Automatic merge of gitlab-org/gitlab master

Gemfile

@@ -274,7 +274,7 @@ gem 'licensee', '~> 9.14.1'
 gem 'charlock_holmes', '~> 0.7.7'
 
 # Detect mime content type from content
-gem 'ruby-magic-static', '~> 0.3.4'
+gem 'ruby-magic-static', '~> 0.3.5'
 
 # Fake version of the gem to trick bundler
 gem 'mimemagic', '0.3.7', path: 'vendor/shims/mimemagic', require: false

Gemfile.lock

@@ -1113,7 +1113,8 @@ GEM
       i18n
     ruby-fogbugz (0.2.1)
       crack (~> 0.4)
-    ruby-magic-static (0.3.4)
+    ruby-magic-static (0.3.5)
+      mini_portile2 (~> 2.5.0)
     ruby-prof (1.3.1)
     ruby-progressbar (1.11.0)
     ruby-saml (1.7.2)
@@ -1559,7 +1560,7 @@ DEPENDENCIES
   rspec_junit_formatter
   rspec_profiling (~> 0.0.6)
   ruby-fogbugz (~> 0.2.1)
-  ruby-magic-static (~> 0.3.4)
+  ruby-magic-static (~> 0.3.5)
   ruby-prof (~> 1.3.0)
   ruby-progressbar (~> 1.10)
   ruby_parser (~> 3.15)

app/views/shared/form_elements/_description.html.haml

 - project = local_assigns.fetch(:project)
 - model = local_assigns.fetch(:model)
 - form = local_assigns.fetch(:form)
-- placeholder = model.is_a?(MergeRequest) ? _('Describe the goal of the changes and what reviewers should be aware of.') : _('Write a comment or drag your files here…')
+- placeholder = model.is_a?(MergeRequest) ? _('Describe the goal of the changes and what reviewers should be aware of.') : _('Write a description or drag your files here…')
 
 - supports_quick_actions = true
 - preview_url = preview_markdown_path(project, target_type: model.class.name)

changelogs/unreleased/322449-write-description.yml

+---
+title: Update New Issue form description copy from 'wite a comment' to 'wite a description'
+merge_request: 58068
+author:
+type: changed

changelogs/unreleased/sh-update-ruby-magic-static-0-3-5.yml

+---
+title: Update ruby-magic-static to v0.3.5
+merge_request: 57984
+author:
+type: changed

doc/user/project/integrations/jira_integrations.md

@@ -6,30 +6,18 @@ info: To determine the technical writer assigned to the Stage/Group associated w
 
 # Jira integrations **(FREE)**
 
-GitLab can be integrated with [Jira](https://www.atlassian.com/software/jira).
+If your organization uses [Jira](https://www.atlassian.com/software/jira) issues,
+you can [migrate](../../../user/project/import/jira.md) your issues from Jira and work
+exclusively in GitLab.
 
-[Issues](../issues/index.md) are a tool for discussing ideas, and planning and tracking work.
-However, your organization may already use Jira for these purposes, with extensive, established data
-and business processes they rely on.
+However, if you'd like to continue to use Jira, you can integrate it with GitLab.
 
-Although you can [migrate](../../../user/project/import/jira.md) your Jira issues and work
-exclusively in GitLab, you can also continue to use Jira by using the GitLab Jira integrations.
+There are two ways to use GitLab with Jira:
 
-## Integration types
-
-There are two different Jira integrations that allow different types of cross-referencing between
-GitLab activity and Jira issues, with additional features:
-
-- [Jira integration](jira.md), built in to GitLab. In a given GitLab project, it can be configured
-  to connect to any Jira instance, either hosted by you or hosted in
-  [Atlassian cloud](https://www.atlassian.com/cloud).
-- [Jira development panel integration](../../../integration/jira/index.md). Connects all
-  GitLab projects under a specified group or personal namespace.
-
-Jira development panel integration configuration depends on whether:
-
-- You're using GitLab.com or a self-managed GitLab instance.
-- You're using Jira on [Atlassian cloud](https://www.atlassian.com/cloud) or on your own server.
+- [Jira integration](jira.md). Connect a GitLab project
+  to a Jira instance. The Jira instance can be hosted by you or in [Atlassian cloud](https://www.atlassian.com/cloud).
+- [Jira Development panel integration](../../../integration/jira_development_panel.md).
+  Connect all GitLab projects under a group or personal namespace.
 
