Merge branch 'ajk-ci-no-empty-groups' into 'master'

Ensure groups are never empty [RUN ALL RSPEC] [RUN AS-IF-FOSS]

See merge request gitlab-org/gitlab!58789

app/graphql/types/ci/stage_type.rb

@@ -36,6 +36,34 @@ module Types
             jobs_for_pipeline(pl, indexed.keys, include_needs).each do |stage_id, statuses|
               key = indexed[stage_id]
               groups = ::Ci::Group.fabricate(project, key.stage, statuses)
+
+              if Feature.enabled?(:ci_no_empty_groups, project)
+                groups.each do |group|
+                  rejected = group.jobs.reject { |job| Ability.allowed?(current_user, :read_commit_status, job) }
+                  group.jobs.select! { |job| Ability.allowed?(current_user, :read_commit_status, job) }
+                  next unless group.jobs.empty?
+
+                  exc = StandardError.new('Empty Ci::Group')
+                  traces = rejected.map do |job|
+                    trace = []
+                    policy = Ability.policy_for(current_user, job)
+                    policy.debug(:read_commit_status, trace)
+                    trace
+                  end
+                  extra = {
+                    current_user_id: current_user&.id,
+                    project_id: project.id,
+                    pipeline_id: pl.id,
+                    stage_id: stage_id,
+                    group_name: group.name,
+                    rejected_job_ids: rejected.map(&:id),
+                    rejected_traces: traces
+                  }
+                  Gitlab::ErrorTracking.track_exception(exc, extra)
+                end
+                groups.reject! { |group| group.jobs.empty? }
+              end
+
               loader.call(key, groups)
             end
           end

config/feature_flags/development/ci_no_empty_groups.yml

+---
+name: ci_no_empty_groups
+introduced_by_url: https://gitlab.com/gitlab-org/gitlab/-/merge_requests/58789
+rollout_issue_url: https://gitlab.com/gitlab-org/gitlab/-/issues/327139
+milestone: '13.11'
+type: development
+group: group::verify
+default_enabled: false