Merge branch 'master' into 'alerts-for-built-in-metrics'

# Conflicts:
#   db/schema.rb

.eslintrc.yml

@@ -33,6 +33,15 @@ rules:
     - error
     - max: 1
   promise/catch-or-return: error
+  no-param-reassign:
+    - error
+    - props: true
+      ignorePropertyModificationsFor:
+        - "acc"         # for reduce accumulators
+        - "accumulator" # for reduce accumulators
+        - "el"          # for DOM elements
+        - "element"     # for DOM elements
+        - "state"       # for Vuex mutations
   no-underscore-dangle:
     - error
     - allow:

.gitignore

@@ -77,3 +77,4 @@ eslint-report.html
 /plugins/*
 /.gitlab_pages_secret
 package-lock.json
+/junit_rspec.xml

.gitlab-ci.yml

@@ -171,7 +171,7 @@ stages:
     - '[[ -f $FLAKY_RSPEC_REPORT_PATH ]] || echo "{}" > ${FLAKY_RSPEC_REPORT_PATH}'
     - '[[ -f $NEW_FLAKY_RSPEC_REPORT_PATH ]] || echo "{}" > ${NEW_FLAKY_RSPEC_REPORT_PATH}'
     - scripts/gitaly-test-spawn
-    - knapsack rspec "--color --format documentation"
+    - knapsack rspec "--color --format documentation --format RspecJunitFormatter --out junit_rspec.xml"
   artifacts:
     expire_in: 31d
     when: always
@@ -180,6 +180,8 @@ stages:
       - knapsack/
       - rspec_flaky/
       - tmp/capybara/
+    reports:
+      junit: junit_rspec.xml
 
 .rspec-metadata-pg: &rspec-metadata-pg
   <<: *rspec-metadata

.gitlab/CODEOWNERS

+# Backend Maintainers are the default for all ruby files
+*.rb @ayufan @DouweM @dzaporozhets @grzesiek @nick.thomas @rspeicher @rymai @smcgivern
+*.rake @ayufan @DouweM @dzaporozhets @grzesiek @nick.thomas @rspeicher @rymai @smcgivern
+
+# Technical writing team are the default reviewers for everything in `doc/`
+/doc/ @axil @marcia
+
+# Frontend maintainers should see everything in `app/assets/`
+app/assets/ @annabeldunstone @ClemMakesApps @fatihacet @filipa @iamphill @mikegreiling @timzallmann
+
+# Someone from the database team should review changes in `db/`
+db/ @abrandl @NikolayS
+
+# Feature specific owners
+/ee/lib/gitlab/code_owners/ @reprazent

CONTRIBUTING.md

@@ -36,7 +36,7 @@ _This notice should stay as the first item in the CONTRIBUTING.md file._
   - [Release Scoping labels](#release-scoping-labels)
   - [Priority labels](#priority-labels)
   - [Severity labels](#severity-labels)
-    - [Severity impact guidance](#severity-impact-guidance)
+     - [Severity impact guidance](#severity-impact-guidance)
   - [Label for community contributors](#label-for-community-contributors)
 - [Implement design & UI elements](#implement-design--ui-elements)
 - [Issue tracker](#issue-tracker)

GITALY_SERVER_VERSION

-0.117.2
+0.119.0

GITLAB_WORKHORSE_VERSION

-6.0.0
+6.1.0

Gemfile

@@ -68,7 +68,7 @@ gem 'u2f', '~> 0.2.1'
 gem 'validates_hostname', '~> 1.0.6'
 
 # Browser detection
-gem 'browser', '~> 2.2'
+gem 'browser', '~> 2.5'
 
 # GPG
 gem 'gpgme'
@@ -107,7 +107,9 @@ gem 'kaminari', '~> 1.0'
 gem 'hamlit', '~> 2.8.8'
 
 # Files attachments
-gem 'carrierwave', '~> 1.2'
+# Locked until https://github.com/carrierwaveuploader/carrierwave/pull/2332/files is merged.
+# config/initializers/carrierwave_patch.rb can be removed once that change is released.
+gem 'carrierwave', '= 1.2.3'
 gem 'mini_magick'
 
 # Drag and Drop UI
@@ -389,6 +391,7 @@ group :test do
   gem 'sham_rack', '~> 1.3.6'
   gem 'concurrent-ruby', '~> 1.0.5'
   gem 'test-prof', '~> 0.2.5'
+  gem 'rspec_junit_formatter'
 end
 
 gem 'octokit', '~> 4.9'
@@ -422,7 +425,7 @@ group :ed25519 do
 end
 
 # Gitaly GRPC client
-gem 'gitaly-proto', '~> 0.113.0', require: 'gitaly'
+gem 'gitaly-proto', '~> 0.117.0', require: 'gitaly'
 gem 'grpc', '~> 1.11.0'
 
 # Locked until https://github.com/google/protobuf/issues/4210 is closed

Gemfile.lock

@@ -90,7 +90,7 @@ GEM
       msgpack (~> 1.0)
     bootstrap_form (2.7.0)
     brakeman (4.2.1)
-    browser (2.2.0)
+    browser (2.5.3)
     builder (3.2.3)
     bullet (5.5.1)
       activesupport (>= 3.0.0)
@@ -276,7 +276,7 @@ GEM
       gettext_i18n_rails (>= 0.7.1)
       po_to_json (>= 1.0.0)
       rails (>= 3.2.0)
-    gitaly-proto (0.113.0)
+    gitaly-proto (0.117.0)
       google-protobuf (~> 3.1)
       grpc (~> 1.10)
     github-linguist (5.3.3)
@@ -770,6 +770,9 @@ GEM
       rspec-core
     rspec-set (0.1.3)
     rspec-support (3.7.1)
+    rspec_junit_formatter (0.2.3)
+      builder (< 4)
+      rspec-core (>= 2, < 4, != 2.12.0)
     rspec_profiling (0.0.5)
       activerecord
       pg
@@ -798,7 +801,7 @@ GEM
       sexp_processor (~> 4.1)
     rubyntlm (0.6.2)
     rubypants (0.2.0)
-    rubyzip (1.2.1)
+    rubyzip (1.2.2)
     rufus-scheduler (3.4.0)
       et-orbi (~> 1.0)
     rugged (0.27.4)
@@ -988,12 +991,12 @@ DEPENDENCIES
   bootsnap (~> 1.3)
   bootstrap_form (~> 2.7.0)
   brakeman (~> 4.2)
-  browser (~> 2.2)
+  browser (~> 2.5)
   bullet (~> 5.5.0)
   bundler-audit (~> 0.5.0)
   capybara (~> 2.15)
   capybara-screenshot (~> 1.0.0)
-  carrierwave (~> 1.2)
+  carrierwave (= 1.2.3)
   charlock_holmes (~> 0.7.5)
   chronic (~> 0.10.2)
   chronic_duration (~> 0.10.6)
@@ -1035,7 +1038,7 @@ DEPENDENCIES
   gettext (~> 3.2.2)
   gettext_i18n_rails (~> 1.8.0)
   gettext_i18n_rails_js (~> 1.3)
-  gitaly-proto (~> 0.113.0)
+  gitaly-proto (~> 0.117.0)
   github-linguist (~> 5.3.3)
   gitlab-flowdock-git-hook (~> 1.0.1)
   gitlab-gollum-lib (~> 4.2)
@@ -1143,6 +1146,7 @@ DEPENDENCIES
   rspec-rails (~> 3.7.0)
   rspec-retry (~> 0.4.5)
   rspec-set (~> 0.1.3)
+  rspec_junit_formatter
   rspec_profiling (~> 0.0.5)
   rubocop (~> 0.54.0)
   rubocop-rspec (~> 1.22.1)

Gemfile.rails5.lock

@@ -93,7 +93,7 @@ GEM
       msgpack (~> 1.0)
     bootstrap_form (2.7.0)
     brakeman (4.2.1)
-    browser (2.2.0)
+    browser (2.5.3)
     builder (3.2.3)
     bullet (5.5.1)
       activesupport (>= 3.0.0)
@@ -279,7 +279,7 @@ GEM
       gettext_i18n_rails (>= 0.7.1)
       po_to_json (>= 1.0.0)
       rails (>= 3.2.0)
-    gitaly-proto (0.113.0)
+    gitaly-proto (0.117.0)
       google-protobuf (~> 3.1)
       grpc (~> 1.10)
     github-linguist (5.3.3)
@@ -779,6 +779,8 @@ GEM
       rspec-core
     rspec-set (0.1.3)
     rspec-support (3.7.1)
+    rspec_junit_formatter (0.4.1)
+      rspec-core (>= 2, < 4, != 2.12.0)
     rspec_profiling (0.0.5)
       activerecord
       pg
@@ -807,7 +809,7 @@ GEM
       sexp_processor (~> 4.1)
     rubyntlm (0.6.2)
     rubypants (0.2.0)
-    rubyzip (1.2.1)
+    rubyzip (1.2.2)
     rufus-scheduler (3.4.0)
       et-orbi (~> 1.0)
     rugged (0.27.4)
@@ -998,12 +1000,12 @@ DEPENDENCIES
   bootsnap (~> 1.3)
   bootstrap_form (~> 2.7.0)
   brakeman (~> 4.2)
-  browser (~> 2.2)
+  browser (~> 2.5)
   bullet (~> 5.5.0)
   bundler-audit (~> 0.5.0)
   capybara (~> 2.15)
   capybara-screenshot (~> 1.0.0)
-  carrierwave (~> 1.2)
+  carrierwave (= 1.2.3)
   charlock_holmes (~> 0.7.5)
   chronic (~> 0.10.2)
   chronic_duration (~> 0.10.6)
@@ -1045,7 +1047,7 @@ DEPENDENCIES
   gettext (~> 3.2.2)
   gettext_i18n_rails (~> 1.8.0)
   gettext_i18n_rails_js (~> 1.3)
-  gitaly-proto (~> 0.113.0)
+  gitaly-proto (~> 0.117.0)
   github-linguist (~> 5.3.3)
   gitlab-flowdock-git-hook (~> 1.0.1)
   gitlab-gollum-lib (~> 4.2)
@@ -1154,6 +1156,7 @@ DEPENDENCIES
   rspec-rails (~> 3.7.0)
   rspec-retry (~> 0.4.5)
   rspec-set (~> 0.1.3)
+  rspec_junit_formatter
   rspec_profiling (~> 0.0.5)
   rubocop (~> 0.54.0)
   rubocop-rspec (~> 1.22.1)

