diff --git a/.haml-lint_todo.yml b/.haml-lint_todo.yml
index 12505521435..c83d5420a4d 100644
--- a/.haml-lint_todo.yml
+++ b/.haml-lint_todo.yml
@@ -214,7 +214,6 @@ linters:
       - 'app/views/projects/mattermosts/_team_selection.html.haml'
       - 'app/views/projects/mattermosts/new.html.haml'
       - 'app/views/projects/merge_requests/_commits.html.haml'
-      - 'app/views/projects/merge_requests/_how_to_merge.html.haml'
       - 'app/views/projects/merge_requests/_mr_title.html.haml'
       - 'app/views/projects/merge_requests/conflicts/_commit_stats.html.haml'
       - 'app/views/projects/merge_requests/conflicts/_file_actions.html.haml'
diff --git a/GITALY_SERVER_VERSION b/GITALY_SERVER_VERSION
index 857ea235035..895e4e48247 100644
--- a/GITALY_SERVER_VERSION
+++ b/GITALY_SERVER_VERSION
@@ -1 +1 @@
-9677be26e1a7f7e4f56bf4f7ba47bc0d16f40e16
+ae38755015839b67292e5f550a9a4fd72c3c1a56
diff --git a/app/assets/javascripts/boards/components/board_assignee_dropdown.vue b/app/assets/javascripts/boards/components/board_assignee_dropdown.vue
index 231cde0d24f..b4a9d34e738 100644
--- a/app/assets/javascripts/boards/components/board_assignee_dropdown.vue
+++ b/app/assets/javascripts/boards/components/board_assignee_dropdown.vue
@@ -1,5 +1,5 @@
 <script>
-import { mapActions, mapGetters } from 'vuex';
+import { mapActions, mapGetters, mapState } from 'vuex';
 import { cloneDeep } from 'lodash';
 import {
   GlDropdownItem,
@@ -75,6 +75,7 @@ export default {
   },
   computed: {
     ...mapGetters(['activeIssue']),
+    ...mapState(['isSettingAssignees']),
     assigneeText() {
       return n__('Assignee', '%d Assignees', this.selected.length);
     },
@@ -131,7 +132,7 @@ export default {
 </script>
 
 <template>
-  <board-editable-item :title="assigneeText" @close="saveAssignees">
+  <board-editable-item :loading="isSettingAssignees" :title="assigneeText" @close="saveAssignees">
     <template #collapsed>
       <issuable-assignees :users="selected" @assign-self="assignSelf" />
     </template>
diff --git a/app/assets/javascripts/boards/stores/actions.js b/app/assets/javascripts/boards/stores/actions.js
index 2b6d606c56e..fd5049ef9bc 100644
--- a/app/assets/javascripts/boards/stores/actions.js
+++ b/app/assets/javascripts/boards/stores/actions.js
@@ -320,6 +320,8 @@ export default {
   },
 
   setAssignees: ({ commit, getters }, assigneeUsernames) => {
+    commit(types.SET_ASSIGNEE_LOADING, true);
+
     return gqlClient
       .mutate({
         mutation: updateAssignees,
@@ -339,6 +341,9 @@ export default {
         });
 
         return nodes;
+      })
+      .finally(() => {
+        commit(types.SET_ASSIGNEE_LOADING, false);
       });
   },
 
diff --git a/app/assets/javascripts/boards/stores/mutation_types.js b/app/assets/javascripts/boards/stores/mutation_types.js
index 3a57cb9b5e1..2b2c2bee51c 100644
--- a/app/assets/javascripts/boards/stores/mutation_types.js
+++ b/app/assets/javascripts/boards/stores/mutation_types.js
@@ -34,4 +34,5 @@ export const SET_CURRENT_PAGE = 'SET_CURRENT_PAGE';
 export const TOGGLE_EMPTY_STATE = 'TOGGLE_EMPTY_STATE';
 export const SET_ACTIVE_ID = 'SET_ACTIVE_ID';
 export const UPDATE_ISSUE_BY_ID = 'UPDATE_ISSUE_BY_ID';
+export const SET_ASSIGNEE_LOADING = 'SET_ASSIGNEE_LOADING';
 export const RESET_ISSUES = 'RESET_ISSUES';
diff --git a/app/assets/javascripts/boards/stores/mutations.js b/app/assets/javascripts/boards/stores/mutations.js
index bb083158c8f..efe6c2042af 100644
--- a/app/assets/javascripts/boards/stores/mutations.js
+++ b/app/assets/javascripts/boards/stores/mutations.js
@@ -143,6 +143,10 @@ export default {
     Vue.set(state.issues[issueId], prop, value);
   },
 
+  [mutationTypes.SET_ASSIGNEE_LOADING](state, isLoading) {
+    state.isSettingAssignees = isLoading;
+  },
+
   [mutationTypes.REQUEST_ADD_ISSUE]: () => {
     notImplemented();
   },
diff --git a/app/assets/javascripts/boards/stores/state.js b/app/assets/javascripts/boards/stores/state.js
index b91c09f8051..6f29115aebd 100644
--- a/app/assets/javascripts/boards/stores/state.js
+++ b/app/assets/javascripts/boards/stores/state.js
@@ -11,6 +11,7 @@ export default () => ({
   boardLists: {},
   listsFlags: {},
   issuesByListId: {},
+  isSettingAssignees: false,
   pageInfoByListId: {},
   issues: {},
   filterParams: {},
diff --git a/app/assets/javascripts/close_reopen_report_toggle.js b/app/assets/javascripts/close_reopen_report_toggle.js
deleted file mode 100644
index 9bbbe07e7a1..00000000000
--- a/app/assets/javascripts/close_reopen_report_toggle.js
+++ /dev/null
@@ -1,92 +0,0 @@
-import DropLab from './droplab/drop_lab';
-import ISetter from './droplab/plugins/input_setter';
-
-// Todo: Remove this when fixing issue in input_setter plugin
-const InputSetter = { ...ISetter };
-
-class CloseReopenReportToggle {
-  constructor(opts = {}) {
-    this.dropdownTrigger = opts.dropdownTrigger;
-    this.dropdownList = opts.dropdownList;
-    this.button = opts.button;
-  }
-
-  initDroplab() {
-    this.reopenItem = this.dropdownList.querySelector('.reopen-item');
-    this.closeItem = this.dropdownList.querySelector('.close-item');
-
-    this.droplab = new DropLab();
-
-    const config = this.setConfig();
-
-    this.droplab.init(this.dropdownTrigger, this.dropdownList, [InputSetter], config);
-  }
-
-  updateButton(isClosed) {
-    this.toggleButtonType(isClosed);
-
-    this.button.blur();
-  }
-
-  toggleButtonType(isClosed) {
-    const [showItem, hideItem] = this.getButtonTypes(isClosed);
-
-    showItem.classList.remove('hidden');
-    showItem.classList.add('droplab-item-selected');
-
-    hideItem.classList.add('hidden');
-    hideItem.classList.remove('droplab-item-selected');
-
-    showItem.click();
-  }
-
-  getButtonTypes(isClosed) {
-    return isClosed ? [this.reopenItem, this.closeItem] : [this.closeItem, this.reopenItem];
-  }
-
-  setDisable(shouldDisable = true) {
-    if (shouldDisable) {
-      this.button.setAttribute('disabled', 'true');
-      this.dropdownTrigger.setAttribute('disabled', 'true');
-    } else {
-      this.button.removeAttribute('disabled');
-      this.dropdownTrigger.removeAttribute('disabled');
-    }
-  }
-
-  setConfig() {
-    const config = {
-      InputSetter: [
-        {
-          input: this.button,
-          valueAttribute: 'data-text',
-          inputAttribute: 'data-value',
-        },
-        {
-          input: this.button,
-          valueAttribute: 'data-text',
-          inputAttribute: 'title',
-        },
-        {
-          input: this.button,
-          valueAttribute: 'data-button-class',
-          inputAttribute: 'class',
-        },
-        {
-          input: this.dropdownTrigger,
-          valueAttribute: 'data-toggle-class',
-          inputAttribute: 'class',
-        },
-        {
-          input: this.button,
-          valueAttribute: 'data-url',
-          inputAttribute: 'data-endpoint',
-        },
-      ],
-    };
-
-    return config;
-  }
-}
-
-export default CloseReopenReportToggle;
diff --git a/app/assets/javascripts/diffs/components/merge_conflict_warning.vue b/app/assets/javascripts/diffs/components/merge_conflict_warning.vue
index e47bea8e589..587efd6ed41 100644
--- a/app/assets/javascripts/diffs/components/merge_conflict_warning.vue
+++ b/app/assets/javascripts/diffs/components/merge_conflict_warning.vue
@@ -1,5 +1,5 @@
 <script>
-import { GlButton, GlAlert } from '@gitlab/ui';
+import { GlButton, GlAlert, GlModalDirective } from '@gitlab/ui';
 import { CENTERED_LIMITED_CONTAINER_CLASSES } from '../constants';
 
 export default {
@@ -7,6 +7,9 @@ export default {
     GlAlert,
     GlButton,
   },
+  directives: {
+    GlModalDirective,
+  },
   props: {
     limited: {
       type: Boolean,
@@ -60,9 +63,8 @@ export default {
         </gl-button>
         <gl-button
           v-if="mergeable"
+          v-gl-modal-directive="'modal-merge-info'"
           class="gl-alert-action"
-          data-toggle="modal"
-          data-target="#modal_merge_info"
         >
           {{ __('Merge locally') }}
         </gl-button>
diff --git a/app/assets/javascripts/helpers/issuables_helper.js b/app/assets/javascripts/helpers/issuables_helper.js
deleted file mode 100644
index 52d0f7e43fc..00000000000
--- a/app/assets/javascripts/helpers/issuables_helper.js
+++ /dev/null
@@ -1,27 +0,0 @@
-import CloseReopenReportToggle from '../close_reopen_report_toggle';
-
-function initCloseReopenReport() {
-  const container = document.querySelector('.js-issuable-close-dropdown');
-
-  if (!container) return undefined;
-
-  const dropdownTrigger = container.querySelector('.js-issuable-close-toggle');
-  const dropdownList = container.querySelector('.js-issuable-close-menu');
-  const button = container.querySelector('.js-issuable-close-button');
-
-  const closeReopenReportToggle = new CloseReopenReportToggle({
-    dropdownTrigger,
-    dropdownList,
-    button,
-  });
-
-  closeReopenReportToggle.initDroplab();
-
-  return closeReopenReportToggle;
-}
-
-const IssuablesHelper = {
-  initCloseReopenReport,
-};
-
-export default IssuablesHelper;
diff --git a/app/assets/javascripts/how_to_merge.js b/app/assets/javascripts/how_to_merge.js
deleted file mode 100644
index bb734246584..00000000000
--- a/app/assets/javascripts/how_to_merge.js
+++ /dev/null
@@ -1,15 +0,0 @@
-import $ from 'jquery';
-
-export default () => {
-  const modal = $('#modal_merge_info');
-
-  if (modal) {
-    modal.modal({
-      modal: true,
-      show: false,
-    });
-
-    $('.how_to_merge_link').on('click', modal.show);
-    $('.modal-header .close').on('click', modal.hide);
-  }
-};
diff --git a/app/assets/javascripts/issuable_show/components/issuable_header.vue b/app/assets/javascripts/issuable_show/components/issuable_header.vue
index 3815c50cac6..5404753631d 100644
--- a/app/assets/javascripts/issuable_show/components/issuable_header.vue
+++ b/app/assets/javascripts/issuable_show/components/issuable_header.vue
@@ -112,7 +112,7 @@ export default {
     </div>
     <div
       data-testid="header-actions"
-      class="detail-page-header-actions js-issuable-actions js-issuable-buttons gl-display-flex gl-display-md-block"
+      class="detail-page-header-actions gl-display-flex gl-display-md-block"
     >
       <slot name="header-actions"></slot>
     </div>
diff --git a/app/assets/javascripts/issue.js b/app/assets/javascripts/issue.js
index f65d9259e7b..5d2880c3c10 100644
--- a/app/assets/javascripts/issue.js
+++ b/app/assets/javascripts/issue.js
@@ -1,41 +1,22 @@
-/* eslint-disable consistent-return */
-
 import $ from 'jquery';
 import axios from './lib/utils/axios_utils';
 import { addDelimiter } from './lib/utils/text_utility';
 import { deprecatedCreateFlash as flash } from './flash';
 import CreateMergeRequestDropdown from './create_merge_request_dropdown';
-import IssuablesHelper from './helpers/issuables_helper';
 import { joinPaths } from '~/lib/utils/url_utility';
 import { __ } from './locale';
 
 export default class Issue {
   constructor() {
-    if ($('.btn-close, .btn-reopen').length) this.initIssueBtnEventListeners();
-
-    if ($('.js-close-blocked-issue-warning').length) this.initIssueWarningBtnEventListener();
-
     if ($('.js-alert-moved-from-service-desk-warning').length) {
-      const trimmedPathname = window.location.pathname.slice(1);
-      this.alertMovedFromServiceDeskDismissedKey = joinPaths(
-        trimmedPathname,
-        'alert-issue-moved-from-service-desk-dismissed',
-      );
-
-      this.initIssueMovedFromServiceDeskDismissHandler();
+      Issue.initIssueMovedFromServiceDeskDismissHandler();
     }
 
-    Issue.$btnNewBranch = $('#new-branch');
-    Issue.createMrDropdownWrap = document.querySelector('.create-mr-dropdown-wrap');
-
     if (document.querySelector('#related-branches')) {
       Issue.initRelatedBranches();
     }
 
-    this.closeButtons = $('.btn-close');
-    this.reopenButtons = $('.btn-reopen');
-
-    this.initCloseReopenReport();
+    Issue.createMrDropdownWrap = document.querySelector('.create-mr-dropdown-wrap');
 
     if (Issue.createMrDropdownWrap) {
       this.createMergeRequestDropdown = new CreateMergeRequestDropdown(Issue.createMrDropdownWrap);
@@ -71,7 +52,6 @@ export default class Issue {
       isOpenBadge.toggleClass('hidden', isClosed);
 
       $(document).trigger('issuable:change', isClosed);
-      this.toggleCloseReopenButton(isClosed);
 
       let numProjectIssues = Number(
         projectIssuesCounter
@@ -91,104 +71,16 @@ export default class Issue {
     }
   }
 
-  initIssueBtnEventListeners() {
-    const issueFailMessage = __('Unable to update this issue at this time.');
-
-    $('.report-abuse-link').on('click', e => {
-      // this is needed because of the implementation of
-      // the dropdown toggle and Report Abuse needing to be
-      // linked to another page.
-      e.stopPropagation();
-    });
-
-    // NOTE: data attribute seems unnecessary but is actually necessary
-    return $('.js-issuable-buttons[data-action="close-reopen"]').on(
-      'click',
-      '.btn-close, .btn-reopen, .btn-close-anyway',
-      e => {
-        e.preventDefault();
-        e.stopImmediatePropagation();
-        const $button = $(e.currentTarget);
-        const shouldSubmit = $button.hasClass('btn-comment');
-        if (shouldSubmit) {
-          Issue.submitNoteForm($button.closest('form'));
-        }
-
-        const shouldDisplayBlockedWarning = $button.hasClass('btn-issue-blocked');
-        const warningBanner = $('.js-close-blocked-issue-warning');
-        if (shouldDisplayBlockedWarning) {
-          this.toggleWarningAndCloseButton();
-        } else {
-          this.disableCloseReopenButton($button);
-
-          const url = $button.data('endpoint');
-
-          return axios
-            .put(url)
-            .then(({ data }) => {
-              const isClosed = $button.is('.btn-close, .btn-close-anyway');
-              this.updateTopState(isClosed, data);
-              if ($button.hasClass('btn-close-anyway')) {
-                warningBanner.addClass('hidden');
-                if (this.closeReopenReportToggle)
-                  $('.js-issuable-close-dropdown').removeClass('hidden');
-              }
-            })
-            .catch(() => flash(issueFailMessage))
-            .then(() => {
-              this.disableCloseReopenButton($button, false);
-            });
-        }
-      },
-    );
-  }
-
-  initCloseReopenReport() {
-    this.closeReopenReportToggle = IssuablesHelper.initCloseReopenReport();
-
-    if (this.closeButtons) this.closeButtons = this.closeButtons.not('.issuable-close-button');
-    if (this.reopenButtons) this.reopenButtons = this.reopenButtons.not('.issuable-close-button');
-  }
-
-  disableCloseReopenButton($button, shouldDisable) {
-    if (this.closeReopenReportToggle) {
-      this.closeReopenReportToggle.setDisable(shouldDisable);
-    } else {
-      $button.prop('disabled', shouldDisable);
-    }
-  }
-
-  toggleCloseReopenButton(isClosed) {
-    if (this.closeReopenReportToggle) this.closeReopenReportToggle.updateButton(isClosed);
-    this.closeButtons.toggleClass('hidden', isClosed);
-    this.reopenButtons.toggleClass('hidden', !isClosed);
-  }
-
-  toggleWarningAndCloseButton() {
-    const warningBanner = $('.js-close-blocked-issue-warning');
-    warningBanner.toggleClass('hidden');
-    $('.btn-close').toggleClass('hidden');
-    if (this.closeReopenReportToggle) {
-      $('.js-issuable-close-dropdown').toggleClass('hidden');
-    }
-  }
-
-  initIssueWarningBtnEventListener() {
-    return $(document).on(
-      'click',
-      '.js-close-blocked-issue-warning .js-cancel-blocked-issue-warning',
-      e => {
-        e.preventDefault();
-        e.stopImmediatePropagation();
-        this.toggleWarningAndCloseButton();
-      },
-    );
-  }
-
-  initIssueMovedFromServiceDeskDismissHandler() {
+  static initIssueMovedFromServiceDeskDismissHandler() {
     const alertMovedFromServiceDeskWarning = $('.js-alert-moved-from-service-desk-warning');
 
-    if (!localStorage.getItem(this.alertMovedFromServiceDeskDismissedKey)) {
+    const trimmedPathname = window.location.pathname.slice(1);
+    const alertMovedFromServiceDeskDismissedKey = joinPaths(
+      trimmedPathname,
+      'alert-issue-moved-from-service-desk-dismissed',
+    );
+
+    if (!localStorage.getItem(alertMovedFromServiceDeskDismissedKey)) {
       alertMovedFromServiceDeskWarning.show();
     }
 
@@ -196,20 +88,13 @@ export default class Issue {
       e.preventDefault();
       e.stopImmediatePropagation();
       alertMovedFromServiceDeskWarning.remove();
-      localStorage.setItem(this.alertMovedFromServiceDeskDismissedKey, true);
+      localStorage.setItem(alertMovedFromServiceDeskDismissedKey, true);
     });
   }
 
-  static submitNoteForm(form) {
-    const noteText = form.find('textarea.js-note-text').val();
-    if (noteText && noteText.trim().length > 0) {
-      return form.submit();
-    }
-  }
-
   static initRelatedBranches() {
     const $container = $('#related-branches');
-    return axios
+    axios
       .get($container.data('url'))
       .then(({ data }) => {
         if ('html' in data) {
diff --git a/app/assets/javascripts/pages/projects/merge_requests/init_merge_request_show.js b/app/assets/javascripts/pages/projects/merge_requests/init_merge_request_show.js
index 868e001b182..0714fc21b17 100644
--- a/app/assets/javascripts/pages/projects/merge_requests/init_merge_request_show.js
+++ b/app/assets/javascripts/pages/projects/merge_requests/init_merge_request_show.js
@@ -2,7 +2,6 @@ import ZenMode from '~/zen_mode';
 import initIssuableSidebar from '~/init_issuable_sidebar';
 import ShortcutsIssuable from '~/behaviors/shortcuts/shortcuts_issuable';
 import { handleLocationHash } from '~/lib/utils/common_utils';
-import howToMerge from '~/how_to_merge';
 import initPipelines from '~/commit/pipelines/pipelines_bundle';
 import initSourcegraph from '~/sourcegraph';
 import loadAwardsHandler from '~/awards_handler';
@@ -15,7 +14,6 @@ export default function() {
   initPipelines();
   new ShortcutsIssuable(true); // eslint-disable-line no-new
   handleLocationHash();
-  howToMerge();
   initSourcegraph();
   loadAwardsHandler();
   initInviteMemberModal();
diff --git a/app/assets/javascripts/vue_merge_request_widget/components/mr_widget_merge_help.vue b/app/assets/javascripts/vue_merge_request_widget/components/mr_widget_merge_help.vue
index 53bf9d5ab6f..1727383ea2c 100644
--- a/app/assets/javascripts/vue_merge_request_widget/components/mr_widget_merge_help.vue
+++ b/app/assets/javascripts/vue_merge_request_widget/components/mr_widget_merge_help.vue
@@ -1,8 +1,15 @@
 <script>
+import { GlButton, GlModalDirective } from '@gitlab/ui';
 import { sprintf, s__ } from '~/locale';
 
 export default {
   name: 'MRWidgetMergeHelp',
+  components: {
+    GlButton,
+  },
+  directives: {
+    GlModalDirective,
+  },
   props: {
     missingBranch: {
       type: String,
@@ -31,13 +38,12 @@ export default {
       {{ s__('mrWidget|You can merge this merge request manually using the') }}
     </template>
 
-    <button
-      type="button"
-      class="btn-link btn-blank js-open-modal-help"
-      data-toggle="modal"
-      data-target="#modal_merge_info"
+    <gl-button
+      v-gl-modal-directive="'modal-merge-info'"
+      variant="link"
+      class="gl-mt-n2 js-open-modal-help"
     >
       {{ s__('mrWidget|command line') }}
-    </button>
+    </gl-button>
   </section>
 </template>
diff --git a/app/assets/stylesheets/pages/issuable.scss b/app/assets/stylesheets/pages/issuable.scss
index cd33d5b9ce1..b0ce90ca596 100644
--- a/app/assets/stylesheets/pages/issuable.scss
+++ b/app/assets/stylesheets/pages/issuable.scss
@@ -887,11 +887,6 @@
   }
 }
 
-.issuable-close-button,
-.issuable-close-toggle {
-  @include transition(border-color, color);
-}
-
 .issuable-close-dropdown {
   .dropdown-menu {
     min-width: 270px;
diff --git a/app/assets/stylesheets/pages/merge_requests.scss b/app/assets/stylesheets/pages/merge_requests.scss
index 069392f8a99..b6a5c133c05 100644
--- a/app/assets/stylesheets/pages/merge_requests.scss
+++ b/app/assets/stylesheets/pages/merge_requests.scss
@@ -507,19 +507,6 @@ $mr-widget-min-height: 69px;
   display: none;
 }
 
-#modal_merge_info .modal-dialog {
-  .dark {
-    margin-right: 40px;
-  }
-
-  .btn-clipboard {
-    margin-right: 20px;
-    margin-top: 5px;
-    position: absolute;
-    right: 0;
-  }
-}
-
 .mr-links {
   padding-left: $gl-padding-8 + $status-icon-size + $gl-btn-padding;
 
diff --git a/app/controllers/projects/issues_controller.rb b/app/controllers/projects/issues_controller.rb
index 261847faed3..eb0714c0282 100644
--- a/app/controllers/projects/issues_controller.rb
+++ b/app/controllers/projects/issues_controller.rb
@@ -73,6 +73,8 @@ class Projects::IssuesController < Projects::ApplicationController
   feature_category :service_desk, [:service_desk]
   feature_category :importers, [:import_csv, :export_csv]
 
+  attr_accessor :vulnerability_id
+
   def index
     @issues = @issuables
 
@@ -124,6 +126,8 @@ class Projects::IssuesController < Projects::ApplicationController
     service = ::Issues::CreateService.new(project, current_user, create_params)
     @issue = service.execute
 
+    create_vulnerability_issue_link(issue)
+
     if service.discussions_to_resolve.count(&:resolved?) > 0
       flash[:notice] = if service.discussion_to_resolve_id
                          _("Resolved 1 discussion.")
@@ -384,6 +388,9 @@ class Projects::IssuesController < Projects::ApplicationController
   def service_desk?
     action_name == 'service_desk'
   end
+
+  # Overridden in EE
+  def create_vulnerability_issue_link(issue); end
 end
 
 Projects::IssuesController.prepend_if_ee('EE::Projects::IssuesController')
diff --git a/app/controllers/repositories/git_http_client_controller.rb b/app/controllers/repositories/git_http_client_controller.rb
index ec854bd0dde..a5b81054ee4 100644
--- a/app/controllers/repositories/git_http_client_controller.rb
+++ b/app/controllers/repositories/git_http_client_controller.rb
@@ -87,8 +87,12 @@ module Repositories
       @project
     end
 
+    def repository_path
+      @repository_path ||= params[:repository_path]
+    end
+
     def parse_repo_path
-      @container, @project, @repo_type, @redirected_path = Gitlab::RepoPath.parse("#{params[:namespace_id]}/#{params[:repository_id]}")
+      @container, @project, @repo_type, @redirected_path = Gitlab::RepoPath.parse(repository_path)
     end
 
     def render_missing_personal_access_token
diff --git a/app/controllers/repositories/git_http_controller.rb b/app/controllers/repositories/git_http_controller.rb
index aa6609bef2a..639e403d797 100644
--- a/app/controllers/repositories/git_http_controller.rb
+++ b/app/controllers/repositories/git_http_controller.rb
@@ -90,7 +90,6 @@ module Repositories
     def access
       @access ||= access_klass.new(access_actor, container, 'http',
         authentication_abilities: authentication_abilities,
-        namespace_path: params[:namespace_id],
         repository_path: repository_path,
         redirected_path: redirected_path,
         auth_result_type: auth_result_type)
@@ -113,10 +112,6 @@ module Repositories
       @access_klass ||= repo_type.access_checker_class
     end
 
-    def repository_path
-      @repository_path ||= params[:repository_id].sub(/\.git$/, '')
-    end
-
     def log_user_activity
       Users::ActivityService.new(user).execute
     end
diff --git a/app/controllers/users_controller.rb b/app/controllers/users_controller.rb
index 672f36dedc0..6ff30af963a 100644
--- a/app/controllers/users_controller.rb
+++ b/app/controllers/users_controller.rb
@@ -33,6 +33,8 @@ class UsersController < ApplicationController
       end
 
       format.json do
+        # In 13.8, this endpoint will be removed:
+        # https://gitlab.com/gitlab-org/gitlab/-/issues/289972
         load_events
         pager_json("events/_events", @events.count, events: @events)
       end
@@ -42,6 +44,11 @@ class UsersController < ApplicationController
   def activity
     respond_to do |format|
       format.html { render 'show' }
+
+      format.json do
+        load_events
+        pager_json("events/_events", @events.count, events: @events)
+      end
     end
   end
 
diff --git a/app/finders/group_members_finder.rb b/app/finders/group_members_finder.rb
index 09283f061c0..d334d2d8bf3 100644
--- a/app/finders/group_members_finder.rb
+++ b/app/finders/group_members_finder.rb
@@ -21,7 +21,7 @@ class GroupMembersFinder < UnionFinder
     group_members = group_members_list
     relations = []
 
-    return group_members if include_relations == [:direct]
+    return filter_members(group_members) if include_relations == [:direct]
 
     relations << group_members if include_relations.include?(:direct)
 
diff --git a/app/graphql/types/award_emojis/award_emoji_type.rb b/app/graphql/types/award_emojis/award_emoji_type.rb
index fe7affa50cc..cd7a2f34ba6 100644
--- a/app/graphql/types/award_emojis/award_emoji_type.rb
+++ b/app/graphql/types/award_emojis/award_emoji_type.rb
@@ -38,10 +38,11 @@ module Types
       field :user,
             Types::UserType,
             null: false,
-            description: 'The user who awarded the emoji',
-            resolve: -> (award_emoji, _args, _context) {
-              Gitlab::Graphql::Loaders::BatchModelLoader.new(User, award_emoji.user_id).find
-            }
+            description: 'The user who awarded the emoji'
+
+      def user
+        Gitlab::Graphql::Loaders::BatchModelLoader.new(User, object.user_id).find
+      end
     end
   end
 end
diff --git a/app/graphql/types/board_list_type.rb b/app/graphql/types/board_list_type.rb
index 6ee76b0d1f1..7999e77eb30 100644
--- a/app/graphql/types/board_list_type.rb
+++ b/app/graphql/types/board_list_type.rb
@@ -19,8 +19,7 @@ module Types
     field :label, Types::LabelType, null: true,
           description: 'Label of the list'
     field :collapsed, GraphQL::BOOLEAN_TYPE, null: true,
-          description: 'Indicates if list is collapsed for this user',
-          resolve: -> (list, _args, ctx) { list.collapsed?(ctx[:current_user]) }
+          description: 'Indicates if list is collapsed for this user'
     field :issues_count, GraphQL::INT_TYPE, null: true,
           description: 'Count of issues in the list'
 
