.eslintignore

@@ -7,3 +7,4 @@
 /vendor/
 karma.config.js
 webpack.config.js
+/app/assets/javascripts/locale/**/*.js

.gitignore

 *.log
 *.swp
+*.mo
+*.edit.po
 .DS_Store
 .bundle
 .chef
@@ -16,6 +18,7 @@ eslint-report.html
 .sass-cache/
 /.secret
 /.vagrant
+/.yarn-cache
 /.byebug_history
 /Vagrantfile
 /backups/*
@@ -46,6 +49,7 @@ eslint-report.html
 /public/uploads/
 /shared/artifacts/
 /spec/javascripts/fixtures/blob/pdf/
+/spec/javascripts/fixtures/blob/balsamiq/
 /rails_best_practices_output.html
 /tags
 /tmp/*
@@ -54,3 +58,4 @@ eslint-report.html
 /shared/*
 /.gitlab_workhorse_secret
 /webpack-report/
+/locale/**/LC_MESSAGES

.gitlab-ci.yml

 image: "dev.gitlab.org:5005/gitlab/gitlab-build-images:ruby-2.3.3-golang-1.8-git-2.7-phantomjs-2.1-node-7.1-postgresql-9.6"
 cache:
-  key: "ruby-233"
+  key: "ruby-233-with-yarn"
   paths:
   - vendor/ruby
+  - .yarn-cache/
 variables:
   MYSQL_ALLOW_EMPTY_PASSWORD: "1"
@@ -23,6 +24,7 @@ before_script:
   - source scripts/prepare_build.sh
 stages:
+- build
 - prepare
 - test
 - post-test
@@ -73,7 +75,7 @@ stages:
 # https://docs.gitlab.com/ce/development/writing_documentation.html#testing
 .except-docs: &except-docs
   except:
-    - /^docs\/.*/
+    - /(^docs[\/-].*|.*-docs$)/
 .rspec-knapsack: &rspec-knapsack
   stage: test
@@ -82,7 +84,7 @@ stages:
     - JOB_NAME=( $CI_JOB_NAME )
     - export CI_NODE_INDEX=${JOB_NAME[-2]}
     - export CI_NODE_TOTAL=${JOB_NAME[-1]}
-    - export KNAPSACK_REPORT_PATH=knapsack/${CI_PROJECT_NAME}/${JOB_NAME[0]}_${JOB_NAME[1]}_node_${CI_NODE_INDEX}_${CI_NODE_TOTAL}_report.json
+    - export KNAPSACK_REPORT_PATH=knapsack/${CI_PROJECT_NAME}/${JOB_NAME[0]}_node_${CI_NODE_INDEX}_${CI_NODE_TOTAL}_report.json
     - export KNAPSACK_GENERATE_REPORT=true
     - export CACHE_CLASSES=true
     - cp ${KNAPSACK_RSPEC_SUITE_REPORT_PATH} ${KNAPSACK_REPORT_PATH}
@@ -113,7 +115,7 @@ stages:
     - JOB_NAME=( $CI_JOB_NAME )
     - export CI_NODE_INDEX=${JOB_NAME[-2]}
     - export CI_NODE_TOTAL=${JOB_NAME[-1]}
-    - export KNAPSACK_REPORT_PATH=knapsack/${CI_PROJECT_NAME}/${JOB_NAME[0]}_${JOB_NAME[1]}_node_${CI_NODE_INDEX}_${CI_NODE_TOTAL}_report.json
+    - export KNAPSACK_REPORT_PATH=knapsack/${CI_PROJECT_NAME}/${JOB_NAME[0]}_node_${CI_NODE_INDEX}_${CI_NODE_TOTAL}_report.json
     - export KNAPSACK_GENERATE_REPORT=true
     - export CACHE_CLASSES=true
     - cp ${KNAPSACK_SPINACH_SUITE_REPORT_PATH} ${KNAPSACK_REPORT_PATH}
@@ -137,6 +139,26 @@ stages:
   <<: *only-master-and-ee-or-mysql
   <<: *except-docs
+.only-canonical-masters: &only-canonical-masters
+  only:
+    - master@gitlab-org/gitlab-ce
+    - master@gitlab-org/gitlab-ee
+    - master@gitlab/gitlabhq
+    - master@gitlab/gitlab-ee
+
+# Trigger a package build on omnibus-gitlab repository
+
+build-package:
+  before_script: []
+  services: []
+  variables:
+    SETUP_DB: "false"
+    USE_BUNDLE_INSTALL: "false"
+  stage: build
+  when: manual
+  script:
+    - scripts/trigger-build
+
 # Prepare and merge knapsack tests
 knapsack:
   <<: *knapsack-state
@@ -153,17 +175,13 @@ knapsack:
 update-knapsack:
   <<: *knapsack-state
   <<: *dedicated-runner
+  <<: *only-canonical-masters
   stage: post-test
   script:
-    - scripts/merge-reports ${KNAPSACK_RSPEC_SUITE_REPORT_PATH} knapsack/${CI_PROJECT_NAME}/rspec_pg_node_*.json