app/assets/javascripts/clusters/clusters_bundle.js

 import Visibility from 'visibilityjs';
 import Vue from 'vue';
+import initDismissableCallout from '~/dismissable_callout';
 import { s__, sprintf } from '../locale';
 import Flash from '../flash';
 import Poll from '../lib/utils/poll';
 import initSettingsPanels from '../settings_panels';
 import eventHub from './event_hub';
-import {
-  APPLICATION_STATUS,
-  REQUEST_LOADING,
-  REQUEST_SUCCESS,
-  REQUEST_FAILURE,
-} from './constants';
+import { APPLICATION_STATUS, REQUEST_LOADING, REQUEST_SUCCESS, REQUEST_FAILURE } from './constants';
 import ClustersService from './services/clusters_service';
 import ClustersStore from './stores/clusters_store';
 import applications from './components/applications.vue';
@@ -66,6 +62,7 @@ export default class Clusters {
     this.showTokenButton = document.querySelector('.js-show-cluster-token');
     this.tokenField = document.querySelector('.js-cluster-token');
 
+    initDismissableCallout('.js-cluster-security-warning');
     initSettingsPanels();
     setupToggleButtons(document.querySelector('.js-cluster-enable-toggle-area'));
     this.initApplications();
@@ -129,7 +126,8 @@ export default class Clusters {
     if (!Visibility.hidden()) {
       this.poll.makeRequest();
     } else {
-      this.service.fetchData()
+      this.service
+        .fetchData()
         .then(data => this.handleSuccess(data))
         .catch(() => Clusters.handleError());
     }
@@ -177,15 +175,21 @@ export default class Clusters {
 
   checkForNewInstalls(prevApplicationMap, newApplicationMap) {
     const appTitles = Object.keys(newApplicationMap)
-      .filter(appId => newApplicationMap[appId].status === APPLICATION_STATUS.INSTALLED &&
-        prevApplicationMap[appId].status !== APPLICATION_STATUS.INSTALLED &&
-        prevApplicationMap[appId].status !== null)
+      .filter(
+        appId =>
+          newApplicationMap[appId].status === APPLICATION_STATUS.INSTALLED &&
+          prevApplicationMap[appId].status !== APPLICATION_STATUS.INSTALLED &&
+          prevApplicationMap[appId].status !== null,
+      )
       .map(appId => newApplicationMap[appId].title);
 
     if (appTitles.length > 0) {
-      const text = sprintf(s__('ClusterIntegration|%{appList} was successfully installed on your Kubernetes cluster'), {
-        appList: appTitles.join(', '),
-      });
+      const text = sprintf(
+        s__('ClusterIntegration|%{appList} was successfully installed on your Kubernetes cluster'),
+        {
+          appList: appTitles.join(', '),
+        },
+      );
       Flash(text, 'notice', this.successApplicationContainer);
     }
   }
@@ -218,13 +222,18 @@ export default class Clusters {
     this.store.updateAppProperty(appId, 'requestStatus', REQUEST_LOADING);
     this.store.updateAppProperty(appId, 'requestReason', null);
 
-    this.service.installApplication(appId, data.params)
+    this.service
+      .installApplication(appId, data.params)
       .then(() => {
         this.store.updateAppProperty(appId, 'requestStatus', REQUEST_SUCCESS);
       })
       .catch(() => {
         this.store.updateAppProperty(appId, 'requestStatus', REQUEST_FAILURE);
-        this.store.updateAppProperty(appId, 'requestReason', s__('ClusterIntegration|Request to begin installing failed'));
+        this.store.updateAppProperty(
+          appId,
+          'requestReason',
+          s__('ClusterIntegration|Request to begin installing failed'),
+        );
       });
   }
 

app/assets/javascripts/clusters/clusters_index.js

 import createFlash from '~/flash';
 import { __ } from '~/locale';
 import setupToggleButtons from '~/toggle_buttons';
-import gcpSignupOffer from '~/clusters/components/gcp_signup_offer';
+import initDismissableCallout from '~/dismissable_callout';
 
 import ClustersService from './services/clusters_service';
 
 export default () => {
   const clusterList = document.querySelector('.js-clusters-list');
 
-  gcpSignupOffer();
+  initDismissableCallout('.gcp-signup-offer');
 
   // The empty state won't have a clusterList
   if (clusterList) {

app/assets/javascripts/diffs/components/changed_files_dropdown.vue

@@ -63,7 +63,7 @@ export default {
           v-else
           role="button"
           class="fa fa-times dropdown-input-search"
-          @click="clearSearch"
+          @click.stop.prevent="clearSearch"
         ></i>
       </div>
       <div class="dropdown-content">

app/assets/javascripts/diffs/components/inline_diff_comment_row.vue

@@ -44,10 +44,9 @@ export default {
     class="notes_holder"
   >
     <td
-      class="notes_line"
-      colspan="2"
-    ></td>
-    <td class="notes_content">
+      class="notes_content"
+      colspan="3"
+    >
       <div class="content">
         <diff-discussions
           v-if="discussions.length"

app/assets/javascripts/diffs/store/mutations.js

@@ -107,7 +107,6 @@ export default {
   },
 
   [types.EXPAND_ALL_FILES](state) {
-    // eslint-disable-next-line no-param-reassign
     state.diffFiles = state.diffFiles.map(file => ({
       ...file,
       collapsed: false,

app/assets/javascripts/clusters/components/gcp_signup_offer.js → app/assets/javascripts/dismissable_callout.js

@@ -3,8 +3,8 @@ import axios from '~/lib/utils/axios_utils';
 import { __ } from '~/locale';
 import Flash from '~/flash';
 
-export default function gcpSignupOffer() {
-  const alertEl = document.querySelector('.gcp-signup-offer');
+export default function initDismissableCallout(alertSelector) {
+  const alertEl = document.querySelector(alertSelector);
   if (!alertEl) {
     return;
   }

app/assets/javascripts/fly_out_nav.js

@@ -65,8 +65,8 @@ export const hideMenu = (el) => {
 
   const parentEl = el.parentNode;
 
-  el.style.display = ''; // eslint-disable-line no-param-reassign
-  el.style.transform = ''; // eslint-disable-line no-param-reassign
+  el.style.display = '';
+  el.style.transform = '';
   el.classList.remove(IS_ABOVE_CLASS);
   parentEl.classList.remove(IS_OVER_CLASS);
   parentEl.classList.remove(IS_SHOWING_FLY_OUT_CLASS);

app/assets/javascripts/groups/components/groups.vue

@@ -37,7 +37,7 @@
 </script>
 
 <template>
-  <div class="groups-list-tree-container">
+  <div class="groups-list-tree-container qa-groups-list-tree-container">
     <div
       v-if="searchEmpty"
       class="has-no-search-results"

app/assets/javascripts/ide/stores/modules/branches/mutations.js

-/* eslint-disable no-param-reassign */
 import * as types from './mutation_types';
 
 export default {

app/assets/javascripts/ide/stores/modules/file_templates/mutations.js

-/* eslint-disable no-param-reassign */
 import * as types from './mutation_types';
 
 export default {

app/assets/javascripts/ide/stores/modules/merge_requests/mutations.js

-/* eslint-disable no-param-reassign */
 import * as types from './mutation_types';
 
 export default {

app/assets/javascripts/ide/stores/modules/pipelines/mutations.js

-/* eslint-disable no-param-reassign */
 import * as types from './mutation_types';
 import { normalizeJob } from './utils';
 

app/assets/javascripts/ide/stores/mutations.js

-/* eslint-disable no-param-reassign */
 import * as types from './mutation_types';
 import projectMutations from './mutations/project';
 import mergeRequestMutation from './mutations/merge_request';

app/assets/javascripts/ide/stores/mutations/file.js

-/* eslint-disable no-param-reassign */
 import * as types from '../mutation_types';
 import { sortTree } from '../utils';
 import { diffModes } from '../../constants';

app/assets/javascripts/jobs/store/mutations.js

-/* eslint-disable no-param-reassign */
-
 import * as types from './mutation_types';
 
 export default {

app/assets/javascripts/notes.js

@@ -1074,7 +1074,7 @@ export default class Notes {
     addForm = false;
     let lineTypeSelector = '';
     rowCssToAdd =
-      '<tr class="notes_holder js-temp-notes-holder"><td class="notes_line" colspan="2"></td><td class="notes_content"><div class="content"></div></td></tr>';
+      '<tr class="notes_holder js-temp-notes-holder"><td class="notes_content" colspan="3"><div class="content"></div></td></tr>';
     // In parallel view, look inside the correct left/right pane
     if (this.isParallelView()) {
       lineTypeSelector = `.${lineType}`;

app/assets/javascripts/notes/components/diff_with_note.vue

@@ -148,10 +148,9 @@ export default {
         </tr>
         <tr class="notes_holder">
           <td
-            class="notes_line"
-            colspan="2"
-          ></td>
-          <td class="notes_content">
+            class="notes_content"
+            colspan="3"
+          >
             <slot></slot>
           </td>
         </tr>