@@ -32,6 +31,10 @@ module Types
       metadata[:size]
     end
 
+    def collapsed
+      object.collapsed?(context[:current_user])
+    end
+
     def metadata
       strong_memoize(:metadata) do
         list = self.object
diff --git a/app/graphql/types/ci/detailed_status_type.rb b/app/graphql/types/ci/detailed_status_type.rb
index 6d8af400ac4..5843bcfde89 100644
--- a/app/graphql/types/ci/detailed_status_type.rb
+++ b/app/graphql/types/ci/detailed_status_type.rb
@@ -25,20 +25,21 @@ module Types
             description: 'Tooltip associated with the status',
             method: :status_tooltip
       field :action, Types::Ci::StatusActionType, null: true,
-            description: 'Action information for the status. This includes method, button title, icon, path, and title',
-            resolve: -> (obj, _args, _ctx) {
-              if obj.has_action?
-                {
-                  button_title: obj.action_button_title,
-                  icon: obj.action_icon,
-                  method: obj.action_method,
-                  path: obj.action_path,
-                  title: obj.action_title
-                }
-              else
-                nil
-              end
-            }
+            description: 'Action information for the status. This includes method, button title, icon, path, and title'
+
+      def action
+        if object.has_action?
+          {
+            button_title: object.action_button_title,
+            icon: object.action_icon,
+            method: object.action_method,
+            path: object.action_path,
+            title: object.action_title
+          }
+        else
+          nil
+        end
+      end
     end
     # rubocop: enable Graphql/AuthorizeTypes
   end
diff --git a/app/graphql/types/ci/group_type.rb b/app/graphql/types/ci/group_type.rb
index d930ae311b7..03fd50d5dbb 100644
--- a/app/graphql/types/ci/group_type.rb
+++ b/app/graphql/types/ci/group_type.rb
@@ -13,8 +13,11 @@ module Types
       field :jobs, Ci::JobType.connection_type, null: true,
         description: 'Jobs in group'
       field :detailed_status, Types::Ci::DetailedStatusType, null: true,
-            description: 'Detailed status of the group',
-            resolve: -> (obj, _args, ctx) { obj.detailed_status(ctx[:current_user]) }
+            description: 'Detailed status of the group'
+
+      def detailed_status
+        object.detailed_status(context[:current_user])
+      end
     end
   end
 end
diff --git a/app/graphql/types/ci/job_type.rb b/app/graphql/types/ci/job_type.rb
index f1ebaeb2b47..7d736db137a 100644
--- a/app/graphql/types/ci/job_type.rb
+++ b/app/graphql/types/ci/job_type.rb
@@ -7,25 +7,26 @@ module Types
       graphql_name 'CiJob'
 
       field :pipeline, Types::Ci::PipelineType, null: false,
-        description: 'Pipeline the job belongs to',
-        resolve: -> (build, _, _) { Gitlab::Graphql::Loaders::BatchModelLoader.new(::Ci::Pipeline, build.pipeline_id).find }
-
+            description: 'Pipeline the job belongs to'
       field :name, GraphQL::STRING_TYPE, null: true,
-        description: 'Name of the job'
-
+            description: 'Name of the job'
       field :needs, JobType.connection_type, null: true,
-        description: 'Builds that must complete before the jobs run'
-
+            description: 'Builds that must complete before the jobs run'
       field :detailed_status, Types::Ci::DetailedStatusType, null: true,
-            description: 'Detailed status of the job',
-            resolve: -> (obj, _args, ctx) { obj.detailed_status(ctx[:current_user]) }
-
+            description: 'Detailed status of the job'
       field :scheduled_at, Types::TimeType, null: true,
-        description: 'Schedule for the build'
-
+            description: 'Schedule for the build'
       field :artifacts, Types::Ci::JobArtifactType.connection_type, null: true,
             description: 'Artifacts generated by the job'
 
+      def pipeline
+        Gitlab::Graphql::Loaders::BatchModelLoader.new(::Ci::Pipeline, object.pipeline_id).find
+      end
+
+      def detailed_status
+        object.detailed_status(context[:current_user])
+      end
+
       def artifacts
         if object.is_a?(::Ci::Build)
           object.job_artifacts
diff --git a/app/graphql/types/ci/pipeline_type.rb b/app/graphql/types/ci/pipeline_type.rb
index c25db39f600..0469c4c21f6 100644
--- a/app/graphql/types/ci/pipeline_type.rb
+++ b/app/graphql/types/ci/pipeline_type.rb
@@ -27,8 +27,7 @@ module Types
             description: "Status of the pipeline (#{::Ci::Pipeline.all_state_names.compact.join(', ').upcase})"
 
       field :detailed_status, Types::Ci::DetailedStatusType, null: false,
-            description: 'Detailed status of the pipeline',
-            resolve: -> (obj, _args, ctx) { obj.detailed_status(ctx[:current_user]) }
+            description: 'Detailed status of the pipeline'
 
       field :config_source, PipelineConfigSourceEnum, null: true,
             description: "Config source of the pipeline (#{::Enums::Ci::Pipeline.config_sources.keys.join(', ').upcase})"
@@ -60,8 +59,7 @@ module Types
             resolver: Resolvers::Ci::PipelineStagesResolver
 
       field :user, Types::UserType, null: true,
-            description: 'Pipeline user',
-            resolve: -> (pipeline, _args, _context) { Gitlab::Graphql::Loaders::BatchModelLoader.new(User, pipeline.user_id).find }
+            description: 'Pipeline user'
 
       field :retryable, GraphQL::BOOLEAN_TYPE,
             description: 'Specifies if a pipeline can be retried',
@@ -91,11 +89,22 @@ module Types
             method: :triggered_by_pipeline
 
       field :path, GraphQL::STRING_TYPE, null: true,
-            description: "Relative path to the pipeline's page",
-            resolve: -> (obj, _args, _ctx) { ::Gitlab::Routing.url_helpers.project_pipeline_path(obj.project, obj) }
+            description: "Relative path to the pipeline's page"
 
       field :project, Types::ProjectType, null: true,
             description: 'Project the pipeline belongs to'
+
+      def detailed_status
+        object.detailed_status(context[:current_user])
+      end
+
+      def user
+        Gitlab::Graphql::Loaders::BatchModelLoader.new(User, object.user_id).find
+      end
+
+      def path
+        ::Gitlab::Routing.url_helpers.project_pipeline_path(object.project, object)
+      end
     end
   end
 end
diff --git a/app/graphql/types/ci/stage_type.rb b/app/graphql/types/ci/stage_type.rb
index fc2c72d0d06..fd0bde90836 100644
--- a/app/graphql/types/ci/stage_type.rb
+++ b/app/graphql/types/ci/stage_type.rb
@@ -11,8 +11,11 @@ module Types
       field :groups, Ci::GroupType.connection_type, null: true,
         description: 'Group of jobs for the stage'
       field :detailed_status, Types::Ci::DetailedStatusType, null: true,
-            description: 'Detailed status of the stage',
-            resolve: -> (obj, _args, ctx) { obj.detailed_status(ctx[:current_user]) }
+            description: 'Detailed status of the stage'
+
+      def detailed_status
+        object.detailed_status(context[:current_user])
+      end
     end
   end
 end
diff --git a/app/graphql/types/commit_type.rb b/app/graphql/types/commit_type.rb
index c24b47f08ef..fab54d044fb 100644
--- a/app/graphql/types/commit_type.rb
+++ b/app/graphql/types/commit_type.rb
@@ -31,10 +31,7 @@ module Types
     field :author_name, type: GraphQL::STRING_TYPE, null: true,
           description: 'Commit authors name'
     field :author_gravatar, type: GraphQL::STRING_TYPE, null: true,
-          description: 'Commit authors gravatar',
-          resolve: -> (commit, args, context) do
-            GravatarService.new.execute(commit.author_email, 40)
-          end
+          description: 'Commit authors gravatar'
 
     # models/commit lazy loads the author by email
     field :author, type: Types::UserType, null: true,
@@ -44,5 +41,9 @@ module Types
           null: true,
           description: 'Pipelines of the commit ordered latest first',
           resolver: Resolvers::CommitPipelinesResolver
+
+    def author_gravatar
+      GravatarService.new.execute(object.author_email, 40)
+    end
   end
 end
diff --git a/app/graphql/types/group_invitation_type.rb b/app/graphql/types/group_invitation_type.rb
index 0372ce178ff..efb0c8a41c8 100644
--- a/app/graphql/types/group_invitation_type.rb
+++ b/app/graphql/types/group_invitation_type.rb
@@ -11,7 +11,10 @@ module Types
     description 'Represents a Group Invitation'
 
     field :group, Types::GroupType, null: true,
-          description: 'Group that a User is invited to',
-          resolve: -> (obj, _args, _ctx) { Gitlab::Graphql::Loaders::BatchModelLoader.new(Group, obj.source_id).find }
+          description: 'Group that a User is invited to'
+
+    def group
+      Gitlab::Graphql::Loaders::BatchModelLoader.new(Group, object.source_id).find
+    end
   end
 end
diff --git a/app/graphql/types/group_member_type.rb b/app/graphql/types/group_member_type.rb
index 6cca0a50647..204da5a302a 100644
--- a/app/graphql/types/group_member_type.rb
+++ b/app/graphql/types/group_member_type.rb
@@ -11,7 +11,10 @@ module Types
     description 'Represents a Group Membership'
 
     field :group, Types::GroupType, null: true,
-          description: 'Group that a User is a member of',
-          resolve: -> (obj, _args, _ctx) { Gitlab::Graphql::Loaders::BatchModelLoader.new(Group, obj.source_id).find }
+          description: 'Group that a User is a member of'
+
+    def group
+      Gitlab::Graphql::Loaders::BatchModelLoader.new(Group, object.source_id).find
+    end
   end
 end
diff --git a/app/graphql/types/group_type.rb b/app/graphql/types/group_type.rb
index fb028184488..cddf8698826 100644
--- a/app/graphql/types/group_type.rb
+++ b/app/graphql/types/group_type.rb
@@ -12,10 +12,7 @@ module Types
           description: 'Web URL of the group'
 
     field :avatar_url, GraphQL::STRING_TYPE, null: true,
-          description: 'Avatar URL of the group',
-          resolve: -> (group, args, ctx) do
-            group.avatar_url(only_path: false)
-          end
+          description: 'Avatar URL of the group'
 
     field :custom_emoji, Types::CustomEmojiType.connection_type, null: true,
           description: 'Custom emoji within this namespace',
@@ -44,8 +41,7 @@ module Types
           description: 'Indicates if a group is disabled from getting mentioned'
 
     field :parent, GroupType, null: true,
-          description: 'Parent group',
-          resolve: -> (obj, _args, _ctx) { Gitlab::Graphql::Loaders::BatchModelLoader.new(Group, obj.parent_id).find }
+          description: 'Parent group'
 
     field :issues,
           Types::IssueType.connection_type,
@@ -120,6 +116,14 @@ module Types
         .execute
     end
 
+    def avatar_url
+      object.avatar_url(only_path: false)
+    end
+
+    def parent
+      Gitlab::Graphql::Loaders::BatchModelLoader.new(Group, object.parent_id).find
+    end
+
     private
 
     def group
diff --git a/app/graphql/types/merge_request_type.rb b/app/graphql/types/merge_request_type.rb
index 6d1e15742e7..91cc26868fb 100644
--- a/app/graphql/types/merge_request_type.rb
+++ b/app/graphql/types/merge_request_type.rb
@@ -132,8 +132,7 @@ module Types
           description: 'Labels of the merge request'
     field :discussion_locked, GraphQL::BOOLEAN_TYPE,
           description: 'Indicates if comments on the merge request are locked to members only',
-          null: false,
-          resolve: -> (obj, _args, _ctx) { !!obj.discussion_locked }
+          null: false
     field :time_estimate, GraphQL::INT_TYPE, null: false,
           description: 'Time estimate of the merge request'
     field :total_time_spent, GraphQL::INT_TYPE, null: false,
@@ -200,6 +199,11 @@ module Types
     def source_branch_protected
       object.source_project.present? && ProtectedBranch.protected?(object.source_project, object.source_branch)
     end
+
+    def discussion_locked
+      !!object.discussion_locked
+    end
   end
 end
+
 Types::MergeRequestType.prepend_if_ee('::EE::Types::MergeRequestType')
diff --git a/app/graphql/types/namespace_type.rb b/app/graphql/types/namespace_type.rb
index fbdf049b755..4dec6f4c5e6 100644
--- a/app/graphql/types/namespace_type.rb
+++ b/app/graphql/types/namespace_type.rb
@@ -21,6 +21,7 @@ module Types
     field :description, GraphQL::STRING_TYPE, null: true,
           description: 'Description of the namespace'
     markdown_field :description_html, null: true
+
     field :visibility, GraphQL::STRING_TYPE, null: true,
           description: 'Visibility of the namespace'
     field :lfs_enabled, GraphQL::BOOLEAN_TYPE, null: true, method: :lfs_enabled?,
@@ -30,12 +31,15 @@ module Types
 
     field :root_storage_statistics, Types::RootStorageStatisticsType,
           null: true,
-          description: 'Aggregated storage statistics of the namespace. Only available for root namespaces',
-          resolve: -> (obj, _args, _ctx) { Gitlab::Graphql::Loaders::BatchRootStorageStatisticsLoader.new(obj.id).find }
+          description: 'Aggregated storage statistics of the namespace. Only available for root namespaces'
 
     field :projects, Types::ProjectType.connection_type, null: false,
           description: 'Projects within this namespace',
           resolver: ::Resolvers::NamespaceProjectsResolver
+
+    def root_storage_statistics
+      Gitlab::Graphql::Loaders::BatchRootStorageStatisticsLoader.new(object.id).find
+    end
   end
 end
 
diff --git a/app/graphql/types/notes/diff_position_type.rb b/app/graphql/types/notes/diff_position_type.rb
index cc00feba2e6..13d9be49484 100644
--- a/app/graphql/types/notes/diff_position_type.rb
+++ b/app/graphql/types/notes/diff_position_type.rb
@@ -21,25 +21,43 @@ module Types
 
       # Fields for text positions
       field :old_line, GraphQL::INT_TYPE, null: true,
-            description: 'Line on start SHA that was changed',
-            resolve: -> (position, _args, _ctx) { position.old_line if position.on_text? }
+            description: 'Line on start SHA that was changed'
       field :new_line, GraphQL::INT_TYPE, null: true,
-            description: 'Line on HEAD SHA that was changed',
-            resolve: -> (position, _args, _ctx) { position.new_line if position.on_text? }
+            description: 'Line on HEAD SHA that was changed'
 
       # Fields for image positions
       field :x, GraphQL::INT_TYPE, null: true,
-            description: 'X position of the note',
-            resolve: -> (position, _args, _ctx) { position.x if position.on_image? }
+            description: 'X position of the note'
       field :y, GraphQL::INT_TYPE, null: true,
-            description: 'Y position of the note',
-            resolve: -> (position, _args, _ctx) { position.y if position.on_image? }
+            description: 'Y position of the note'
       field :width, GraphQL::INT_TYPE, null: true,
-            description: 'Total width of the image',
-            resolve: -> (position, _args, _ctx) { position.width if position.on_image? }
+            description: 'Total width of the image'
       field :height, GraphQL::INT_TYPE, null: true,
-            description: 'Total height of the image',
-            resolve: -> (position, _args, _ctx) { position.height if position.on_image? }
+            description: 'Total height of the image'
+
+      def old_line
+        object.old_line if object.on_text?
+      end
+
+      def new_line
+        object.new_line if object.on_text?
+      end
+
+      def x
+        object.x if object.on_image?
+      end
+
+      def y
+        object.y if object.on_image?
+      end
+
+      def width
+        object.width if object.on_image?
+      end
+
+      def height
+        object.height if object.on_image?
+      end
     end
     # rubocop: enable Graphql/AuthorizeTypes
   end
diff --git a/app/graphql/types/notes/note_type.rb b/app/graphql/types/notes/note_type.rb
index 5d41f0032bd..f4e05e19eca 100644
--- a/app/graphql/types/notes/note_type.rb
+++ b/app/graphql/types/notes/note_type.rb
@@ -16,13 +16,11 @@ module Types
 
       field :project, Types::ProjectType,
             null: true,
-            description: 'Project associated with the note',
-            resolve: -> (note, args, context) { Gitlab::Graphql::Loaders::BatchModelLoader.new(Project, note.project_id).find }
+            description: 'Project associated with the note'
 
       field :author, Types::UserType,
             null: false,
-            description: 'User who wrote this note',
-            resolve: -> (note, args, context) { Gitlab::Graphql::Loaders::BatchModelLoader.new(User, note.author_id).find }
+            description: 'User who wrote this note'
 
       field :system, GraphQL::BOOLEAN_TYPE,
             null: false,
@@ -52,6 +50,14 @@ module Types
       def system_note_icon_name
         SystemNoteHelper.system_note_icon_name(object) if object.system?
       end
+
+      def project
+        Gitlab::Graphql::Loaders::BatchModelLoader.new(Project, object.project_id).find
+      end
+
+      def author
+        Gitlab::Graphql::Loaders::BatchModelLoader.new(User, object.author_id).find
+      end
     end
   end
 end
diff --git a/app/graphql/types/permission_types/merge_request.rb b/app/graphql/types/permission_types/merge_request.rb
index e9c89b0c92e..52c11fe5588 100644
--- a/app/graphql/types/permission_types/merge_request.rb
+++ b/app/graphql/types/permission_types/merge_request.rb
@@ -19,7 +19,9 @@ module Types
         permission_field field_name, method: :"can_#{field_name}?", calls_gitaly: true
       end
 
-      permission_field :can_merge, calls_gitaly: true, resolve: -> (object, args, context) do
+      permission_field :can_merge, calls_gitaly: true
+
+      def can_merge
         object.can_be_merged_by?(context[:current_user])
       end
     end
diff --git a/app/graphql/types/project_type.rb b/app/graphql/types/project_type.rb
index 16f758c0c6b..4bf8402c0fb 100644
--- a/app/graphql/types/project_type.rb
+++ b/app/graphql/types/project_type.rb
@@ -67,33 +67,25 @@ module Types
           description: 'E-mail address of the service desk.'
 
     field :avatar_url, GraphQL::STRING_TYPE, null: true, calls_gitaly: true,
-          description: 'URL to avatar image file of the project',
-          resolve: -> (project, args, ctx) do
-            project.avatar_url(only_path: false)
-          end
+          description: 'URL to avatar image file of the project'
 
     %i[issues merge_requests wiki snippets].each do |feature|
       field "#{feature}_enabled", GraphQL::BOOLEAN_TYPE, null: true,
-            description: "Indicates if #{feature.to_s.titleize.pluralize} are enabled for the current user",
-            resolve: -> (project, args, ctx) do
-              project.feature_available?(feature, ctx[:current_user])
-            end
+            description: "Indicates if #{feature.to_s.titleize.pluralize} are enabled for the current user"
+
+      define_method "#{feature}_enabled" do
+        object.feature_available?(feature, context[:current_user])
+      end
     end
 
     field :jobs_enabled, GraphQL::BOOLEAN_TYPE, null: true,
-          description: 'Indicates if CI/CD pipeline jobs are enabled for the current user',
-          resolve: -> (project, args, ctx) do
-            project.feature_available?(:builds, ctx[:current_user])
-          end
+          description: 'Indicates if CI/CD pipeline jobs are enabled for the current user'
 
     field :public_jobs, GraphQL::BOOLEAN_TYPE, method: :public_builds, null: true,
           description: 'Indicates if there is public access to pipelines and job details of the project, including output logs and artifacts'
 
     field :open_issues_count, GraphQL::INT_TYPE, null: true,
-          description: 'Number of open issues for the project',
-          resolve: -> (project, args, ctx) do
-            project.open_issues_count if project.feature_available?(:issues, ctx[:current_user])
-          end
+          description: 'Number of open issues for the project'
 
     field :import_status, GraphQL::STRING_TYPE, null: true,
           description: 'Status of import background job of the project'
@@ -123,8 +115,7 @@ module Types
 
     field :statistics, Types::ProjectStatisticsType,
           null: true,
-          description: 'Statistics of the project',
-          resolve: -> (obj, _args, _ctx) { Gitlab::Graphql::Loaders::BatchProjectStatisticsLoader.new(obj.id).find }
+          description: 'Statistics of the project'
 
     field :repository, Types::RepositoryType, null: true,
           description: 'Git repository of the project'
@@ -334,6 +325,22 @@ module Types
         .execute
     end
 
+    def avatar_url
+      object.avatar_url(only_path: false)
+    end
+
+    def jobs_enabled
+      object.feature_available?(:builds, context[:current_user])
+    end
+
+    def open_issues_count
+      object.open_issues_count if object.feature_available?(:issues, context[:current_user])
+    end
+
+    def statistics
+      Gitlab::Graphql::Loaders::BatchProjectStatisticsLoader.new(object.id).find
+    end
+
     private
 
     def project
diff --git a/app/graphql/types/query_type.rb b/app/graphql/types/query_type.rb
index d194b0979b3..75ff6f8deca 100644
--- a/app/graphql/types/query_type.rb
+++ b/app/graphql/types/query_type.rb
@@ -24,7 +24,6 @@ module Types
 
     field :current_user, Types::UserType,
           null: true,
-          resolve: -> (_obj, _args, context) { context[:current_user] },
           description: "Get information about current user"
 
     field :namespace, Types::NamespaceType,
@@ -116,6 +115,10 @@ module Types
       id = ::Types::GlobalIDType[::ContainerRepository].coerce_isolated_input(id)
       GitlabSchema.find_by_gid(id)
     end
+
+    def current_user
+      context[:current_user]
+    end
   end
 end
 
diff --git a/app/graphql/types/snippets/blob_viewer_type.rb b/app/graphql/types/snippets/blob_viewer_type.rb
index 50d0b0522d6..a2ffa144066 100644
--- a/app/graphql/types/snippets/blob_viewer_type.rb
+++ b/app/graphql/types/snippets/blob_viewer_type.rb
@@ -17,14 +17,12 @@ module Types
       field :collapsed, GraphQL::BOOLEAN_TYPE,
             description: 'Shows whether the blob should be displayed collapsed',
             method: :collapsed?,
-            null: false,
-            resolve: -> (viewer, _args, _ctx) { !!viewer&.collapsed? }
+            null: false
 
       field :too_large, GraphQL::BOOLEAN_TYPE,
             description: 'Shows whether the blob too large to be displayed',
             method: :too_large?,
-            null: false,
-            resolve: -> (viewer, _args, _ctx) { !!viewer&.too_large? }
+            null: false
 
       field :render_error, GraphQL::STRING_TYPE,
             description: 'Error rendering the blob content',
@@ -38,6 +36,14 @@ module Types
       field :loading_partial_name, GraphQL::STRING_TYPE,
             description: 'Loading partial name',
             null: false
+
+      def collapsed
+        !!object&.collapsed?
+      end
+
+      def too_large
+        !!object&.too_large?
+      end
     end
   end
 end
diff --git a/app/graphql/types/terraform/state_type.rb b/app/graphql/types/terraform/state_type.rb
index 05b6d130f19..f1bc66bba78 100644
--- a/app/graphql/types/terraform/state_type.rb
+++ b/app/graphql/types/terraform/state_type.rb
@@ -20,8 +20,7 @@ module Types
       field :locked_by_user, Types::UserType,
             null: true,
             authorize: :read_user,
-            description: 'The user currently holding a lock on the Terraform state',
-            resolve: -> (state, _, _) { Gitlab::Graphql::Loaders::BatchModelLoader.new(User, state.locked_by_user_id).find }
+            description: 'The user currently holding a lock on the Terraform state'
 
       field :locked_at, Types::TimeType,
             null: true,
@@ -39,6 +38,10 @@ module Types
       field :updated_at, Types::TimeType,
             null: false,
             description: 'Timestamp the Terraform state was updated'
+
+      def locked_by_user
+        Gitlab::Graphql::Loaders::BatchModelLoader.new(User, object.locked_by_user_id).find
+      end
     end
   end
 end
diff --git a/app/graphql/types/terraform/state_version_type.rb b/app/graphql/types/terraform/state_version_type.rb
index b1fbe42ecaf..ddc1849456e 100644
--- a/app/graphql/types/terraform/state_version_type.rb
+++ b/app/graphql/types/terraform/state_version_type.rb
@@ -14,14 +14,12 @@ module Types
       field :created_by_user, Types::UserType,
             null: true,
             authorize: :read_user,
-            description: 'The user that created this version',
-            resolve: -> (version, _, _) { Gitlab::Graphql::Loaders::BatchModelLoader.new(User, version.created_by_user_id).find }
+            description: 'The user that created this version'
 
       field :job, Types::Ci::JobType,
             null: true,
             authorize: :read_build,
-            description: 'The job that created this version',
-            resolve: -> (version, _, _) { Gitlab::Graphql::Loaders::BatchModelLoader.new(::Ci::Build, version.ci_build_id).find }
+            description: 'The job that created this version'
 
       field :created_at, Types::TimeType,
             null: false,
@@ -30,6 +28,14 @@ module Types
       field :updated_at, Types::TimeType,
             null: false,
             description: 'Timestamp the version was updated'
+
+      def created_by_user
+        Gitlab::Graphql::Loaders::BatchModelLoader.new(User, object.created_by_user_id).find
+      end
+
+      def job
+        Gitlab::Graphql::Loaders::BatchModelLoader.new(::Ci::Build, object.ci_build_id).find
+      end
     end
   end
 end
diff --git a/app/graphql/types/todo_type.rb b/app/graphql/types/todo_type.rb
index 4f21da3d897..3694980ef93 100644
--- a/app/graphql/types/todo_type.rb
+++ b/app/graphql/types/todo_type.rb
@@ -16,19 +16,16 @@ module Types
     field :project, Types::ProjectType,
           description: 'The project this todo is associated with',
           null: true,
-          authorize: :read_project,
-          resolve: -> (todo, args, context) { Gitlab::Graphql::Loaders::BatchModelLoader.new(Project, todo.project_id).find }
+          authorize: :read_project
 
     field :group, Types::GroupType,
           description: 'Group this todo is associated with',
           null: true,
-          authorize: :read_group,
-          resolve: -> (todo, args, context) { Gitlab::Graphql::Loaders::BatchModelLoader.new(Group, todo.group_id).find }
+          authorize: :read_group
 
     field :author, Types::UserType,
           description: 'The author of this todo',
-          null: false,
-          resolve: -> (todo, args, context) { Gitlab::Graphql::Loaders::BatchModelLoader.new(User, todo.author_id).find }
+          null: false
 
     field :action, Types::TodoActionEnum,
           description: 'Action of the todo',
@@ -50,5 +47,17 @@ module Types
     field :created_at, Types::TimeType,
           description: 'Timestamp this todo was created',
           null: false
+
+    def project
+      Gitlab::Graphql::Loaders::BatchModelLoader.new(Project, object.project_id).find
+    end
+
+    def group
+      Gitlab::Graphql::Loaders::BatchModelLoader.new(Group, object.group_id).find
+    end
+
+    def author
+      Gitlab::Graphql::Loaders::BatchModelLoader.new(User, object.author_id).find
+    end
   end
 end
diff --git a/app/graphql/types/tree/blob_type.rb b/app/graphql/types/tree/blob_type.rb
index cc6bf7b4f00..a7b90d2533b 100644
--- a/app/graphql/types/tree/blob_type.rb
+++ b/app/graphql/types/tree/blob_type.rb
@@ -15,13 +15,14 @@ module Types
       field :web_path, GraphQL::STRING_TYPE, null: true,
             description: 'Web path of the blob'
       field :lfs_oid, GraphQL::STRING_TYPE, null: true,
-            description: 'LFS ID of the blob',
-            resolve: -> (blob, args, ctx) do
-              Gitlab::Graphql::Loaders::BatchLfsOidLoader.new(blob.repository, blob.id).find
-            end
+            description: 'LFS ID of the blob'
       field :mode, GraphQL::STRING_TYPE, null: true,
             description: 'Blob mode in numeric format'
-      # rubocop: enable Graphql/AuthorizeTypes
+
+      def lfs_oid
+        Gitlab::Graphql::Loaders::BatchLfsOidLoader.new(object.repository, object.id).find
+      end
     end
+    # rubocop: enable Graphql/AuthorizeTypes
   end
 end
diff --git a/app/graphql/types/tree/tree_type.rb b/app/graphql/types/tree/tree_type.rb
index b9fb6b28e71..fecd6c0f309 100644
--- a/app/graphql/types/tree/tree_type.rb
+++ b/app/graphql/types/tree/tree_type.rb
@@ -8,27 +8,32 @@ module Types
 
