index 3c9e831f7c7..185bf3e8164 100644
--- a/spec/models/ci/build_spec.rb
+++ b/spec/models/ci/build_spec.rb
@@ -5609,4 +5609,58 @@ RSpec.describe Ci::Build do
     let!(:model) { create(:ci_build, user: create(:user)) }
     let!(:parent) { model.user }
   end
+
+  describe '#clone' do
+    let_it_be(:user) { FactoryBot.build(:user) }
+
+    context 'when given new job variables' do
+      context 'when the cloned build has an action' do
+        it 'applies the new job variables' do
+          build = create(:ci_build, :actionable)
+          create(:ci_job_variable, job: build, key: 'TEST_KEY', value: 'old value')
+          create(:ci_job_variable, job: build, key: 'OLD_KEY', value: 'i will not live for long')
+
+          new_build = build.clone(current_user: user, new_job_variables_attributes: [
+            { key: 'TEST_KEY', value: 'new value' },
+            { key: 'NEW_KEY', value: 'exciting new value' }
+          ])
+          new_build.save!
+
+          expect(new_build.job_variables.count).to be(2)
+          expect(new_build.job_variables.pluck(:key)).to contain_exactly('TEST_KEY', 'NEW_KEY')
+          expect(new_build.job_variables.map(&:value)).to contain_exactly('new value', 'exciting new value')
+        end
+      end
+
+      context 'when the cloned build does not have an action' do
+        it 'applies the old job variables' do
+          build = create(:ci_build)
+          create(:ci_job_variable, job: build, key: 'TEST_KEY', value: 'old value')
+
+          new_build = build.clone(current_user: user, new_job_variables_attributes: [
+            { key: 'TEST_KEY', value: 'new value' }
+          ])
+          new_build.save!
+
+          expect(new_build.job_variables.count).to be(1)
+          expect(new_build.job_variables.pluck(:key)).to contain_exactly('TEST_KEY')
+          expect(new_build.job_variables.map(&:value)).to contain_exactly('old value')
+        end
+      end
+    end
+
+    context 'when not given new job variables' do
+      it 'applies the old job variables' do
+        build = create(:ci_build)
+        create(:ci_job_variable, job: build, key: 'TEST_KEY', value: 'old value')
+
+        new_build = build.clone(current_user: user)
+        new_build.save!
+
+        expect(new_build.job_variables.count).to be(1)
+        expect(new_build.job_variables.pluck(:key)).to contain_exactly('TEST_KEY')
+        expect(new_build.job_variables.map(&:value)).to contain_exactly('old value')
+      end
+    end
+  end
 end
diff --git a/spec/models/container_repository_spec.rb b/spec/models/container_repository_spec.rb
index d85edf5595b..a4329993e91 100644
--- a/spec/models/container_repository_spec.rb
+++ b/spec/models/container_repository_spec.rb
@@ -525,6 +525,162 @@ RSpec.describe ContainerRepository, :aggregate_failures do
     end
   end
 