app/assets/javascripts/pages/admin/application_settings/index.js

 import initSettingsPanels from '~/settings_panels';
 import projectSelect from '~/project_select';
+import UsagePingPayload from './usage_ping_payload';
 
 document.addEventListener('DOMContentLoaded', () => {
   // Initialize expandable settings panels
   initSettingsPanels();
   projectSelect();
+  new UsagePingPayload(
+    document.querySelector('.js-usage-ping-payload-trigger'),
+    document.querySelector('.js-usage-ping-payload'),
+  ).init();
 });

app/assets/javascripts/pages/admin/application_settings/usage_ping_payload.js

+import axios from '../../../lib/utils/axios_utils';
+import { __ } from '../../../locale';
+import flash from '../../../flash';
+
+export default class UsagePingPayload {
+  constructor(trigger, container) {
+    this.trigger = trigger;
+    this.container = container;
+    this.isVisible = false;
+    this.isInserted = false;
+  }
+
+  init() {
+    this.spinner = this.trigger.querySelector('.js-spinner');
+    this.text = this.trigger.querySelector('.js-text');
+
+    this.trigger.addEventListener('click', event => {
+      event.preventDefault();
+
+      if (this.isVisible) return this.hidePayload();
+
+      return this.requestPayload();
+    });
+  }
+
+  requestPayload() {
+    if (this.isInserted) return this.showPayload();
+
+    this.spinner.classList.add('d-inline');
+
+    return axios
+      .get(this.container.dataset.endpoint, {
+        responseType: 'text',
+      })
+      .then(({ data }) => {
+        this.spinner.classList.remove('d-inline');
+        this.insertPayload(data);
+      })
+      .catch(() => {
+        this.spinner.classList.remove('d-inline');
+        flash(__('Error fetching usage ping data.'));
+      });
+  }
+
+  hidePayload() {
+    this.isVisible = false;
+    this.container.classList.add('d-none');
+    this.text.textContent = __('Preview payload');
+  }
+
+  showPayload() {
+    this.isVisible = true;
+    this.container.classList.remove('d-none');
+    this.text.textContent = __('Hide payload');
+  }
+
+  insertPayload(data) {
+    this.isInserted = true;
+    this.container.innerHTML = data;
+    this.showPayload();
+  }
+}

app/assets/javascripts/pages/instance_statistics/cohorts/index.js

-import initUsagePing from './usage_ping';
-
-document.addEventListener('DOMContentLoaded', initUsagePing);

app/assets/javascripts/pages/instance_statistics/cohorts/usage_ping.js

-import axios from '../../../lib/utils/axios_utils';
-import { __ } from '../../../locale';
-import flash from '../../../flash';
-
-export default function UsagePing() {
-  const el = document.querySelector('.usage-data');
-
-  axios.get(el.dataset.endpoint, {
-    responseType: 'text',
-  }).then(({ data }) => {
-    el.innerHTML = data;
-  }).catch(() => flash(__('Error fetching usage ping data.')));
-}

app/assets/javascripts/pages/projects/index.js

-import gcpSignupOffer from '~/clusters/components/gcp_signup_offer';
+import initDismissableCallout from '~/dismissable_callout';
 import initGkeDropdowns from '~/projects/gke_cluster_dropdowns';
 import Project from './project';
 import ShortcutsNavigation from '../../shortcuts_navigation';
@@ -12,7 +12,7 @@ document.addEventListener('DOMContentLoaded', () => {
   ];
 
   if (newClusterViews.indexOf(page) > -1) {
-    gcpSignupOffer();
+    initDismissableCallout('.gcp-signup-offer');
     initGkeDropdowns();
   }
 

app/assets/javascripts/pages/projects/project.js

@@ -13,40 +13,52 @@ export default class Project {
   constructor() {
     const $cloneOptions = $('ul.clone-options-dropdown');
     const $projectCloneField = $('#project_clone');
-    const $cloneBtnText = $('a.clone-dropdown-btn span');
+    const $cloneBtnLabel = $('.js-git-clone-holder .js-clone-dropdown-label');
 
-    const selectedCloneOption = $cloneBtnText.text().trim();
+    const selectedCloneOption = $cloneBtnLabel.text().trim();
     if (selectedCloneOption.length > 0) {
       $(`a:contains('${selectedCloneOption}')`, $cloneOptions).addClass('is-active');
     }
 
-    $('a', $cloneOptions).on('click', (e) => {
+    $('a', $cloneOptions).on('click', e => {
+      e.preventDefault();
       const $this = $(e.currentTarget);
       const url = $this.attr('href');
-      const activeText = $this.find('.dropdown-menu-inner-title').text();
+      const cloneType = $this.data('cloneType');
 
-      e.preventDefault();
+      $('.is-active', $cloneOptions).removeClass('is-active');
+      $(`a[data-clone-type="${cloneType}"]`).each(function() {
+        const $el = $(this);
+        const activeText = $el.find('.dropdown-menu-inner-title').text();
+        const $container = $el.closest('.project-clone-holder');
+        const $label = $container.find('.js-clone-dropdown-label');
 
-      $('.is-active', $cloneOptions).not($this).removeClass('is-active');
-      $this.toggleClass('is-active');
-      $projectCloneField.val(url);
-      $cloneBtnText.text(activeText);
+        $el.toggleClass('is-active');
+        $label.text(activeText);
+      });
 
-      return $('.clone').text(url);
+      $projectCloneField.val(url);
+      $('.js-git-empty .js-clone').text(url);
     });
     // Ref switcher
     Project.initRefSwitcher();
     $('.project-refs-select').on('change', function() {
-      return $(this).parents('form').submit();
+      return $(this)
+        .parents('form')
+        .submit();
     });
     $('.hide-no-ssh-message').on('click', function(e) {
       Cookies.set('hide_no_ssh_message', 'false');
-      $(this).parents('.no-ssh-key-message').remove();
+      $(this)
+        .parents('.no-ssh-key-message')
+        .remove();
       return e.preventDefault();
     });
     $('.hide-no-password-message').on('click', function(e) {
       Cookies.set('hide_no_password_message', 'false');
-      $(this).parents('.no-password-message').remove();
+      $(this)
+        .parents('.no-password-message')
+        .remove();
       return e.preventDefault();
     });
     Project.projectSelectDropdown();
@@ -58,7 +70,7 @@ export default class Project {
   }
 
   static changeProject(url) {
-    return window.location = url;
+    return (window.location = url);
   }
 
   static initRefSwitcher() {
@@ -73,14 +85,15 @@ export default class Project {
       selected = $dropdown.data('selected');
       return $dropdown.glDropdown({
         data(term, callback) {
-          axios.get($dropdown.data('refsUrl'), {
-            params: {
-              ref: $dropdown.data('ref'),
-              search: term,
-            },
-          })
-          .then(({ data }) => callback(data))
-          .catch(() => flash(__('An error occurred while getting projects')));
+          axios
+            .get($dropdown.data('refsUrl'), {
+              params: {
+                ref: $dropdown.data('ref'),
+                search: term,
+              },
+            })
+            .then(({ data }) => callback(data))
+            .catch(() => flash(__('An error occurred while getting projects')));
         },
         selectable: true,
         filterable: true,

app/assets/javascripts/pages/projects/show/index.js

@@ -8,15 +8,18 @@ import BlobViewer from '~/blob/viewer/index';
 import Activities from '~/activities';
 import { ajaxGet } from '~/lib/utils/common_utils';
 import GpgBadges from '~/gpg_badges';
+import initReadMore from '~/read_more';
 import Star from '../../../star';
 import notificationsDropdown from '../../../notifications_dropdown';
 
 document.addEventListener('DOMContentLoaded', () => {
+  initReadMore();
   new Star(); // eslint-disable-line no-new
   notificationsDropdown();
   new ShortcutsNavigation(); // eslint-disable-line no-new
   new NotificationsForm(); // eslint-disable-line no-new
-  new UserCallout({ // eslint-disable-line no-new
+  // eslint-disable-next-line no-new
+  new UserCallout({
     setCalloutPerProject: false,
     className: 'js-autodevops-banner',
   });

app/assets/javascripts/pipelines/components/pipelines_table_row.vue

@@ -132,10 +132,8 @@ export default {
       if (this.pipeline.ref) {
         return Object.keys(this.pipeline.ref).reduce((accumulator, prop) => {
           if (prop === 'path') {
-            // eslint-disable-next-line no-param-reassign
             accumulator.ref_url = this.pipeline.ref[prop];
           } else {
-            // eslint-disable-next-line no-param-reassign
             accumulator[prop] = this.pipeline.ref[prop];
           }
           return accumulator;

app/assets/javascripts/read_more.js

+/**
+ * ReadMore
+ *
+ * Adds "read more" functionality to elements.
+ *
+ * Specifically, it looks for a trigger, by default ".js-read-more-trigger", and adds the class
+ * "is-expanded" to the previous element in order to provide a click to expand functionality.
+ *
+ * This is useful for long text elements that you would like to truncate, especially for mobile.
+ *
+ * Example Markup
+ * <div class="read-more-container">
+ *   <p>Some text that should be long enough to have to truncate within a specified container.</p>
+ *   <p>This text will not appear in the container, as only the first line can be truncated.</p>
+ *   <p>This should also not appear, if everything is working correctly!</p>
+ * </div>
+ * <button class="js-read-more-trigger">Read more</button>
+ *
+ */
+export default function initReadMore(triggerSelector = '.js-read-more-trigger') {
+  const triggerEls = document.querySelectorAll(triggerSelector);
+
+  if (!triggerEls) return;
+
+  triggerEls.forEach(triggerEl => {
+    const targetEl = triggerEl.previousElementSibling;
+
+    if (!targetEl) {
+      return;
+    }
+
+    triggerEl.addEventListener(
+      'click',
+      e => {
+        targetEl.classList.add('is-expanded');
+        e.target.remove();
+      },
+      { once: true },
+    );
+  });
+}