       # Complexity 10 as it triggers a Gitaly call on each render
       field :last_commit, Types::CommitType,
-        null: true, complexity: 10, calls_gitaly: true, resolver: Resolvers::LastCommitResolver,
-        description: 'Last commit for the tree'
+            null: true, complexity: 10, calls_gitaly: true, resolver: Resolvers::LastCommitResolver,
+            description: 'Last commit for the tree'
 
       field :trees, Types::Tree::TreeEntryType.connection_type, null: false,
-            description: 'Trees of the tree',
-            resolve: -> (obj, args, ctx) do
-              Gitlab::Graphql::Representation::TreeEntry.decorate(obj.trees, obj.repository)
-            end
+            description: 'Trees of the tree'
 
       field :submodules, Types::Tree::SubmoduleType.connection_type, null: false,
             description: 'Sub-modules of the tree',
-            calls_gitaly: true, resolve: -> (obj, args, ctx) do
-              Gitlab::Graphql::Representation::SubmoduleTreeEntry.decorate(obj.submodules, obj)
-            end
+            calls_gitaly: true
 
       field :blobs, Types::Tree::BlobType.connection_type, null: false,
             description: 'Blobs of the tree',
-            calls_gitaly: true, resolve: -> (obj, args, ctx) do
-              Gitlab::Graphql::Representation::TreeEntry.decorate(obj.blobs, obj.repository)
-            end
-      # rubocop: enable Graphql/AuthorizeTypes
+            calls_gitaly: true
+
+      def trees
+        Gitlab::Graphql::Representation::TreeEntry.decorate(object.trees, object.repository)
+      end
+
+      def submodules
+        Gitlab::Graphql::Representation::SubmoduleTreeEntry.decorate(object.submodules, object)
+      end
+
+      def blobs
+        Gitlab::Graphql::Representation::TreeEntry.decorate(object.blobs, object.repository)
+      end
     end
+    # rubocop: enable Graphql/AuthorizeTypes
   end
 end
diff --git a/app/models/analytics/devops_adoption.rb b/app/models/analytics/devops_adoption.rb
deleted file mode 100644
index ed5a5b16a6e..00000000000
--- a/app/models/analytics/devops_adoption.rb
+++ /dev/null
@@ -1,6 +0,0 @@
-# frozen_string_literal: true
-module Analytics::DevopsAdoption
-  def self.table_name_prefix
-    'analytics_devops_adoption_'
-  end
-end
diff --git a/app/models/analytics/devops_adoption/segment.rb b/app/models/analytics/devops_adoption/segment.rb
deleted file mode 100644
index baab5b94126..00000000000
--- a/app/models/analytics/devops_adoption/segment.rb
+++ /dev/null
@@ -1,24 +0,0 @@
-# frozen_string_literal: true
-
-class Analytics::DevopsAdoption::Segment < ApplicationRecord
-  ALLOWED_SEGMENT_COUNT = 20
-
-  has_many :segment_selections
-  has_many :groups, through: :segment_selections
-
-  validates :name, presence: true, uniqueness: true, length: { maximum: 255 }
-  validate :validate_segment_count, on: :create
-
-  accepts_nested_attributes_for :segment_selections, allow_destroy: true
-
-  scope :ordered_by_name, -> { order(:name) }
-  scope :with_groups, -> { preload(:groups) }
-
-  private
-
-  def validate_segment_count
-    if self.class.count >= ALLOWED_SEGMENT_COUNT
-      errors.add(:name, s_('DevopsAdoptionSegment|The maximum number of segments has been reached'))
-    end
-  end
-end
diff --git a/app/models/analytics/devops_adoption/segment_selection.rb b/app/models/analytics/devops_adoption/segment_selection.rb
deleted file mode 100644
index 8f95ce088a2..00000000000
--- a/app/models/analytics/devops_adoption/segment_selection.rb
+++ /dev/null
@@ -1,36 +0,0 @@
-# frozen_string_literal: true
-
-class Analytics::DevopsAdoption::SegmentSelection < ApplicationRecord
-  ALLOWED_SELECTIONS_PER_SEGMENT = 20
-
-  belongs_to :segment
-  belongs_to :project
-  belongs_to :group
-
-  validates :segment, presence: true
-  validates :project, presence: { unless: :group }
-  validates :project_id, uniqueness: { scope: :segment_id, if: :project }
-  validates :group, presence: { unless: :project }
-  validates :group_id, uniqueness: { scope: :segment_id, if: :group }
-
-  validate :exclusive_project_or_group
-  validate :validate_selection_count, on: :create
-
-  private
-
-  def exclusive_project_or_group
-    if project.present? && group.present?
-      errors.add(:group, s_('DevopsAdoptionSegmentSelection|The selection cannot be configured for a project and for a group at the same time'))
-    end
-  end
-
-  def validate_selection_count
-    return unless segment
-
-    # handle single model creation and bulk creation from accepts_nested_attributes_for
-    selections = segment.segment_selections + [self]
-    if selections.reject(&:marked_for_destruction?).uniq.size > ALLOWED_SELECTIONS_PER_SEGMENT
-      errors.add(:segment, s_('DevopsAdoptionSegmentSelection|The maximum number of selections has been reached'))
-    end
-  end
-end
diff --git a/app/services/import/github_service.rb b/app/services/import/github_service.rb
index 948dba2d206..3c9fdbaaddf 100644
--- a/app/services/import/github_service.rb
+++ b/app/services/import/github_service.rb
@@ -31,9 +31,8 @@ module Import
         project_name,
         target_namespace,
         current_user,
-        access_params,
-        type: provider
-      ).execute(extra_project_attrs)
+        type: provider,
+        **access_params).execute(extra_project_attrs)
     end
 
     def repo
diff --git a/app/views/clusters/clusters/gcp/_form.html.haml b/app/views/clusters/clusters/gcp/_form.html.haml
index d1ea7fec49d..573b96caae5 100644
--- a/app/views/clusters/clusters/gcp/_form.html.haml
+++ b/app/views/clusters/clusters/gcp/_form.html.haml
@@ -32,7 +32,7 @@
           %button.dropdown-menu-toggle.dropdown-menu-full-width{ type: 'button', disabled: true }
             %span.dropdown-toggle-text
               = _('Select project')
-            = icon('chevron-down')
+            = sprite_icon('chevron-down', css_class: 'dropdown-menu-toggle-icon gl-top-3')
         %span.form-text.text-muted &nbsp;
 
     .form-group
@@ -43,7 +43,7 @@
           %button.dropdown-menu-toggle.dropdown-menu-full-width{ type: 'button', disabled: true }
             %span.dropdown-toggle-text
               = _('Select project to choose zone')
-            = icon('chevron-down')
+            = sprite_icon('chevron-down', css_class: 'dropdown-menu-toggle-icon gl-top-3')
       %p.form-text.text-muted
         = s_('ClusterIntegration|Learn more about %{help_link_start}zones%{help_link_end}.').html_safe % { help_link_start: help_link_start % { url: zones_link_url }, help_link_end: help_link_end }
 
@@ -59,7 +59,7 @@
           %button.dropdown-menu-toggle.dropdown-menu-full-width{ type: 'button', disabled: true }
             %span.dropdown-toggle-text
               = _('Select project and zone to choose machine type')
-            = icon('chevron-down')
+            = sprite_icon('chevron-down', css_class: 'dropdown-menu-toggle-icon gl-top-3')
       %p.form-text.text-muted
         = s_('ClusterIntegration|Learn more about %{help_link_start_machine_type}machine types%{help_link_end} and %{help_link_start_pricing}pricing%{help_link_end}.').html_safe % { help_link_start_machine_type: help_link_start % { url: machine_type_link_url }, help_link_start_pricing: help_link_start % { url: pricing_link_url }, help_link_end: help_link_end }
 
diff --git a/app/views/layouts/jira_connect.html.haml b/app/views/layouts/jira_connect.html.haml
index 8e1549f5f59..0d4ecfc5a10 100644
--- a/app/views/layouts/jira_connect.html.haml
+++ b/app/views/layouts/jira_connect.html.haml
@@ -9,6 +9,7 @@
 
     = javascript_include_tag 'https://connect-cdn.atl-paas.net/all.js'
     = javascript_include_tag 'https://unpkg.com/jquery@3.3.1/dist/jquery.min.js'
+    = Gon::Base.render_data(nonce: content_security_policy_nonce)
     = yield :head
   %body
     .ac-content
diff --git a/app/views/projects/issuable/_show.html.haml b/app/views/projects/issuable/_show.html.haml
index 48920c4e342..8015b205568 100644
--- a/app/views/projects/issuable/_show.html.haml
+++ b/app/views/projects/issuable/_show.html.haml
@@ -3,7 +3,6 @@
 - if issuable.relocation_target
   - page_canonical_link issuable.relocation_target.present(current_user: current_user).web_url
 
-= render_if_exists "projects/issues/alert_blocked", issue: issuable, current_user: current_user
 = render "projects/issues/alert_moved_from_service_desk", issue: issuable
 
 = render 'shared/issue_type/details_header', issuable: issuable
diff --git a/app/views/projects/merge_requests/_how_to_merge.html.haml b/app/views/projects/merge_requests/_how_to_merge.html.haml
deleted file mode 100644
index a831972a823..00000000000
--- a/app/views/projects/merge_requests/_how_to_merge.html.haml
+++ /dev/null
@@ -1,56 +0,0 @@
-#modal_merge_info.modal{ tabindex: '-1' }
-  .modal-dialog.modal-lg
-    .modal-content
-      .modal-header
-        %h3.modal-title Check out, review, and merge locally
-        %button.close{ type: "button", "data-dismiss": "modal", "aria-label" => _('Close') }
-          %span{ "aria-hidden": true } &times;
-      .modal-body
-        %p
-          %strong Step 1.
-          Fetch and check out the branch for this merge request
-        = clipboard_button(target: "pre#merge-info-1", title: _("Copy commands"))
-        %pre.dark#merge-info-1
-          - if @merge_request.for_fork?
-            -# All repo/branch refs have been quoted to allow support for special characters (such as #my-branch)
-            :preserve
-              git fetch "#{h default_url_to_repo(@merge_request.source_project)}" "#{h @merge_request.source_branch}"
-              git checkout -b "#{h @merge_request.source_project_path}-#{h @merge_request.source_branch}" FETCH_HEAD
-          - else
-            :preserve
-              git fetch origin
-              git checkout -b "#{h @merge_request.source_branch}" "origin/#{h @merge_request.source_branch}"
-        %p
-          %strong Step 2.
-          Review the changes locally
-
-        %p
-          %strong Step 3.
-          Merge the branch and fix any conflicts that come up
-        = clipboard_button(target: "pre#merge-info-3", title: _("Copy commands"))
-        %pre.dark#merge-info-3
-          - if @merge_request.for_fork?
-            :preserve
-              git fetch origin
-              git checkout "#{h @merge_request.target_branch}"
-              git merge --no-ff "#{h @merge_request.source_project_path}-#{h @merge_request.source_branch}"
-          - else
-            :preserve
-              git fetch origin
-              git checkout "#{h @merge_request.target_branch}"
-              git merge --no-ff "#{h @merge_request.source_branch}"
-        %p
-          %strong Step 4.
-          Push the result of the merge to GitLab
-        = clipboard_button(target: "pre#merge-info-4", title: _("Copy commands"))
-        %pre.dark#merge-info-4
-          :preserve
-            git push origin "#{h @merge_request.target_branch}"
-        - unless @merge_request.can_be_merged_by?(current_user)
-          %p
-            Note that pushing to GitLab requires write access to this repository.
-        %p
-          %strong Tip:
-          = succeed '.' do
-            You can also checkout merge requests locally by
-            = link_to 'following these guidelines', help_page_path('user/project/merge_requests/reviewing_and_managing_merge_requests.md', anchor: "checkout-merge-requests-locally-through-the-head-ref"), target: '_blank', rel: 'noopener noreferrer'
diff --git a/app/views/projects/merge_requests/show.html.haml b/app/views/projects/merge_requests/show.html.haml
index 53ea9678c07..c70fc624dde 100644
--- a/app/views/projects/merge_requests/show.html.haml
+++ b/app/views/projects/merge_requests/show.html.haml
@@ -16,9 +16,6 @@
 .merge-request{ data: { mr_action: mr_action, url: merge_request_path(@merge_request, format: :json), project_path: project_path(@merge_request.project), lock_version: @merge_request.lock_version } }
   = render "projects/merge_requests/mr_title"
 
-  - if @merge_request.source_branch_exists?
-    = render "projects/merge_requests/how_to_merge"
-
   .merge-request-details.issuable-details{ data: { id: @merge_request.project.id } }
     = render "projects/merge_requests/mr_box"
     .merge-request-tabs-holder{ class: ("js-tabs-affix" unless ENV['RAILS_ENV'] == 'test') }
diff --git a/app/views/shared/issuable/_form.html.haml b/app/views/shared/issuable/_form.html.haml
index c0aba0eef7f..b412f61e2a8 100644
--- a/app/views/shared/issuable/_form.html.haml
+++ b/app/views/shared/issuable/_form.html.haml
@@ -88,3 +88,6 @@
   = form.hidden_field :issue_type
 
 = form.hidden_field :lock_version
+
+- if @vulnerability_id
+  = hidden_field_tag 'vulnerability_id', @vulnerability_id
diff --git a/app/views/users/_overview.html.haml b/app/views/users/_overview.html.haml
index 1367d80cf54..a78971967ff 100644
--- a/app/views/users/_overview.html.haml
+++ b/app/views/users/_overview.html.haml
@@ -18,7 +18,7 @@
             %h4.gl-flex-grow-1
               = Feature.enabled?(:security_auto_fix) && @user.bot? ? s_('UserProfile|Bot activity') : s_('UserProfile|Activity')
             = link_to s_('UserProfile|View all'), user_activity_path, class: "hide js-view-all"
-          .overview-content-list{ data: { href: user_path } }
+          .overview-content-list{ data: { href: user_activity_path } }
             .center.light.loading
               .spinner.spinner-md
 
diff --git a/app/views/users/show.html.haml b/app/views/users/show.html.haml
index 822a9763d6c..9f6b0bc2373 100644
--- a/app/views/users/show.html.haml
+++ b/app/views/users/show.html.haml
@@ -139,7 +139,7 @@
           - if can?(current_user, :read_cross_project)
             %h4.prepend-top-20
               = s_('UserProfile|Most Recent Activity')
-            .content_list{ data: { href: user_path } }
+            .content_list{ data: { href: user_activity_path } }
             .loading
               .spinner.spinner-md
       - unless @user.bot?
diff --git a/app/workers/all_queues.yml b/app/workers/all_queues.yml
index b5e62af4a87..ec64467f46d 100644
--- a/app/workers/all_queues.yml
+++ b/app/workers/all_queues.yml
@@ -1852,7 +1852,7 @@
   :urgency: :high
   :resource_boundary: :unknown
   :weight: 1
-  :idempotent:
+  :idempotent: true
   :tags: []
 - :name: project_daily_statistics
   :feature_category: :source_code_management
diff --git a/app/workers/project_cache_worker.rb b/app/workers/project_cache_worker.rb
index b114c67de47..8a9c166e5df 100644
--- a/app/workers/project_cache_worker.rb
+++ b/app/workers/project_cache_worker.rb
@@ -1,7 +1,7 @@
 # frozen_string_literal: true
 
 # Worker for updating any project specific caches.
-class ProjectCacheWorker # rubocop:disable Scalability/IdempotentWorker
+class ProjectCacheWorker
   include ApplicationWorker
 
   LEASE_TIMEOUT = 15.minutes.to_i
@@ -9,6 +9,7 @@ class ProjectCacheWorker # rubocop:disable Scalability/IdempotentWorker
   feature_category :source_code_management
   urgency :high
   loggable_arguments 1, 2, 3
+  idempotent!
 
   # project_id - The ID of the project for which to flush the cache.
   # files - An Array containing extra types of files to refresh such as
diff --git a/changelogs/unreleased/228675-separate-filtering-users-from-sorting-users-support-multiple-filte.yml b/changelogs/unreleased/228675-separate-filtering-users-from-sorting-users-support-multiple-filte.yml
new file mode 100644
index 00000000000..e6e5bf122dc
--- /dev/null
+++ b/changelogs/unreleased/228675-separate-filtering-users-from-sorting-users-support-multiple-filte.yml
@@ -0,0 +1,5 @@
+---
+title: Add support for filtering direct group members by 2FA enabled/disabled
+merge_request: 48084
+author:
+type: changed
diff --git a/changelogs/unreleased/229677-mr-widget-conflicts-warning.yml b/changelogs/unreleased/229677-mr-widget-conflicts-warning.yml
new file mode 100644
index 00000000000..eadc599ee84
--- /dev/null
+++ b/changelogs/unreleased/229677-mr-widget-conflicts-warning.yml
@@ -0,0 +1,5 @@
+---
+title: Replace how to merge HAML with Vue component
+merge_request: 48766
+author:
+type: changed
diff --git a/changelogs/unreleased/285096-replace-fa-chevron-down-icons-in-clusters-gcp-form.yml b/changelogs/unreleased/285096-replace-fa-chevron-down-icons-in-clusters-gcp-form.yml
new file mode 100644
index 00000000000..009f7a9685a
--- /dev/null
+++ b/changelogs/unreleased/285096-replace-fa-chevron-down-icons-in-clusters-gcp-form.yml
@@ -0,0 +1,5 @@
+---
+title: Replace fa-chevron-down icons with GitLab SVG in gcp cluster form
+merge_request: 48656
+author:
+type: changed
diff --git a/changelogs/unreleased/288944-move-users-show-json.yml b/changelogs/unreleased/288944-move-users-show-json.yml
new file mode 100644
index 00000000000..7996591bd42
--- /dev/null
+++ b/changelogs/unreleased/288944-move-users-show-json.yml
@@ -0,0 +1,5 @@
+---
+title: Move users#show.json to users#activity.json
+merge_request: 48712
+author: Takuya Noguchi
+type: other
diff --git a/changelogs/unreleased/create-devops-adoption-measurements.yml b/changelogs/unreleased/create-devops-adoption-measurements.yml
new file mode 100644
index 00000000000..a5b3f6d3c2a
--- /dev/null
+++ b/changelogs/unreleased/create-devops-adoption-measurements.yml
@@ -0,0 +1,5 @@
+---
+title: Add analytics_devops_adoption_snapshots table
+merge_request: 47388
+author:
+type: other
diff --git a/changelogs/unreleased/ss-add-loading-state-to-assignee-header.yml b/changelogs/unreleased/ss-add-loading-state-to-assignee-header.yml
new file mode 100644
index 00000000000..d2b37d9fb5e
--- /dev/null
+++ b/changelogs/unreleased/ss-add-loading-state-to-assignee-header.yml
@@ -0,0 +1,5 @@
+---
+title: Add loading state to assignees header
+merge_request: 48392
+author:
+type: added
diff --git a/changelogs/unreleased/ss-add-loading-to-assignees.yml b/changelogs/unreleased/ss-add-loading-to-assignees.yml
index 1b9a9690cff..0834b0b83b9 100644
--- a/changelogs/unreleased/ss-add-loading-to-assignees.yml
+++ b/changelogs/unreleased/ss-add-loading-to-assignees.yml
@@ -1,5 +1,5 @@
 ---
-title: Add loading state to assignees dropdown
+title: Add loading state to boards assignees header dropdown
 merge_request: 47848
 author:
 type: added
diff --git a/config/feature_categories.yml b/config/feature_categories.yml
index 0f36e3e1727..3db25e0996b 100644
--- a/config/feature_categories.yml
+++ b/config/feature_categories.yml
@@ -38,7 +38,6 @@
 - dependency_proxy
 - dependency_scanning
 - design_management
-- design_system
 - devops_reports
 - disaster_recovery
 - dynamic_application_security_testing
@@ -54,7 +53,6 @@
 - git_lfs
 - gitaly
 - gitlab_docs
-- gitlab_handbook
 - global_search
 - helm_chart_registry
 - importers
@@ -69,7 +67,6 @@
 - issue_tracking
 - jenkins_importer
 - jira_importer
-- jupyter_notebooks
 - kubernetes_management
 - license_compliance
 - live_preview
diff --git a/config/routes/git_http.rb b/config/routes/git_http.rb
index fb8119904ea..f27fc2b79b3 100644
--- a/config/routes/git_http.rb
+++ b/config/routes/git_http.rb
@@ -1,60 +1,47 @@
-concern :gitactionable do
-  scope(controller: :git_http) do
-    get '/info/refs', action: :info_refs
-    post '/git-upload-pack', action: :git_upload_pack
-    post '/git-receive-pack', action: :git_receive_pack
-  end
-end
-
-concern :lfsable do
-  # Git LFS API (metadata)
-  scope(path: 'info/lfs/objects', controller: :lfs_api) do
-    post :batch
-    post '/', action: :deprecated
-    get '/*oid', action: :deprecated
-  end
-
-  scope(path: 'info/lfs') do
-    resources :lfs_locks, controller: :lfs_locks_api, path: 'locks' do
-      post :unlock, on: :member
-      post :verify, on: :collection
-    end
-  end
-
-  # GitLab LFS object storage
-  scope(path: 'gitlab-lfs/objects/*oid', controller: :lfs_storage, constraints: { oid: /[a-f0-9]{64}/ }) do
-    get '/', action: :download
-
-    scope constraints: { size: /[0-9]+/ } do
-      put '/*size/authorize', action: :upload_authorize
-      put '/*size', action: :upload_finalize
-    end
-  end
-end
-
-# Git route for personal and project snippets
-scope(path: ':namespace_id/:repository_id',
-      format: nil,
-      constraints: { namespace_id: Gitlab::PathRegex.personal_and_project_snippets_path_regex, repository_id: /\d+\.git/ },
-      module: :repositories) do
-  concerns :gitactionable
-end
-
-scope(path: '*namespace_id/:repository_id',
-      format: nil,
-      constraints: { namespace_id: Gitlab::PathRegex.full_namespace_route_regex }) do
-  scope(constraints: { repository_id: Gitlab::PathRegex.project_git_route_regex }) do
+scope(path: '*repository_path', format: false) do
+  constraints(repository_path: Gitlab::PathRegex.repository_git_route_regex) do
     scope(module: :repositories) do
-      concerns :gitactionable
-      concerns :lfsable
+      # Git HTTP API
+      scope(controller: :git_http) do
+        get '/info/refs', action: :info_refs
+        post '/git-upload-pack', action: :git_upload_pack
+        post '/git-receive-pack', action: :git_receive_pack
+      end
+
+      # NOTE: LFS routes are exposed on all repository types, but we still check for
+      # LFS availability on the repository container in LfsRequest#require_lfs_enabled!
+
+      # Git LFS API (metadata)
+      scope(path: 'info/lfs/objects', controller: :lfs_api) do
+        post :batch
+        post '/', action: :deprecated
+        get '/*oid', action: :deprecated
+      end
+
+      scope(path: 'info/lfs') do
+        resources :lfs_locks, controller: :lfs_locks_api, path: 'locks' do
+          post :unlock, on: :member
+          post :verify, on: :collection
+        end
+      end
+
+      # GitLab LFS object storage
+      scope(path: 'gitlab-lfs/objects/*oid', controller: :lfs_storage, constraints: { oid: /[a-f0-9]{64}/ }) do
+        get '/', action: :download
+
+        constraints(size: /[0-9]+/) do
+          put '/*size/authorize', action: :upload_authorize
+          put '/*size', action: :upload_finalize
+        end
+      end
     end
   end
 
   # Redirect /group/project.wiki.git to the project wiki
-  scope(format: true, constraints: { repository_id: Gitlab::PathRegex.project_wiki_git_route_regex, format: :git }) do
+  constraints(repository_path: Gitlab::PathRegex.repository_wiki_git_route_regex) do
     wiki_redirect = redirect do |params, request|
-      project_id = params[:repository_id].delete_suffix('.wiki')
-      path = [params[:namespace_id], project_id, 'wikis'].join('/')
+      container_path = params[:repository_path].delete_suffix('.wiki.git')
+      path = File.join(container_path, '-', 'wikis')
       path << "?#{request.query_string}" unless request.query_string.blank?
       path
     end
@@ -63,22 +50,14 @@ scope(path: '*namespace_id/:repository_id',
   end
 
   # Redirect /group/project/info/refs to /group/project.git/info/refs
-  scope(constraints: { repository_id: Gitlab::PathRegex.project_route_regex }) do
-    # Allow /info/refs, /info/refs?service=git-upload-pack, and
-    # /info/refs?service=git-receive-pack, but nothing else.
-    #
-    git_http_handshake = lambda do |request|
-      ::Constraints::ProjectUrlConstrainer.new.matches?(request, existence_check: false) &&
-        (request.query_string.blank? ||
-         request.query_string.match(/\Aservice=git-(upload|receive)-pack\z/))
-    end
-
+  # This allows cloning a repository without the trailing `.git`
+  constraints(repository_path: Gitlab::PathRegex.repository_route_regex) do
     ref_redirect = redirect do |params, request|
-      path = "#{params[:namespace_id]}/#{params[:repository_id]}.git/info/refs"
+      path = "#{params[:repository_path]}.git/info/refs"
       path << "?#{request.query_string}" unless request.query_string.blank?
       path
     end
 
-    get '/info/refs', constraints: git_http_handshake, to: ref_redirect
+    get '/info/refs', constraints: ::Constraints::RepositoryRedirectUrlConstrainer.new, to: ref_redirect
   end
 end
diff --git a/db/migrate/20201111100136_create_analytics_devops_adoption_snapshots.rb b/db/migrate/20201111100136_create_analytics_devops_adoption_snapshots.rb
new file mode 100644
index 00000000000..ee029d17c94
--- /dev/null
+++ b/db/migrate/20201111100136_create_analytics_devops_adoption_snapshots.rb
@@ -0,0 +1,21 @@
+# frozen_string_literal: true
+
+class CreateAnalyticsDevopsAdoptionSnapshots < ActiveRecord::Migration[6.0]
+  DOWNTIME = false
+
+  def change
+    create_table :analytics_devops_adoption_snapshots do |t|
+      t.references :segment, index: false, null: false, foreign_key: { to_table: :analytics_devops_adoption_segments, on_delete: :cascade }
+      t.datetime_with_timezone :recorded_at, null: false
+      t.boolean :issue_opened, null: false
+      t.boolean :merge_request_opened, null: false
+      t.boolean :merge_request_approved, null: false
+      t.boolean :runner_configured, null: false
+      t.boolean :pipeline_succeeded, null: false
+      t.boolean :deploy_succeeded, null: false
+      t.boolean :security_scan_succeeded, null: false
+
+      t.index [:segment_id, :recorded_at], name: 'index_on_snapshots_segment_id_recorded_at'
+    end
+  end
+end
diff --git a/db/schema_migrations/20201111100136 b/db/schema_migrations/20201111100136
new file mode 100644
index 00000000000..da41078fafb
--- /dev/null
+++ b/db/schema_migrations/20201111100136
@@ -0,0 +1 @@
+7a905f8e636be21e328a622d9871018903982989836e6e0def09fd2c2826691f
\ No newline at end of file
diff --git a/db/structure.sql b/db/structure.sql
index d99e6a8c2ca..d50148599b3 100644
--- a/db/structure.sql
+++ b/db/structure.sql
@@ -8990,6 +8990,28 @@ CREATE SEQUENCE analytics_devops_adoption_segments_id_seq
 