 The integration you choose depends on the capabilities you require.
 You can also install both at the same time.

ee/app/models/security/orchestration_policy_configuration.rb

@@ -6,7 +6,8 @@ module Security
 
     self.table_name = 'security_orchestration_policy_configurations'
 
-    POLICIES_BASE_PATH = '.gitlab/security-policies/'
+    POLICY_PATH = '.gitlab/security-policies/policy.yml'
+    POLICY_LIMIT = 5
 
     ON_DEMAND_SCANS = %w[dast].freeze
 
@@ -23,12 +24,7 @@ module Security
     def active_policies
       return [] unless enabled?
 
-      security_policy_management_project
-        .repository
-        .ls_files(security_policy_management_project.default_branch_or_master)
-        .grep(/\A#{Regexp.escape(POLICIES_BASE_PATH)}.+\.(yml|yaml)\z/)
-        .map { |path| policy_at(path) }
-        .select { |config| config[:enabled] }
+      scan_execution_policy_at(POLICY_PATH).select { |config| config[:enabled] }.first(POLICY_LIMIT)
     end
 
     def on_demand_scan_actions(branch)
@@ -48,6 +44,14 @@ module Security
 
     private
 
+    def policy_repo
+      security_policy_management_project.repository
+    end
+
+    def default_branch_or_master
+      security_policy_management_project.default_branch_or_master
+    end
+
     def active_policy_names_with_dast_profiles
       strong_memoize(:active_policy_names_with_dast_profiles) do
         profiles = { site_profiles: Hash.new { Set.new }, scanner_profiles: Hash.new { Set.new } }
@@ -65,11 +69,9 @@ module Security
       end
     end
 
-    def policy_at(path)
-      security_policy_management_project
-        .repository
-        .blob_data_at(security_policy_management_project.default_branch_or_master, path)
-        .then { |config| Gitlab::Config::Loader::Yaml.new(config).load! }
+    def scan_execution_policy_at(path)
+      policy_repo.blob_data_at(default_branch_or_master, path)
+        .then { |config| Gitlab::Config::Loader::Yaml.new(config).load!.fetch(:scan_execution_policy, []) }
     end
 
     def applicable_for_branch?(policy, ref)

ee/spec/fixtures/security_orchestration.yml

+scan_execution_policy:
+  - name: Run DAST in every pipeline
+    description: This policy enforces to run DAST for every pipeline within the project
+    enabled: true
+    rules:
+    - type: pipeline
+      branches:
+      - "production"
+    actions:
+    - scan: dast
+      site_profile: Site Profile
+      scanner_profile: Scanner Profile
+  - name: Run DAST in every pipeline_v1
+    description: This policy enforces to run DAST for every pipeline within the project
+    enabled: true
+    rules:
+    - type: pipeline
+      branches:
+      - "master"
+    actions:
+    - scan: dast
+      site_profile: Site Profile
+      scanner_profile: Scanner Profile
+  - name: Disabled policy
+    description: This policy is disabled
+    enabled: false
+    rules: []
+    actions: []
+  - name: Disabled policy_v2
+    description: This policy is disabled v2
+    enabled: false
+    rules: []
+    actions: []
+  - name: Run DAST in every pipeline_v3
+    description: This policy enforces to run DAST for every pipeline within the project
+    enabled: true
+    rules:
+    - type: pipeline
+      branches:
+      - "master"
+    actions:
+    - scan: dast
+      site_profile: Site Profile
+      scanner_profile: Scanner Profile
+  - name: Run DAST in every pipeline_v4
+    description: This policy enforces to run DAST for every pipeline within the project
+    enabled: true
+    rules:
+    - type: pipeline
+      branches:
+      - "master"
+    actions:
+    - scan: dast
+      site_profile: Site Profile
+      scanner_profile: Scanner Profile
+  - name: Run DAST in every pipeline_v5
+    description: This policy enforces to run DAST for every pipeline within the project
+    enabled: true
+    rules:
+    - type: pipeline
+      branches:
+      - "master"
+    actions:
+    - scan: dast
+      site_profile: Site Profile
+      scanner_profile: Scanner Profile
+  - name: Run DAST in every pipeline_v6
+    description: This policy enforces to run DAST for every pipeline within the project
+    enabled: true
+    rules:
+    - type: pipeline
+      branches:
+      - "master"
+    actions:
+    - scan: dast
+      site_profile: Site Profile
+      scanner_profile: Scanner Profile
\ No newline at end of file

ee/spec/models/security/orchestration_policy_configuration_spec.rb

@@ -4,7 +4,9 @@ require 'spec_helper'
 