app/assets/javascripts/reports/store/mutations.js

-/* eslint-disable no-param-reassign */
 import * as types from './mutation_types';
 
 export default {

app/assets/javascripts/vue_merge_request_widget/components/mr_widget_header.vue

@@ -4,6 +4,7 @@ import { n__, s__, sprintf } from '~/locale';
 import { mergeUrlParams, webIDEUrl } from '~/lib/utils/url_utility';
 import Icon from '~/vue_shared/components/icon.vue';
 import clipboardButton from '~/vue_shared/components/clipboard_button.vue';
+import tooltip from '~/vue_shared/directives/tooltip';
 import TooltipOnTruncate from '~/vue_shared/components/tooltip_on_truncate.vue';
 
 export default {
@@ -13,6 +14,9 @@ export default {
     clipboardButton,
     TooltipOnTruncate,
   },
+  directives: {
+    tooltip,
+  },
   props: {
     mr: {
       type: Object,
@@ -40,10 +44,19 @@ export default {
       });
     },
     webIdePath() {
-      return mergeUrlParams({
-        target_project: this.mr.sourceProjectFullPath !== this.mr.targetProjectFullPath ?
-          this.mr.targetProjectFullPath : '',
-      }, webIDEUrl(`/${this.mr.sourceProjectFullPath}/merge_requests/${this.mr.iid}`));
+      if (this.mr.canPushToSourceBranch) {
+        return mergeUrlParams({
+          target_project: this.mr.sourceProjectFullPath !== this.mr.targetProjectFullPath ?
+            this.mr.targetProjectFullPath : '',
+        }, webIDEUrl(`/${this.mr.sourceProjectFullPath}/merge_requests/${this.mr.iid}`));
+      }
+
+      return null;
+    },
+    ideButtonTitle() {
+      return !this.mr.canPushToSourceBranch
+        ? s__('mrWidget|You are not allowed to edit this project directly. Please fork to make changes.')
+        : '';
     },
   },
 };
@@ -93,13 +106,22 @@ export default {
         v-if="mr.isOpen"
         class="branch-actions"
       >
-        <a
-          v-if="!mr.sourceBranchRemoved"
-          :href="webIdePath"
-          class="btn btn-default inline js-web-ide d-none d-md-inline-block"
+        <span
+          v-tooltip
+          :title="ideButtonTitle"
+          data-placement="bottom"
+          tabindex="0"
         >
-          {{ s__("mrWidget|Open in Web IDE") }}
-        </a>
+          <a
+            v-if="!mr.sourceBranchRemoved"
+            :href="webIdePath"
+            :class="{ disabled: !mr.canPushToSourceBranch }"
+            class="btn btn-default inline js-web-ide d-none d-md-inline-block"
+            role="button"
+          >
+            {{ s__("mrWidget|Open in Web IDE") }}
+          </a>
+        </span>
         <button
           :disabled="mr.sourceBranchRemoved"
           data-target="#modal_merge_info"

app/assets/javascripts/vue_shared/vue_resource_interceptor.js

@@ -28,7 +28,7 @@ Vue.http.interceptors.push((request, next) => {
     response.headers.forEach((value, key) => {
       headers[key] = value;
     });
-
+    // eslint-disable-next-line no-param-reassign
     response.headers = headers;
   });
 });

app/assets/stylesheets/framework.scss

@@ -64,3 +64,4 @@
 @import 'framework/ci_variable_list';
 @import 'framework/feature_highlight';
 @import 'framework/terms';
+@import 'framework/read_more';

app/assets/stylesheets/framework/awards.scss

@@ -229,8 +229,8 @@
 
     svg {
       margin-bottom: 1px;
-      height: 18px;
-      width: 18px;
+      height: $default-icon-size;
+      width: $default-icon-size;
       border-radius: 50%;
 
       path {

app/assets/stylesheets/framework/buttons.scss

@@ -149,7 +149,8 @@
   &.btn-success,
   &.btn-new,
   &.btn-create,
-  &.btn-save {
+  &.btn-save,
+  &.btn-register {
     @include btn-green;
   }
 
@@ -172,8 +173,7 @@
   }
 
   &.btn-info,
-  &.btn-primary,
-  &.btn-register {
+  &.btn-primary {
     @include btn-blue;
   }
 
@@ -248,7 +248,7 @@
 .btn-terminal {
   svg {
     height: 14px;
-    width: 18px;
+    width: $default-icon-size;
   }
 }
 

app/assets/stylesheets/framework/filters.scss

@@ -216,8 +216,8 @@
     vertical-align: inherit;
 
     img {
-      height: 18px;
-      width: 18px;
+      height: $default-icon-size;
+      width: $default-icon-size;
     }
   }
 

app/assets/stylesheets/framework/mobile.scss

@@ -4,11 +4,6 @@
     margin-top: 20px;
   }
 
-  .container-fluid {
-    padding-left: 5px;
-    padding-right: 5px;
-  }
-
   .nav-links > li > a {
     padding: 10px;
     font-size: 12px;
@@ -49,12 +44,8 @@
     .project-repo-buttons {
       display: block;
 
-      .count-buttons .btn {
-        margin: 0 10px;
-      }
-
-      .count-buttons .count-with-arrow {
-        display: none;
+      .count-buttons .count-badge {
+        margin-top: $gl-padding-8;
       }
     }
   }

app/assets/stylesheets/framework/read_more.scss

+.read-more-container {
+  @include media-breakpoint-down(md) {
+    &:not(.is-expanded) {
+      white-space: nowrap;
+      overflow: hidden;
+      text-overflow: ellipsis;
+
+      > * {
+        display: inline;
+      }
+    }
+  }
+}

app/assets/stylesheets/framework/toggle.scss

@@ -56,8 +56,8 @@
 
     &,
     .toggle-icon-svg {
-      width: 18px;
-      height: 18px;
+      width: $default-icon-size;
+      height: $default-icon-size;
     }
 
     .toggle-icon-svg {

app/assets/stylesheets/framework/variables.scss

@@ -250,7 +250,7 @@ $container-text-max-width: 540px;
 $gl-avatar-size: 40px;
 $border-radius-default: 4px;
 $border-radius-small: 2px;
-$settings-icon-size: 18px;
+$default-icon-size: 18px;
 $layout-link-gray: #7e7c7c;
 $btn-side-margin: 10px;
 $btn-sm-side-margin: 7px;
@@ -271,6 +271,7 @@ $performance-bar-height: 35px;
 $flash-height: 52px;
 $context-header-height: 60px;
 $breadcrumb-min-height: 48px;
+$project-title-row-height: 24px;
 
 /*
 * Common component specific colors

app/assets/stylesheets/pages/admin.scss

@@ -4,3 +4,7 @@
     padding-bottom: 46px;
   }
 }
+
+.usage-data {
+  max-height: 400px;
+}

app/assets/stylesheets/pages/diff.scss

@@ -749,6 +749,10 @@
     left: $gl-padding;
   }
 
+  .dropdown-input .dropdown-input-search {
+    pointer-events: all;
+  }
+
   .diff-changed-file {
     display: flex;
     padding-top: 8px;

app/assets/stylesheets/pages/login.scss

@@ -100,6 +100,22 @@
     p {
       margin: 0;
     }
+
+    .omniauth-btn {
+      margin-bottom: $gl-padding;
+      width: 48%;
+      padding: $gl-padding-8;
+
+      @include media-breakpoint-down(md) {
+        width: 100%;
+      }
+
+      img {
+        width: $default-icon-size;
+        height: $default-icon-size;
+        margin-right: $gl-padding;
+      }
+    }
   }
 
   .new-session-tabs {
@@ -169,10 +185,6 @@
     }
   }
 
-  label {
-    font-weight: $gl-font-weight-normal;
-  }
-
   .submit-container {
     margin-top: 16px;
   }
@@ -200,15 +212,6 @@
   }
 }
 
-.oauth-image-link {
-  margin-right: 10px;
-
-  img {
-    width: 32px;
-    height: 32px;
-  }
-}
-
 .devise-layout-html {
   margin: 0;
   padding: 0;

app/assets/stylesheets/pages/notes.scss

@@ -334,20 +334,6 @@ ul.notes {
       border: 1px solid $white-normal;
       border-left: 0;
 
-      &.notes_line {
-        vertical-align: middle;
-        text-align: center;
-        padding: 10px 0;
-        background: $gray-light;
-        color: $text-color;
-      }
-
-      &.notes_line2 {
-        text-align: center;
-        padding: 10px 0;
-        border-left: 1px solid $note-line2-border !important;
-      }
-
       &.notes_content {
         background-color: $gray-light;
         border-width: 1px 0;

app/assets/stylesheets/pages/projects.scss

@@ -115,7 +115,7 @@
 .project-feature-controls {
   display: flex;
   align-items: center;
-  margin: 8px 0;
+  margin: $gl-padding-8 0;
   max-width: 432px;
 
   .toggle-wrapper {
@@ -144,12 +144,8 @@
 .group-home-panel {
   padding-top: 24px;
   padding-bottom: 24px;
+  border-bottom: 1px solid $border-color;
 
-  @include media-breakpoint-up(sm) {
-    border-bottom: 1px solid $border-color;
-  }
-
-  .project-avatar,
   .group-avatar {
     float: none;
     margin: 0 auto;
@@ -175,7 +171,6 @@
     }
   }
 
-  .project-home-desc,
   .group-home-desc {
     margin-left: auto;
     margin-right: auto;
@@ -199,6 +194,62 @@
   }
 }
 