 ALTER SEQUENCE analytics_devops_adoption_segments_id_seq OWNED BY analytics_devops_adoption_segments.id;
 
+CREATE TABLE analytics_devops_adoption_snapshots (
+    id bigint NOT NULL,
+    segment_id bigint NOT NULL,
+    recorded_at timestamp with time zone NOT NULL,
+    issue_opened boolean NOT NULL,
+    merge_request_opened boolean NOT NULL,
+    merge_request_approved boolean NOT NULL,
+    runner_configured boolean NOT NULL,
+    pipeline_succeeded boolean NOT NULL,
+    deploy_succeeded boolean NOT NULL,
+    security_scan_succeeded boolean NOT NULL
+);
+
+CREATE SEQUENCE analytics_devops_adoption_snapshots_id_seq
+    START WITH 1
+    INCREMENT BY 1
+    NO MINVALUE
+    NO MAXVALUE
+    CACHE 1;
+
+ALTER SEQUENCE analytics_devops_adoption_snapshots_id_seq OWNED BY analytics_devops_adoption_snapshots.id;
+
 CREATE TABLE analytics_instance_statistics_measurements (
     id bigint NOT NULL,
     count bigint NOT NULL,
@@ -17773,6 +17795,8 @@ ALTER TABLE ONLY analytics_devops_adoption_segment_selections ALTER COLUMN id SE
 
 ALTER TABLE ONLY analytics_devops_adoption_segments ALTER COLUMN id SET DEFAULT nextval('analytics_devops_adoption_segments_id_seq'::regclass);
 
+ALTER TABLE ONLY analytics_devops_adoption_snapshots ALTER COLUMN id SET DEFAULT nextval('analytics_devops_adoption_snapshots_id_seq'::regclass);
+
 ALTER TABLE ONLY analytics_instance_statistics_measurements ALTER COLUMN id SET DEFAULT nextval('analytics_instance_statistics_measurements_id_seq'::regclass);
 
 ALTER TABLE ONLY appearances ALTER COLUMN id SET DEFAULT nextval('appearances_id_seq'::regclass);
@@ -18754,6 +18778,9 @@ ALTER TABLE ONLY analytics_devops_adoption_segment_selections
 ALTER TABLE ONLY analytics_devops_adoption_segments
     ADD CONSTRAINT analytics_devops_adoption_segments_pkey PRIMARY KEY (id);
 
+ALTER TABLE ONLY analytics_devops_adoption_snapshots
+    ADD CONSTRAINT analytics_devops_adoption_snapshots_pkey PRIMARY KEY (id);
+
 ALTER TABLE ONLY analytics_instance_statistics_measurements
     ADD CONSTRAINT analytics_instance_statistics_measurements_pkey PRIMARY KEY (id);
 
@@ -21632,6 +21659,8 @@ CREATE UNIQUE INDEX index_on_segment_selections_project_id_segment_id ON analyti
 
 CREATE INDEX index_on_segment_selections_segment_id ON analytics_devops_adoption_segment_selections USING btree (segment_id);
 
+CREATE INDEX index_on_snapshots_segment_id_recorded_at ON analytics_devops_adoption_snapshots USING btree (segment_id, recorded_at);
+
 CREATE INDEX index_on_users_lower_email ON users USING btree (lower((email)::text));
 
 CREATE INDEX index_on_users_lower_username ON users USING btree (lower((username)::text));
@@ -23742,6 +23771,9 @@ ALTER TABLE ONLY saml_group_links
 ALTER TABLE ONLY group_custom_attributes
     ADD CONSTRAINT fk_rails_246e0db83a FOREIGN KEY (group_id) REFERENCES namespaces(id) ON DELETE CASCADE;
 
+ALTER TABLE ONLY analytics_devops_adoption_snapshots
+    ADD CONSTRAINT fk_rails_25da9a92c0 FOREIGN KEY (segment_id) REFERENCES analytics_devops_adoption_segments(id) ON DELETE CASCADE;
+
 ALTER TABLE ONLY cluster_agents
     ADD CONSTRAINT fk_rails_25e9fc2d5d FOREIGN KEY (project_id) REFERENCES projects(id) ON DELETE CASCADE;
 
diff --git a/doc/api/graphql/reference/gitlab_schema.graphql b/doc/api/graphql/reference/gitlab_schema.graphql
index 237d8a4c776..f8054919b5c 100644
--- a/doc/api/graphql/reference/gitlab_schema.graphql
+++ b/doc/api/graphql/reference/gitlab_schema.graphql
@@ -5298,12 +5298,12 @@ Represents a DAST Site Validation
 """
 type DastSiteValidation {
   """
-  ID of the site validation
+  Global ID of the site validation
   """
   id: DastSiteValidationID!
 
   """
-  The status of the validation
+  Status of the site validation
   """
   status: DastSiteProfileValidationStatusEnum!
 }
@@ -6539,33 +6539,18 @@ type DevopsAdoptionSegment {
   """
   Assigned groups
   """
-  groups(
-    """
-    Returns the elements in the list that come after the specified cursor.
-    """
-    after: String
-
-    """
-    Returns the elements in the list that come before the specified cursor.
-    """
-    before: String
-
-    """
-    Returns the first _n_ elements from the list.
-    """
-    first: Int
-
-    """
-    Returns the last _n_ elements from the list.
-    """
-    last: Int
-  ): GroupConnection
+  groups: [Group!]
 
   """
   ID of the segment
   """
   id: ID!
 
+  """
+  The latest adoption metrics for the segment
+  """
+  latestSnapshot: DevopsAdoptionSnapshot
+
   """
   Name of the segment
   """
@@ -6607,6 +6592,61 @@ type DevopsAdoptionSegmentEdge {
   node: DevopsAdoptionSegment
 }
 
+"""
+Snapshot
+"""
+type DevopsAdoptionSnapshot {
+  """
+  At least one deployment succeeded
+  """
+  deploySucceeded: Boolean!
+
+  """
+  The end time for the snapshot where the data points were collected
+  """
+  endTime: Time!
+
+  """
+  At least one issue was opened
+  """
+  issueOpened: Boolean!
+
+  """
+  At least one merge request was approved
+  """
+  mergeRequestApproved: Boolean!
+
+  """
+  At least one merge request was opened
+  """
+  mergeRequestOpened: Boolean!
+
+  """
+  At least one pipeline succeeded
+  """
+  pipelineSucceeded: Boolean!
+
+  """
+  The time the snapshot was recorded
+  """
+  recordedAt: Time!
+
+  """
+  At least one runner was used
+  """
+  runnerConfigured: Boolean!
+
+  """
+  At least one security scan succeeded
+  """
+  securityScanSucceeded: Boolean!
+
+  """
+  The start time for the snapshot where the data points were collected
+  """
+  startTime: Time!
+}
+
 input DiffImagePositionInput {
   """
   Merge base of the branch the comment was made on
@@ -7803,12 +7843,12 @@ type EpicIssue implements CurrentUserTodos & Noteable {
   author: User!
 
   """
-  Indicates the issue is blocked
+  Indicates the issue is blocked.
   """
   blocked: Boolean!
 
   """
-  Count of issues blocking this issue
+  Count of issues blocking this issue.
   """
   blockedByCount: Int
 
@@ -7918,7 +7958,7 @@ type EpicIssue implements CurrentUserTodos & Noteable {
   emailsDisabled: Boolean!
 
   """
-  Epic to which this issue belongs
+  Epic to which this issue belongs.
   """
   epic: Epic
 
@@ -7953,7 +7993,7 @@ type EpicIssue implements CurrentUserTodos & Noteable {
   iid: ID!
 
   """
-  Iteration of the issue
+  Iteration of the issue.
   """
   iteration: Iteration
 
@@ -8088,7 +8128,7 @@ type EpicIssue implements CurrentUserTodos & Noteable {
   state: IssueState!
 
   """
-  Indicates whether an issue is published to the status page
+  Indicates whether an issue is published to the status page.
   """
   statusPagePublishedIncident: Boolean
 
@@ -8168,7 +8208,7 @@ type EpicIssue implements CurrentUserTodos & Noteable {
   webUrl: String!
 
   """
-  Weight of the issue
+  Weight of the issue.
   """
   weight: Int
 }
@@ -9872,41 +9912,6 @@ type Group {
   webUrl: String!
 }
 
-"""
-The connection type for Group.
-"""
-type GroupConnection {
-  """
-  A list of edges.
-  """
-  edges: [GroupEdge]
-
-  """
-  A list of nodes.
-  """
-  nodes: [Group]
-
-  """
-  Information to aid in pagination.
-  """
-  pageInfo: PageInfo!
-}
-
-"""
-An edge in a connection.
-"""
-type GroupEdge {
-  """
-  A cursor for use in pagination.
-  """
-  cursor: String!
-
-  """
-  The item at the end of the edge.
-  """
-  node: Group
-}
-
 """
 Identifier of Group
 """
@@ -10484,12 +10489,12 @@ type Issue implements CurrentUserTodos & Noteable {
   author: User!
 
   """
-  Indicates the issue is blocked
+  Indicates the issue is blocked.
   """
   blocked: Boolean!
 
   """
-  Count of issues blocking this issue
+  Count of issues blocking this issue.
   """
   blockedByCount: Int
 
@@ -10599,7 +10604,7 @@ type Issue implements CurrentUserTodos & Noteable {
   emailsDisabled: Boolean!
 
   """
-  Epic to which this issue belongs
+  Epic to which this issue belongs.
   """
   epic: Epic
 
@@ -10629,7 +10634,7 @@ type Issue implements CurrentUserTodos & Noteable {
   iid: ID!
 
   """
-  Iteration of the issue
+  Iteration of the issue.
   """
   iteration: Iteration
 
@@ -10759,7 +10764,7 @@ type Issue implements CurrentUserTodos & Noteable {
   state: IssueState!
 
   """
-  Indicates whether an issue is published to the status page
+  Indicates whether an issue is published to the status page.
   """
   statusPagePublishedIncident: Boolean
 
@@ -10839,7 +10844,7 @@ type Issue implements CurrentUserTodos & Noteable {
   webUrl: String!
 
   """
-  Weight of the issue
+  Weight of the issue.
   """
   weight: Int
 }
diff --git a/doc/api/graphql/reference/gitlab_schema.json b/doc/api/graphql/reference/gitlab_schema.json
index 9ced0721e91..bc773762178 100644
--- a/doc/api/graphql/reference/gitlab_schema.json
+++ b/doc/api/graphql/reference/gitlab_schema.json
@@ -14507,7 +14507,7 @@
           "fields": [
             {
               "name": "id",
-              "description": "ID of the site validation",
+              "description": "Global ID of the site validation",
               "args": [
 
               ],
@@ -14525,7 +14525,7 @@
             },
             {
               "name": "status",
-              "description": "The status of the validation",
+              "description": "Status of the site validation",
               "args": [
 
               ],
@@ -18042,51 +18042,20 @@
               "name": "groups",
               "description": "Assigned groups",
               "args": [
-                {
-                  "name": "after",
-                  "description": "Returns the elements in the list that come after the specified cursor.",
-                  "type": {
-                    "kind": "SCALAR",
-                    "name": "String",
-                    "ofType": null
-                  },
-                  "defaultValue": null
-                },
-                {
-                  "name": "before",
-                  "description": "Returns the elements in the list that come before the specified cursor.",
-                  "type": {
-                    "kind": "SCALAR",
-                    "name": "String",
-                    "ofType": null
-                  },
-                  "defaultValue": null
-                },
-                {
-                  "name": "first",
-                  "description": "Returns the first _n_ elements from the list.",
-                  "type": {
-                    "kind": "SCALAR",
-                    "name": "Int",
-                    "ofType": null
-                  },
-                  "defaultValue": null
-                },
-                {
-                  "name": "last",
-                  "description": "Returns the last _n_ elements from the list.",
-                  "type": {
-                    "kind": "SCALAR",
-                    "name": "Int",
-                    "ofType": null
-                  },
-                  "defaultValue": null
-                }
+
               ],
               "type": {
-                "kind": "OBJECT",
-                "name": "GroupConnection",
-                "ofType": null
+                "kind": "LIST",
+                "name": null,
+                "ofType": {
+                  "kind": "NON_NULL",
+                  "name": null,
+                  "ofType": {
+                    "kind": "OBJECT",
+                    "name": "Group",
+                    "ofType": null
+                  }
+                }
               },
               "isDeprecated": false,
               "deprecationReason": null
@@ -18109,6 +18078,20 @@
               "isDeprecated": false,
               "deprecationReason": null
             },
+            {
+              "name": "latestSnapshot",
+              "description": "The latest adoption metrics for the segment",
+              "args": [
+
+              ],
+              "type": {
+                "kind": "OBJECT",
+                "name": "DevopsAdoptionSnapshot",
+                "ofType": null
+              },
+              "isDeprecated": false,
+              "deprecationReason": null
+            },
             {
               "name": "name",
               "description": "Name of the segment",
@@ -18247,6 +18230,199 @@
           "enumValues": null,
           "possibleTypes": null
         },
+        {
+          "kind": "OBJECT",
+          "name": "DevopsAdoptionSnapshot",
+          "description": "Snapshot",
+          "fields": [
+            {
+              "name": "deploySucceeded",
+              "description": "At least one deployment succeeded",
+              "args": [
+
+              ],
+              "type": {
+                "kind": "NON_NULL",
+                "name": null,
+                "ofType": {
+                  "kind": "SCALAR",
+                  "name": "Boolean",
+                  "ofType": null
+                }
+              },
+              "isDeprecated": false,
+              "deprecationReason": null
+            },
+            {
+              "name": "endTime",
+              "description": "The end time for the snapshot where the data points were collected",
+              "args": [
+
+              ],
+              "type": {
+                "kind": "NON_NULL",
+                "name": null,
+                "ofType": {
+                  "kind": "SCALAR",
+                  "name": "Time",
+                  "ofType": null
+                }
+              },
+              "isDeprecated": false,
+              "deprecationReason": null
+            },
+            {
+              "name": "issueOpened",
+              "description": "At least one issue was opened",
+              "args": [
+
+              ],
+              "type": {
+                "kind": "NON_NULL",
+                "name": null,
+                "ofType": {
+                  "kind": "SCALAR",
+                  "name": "Boolean",
+                  "ofType": null
+                }
+              },
+              "isDeprecated": false,
+              "deprecationReason": null
+            },
+            {
+              "name": "mergeRequestApproved",
+              "description": "At least one merge request was approved",
+              "args": [
+
+              ],
+              "type": {
+                "kind": "NON_NULL",
+                "name": null,
+                "ofType": {
+                  "kind": "SCALAR",
+                  "name": "Boolean",
+                  "ofType": null
+                }
+              },
+              "isDeprecated": false,
+              "deprecationReason": null
+            },
+            {
+              "name": "mergeRequestOpened",
+              "description": "At least one merge request was opened",
+              "args": [
+
+              ],
+              "type": {
+                "kind": "NON_NULL",
+                "name": null,
+                "ofType": {
+                  "kind": "SCALAR",
+                  "name": "Boolean",
+                  "ofType": null
+                }
+              },
+              "isDeprecated": false,
+              "deprecationReason": null
+            },
+            {
+              "name": "pipelineSucceeded",
+              "description": "At least one pipeline succeeded",
+              "args": [
+
+              ],
+              "type": {
+                "kind": "NON_NULL",
+                "name": null,
+                "ofType": {
+                  "kind": "SCALAR",
+                  "name": "Boolean",
+                  "ofType": null
+                }
+              },
+              "isDeprecated": false,
+              "deprecationReason": null
+            },
+            {
+              "name": "recordedAt",
+              "description": "The time the snapshot was recorded",
+              "args": [
+
+              ],
+              "type": {
+                "kind": "NON_NULL",
+                "name": null,
+                "ofType": {
+                  "kind": "SCALAR",
+                  "name": "Time",
+                  "ofType": null
+                }
+              },
+              "isDeprecated": false,
+              "deprecationReason": null
+            },
+            {
+              "name": "runnerConfigured",
+              "description": "At least one runner was used",
+              "args": [
+
+              ],
+              "type": {
+                "kind": "NON_NULL",
+                "name": null,
+                "ofType": {
+                  "kind": "SCALAR",
+                  "name": "Boolean",
+                  "ofType": null
+                }
+              },
+              "isDeprecated": false,
+              "deprecationReason": null
+            },
+            {
+              "name": "securityScanSucceeded",
+              "description": "At least one security scan succeeded",
+              "args": [
+
+              ],
+              "type": {
+                "kind": "NON_NULL",
+                "name": null,
+                "ofType": {
+                  "kind": "SCALAR",
+                  "name": "Boolean",
+                  "ofType": null
+                }
+              },
+              "isDeprecated": false,
+              "deprecationReason": null
+            },
+            {
+              "name": "startTime",
+              "description": "The start time for the snapshot where the data points were collected",
+              "args": [
+
+              ],
+              "type": {
+                "kind": "NON_NULL",
+                "name": null,
+                "ofType": {
+                  "kind": "SCALAR",
+                  "name": "Time",
+                  "ofType": null
+                }
+              },
+              "isDeprecated": false,
+              "deprecationReason": null
+            }
+          ],
+          "inputFields": null,
+          "interfaces": [
+
+          ],
+          "enumValues": null,
+          "possibleTypes": null
+        },
         {
           "kind": "INPUT_OBJECT",
           "name": "DiffImagePositionInput",
@@ -21660,7 +21836,7 @@
             },
             {
               "name": "blocked",
-              "description": "Indicates the issue is blocked",
+              "description": "Indicates the issue is blocked.",
               "args": [
 
               ],
@@ -21678,7 +21854,7 @@
             },
             {
               "name": "blockedByCount",
-              "description": "Count of issues blocking this issue",
+              "description": "Count of issues blocking this issue.",
               "args": [
 
               ],
@@ -21976,7 +22152,7 @@
             },
             {
               "name": "epic",
-              "description": "Epic to which this issue belongs",
+              "description": "Epic to which this issue belongs.",
               "args": [
 
               ],
@@ -22082,7 +22258,7 @@
             },
             {
               "name": "iteration",
-              "description": "Iteration of the issue",
+              "description": "Iteration of the issue.",
               "args": [
 
               ],
@@ -22424,7 +22600,7 @@
             },
             {
               "name": "statusPagePublishedIncident",
-              "description": "Indicates whether an issue is published to the status page",
+              "description": "Indicates whether an issue is published to the status page.",
               "args": [
 
               ],
@@ -22696,7 +22872,7 @@
             },
             {
               "name": "weight",
-              "description": "Weight of the issue",
+              "description": "Weight of the issue.",
               "args": [
 
               ],
@@ -26953,118 +27129,6 @@
           "enumValues": null,
           "possibleTypes": null
         },
-        {
-          "kind": "OBJECT",
-          "name": "GroupConnection",
-          "description": "The connection type for Group.",
-          "fields": [
-            {
-              "name": "edges",
-              "description": "A list of edges.",
-              "args": [
-
-              ],
-              "type": {
-                "kind": "LIST",
-                "name": null,
-                "ofType": {
-                  "kind": "OBJECT",
-                  "name": "GroupEdge",
-                  "ofType": null
-                }
-              },
-              "isDeprecated": false,
-              "deprecationReason": null
-            },
-            {
-              "name": "nodes",
-              "description": "A list of nodes.",
-              "args": [
-
-              ],
-              "type": {
-                "kind": "LIST",
-                "name": null,
-                "ofType": {
-                  "kind": "OBJECT",
-                  "name": "Group",
-                  "ofType": null
-                }
-              },
-              "isDeprecated": false,
-              "deprecationReason": null
-            },
-            {
-              "name": "pageInfo",
-              "description": "Information to aid in pagination.",
-              "args": [
-
-              ],
-              "type": {
-                "kind": "NON_NULL",
-                "name": null,
-                "ofType": {
-                  "kind": "OBJECT",
-                  "name": "PageInfo",
-                  "ofType": null
-                }
-              },
-              "isDeprecated": false,
-              "deprecationReason": null
-            }
-          ],
-          "inputFields": null,
-          "interfaces": [
-
-          ],
-          "enumValues": null,
-          "possibleTypes": null
-        },
-        {
-          "kind": "OBJECT",
-          "name": "GroupEdge",
-          "description": "An edge in a connection.",
-          "fields": [
-            {
-              "name": "cursor",
-              "description": "A cursor for use in pagination.",
-              "args": [
-
-              ],
-              "type": {
-                "kind": "NON_NULL",
-                "name": null,
-                "ofType": {
-                  "kind": "SCALAR",
-                  "name": "String",
-                  "ofType": null
-                }
-              },
-              "isDeprecated": false,
-              "deprecationReason": null
-            },
-            {
-              "name": "node",
-              "description": "The item at the end of the edge.",
-              "args": [
-
-              ],
-              "type": {
-                "kind": "OBJECT",
-                "name": "Group",
-                "ofType": null
-              },
-              "isDeprecated": false,
-              "deprecationReason": null
-            }
-          ],
-          "inputFields": null,
-          "interfaces": [
-
-          ],
-          "enumValues": null,
-          "possibleTypes": null
-        },
         {
           "kind": "SCALAR",
           "name": "GroupID",
@@ -28744,7 +28808,7 @@
             },
             {
               "name": "blocked",
-              "description": "Indicates the issue is blocked",
+              "description": "Indicates the issue is blocked.",
               "args": [
 
               ],
@@ -28762,7 +28826,7 @@
             },
             {
               "name": "blockedByCount",
-              "description": "Count of issues blocking this issue",
+              "description": "Count of issues blocking this issue.",
               "args": [
 
               ],
@@ -29060,7 +29124,7 @@
             },
             {
               "name": "epic",
-              "description": "Epic to which this issue belongs",
+              "description": "Epic to which this issue belongs.",
               "args": [
 
               ],
@@ -29152,7 +29216,7 @@
             },
             {
               "name": "iteration",
-              "description": "Iteration of the issue",
+              "description": "Iteration of the issue.",
               "args": [
 
               ],
@@ -29480,7 +29544,7 @@
             },
             {
               "name": "statusPagePublishedIncident",
-              "description": "Indicates whether an issue is published to the status page",
+              "description": "Indicates whether an issue is published to the status page.",
               "args": [
 
               ],
@@ -29752,7 +29816,7 @@
             },
             {
               "name": "weight",
-              "description": "Weight of the issue",
+              "description": "Weight of the issue.",
               "args": [
 
               ],
diff --git a/doc/api/graphql/reference/index.md b/doc/api/graphql/reference/index.md
index d6f4cfe0ad1..b25aba81c25 100644
--- a/doc/api/graphql/reference/index.md
+++ b/doc/api/graphql/reference/index.md
@@ -887,8 +887,8 @@ Represents a DAST Site Validation.
 
 | Field | Type | Description |
 | ----- | ---- | ----------- |
-| `id` | DastSiteValidationID! | ID of the site validation |
-| `status` | DastSiteProfileValidationStatusEnum! | The status of the validation |
+| `id` | DastSiteValidationID! | Global ID of the site validation |
+| `status` | DastSiteProfileValidationStatusEnum! | Status of the site validation |
 
 ### DastSiteValidationCreatePayload
 
@@ -1104,10 +1104,28 @@ Segment.
 
 | Field | Type | Description |
 | ----- | ---- | ----------- |
-| `groups` | GroupConnection | Assigned groups |
+| `groups` | Group! => Array | Assigned groups |
 | `id` | ID! | ID of the segment |
+| `latestSnapshot` | DevopsAdoptionSnapshot | The latest adoption metrics for the segment |
 | `name` | String! | Name of the segment |
 
+### DevopsAdoptionSnapshot
+
+Snapshot.
+
+| Field | Type | Description |
+| ----- | ---- | ----------- |
+| `deploySucceeded` | Boolean! | At least one deployment succeeded |
+| `endTime` | Time! | The end time for the snapshot where the data points were collected |
+| `issueOpened` | Boolean! | At least one issue was opened |
+| `mergeRequestApproved` | Boolean! | At least one merge request was approved |
+| `mergeRequestOpened` | Boolean! | At least one merge request was opened |
+| `pipelineSucceeded` | Boolean! | At least one pipeline succeeded |
+| `recordedAt` | Time! | The time the snapshot was recorded |
+| `runnerConfigured` | Boolean! | At least one runner was used |
+| `securityScanSucceeded` | Boolean! | At least one security scan succeeded |
+| `startTime` | Time! | The start time for the snapshot where the data points were collected |
+
 ### DiffPosition
 
 | Field | Type | Description |
@@ -1309,8 +1327,8 @@ Relationship between an epic and an issue.
 | `alertManagementAlert` | AlertManagementAlert | Alert associated to this issue |
 | `assignees` | UserConnection | Assignees of the issue |
 | `author` | User! | User that created the issue |
-| `blocked` | Boolean! | Indicates the issue is blocked |
-| `blockedByCount` | Int | Count of issues blocking this issue |
+| `blocked` | Boolean! | Indicates the issue is blocked. |
+| `blockedByCount` | Int | Count of issues blocking this issue. |
 | `closedAt` | Time | Timestamp of when the issue was closed |
 | `confidential` | Boolean! | Indicates the issue is confidential |
 | `createdAt` | Time! | Timestamp of when the issue was created |
@@ -1323,14 +1341,14 @@ Relationship between an epic and an issue.
 | `downvotes` | Int! | Number of downvotes the issue has received |
 | `dueDate` | Time | Due date of the issue |
 | `emailsDisabled` | Boolean! | Indicates if a project has email notifications disabled: `true` if email notifications are disabled |
-| `epic` | Epic | Epic to which this issue belongs |
+| `epic` | Epic | Epic to which this issue belongs. |
 | `epicIssueId` | ID! | ID of the epic-issue relation |
 | `healthStatus` | HealthStatus | Current health status. Returns null if `save_issuable_health_status` feature flag is disabled. |
 | `humanTimeEstimate` | String | Human-readable time estimate of the issue |
 | `humanTotalTimeSpent` | String | Human-readable total time reported as spent on the issue |
 | `id` | ID | Global ID of the epic-issue relation |
 | `iid` | ID! | Internal ID of the issue |
-| `iteration` | Iteration | Iteration of the issue |
+| `iteration` | Iteration | Iteration of the issue. |
 | `labels` | LabelConnection | Labels of the issue |
 | `metricImages` | MetricImage! => Array | Metric images associated to the issue. |
 | `milestone` | Milestone | Milestone of the issue |
@@ -1344,7 +1362,7 @@ Relationship between an epic and an issue.
 | `severity` | IssuableSeverity | Severity level of the incident |
 | `slaDueAt` | Time | Timestamp of when the issue SLA expires. |
 | `state` | IssueState! | State of the issue |
-| `statusPagePublishedIncident` | Boolean | Indicates whether an issue is published to the status page |
+| `statusPagePublishedIncident` | Boolean | Indicates whether an issue is published to the status page. |
 | `subscribed` | Boolean! | Indicates the currently logged in user is subscribed to the issue |
 | `taskCompletionStatus` | TaskCompletionStatus! | Task completion status of the issue |
 | `timeEstimate` | Int! | Time estimate of the issue |
@@ -1360,7 +1378,7 @@ Relationship between an epic and an issue.
 | `userPermissions` | IssuePermissions! | Permissions for the current user on the resource |
 | `webPath` | String! | Web path of the issue |
 | `webUrl` | String! | Web URL of the issue |
-| `weight` | Int | Weight of the issue |
+| `weight` | Int | Weight of the issue. |
 
 ### EpicPermissions
 
@@ -1608,8 +1626,8 @@ Represents a recorded measurement (object count) for the Admins.
 | `alertManagementAlert` | AlertManagementAlert | Alert associated to this issue |
 | `assignees` | UserConnection | Assignees of the issue |
 | `author` | User! | User that created the issue |
-| `blocked` | Boolean! | Indicates the issue is blocked |
-| `blockedByCount` | Int | Count of issues blocking this issue |
+| `blocked` | Boolean! | Indicates the issue is blocked. |
+| `blockedByCount` | Int | Count of issues blocking this issue. |
 | `closedAt` | Time | Timestamp of when the issue was closed |
 | `confidential` | Boolean! | Indicates the issue is confidential |
 | `createdAt` | Time! | Timestamp of when the issue was created |
@@ -1622,13 +1640,13 @@ Represents a recorded measurement (object count) for the Admins.
 | `downvotes` | Int! | Number of downvotes the issue has received |
 | `dueDate` | Time | Due date of the issue |
 | `emailsDisabled` | Boolean! | Indicates if a project has email notifications disabled: `true` if email notifications are disabled |
-| `epic` | Epic | Epic to which this issue belongs |
+| `epic` | Epic | Epic to which this issue belongs. |
 | `healthStatus` | HealthStatus | Current health status. Returns null if `save_issuable_health_status` feature flag is disabled. |
 | `humanTimeEstimate` | String | Human-readable time estimate of the issue |
 | `humanTotalTimeSpent` | String | Human-readable total time reported as spent on the issue |
 | `id` | ID! | ID of the issue |
 | `iid` | ID! | Internal ID of the issue |
-| `iteration` | Iteration | Iteration of the issue |
+| `iteration` | Iteration | Iteration of the issue. |
 | `labels` | LabelConnection | Labels of the issue |
 | `metricImages` | MetricImage! => Array | Metric images associated to the issue. |
 | `milestone` | Milestone | Milestone of the issue |
@@ -1641,7 +1659,7 @@ Represents a recorded measurement (object count) for the Admins.
 | `severity` | IssuableSeverity | Severity level of the incident |
 | `slaDueAt` | Time | Timestamp of when the issue SLA expires. |
 | `state` | IssueState! | State of the issue |
-| `statusPagePublishedIncident` | Boolean | Indicates whether an issue is published to the status page |
+| `statusPagePublishedIncident` | Boolean | Indicates whether an issue is published to the status page. |
 | `subscribed` | Boolean! | Indicates the currently logged in user is subscribed to the issue |
 | `taskCompletionStatus` | TaskCompletionStatus! | Task completion status of the issue |
 | `timeEstimate` | Int! | Time estimate of the issue |
@@ -1657,7 +1675,7 @@ Represents a recorded measurement (object count) for the Admins.
 | `userPermissions` | IssuePermissions! | Permissions for the current user on the resource |
 | `webPath` | String! | Web path of the issue |
 | `webUrl` | String! | Web URL of the issue |
-| `weight` | Int | Weight of the issue |
+| `weight` | Int | Weight of the issue. |
 
 ### IssueMoveListPayload
 
diff --git a/doc/user/application_security/dast/index.md b/doc/user/application_security/dast/index.md
index 6eeabc63b7c..6b9c73e6e13 100644
--- a/doc/user/application_security/dast/index.md
+++ b/doc/user/application_security/dast/index.md
@@ -91,12 +91,22 @@ There are two ways to define the URL to be scanned by DAST:
 1. Set the `DAST_WEBSITE` [variable](../../../ci/yaml/README.md#variables).
 