-    - scripts/merge-reports ${KNAPSACK_SPINACH_SUITE_REPORT_PATH} knapsack/${CI_PROJECT_NAME}/spinach_pg_node_*.json
+    - scripts/merge-reports ${KNAPSACK_RSPEC_SUITE_REPORT_PATH} knapsack/${CI_PROJECT_NAME}/rspec-pg_node_*.json
+    - scripts/merge-reports ${KNAPSACK_SPINACH_SUITE_REPORT_PATH} knapsack/${CI_PROJECT_NAME}/spinach-pg_node_*.json
     - '[[ -z ${KNAPSACK_S3_BUCKET} ]] || scripts/sync-reports put $KNAPSACK_S3_BUCKET $KNAPSACK_RSPEC_SUITE_REPORT_PATH $KNAPSACK_SPINACH_SUITE_REPORT_PATH'
     - rm -f knapsack/${CI_PROJECT_NAME}/*_node_*.json
-  only:
-    - master@gitlab-org/gitlab-ce
-    - master@gitlab-org/gitlab-ee
-    - master@gitlab/gitlabhq
-    - master@gitlab/gitlab-ee
 setup-test-env:
   <<: *use-pg
@@ -172,7 +190,7 @@ setup-test-env:
   stage: prepare
   script:
     - node --version
-    - yarn install --pure-lockfile
+    - yarn install --pure-lockfile --cache-folder .yarn-cache
     - bundle exec rake gitlab:assets:compile
     - bundle exec ruby -Ispec -e 'require "spec_helper" ; TestEnv.init'
   artifacts:
@@ -182,76 +200,75 @@ setup-test-env:
       - public/assets
       - tmp/tests
-rspec pg 0 20: *rspec-knapsack-pg
-rspec pg 1 20: *rspec-knapsack-pg
-rspec pg 2 20: *rspec-knapsack-pg
-rspec pg 3 20: *rspec-knapsack-pg
-rspec pg 4 20: *rspec-knapsack-pg
-rspec pg 5 20: *rspec-knapsack-pg
-rspec pg 6 20: *rspec-knapsack-pg
-rspec pg 7 20: *rspec-knapsack-pg
-rspec pg 8 20: *rspec-knapsack-pg
-rspec pg 9 20: *rspec-knapsack-pg
-rspec pg 10 20: *rspec-knapsack-pg
-rspec pg 11 20: *rspec-knapsack-pg
-rspec pg 12 20: *rspec-knapsack-pg
-rspec pg 13 20: *rspec-knapsack-pg
-rspec pg 14 20: *rspec-knapsack-pg
-rspec pg 15 20: *rspec-knapsack-pg
-rspec pg 16 20: *rspec-knapsack-pg
-rspec pg 17 20: *rspec-knapsack-pg
-rspec pg 18 20: *rspec-knapsack-pg
-rspec pg 19 20: *rspec-knapsack-pg
-
-rspec mysql 0 20: *rspec-knapsack-mysql
-rspec mysql 1 20: *rspec-knapsack-mysql
-rspec mysql 2 20: *rspec-knapsack-mysql
-rspec mysql 3 20: *rspec-knapsack-mysql
-rspec mysql 4 20: *rspec-knapsack-mysql
-rspec mysql 5 20: *rspec-knapsack-mysql
-rspec mysql 6 20: *rspec-knapsack-mysql
-rspec mysql 7 20: *rspec-knapsack-mysql
-rspec mysql 8 20: *rspec-knapsack-mysql
-rspec mysql 9 20: *rspec-knapsack-mysql
-rspec mysql 10 20: *rspec-knapsack-mysql
-rspec mysql 11 20: *rspec-knapsack-mysql
-rspec mysql 12 20: *rspec-knapsack-mysql
-rspec mysql 13 20: *rspec-knapsack-mysql
-rspec mysql 14 20: *rspec-knapsack-mysql
-rspec mysql 15 20: *rspec-knapsack-mysql
-rspec mysql 16 20: *rspec-knapsack-mysql
-rspec mysql 17 20: *rspec-knapsack-mysql
-rspec mysql 18 20: *rspec-knapsack-mysql
-rspec mysql 19 20: *rspec-knapsack-mysql
-
-spinach pg 0 10: *spinach-knapsack-pg
-spinach pg 1 10: *spinach-knapsack-pg
-spinach pg 2 10: *spinach-knapsack-pg
-spinach pg 3 10: *spinach-knapsack-pg
-spinach pg 4 10: *spinach-knapsack-pg
-spinach pg 5 10: *spinach-knapsack-pg
-spinach pg 6 10: *spinach-knapsack-pg
-spinach pg 7 10: *spinach-knapsack-pg
-spinach pg 8 10: *spinach-knapsack-pg
-spinach pg 9 10: *spinach-knapsack-pg
-
-spinach mysql 0 10: *spinach-knapsack-mysql
-spinach mysql 1 10: *spinach-knapsack-mysql
-spinach mysql 2 10: *spinach-knapsack-mysql
-spinach mysql 3 10: *spinach-knapsack-mysql
-spinach mysql 4 10: *spinach-knapsack-mysql
-spinach mysql 5 10: *spinach-knapsack-mysql
-spinach mysql 6 10: *spinach-knapsack-mysql