+.project-home-panel {
+  padding-top: $gl-padding-8;
+  padding-bottom: $gl-padding-24;
+
+  .project-title-row {
+    margin-right: $gl-padding-8;
+  }
+
+  .project-avatar {
+    width: $project-title-row-height;
+    height: $project-title-row-height;
+    flex-shrink: 0;
+    flex-basis: $project-title-row-height;
+    margin: 0 $gl-padding-8 0 0;
+  }
+
+  .project-title {
+    font-size: 20px;
+    line-height: $project-title-row-height;
+    font-weight: bold;
+  }
+
+  .project-metadata {
+    font-weight: normal;
+    font-size: 14px;
+    line-height: $gl-btn-line-height;
+    color: $gl-text-color-secondary;
+
+    .icon {
+      margin-right: $gl-padding-4;
+      font-size: 16px;
+    }
+
+    .project-visibility,
+    .project-license,
+    .project-tag-list {
+      margin-right: $gl-padding-8;
+    }
+
+    .project-license {
+      .btn {
+        line-height: 0;
+        border-width: 0;
+      }
+    }
+
+    .project-tag-list,
+    .project-license {
+      .icon {
+        position: relative;
+        top: 2px;
+      }
+    }
+  }
+}
+
 .nav > .project-repo-buttons {
   margin-top: 0;
 }
@@ -206,8 +257,6 @@
 .project-repo-buttons,
 .group-buttons {
   .btn {
-    padding: 3px 10px;
-
     &:last-child {
       margin-left: 0;
     }
@@ -222,11 +271,15 @@
 
     .fa-caret-down {
       margin-left: 3px;
+
+      &.dropdown-btn-icon {
+        margin-left: 0;
+      }
     }
   }
 
   .project-action-button {
-    margin: 15px 5px 0;
+    margin: $gl-padding $gl-padding-8 0 0;
     vertical-align: top;
   }
 
@@ -243,82 +296,45 @@
   .count-buttons {
     display: inline-block;
     vertical-align: top;
-    margin-top: 15px;
-  }
+    margin-top: $gl-padding;
 
-  .project-clone-holder {
-    display: inline-block;
-    margin: 15px 5px 0 0;
+    .count-badge {
+      height: $input-height;
 
-    input {
-      height: 28px;
+      .icon {
+        top: -1px;
+      }
     }
-  }
 
-  .count-with-arrow {
-    display: inline-block;
-    position: relative;
-    margin-left: 4px;
+    .count-badge-count,
+    .count-badge-button {
+      border: 1px solid $border-color;
+      line-height: 1;
+    }
 
-    .arrow {
-      &::before {
-        content: '';
-        display: inline-block;
-        position: absolute;
-        width: 0;
-        height: 0;
-        border-color: transparent;
-        border-style: solid;
-        top: 50%;
-        left: 0;
-        margin-top: -6px;
-        border-width: 7px 5px 7px 0;
-        border-right-color: $count-arrow-border;
-        pointer-events: none;
-      }
+    .count,
+    .count-badge-button {
+      color: $gl-text-color;
+    }
 
-      &::after {
-        content: '';
-        position: absolute;
-        width: 0;
-        height: 0;
-        border-color: transparent;
-        border-style: solid;
-        top: 50%;
-        left: 1px;
-        margin-top: -9px;
-        border-width: 10px 7px 10px 0;
-        border-right-color: $white-light;
-        pointer-events: none;
-      }
+    .count-badge-count {
+      padding: 0 12px;
+      border-right: 0;
+      border-radius: $border-radius-base 0 0 $border-radius-base;
+      background: $gray-light;
     }
 
-    .count {
-      @include btn-white;
-      display: inline-block;
-      background: $white-light;
-      border-radius: 2px;
-      border-width: 1px;
-      border-style: solid;
-      font-size: 13px;
-      font-weight: $gl-font-weight-bold;
-      line-height: 13px;
-      letter-spacing: 0.4px;
-      padding: 6px 14px;
-      text-align: center;
-      vertical-align: middle;
-      touch-action: manipulation;
-      background-image: none;
-      white-space: nowrap;
-      margin: 0 10px 0 4px;
+    .count-badge-button {
+      border-radius: 0 $border-radius-base $border-radius-base 0;
+    }
+  }
 
-      a {
-        color: inherit;
-      }
+  .project-clone-holder {
+    display: inline-block;
+    margin: $gl-padding $gl-padding-8 0 0;
 
-      &:hover {
-        background: $white-light;
-      }
+    input {
+      height: $input-height;
     }
   }
 
@@ -333,6 +349,14 @@
       min-width: 320px;
     }
   }
+
+  .mobile-git-clone {
+    margin-top: $gl-padding-8;
+
+    .dropdown-menu-inner-content {
+      @extend .monospace;
+    }
+  }
 }
 
 .split-one {
@@ -511,7 +535,6 @@
     .controls {
       margin-left: auto;
     }
-
   }
 
   .choose-template {
@@ -574,7 +597,7 @@
     flex-wrap: wrap;
 
     .btn {
-      padding: 8px;
+      padding: $gl-padding-8;
       margin-right: 10px;
     }
 
@@ -651,7 +674,7 @@
       left: -10px;
       top: 50%;
       z-index: 10;
-      padding: 8px 0;
+      padding: $gl-padding-8 0;
       text-align: center;
       background-color: $white-light;
       color: $gl-text-color-tertiary;
@@ -665,7 +688,7 @@
         left: 50%;
         top: 0;
         transform: translateX(-50%);
-        padding: 0 8px;
+        padding: 0 $gl-padding-8;
       }
     }
 
@@ -699,17 +722,51 @@
 .project-stats {
   font-size: 0;
   text-align: center;
-  max-width: 100%;
   border-bottom: 1px solid $border-color;
 
-  .nav {
-    margin-top: $gl-padding-8;
-    margin-bottom: $gl-padding-8;
+  .scrolling-tabs-container {
+    .scrolling-tabs {
+      margin-top: $gl-padding-8;
+      margin-bottom: $gl-padding-8;
+      flex-wrap: wrap;
+      border-bottom: 0;
+    }
 
+    .fade-left,
+    .fade-right {
+      top: 0;
+      height: 100%;
+
+      .fa {
+        top: 50%;
+        margin-top: -$gl-padding-8;
+      }
+    }
+
+    .nav {
+      flex-basis: 100%;
+
+      + .nav {
+        margin: $gl-padding-8 0;
+      }
+    }
+
+    @include media-breakpoint-down(md) {
+      flex-direction: column;
+
+      .nav {
+        flex-wrap: nowrap;
+      }
+
+      .nav:first-child {
+        margin-right: $gl-padding-8;
+      }
+    }
+  }
+
+  .nav {
     > li {
       display: inline-block;
-      margin-top: $gl-padding-4;
-      margin-bottom: $gl-padding-4;
 
       &:not(:last-child) {
         margin-right: $gl-padding;
@@ -732,13 +789,17 @@
       font-size: $gl-font-size;
       line-height: $gl-btn-line-height;
       color: $gl-text-color-secondary;
+      white-space: nowrap;
     }
 
     .stat-link {
+      border-bottom: 0;
+
       &:hover,
       &:focus {
         color: $gl-text-color;
         text-decoration: underline;
+        border-bottom: 0;
       }
     }
 
@@ -868,7 +929,7 @@ pre.light-well {
 }
 
 .git-clone-holder {
-  width: 380px;
+  width: 320px;
 
   .btn-clipboard {
     border: 1px solid $border-color;

app/assets/stylesheets/pages/settings.scss

@@ -106,7 +106,7 @@
 
 .settings-list-icon {
   color: $gl-text-color-secondary;
-  font-size: $settings-icon-size;
+  font-size: $default-icon-size;
   line-height: 42px;
 }
 

app/controllers/application_controller.rb

@@ -110,6 +110,7 @@ class ApplicationController < ActionController::Base
   def append_info_to_payload(payload)
     super
 
+    payload[:ua] = request.env["HTTP_USER_AGENT"]
     payload[:remote_ip] = request.remote_ip
 
     logged_user = auth_user

app/controllers/concerns/issuable_collections.rb

 module IssuableCollections
   extend ActiveSupport::Concern
+  include CookiesHelper
   include SortingHelper
   include Gitlab::IssuableMetadata
   include Gitlab::Utils::StrongMemoize
@@ -107,11 +108,14 @@ module IssuableCollections
   end
 
   def set_sort_order_from_cookie
-    cookies[remember_sorting_key] = params[:sort] if params[:sort].present?
+    sort_param = params[:sort] if params[:sort].present?
     # fallback to legacy cookie value for backward compatibility
-    cookies[remember_sorting_key] ||= cookies['issuable_sort']
-    cookies[remember_sorting_key] = update_cookie_value(cookies[remember_sorting_key])
-    params[:sort] = cookies[remember_sorting_key]
+    sort_param ||= cookies['issuable_sort']
+    sort_param ||= cookies[remember_sorting_key]
+
+    sort_value = update_cookie_value(sort_param)
+    set_secure_cookie(remember_sorting_key, sort_value)
+    params[:sort] = sort_value
   end
 
   def remember_sorting_key

app/controllers/concerns/send_file_upload.rb

 module SendFileUpload
   def send_upload(file_upload, send_params: {}, redirect_params: {}, attachment: nil, disposition: 'attachment')
     if attachment
-      redirect_params[:query] = { "response-content-disposition" => "#{disposition};filename=#{attachment.inspect}" }
+      # Response-Content-Type will not override an existing Content-Type in
+      # Google Cloud Storage, so the metadata needs to be cleared on GCS for
+      # this to work. However, this override works with AWS.
+      redirect_params[:query] = { "response-content-disposition" => "#{disposition};filename=#{attachment.inspect}",
+                                  "response-content-type" => guess_content_type(attachment) }
       # By default, Rails will send uploads with an extension of .js with a
       # content-type of text/javascript, which will trigger Rails'
       # cross-origin JavaScript protection.
@@ -18,4 +22,14 @@ module SendFileUpload
       redirect_to file_upload.url(**redirect_params)
     end
   end
+
+  def guess_content_type(filename)
+    types = MIME::Types.type_for(filename)
+
+    if types.present?
+      types.first.content_type
+    else
+      "application/octet-stream"
+    end
+  end
 end