 1. Add it in an `environment_url.txt` file at the root of your project.
-   This is great for testing in dynamic environments. In order to run DAST against
-   an app dynamically created during a GitLab CI/CD pipeline, have the app
-   persist its domain in an `environment_url.txt` file, and DAST
-   automatically parses that file to find its scan target.
-   You can see an [example](https://gitlab.com/gitlab-org/gitlab/blob/master/lib/gitlab/ci/templates/Jobs/Deploy.gitlab-ci.yml)
-   of this in our Auto DevOps CI YAML.
+   This is useful for testing in dynamic environments. To run DAST against an application
+   dynamically created during a GitLab CI/CD pipeline, a job that runs prior to the DAST scan must
+   persist the application's domain in an `environment_url.txt` file. DAST automatically parses the
+   `environment_url.txt` file to find its scan target.
+
+   For example, in a job that runs prior to DAST, you could include code that looks similar to:
+
+   ```yaml
+   script:
+     - echo http://${CI_PROJECT_ID}-${CI_ENVIRONMENT_SLUG}.domain.com > environment_url.txt
+   artifacts:
+     paths: [environment_url.txt]
+     when: always
+   ```
+  
+   You can see an example of this in our [Auto DevOps CI YAML](https://gitlab.com/gitlab-org/gitlab/blob/master/lib/gitlab/ci/templates/Jobs/Deploy.gitlab-ci.yml) file.
 
 If both values are set, the `DAST_WEBSITE` value takes precedence.
 
diff --git a/lib/api/helpers/internal_helpers.rb b/lib/api/helpers/internal_helpers.rb
index 69b53ea6c2f..12b0a053e79 100644
--- a/lib/api/helpers/internal_helpers.rb
+++ b/lib/api/helpers/internal_helpers.rb
@@ -31,8 +31,7 @@ module API
       def access_checker_for(actor, protocol)
         access_checker_klass.new(actor.key_or_user, container, protocol,
           authentication_abilities: ssh_authentication_abilities,
-          namespace_path: namespace_path,
-          repository_path: project_path,
+          repository_path: repository_path,
           redirected_path: redirected_path)
       end
 
@@ -71,18 +70,22 @@ module API
         false
       end
 
-      def project_path
-        project&.path || project_path_match[:project_path]
-      end
-
-      def namespace_path
-        project&.namespace&.full_path || project_path_match[:namespace_path]
-      end
-
       private
 
-      def project_path_match
-        @project_path_match ||= params[:project].match(Gitlab::PathRegex.full_project_git_path_regex) || {}
+      def repository_path
+        if container
+          "#{container.full_path}.git"
+        elsif params[:project]
+          # When the project doesn't exist, we still need to pass on the path
+          # to support auto-creation in `GitAccessProject`.
+          #
+          # For consistency with the Git HTTP controllers, we normalize the path
+          # to remove a leading slash and ensure a trailing `.git`.
+          #
+          # NOTE: For GitLab Shell, `params[:project]` is the full repository path
+          # from the SSH command, with an optional trailing `.git`.
+          "#{params[:project].delete_prefix('/').delete_suffix('.git')}.git"
+        end
       end
 
       # rubocop:disable Gitlab/ModuleWithInstanceVariables
@@ -96,7 +99,7 @@ module API
       end
       # rubocop:enable Gitlab/ModuleWithInstanceVariables
 
-      # Project id to pass between components that don't share/don't have
+      # Repository id to pass between components that don't share/don't have
       # access to the same filesystem mounts
       def gl_repository
         repo_type.identifier_for_container(container)
@@ -106,8 +109,9 @@ module API
         repository.full_path
       end
 
-      # Return the repository depending on whether we want the wiki or the
-      # regular repository
+      # Return the repository for the detected type and container
+      #
+      # @returns [Repository]
       def repository
         @repository ||= repo_type.repository_for(container)
       end
diff --git a/lib/constraints/project_url_constrainer.rb b/lib/constraints/project_url_constrainer.rb
index 3e9cf2ab320..d41490d2ebd 100644
--- a/lib/constraints/project_url_constrainer.rb
+++ b/lib/constraints/project_url_constrainer.rb
@@ -4,7 +4,7 @@ module Constraints
   class ProjectUrlConstrainer
     def matches?(request, existence_check: true)
       namespace_path = request.params[:namespace_id]
-      project_path = request.params[:project_id] || request.params[:id] || request.params[:repository_id]
+      project_path = request.params[:project_id] || request.params[:id]
       full_path = [namespace_path, project_path].join('/')
 
       return false unless ProjectPathValidator.valid_path?(full_path)
diff --git a/lib/constraints/repository_redirect_url_constrainer.rb b/lib/constraints/repository_redirect_url_constrainer.rb
new file mode 100644
index 00000000000..44df670d8d3
--- /dev/null
+++ b/lib/constraints/repository_redirect_url_constrainer.rb
@@ -0,0 +1,28 @@
+# frozen_string_literal: true
+
+module Constraints
+  class RepositoryRedirectUrlConstrainer
+    def matches?(request)
+      path = request.params[:repository_path].delete_suffix('.git')
+      query = request.query_string
+
+      git_request?(query) && container_path?(path)
+    end
+
+    # Allow /info/refs, /info/refs?service=git-upload-pack, and
+    # /info/refs?service=git-receive-pack, but nothing else.
+    def git_request?(query)
+      query.blank? ||
+        query == 'service=git-upload-pack' ||
+        query == 'service=git-receive-pack'
+    end
+
+    # Check if the path matches any known repository containers.
+    # These also cover wikis, since a `.wiki` suffix is valid in project/group paths too.
+    def container_path?(path)
+      NamespacePathValidator.valid_path?(path) ||
+        ProjectPathValidator.valid_path?(path) ||
+        path =~ Gitlab::PathRegex.full_snippets_repository_path_regex
+    end
+  end
+end
diff --git a/lib/gitlab/application_context.rb b/lib/gitlab/application_context.rb
index b4bbb309c36..84fe3d1c959 100644
--- a/lib/gitlab/application_context.rb
+++ b/lib/gitlab/application_context.rb
@@ -30,7 +30,7 @@ module Gitlab
       Labkit::Context.current.to_h.include?(Labkit::Context.log_key(attribute_name))
     end
 
-    def initialize(args)
+    def initialize(**args)
       unknown_attributes = args.keys - APPLICATION_ATTRIBUTES.map(&:name)
       raise ArgumentError, "#{unknown_attributes} are not known keys" if unknown_attributes.any?
 
diff --git a/lib/gitlab/ci/templates/Security/DAST-On-Demand-Scan.gitlab-ci.yml b/lib/gitlab/ci/templates/Security/DAST-On-Demand-Scan.gitlab-ci.yml
new file mode 100644
index 00000000000..a0564a16c07
--- /dev/null
+++ b/lib/gitlab/ci/templates/Security/DAST-On-Demand-Scan.gitlab-ci.yml
@@ -0,0 +1,24 @@
+stages:
+  - build
+  - test
+  - deploy
+  - dast
+
+variables:
+  DAST_VERSION: 1
+  # Setting this variable will affect all Security templates
+  # (SAST, Dependency Scanning, ...)
+  SECURE_ANALYZERS_PREFIX: "registry.gitlab.com/gitlab-org/security-products/analyzers"
+
+dast:
+  stage: dast
+  image:
+    name: "$SECURE_ANALYZERS_PREFIX/dast:$DAST_VERSION"
+  variables:
+    GIT_STRATEGY: none
+  allow_failure: true
+  script:
+    - /analyze
+  artifacts:
+    reports:
+      dast: gl-dast-report.json
diff --git a/lib/gitlab/git_access.rb b/lib/gitlab/git_access.rb
index 0576d1dd9db..5ed4322341e 100644
--- a/lib/gitlab/git_access.rb
+++ b/lib/gitlab/git_access.rb
@@ -43,7 +43,7 @@ module Gitlab
     ALL_COMMANDS = DOWNLOAD_COMMANDS + PUSH_COMMANDS
 
     attr_reader :actor, :protocol, :authentication_abilities,
-                :namespace_path, :redirected_path, :auth_result_type,
+                :repository_path, :redirected_path, :auth_result_type,
                 :cmd, :changes
     attr_accessor :container
 
@@ -57,21 +57,16 @@ module Gitlab
       raise ArgumentError, "No error message defined for #{key}"
     end
 
-    def initialize(actor, container, protocol, authentication_abilities:, namespace_path: nil, repository_path: nil, redirected_path: nil, auth_result_type: nil)
+    def initialize(actor, container, protocol, authentication_abilities:, repository_path: nil, redirected_path: nil, auth_result_type: nil)
       @actor     = actor
       @container = container
       @protocol  = protocol
       @authentication_abilities = Array(authentication_abilities)
-      @namespace_path = namespace_path
       @repository_path = repository_path
       @redirected_path = redirected_path
       @auth_result_type = auth_result_type
     end
 
-    def repository_path
-      @repository_path ||= project&.path
-    end
-
     def check(cmd, changes)
       @changes = changes
       @cmd = cmd
diff --git a/lib/gitlab/git_access_project.rb b/lib/gitlab/git_access_project.rb
index cdefcc84f7d..7e9bab4a8e6 100644
--- a/lib/gitlab/git_access_project.rb
+++ b/lib/gitlab/git_access_project.rb
@@ -35,7 +35,19 @@ module Gitlab
     end
 
     def namespace
-      @namespace ||= Namespace.find_by_full_path(namespace_path)
+      strong_memoize(:namespace) { Namespace.find_by_full_path(namespace_path) }
+    end
+
+    def namespace_path
+      strong_memoize(:namespace_path) { repository_path_match[:namespace_path] }
+    end
+
+    def project_path
+      strong_memoize(:project_path) { repository_path_match[:project_path] }
+    end
+
+    def repository_path_match
+      strong_memoize(:repository_path_match) { repository_path.match(Gitlab::PathRegex.full_project_git_path_regex) || {} }
     end
 
     def ensure_project_on_push!
@@ -44,7 +56,7 @@ module Gitlab
       return unless user&.can?(:create_projects, namespace)
 
       project_params = {
-        path: repository_path,
+        path: project_path,
         namespace_id: namespace.id,
         visibility_level: Gitlab::VisibilityLevel::PRIVATE
       }
diff --git a/lib/gitlab/graphql/expose_permissions.rb b/lib/gitlab/graphql/expose_permissions.rb
index 365b7cca24f..ab9ed354673 100644
--- a/lib/gitlab/graphql/expose_permissions.rb
+++ b/lib/gitlab/graphql/expose_permissions.rb
@@ -9,7 +9,7 @@ module Gitlab
           field :user_permissions, permission_type,
                 description: description,
                 null: false,
-                resolve: -> (obj, _, _) { obj }
+                method: :itself
         end
       end
     end
diff --git a/lib/gitlab/legacy_github_import/project_creator.rb b/lib/gitlab/legacy_github_import/project_creator.rb
index b484b69c932..c54325bcdf5 100644
--- a/lib/gitlab/legacy_github_import/project_creator.rb
+++ b/lib/gitlab/legacy_github_import/project_creator.rb
@@ -5,7 +5,7 @@ module Gitlab
     class ProjectCreator
       attr_reader :repo, :name, :namespace, :current_user, :session_data, :type
 
-      def initialize(repo, name, namespace, current_user, session_data, type: 'github')
+      def initialize(repo, name, namespace, current_user, type: 'github', **session_data)
         @repo = repo
         @name = name
         @namespace = namespace
diff --git a/lib/gitlab/path_regex.rb b/lib/gitlab/path_regex.rb
index ad0a5c80604..2ff23980ebd 100644
--- a/lib/gitlab/path_regex.rb
+++ b/lib/gitlab/path_regex.rb
@@ -180,12 +180,16 @@ module Gitlab
       end
     end
 
-    def project_git_route_regex
-      @project_git_route_regex ||= /#{project_route_regex}\.git/.freeze
+    def repository_route_regex
+      @repository_route_regex ||= /#{full_namespace_route_regex}|#{personal_snippet_repository_path_regex}/.freeze
     end
 
-    def project_wiki_git_route_regex
-      @project_wiki_git_route_regex ||= /#{PATH_REGEX_STR}\.wiki/.freeze
+    def repository_git_route_regex
+      @repository_git_route_regex ||= /#{repository_route_regex}\.git/.freeze
+    end
+
+    def repository_wiki_git_route_regex
+      @repository_wiki_git_route_regex ||= /#{full_namespace_route_regex}\.wiki\.git/.freeze
     end
 
     def full_namespace_path_regex
@@ -250,10 +254,6 @@ module Gitlab
       %r{\A(#{personal_snippet_repository_path_regex}|#{project_snippet_repository_path_regex})\z}
     end
 
-    def personal_and_project_snippets_path_regex
-      %r{#{personal_snippet_path_regex}|#{project_snippet_path_regex}}
-    end
-
     def container_image_regex
       @container_image_regex ||= %r{([\w\.-]+\/){0,1}[\w\.-]+}.freeze
     end
diff --git a/lib/gitlab/repo_path.rb b/lib/gitlab/repo_path.rb
index 9ee6f67e455..79cf081b9dc 100644
--- a/lib/gitlab/repo_path.rb
+++ b/lib/gitlab/repo_path.rb
@@ -5,7 +5,7 @@ module Gitlab
     NotFoundError = Class.new(StandardError)
 
     def self.parse(path)
-      repo_path = path.sub(/\.git\z/, '').sub(%r{\A/}, '')
+      repo_path = path.delete_prefix('/').delete_suffix('.git')
       redirected_path = nil
 
       # Detect the repo type based on the path, the first one tried is the project
diff --git a/lib/tasks/gitlab/assets.rake b/lib/tasks/gitlab/assets.rake
index ab2d77eeaf0..54e74fd9c8b 100644
--- a/lib/tasks/gitlab/assets.rake
+++ b/lib/tasks/gitlab/assets.rake
@@ -81,7 +81,10 @@ namespace :gitlab do
 
       if head_assets_md5 != master_assets_md5 || !public_assets_webpack_dir_exists
         FileUtils.rm_r(Tasks::Gitlab::Assets::PUBLIC_ASSETS_WEBPACK_DIR) if public_assets_webpack_dir_exists
-        system('yarn webpack')
+
+        unless system('yarn webpack')
+          abort 'Error: Unable to compile webpack production bundle.'.color(:red)
+        end
       end
     end
 
diff --git a/locale/gitlab.pot b/locale/gitlab.pot
index ef4ae3f39ec..d27d6f6604d 100644
--- a/locale/gitlab.pot
+++ b/locale/gitlab.pot
@@ -9525,6 +9525,9 @@ msgstr ""
 msgid "DevopsAdoptionSegment|The maximum number of segments has been reached"
 msgstr ""
 
+msgid "DevopsAdoptionSegment|The maximum number of selections has been reached"
+msgstr ""
+
 msgid "DevopsAdoption|%{selectedCount} group selected (20 max)"
 msgstr ""
 
@@ -16491,6 +16494,9 @@ msgstr ""
 msgid "ManualOrdering|Couldn't save the order of the issues"
 msgstr ""
 
+msgid "Manually link this issue by adding it to the linked issue section of the %{originating_vulnerability}."
+msgstr ""
+
 msgid "Map a FogBugz account ID to a GitLab user"
 msgstr ""
 
@@ -27815,9 +27821,6 @@ msgstr ""
 msgid "This issue is currently blocked by the following issues:"
 msgstr ""
 
-msgid "This issue is currently blocked by the following issues: %{issues}."
-msgstr ""
-
 msgid "This issue is in a child epic of the filtered epic"
 msgstr ""
 
@@ -28977,6 +28980,9 @@ msgstr ""
 msgid "Unable to convert Kubernetes logs encoding to UTF-8"
 msgstr ""
 
+msgid "Unable to create link to vulnerability"
+msgstr ""
+
 msgid "Unable to fetch unscanned projects"
 msgstr ""
 
@@ -32815,6 +32821,9 @@ msgstr ""
 msgid "or"
 msgstr ""
 
+msgid "originating vulnerability"
+msgstr ""
+
 msgid "out of %d total test"
 msgid_plural "out of %d total tests"
 msgstr[0] ""
diff --git a/spec/controllers/omniauth_callbacks_controller_spec.rb b/spec/controllers/omniauth_callbacks_controller_spec.rb
index 291d51348e6..edd587389cb 100644
--- a/spec/controllers/omniauth_callbacks_controller_spec.rb
+++ b/spec/controllers/omniauth_callbacks_controller_spec.rb
@@ -367,8 +367,8 @@ RSpec.describe OmniauthCallbacksController, type: :controller do
 
     before do
       stub_last_request_id(last_request_id)
-      stub_omniauth_saml_config({ enabled: true, auto_link_saml_user: true, allow_single_sign_on: ['saml'],
-                                  providers: [saml_config] })
+      stub_omniauth_saml_config(enabled: true, auto_link_saml_user: true, allow_single_sign_on: ['saml'],
+                                  providers: [saml_config])
       mock_auth_hash_with_saml_xml('saml', +'my-uid', user.email, mock_saml_response)
       request.env['devise.mapping'] = Devise.mappings[:user]
       request.env['omniauth.auth'] = Rails.application.env_config['omniauth.auth']
diff --git a/spec/controllers/projects/issues_controller_spec.rb b/spec/controllers/projects/issues_controller_spec.rb
index 26e1842468b..4ad5e649522 100644
--- a/spec/controllers/projects/issues_controller_spec.rb
+++ b/spec/controllers/projects/issues_controller_spec.rb
@@ -1128,12 +1128,12 @@ RSpec.describe Projects::IssuesController do
         { merge_request_to_resolve_discussions_of: merge_request.iid }
       end
 
-      def post_issue(issue_params, other_params: {})
+      def post_issue(other_params: {}, **issue_params)
         post :create, params: { namespace_id: project.namespace.to_param, project_id: project, issue: issue_params, merge_request_to_resolve_discussions_of: merge_request.iid }.merge(other_params)
       end
 
       it 'creates an issue for the project' do
-        expect { post_issue({ title: 'Hello' }) }.to change { project.issues.reload.size }.by(1)
+        expect { post_issue(title: 'Hello') }.to change { project.issues.reload.size }.by(1)
       end
 
       it "doesn't overwrite given params" do
@@ -1157,7 +1157,7 @@ RSpec.describe Projects::IssuesController do
 
       describe "resolving a single discussion" do
         before do
-          post_issue({ title: 'Hello' }, other_params: { discussion_to_resolve: discussion.id })
+          post_issue(title: 'Hello', other_params: { discussion_to_resolve: discussion.id })
         end
         it 'resolves a single discussion' do
           discussion.first_note.reload
diff --git a/spec/controllers/repositories/git_http_controller_spec.rb b/spec/controllers/repositories/git_http_controller_spec.rb
index 851c1b7e519..307c5b4725a 100644
--- a/spec/controllers/repositories/git_http_controller_spec.rb
+++ b/spec/controllers/repositories/git_http_controller_spec.rb
@@ -9,28 +9,20 @@ RSpec.describe Repositories::GitHttpController do
   let_it_be(:personal_snippet) { create(:personal_snippet, :public, :repository) }
   let_it_be(:project_snippet) { create(:project_snippet, :public, :repository, project: project) }
 
-  let(:namespace_id) { project.namespace.to_param }
-  let(:repository_id) { project.path + '.git' }
-  let(:container_params) do
-    {
-      namespace_id: namespace_id,
-      repository_id: repository_id
-    }
-  end
+  shared_examples Repositories::GitHttpController do
+    let(:repository_path) { "#{container.full_path}.git" }
+    let(:params) { { repository_path: repository_path } }
 
-  let(:params) { container_params }
+    describe 'HEAD #info_refs' do
+      it 'returns 403' do
+        head :info_refs, params: params
 
-  describe 'HEAD #info_refs' do
-    it 'returns 403' do
-      head :info_refs, params: params
-
-      expect(response).to have_gitlab_http_status(:forbidden)
+        expect(response).to have_gitlab_http_status(:forbidden)
+      end
     end
-  end
 
-  shared_examples 'info_refs behavior' do
     describe 'GET #info_refs' do
-      let(:params) { container_params.merge(service: 'git-upload-pack') }
+      let(:params) { super().merge(service: 'git-upload-pack') }
 
       it 'returns 401 for unauthenticated requests to public repositories when http protocol is disabled' do
         stub_application_setting(enabled_git_access_protocol: 'ssh')
@@ -43,6 +35,26 @@ RSpec.describe Repositories::GitHttpController do
         expect(response).to have_gitlab_http_status(:unauthorized)
       end
 
+      it 'calls the right access checker class with the right object' do
+        allow(controller).to receive(:verify_workhorse_api!).and_return(true)
+
+        access_double = double
+        options = {
+          authentication_abilities: [:download_code],
+          repository_path: repository_path,
+          redirected_path: nil,
+          auth_result_type: :none
+        }
+
+        expect(access_checker_class).to receive(:new)
+          .with(nil, container, 'http', hash_including(options))
+          .and_return(access_double)
+
+        allow(access_double).to receive(:check).and_return(false)
+
+        get :info_refs, params: params
+      end
+
       context 'with authorized user' do
         before do
           request.headers.merge! auth_env(user.username, user.password, nil)
@@ -97,54 +109,38 @@ RSpec.describe Repositories::GitHttpController do
         end
       end
     end
-  end
 
-  shared_examples 'git_upload_pack behavior' do |expected|
     describe 'POST #git_upload_pack' do
       before do
-        allow(controller).to receive(:authenticate_user).and_return(true)
         allow(controller).to receive(:verify_workhorse_api!).and_return(true)
-        allow(controller).to receive(:access_check).and_return(nil)
       end
 
-      def send_request
+      it 'returns 200' do
         post :git_upload_pack, params: params
-      end
 
-      context 'on a read-only instance' do
+        expect(response).to have_gitlab_http_status(:ok)
+      end
+    end
+  end
+
+  context 'when repository container is a project' do
+    it_behaves_like Repositories::GitHttpController do
+      let(:container) { project }
+      let(:user) { project.owner }
+      let(:access_checker_class) { Gitlab::GitAccess }
+
+      describe 'POST #git_upload_pack' do
         before do
-          allow(Gitlab::Database).to receive(:read_only?).and_return(true)
+          allow(controller).to receive(:verify_workhorse_api!).and_return(true)
         end
 
-        it 'does not update project statistics' do
-          expect(ProjectDailyStatisticsWorker).not_to receive(:perform_async)
-
-          send_request
+        def send_request
+          post :git_upload_pack, params: params
         end
-      end
 
-      if expected
-        context 'when project_statistics_sync feature flag is disabled' do
+        context 'on a read-only instance' do
           before do
-            stub_feature_flags(project_statistics_sync: false)
-          end
-
-          it 'updates project statistics async' do
-            expect(ProjectDailyStatisticsWorker).to receive(:perform_async)
-
-            send_request
-          end
-        end
-
-        it 'updates project statistics sync' do
-          expect { send_request }.to change {
-            Projects::DailyStatisticsFinder.new(project).total_fetch_count
-          }.from(0).to(1)
-        end
-      else
-        context 'when project_statistics_sync feature flag is disabled' do
-          before do
-            stub_feature_flags(project_statistics_sync: false)
+            allow(Gitlab::Database).to receive(:read_only?).and_return(true)
           end
 
           it 'does not update project statistics' do
@@ -154,68 +150,48 @@ RSpec.describe Repositories::GitHttpController do
           end
         end
 
-        it 'does not update project statistics' do
-          expect { send_request }.not_to change {
-            Projects::DailyStatisticsFinder.new(project).total_fetch_count
-          }.from(0)
+        context 'when project_statistics_sync feature flag is disabled' do
+          before do
+            stub_feature_flags(project_statistics_sync: false)
+          end
+
+          it 'updates project statistics async for projects' do
+            expect(ProjectDailyStatisticsWorker).to receive(:perform_async)
+
+            send_request
+          end
+        end
+
+        it 'updates project statistics sync for projects' do
+          expect { send_request }.to change {
+            Projects::DailyStatisticsFinder.new(container).total_fetch_count
+          }.from(0).to(1)
         end
       end
     end
   end
 