-spinach mysql 7 10: *spinach-knapsack-mysql
-spinach mysql 8 10: *spinach-knapsack-mysql
-spinach mysql 9 10: *spinach-knapsack-mysql
-
-# Other generic tests
+rspec-pg 0 20: *rspec-knapsack-pg
+rspec-pg 1 20: *rspec-knapsack-pg
+rspec-pg 2 20: *rspec-knapsack-pg
+rspec-pg 3 20: *rspec-knapsack-pg
+rspec-pg 4 20: *rspec-knapsack-pg
+rspec-pg 5 20: *rspec-knapsack-pg
+rspec-pg 6 20: *rspec-knapsack-pg
+rspec-pg 7 20: *rspec-knapsack-pg
+rspec-pg 8 20: *rspec-knapsack-pg
+rspec-pg 9 20: *rspec-knapsack-pg
+rspec-pg 10 20: *rspec-knapsack-pg
+rspec-pg 11 20: *rspec-knapsack-pg
+rspec-pg 12 20: *rspec-knapsack-pg
+rspec-pg 13 20: *rspec-knapsack-pg
+rspec-pg 14 20: *rspec-knapsack-pg
+rspec-pg 15 20: *rspec-knapsack-pg
+rspec-pg 16 20: *rspec-knapsack-pg
+rspec-pg 17 20: *rspec-knapsack-pg
+rspec-pg 18 20: *rspec-knapsack-pg
+rspec-pg 19 20: *rspec-knapsack-pg
+
+rspec-mysql 0 20: *rspec-knapsack-mysql
+rspec-mysql 1 20: *rspec-knapsack-mysql
+rspec-mysql 2 20: *rspec-knapsack-mysql
+rspec-mysql 3 20: *rspec-knapsack-mysql
+rspec-mysql 4 20: *rspec-knapsack-mysql
+rspec-mysql 5 20: *rspec-knapsack-mysql
+rspec-mysql 6 20: *rspec-knapsack-mysql
+rspec-mysql 7 20: *rspec-knapsack-mysql
+rspec-mysql 8 20: *rspec-knapsack-mysql
+rspec-mysql 9 20: *rspec-knapsack-mysql
+rspec-mysql 10 20: *rspec-knapsack-mysql
+rspec-mysql 11 20: *rspec-knapsack-mysql
+rspec-mysql 12 20: *rspec-knapsack-mysql
+rspec-mysql 13 20: *rspec-knapsack-mysql
+rspec-mysql 14 20: *rspec-knapsack-mysql
+rspec-mysql 15 20: *rspec-knapsack-mysql
+rspec-mysql 16 20: *rspec-knapsack-mysql
+rspec-mysql 17 20: *rspec-knapsack-mysql
+rspec-mysql 18 20: *rspec-knapsack-mysql
+rspec-mysql 19 20: *rspec-knapsack-mysql
+
+spinach-pg 0 10: *spinach-knapsack-pg
+spinach-pg 1 10: *spinach-knapsack-pg
+spinach-pg 2 10: *spinach-knapsack-pg
+spinach-pg 3 10: *spinach-knapsack-pg
+spinach-pg 4 10: *spinach-knapsack-pg
+spinach-pg 5 10: *spinach-knapsack-pg
+spinach-pg 6 10: *spinach-knapsack-pg
+spinach-pg 7 10: *spinach-knapsack-pg
+spinach-pg 8 10: *spinach-knapsack-pg
+spinach-pg 9 10: *spinach-knapsack-pg
+
+spinach-mysql 0 10: *spinach-knapsack-mysql
+spinach-mysql 1 10: *spinach-knapsack-mysql
+spinach-mysql 2 10: *spinach-knapsack-mysql
+spinach-mysql 3 10: *spinach-knapsack-mysql
+spinach-mysql 4 10: *spinach-knapsack-mysql
+spinach-mysql 5 10: *spinach-knapsack-mysql
+spinach-mysql 6 10: *spinach-knapsack-mysql
+spinach-mysql 7 10: *spinach-knapsack-mysql
+spinach-mysql 8 10: *spinach-knapsack-mysql
+spinach-mysql 9 10: *spinach-knapsack-mysql
+
+# Static analysis jobs
 .ruby-static-analysis: &ruby-static-analysis
   variables:
     SIMPLECOV: "false"
     SETUP_DB: "false"
-    USE_BUNDLE_INSTALL: "true"
 .rake-exec: &rake-exec
   <<: *ruby-static-analysis
@@ -294,7 +311,7 @@ downtime_check:
     - master
     - tags
     - /^[\d-]+-stable(-ee)?$/
-    - /^docs\/*/
+    - /(^docs[\/-].*|.*-docs$)/
 ee_compat_check:
   <<: *rake-exec
@@ -316,6 +333,7 @@ ee_compat_check:
     paths:
       - ee_compat_check/patches/*.patch
+# DB migration, rollback, and seed jobs
 .db-migrate-reset: &db-migrate-reset
   stage: test
   <<: *dedicated-runner
@@ -323,14 +341,38 @@ ee_compat_check:
   script:
     - bundle exec rake db:migrate:reset
-rake pg db:migrate:reset:
+db:migrate:reset-pg:
   <<: *db-migrate-reset
   <<: *use-pg
-rake mysql db:migrate:reset:
+db:migrate:reset-mysql:
   <<: *db-migrate-reset
   <<: *use-mysql
+.migration-paths: &migration-paths
+  stage: test
+  <<: *dedicated-runner
+  variables:
+    SETUP_DB: "false"
+  <<: *only-canonical-masters
+  script:
+    - git fetch origin v8.14.10
+    - git checkout -f FETCH_HEAD
+    - bundle install $BUNDLE_INSTALL_FLAGS
+    - bundle exec rake db:drop db:create db:schema:load db:seed_fu
+    - git checkout $CI_COMMIT_SHA
+    - bundle install $BUNDLE_INSTALL_FLAGS
+    - . scripts/prepare_build.sh
+    - bundle exec rake db:migrate
+
+migration:path-pg:
+  <<: *migration-paths
+  <<: *use-pg
+
+migration:path-mysql:
+  <<: *migration-paths
+  <<: *use-mysql
+
 .db-rollback: &db-rollback
   stage: test
   <<: *dedicated-runner
@@ -339,11 +381,11 @@ rake mysql db:migrate:reset:
     - bundle exec rake db:rollback STEP=120
     - bundle exec rake db:migrate
-rake pg db:rollback:
+db:rollback-pg:
   <<: *db-rollback
   <<: *use-pg
-rake mysql db:rollback:
+db:rollback-mysql:
   <<: *db-rollback
   <<: *use-mysql
@@ -365,15 +407,16 @@ rake mysql db:rollback:
     paths:
       - log/development.log
-rake pg db:seed_fu:
+db:seed_fu-pg:
   <<: *db-seed_fu
   <<: *use-pg
-rake mysql db:seed_fu:
+db:seed_fu-mysql:
   <<: *db-seed_fu
   <<: *use-mysql
-rake gitlab:assets:compile:
+# Frontend-related jobs
+gitlab:assets:compile:
   stage: test
   <<: *dedicated-runner
   <<: *except-docs
@@ -386,17 +429,15 @@ rake gitlab:assets:compile:
     SKIP_STORAGE_VALIDATION: "true"
     WEBPACK_REPORT: "true"
   script:
-    - bundle exec rake yarn:install gitlab:assets:compile
+    - yarn install --pure-lockfile --production --cache-folder .yarn-cache
+    - bundle exec rake gitlab:assets:compile
   artifacts:
     name: webpack-report
     expire_in: 31d
     paths:
     - webpack-report/
-rake karma:
-  cache:
-    paths:
-      - vendor/ruby
+karma:
   stage: test
   <<: *use-pg
   <<: *dedicated-runner
@@ -412,46 +453,6 @@ rake karma:
     paths:
     - coverage-javascript/
-bundler:audit:
-  stage: test
-  <<: *ruby-static-analysis
-  <<: *dedicated-runner
-  only:
-    - master@gitlab-org/gitlab-ce
-    - master@gitlab-org/gitlab-ee
-    - master@gitlab/gitlabhq
-    - master@gitlab/gitlab-ee
-  script:
-    - "bundle exec bundle-audit check --update --ignore CVE-2016-4658"
-
-.migration-paths: &migration-paths
-  stage: test
-  <<: *dedicated-runner
-  variables:
-    SETUP_DB: "false"
-  only:
-    - master@gitlab-org/gitlab-ce
-    - master@gitlab-org/gitlab-ee
-    - master@gitlab/gitlabhq
-    - master@gitlab/gitlab-ee
-  script:
-    - git fetch origin v8.14.10
-    - git checkout -f FETCH_HEAD
-    - bundle install $BUNDLE_INSTALL_FLAGS
-    - bundle exec rake db:drop db:create db:schema:load db:seed_fu
-    - git checkout $CI_COMMIT_SHA
-    - bundle install $BUNDLE_INSTALL_FLAGS
-    - . scripts/prepare_build.sh
-    - bundle exec rake db:migrate
-
-migration pg paths:
-  <<: *migration-paths
-  <<: *use-pg
-
-migration mysql paths:
-  <<: *migration-paths
-  <<: *use-mysql
-
 coverage:
   stage: post-test
   services: []
@@ -509,8 +510,8 @@ pages:
   <<: *dedicated-runner
   dependencies:
     - coverage
-    - rake karma
-    - rake gitlab:assets:compile
+    - karma
+    - gitlab:assets:compile
     - lint:javascript:report
   script:
     - mv public/ .public/