 RSpec.describe Security::OrchestrationPolicyConfiguration do
   let_it_be(:security_policy_management_project) { create(:project, :repository) }
-  let_it_be(:security_orchestration_policy_configuration) { create(:security_orchestration_policy_configuration, security_policy_management_project: security_policy_management_project) }
+  let_it_be(:security_orchestration_policy_configuration) do
+    create( :security_orchestration_policy_configuration, security_policy_management_project: security_policy_management_project)
+  end
 
   let(:default_branch) { security_policy_management_project.default_branch_or_master }
   let(:repository) { instance_double(Repository, root_ref: 'master') }
@@ -57,26 +59,54 @@ RSpec.describe Security::OrchestrationPolicyConfiguration do
       EOS
     end
 
-    let(:disabled_policy_yaml) do
-      <<-EOS
-      type: scan_execution_policy
-      name: Disabled policy
-      description: This policy is disabled
-      enabled: false
-      rules: []
-      actions: []
-      EOS
-    end
+    let(:policy_yaml) { fixture_file('security_orchestration.yml', dir: 'ee') }
 
     let(:expected_active_policies) do
       [
         {
-          type: 'scan_execution_policy',
           name: 'Run DAST in every pipeline',
           description: 'This policy enforces to run DAST for every pipeline within the project',
           enabled: true,
-          rules: [{ type: 'pipeline', branches: ['production'] }],
-          actions: [{ scan: 'dast', site_profile: 'Site Profile', scanner_profile: 'Scanner Profile' }]
+          rules: [{ type: 'pipeline', branches: %w[production] }],
+          actions: [
+            { scan: 'dast', site_profile: 'Site Profile', scanner_profile: 'Scanner Profile' }
+          ]
+        },
+        {
+          name: 'Run DAST in every pipeline_v1',
+          description: 'This policy enforces to run DAST for every pipeline within the project',
+          enabled: true,
+          rules: [{ type: 'pipeline', branches: %w[master] }],
+          actions: [
+            { scan: 'dast', site_profile: 'Site Profile', scanner_profile: 'Scanner Profile' }
+          ]
+        },
+        {
+          name: 'Run DAST in every pipeline_v3',
+          description: 'This policy enforces to run DAST for every pipeline within the project',
+          enabled: true,
+          rules: [{ type: 'pipeline', branches: %w[master] }],
+          actions: [
+            { scan: 'dast', site_profile: 'Site Profile', scanner_profile: 'Scanner Profile' }
+          ]
+        },
+        {
+          name: 'Run DAST in every pipeline_v4',
+          description: 'This policy enforces to run DAST for every pipeline within the project',
+          enabled: true,
+          rules: [{ type: 'pipeline', branches: %w[master] }],
+          actions: [
+            { scan: 'dast', site_profile: 'Site Profile', scanner_profile: 'Scanner Profile' }
+          ]
+        },
+        {
+          name: 'Run DAST in every pipeline_v5',
+          description: 'This policy enforces to run DAST for every pipeline within the project',
+          enabled: true,
+          rules: [{ type: 'pipeline', branches: %w[master] }],
+          actions: [
+            { scan: 'dast', site_profile: 'Site Profile', scanner_profile: 'Scanner Profile' }
+          ]
         }
       ]
     end
@@ -85,17 +115,7 @@ RSpec.describe Security::OrchestrationPolicyConfiguration do
 
     before do
       allow(security_policy_management_project).to receive(:repository).and_return(repository)
-      allow(repository).to receive(:ls_files).and_return(['README.md', '.gitlab/security-policies/enforce-dast.yml', '.gitlab/security-policies/disabled-policy.yml', '.gitlab-ci.yml'])
-      allow(repository).to receive(:blob_data_at).with(default_branch, '.gitlab/security-policies/enforce-dast.yml').and_return(enforce_dast_yaml)
-      allow(repository).to receive(:blob_data_at).with(default_branch, '.gitlab/security-policies/disabled-policy.yml').and_return(disabled_policy_yaml)
-    end
-
-    it 'reads yml file from repository' do
-      expect(repository).to receive(:ls_files).with(default_branch)
-      expect(repository).to receive(:blob_data_at).with(default_branch, '.gitlab/security-policies/enforce-dast.yml')
-      expect(repository).to receive(:blob_data_at).with(default_branch, '.gitlab/security-policies/disabled-policy.yml')
-
-      active_policies
+      allow(repository).to receive(:blob_data_at).with( default_branch, Security::OrchestrationPolicyConfiguration::POLICY_PATH).and_return(policy_yaml)
     end
 
     it 'returns only enabled policies' do
@@ -114,10 +134,10 @@ RSpec.describe Security::OrchestrationPolicyConfiguration do
   end
 