-  shared_examples 'access checker class' do
-    let(:params) { container_params.merge(service: 'git-upload-pack') }
-
-    it 'calls the right access class checker with the right object' do
-      allow(controller).to receive(:verify_workhorse_api!).and_return(true)
-
-      access_double = double
-      expect(expected_class).to receive(:new).with(anything, expected_object, 'http', anything).and_return(access_double)
-      allow(access_double).to receive(:check).and_return(false)
-
-      get :info_refs, params: params
-    end
-  end
-
-  context 'when repository container is a project' do
-    it_behaves_like 'info_refs behavior' do
+  context 'when repository container is a project wiki' do
+    it_behaves_like Repositories::GitHttpController do
+      let(:container) { create(:project_wiki, :empty_repo, project: project) }
       let(:user) { project.owner }
-    end
-
-    it_behaves_like 'git_upload_pack behavior', true
-    it_behaves_like 'access checker class' do
-      let(:expected_class) { Gitlab::GitAccess }
-      let(:expected_object) { project }
+      let(:access_checker_class) { Gitlab::GitAccessWiki }
     end
   end
 
   context 'when repository container is a personal snippet' do
-    let(:namespace_id) { 'snippets' }
-    let(:repository_id) { personal_snippet.to_param + '.git' }
-
-    it_behaves_like 'info_refs behavior' do
+    it_behaves_like Repositories::GitHttpController do
+      let(:container) { personal_snippet }
       let(:user) { personal_snippet.author }
-    end
-
-    it_behaves_like 'git_upload_pack behavior', false
-    it_behaves_like 'access checker class' do
-      let(:expected_class) { Gitlab::GitAccessSnippet }
-      let(:expected_object) { personal_snippet }
+      let(:access_checker_class) { Gitlab::GitAccessSnippet }
     end
   end
 
   context 'when repository container is a project snippet' do
-    let(:namespace_id) { project.full_path + '/snippets' }
-    let(:repository_id) { project_snippet.to_param + '.git' }
-
-    it_behaves_like 'info_refs behavior' do
+    it_behaves_like Repositories::GitHttpController do
+      let(:container) { project_snippet }
       let(:user) { project_snippet.author }
-    end
-
-    it_behaves_like 'git_upload_pack behavior', false
-    it_behaves_like 'access checker class' do
-      let(:expected_class) { Gitlab::GitAccessSnippet }
-      let(:expected_object) { project_snippet }
+      let(:access_checker_class) { Gitlab::GitAccessSnippet }
     end
   end
 end
diff --git a/spec/controllers/repositories/lfs_storage_controller_spec.rb b/spec/controllers/repositories/lfs_storage_controller_spec.rb
index 4f9d049cf87..e361a7442bb 100644
--- a/spec/controllers/repositories/lfs_storage_controller_spec.rb
+++ b/spec/controllers/repositories/lfs_storage_controller_spec.rb
@@ -23,8 +23,7 @@ RSpec.describe Repositories::LfsStorageController do
 
     let(:params) do
       {
-        namespace_id: project.namespace.path,
-        repository_id: "#{project.path}.git",
+        repository_path: "#{project.full_path}.git",
         oid: '6b9765d3888aaec789e8c309eb05b05c3a87895d6ad70d2264bd7270fff665ac',
         size: '6725030'
       }
diff --git a/spec/controllers/users_controller_spec.rb b/spec/controllers/users_controller_spec.rb
index bec4b24484a..cabd01bcae1 100644
--- a/spec/controllers/users_controller_spec.rb
+++ b/spec/controllers/users_controller_spec.rb
@@ -114,6 +114,113 @@ RSpec.describe UsersController do
     end
   end
 
+  describe 'GET #activity' do
+    context 'with rendered views' do
+      render_views
+
+      describe 'when logged in' do
+        before do
+          sign_in(user)
+        end
+
+        it 'renders the show template' do
+          get :show, params: { username: user.username }
+
+          expect(response).to be_successful
+          expect(response).to render_template('show')
+        end
+      end
+
+      describe 'when logged out' do
+        it 'renders the show template' do
+          get :activity, params: { username: user.username }
+
+          expect(response).to have_gitlab_http_status(:ok)
+          expect(response).to render_template('show')
+        end
+      end
+    end
+
+    context 'when public visibility level is restricted' do
+      before do
+        stub_application_setting(restricted_visibility_levels: [Gitlab::VisibilityLevel::PUBLIC])
+      end
+
+      context 'when logged out' do
+        it 'redirects to login page' do
+          get :activity, params: { username: user.username }
+          expect(response).to redirect_to new_user_session_path
+        end
+      end
+
+      context 'when logged in' do
+        before do
+          sign_in(user)
+        end
+
+        it 'renders show' do
+          get :activity, params: { username: user.username }
+          expect(response).to have_gitlab_http_status(:ok)
+          expect(response).to render_template('show')
+        end
+      end
+    end
+
+    context 'when a user by that username does not exist' do
+      context 'when logged out' do
+        it 'redirects to login page' do
+          get :activity, params: { username: 'nonexistent' }
+          expect(response).to redirect_to new_user_session_path
+        end
+      end
+
+      context 'when logged in' do
+        before do
+          sign_in(user)
+        end
+
+        it 'renders 404' do
+          get :activity, params: { username: 'nonexistent' }
+          expect(response).to have_gitlab_http_status(:not_found)
+        end
+      end
+    end
+
+    context 'json with events' do
+      let(:project) { create(:project) }
+
+      before do
+        project.add_developer(user)
+        Gitlab::DataBuilder::Push.build_sample(project, user)
+
+        sign_in(user)
+      end
+
+      it 'loads events' do
+        get :activity, params: { username: user }, format: :json
+
+        expect(assigns(:events)).not_to be_empty
+      end
+
+      it 'hides events if the user cannot read cross project' do
+        allow(Ability).to receive(:allowed?).and_call_original
+        expect(Ability).to receive(:allowed?).with(user, :read_cross_project) { false }
+
+        get :activity, params: { username: user }, format: :json
+
+        expect(assigns(:events)).to be_empty
+      end
+
+      it 'hides events if the user has a private profile' do
+        Gitlab::DataBuilder::Push.build_sample(project, private_user)
+
+        get :activity, params: { username: private_user.username }, format: :json
+
+        expect(assigns(:events)).to be_empty
+      end
+    end
+  end
+
   describe 'GET #calendar' do
     context 'for user' do
       let(:project) { create(:project) }
diff --git a/spec/factories/analytics/devops_adoption/segment_selections.rb b/spec/factories/analytics/devops_adoption/segment_selections.rb
deleted file mode 100644
index 8f10369ba35..00000000000
--- a/spec/factories/analytics/devops_adoption/segment_selections.rb
+++ /dev/null
@@ -1,18 +0,0 @@
-# frozen_string_literal: true
-
-FactoryBot.define do
-  factory :devops_adoption_segment_selection, class: 'Analytics::DevopsAdoption::SegmentSelection' do
-    association :segment, factory: :devops_adoption_segment
-    project
-
-    trait :project do
-      group { nil }
-      project
-    end
-
-    trait :group do
-      project { nil }
-      group
-    end
-  end
-end
diff --git a/spec/factories/analytics/devops_adoption/segments.rb b/spec/factories/analytics/devops_adoption/segments.rb
deleted file mode 100644
index 367ee01fa18..00000000000
--- a/spec/factories/analytics/devops_adoption/segments.rb
+++ /dev/null
@@ -1,7 +0,0 @@
-# frozen_string_literal: true
-
-FactoryBot.define do
-  factory :devops_adoption_segment, class: 'Analytics::DevopsAdoption::Segment' do
-    sequence(:name) { |n| "Segment #{n}" }
-  end
-end
diff --git a/spec/factories/sequences.rb b/spec/factories/sequences.rb
index 4e66d7c125c..7e2836d3688 100644
--- a/spec/factories/sequences.rb
+++ b/spec/factories/sequences.rb
@@ -13,5 +13,6 @@ FactoryBot.define do
   sequence(:past_time) { |n| 4.hours.ago + (2 * n).seconds }
   sequence(:iid)
   sequence(:sha) { |n| Digest::SHA1.hexdigest("commit-like-#{n}") }
+  sequence(:oid) { |n| Digest::SHA2.hexdigest("oid-like-#{n}") }
   sequence(:variable) { |n| "var#{n}" }
 end
diff --git a/spec/finders/group_members_finder_spec.rb b/spec/finders/group_members_finder_spec.rb
index 67e7de5921a..a87a05d4408 100644
--- a/spec/finders/group_members_finder_spec.rb
+++ b/spec/finders/group_members_finder_spec.rb
@@ -129,4 +129,48 @@ RSpec.describe GroupMembersFinder, '#execute' do
     expect(result.to_a).not_to include(member_with_2fa)
     expect(result.to_a).to match_array([member1, member2])
   end
+
+  it 'returns direct members with two-factor auth if requested by owner' do
+    group.add_owner(user1)
+    group.add_maintainer(user2)
+    nested_group.add_maintainer(user3)
+    member_with_2fa = nested_group.add_maintainer(user5)
+
+    result = described_class.new(nested_group, user1, params: { two_factor: 'enabled' }).execute(include_relations: [:direct])
+
+    expect(result.to_a).to match_array([member_with_2fa])
+  end
+
+  it 'returns inherited members with two-factor auth if requested by owner' do
+    group.add_owner(user1)
+    member_with_2fa = group.add_maintainer(user5)
+    nested_group.add_maintainer(user2)
+    nested_group.add_maintainer(user3)
+
+    result = described_class.new(nested_group, user1, params: { two_factor: 'enabled' }).execute(include_relations: [:inherited])
+
+    expect(result.to_a).to match_array([member_with_2fa])
+  end
+
+  it 'returns direct members without two-factor auth if requested by owner' do
+    group.add_owner(user1)
+    group.add_maintainer(user2)
+    member3 = nested_group.add_maintainer(user3)
+    nested_group.add_maintainer(user5)
+
+    result = described_class.new(nested_group, user1, params: { two_factor: 'disabled' }).execute(include_relations: [:direct])
+
+    expect(result.to_a).to match_array([member3])
+  end
+
+  it 'returns inherited members without two-factor auth if requested by owner' do
+    member1 = group.add_owner(user1)
+    group.add_maintainer(user5)
+    nested_group.add_maintainer(user2)
+    nested_group.add_maintainer(user3)
+
+    result = described_class.new(nested_group, user1, params: { two_factor: 'disabled' }).execute(include_relations: [:inherited])
+
+    expect(result.to_a).to match_array([member1])
+  end
 end
diff --git a/spec/frontend/boards/components/board_assignee_dropdown_spec.js b/spec/frontend/boards/components/board_assignee_dropdown_spec.js
index 5ddd00f7fd4..499e6b5882d 100644
--- a/spec/frontend/boards/components/board_assignee_dropdown_spec.js
+++ b/spec/frontend/boards/components/board_assignee_dropdown_spec.js
@@ -37,7 +37,7 @@ describe('BoardCardAssigneeDropdown', () => {
       data() {
         return {
           search,
-          selected: store.getters.activeIssue.assignees,
+          selected: [],
           participants,
         };
       },
@@ -63,14 +63,13 @@ describe('BoardCardAssigneeDropdown', () => {
       [getIssueParticipants, getIssueParticipantsSpy],
       [searchUsers, getSearchUsersSpy],
     ]);
-
     wrapper = mount(BoardAssigneeDropdown, {
       localVue,
       apolloProvider: fakeApollo,
       data() {
         return {
           search,
-          selected: store.getters.activeIssue.assignees,
+          selected: [],
           participants,
         };
       },
@@ -369,4 +368,18 @@ describe('BoardCardAssigneeDropdown', () => {
       expect(findByText(currentUser.username).exists()).toBe(true);
     });
   });
+
+  describe('when setting an assignee', () => {
+    beforeEach(() => {
+      createComponent();
+    });
+
+    it('passes loading state from Vuex to BoardEditableItem', async () => {
+      store.state.isSettingAssignees = true;
+
+      await wrapper.vm.$nextTick();
+
+      expect(wrapper.find(BoardEditableItem).props('loading')).toBe(true);
+    });
+  });
 });
diff --git a/spec/frontend/boards/stores/actions_spec.js b/spec/frontend/boards/stores/actions_spec.js
index 478f5dc59e0..679a83bf55f 100644
--- a/spec/frontend/boards/stores/actions_spec.js
+++ b/spec/frontend/boards/stores/actions_spec.js
@@ -690,10 +690,18 @@ describe('setAssignees', () => {
       {},
       { activeIssue: { iid, referencePath: refPath }, commit: () => {} },
       [
+        {
+          type: 'SET_ASSIGNEE_LOADING',
+          payload: true,
+        },
         {
           type: 'UPDATE_ISSUE_BY_ID',
           payload: { prop: 'assignees', issueId: undefined, value: [node] },
         },
+        {
+          type: 'SET_ASSIGNEE_LOADING',
+          payload: false,
+        },
       ],
       [],
       done,
diff --git a/spec/frontend/boards/stores/mutations_spec.js b/spec/frontend/boards/stores/mutations_spec.js
index 65b37007b5c..5246bc7a7c9 100644
--- a/spec/frontend/boards/stores/mutations_spec.js
+++ b/spec/frontend/boards/stores/mutations_spec.js
@@ -516,6 +516,14 @@ describe('Board Store Mutations', () => {
     });
   });
 
+  describe('SET_ASSIGNEE_LOADING', () => {
+    it('sets isSettingAssignees to the value passed', () => {
+      mutations.SET_ASSIGNEE_LOADING(state, true);
+
+      expect(state.isSettingAssignees).toBe(true);
+    });
+  });
+
   describe('SET_CURRENT_PAGE', () => {
     expectNotImplemented(mutations.SET_CURRENT_PAGE);
   });
diff --git a/spec/frontend/close_reopen_report_toggle_spec.js b/spec/frontend/close_reopen_report_toggle_spec.js
deleted file mode 100644
index d2ce6298c5c..00000000000
--- a/spec/frontend/close_reopen_report_toggle_spec.js
+++ /dev/null
@@ -1,283 +0,0 @@
-import CloseReopenReportToggle from '~/close_reopen_report_toggle';
-import DropLab from '~/droplab/drop_lab';
-
-describe('CloseReopenReportToggle', () => {
-  describe('class constructor', () => {
-    const dropdownTrigger = {};
-    const dropdownList = {};
-    const button = {};
-    let commentTypeToggle;
-
-    beforeEach(() => {
-      commentTypeToggle = new CloseReopenReportToggle({
-        dropdownTrigger,
-        dropdownList,
-        button,
-      });
-    });
-
-    it('sets .dropdownTrigger', () => {
-      expect(commentTypeToggle.dropdownTrigger).toBe(dropdownTrigger);
-    });
-
-    it('sets .dropdownList', () => {
-      expect(commentTypeToggle.dropdownList).toBe(dropdownList);
-    });
-
-    it('sets .button', () => {
-      expect(commentTypeToggle.button).toBe(button);
-    });
-  });
-
-  describe('initDroplab', () => {
-    let closeReopenReportToggle;
-    const dropdownList = {
-      querySelector: jest.fn(),
-    };
-    const dropdownTrigger = {};
-    const button = {};
-    const reopenItem = {};
-    const closeItem = {};
-    const config = {};
-
-    beforeEach(() => {
-      jest.spyOn(DropLab.prototype, 'init').mockImplementation(() => {});
-      dropdownList.querySelector.mockReturnValueOnce(reopenItem).mockReturnValueOnce(closeItem);
-
-      closeReopenReportToggle = new CloseReopenReportToggle({
-        dropdownTrigger,
-        dropdownList,
-        button,
-      });
-
-      jest.spyOn(closeReopenReportToggle, 'setConfig').mockReturnValue(config);
-
-      closeReopenReportToggle.initDroplab();
-    });
-
-    it('sets .reopenItem and .closeItem', () => {
-      expect(dropdownList.querySelector).toHaveBeenCalledWith('.reopen-item');
-      expect(dropdownList.querySelector).toHaveBeenCalledWith('.close-item');
-      expect(closeReopenReportToggle.reopenItem).toBe(reopenItem);
-      expect(closeReopenReportToggle.closeItem).toBe(closeItem);
-    });
-
-    it('sets .droplab', () => {
-      expect(closeReopenReportToggle.droplab).toEqual(expect.any(Object));
-    });
-
-    it('calls .setConfig', () => {
-      expect(closeReopenReportToggle.setConfig).toHaveBeenCalled();
-    });
-
-    it('calls droplab.init', () => {
-      expect(DropLab.prototype.init).toHaveBeenCalledWith(
-        dropdownTrigger,
-        dropdownList,
-        expect.any(Array),
-        config,
-      );
-    });
-  });
-
-  describe('updateButton', () => {
-    let closeReopenReportToggle;
-    const dropdownList = {};
-    const dropdownTrigger = {};
-    const button = {
-      blur: jest.fn(),
-    };
-    const isClosed = true;
-
-    beforeEach(() => {
-      closeReopenReportToggle = new CloseReopenReportToggle({
-        dropdownTrigger,
-        dropdownList,
-        button,
-      });
-
-      jest.spyOn(closeReopenReportToggle, 'toggleButtonType').mockImplementation(() => {});
-
-      closeReopenReportToggle.updateButton(isClosed);
-    });
-
-    it('calls .toggleButtonType', () => {
-      expect(closeReopenReportToggle.toggleButtonType).toHaveBeenCalledWith(isClosed);
-    });
-
-    it('calls .button.blur', () => {
-      expect(closeReopenReportToggle.button.blur).toHaveBeenCalled();
-    });
-  });
-
-  describe('toggleButtonType', () => {
-    let closeReopenReportToggle;
-    const dropdownList = {};
-    const dropdownTrigger = {};
-    const button = {};
-    const isClosed = true;
-    const showItem = {
-      click: jest.fn(),
-    };
-    const hideItem = {};
-    showItem.classList = {
-      add: jest.fn(),
-      remove: jest.fn(),
-    };
-    hideItem.classList = {
-      add: jest.fn(),
-      remove: jest.fn(),
-    };
-
-    beforeEach(() => {
-      closeReopenReportToggle = new CloseReopenReportToggle({
-        dropdownTrigger,
-        dropdownList,
-        button,
-      });
-
-      jest.spyOn(closeReopenReportToggle, 'getButtonTypes').mockReturnValue([showItem, hideItem]);
-
-      closeReopenReportToggle.toggleButtonType(isClosed);
-    });
-
-    it('calls .getButtonTypes', () => {
-      expect(closeReopenReportToggle.getButtonTypes).toHaveBeenCalledWith(isClosed);
-    });
-
-    it('removes hide class and add selected class to showItem, opposite for hideItem', () => {
-      expect(showItem.classList.remove).toHaveBeenCalledWith('hidden');
-      expect(showItem.classList.add).toHaveBeenCalledWith('droplab-item-selected');
-      expect(hideItem.classList.add).toHaveBeenCalledWith('hidden');
-      expect(hideItem.classList.remove).toHaveBeenCalledWith('droplab-item-selected');
-    });
-
-    it('clicks the showItem', () => {
-      expect(showItem.click).toHaveBeenCalled();
-    });
-  });
-
-  describe('getButtonTypes', () => {
-    let closeReopenReportToggle;
-    const dropdownList = {};
-    const dropdownTrigger = {};
-    const button = {};
-    const reopenItem = {};
-    const closeItem = {};
-
-    beforeEach(() => {
-      closeReopenReportToggle = new CloseReopenReportToggle({
-        dropdownTrigger,
-        dropdownList,
-        button,
-      });
-
-      closeReopenReportToggle.reopenItem = reopenItem;
-      closeReopenReportToggle.closeItem = closeItem;
-    });
-
-    it('returns reopenItem, closeItem if isClosed is true', () => {
-      const buttonTypes = closeReopenReportToggle.getButtonTypes(true);
-
-      expect(buttonTypes).toEqual([reopenItem, closeItem]);
-    });
-
-    it('returns closeItem, reopenItem if isClosed is false', () => {
-      const buttonTypes = closeReopenReportToggle.getButtonTypes(false);
-
-      expect(buttonTypes).toEqual([closeItem, reopenItem]);
-    });
-  });
-
-  describe('setDisable', () => {
-    let closeReopenReportToggle;
-    const dropdownList = {};
-    const dropdownTrigger = {
-      setAttribute: jest.fn(),
-      removeAttribute: jest.fn(),
-    };
-    const button = {
-      setAttribute: jest.fn(),
-      removeAttribute: jest.fn(),
-    };
-
-    beforeEach(() => {
-      closeReopenReportToggle = new CloseReopenReportToggle({
-        dropdownTrigger,
-        dropdownList,
-        button,
-      });
-    });
-
-    it('disable .button and .dropdownTrigger if shouldDisable is true', () => {
-      closeReopenReportToggle.setDisable(true);
-
-      expect(button.setAttribute).toHaveBeenCalledWith('disabled', 'true');
-      expect(dropdownTrigger.setAttribute).toHaveBeenCalledWith('disabled', 'true');
-    });
-
-    it('disable .button and .dropdownTrigger if shouldDisable is undefined', () => {
-      closeReopenReportToggle.setDisable();
-
-      expect(button.setAttribute).toHaveBeenCalledWith('disabled', 'true');
-      expect(dropdownTrigger.setAttribute).toHaveBeenCalledWith('disabled', 'true');
-    });
-
-    it('enable .button and .dropdownTrigger if shouldDisable is false', () => {
-      closeReopenReportToggle.setDisable(false);
-
-      expect(button.removeAttribute).toHaveBeenCalledWith('disabled');
-      expect(dropdownTrigger.removeAttribute).toHaveBeenCalledWith('disabled');
-    });
-  });
-
-  describe('setConfig', () => {
-    let closeReopenReportToggle;
-    const dropdownList = {};
-    const dropdownTrigger = {};
-    const button = {};
-    let config;
-
-    beforeEach(() => {
-      closeReopenReportToggle = new CloseReopenReportToggle({
-        dropdownTrigger,
-        dropdownList,
-        button,
-      });
-
-      config = closeReopenReportToggle.setConfig();
-    });
-
-    it('returns a config object', () => {
-      expect(config).toEqual({
-        InputSetter: [
-          {
-            input: button,
-            valueAttribute: 'data-text',
-            inputAttribute: 'data-value',
-          },
-          {
-            input: button,
-            valueAttribute: 'data-text',
-            inputAttribute: 'title',
-          },
-          {
-            input: button,
-            valueAttribute: 'data-button-class',
-            inputAttribute: 'class',
-          },
-          {
-            input: dropdownTrigger,
-            valueAttribute: 'data-toggle-class',
-            inputAttribute: 'class',
-          },
-          {
-            input: button,
-            valueAttribute: 'data-url',
-            inputAttribute: 'data-endpoint',
-          },
-        ],
-      });
-    });
-  });
-});
diff --git a/spec/frontend/fixtures/issues.rb b/spec/frontend/fixtures/issues.rb
index fccd0ca1d2c..2bea6abbbaf 100644
--- a/spec/frontend/fixtures/issues.rb
+++ b/spec/frontend/fixtures/issues.rb
@@ -40,11 +40,6 @@ RSpec.describe Projects::IssuesController, '(JavaScript fixtures)', type: :contr
     render_issue(create(:closed_issue, project: project))
   end
 
-  it 'issues/issue-with-task-list.html' do
-    issue = create(:issue, project: project, description: '- [ ] Task List Item')
-    render_issue(issue)
-  end
-
   it 'issues/issue_list.html' do
     create(:issue, project: project)
 
diff --git a/spec/frontend/fixtures/static/issue_with_mermaid_graph.html b/spec/frontend/fixtures/static/issue_with_mermaid_graph.html
deleted file mode 100644
index e9fa75c8ba9..00000000000
--- a/spec/frontend/fixtures/static/issue_with_mermaid_graph.html
+++ /dev/null
@@ -1,82 +0,0 @@
-<div class="description" updated-at="">
-  <div class="md issue-realtime-trigger-pulse">
-    <svg
-      id="mermaid-1587752414912"
-      width="100%"
-      xmlns="http://www.w3.org/2000/svg"
-      style="max-width: 185.35000610351562px;"
-      viewBox="0 0 185.35000610351562 50.5"
-      class="mermaid"
-    >
-      <g transform="translate(0, 0)">
-        <g class="output">
-          <g class="clusters"></g>
-          <g class="edgePaths"></g>
-          <g class="edgeLabels"></g>
-          <g class="nodes">
-            <g
-              class="node js-issuable-buttons btn-close clickable"
-              style="opacity: 1;"
-              id="A"
-              transform="translate(92.67500305175781,25.25)"
-              title="click to PUT"
-            >
-              <a
-                class="js-issuable-buttons btn-close clickable"
-                href="https://invalid"
-                rel="noopener"
-              >
-                <rect
-                  rx="0"
-                  ry="0"
-                  x="-84.67500305175781"
-                  y="-17.25"
-                  width="169.35000610351562"
-                  height="34.5"
-                  class="label-container"
-                ></rect>
-                <g class="label" transform="translate(0,0)">
-                  <g transform="translate(-74.67500305175781,-7.25)">
-                    <text style="">
-                      <tspan xml:space="preserve" dy="1em" x="1">Click to send a PUT request</tspan>
-                    </text>
-                  </g>
-                </g>
-              </a>
-            </g>
-          </g>
-        </g>
-      </g>
-      <text class="source" display="none">
-        Click to send a PUT request
-      </text>
-    </svg>
-  </div>
-  <textarea
-    data-update-url="/h5bp/html5-boilerplate/-/issues/35.json"
-    dir="auto"
-    class="hidden js-task-list-field"
-  ></textarea>
-  <div class="modal-open recaptcha-modal js-recaptcha-modal" style="display: none;">
-    <div role="dialog" tabindex="-1" class="modal d-block">
-      <div role="document" class="modal-dialog">
-        <div class="modal-content">
-          <div class="modal-header">
-            <h4 class="modal-title float-left">Please solve the reCAPTCHA</h4>
-            <button type="button" data-dismiss="modal" aria-label="Close" class="close float-right">
-              <span aria-hidden="true">×</span>
-            </button>
-          </div>
-          <div class="modal-body">
-            <div>
-              <p>We want to be sure it is you, please confirm you are not a robot.</p>
-              <div></div>
-            </div>
-          </div>
-          <!---->
-        </div>
-      </div>
-    </div>
-    <div class="modal-backdrop fade show"></div>
-  </div>
-</div>
diff --git a/spec/frontend/issue_spec.js b/spec/frontend/issue_spec.js
index 4737f9f2428..00595736821 100644
--- a/spec/frontend/issue_spec.js
+++ b/spec/frontend/issue_spec.js
@@ -1,5 +1,3 @@
-/* eslint-disable one-var, no-use-before-define */
-
 import $ from 'jquery';
 import MockAdapter from 'axios-mock-adapter';
 import axios from '~/lib/utils/axios_utils';
@@ -7,23 +5,16 @@ import Issue from '~/issue';
 import '~/lib/utils/text_utility';
 
 describe('Issue', () => {
+  let $boxClosed;
+  let $boxOpen;
   let testContext;
 
   beforeEach(() => {
     testContext = {};
   });
 
-  let $boxClosed, $boxOpen;
-
   preloadFixtures('issues/closed-issue.html');
-  preloadFixtures('issues/issue-with-task-list.html');
   preloadFixtures('issues/open-issue.html');
-  preloadFixtures('static/issue_with_mermaid_graph.html');
-
-  function expectIssueState(isIssueOpen) {
-    expectVisibility($boxClosed, !isIssueOpen);
-    expectVisibility($boxOpen, isIssueOpen);
-  }
 
   function expectVisibility($element, shouldBeVisible) {
     if (shouldBeVisible) {
@@ -33,6 +24,11 @@ describe('Issue', () => {
     }
   }
 
+  function expectIssueState(isIssueOpen) {
+    expectVisibility($boxClosed, !isIssueOpen);
+    expectVisibility($boxOpen, isIssueOpen);
+  }
+
   function findElements() {
     $boxClosed = $('div.status-box-issue-closed');
 
@@ -93,30 +89,4 @@ describe('Issue', () => {
       });
     });
   });
-
-  describe('when not displaying blocked warning', () => {
-    describe('when clicking a mermaid graph inside an issue description', () => {
-      let mock;
-      let spy;
-
-      beforeEach(() => {
-        loadFixtures('static/issue_with_mermaid_graph.html');
-        mock = new MockAdapter(axios);
-        spy = jest.spyOn(axios, 'put');
-      });
-
-      afterEach(() => {
-        mock.restore();
-        jest.clearAllMocks();
-      });
-
-      it('does not make a PUT request', () => {
-        Issue.prototype.initIssueBtnEventListeners();
-
-        $('svg a.js-issuable-actions').trigger('click');
-
-        expect(spy).not.toHaveBeenCalled();
-      });
-    });
-  });
 });
diff --git a/spec/frontend/vue_mr_widget/components/mr_widget_merge_help_spec.js b/spec/frontend/vue_mr_widget/components/mr_widget_merge_help_spec.js
index 00e79a22485..53a74bf7456 100644
--- a/spec/frontend/vue_mr_widget/components/mr_widget_merge_help_spec.js
+++ b/spec/frontend/vue_mr_widget/components/mr_widget_merge_help_spec.js
@@ -1,69 +1,45 @@
-import Vue from 'vue';
-import mountComponent from 'helpers/vue_mount_component_helper';
-import mergeHelpComponent from '~/vue_merge_request_widget/components/mr_widget_merge_help.vue';
+import { shallowMount } from '@vue/test-utils';
+import MergeHelpComponent from '~/vue_merge_request_widget/components/mr_widget_merge_help.vue';
 
 describe('MRWidgetMergeHelp', () => {
-  let vm;
-  let Component;
+  let wrapper;
 