.gitlab/issue_templates/Bug.md

@@ -40,6 +40,7 @@ logs, and code as it's very hard to read otherwise.)
 #### Results of GitLab environment info
 <details>
+<summary>Expand for output related to GitLab environment info</summary>
 <pre>
 (For installations with omnibus-gitlab package run and paste the output of:
@@ -54,6 +55,7 @@ logs, and code as it's very hard to read otherwise.)
 #### Results of GitLab application Check
 <details>
+<summary>Expand for output related to the GitLab application check</summary>
 <pre>
 (For installations with omnibus-gitlab package run and paste the output of:

.rubocop.yml

@@ -494,7 +494,13 @@ Style/TrailingBlankLines:
 # This cop checks for trailing comma in array and hash literals.
 Style/TrailingCommaInLiteral:
-  Enabled: false
+  Enabled: true
+  EnforcedStyleForMultiline: no_comma
+
+# This cop checks for trailing comma in argument lists.
+Style/TrailingCommaInArguments:
+  Enabled: true
+  EnforcedStyleForMultiline: no_comma
 # Checks for %W when interpolation is not needed.
 Style/UnneededCapitalW:
@@ -963,6 +969,12 @@ RSpec/DescribeSymbol:
 RSpec/DescribedClass:
   Enabled: true
+# Checks if an example group does not include any tests.
+RSpec/EmptyExampleGroup:
+  Enabled: true
+  CustomIncludeMethods:
+    - run_permission_checks
+
 # Checks for long example.
 RSpec/ExampleLength:
   Enabled: false
@@ -981,6 +993,10 @@ RSpec/ExampleWording:
 RSpec/ExpectActual:
   Enabled: true
+# Checks for opportunities to use `expect { … }.to output`.
+RSpec/ExpectOutput:
+  Enabled: true
+
 # Checks the file and folder naming of the spec file.
 RSpec/FilePath:
   Enabled: true

.rubocop_todo.yml

@@ -10,11 +10,6 @@
 RSpec/BeforeAfterAll:
   Enabled: false
-# Offense count: 15
-# Configuration parameters: CustomIncludeMethods.
-RSpec/EmptyExampleGroup:
-  Enabled: false
-
 # Offense count: 233
 RSpec/EmptyLineAfterFinalLet:
   Enabled: false
@@ -23,10 +18,6 @@ RSpec/EmptyLineAfterFinalLet:
 RSpec/EmptyLineAfterSubject:
   Enabled: false
-# Offense count: 3
-RSpec/ExpectOutput:
-  Enabled: false
-
 # Offense count: 72
 # Configuration parameters: EnforcedStyle, SupportedStyles.
 # SupportedStyles: implicit, each, example
@@ -369,13 +360,6 @@ Style/SymbolProc:
 Style/TernaryParentheses:
   Enabled: false
-# Offense count: 53
-# Cop supports --auto-correct.
-# Configuration parameters: EnforcedStyleForMultiline, SupportedStylesForMultiline.
-# SupportedStylesForMultiline: comma, consistent_comma, no_comma
-Style/TrailingCommaInArguments:
-  Enabled: false
-
 # Offense count: 18
 # Cop supports --auto-correct.
 # Configuration parameters: AllowNamedUnderscoreVariables.