   describe '#on_demand_scan_actions' do
-    let(:policy_1_yaml) do
+    let(:policy_yaml) do
       <<-EOS
-      type: scan_execution_policy
-      name: Run DAST in every pipeline
+      scan_execution_policy:
+        - name: Run DAST in every pipeline
           enabled: true
           rules:
           - type: pipeline
@@ -127,13 +147,7 @@ RSpec.describe Security::OrchestrationPolicyConfiguration do
           - scan: dast
             site_profile: Site Profile
             scanner_profile: Scanner Profile
-      EOS
-    end
-
-    let(:policy_2_yaml) do
-      <<-EOS
-      type: scan_execution_policy
-      name: Run DAST in every pipeline
+        - name: Run DAST in every pipeline
           enabled: true
           rules:
           - type: pipeline
@@ -143,13 +157,7 @@ RSpec.describe Security::OrchestrationPolicyConfiguration do
           - scan: dast
             site_profile: Site Profile 2
             scanner_profile: Scanner Profile 2
-      EOS
-    end
-
-    let(:policy_3_yaml) do
-      <<-EOS
-      type: scan_execution_policy
-      name: Run DAST in every pipeline
+        - name: Run DAST in every pipeline
           enabled: true
           rules:
           - type: pipeline
@@ -159,13 +167,7 @@ RSpec.describe Security::OrchestrationPolicyConfiguration do
           - scan: dast
             site_profile: Site Profile 3
             scanner_profile: Scanner Profile 3
-      EOS
-    end
-
-    let(:policy_4_yaml) do
-      <<-EOS
-      type: scan_execution_policy
-      name: Run SAST in every pipeline
+        - name: Run SAST in every pipeline
           enabled: true
           rules:
           - type: pipeline
@@ -183,15 +185,13 @@ RSpec.describe Security::OrchestrationPolicyConfiguration do
       ]
     end
 
-    subject(:on_demand_scan_actions) { security_orchestration_policy_configuration.on_demand_scan_actions('release/123') }
+    subject(:on_demand_scan_actions) do
+      security_orchestration_policy_configuration.on_demand_scan_actions('release/123')
+    end
 
     before do
       allow(security_policy_management_project).to receive(:repository).and_return(repository)
-      allow(repository).to receive(:ls_files).and_return(['.gitlab/security-policies/policy-1.yml', '.gitlab/security-policies/policy-2.yml', '.gitlab/security-policies/policy-3.yml', '.gitlab/security-policies/policy-4.yml'])
-      allow(repository).to receive(:blob_data_at).with(default_branch, '.gitlab/security-policies/policy-1.yml').and_return(policy_1_yaml)
-      allow(repository).to receive(:blob_data_at).with(default_branch, '.gitlab/security-policies/policy-2.yml').and_return(policy_2_yaml)
-      allow(repository).to receive(:blob_data_at).with(default_branch, '.gitlab/security-policies/policy-3.yml').and_return(policy_3_yaml)
-      allow(repository).to receive(:blob_data_at).with(default_branch, '.gitlab/security-policies/policy-4.yml').and_return(policy_4_yaml)
+      allow(repository).to receive(:blob_data_at).with(default_branch, Security::OrchestrationPolicyConfiguration::POLICY_PATH).and_return(policy_yaml)
     end
 
     it 'returns only actions for on-demand scans applicable for branch' do
@@ -200,10 +200,10 @@ RSpec.describe Security::OrchestrationPolicyConfiguration do
   end
 
   describe '#active_policy_names_with_dast_site_profile' do
-    let(:enforce_dast_yaml) do
+    let(:policy_yaml) do
       <<-EOS
-      type: scan_execution_policy
-      name: Run DAST in every pipeline
+      scan_execution_policy:
+        - name: Run DAST in every pipeline
           description: This policy enforces to run DAST for every pipeline within the project
           enabled: true
           rules:
@@ -222,20 +222,20 @@ RSpec.describe Security::OrchestrationPolicyConfiguration do
 
     before do
       allow(security_policy_management_project).to receive(:repository).and_return(repository)
-      allow(repository).to receive(:ls_files).and_return(['.gitlab/security-policies/enforce-dast.yml'])
-      allow(repository).to receive(:blob_data_at).with(default_branch, '.gitlab/security-policies/enforce-dast.yml').and_return(enforce_dast_yaml)
+      allow(repository).to receive(:blob_data_at).with(default_branch, Security::OrchestrationPolicyConfiguration::POLICY_PATH).and_return(policy_yaml)
     end
 