+  describe '#each_tags_page' do
+    let(:page_size) { 100 }
+
+    shared_examples 'iterating through a page' do |expected_tags: true|
+      it 'iterates through one page' do
+        expect(repository.gitlab_api_client).to receive(:tags)
+                                                  .with(repository.path, page_size: page_size, last: nil)
+                                                  .and_return(client_response)
+        expect { |b| repository.each_tags_page(page_size: page_size, &b) }
+          .to yield_with_args(expected_tags ? expected_tags_from(client_response_tags) : [])
+      end
+    end
+
+    context 'with an empty page' do
+      let(:client_response) { { pagination: {}, response_body: [] } }
+
+      it_behaves_like 'iterating through a page', expected_tags: false
+    end
+
+    context 'with one page' do
+      let(:client_response) { { pagination: {}, response_body: client_response_tags } }
+      let(:client_response_tags) do
+        [
+          {
+            'name' => '0.1.0',
+            'created_at' => '2022-06-07T12:10:12.412+00:00'
+          },
+          {
+            'name' => 'latest',
+            'created_at' => '2022-06-07T12:11:13.633+00:00'
+          }
+        ]
+      end
+
+      context 'with a nil created_at' do
+        let(:client_response_tags) { ['name' => '0.1.0', 'created_at' => nil] }
+
+        it_behaves_like 'iterating through a page'
+      end
+
+      context 'with an invalid created_at' do
+        let(:client_response_tags) { ['name' => '0.1.0', 'created_at' => 'not_a_timestamp'] }
+
+        it_behaves_like 'iterating through a page'
+      end
+    end
+
+    context 'with two pages' do
+      let(:client_response1) { { pagination: { next: { uri: URI('http://localhost/next?last=latest') } }, response_body: client_response_tags1 } }
+      let(:client_response_tags1) do
+        [
+          {
+            'name' => '0.1.0',
+            'created_at' => '2022-06-07T12:10:12.412+00:00'
+          },
+          {
+            'name' => 'latest',
+            'created_at' => '2022-06-07T12:11:13.633+00:00'
+          }
+        ]
+      end
+
+      let(:client_response2) { { pagination: {}, response_body: client_response_tags2 } }
+      let(:client_response_tags2) do
+        [
+          {
+            'name' => '1.2.3',
+            'created_at' => '2022-06-10T12:10:15.412+00:00'
+          },
+          {
+            'name' => '2.3.4',
+            'created_at' => '2022-06-11T12:11:17.633+00:00'
+          }
+        ]
+      end
+
+      it 'iterates through two pages' do
+        expect(repository.gitlab_api_client).to receive(:tags)
+                                                  .with(repository.path, page_size: page_size, last: nil)
+                                                  .and_return(client_response1)
+        expect(repository.gitlab_api_client).to receive(:tags)
+                                                  .with(repository.path, page_size: page_size, last: 'latest')
+                                                  .and_return(client_response2)
+        expect { |b| repository.each_tags_page(page_size: page_size, &b) }
+          .to yield_successive_args(expected_tags_from(client_response_tags1), expected_tags_from(client_response_tags2))
+      end
+    end
+
+    context 'when max pages is reached' do
+      before do
+        stub_const('ContainerRepository::MAX_TAGS_PAGES', 0)
+      end
+
+      it 'raises an error' do
+        expect { repository.each_tags_page(page_size: page_size) {} }
+          .to raise_error(StandardError, 'too many pages requested')
+      end
+    end
+
+    context 'without a block set' do
+      it 'raises an Argument error' do
+        expect { repository.each_tags_page(page_size: page_size) }.to raise_error(ArgumentError, 'block not given')
+      end
+    end
+
+    context 'without a page size set' do
+      let(:client_response) { { pagination: {}, response_body: [] } }
+
+      it 'uses a default size' do
+        expect(repository.gitlab_api_client).to receive(:tags)
+                                                  .with(repository.path, page_size: 100, last: nil)
+                                                  .and_return(client_response)
+        expect { |b| repository.each_tags_page(&b) }.to yield_with_args([])
+      end
+    end
+
+    context 'with an empty client response' do
+      let(:client_response) { {} }
+
+      it 'breaks the loop' do
+        expect(repository.gitlab_api_client).to receive(:tags)
+                                                  .with(repository.path, page_size: page_size, last: nil)
+                                                  .and_return(client_response)
+        expect { |b| repository.each_tags_page(page_size: page_size, &b) }.not_to yield_control
+      end
+    end
+
+    context 'with a nil page' do
+      let(:client_response) { { pagination: {}, response_body: nil } }
+
+      it_behaves_like 'iterating through a page', expected_tags: false
+    end
+
+    context 'calling on a non migrated repository' do
+      before do
+        repository.update!(created_at: described_class::MIGRATION_PHASE_1_ENDED_AT - 3.days)
+      end
+
+      it 'raises an Argument error' do
+        expect { repository.each_tags_page }.to raise_error(ArgumentError, 'not a migrated repository')
+      end
+    end
+
+    def expected_tags_from(client_tags)
+      client_tags.map do |tag|
+        created_at =
+          begin
+            DateTime.iso8601(tag['created_at'])
+          rescue ArgumentError
+            nil
+          end
+        an_object_having_attributes(name: tag['name'], created_at: created_at)
+      end
+    end
+  end
+
   describe '#tags_count' do
     it 'returns the count of tags' do
       expect(repository.tags_count).to eq(1)
@@ -1348,6 +1504,28 @@ RSpec.describe ContainerRepository, :aggregate_failures do
     end
   end
 