CHANGELOG.md

@@ -2,6 +2,29 @@
 documentation](doc/development/changelog.md) for instructions on adding your own
 entry.
+## 9.1.4 (2017-05-12)
+
+- Fix error on CI/CD Settings page related to invalid pipeline trigger. !10948 (dosuken123)
+- Sort the network graph both by commit date and topographically. !11057
+- Fix cross referencing for private and internal projects. !11243
+- Handle incoming emails from aliases correctly.
+- Gracefully handle failures for incoming emails which do not match on the To header, and have no References header.
+- Add missing project attributes to Import/Export.
+- Fixed search terms not correctly highlighting.
+- Fixed bug where merge request JSON would be displayed.
+
+## 9.1.3 (2017-05-05)
+
+- Do not show private groups on subgroups page if user doesn't have access to.
+- Enforce project features when searching blobs and wikis.
+- Fixed branches dropdown rendering branch names as HTML.
+- Make Asciidoc & other markup go through pipeline to prevent XSS.
+- Validate URLs in markdown using URI to detect the host correctly.
+- Fix for XSS in project import view caused by Hamlit filter usage.
+- Sanitize submodule URLs before linking to them in the file tree view.
+- Refactor snippets finder & dont return internal snippets for external users.
+- Fix snippets visibility for show action - external users can not see internal snippets.
+
 ## 9.1.2 (2017-05-01)
 - Add index on ci_runners.contacted_at. !10876 (blackst0ne)
@@ -30,6 +53,7 @@ entry.
 ## 9.1.0 (2017-04-22)
+- Add Jupyter notebook rendering !10017
 - Added merge requests empty state. !7342
 - Add option to start a new resolvable discussion in an MR. !7527
 - Hide form inputs for group member without editing rights. !7816
@@ -276,6 +300,18 @@ entry.
 - Only send chat notifications for the default branch.
 - Don't fill in the default kubernetes namespace.
+## 9.0.7 (2017-05-05)
+
+- Enforce project features when searching blobs and wikis.
+- Fixed branches dropdown rendering branch names as HTML.
+- Make Asciidoc & other markup go through pipeline to prevent XSS.
+- Validate URLs in markdown using URI to detect the host correctly.
+- Fix for XSS in project import view caused by Hamlit filter usage.
+- Sanitize submodule URLs before linking to them in the file tree view.
+- Refactor snippets finder & dont return internal snippets for external users.
+- Fix snippets visibility for show action - external users can not see internal snippets.
+- Do not show private groups on subgroups page if user doesn't have access to.
+
 ## 9.0.6 (2017-04-21)
 - Bugfix: POST /projects/:id/hooks and PUT /projects/:id/hook/:hook_id no longer ignore the the job_events param in the V4 API. !10586
@@ -620,6 +656,17 @@ entry.
 - Change development tanuki favicon colors to match logo color order.
 - API issues - support filtering by iids.
+## 8.17.6 (2017-05-05)
+
+- Enforce project features when searching blobs and wikis.
+- Fixed branches dropdown rendering branch names as HTML.
+- Make Asciidoc & other markup go through pipeline to prevent XSS.
+- Validate URLs in markdown using URI to detect the host correctly.
+- Fix for XSS in project import view caused by Hamlit filter usage.
+- Sanitize submodule URLs before linking to them in the file tree view.
+- Refactor snippets finder & dont return internal snippets for external users.
+- Fix snippets visibility for show action - external users can not see internal snippets.
+
 ## 8.17.5 (2017-04-05)
 - Don’t show source project name when user does not have access.