app/controllers/concerns/uploads_actions.rb

@@ -53,6 +53,8 @@ module UploadsActions
       maximum_size: Gitlab::CurrentSettings.max_attachment_size.megabytes.to_i)
 
     render json: authorized
+  rescue SocketError
+    render json: "Error uploading file", status: :internal_server_error
   end
 
   private

app/controllers/groups/labels_controller.rb

@@ -11,7 +11,7 @@ class Groups::LabelsController < Groups::ApplicationController
   def index
     respond_to do |format|
       format.html do
-        @labels = @group.labels.page(params[:page])
+        @labels = @available_labels.page(params[:page])
       end
       format.json do
         render json: LabelSerializer.new.represent_appearance(@available_labels)
@@ -113,7 +113,7 @@ class Groups::LabelsController < Groups::ApplicationController
         group_id: @group.id,
         only_group_labels: params[:only_group_labels],
         include_ancestor_groups: params[:include_ancestor_groups],
-        include_descendant_groups: params[:include_descendant_groups]
-      ).execute
+        include_descendant_groups: params[:include_descendant_groups],
+        search: params[:search]).execute
   end
 end

app/controllers/instance_statistics/cohorts_controller.rb

 # frozen_string_literal: true
 
 class InstanceStatistics::CohortsController < InstanceStatistics::ApplicationController
+  before_action :authenticate_usage_ping_enabled_or_admin!
+
   def index
     if Gitlab::CurrentSettings.usage_ping_enabled
       cohorts_results = Rails.cache.fetch('cohorts', expires_in: 1.day) do
@@ -10,4 +12,8 @@ class InstanceStatistics::CohortsController < InstanceStatistics::ApplicationCon
       @cohorts = CohortsSerializer.new.represent(cohorts_results)
     end
   end
+
+  def authenticate_usage_ping_enabled_or_admin!
+    render_404 unless Gitlab::CurrentSettings.usage_ping_enabled || current_user.admin?
+  end
 end

app/controllers/projects/application_controller.rb

 class Projects::ApplicationController < ApplicationController
+  include CookiesHelper
   include RoutableActions
   include ChecksCollaboration
 
@@ -74,7 +75,7 @@ class Projects::ApplicationController < ApplicationController
   end
 
   def apply_diff_view_cookie!
-    cookies.permanent[:diff_view] = params.delete(:view) if params[:view].present?
+    set_secure_cookie(:diff_view, params.delete(:view), permanent: true) if params[:view].present?
   end
 
   def require_pages_enabled!

app/controllers/projects/clusters_controller.rb

@@ -157,7 +157,8 @@ class Projects::ClustersController < Projects::ApplicationController
         :namespace,
         :api_url,
         :token,
-        :ca_cert
+        :ca_cert,
+        :authorization_type
       ]).merge(
         provider_type: :user,
         platform_type: :kubernetes

app/controllers/projects/hooks_controller.rb

@@ -66,6 +66,7 @@ class Projects::HooksController < Projects::ApplicationController
       :enable_ssl_verification,
       :token,
       :url,
+      :push_events_branch_filter,
       *ProjectHook.triggers.values
     )
   end

app/controllers/projects/refs_controller.rb

@@ -36,54 +36,47 @@ class Projects::RefsController < Projects::ApplicationController
   end
 
   def logs_tree
-    @offset = if params[:offset].present?
-                params[:offset].to_i
-              else
-                0
-              end
+    summary = ::Gitlab::TreeSummary.new(
+      @commit,
+      @project,
+      path: @path,
+      offset: params[:offset],
+      limit: 25
+    )
 
-    @limit = 25
-
-    @path = params[:path]
-
-    contents = []
-    contents.push(*tree.trees)
-    contents.push(*tree.blobs)
-    contents.push(*tree.submodules)
-
-    # n+1: https://gitlab.com/gitlab-org/gitlab-ce/issues/37433
-    @logs = Gitlab::GitalyClient.allow_n_plus_1_calls do
-      contents[@offset, @limit].to_a.map do |content|
-        file = @path ? File.join(@path, content.name) : content.name
-        last_commit = @repo.last_commit_for_path(@commit.id, file)
-        commit_path = project_commit_path(@project, last_commit) if last_commit
-        {
-          file_name: content.name,
-          commit: last_commit,
-          type: content.type,
-          commit_path: commit_path
-        }
-      end
-    end
-
-    offset = (@offset + @limit)
-    if contents.size > offset
-      @more_log_url = logs_file_project_ref_path(@project, @ref, @path || '', offset: offset)
-    end
+    @logs, commits = summary.summarize
+    @more_log_url = more_url(summary.next_offset) if summary.more?
 
     respond_to do |format|
       format.html { render_404 }
       format.json do
-        response.headers["More-Logs-Url"] = @more_log_url
-
+        response.headers["More-Logs-Url"] = @more_log_url if summary.more?
         render json: @logs
       end
-      format.js
+
+      # The commit titles must be rendered and redacted before being shown.
+      # Doing it here allows us to apply performance optimizations that avoid
+      # N+1 problems
+      format.js do
+        prerender_commit_full_titles!(commits)
+      end
     end
   end
 
   private
 
+  def more_url(offset)
+    logs_file_project_ref_path(@project, @ref, @path, offset: offset)
+  end
+
+  def prerender_commit_full_titles!(commits)
+    # Preload commit authors as they are used in rendering
+    commits.each(&:lazy_author)
+
+    renderer = Banzai::ObjectRenderer.new(user: current_user, default_project: @project)
+    renderer.render(commits, :full_title)
+  end
+
   def validate_ref_id
     return not_found! if params[:id].present? && params[:id] !~ Gitlab::PathRegex.git_reference_regex
   end

app/finders/template_finder.rb

+class TemplateFinder
+  VENDORED_TEMPLATES = {
+    dockerfiles: ::Gitlab::Template::DockerfileTemplate,
+    gitignores: ::Gitlab::Template::GitignoreTemplate,
+    gitlab_ci_ymls: ::Gitlab::Template::GitlabCiYmlTemplate
+  }.freeze
+
+  class << self
+    def build(type, params = {})
+      if type == :licenses
+        LicenseTemplateFinder.new(params)
+      else
+        new(type, params)
+      end
+    end
+  end
+
+  attr_reader :type, :params
+
+  attr_reader :vendored_templates
+  private :vendored_templates
+
+  def initialize(type, params = {})
+    @type = type
+    @params = params
+
+    @vendored_templates = VENDORED_TEMPLATES.fetch(type)
+  end
+
+  def execute
+    if params[:name]
+      vendored_templates.find(params[:name])
+    else
+      vendored_templates.all
+    end
+  end
+end

app/helpers/blob_helper.rb

@@ -158,32 +158,35 @@ module BlobHelper
   end
 
   def licenses_for_select
-    return @licenses_for_select if defined?(@licenses_for_select)
-
-    grouped_licenses = LicenseTemplateFinder.new.execute.group_by(&:category)
-    categories = grouped_licenses.keys
-
-    @licenses_for_select = categories.each_with_object({}) do |category, hash|
-      hash[category] = grouped_licenses[category].map do |license|
-        { name: license.name, id: license.id }
-      end
-    end
+    @licenses_for_select ||= template_dropdown_names(TemplateFinder.build(:licenses).execute)
   end
 
   def ref_project
     @ref_project ||= @target_project || @project
   end
 
+  def template_dropdown_names(items)
+    grouped = items.group_by(&:category)
+    categories = grouped.keys
+
+    categories.each_with_object({}) do |category, hash|
+      hash[category] = grouped[category].map do |item|
+        { name: item.name, id: item.id }
+      end
+    end
+  end
+  private :template_dropdown_names
+
   def gitignore_names
-    @gitignore_names ||= Gitlab::Template::GitignoreTemplate.dropdown_names
+    @gitignore_names ||= template_dropdown_names(TemplateFinder.build(:gitignores).execute)
   end
 
   def gitlab_ci_ymls
-    @gitlab_ci_ymls ||= Gitlab::Template::GitlabCiYmlTemplate.dropdown_names(params[:context])
+    @gitlab_ci_ymls ||= template_dropdown_names(TemplateFinder.build(:gitlab_ci_ymls).execute)
   end
 
   def dockerfile_names
-    @dockerfile_names ||= Gitlab::Template::DockerfileTemplate.dropdown_names
+    @dockerfile_names ||= template_dropdown_names(TemplateFinder.build(:dockerfiles).execute)
   end
 
   def blob_editor_paths

app/helpers/button_helper.rb

@@ -61,7 +61,7 @@ module ButtonHelper
     dropdown_description = http_dropdown_description(protocol)
     append_url = project.http_url_to_repo if append_link
 
-    dropdown_item_with_description(protocol, dropdown_description, href: append_url)
+    dropdown_item_with_description(protocol, dropdown_description, href: append_url, data: { clone_type: 'http' })
   end
 
   def http_dropdown_description(protocol)
@@ -80,16 +80,17 @@ module ButtonHelper
 
     append_url = project.ssh_url_to_repo if append_link
 
-    dropdown_item_with_description('SSH', dropdown_description, href: append_url)
+    dropdown_item_with_description('SSH', dropdown_description, href: append_url, data: { clone_type: 'ssh' })
   end
 