-  beforeEach(() => {
-    Component = Vue.extend(mergeHelpComponent);
-  });
+  const createComponent = ({ props = {} } = {}) => {
+    wrapper = shallowMount(MergeHelpComponent, {
+      propsData: {
+        missingBranch: 'this-is-not-the-branch-you-are-looking-for',
+        ...props,
+      },
+    });
+  };
 
   afterEach(() => {
-    vm.$destroy();
+    wrapper.destroy();
+    wrapper = null;
   });
 
   describe('with missing branch', () => {
     beforeEach(() => {
-      vm = mountComponent(Component, {
-        missingBranch: 'this-is-not-the-branch-you-are-looking-for',
-      });
+      createComponent();
     });
 
     it('renders missing branch information', () => {
-      expect(
-        vm.$el.textContent
-          .trim()
-          .replace(/[\r\n]+/g, ' ')
-          .replace(/\s\s+/g, ' '),
-      ).toEqual(
-        'If the this-is-not-the-branch-you-are-looking-for branch exists in your local repository, you can merge this merge request manually using the command line',
-      );
-    });
-
-    it('renders button to open help modal', () => {
-      expect(vm.$el.querySelector('.js-open-modal-help').getAttribute('data-target')).toEqual(
-        '#modal_merge_info',
-      );
-
-      expect(vm.$el.querySelector('.js-open-modal-help').getAttribute('data-toggle')).toEqual(
-        'modal',
+      expect(wrapper.find('.mr-widget-help').text()).toContain(
+        'If the this-is-not-the-branch-you-are-looking-for branch exists in your local repository',
       );
     });
   });
 
   describe('without missing branch', () => {
     beforeEach(() => {
-      vm = mountComponent(Component);
+      createComponent({
+        props: { missingBranch: '' },
+      });
     });
 
     it('renders information about how to merge manually', () => {
-      expect(
-        vm.$el.textContent
-          .trim()
-          .replace(/[\r\n]+/g, ' ')
-          .replace(/\s\s+/g, ' '),
-      ).toEqual('You can merge this merge request manually using the command line');
-    });
-
-    it('renders element to open a modal', () => {
-      expect(vm.$el.querySelector('.js-open-modal-help').getAttribute('data-target')).toEqual(
-        '#modal_merge_info',
-      );
-
-      expect(vm.$el.querySelector('.js-open-modal-help').getAttribute('data-toggle')).toEqual(
-        'modal',
+      expect(wrapper.find('.mr-widget-help').text()).toContain(
+        'You can merge this merge request manually',
       );
     });
   });
diff --git a/spec/lib/gitlab/git_access_project_spec.rb b/spec/lib/gitlab/git_access_project_spec.rb
index f80915b2be9..953b74cf1a9 100644
--- a/spec/lib/gitlab/git_access_project_spec.rb
+++ b/spec/lib/gitlab/git_access_project_spec.rb
@@ -9,6 +9,7 @@ RSpec.describe Gitlab::GitAccessProject do
   let(:actor) { user }
   let(:project_path) { project.path }
   let(:namespace_path) { project&.namespace&.path }
+  let(:repository_path) { "#{namespace_path}/#{project_path}.git" }
   let(:protocol) { 'ssh' }
   let(:authentication_abilities) { %i[read_project download_code push_code] }
   let(:changes) { Gitlab::GitAccess::ANY }
@@ -17,7 +18,7 @@ RSpec.describe Gitlab::GitAccessProject do
   let(:access) do
     described_class.new(actor, container, protocol,
                         authentication_abilities: authentication_abilities,
-                        repository_path: project_path, namespace_path: namespace_path)
+                        repository_path: repository_path)
   end
 
   describe '#check_namespace!' do
@@ -103,6 +104,20 @@ RSpec.describe Gitlab::GitAccessProject do
               end
             end
 
+            context 'when namespace is blank' do
+              let(:repository_path) { 'project.git' }
+
+              it_behaves_like 'no project is created' do
+                let(:raise_specific_error) { raise_namespace_not_found }
+              end
+            end
+
+            context 'when namespace does not exist' do
+              let(:namespace_path) { 'unknown' }
+
+              it_behaves_like 'no project is created'
+            end
+
             context 'when user cannot create project in namespace' do
               let(:user2) { create(:user) }
               let(:namespace_path) { user2.namespace.path }
diff --git a/spec/lib/gitlab/git_access_spec.rb b/spec/lib/gitlab/git_access_spec.rb
index 21607edbc32..cd465a92fec 100644
--- a/spec/lib/gitlab/git_access_spec.rb
+++ b/spec/lib/gitlab/git_access_spec.rb
@@ -10,8 +10,7 @@ RSpec.describe Gitlab::GitAccess do
 
   let(:actor) { user }
   let(:project) { create(:project, :repository) }
-  let(:project_path) { project&.path }
-  let(:namespace_path) { project&.namespace&.path }
+  let(:repository_path) { "#{project.full_path}.git" }
   let(:protocol) { 'ssh' }
   let(:authentication_abilities) { %i[read_project download_code push_code] }
   let(:redirected_path) { nil }
@@ -210,10 +209,9 @@ RSpec.describe Gitlab::GitAccess do
       end
     end
 
-    context 'when the project is nil' do
+    context 'when the project does not exist' do
       let(:project) { nil }
-      let(:project_path) { "new-project" }
-      let(:namespace_path) { user.namespace.path }
+      let(:repository_path) { "#{user.namespace.path}/new-project.git" }
 
       it 'blocks push and pull with "not found"' do
         aggregate_failures do
@@ -452,9 +450,8 @@ RSpec.describe Gitlab::GitAccess do
 
       context 'when project is public' do
         let(:public_project) { create(:project, :public, :repository) }
-        let(:project_path) { public_project.path }
-        let(:namespace_path) { public_project.namespace.path }
-        let(:access) { access_class.new(nil, public_project, 'web', authentication_abilities: [:download_code], repository_path: project_path, namespace_path: namespace_path) }
+        let(:repository_path) { "#{public_project.full_path}.git" }
+        let(:access) { access_class.new(nil, public_project, 'web', authentication_abilities: [:download_code], repository_path: repository_path) }
 
         context 'when repository is enabled' do
           it 'give access to download code' do
@@ -1169,7 +1166,7 @@ RSpec.describe Gitlab::GitAccess do
   def access
     access_class.new(actor, project, protocol,
                         authentication_abilities: authentication_abilities,
-                        namespace_path: namespace_path, repository_path: project_path,
+                        repository_path: repository_path,
                         redirected_path: redirected_path, auth_result_type: auth_result_type)
   end
 
diff --git a/spec/lib/gitlab/path_regex_spec.rb b/spec/lib/gitlab/path_regex_spec.rb
index f320b8a66e8..8e9f7e372c5 100644
--- a/spec/lib/gitlab/path_regex_spec.rb
+++ b/spec/lib/gitlab/path_regex_spec.rb
@@ -433,37 +433,85 @@ RSpec.describe Gitlab::PathRegex do
     it { is_expected.not_to match('gitlab.git') }
   end
 
-  shared_examples 'invalid snippet routes' do
-    it { is_expected.not_to match('gitlab-org/gitlab/snippets/1.git') }
-    it { is_expected.not_to match('snippets/1.git') }
-    it { is_expected.not_to match('gitlab-org/gitlab/snippets/') }
-    it { is_expected.not_to match('/gitlab-org/gitlab/snippets/1') }
-    it { is_expected.not_to match('gitlab-org/gitlab/snippets/foo') }
-    it { is_expected.not_to match('root/snippets/1') }
-    it { is_expected.not_to match('/snippets/1') }
-    it { is_expected.not_to match('snippets/') }
-    it { is_expected.not_to match('snippets/foo') }
-  end
+  context 'repository routes' do
+    # Paths that match a known container
+    let_it_be(:container_paths) do
+      [
+        'gitlab-org',
+        'gitlab-org/gitlab-test',
+        'gitlab-org/gitlab-test/snippets/1',
+        'gitlab-org/gitlab-test/snippets/foo', # ambiguous, we allow creating a sub-group called 'snippets'
+        'snippets/1'
+      ]
+    end
 
-  describe '.full_snippets_repository_path_regex' do
-    subject { described_class.full_snippets_repository_path_regex }
+    # Paths that never match a container
+    let_it_be(:invalid_paths) do
+      [
+        'gitlab/',
+        '/gitlab',
+        'gitlab/foo/',
+        '?gitlab',
+        'git lab',
+        '/snippets/1',
+        'snippets/foo',
+        'gitlab-org/gitlab/snippets/'
+      ]
+    end
 
-    it { is_expected.to match('gitlab-org/gitlab/snippets/1') }
-    it { is_expected.to match('snippets/1') }
+    let_it_be(:git_paths) { container_paths.map { |path| path + '.git' } }
+    let_it_be(:snippet_paths) { container_paths.grep(%r{snippets/\d}) }
+    let_it_be(:wiki_git_paths) { (container_paths - snippet_paths).map { |path| path + '.wiki.git' } }
+    let_it_be(:invalid_git_paths) { invalid_paths.map { |path| path + '.git' } }
 
-    it_behaves_like 'invalid snippet routes'
-  end
+    def expect_route_match(paths)
+      paths.each { |path| is_expected.to match(path) }
+    end
 
-  describe '.personal_and_project_snippets_path_regex' do
-    subject { %r{\A#{described_class.personal_and_project_snippets_path_regex}\z} }
+    def expect_no_route_match(paths)
+      paths.each { |path| is_expected.not_to match(path) }
+    end
 
-    it { is_expected.to match('gitlab-org/gitlab/snippets') }
-    it { is_expected.to match('snippets') }
+    describe '.repository_route_regex' do
+      subject { %r{\A#{described_class.repository_route_regex}\z} }
 
-    it { is_expected.not_to match('gitlab-org/gitlab/snippets/1') }
-    it { is_expected.not_to match('snippets/1') }
+      it 'matches the expected paths' do
+        expect_route_match(container_paths)
+        expect_no_route_match(invalid_paths + git_paths)
+      end
+    end
 
-    it_behaves_like 'invalid snippet routes'
+    describe '.repository_git_route_regex' do
+      subject { %r{\A#{described_class.repository_git_route_regex}\z} }
+
+      it 'matches the expected paths' do
+        expect_route_match(git_paths + wiki_git_paths)
+        expect_no_route_match(container_paths + invalid_paths + invalid_git_paths)
+      end
+    end
+
+    describe '.repository_wiki_git_route_regex' do
+      subject { %r{\A#{described_class.repository_wiki_git_route_regex}\z} }
+
+      it 'matches the expected paths' do
+        expect_route_match(wiki_git_paths)
+        expect_no_route_match(git_paths + invalid_git_paths)
+      end
+
+      it { is_expected.not_to match('snippets/1.wiki.git') }
+    end
+
+    describe '.full_snippets_repository_path_regex' do
+      subject { described_class.full_snippets_repository_path_regex }
+
+      it 'matches the expected paths' do
+        expect_route_match(snippet_paths)
+        expect_no_route_match(container_paths - snippet_paths + git_paths + invalid_paths)
+      end
+
+      it { is_expected.not_to match('root/snippets/1') }
+      it { is_expected.not_to match('gitlab-org/gitlab-test/snippets/foo') }
+    end
   end
 
   describe '.container_image_regex' do
diff --git a/spec/models/analytics/devops_adoption/segment_selection_spec.rb b/spec/models/analytics/devops_adoption/segment_selection_spec.rb
deleted file mode 100644
index 64ef6636f2c..00000000000
--- a/spec/models/analytics/devops_adoption/segment_selection_spec.rb
+++ /dev/null
@@ -1,71 +0,0 @@
-# frozen_string_literal: true
-
-require 'spec_helper'
-
-RSpec.describe Analytics::DevopsAdoption::SegmentSelection, type: :model do
-  subject { build(:devops_adoption_segment_selection, :project) }
-
-  describe 'validation' do
-    let_it_be(:group) { create(:group) }
-    let_it_be(:project) { create(:project) }
-
-    it { is_expected.to validate_presence_of(:segment) }
-
-    context do
-      subject { create(:devops_adoption_segment_selection, :project, project: project) }
-
-      it { is_expected.to validate_uniqueness_of(:project_id).scoped_to(:segment_id) }
-    end
-
-    context do
-      subject { create(:devops_adoption_segment_selection, :group, group: group) }
-
-      it { is_expected.to validate_uniqueness_of(:group_id).scoped_to(:segment_id) }
-    end
-
-    it 'project is required' do
-      selection = build(:devops_adoption_segment_selection, project: nil, group: nil)
-
-      selection.validate
-
-      expect(selection.errors).to have_key(:project)
-    end
-
-    it 'project is not required when a group is given' do
-      selection = build(:devops_adoption_segment_selection, :group, group: group)
-
-      expect(selection).to be_valid
-    end
-
-    it 'does not allow group to be set when project is present' do
-      selection = build(:devops_adoption_segment_selection)
-
-      selection.group = group
-      selection.project = project
-
-      selection.validate
-
-      expect(selection.errors[:group]).to eq([s_('DevopsAdoptionSegmentSelection|The selection cannot be configured for a project and for a group at the same time')])
-    end
-
-    context 'limit the number of segment selections' do
-      let_it_be(:segment) { create(:devops_adoption_segment) }
-
-      subject { build(:devops_adoption_segment_selection, project: project, segment: segment) }
-
-      before do
-        create(:devops_adoption_segment_selection, :project, segment: segment)
-
-        segment.reload
-
-        stub_const("#{described_class}::ALLOWED_SELECTIONS_PER_SEGMENT", 1)
-      end
-
-      it 'shows validation error' do
-        subject.validate
-
-        expect(subject.errors[:segment]).to eq([s_('DevopsAdoptionSegment|The maximum number of selections has been reached')])
-      end
-    end
-  end
-end
diff --git a/spec/requests/api/import_github_spec.rb b/spec/requests/api/import_github_spec.rb
index 5bbcb0c1950..d5fed330401 100644
--- a/spec/requests/api/import_github_spec.rb
+++ b/spec/requests/api/import_github_spec.rb
@@ -44,7 +44,7 @@ RSpec.describe API::ImportGithub do
 
     it 'returns 201 response when the project is imported successfully' do
       allow(Gitlab::LegacyGithubImport::ProjectCreator)
-        .to receive(:new).with(provider_repo, provider_repo.name, user.namespace, user, access_params, type: provider)
+        .to receive(:new).with(provider_repo, provider_repo.name, user.namespace, user, type: provider, **access_params)
           .and_return(double(execute: project))
 
       post api("/import/github", user), params: {
@@ -59,7 +59,7 @@ RSpec.describe API::ImportGithub do
 
     it 'returns 201 response when the project is imported successfully from GHE' do
       allow(Gitlab::LegacyGithubImport::ProjectCreator)
-        .to receive(:new).with(provider_repo, provider_repo.name, user.namespace, user, access_params, type: provider)
+        .to receive(:new).with(provider_repo, provider_repo.name, user.namespace, user, type: provider, **access_params)
           .and_return(double(execute: project))
 
       post api("/import/github", user), params: {
diff --git a/spec/requests/api/internal/base_spec.rb b/spec/requests/api/internal/base_spec.rb
index 6fe77727702..c079ee3da32 100644
--- a/spec/requests/api/internal/base_spec.rb
+++ b/spec/requests/api/internal/base_spec.rb
@@ -722,8 +722,7 @@ RSpec.describe API::Internal::Base do
           'ssh',
           {
             authentication_abilities: [:read_project, :download_code, :push_code],
-            namespace_path: project.namespace.path,
-            repository_path: project.path,
+            repository_path: "#{project.full_path}.git",
             redirected_path: nil
           }
         ).and_return(access_checker)
diff --git a/spec/routing/git_http_routing_spec.rb b/spec/routing/git_http_routing_spec.rb
index e5216d99eb9..e3cc1440a9e 100644
--- a/spec/routing/git_http_routing_spec.rb
+++ b/spec/routing/git_http_routing_spec.rb
@@ -3,22 +3,60 @@
 require 'spec_helper'
 
 RSpec.describe 'git_http routing' do
-  include RSpec::Rails::RequestExampleGroup
+  describe 'code repositories' do
+    it_behaves_like 'git repository routes' do
+      let(:path) { '/gitlab-org/gitlab-test.git' }
+    end
+  end
 
-  describe 'wiki.git routing', 'routing' do
-    let(:wiki_path)  { '/gitlab/gitlabhq/wikis' }
+  describe 'wiki repositories' do
+    context 'in project' do
+      let(:path) { '/gitlab-org/gitlab-test.wiki.git' }
 
-    it 'redirects namespace/project.wiki.git to the project wiki' do
-      expect(get('/gitlab/gitlabhq.wiki.git')).to redirect_to(wiki_path)
+      it_behaves_like 'git repository routes'
+
+      describe 'redirects', type: :request do
+        let(:web_path) { '/gitlab-org/gitlab-test/-/wikis' }
+
+        it 'redirects namespace/project.wiki.git to the project wiki' do
+          expect(get(path)).to redirect_to(web_path)
+        end
+
+        it 'preserves query parameters' do
+          expect(get("#{path}?foo=bar&baz=qux")).to redirect_to("#{web_path}?foo=bar&baz=qux")
+        end
+
+        it 'only redirects when the format is .git' do
+          expect(get(path.delete_suffix('.git'))).not_to redirect_to(web_path)
+          expect(get(path.delete_suffix('.git') + '.json')).not_to redirect_to(web_path)
+        end
+      end
     end
 
-    it 'preserves query parameters' do
-      expect(get('/gitlab/gitlabhq.wiki.git?foo=bar&baz=qux')).to redirect_to("#{wiki_path}?foo=bar&baz=qux")
+    context 'in toplevel group' do
+      it_behaves_like 'git repository routes' do
+        let(:path) { '/gitlab-org.wiki.git' }
+      end
     end
 
-    it 'only redirects when the format is .git' do
-      expect(get('/gitlab/gitlabhq.wiki')).not_to redirect_to(wiki_path)
-      expect(get('/gitlab/gitlabhq.wiki.json')).not_to redirect_to(wiki_path)
+    context 'in child group' do
+      it_behaves_like 'git repository routes' do
+        let(:path) { '/gitlab-org/child.wiki.git' }
+      end
+    end
+  end
+
+  describe 'snippet repositories' do
+    context 'personal snippet' do
+      it_behaves_like 'git repository routes' do
+        let(:path) { '/snippets/123.git' }
+      end
+    end
+
+    context 'project snippet' do
+      it_behaves_like 'git repository routes' do
+        let(:path) { '/gitlab-org/gitlab-test/snippets/123.git' }
+      end
     end
   end
 end
diff --git a/spec/routing/routing_spec.rb b/spec/routing/routing_spec.rb
index 76ccdf3237c..73d20cad4dd 100644
--- a/spec/routing/routing_spec.rb
+++ b/spec/routing/routing_spec.rb
@@ -54,10 +54,6 @@ RSpec.describe "Mounted Apps", "routing" do
   it "to API" do
     expect(get("/api/issues")).to be_routable
   end
-
-  it "to Grack" do
-    expect(get("/gitlab/gitlabhq.git")).to be_routable
-  end
 end
 
 #     snippets GET    /snippets(.:format)          snippets#index
diff --git a/spec/support/graphql/arguments.rb b/spec/support/graphql/arguments.rb
new file mode 100644
index 00000000000..d8c334c2ca4
--- /dev/null
+++ b/spec/support/graphql/arguments.rb
@@ -0,0 +1,70 @@
+# frozen_string_literal: true
+
+module Graphql
+  class Arguments
+    delegate :blank?, :empty?, to: :to_h
+
+    def initialize(values)
+      @values = values.compact
+    end
+
+    def to_h
+      @values
+    end
+
+    def ==(other)
+      to_h == other&.to_h
+    end
+
+    alias_method :eql, :==
+
+    def to_s
+      return '' if empty?
+
+      @values.map do |name, value|
+        value_str = as_graphql_literal(value)
+
+        "#{GraphqlHelpers.fieldnamerize(name.to_s)}: #{value_str}"
+      end.join(", ")
+    end
+
+    def as_graphql_literal(value)
+      self.class.as_graphql_literal(value)
+    end
+
+    # Transform values to GraphQL literal arguments.
+    # Use symbol for Enum values
+    def self.as_graphql_literal(value)
+      case value
+      when ::Graphql::Arguments then "{#{value}}"
+      when Array then "[#{value.map { |v| as_graphql_literal(v) }.join(',')}]"
+      when Hash then "{#{new(value)}}"
+      when Integer, Float, Symbol then value.to_s
+      when String then "\"#{value.gsub(/"/, '\\"')}\""
+      when nil then 'null'
+      when true then 'true'
+      when false then 'false'
+      else
+        value.to_graphql_value
+      end
+    rescue NoMethodError
+      raise ArgumentError, "Cannot represent #{value} as GraphQL literal"
+    end
+
+    def merge(other)
+      self.class.new(@values.merge(other.to_h))
+    end
+
+    def +(other)
+      if blank?
+        other
+      elsif other.blank?
+        self
+      elsif other.is_a?(String)
+        [to_s, other].compact.join(', ')
+      else
+        merge(other)
+      end
+    end
+  end
+end
diff --git a/spec/support/graphql/field_inspection.rb b/spec/support/graphql/field_inspection.rb
new file mode 100644
index 00000000000..f39ba751141
--- /dev/null
+++ b/spec/support/graphql/field_inspection.rb
@@ -0,0 +1,35 @@
+# frozen_string_literal: true
+
+module Graphql
+  class FieldInspection
+    def initialize(field)
+      @field = field
+    end
+
+    def nested_fields?
+      !scalar? && !enum?
+    end
+
+    def scalar?
+      type.kind.scalar?
+    end
+
+    def enum?
+      type.kind.enum?
+    end
+
+    def type
+      @type ||= begin
+        field_type = @field.type.respond_to?(:to_graphql) ? @field.type.to_graphql : @field.type
+
+        # The type could be nested. For example `[GraphQL::STRING_TYPE]`:
+        # - List
+        # - String!
+        # - String
+        field_type = field_type.of_type while field_type.respond_to?(:of_type)
+
+        field_type
+      end
+    end
+  end
+end
diff --git a/spec/support/graphql/field_selection.rb b/spec/support/graphql/field_selection.rb
new file mode 100644
index 00000000000..e2a3334acac
--- /dev/null
+++ b/spec/support/graphql/field_selection.rb
@@ -0,0 +1,73 @@
+# frozen_string_literal: true
+
+module Graphql
+  class FieldSelection
+    delegate :empty?, :blank?, :to_h, to: :selection
+    delegate :size, to: :paths
+
+    attr_reader :selection
+
+    def initialize(selection = {})
+      @selection = selection.to_h
+    end
+
+    def to_s
+      serialize_field_selection(selection)
+    end
+
+    def paths
+      selection.flat_map do |field, subselection|
+        paths_in([field], subselection)
+      end
+    end
+
+    private
+
+    def paths_in(path, leaves)
+      return [path] if leaves.nil?
+
+      leaves.to_a.flat_map do |k, v|
+        paths_in([k], v).map { |tail| path + tail }
+      end
+    end
+
+    def serialize_field_selection(hash, level = 0)
+      indent = ' ' * level
+
+      hash.map do |field, subselection|
+        if subselection.nil?
+          "#{indent}#{field}"
+        else
+          subfields = serialize_field_selection(subselection, level + 1)
+          "#{indent}#{field} {\n#{subfields}\n#{indent}}"
+        end
+      end.join("\n")
+    end
+
+    NO_SKIP = ->(_name, _field) { false }
+
+    def self.select_fields(type, skip = NO_SKIP, parent_types = Set.new, max_depth = 3)
+      return new if max_depth <= 0
+
+      new(type.fields.flat_map do |name, field|
+        next [] if skip[name, field]
+
+        inspected = ::Graphql::FieldInspection.new(field)
+        singular_field_type = inspected.type
+
+        # If field type is the same as parent type, then we're hitting into
+        # mutual dependency. Break it from infinite recursion
+        next [] if parent_types.include?(singular_field_type)
+
+        if inspected.nested_fields?
+          subselection = select_fields(singular_field_type, skip, parent_types | [type], max_depth - 1)
+          next [] if subselection.empty?
+
+          [[name, subselection.to_h]]
+        else
+          [[name, nil]]
+        end
+      end)
+    end
+  end
+end
diff --git a/spec/support/helpers/git_http_helpers.rb b/spec/support/helpers/git_http_helpers.rb
index c9c1c4dcfc9..c9b4e06f067 100644
--- a/spec/support/helpers/git_http_helpers.rb
+++ b/spec/support/helpers/git_http_helpers.rb
@@ -5,45 +5,45 @@ require_relative 'workhorse_helpers'
 module GitHttpHelpers
   include WorkhorseHelpers
 
-  def clone_get(project, **options)
-    get "/#{project}/info/refs", params: { service: 'git-upload-pack' }, headers: auth_env(*options.values_at(:user, :password, :spnego_request_token))
+  def clone_get(repository_path, **options)
+    get "/#{repository_path}/info/refs", params: { service: 'git-upload-pack' }, headers: auth_env(*options.values_at(:user, :password, :spnego_request_token))
   end
 
-  def clone_post(project, **options)
-    post "/#{project}/git-upload-pack", headers: auth_env(*options.values_at(:user, :password, :spnego_request_token))
+  def clone_post(repository_path, **options)
+    post "/#{repository_path}/git-upload-pack", headers: auth_env(*options.values_at(:user, :password, :spnego_request_token))
   end
 
-  def push_get(project, **options)
-    get "/#{project}/info/refs", params: { service: 'git-receive-pack' }, headers: auth_env(*options.values_at(:user, :password, :spnego_request_token))
+  def push_get(repository_path, **options)
+    get "/#{repository_path}/info/refs", params: { service: 'git-receive-pack' }, headers: auth_env(*options.values_at(:user, :password, :spnego_request_token))
   end
 
-  def push_post(project, **options)
-    post "/#{project}/git-receive-pack", headers: auth_env(*options.values_at(:user, :password, :spnego_request_token))
+  def push_post(repository_path, **options)
+    post "/#{repository_path}/git-receive-pack", headers: auth_env(*options.values_at(:user, :password, :spnego_request_token))
   end
 
-  def download(project, user: nil, password: nil, spnego_request_token: nil)
+  def download(repository_path, user: nil, password: nil, spnego_request_token: nil)
     args = { user: user, password: password, spnego_request_token: spnego_request_token }
 
-    clone_get(project, **args)
+    clone_get(repository_path, **args)
     yield response
 
-    clone_post(project, **args)
+    clone_post(repository_path, **args)
     yield response
   end
 
-  def upload(project, user: nil, password: nil, spnego_request_token: nil)
+  def upload(repository_path, user: nil, password: nil, spnego_request_token: nil)
     args = { user: user, password: password, spnego_request_token: spnego_request_token }
 
-    push_get(project, **args)
+    push_get(repository_path, **args)
     yield response
 
-    push_post(project, **args)
+    push_post(repository_path, **args)
     yield response
   end
 
-  def download_or_upload(project, **args, &block)
-    download(project, **args, &block)
-    upload(project, **args, &block)
+  def download_or_upload(repository_path, **args, &block)
+    download(repository_path, **args, &block)
+    upload(repository_path, **args, &block)
   end
 
   def auth_env(user, password, spnego_request_token)
diff --git a/spec/support/helpers/graphql_helpers.rb b/spec/support/helpers/graphql_helpers.rb
index fa48a0d3cf5..d53ca5b36ee 100644
--- a/spec/support/helpers/graphql_helpers.rb
+++ b/spec/support/helpers/graphql_helpers.rb
@@ -6,6 +6,10 @@ module GraphqlHelpers
   NoData = Class.new(StandardError)
   UnauthorizedObject = Class.new(StandardError)
 
+  def graphql_args(**values)
+    ::Graphql::Arguments.new(values)
+  end
+
   # makes an underscored string look like a fieldname
   # "merge_request" => "mergeRequest"
   def self.fieldnamerize(underscored_field_name)
@@ -240,34 +244,10 @@ module GraphqlHelpers
     type = GitlabSchema.types[class_name.to_s]
     return "" unless type
 
-    type.fields.map do |name, field|
-      # We can't guess arguments, so skip fields that require them
-      next if required_arguments?(field)
-      next if excluded.include?(name)
+    # We can't guess arguments, so skip fields that require them
+    skip = ->(name, field) { excluded.include?(name) || required_arguments?(field) }
 