CONTRIBUTING.md

@@ -13,27 +13,29 @@ _This notice should stay as the first item in the CONTRIBUTING.MD file._
 <!-- DON'T EDIT THIS SECTION, INSTEAD RE-RUN doctoc TO UPDATE -->
 **Table of Contents**  *generated with [DocToc](https://github.com/thlorenz/doctoc)*
-- [Contributor license agreement](#contributor-license-agreement)
 - [Contribute to GitLab](#contribute-to-gitlab)
 - [Security vulnerability disclosure](#security-vulnerability-disclosure)
 - [Closing policy for issues and merge requests](#closing-policy-for-issues-and-merge-requests)
 - [Helping others](#helping-others)
 - [I want to contribute!](#i-want-to-contribute)
-- [Implement design & UI elements](#implement-design-ui-elements)
-- [Release retrospective and kickoff](#release-retrospective-and-kickoff)
-    - [Retrospective](#retrospective)
-    - [Kickoff](#kickoff)
+- [Workflow labels](#workflow-labels)
+  - [Type labels (~"feature proposal", ~bug, ~customer, etc.)](#type-labels-feature-proposal-bug-customer-etc)
+  - [Subject labels (~wiki, ~"container registry", ~ldap, ~api, etc.)](#subject-labels-wiki-container-registry-ldap-api-etc)
+  - [Team labels (~CI, ~Discussion, ~Edge, ~Platform, etc.)](#team-labels-ci-discussion-edge-platform-etc)
+  - [Priority labels (~Deliverable and ~Stretch)](#priority-labels-deliverable-and-stretch)
+  - [Label for community contributors (~"Accepting Merge Requests")](#label-for-community-contributors-accepting-merge-requests)
+- [Implement design & UI elements](#implement-design--ui-elements)
 - [Issue tracker](#issue-tracker)
-    - [Feature proposals](#feature-proposals)
-    - [Issue tracker guidelines](#issue-tracker-guidelines)
-    - [Issue weight](#issue-weight)
-    - [Regression issues](#regression-issues)
-    - [Technical debt](#technical-debt)
-    - [Stewardship](#stewardship)
+  - [Issue triaging](#issue-triaging)
+  - [Feature proposals](#feature-proposals)
+  - [Issue tracker guidelines](#issue-tracker-guidelines)
+  - [Issue weight](#issue-weight)
+  - [Regression issues](#regression-issues)
+  - [Technical debt](#technical-debt)
+  - [Stewardship](#stewardship)
 - [Merge requests](#merge-requests)
-    - [Merge request guidelines](#merge-request-guidelines)
-    - [Contribution acceptance criteria](#contribution-acceptance-criteria)
-- [Changes for Stable Releases](#changes-for-stable-releases)
+  - [Merge request guidelines](#merge-request-guidelines)
+  - [Contribution acceptance criteria](#contribution-acceptance-criteria)
 - [Definition of done](#definition-of-done)
 - [Style guides](#style-guides)
 - [Code of conduct](#code-of-conduct)
@@ -103,34 +105,128 @@ contributing to GitLab.
 ## Workflow labels
-Labelling issues is described in the [GitLab Inc engineering workflow].
-## Implement design & UI elements
-Please see the [UX Guide for GitLab].
-## Release retrospective and kickoff
-### Retrospective
-After each release, we have a retrospective call where we discuss what went well,
-what went wrong, and what we can improve for the next release. The
-[retrospective notes] are public and you are invited to comment on them.
-If you're interested, you can even join the
-[retrospective call][retro-kickoff-call], on the first working day after the
-22nd at 6pm CET / 9am PST.
-### Kickoff
-Before working on the next release, we have a
-kickoff call to explain what we expect to ship in the next release. The
-[kickoff notes] are public and you are invited to comment on them.
-If you're interested, you can even join the [kickoff call][retro-kickoff-call],
-on the first working day after the 7th at 6pm CET / 9am PST..
-[retrospective notes]: https://docs.google.com/document/d/1nEkM_7Dj4bT21GJy0Ut3By76FZqCfLBmFQNVThmW2TY/edit?usp=sharing
-[kickoff notes]: https://docs.google.com/document/d/1ElPkZ90A8ey_iOkTvUs_ByMlwKK6NAB2VOK5835wYK0/edit?usp=sharing
-[retro-kickoff-call]: https://gitlab.zoom.us/j/918821206
+To allow for asynchronous issue handling, we use [milestones][milestones-page]
+and [labels][labels-page]. Leads and product managers handle most of the
+scheduling into milestones. Labelling is a task for everyone.
+Most issues will have labels for at least one of the following:
+- Type: ~"feature proposal", ~bug, ~customer, etc.
+- Subject: ~wiki, ~"container registry", ~ldap, ~api, etc.
+- Team: ~CI, ~Discussion, ~Edge, ~Frontend, ~Platform, etc.
+- Priority: ~Deliverable, ~Stretch
+
+All labels, their meaning and priority are defined on the
+[labels page][labels-page].
+
+If you come across an issue that has none of these, and you're allowed to set
+labels, you can _always_ add the team and type, and often also the subject.
+
+[milestones-page]: https://gitlab.com/gitlab-org/gitlab-ce/milestones
+[labels-page]: https://gitlab.com/gitlab-org/gitlab-ce/labels
+
+### Type labels (~"feature proposal", ~bug, ~customer, etc.)
+
+Type labels are very important. They define what kind of issue this is. Every
+issue should have one or more.
+
+Examples of type labels are ~"feature proposal", ~bug, ~customer, ~security,
+and ~"direction".
+
+A number of type labels have a priority assigned to them, which automatically
+makes them float to the top, depending on their importance.
+
+Type labels are always lowercase, and can have any color, besides blue (which is
+already reserved for subject labels).
+
+The descriptions on the [labels page][labels-page] explain what falls under each type label.
+
+### Subject labels (~wiki, ~"container registry", ~ldap, ~api, etc.)
+
+Subject labels are labels that define what area or feature of GitLab this issue
+hits. They are not always necessary, but very convenient.
+
+If you are an expert in a particular area, it makes it easier to find issues to
+work on. You can also subscribe to those labels to receive an email each time an
+issue is labelled with a subject label corresponding to your expertise.
+
+Examples of subject labels are ~wiki, ~"container registry", ~ldap, ~api,
+~issues, ~"merge requests", ~labels, and ~"container registry".
+
+Subject labels are always all-lowercase.
+
+### Team labels (~CI, ~Discussion, ~Edge, ~Platform, etc.)
+