     it 'returns list of policy names where site profile is referenced' do
-      expect(security_orchestration_policy_configuration.active_policy_names_with_dast_site_profile('Site Profile')).to contain_exactly('Run DAST in every pipeline')
+      expect( security_orchestration_policy_configuration.active_policy_names_with_dast_site_profile('Site Profile')).to contain_exactly('Run DAST in every pipeline')
     end
   end
 
   describe '#active_policy_names_with_dast_scanner_profile' do
     let(:enforce_dast_yaml) do
       <<-EOS
+      scan_execution_policy:
            type: scan_execution_policy
-      name: Run DAST in every pipeline
+        -  name: Run DAST in every pipeline
            description: This policy enforces to run DAST for every pipeline within the project
            enabled: true
            rules:
@@ -254,8 +254,7 @@ RSpec.describe Security::OrchestrationPolicyConfiguration do
 
     before do
       allow(security_policy_management_project).to receive(:repository).and_return(repository)
-      allow(repository).to receive(:ls_files).and_return(['.gitlab/security-policies/enforce-dast.yml'])
-      allow(repository).to receive(:blob_data_at).with(default_branch, '.gitlab/security-policies/enforce-dast.yml').and_return(enforce_dast_yaml)
+      allow(repository).to receive(:blob_data_at).with(default_branch, Security::OrchestrationPolicyConfiguration::POLICY_PATH).and_return(enforce_dast_yaml)
     end
 
     it 'returns list of policy names where site profile is referenced' do

lib/gitlab/ci/pipeline/chain/validate/external.rb

@@ -69,8 +69,12 @@ module Gitlab
             end
 
             def validate_service_request
+              headers = {}
+              headers['X-Gitlab-Token'] = validation_service_token if validation_service_token
+
               Gitlab::HTTP.post(
                 validation_service_url, timeout: validation_service_timeout,
+                headers: headers,
                 body: validation_service_payload.to_json
               )
             end
@@ -86,6 +90,10 @@ module Gitlab
               ENV['EXTERNAL_VALIDATION_SERVICE_URL']
             end
 
+            def validation_service_token
+              ENV['EXTERNAL_VALIDATION_SERVICE_TOKEN']
+            end
+
             def validation_service_payload
               {
                 project: {

locale/gitlab.pot

@@ -34656,6 +34656,9 @@ msgstr ""
 msgid "Write a comment…"
 msgstr ""
 
+msgid "Write a description or drag your files here…"
+msgstr ""
+
 msgid "Write milestone description..."
 msgstr ""
 

scripts/review_apps/base-config.yaml

@@ -136,8 +136,10 @@ postgresql:
   metrics:
     enabled: false
   resources:
+    requests:
       cpu: 600m
       memory: 1000M
+    limits:
       cpu: 1300m
       memory: 1500M
 prometheus:

spec/features/issues/user_creates_issue_spec.rb

@@ -45,7 +45,7 @@ RSpec.describe "User creates issue" do
         .and have_no_content("Milestone")
 
         expect(page.find('#issue_title')['placeholder']).to eq 'Title'
-        expect(page.find('#issue_description')['placeholder']).to eq 'Write a comment or drag your files here…'
+        expect(page.find('#issue_description')['placeholder']).to eq 'Write a description or drag your files here…'
       end
 
       issue_title = "500 error on profile"

spec/lib/gitlab/ci/pipeline/chain/validate/external_spec.rb

@@ -63,6 +63,7 @@ RSpec.describe Gitlab::Ci::Pipeline::Chain::Validate::External do
       expect(::Gitlab::HTTP).to receive(:post) do |_url, params|
         expect(params[:body]).to match_schema('/external_validation')
         expect(params[:timeout]).to eq(described_class::DEFAULT_VALIDATION_REQUEST_TIMEOUT)
+        expect(params[:headers]).to eq({})
       end
 
       perform!
@@ -119,6 +120,20 @@ RSpec.describe Gitlab::Ci::Pipeline::Chain::Validate::External do
       end
     end
 
+    context 'when EXTERNAL_VALIDATION_SERVICE_TOKEN is set' do
+      before do
+        stub_env('EXTERNAL_VALIDATION_SERVICE_TOKEN', '123')
+      end
+
+      it 'passes token in X-Gitlab-Token header' do
+        expect(::Gitlab::HTTP).to receive(:post) do |_url, params|
+          expect(params[:headers]).to eq({ 'X-Gitlab-Token' => '123' })
+        end
+
+        perform!
+      end
+    end
+
     context 'when validation returns 200 OK' do
       before do
         stub_request(:post, validation_service_url).to_return(status: 200, body: "{}")