-      singular_field_type = field_type(field)
-
-      # If field type is the same as parent type, then we're hitting into
-      # mutual dependency. Break it from infinite recursion
-      next if parent_types.include?(singular_field_type)
-
-      if nested_fields?(field)
-        fields =
-          all_graphql_fields_for(singular_field_type, parent_types | [type], max_depth: max_depth - 1)
-
-        "#{name} { #{fields} }" unless fields.blank?
-      else
-        name
-      end
-    end.compact.join("\n")
-  end
-
-  def attributes_to_graphql(attributes)
-    attributes.map do |name, value|
-      value_str = as_graphql_literal(value)
-
-      "#{GraphqlHelpers.fieldnamerize(name.to_s)}: #{value_str}"
-    end.join(", ")
+    ::Graphql::FieldSelection.select_fields(type, skip, parent_types, max_depth)
   end
 
   def with_signature(variables, query)
@@ -278,25 +258,8 @@ module GraphqlHelpers
     ::Graphql::Var.new(generate(:variable), type)
   end
 
-  # Fairly dumb Ruby => GraphQL rendering function. Only suitable for testing.
-  # Use symbol for Enum values
-  def as_graphql_literal(value)
-    case value
-    when Array then "[#{value.map { |v| as_graphql_literal(v) }.join(',')}]"
-    when Hash then "{#{attributes_to_graphql(value)}}"
-    when Integer, Float then value.to_s
-    when String then "\"#{value.gsub(/"/, '\\"')}\""
-    when Symbol then value
-    when nil then 'null'
-    when true then 'true'
-    when false then 'false'
-    else
-      if value.respond_to?(:to_graphql_value)
-        value.to_graphql_value
-      else
-        raise ArgumentError, "Cannot represent #{value} as GraphQL literal"
-      end
-    end
+  def attributes_to_graphql(arguments)
+    ::Graphql::Arguments.new(arguments).to_s
   end
 
   def post_multiplex(queries, current_user: nil, headers: {})
@@ -370,12 +333,16 @@ module GraphqlHelpers
     { operations: operations.to_json, map: map.to_json }.merge(extracted_files)
   end
 
+  def fresh_response_data
+    Gitlab::Json.parse(response.body)
+  end
+
   # Raises an error if no data is found
-  def graphql_data
+  def graphql_data(body = json_response)
     # Note that `json_response` is defined as `let(:json_response)` and
     # therefore, in a spec with multiple queries, will only contain data
     # from the _first_ query, not subsequent ones
-    json_response['data'] || (raise NoData, graphql_errors)
+    body['data'] || (raise NoData, graphql_errors(body))
   end
 
   def graphql_data_at(*path)
@@ -398,14 +365,15 @@ module GraphqlHelpers
     end
   end
 
-  def graphql_errors
-    case json_response
+  # See note at graphql_data about memoization and multiple requests
+  def graphql_errors(body = json_response)
+    case body
     when Hash # regular query
-      json_response['errors']
+      body['errors']
     when Array # multiplexed queries
-      json_response.map { |response| response['errors'] }
+      body.map { |response| response['errors'] }
     else
-      raise "Unknown GraphQL response type #{json_response.class}"
+      raise "Unknown GraphQL response type #{body.class}"
     end
   end
 
@@ -448,15 +416,15 @@ module GraphqlHelpers
   end
 
   def nested_fields?(field)
-    !scalar?(field) && !enum?(field)
+    ::Graphql::FieldInspection.new(field).nested_fields?
   end
 
   def scalar?(field)
-    field_type(field).kind.scalar?
+    ::Graphql::FieldInspection.new(field).scalar?
   end
 
   def enum?(field)
-    field_type(field).kind.enum?
+    ::Graphql::FieldInspection.new(field).enum?
   end
 
   # There are a few non BaseField fields in our schema (pageInfo for one).
@@ -478,15 +446,7 @@ module GraphqlHelpers
   end
 
   def field_type(field)
-    field_type = field.type.respond_to?(:to_graphql) ? field.type.to_graphql : field.type
-
-    # The type could be nested. For example `[GraphQL::STRING_TYPE]`:
-    # - List
-    # - String!
-    # - String
-    field_type = field_type.of_type while field_type.respond_to?(:of_type)
-
-    field_type
+    ::Graphql::FieldInspection.new(field).type
   end
 
   # for most tests, we want to allow unlimited complexity
diff --git a/spec/support/helpers/login_helpers.rb b/spec/support/helpers/login_helpers.rb
index e21d4497cda..d2b7e1abe9a 100644
--- a/spec/support/helpers/login_helpers.rb
+++ b/spec/support/helpers/login_helpers.rb
@@ -198,7 +198,7 @@ module LoginHelpers
     env['omniauth.error.strategy'] = strategy
   end
 
-  def stub_omniauth_saml_config(messages, context: Rails.application)
+  def stub_omniauth_saml_config(context: Rails.application, **messages)
     set_devise_mapping(context: context)
     routes = Rails.application.routes
     routes.disable_clear_and_finalize = true
diff --git a/spec/support/shared_examples/controllers/githubish_import_controller_shared_examples.rb b/spec/support/shared_examples/controllers/githubish_import_controller_shared_examples.rb
index 5a4322f73b6..422282da4d8 100644
--- a/spec/support/shared_examples/controllers/githubish_import_controller_shared_examples.rb
+++ b/spec/support/shared_examples/controllers/githubish_import_controller_shared_examples.rb
@@ -219,7 +219,7 @@ RSpec.shared_examples 'a GitHub-ish import controller: POST create' do
 
   it 'returns 200 response when the project is imported successfully' do
     allow(Gitlab::LegacyGithubImport::ProjectCreator)
-      .to receive(:new).with(provider_repo, provider_repo.name, user.namespace, user, access_params, type: provider)
+      .to receive(:new).with(provider_repo, provider_repo.name, user.namespace, user, type: provider, **access_params)
       .and_return(double(execute: project))
 
     post :create, format: :json
@@ -233,7 +233,7 @@ RSpec.shared_examples 'a GitHub-ish import controller: POST create' do
     project.errors.add(:path, 'is old')
 
     allow(Gitlab::LegacyGithubImport::ProjectCreator)
-      .to receive(:new).with(provider_repo, provider_repo.name, user.namespace, user, access_params, type: provider)
+      .to receive(:new).with(provider_repo, provider_repo.name, user.namespace, user, type: provider, **access_params)
       .and_return(double(execute: project))
 
     post :create, format: :json
@@ -244,7 +244,7 @@ RSpec.shared_examples 'a GitHub-ish import controller: POST create' do
 
   it "touches the etag cache store" do
     allow(Gitlab::LegacyGithubImport::ProjectCreator)
-      .to receive(:new).with(provider_repo, provider_repo.name, user.namespace, user, access_params, type: provider)
+      .to receive(:new).with(provider_repo, provider_repo.name, user.namespace, user, type: provider, **access_params)
       .and_return(double(execute: project))
     expect_next_instance_of(Gitlab::EtagCaching::Store) do |store|
       expect(store).to receive(:touch) { "realtime_changes_import_#{provider}_path" }
@@ -257,7 +257,7 @@ RSpec.shared_examples 'a GitHub-ish import controller: POST create' do
     context "when the provider user and GitLab user's usernames match" do
       it "takes the current user's namespace" do
         expect(Gitlab::LegacyGithubImport::ProjectCreator)
-          .to receive(:new).with(provider_repo, provider_repo.name, user.namespace, user, access_params, type: provider)
+          .to receive(:new).with(provider_repo, provider_repo.name, user.namespace, user, type: provider, **access_params)
           .and_return(double(execute: project))
 
         post :create, format: :json
@@ -269,7 +269,7 @@ RSpec.shared_examples 'a GitHub-ish import controller: POST create' do
 
       it "takes the current user's namespace" do
         expect(Gitlab::LegacyGithubImport::ProjectCreator)
-          .to receive(:new).with(provider_repo, provider_repo.name, user.namespace, user, access_params, type: provider)
+          .to receive(:new).with(provider_repo, provider_repo.name, user.namespace, user, type: provider, **access_params)
           .and_return(double(execute: project))
 
         post :create, format: :json
@@ -296,7 +296,7 @@ RSpec.shared_examples 'a GitHub-ish import controller: POST create' do
 
         it "takes the existing namespace" do
           expect(Gitlab::LegacyGithubImport::ProjectCreator)
-            .to receive(:new).with(provider_repo, provider_repo.name, existing_namespace, user, access_params, type: provider)
+            .to receive(:new).with(provider_repo, provider_repo.name, existing_namespace, user, type: provider, **access_params)
             .and_return(double(execute: project))
 
           post :create, format: :json
@@ -308,7 +308,7 @@ RSpec.shared_examples 'a GitHub-ish import controller: POST create' do
           create(:user, username: other_username)
 
           expect(Gitlab::LegacyGithubImport::ProjectCreator)
-            .to receive(:new).with(provider_repo, provider_repo.name, user.namespace, user, access_params, type: provider)
+            .to receive(:new).with(provider_repo, provider_repo.name, user.namespace, user, type: provider, **access_params)
             .and_return(double(execute: project))
 
           post :create, format: :json
@@ -327,7 +327,7 @@ RSpec.shared_examples 'a GitHub-ish import controller: POST create' do
 
         it "takes the new namespace" do
           expect(Gitlab::LegacyGithubImport::ProjectCreator)
-            .to receive(:new).with(provider_repo, provider_repo.name, an_instance_of(Group), user, access_params, type: provider)
+            .to receive(:new).with(provider_repo, provider_repo.name, an_instance_of(Group), user, type: provider, **access_params)
             .and_return(double(execute: project))
 
           post :create, params: { target_namespace: provider_repo.name }, format: :json
@@ -348,7 +348,7 @@ RSpec.shared_examples 'a GitHub-ish import controller: POST create' do
 
         it "takes the current user's namespace" do
           expect(Gitlab::LegacyGithubImport::ProjectCreator)
-            .to receive(:new).with(provider_repo, provider_repo.name, user.namespace, user, access_params, type: provider)
+            .to receive(:new).with(provider_repo, provider_repo.name, user.namespace, user, type: provider, **access_params)
             .and_return(double(execute: project))
 
           post :create, format: :json
@@ -366,7 +366,7 @@ RSpec.shared_examples 'a GitHub-ish import controller: POST create' do
 
       it 'takes the selected namespace and name' do
         expect(Gitlab::LegacyGithubImport::ProjectCreator)
-          .to receive(:new).with(provider_repo, test_name, test_namespace, user, access_params, type: provider)
+          .to receive(:new).with(provider_repo, test_name, test_namespace, user, type: provider, **access_params)
           .and_return(double(execute: project))
 
         post :create, params: { target_namespace: test_namespace.name, new_name: test_name }, format: :json
@@ -374,7 +374,7 @@ RSpec.shared_examples 'a GitHub-ish import controller: POST create' do
 
       it 'takes the selected name and default namespace' do
         expect(Gitlab::LegacyGithubImport::ProjectCreator)
-          .to receive(:new).with(provider_repo, test_name, user.namespace, user, access_params, type: provider)
+          .to receive(:new).with(provider_repo, test_name, user.namespace, user, type: provider, **access_params)
           .and_return(double(execute: project))
 
         post :create, params: { new_name: test_name }, format: :json
@@ -393,7 +393,7 @@ RSpec.shared_examples 'a GitHub-ish import controller: POST create' do
 
       it 'takes the selected namespace and name' do
         expect(Gitlab::LegacyGithubImport::ProjectCreator)
-          .to receive(:new).with(provider_repo, test_name, nested_namespace, user, access_params, type: provider)
+          .to receive(:new).with(provider_repo, test_name, nested_namespace, user, type: provider, **access_params)
           .and_return(double(execute: project))
 
         post :create, params: { target_namespace: nested_namespace.full_path, new_name: test_name }, format: :json
@@ -405,7 +405,7 @@ RSpec.shared_examples 'a GitHub-ish import controller: POST create' do
 
       it 'takes the selected namespace and name' do
         expect(Gitlab::LegacyGithubImport::ProjectCreator)
-          .to receive(:new).with(provider_repo, test_name, kind_of(Namespace), user, access_params, type: provider)
+          .to receive(:new).with(provider_repo, test_name, kind_of(Namespace), user, type: provider, **access_params)
           .and_return(double(execute: project))
 
         post :create, params: { target_namespace: 'foo/bar', new_name: test_name }, format: :json
@@ -413,7 +413,7 @@ RSpec.shared_examples 'a GitHub-ish import controller: POST create' do
 
       it 'creates the namespaces' do
         allow(Gitlab::LegacyGithubImport::ProjectCreator)
-          .to receive(:new).with(provider_repo, test_name, kind_of(Namespace), user, access_params, type: provider)
+          .to receive(:new).with(provider_repo, test_name, kind_of(Namespace), user, type: provider, **access_params)
           .and_return(double(execute: project))
 
         expect { post :create, params: { target_namespace: 'foo/bar', new_name: test_name }, format: :json }
@@ -422,7 +422,7 @@ RSpec.shared_examples 'a GitHub-ish import controller: POST create' do
 
       it 'new namespace has the right parent' do
         allow(Gitlab::LegacyGithubImport::ProjectCreator)
-          .to receive(:new).with(provider_repo, test_name, kind_of(Namespace), user, access_params, type: provider)
+          .to receive(:new).with(provider_repo, test_name, kind_of(Namespace), user, type: provider, **access_params)
           .and_return(double(execute: project))
 
         post :create, params: { target_namespace: 'foo/bar', new_name: test_name }, format: :json
@@ -441,7 +441,7 @@ RSpec.shared_examples 'a GitHub-ish import controller: POST create' do
 
       it 'takes the selected namespace and name' do
         expect(Gitlab::LegacyGithubImport::ProjectCreator)
-          .to receive(:new).with(provider_repo, test_name, kind_of(Namespace), user, access_params, type: provider)
+          .to receive(:new).with(provider_repo, test_name, kind_of(Namespace), user, type: provider, **access_params)
           .and_return(double(execute: project))
 
         post :create, params: { target_namespace: 'foo/foobar/bar', new_name: test_name }, format: :json
@@ -449,7 +449,7 @@ RSpec.shared_examples 'a GitHub-ish import controller: POST create' do
 
       it 'creates the namespaces' do
         allow(Gitlab::LegacyGithubImport::ProjectCreator)
-          .to receive(:new).with(provider_repo, test_name, kind_of(Namespace), user, access_params, type: provider)
+          .to receive(:new).with(provider_repo, test_name, kind_of(Namespace), user, type: provider, **access_params)
           .and_return(double(execute: project))
 
         expect { post :create, params: { target_namespace: 'foo/foobar/bar', new_name: test_name }, format: :json }
@@ -458,7 +458,7 @@ RSpec.shared_examples 'a GitHub-ish import controller: POST create' do
 
       it 'does not create a new namespace under the user namespace' do
         expect(Gitlab::LegacyGithubImport::ProjectCreator)
-          .to receive(:new).with(provider_repo, test_name, user.namespace, user, access_params, type: provider)
+          .to receive(:new).with(provider_repo, test_name, user.namespace, user, type: provider, **access_params)
           .and_return(double(execute: project))
 
         expect { post :create, params: { target_namespace: "#{user.namespace_path}/test_group", new_name: test_name }, format: :js }
@@ -472,7 +472,7 @@ RSpec.shared_examples 'a GitHub-ish import controller: POST create' do
 
       it 'does not take the selected namespace and name' do
         expect(Gitlab::LegacyGithubImport::ProjectCreator)
-          .to receive(:new).with(provider_repo, test_name, user.namespace, user, access_params, type: provider)
+          .to receive(:new).with(provider_repo, test_name, user.namespace, user, type: provider, **access_params)
           .and_return(double(execute: project))
 
         post :create, params: { target_namespace: 'foo/foobar/bar', new_name: test_name }, format: :js
@@ -480,7 +480,7 @@ RSpec.shared_examples 'a GitHub-ish import controller: POST create' do
 
       it 'does not create the namespaces' do
         allow(Gitlab::LegacyGithubImport::ProjectCreator)
-          .to receive(:new).with(provider_repo, test_name, kind_of(Namespace), user, access_params, type: provider)
+          .to receive(:new).with(provider_repo, test_name, kind_of(Namespace), user, type: provider, **access_params)
           .and_return(double(execute: project))
 
         expect { post :create, params: { target_namespace: 'foo/foobar/bar', new_name: test_name }, format: :js }
@@ -497,7 +497,7 @@ RSpec.shared_examples 'a GitHub-ish import controller: POST create' do
         user.update!(can_create_group: false)
 
         expect(Gitlab::LegacyGithubImport::ProjectCreator)
-          .to receive(:new).with(provider_repo, test_name, group, user, access_params, type: provider)
+          .to receive(:new).with(provider_repo, test_name, group, user, type: provider, **access_params)
           .and_return(double(execute: project))
 
         post :create, params: { target_namespace: 'foo', new_name: test_name }, format: :js
diff --git a/spec/support/shared_examples/routing/git_http_routing_shared_examples.rb b/spec/support/shared_examples/routing/git_http_routing_shared_examples.rb
new file mode 100644
index 00000000000..b0e1e942d81
--- /dev/null
+++ b/spec/support/shared_examples/routing/git_http_routing_shared_examples.rb
@@ -0,0 +1,43 @@
+# frozen_string_literal: true
+
+RSpec.shared_examples 'git repository routes' do
+  let(:params) { { repository_path: path.delete_prefix('/') } }
+  let(:container_path) { path.delete_suffix('.git') }
+
+  it 'routes Git endpoints' do
+    expect(get("#{path}/info/refs")).to route_to('repositories/git_http#info_refs', **params)
+    expect(post("#{path}/git-upload-pack")).to route_to('repositories/git_http#git_upload_pack', **params)
+    expect(post("#{path}/git-receive-pack")).to route_to('repositories/git_http#git_receive_pack', **params)
+  end
+
+  context 'requests without .git format' do
+    it 'redirects requests to /info/refs', type: :request do
+      expect(get("#{container_path}/info/refs")).to redirect_to("#{container_path}.git/info/refs")
+      expect(get("#{container_path}/info/refs?service=git-upload-pack")).to redirect_to("#{container_path}.git/info/refs?service=git-upload-pack")
+      expect(get("#{container_path}/info/refs?service=git-receive-pack")).to redirect_to("#{container_path}.git/info/refs?service=git-receive-pack")
+    end
+
+    it 'does not redirect other requests' do
+      expect(post("#{container_path}/git-upload-pack")).not_to be_routable
+    end
+  end
+
+  it 'routes LFS endpoints' do
+    oid = generate(:oid)
+
+    expect(post("#{path}/info/lfs/objects/batch")).to route_to('repositories/lfs_api#batch', **params)
+    expect(post("#{path}/info/lfs/objects")).to route_to('repositories/lfs_api#deprecated', **params)
+    expect(get("#{path}/info/lfs/objects/#{oid}")).to route_to('repositories/lfs_api#deprecated', oid: oid, **params)
+
+    expect(post("#{path}/info/lfs/locks/123/unlock")).to route_to('repositories/lfs_locks_api#unlock', id: '123', **params)
+    expect(post("#{path}/info/lfs/locks/verify")).to route_to('repositories/lfs_locks_api#verify', **params)
+
+    expect(get("#{path}/gitlab-lfs/objects/#{oid}")).to route_to('repositories/lfs_storage#download', oid: oid, **params)
+    expect(put("#{path}/gitlab-lfs/objects/#{oid}/456/authorize")).to route_to('repositories/lfs_storage#upload_authorize', oid: oid, size: '456', **params)
+    expect(put("#{path}/gitlab-lfs/objects/#{oid}/456")).to route_to('repositories/lfs_storage#upload_finalize', oid: oid, size: '456', **params)
+
+    expect(put("#{path}/gitlab-lfs/objects/foo")).not_to be_routable
+    expect(put("#{path}/gitlab-lfs/objects/#{oid}/foo")).not_to be_routable
+    expect(put("#{path}/gitlab-lfs/objects/#{oid}/foo/authorize")).not_to be_routable
+  end
+end
diff --git a/spec/support_specs/graphql/arguments_spec.rb b/spec/support_specs/graphql/arguments_spec.rb
new file mode 100644
index 00000000000..ffb58503a0e
--- /dev/null
+++ b/spec/support_specs/graphql/arguments_spec.rb
@@ -0,0 +1,71 @@
+# frozen_string_literal: true
+
+require 'spec_helper'
+
+RSpec.describe Graphql::Arguments do
+  it 'returns a blank string if the arguments are blank' do
+    args = described_class.new({})
+
+    expect("#{args}").to be_blank
+  end
+
+  it 'returns a serialized arguments if the arguments are not blank' do
+    units = described_class.new({ temp: :CELSIUS, time: :MINUTES })
+    args = described_class.new({ temp: 180, time: 45, units: units })
+
+    expect("#{args}").to eq('temp: 180, time: 45, units: {temp: CELSIUS, time: MINUTES}')
+  end
+
+  it 'supports merge with +' do
+    lhs = described_class.new({ a: 1, b: 2 })
+    rhs = described_class.new({ b: 3, c: 4 })
+
+    expect(lhs + rhs).to eq({ a: 1, b: 3, c: 4 })
+  end
+
+  it 'supports merge with + and a string' do
+    lhs = described_class.new({ a: 1, b: 2 })
+    rhs = 'x: no'
+
+    expect(lhs + rhs).to eq('a: 1, b: 2, x: no')
+  end
+
+  it 'supports merge with + and a string when empty' do
+    lhs = described_class.new({})
+    rhs = 'x: no'
+
+    expect(lhs + rhs).to eq('x: no')
+  end
+
+  it 'supports merge with + and an empty string' do
+    lhs = described_class.new({ a: 1 })
+    rhs = ''
+
+    expect(lhs + rhs).to eq({ a: 1 })
+  end
+
+  it 'serializes all values correctly' do
+    args = described_class.new({
+      array: [1, 2.5, "foo", nil, true, false, :BAR, { power: :on }],
+      hash: { a: 1, b: 2, c: 3 },
+      int: 42,
+      float: 2.7,
+      string: %q[he said "no"],
+      enum: :OFF,
+      null: nil, # we expect this to be omitted - absence is the same as explicit nullness
+      bool_true: true,
+      bool_false: false,
+      var: ::Graphql::Var.new('x', 'Int')
+    })
+
+    expect(args.to_s).to eq([
+      %q(array: [1,2.5,"foo",null,true,false,BAR,{power: on}]),
+      %q(hash: {a: 1, b: 2, c: 3}),
+      'int: 42, float: 2.7',
+      %q(string: "he said \\"no\\""),
+      'enum: OFF',
+      'boolTrue: true, boolFalse: false',
+      'var: $x'
+    ].join(', '))
+  end
+end
diff --git a/spec/support_specs/graphql/field_selection_spec.rb b/spec/support_specs/graphql/field_selection_spec.rb
new file mode 100644
index 00000000000..8818e59e598
--- /dev/null
+++ b/spec/support_specs/graphql/field_selection_spec.rb
@@ -0,0 +1,62 @@
+# frozen_string_literal: true
+
+require 'spec_helper'
+
+RSpec.describe Graphql::FieldSelection do
+  it 'can report on the paths that are selected' do
+    selection = described_class.new({
+      'foo' => nil,
+      'bar' => nil,
+      'quux' => {
+        'a' => nil,
+        'b' => { 'x' => nil, 'y' => nil }
+      },
+      'qoox' => {
+        'q' => nil,
+        'r' => { 's' => { 't' => nil } }
+      }
+    })
+
+    expect(selection.paths).to include(
+      %w[foo],
+      %w[quux a],
+      %w[quux b x],
+      %w[qoox r s t]
+    )
+  end
+
+  it 'can serialize a field selection nicely' do
+    selection = described_class.new({
+      'foo' => nil,
+      'bar' => nil,
+      'quux' => {
+        'a' => nil,
+        'b' => { 'x' => nil, 'y' => nil }
+      },
+      'qoox' => {
+        'q' => nil,
+        'r' => { 's' => { 't' => nil } }
+      }
+    })
+
+    expect(selection.to_s).to eq(<<~FRAG.strip)
+    foo
+    bar
+    quux {
+     a
+     b {
+      x
+      y
+     }
+    }
+    qoox {
+     q
+     r {
+      s {
+       t
+      }
+     }
+    }
+    FRAG
+  end
+end
diff --git a/spec/support_specs/helpers/graphql_helpers_spec.rb b/spec/support_specs/helpers/graphql_helpers_spec.rb
index 47e5192cdc9..a9fe5b8d196 100644
--- a/spec/support_specs/helpers/graphql_helpers_spec.rb
+++ b/spec/support_specs/helpers/graphql_helpers_spec.rb
@@ -215,13 +215,68 @@ RSpec.describe GraphqlHelpers do
       aFloat: 0.1,
       aString: "wibble",
       anEnum: LOW,
-      null: null,
       aBool: false,
       aVar: #{x.to_graphql_value}
       EXP
     end
   end
 
+  describe '.all_graphql_fields_for' do
+    it 'returns a FieldSelection' do
+      selection = all_graphql_fields_for('User', max_depth: 1)
+
+      expect(selection).to be_a(::Graphql::FieldSelection)
+    end
+
+    it 'returns nil if the depth is too shallow' do
+      selection = all_graphql_fields_for('User', max_depth: 0)
+
+      expect(selection).to be_nil
+    end
+
+    it 'can select just the scalar fields' do
+      selection = all_graphql_fields_for('User', max_depth: 1)
+      paths = selection.paths.map(&:join)
+
+      # A sample, tested using include to save churn as fields are added
+      expect(paths)
+        .to include(*%w[avatarUrl email groupCount id location name state username webPath webUrl])
+
+      expect(selection.paths).to all(have_attributes(size: 1))
+    end
+
+    it 'selects only as far as 3 levels by default' do
+      selection = all_graphql_fields_for('User')
+
+      expect(selection.paths).to all(have_attributes(size: (be <= 3)))
+
+      # Representative sample
+      expect(selection.paths).to include(
+        %w[userPermissions createSnippet],
+        %w[todos nodes id],
+        %w[starredProjects nodes name],
+        %w[authoredMergeRequests count],
+        %w[assignedMergeRequests pageInfo startCursor]
+      )
+    end
+
+    it 'selects only as far as requested' do
+      selection = all_graphql_fields_for('User', max_depth: 2)
+
+      expect(selection.paths).to all(have_attributes(size: (be <= 2)))
+    end
+
+    it 'omits fields that have required arguments' do
+      selection = all_graphql_fields_for('DesignCollection', max_depth: 3)
+
+      expect(selection.paths).not_to be_empty
+
+      expect(selection.paths).not_to include(
+        %w[designAtVersion id]
+      )
+    end
+  end
+
   describe '.graphql_mutation' do
     shared_examples 'correct mutation definition' do
       it 'returns correct mutation definition' do
diff --git a/spec/workers/project_cache_worker_spec.rb b/spec/workers/project_cache_worker_spec.rb
index 0f91f7af255..7f42c700ce4 100644
--- a/spec/workers/project_cache_worker_spec.rb
+++ b/spec/workers/project_cache_worker_spec.rb
@@ -5,8 +5,9 @@ require 'spec_helper'
 RSpec.describe ProjectCacheWorker do
   include ExclusiveLeaseHelpers
 
+  let_it_be(:project) { create(:project, :repository) }
+
   let(:worker) { described_class.new }
-  let(:project) { create(:project, :repository) }
   let(:lease_key) { ["project_cache_worker", project.id, *statistics.sort].join(":") }
   let(:lease_timeout) { ProjectCacheWorker::LEASE_TIMEOUT }
   let(:statistics) { [] }
@@ -126,4 +127,15 @@ RSpec.describe ProjectCacheWorker do
       end
     end
   end
+
+  it_behaves_like 'an idempotent worker' do
+    let(:job_args) { [project.id, %w(readme), %w(repository_size)] }
+
+    it 'calls Projects::UpdateStatisticsService service twice', :clean_gitlab_redis_shared_state do
+      expect(Projects::UpdateStatisticsService).to receive(:new).once.and_return(double(execute: true))
+      expect(UpdateProjectStatisticsWorker).to receive(:perform_in).once
+
+      subject
+    end
+  end
 end