+  describe '#migrated?' do
+    subject { repository.migrated? }
+
+    it { is_expected.to eq(true) }
+
+    context 'with a created_at older than phase 1 ends' do
+      before do
+        repository.update!(created_at: described_class::MIGRATION_PHASE_1_ENDED_AT - 3.days)
+      end
+
+      it { is_expected.to eq(false) }
+
+      context 'with migration state set to import_done' do
+        before do
+          repository.update!(migration_state: 'import_done')
+        end
+
+        it { is_expected.to eq(true) }
+      end
+    end
+  end
+
   context 'with repositories' do
     let_it_be_with_reload(:repository) { create(:container_repository, :cleanup_unscheduled) }
     let_it_be(:other_repository) { create(:container_repository, :cleanup_unscheduled) }
diff --git a/spec/requests/api/graphql/ci/manual_variables_spec.rb b/spec/requests/api/graphql/ci/manual_variables_spec.rb
index b7aa76511a3..a15bac2b8bd 100644
--- a/spec/requests/api/graphql/ci/manual_variables_spec.rb
+++ b/spec/requests/api/graphql/ci/manual_variables_spec.rb
@@ -35,8 +35,8 @@ RSpec.describe 'Query.project(fullPath).pipelines.jobs.manualVariables' do
     project.add_maintainer(user)
   end
 
-  it 'returns the manual variables for the jobs' do
-    job = create(:ci_build, :manual, pipeline: pipeline)
+  it 'returns the manual variables for actionable jobs' do
+    job = create(:ci_build, :actionable, pipeline: pipeline)
     create(:ci_job_variable, key: 'MANUAL_TEST_VAR', job: job)
 
     post_graphql(query, current_user: user)
@@ -46,8 +46,8 @@ RSpec.describe 'Query.project(fullPath).pipelines.jobs.manualVariables' do
     expect(variables_data.map { |var| var['key'] }).to match_array(['MANUAL_TEST_VAR'])
   end
 
-  it 'does not fetch job variables for jobs that are not manual' do
-    job = create(:ci_build, pipeline: pipeline)
+  it 'does not fetch job variables for jobs that are not actionable' do
+    job = create(:ci_build, pipeline: pipeline, status: :manual)
     create(:ci_job_variable, key: 'THIS_VAR_WOULD_SHOULD_NEVER_EXIST', job: job)
 
     post_graphql(query, current_user: user)
diff --git a/spec/requests/api/graphql/mutations/ci/job_retry_spec.rb b/spec/requests/api/graphql/mutations/ci/job_retry_spec.rb
index ef640183bd8..8cf559a372a 100644
--- a/spec/requests/api/graphql/mutations/ci/job_retry_spec.rb
+++ b/spec/requests/api/graphql/mutations/ci/job_retry_spec.rb
@@ -47,6 +47,38 @@ RSpec.describe 'JobRetry' do
     expect(new_job).not_to be_retried
   end
 
+  context 'when given CI variables' do
+    let(:job) { create(:ci_build, :success, :actionable, pipeline: pipeline, name: 'build') }
+
+    let(:mutation) do
+      variables = {
+        id: job.to_global_id.to_s,
+        variables: { key: 'MANUAL_VAR', value: 'test manual var' }
+      }
+
+      graphql_mutation(:job_retry, variables,
+                      <<-QL
+                        errors
+                        job {
+                          id
+                        }
+                      QL
+      )
+    end
+
+    it 'applies them to a retried manual job' do
+      post_graphql_mutation(mutation, current_user: user)
+
+      expect(response).to have_gitlab_http_status(:success)
+
+      new_job_id = GitlabSchema.object_from_id(mutation_response['job']['id']).sync.id
+      new_job = ::Ci::Build.find(new_job_id)
+      expect(new_job.job_variables.count).to be(1)
+      expect(new_job.job_variables.first.key).to eq('MANUAL_VAR')
+      expect(new_job.job_variables.first.value).to eq('test manual var')
+    end
+  end
+
   context 'when the job is not retryable' do
     let(:job) { create(:ci_build, :retried, pipeline: pipeline) }
 