-  def dropdown_item_with_description(title, description, href: nil)
+  def dropdown_item_with_description(title, description, href: nil, data: nil)
     button_content = content_tag(:strong, title, class: 'dropdown-menu-inner-title')
     button_content << content_tag(:span, description, class: 'dropdown-menu-inner-content') if description
 
     content_tag (href ? :a : :span),
       (href ? button_content : title),
       class: "#{title.downcase}-selector",
-      href: (href if href)
+      href: (href if href),
+      data: (data if data)
   end
 end

app/helpers/clusters_helper.rb

@@ -11,4 +11,8 @@ module ClustersHelper
       render 'projects/clusters/gcp_signup_offer_banner'
     end
   end
+
+  def rbac_clusters_feature_enabled?
+    Feature.enabled?(:rbac_clusters)
+  end
 end

app/helpers/cookies_helper.rb

+# frozen_string_literal: true
+
+module CookiesHelper
+  def set_secure_cookie(key, value, httponly: false, permanent: false)
+    cookie_jar = permanent ? cookies.permanent : cookies
+
+    cookie_jar[key] = { value: value, secure: Gitlab.config.gitlab.https, httponly: httponly }
+  end
+end

app/helpers/events_helper.rb

@@ -110,10 +110,12 @@ module EventsHelper
                                    event.note_target)
     elsif event.note?
       if event.note_target
-        event_note_target_path(event)
+        event_note_target_url(event)
       end
     elsif event.push?
       push_event_feed_url(event)
+    elsif event.created_project?
+      project_url(event.project)
     end
   end
 
@@ -145,14 +147,14 @@ module EventsHelper
     end
   end
 
-  def event_note_target_path(event)
+  def event_note_target_url(event)
     if event.commit_note?
-      project_commit_path(event.project, event.note_target, anchor: dom_id(event.target))
+      project_commit_url(event.project, event.note_target, anchor: dom_id(event.target))
     elsif event.project_snippet_note?
-      project_snippet_path(event.project, event.note_target, anchor: dom_id(event.target))
+      project_snippet_url(event.project, event.note_target, anchor: dom_id(event.target))
     else
-      polymorphic_path([event.project.namespace.becomes(Namespace),
-                        event.project, event.note_target],
+      polymorphic_url([event.project.namespace.becomes(Namespace),
+                       event.project, event.note_target],
                         anchor: dom_id(event.target))
     end
   end
@@ -166,7 +168,7 @@ module EventsHelper
           event.note_target_reference
         end
 
-      link_to(text, event_note_target_path(event), title: event.target_title, class: 'has-tooltip')
+      link_to(text, event_note_target_url(event), title: event.target_title, class: 'has-tooltip')
     else
       content_tag(:strong, '(deleted)')
     end

app/helpers/icons_helper.rb

@@ -86,7 +86,7 @@ module IconsHelper
     end
   end
 
-  def visibility_level_icon(level, fw: true)
+  def visibility_level_icon(level, fw: true, options: {})
     name =
       case level
       when Gitlab::VisibilityLevel::PRIVATE
@@ -99,7 +99,7 @@ module IconsHelper
 
     name << " fw" if fw
 
-    icon(name)
+    icon(name, options)
   end
 
   def file_type_icon_class(type, mode, name)

app/helpers/markup_helper.rb

@@ -107,23 +107,23 @@ module MarkupHelper
 
   def markup(file_name, text, context = {})
     context[:project] ||= @project
-    context[:markdown_engine] ||= :redcarpet
+    context[:markdown_engine] ||= :redcarpet unless commonmark_for_repositories_enabled?
     html = context.delete(:rendered) || markup_unsafe(file_name, text, context)
     prepare_for_rendering(html, context)
   end
 
-  def render_wiki_content(wiki_page)
+  def render_wiki_content(wiki_page, context = {})
     text = wiki_page.content
     return '' unless text.present?
 
-    context = {
+    context.merge!(
       pipeline: :wiki,
       project: @project,
       project_wiki: @project_wiki,
       page_slug: wiki_page.slug,
-      issuable_state_filter_enabled: true,
-      markdown_engine: :redcarpet
-    }
+      issuable_state_filter_enabled: true
+    )
+    context[:markdown_engine] ||= :redcarpet unless commonmark_for_repositories_enabled?
 
     html =
       case wiki_page.format
@@ -178,6 +178,10 @@ module MarkupHelper
     end
   end
 
+  def commonmark_for_repositories_enabled?
+    Feature.enabled?(:commonmark_for_repositories, default_enabled: true)
+  end
+
   private
 
   # Return +text+, truncated to +max_chars+ characters, excluding any HTML

app/helpers/projects_helper.rb

@@ -252,6 +252,10 @@ module ProjectsHelper
     "xcode://clone?repo=#{CGI.escape(default_url_to_repo(project))}"
   end
 
+  def legacy_render_context(params)
+    params[:legacy_render] ? { markdown_engine: :redcarpet } : {}
+  end
+
   private
 
   def get_project_nav_tabs(project, current_user)
@@ -351,6 +355,10 @@ module ProjectsHelper
     end
   end
 
+  def default_clone_label
+    _("Copy %{protocol} clone URL") % { protocol: default_clone_protocol.upcase }
+  end
+
   def default_clone_protocol
     if allowed_protocols_present?
       enabled_protocol

app/helpers/user_callouts_helper.rb

 module UserCalloutsHelper
   GKE_CLUSTER_INTEGRATION = 'gke_cluster_integration'.freeze
   GCP_SIGNUP_OFFER = 'gcp_signup_offer'.freeze
+  CLUSTER_SECURITY_WARNING = 'cluster_security_warning'.freeze
 
   def show_gke_cluster_integration_callout?(project)
     can?(current_user, :create_cluster, project) &&
@@ -11,6 +12,10 @@ module UserCalloutsHelper
     !user_dismissed?(GCP_SIGNUP_OFFER)
   end
 
+  def show_cluster_security_warning?
+    !user_dismissed?(CLUSTER_SECURITY_WARNING)
+  end
+
   private
 
   def user_dismissed?(feature_name)

app/helpers/visibility_level_helper.rb

@@ -138,7 +138,7 @@ module VisibilityLevelHelper
   end
 
   def project_visibility_icon_description(level)
-    "#{visibility_level_label(level)} - #{project_visibility_level_description(level)}"
+    "#{project_visibility_level_description(level)}"
   end
 
   def visibility_level_label(level)

app/helpers/wiki_helper.rb

 module WikiHelper
+  include API::Helpers::RelatedResourcesHelpers
+
   # Produces a pure text breadcrumb for a given page.
   #
   # page_slug - The slug of a WikiPage object.
@@ -39,4 +41,8 @@ module WikiHelper
       end
     end
   end
+
+  def wiki_attachment_upload_url
+    expose_url(api_v4_projects_wikis_attachments_path(id: @project.id))
+  end
 end

app/mailers/emails/auto_devops.rb

+# frozen_string_literal: true
+
+module Emails
+  module AutoDevops
+    def autodevops_disabled_email(pipeline, recipient)
+      @pipeline = pipeline
+      @project = pipeline.project
+
+      add_project_headers
+
+      mail(to: recipient,
+           subject: auto_devops_disabled_subject(@project.name)) do |format|
+        format.html { render layout: 'mailer' }
+        format.text { render layout: 'mailer' }
+      end
+    end
+
+    private
+
+    def auto_devops_disabled_subject(project_name)
+      subject("Auto DevOps pipeline was disabled for #{project_name}")
+    end
+  end
+end

app/mailers/notify.rb

@@ -12,6 +12,7 @@ class Notify < BaseMailer
   include Emails::Profile
   include Emails::Pipelines
   include Emails::Members
+  include Emails::AutoDevops
 
   helper MergeRequestsHelper
   helper DiffHelper

app/mailers/previews/notify_preview.rb

@@ -125,6 +125,10 @@ class NotifyPreview < ActionMailer::Preview
     Notify.pipeline_failed_email(pipeline, pipeline.user.try(:email))
   end
 
+  def autodevops_disabled_email
+    Notify.autodevops_disabled_email(pipeline, user.email).message
+  end
+
   private
 
   def project

app/models/ci/job_artifact.rb

@@ -48,6 +48,20 @@ module Ci
       gzip: 3
     }
 
+    # `file_location` indicates where actual files are stored.
+    # Ideally, actual files should be stored in the same directory, and use the same
+    # convention to generate its path. However, sometimes we can't do so due to backward-compatibility.
+    #
+    # legacy_path ... The actual file is stored at a path consists of a timestamp
+    #                 and raw project/model IDs. Those rows were migrated from
+    #                 `ci_builds.artifacts_file` and `ci_builds.artifacts_metadata`
+    # hashed_path ... The actual file is stored at a path consists of a SHA2 based on the project ID.
+    #                 This is the default value.
+    enum file_location: {
+      legacy_path: 1,
+      hashed_path: 2
+    }
+
     FILE_FORMAT_ADAPTERS = {
       gzip: Gitlab::Ci::Build::Artifacts::GzipFileAdapter
     }.freeze
@@ -72,6 +86,12 @@ module Ci
       [nil, ::JobArtifactUploader::Store::LOCAL].include?(self.file_store)
     end
 