diff --git a/spec/services/ci/retry_job_service_spec.rb b/spec/services/ci/retry_job_service_spec.rb
index f042471bd1f..b14e4187c7a 100644
--- a/spec/services/ci/retry_job_service_spec.rb
+++ b/spec/services/ci/retry_job_service_spec.rb
@@ -17,6 +17,7 @@ RSpec.describe Ci::RetryJobService do
                              name: 'test')
   end
 
+  let(:job_variables_attributes) { [{ key: 'MANUAL_VAR', value: 'manual test var' }] }
   let(:user) { developer }
 
   let(:service) { described_class.new(project, user) }
@@ -206,6 +207,14 @@ RSpec.describe Ci::RetryJobService do
       include_context 'retryable bridge'
 
       it_behaves_like 'clones the job'
+
+      context 'when given variables' do
+        let(:new_job) { service.clone!(job, variables: job_variables_attributes) }
+
+        it 'does not give variables to the new bridge' do
+          expect { new_job }.not_to raise_error
+        end
+      end
     end
 
     context 'when the job to be cloned is a build' do
@@ -250,6 +259,28 @@ RSpec.describe Ci::RetryJobService do
           expect { new_job }.not_to change { Environment.count }
         end
       end
+
+      context 'when given variables' do
+        let(:new_job) { service.clone!(job, variables: job_variables_attributes) }
+
+        context 'when the build is actionable' do
+          let_it_be_with_refind(:job) { create(:ci_build, :actionable, pipeline: pipeline) }
+
+          it 'gives variables to the new build' do
+            expect(new_job.job_variables.count).to be(1)
+            expect(new_job.job_variables.first.key).to eq('MANUAL_VAR')
+            expect(new_job.job_variables.first.value).to eq('manual test var')
+          end
+        end
+
+        context 'when the build is not actionable' do
+          let_it_be_with_refind(:job) { create(:ci_build, pipeline: pipeline) }
+
+          it 'does not give variables to the new build' do
+            expect(new_job.job_variables.count).to be_zero
+          end
+        end
+      end
     end
   end
 
@@ -260,6 +291,14 @@ RSpec.describe Ci::RetryJobService do
       include_context 'retryable bridge'
 
       it_behaves_like 'retries the job'
+
+      context 'when given variables' do
+        let(:new_job) { service.clone!(job, variables: job_variables_attributes) }
+
+        it 'does not give variables to the new bridge' do
+          expect { new_job }.not_to raise_error
+        end
+      end
     end
 
     context 'when the job to be retried is a build' do
@@ -288,6 +327,28 @@ RSpec.describe Ci::RetryJobService do
           expect { service.execute(job) }.not_to exceed_all_query_limit(control_count)
         end
       end
+
+      context 'when given variables' do
+        let(:new_job) { service.clone!(job, variables: job_variables_attributes) }
+
+        context 'when the build is actionable' do
+          let_it_be_with_refind(:job) { create(:ci_build, :actionable, pipeline: pipeline) }
+
+          it 'gives variables to the new build' do
+            expect(new_job.job_variables.count).to be(1)
+            expect(new_job.job_variables.first.key).to eq('MANUAL_VAR')
+            expect(new_job.job_variables.first.value).to eq('manual test var')
+          end
+        end
+
+        context 'when the build is not actionable' do
+          let_it_be_with_refind(:job) { create(:ci_build, pipeline: pipeline) }
+
+          it 'does not give variables to the new build' do
+            expect(new_job.job_variables.count).to be_zero
+          end
+        end
+      end
     end
   end
 end