+    def hashed_path?
+      return true if trace? # ArchiveLegacyTraces background migration might not have `file_location` column
+
+      super || self.file_location.nil?
+    end
+
     def expire_in
       expire_at - Time.now if expire_at
     end
@@ -108,7 +128,7 @@ module Ci
     end
 
     def update_project_statistics_after_destroy
-      update_project_statistics(-self.size)
+      update_project_statistics(-self.size.to_i)
     end
 
     def update_project_statistics(difference)

app/models/ci/pipeline.rb

@@ -161,6 +161,12 @@ module Ci
           PipelineNotificationWorker.perform_async(pipeline.id)
         end
       end
+
+      after_transition any => [:failed] do |pipeline|
+        next unless pipeline.auto_devops_source?
+
+        pipeline.run_after_commit { AutoDevops::DisableWorker.perform_async(pipeline.id) }
+      end
     end
 
     scope :internal, -> { where(source: internal_sources) }

app/models/clusters/applications/helm.rb

@@ -32,7 +32,8 @@ module Clusters
       def install_command
         Gitlab::Kubernetes::Helm::InitCommand.new(
           name: name,
-          files: files
+          files: files,
+          rbac: cluster.platform_kubernetes_rbac?
         )
       end
 

app/models/clusters/applications/ingress.rb

@@ -39,6 +39,7 @@ module Clusters
         Gitlab::Kubernetes::Helm::InstallCommand.new(
           name: name,
           version: VERSION,
+          rbac: cluster.platform_kubernetes_rbac?,
           chart: chart,
           files: files
         )

app/models/clusters/applications/jupyter.rb

@@ -40,6 +40,7 @@ module Clusters
         Gitlab::Kubernetes::Helm::InstallCommand.new(
           name: name,
           version: VERSION,
+          rbac: cluster.platform_kubernetes_rbac?,
           chart: chart,
           files: files,
           repository: repository

app/models/clusters/applications/prometheus.rb

@@ -48,6 +48,7 @@ module Clusters
         Gitlab::Kubernetes::Helm::InstallCommand.new(
           name: name,
           version: VERSION,
+          rbac: cluster.platform_kubernetes_rbac?,
           chart: chart,
           files: files
         )
@@ -71,7 +72,7 @@ module Clusters
       private
 
       def kube_client
-        cluster&.kubeclient
+        cluster&.kubeclient&.core_client
       end
     end
   end

app/models/clusters/applications/runner.rb

@@ -33,6 +33,7 @@ module Clusters
         Gitlab::Kubernetes::Helm::InstallCommand.new(
           name: name,
           version: VERSION,
+          rbac: cluster.platform_kubernetes_rbac?,
           chart: chart,
           files: files,
           repository: repository

app/models/clusters/cluster.rb

@@ -42,6 +42,7 @@ module Clusters
     delegate :on_creation?, to: :provider, allow_nil: true
 
     delegate :active?, to: :platform_kubernetes, prefix: true, allow_nil: true
+    delegate :rbac?, to: :platform_kubernetes, prefix: true, allow_nil: true
     delegate :installed?, to: :application_helm, prefix: true, allow_nil: true
     delegate :installed?, to: :application_ingress, prefix: true, allow_nil: true
 

app/models/clusters/platforms/kubernetes.rb

@@ -5,6 +5,7 @@ module Clusters
     class Kubernetes < ActiveRecord::Base
       include Gitlab::Kubernetes
       include ReactiveCaching
+      include EnumWithNil
 
       self.table_name = 'cluster_platforms_kubernetes'
       self.reactive_cache_key = ->(kubernetes) { [kubernetes.class.model_name.singular, kubernetes.id] }
@@ -47,6 +48,12 @@ module Clusters
 
       alias_method :active?, :enabled?
 
+      enum_with_nil authorization_type: {
+        unknown_authorization: nil,
+        rbac: 1,
+        abac: 2
+      }
+
       def actual_namespace
         if namespace.present?
           namespace
@@ -95,7 +102,7 @@ module Clusters
       end
 
       def kubeclient
-        @kubeclient ||= build_kubeclient!
+        @kubeclient ||= build_kube_client!(api_groups: ['api', 'apis/rbac.authorization.k8s.io'])
       end
 
       private
@@ -115,15 +122,16 @@ module Clusters
         slug.gsub(/[^-a-z0-9]/, '-').gsub(/^-+/, '')
       end
 
-      def build_kubeclient!(api_path: 'api', api_version: 'v1')
+      def build_kube_client!(api_groups: ['api'], api_version: 'v1')
         raise "Incomplete settings" unless api_url && actual_namespace
 
         unless (username && password) || token
           raise "Either username/password or token is required to access API"
         end
 
-        ::Kubeclient::Client.new(
-          join_api_url(api_path),
+        Gitlab::Kubernetes::KubeClient.new(
+          api_url,
+          api_groups,
           api_version,
           auth_options: kubeclient_auth_options,
           ssl_options: kubeclient_ssl_options,
@@ -133,7 +141,7 @@ module Clusters
 
       # Returns a hash of all pods in the namespace
       def read_pods
-        kubeclient = build_kubeclient!
+        kubeclient = build_kube_client!
 
         kubeclient.get_pods(namespace: actual_namespace).as_json
       rescue Kubeclient::HttpError => err
@@ -157,15 +165,6 @@ module Clusters
         { bearer_token: token }
       end
 
-      def join_api_url(api_path)
-        url = URI.parse(api_url)
-        prefix = url.path.sub(%r{/+\z}, '')
-
-        url.path = [prefix, api_path].join("/")
-
-        url.to_s
-      end
-
       def terminal_auth
         {
           token: token,

app/models/commit.rb

@@ -22,6 +22,7 @@ class Commit
   attr_accessor :project, :author
   attr_accessor :redacted_description_html
   attr_accessor :redacted_title_html
+  attr_accessor :redacted_full_title_html
   attr_reader :gpg_commit
 
   DIFF_SAFE_LINES = Gitlab::Git::DiffCollection::DEFAULT_LIMITS[:max_lines]

app/models/concerns/avatarable.rb

@@ -9,7 +9,7 @@ module Avatarable
     include Gitlab::Utils::StrongMemoize
 
     validate :avatar_type, if: ->(user) { user.avatar.present? && user.avatar_changed? }
-    validates :avatar, file_size: { maximum: 200.kilobytes.to_i }
+    validates :avatar, file_size: { maximum: 200.kilobytes.to_i }, if: :avatar_changed?
 
     mount_uploader :avatar, AvatarUploader
 

app/models/concerns/case_sensitivity.rb

@@ -9,23 +9,46 @@ module CaseSensitivity
     #
     # Unlike other ActiveRecord methods this method only operates on a Hash.
     def iwhere(params)
-      criteria   = self
-      cast_lower = Gitlab::Database.postgresql?
+      criteria = self
 
       params.each do |key, value|
-        column = ActiveRecord::Base.connection.quote_table_name(key)
+        criteria = case value
+                   when Array
+                     criteria.where(value_in(key, value))
+                   else
+                     criteria.where(value_equal(key, value))
+                   end
+      end
+
+      criteria
+    end
 
-        condition =
-          if cast_lower
-            "LOWER(#{column}) = LOWER(:value)"
-          else
-            "#{column} = :value"
-          end
+    private
+
+    def value_equal(column, value)
+      lower_value = lower_value(value)
+
+      lower_column(arel_table[column]).eq(lower_value).to_sql
+    end
 
-        criteria = criteria.where(condition, value: value)
+    def value_in(column, values)
+      lower_values = values.map do |value|
+        lower_value(value)
       end
 
-      criteria
+      lower_column(arel_table[column]).in(lower_values).to_sql
+    end
+
+    def lower_value(value)
+      return value if Gitlab::Database.mysql?
+
+      Arel::Nodes::NamedFunction.new('LOWER', [Arel::Nodes.build_quoted(value)])
+    end
+
+    def lower_column(column)
+      return column if Gitlab::Database.mysql?
+
+      column.lower
     end
   end
 end

app/models/concerns/issuable.rb

@@ -49,7 +49,7 @@ module Issuable
       end
     end
 
-    has_many :label_links, as: :target, dependent: :destroy # rubocop:disable Cop/ActiveRecordDependent
+    has_many :label_links, as: :target, dependent: :destroy, inverse_of: :target # rubocop:disable Cop/ActiveRecordDependent
     has_many :labels, through: :label_links
     has_many :todos, as: :target, dependent: :destroy # rubocop:disable Cop/ActiveRecordDependent
 

app/models/concerns/protected_ref.rb

@@ -50,14 +50,20 @@ module ProtectedRef
         .map(&:"#{action}_access_levels").flatten
     end
 
+    # Returns all protected refs that match the given ref name.
+    # This checks all records from the scope built up so far, and does
+    # _not_ return a relation.
+    #
+    # This method optionally takes in a list of `protected_refs` to search
+    # through, to avoid calling out to the database.
     def matching(ref_name, protected_refs: nil)
-      ProtectedRefMatcher.matching(self, ref_name, protected_refs: protected_refs)
+      (protected_refs || self.all).select { |protected_ref| protected_ref.matches?(ref_name) }
     end
   end
 
   private
 
   def ref_matcher
-    @ref_matcher ||= ProtectedRefMatcher.new(self)
+    @ref_matcher ||= RefMatcher.new(self.name)
   end
 end

app/models/concerns/triggerable_hooks.rb

@@ -29,6 +29,12 @@ module TriggerableHooks
       public_send(trigger) # rubocop:disable GitlabSecurity/PublicSend
     end
 
+    def select_active(hooks_scope, data)
+      select do |hook|
+        ActiveHookFilter.new(hook).matches?(hooks_scope, data)
+      end
+    end
+
     private
 
     def triggerable_hooks(hooks)

app/models/hooks/active_hook_filter.rb

+class ActiveHookFilter
+  def initialize(hook)
+    @hook = hook
+    @push_events_filter_matcher = RefMatcher.new(@hook.push_events_branch_filter)
+  end
+
+  def matches?(hooks_scope, data)
+    return true if hooks_scope != :push_hooks
+    return true if @hook.push_events_branch_filter.blank?
+
+    branch_name = Gitlab::Git.branch_name(data[:ref])
+    @push_events_filter_matcher.matches?(branch_name)
+  end
+end