+Team labels specify what team is responsible for this issue.
+Assigning a team label makes sure issues get the attention of the appropriate
+people.
+
+The current team labels are ~Build, ~CI, ~Discussion, ~Documentation, ~Edge,
+~Gitaly, ~Platform, ~Prometheus, ~Release, and ~"UX".
+
+The descriptions on the [labels page][labels-page] explain what falls under the
+responsibility of each team.
+
+Within those team labels, we also have the ~backend and ~frontend labels to
+indicate if an issue needs backend work, frontend work, or both.
+
+Team labels are always capitalized so that they show up as the first label for
+any issue.
+### Priority labels (~Deliverable and ~Stretch)
+Priority labels help us clearly communicate expectations of the work for the
+release. There are two levels of priority labels:
+- ~Deliverable: Issues that are expected to be delivered in the current
+  milestone.
+- ~Stretch: Issues that are a stretch goal for delivering in the current
+  milestone. If these issues are not done in the current release, they will
+  strongly be considered for the next release.
+### Label for community contributors (~"Accepting Merge Requests")
+Issues that are beneficial to our users, 'nice to haves', that we currently do
+not have the capacity for or want to give the priority to, are labeled as
+~"Accepting Merge Requests", so the community can make a contribution.
+Community contributors can submit merge requests for any issue they want, but
+the ~"Accepting Merge Requests" label has a special meaning. It points to
+changes that:
+
+1. We already agreed on,
+1. Are well-defined,
+1. Are likely to get accepted by a maintainer.
+
+We want to avoid a situation when a contributor picks an
+~"Accepting Merge Requests" issue and then their merge request gets closed,
+because we realize that it does not fit our vision, or we want to solve it in a
+different way.
+
+We add the ~"Accepting Merge Requests" label to:
+
+- Low priority ~bug issues (i.e. we do not add it to the bugs that we want to
+solve in the ~"Next Patch Release")
+- Small ~"feature proposal" that do not need ~UX / ~"Product work", or for which
+the ~UX / ~"Product work" is already done
+- Small ~"technical debt" issues
+
+After adding the ~"Accepting Merge Requests" label, we try to estimate the
+[weight](#issue-weight) of the issue. We use issue weight to let contributors
+know how difficult the issue is. Additionally:
+
+- We advertise [~"Accepting Merge Requests" issues with weight < 5][up-for-grabs]
+  as suitable for people that have never contributed to GitLab before on the
+  [Up For Grabs campaign](http://up-for-grabs.net)
+- We encourage people that have never contributed to any open source project to
+  look for [~"Accepting Merge Requests" issues with a weight of 1][firt-timers]
+
+[up-for-grabs]: https://gitlab.com/gitlab-org/gitlab-ce/issues?label_name=Accepting+Merge+Requests&scope=all&sort=weight_asc&state=opened
+[firt-timers]: https://gitlab.com/gitlab-org/gitlab-ce/issues?label_name%5B%5D=Accepting+Merge+Requests&scope=all&sort=upvotes_desc&state=opened&weight=1
+
+## Implement design & UI elements
+
+Please see the [UX Guide for GitLab].
 ## Issue tracker
@@ -154,6 +250,21 @@ If it happens that you know the solution to an existing bug, please first
 open the issue in order to keep track of it and then open the relevant merge
 request that potentially fixes it.
+### Issue triaging
+
+Our issue triage policies are [described in our handbook]. You are very welcome
+to help the GitLab team triage issues. We also organize [issue bash events] once
+every quarter.
+
+The most important thing is making sure valid issues receive feedback from the
+development team. Therefore the priority is mentioning developers that can help
+on those issues. Please select someone with relevant experience from the
+[GitLab team][team]. If there is nobody mentioned with that expertise look in
+the commit history for the affected files to find someone.
+
+[described in our handbook]: https://about.gitlab.com/handbook/engineering/issues/issue-triage-policies/
+[issue bash events]: https://gitlab.com/gitlab-org/gitlab-ce/issues/17815
+
 ### Feature proposals
 To create a feature proposal for CE, open an issue on the
@@ -327,13 +438,17 @@ request is as follows:
      "Description" field.
   1. If you are contributing documentation, choose `Documentation` from the
      "Choose a template" menu and fill in the template.
+  1. Mention the issue(s) your merge request solves, using the `Solves #XXX` or
+    `Closes #XXX` syntax to auto-close the issue(s) once the merge request will
+    be merged.
+1. If you're allowed to, set a relevant milestone and labels
 1. If the MR changes the UI it should include *Before* and *After* screenshots
 1. If the MR changes CSS classes please include the list of affected pages,
    `grep css-class ./app -R`
-1. Link any relevant [issues][ce-tracker] in the merge request description and
-   leave a comment on them with a link back to the MR
 1. Be prepared to answer questions and incorporate feedback even if requests
    for this arrive weeks or months after your MR submission
+  1. If a discussion has been addressed, select the "Resolve discussion" button
+    beneath it to mark it resolved.
 1. If your MR touches code that executes shell commands, reads or opens files or
    handles paths to files on disk, make sure it adheres to the
    [shell command guidelines](doc/development/shell_commands.md)
@@ -369,24 +484,6 @@ Please ensure that your merge request meets the contribution acceptance criteria
 When having your code reviewed and when reviewing merge requests please take the
 [code review guidelines](doc/development/code_review.md) into account.
-### Getting your merge request reviewed, approved, and merged
-
-There are a few rules to get your merge request accepted:
-
-1. Your merge request should only be **merged by a [maintainer][team]**.
-  1. If your merge request includes only backend changes [^1], it must be
-    **approved by a [backend maintainer][team]**.
-  1. If your merge request includes only frontend changes [^1], it must be
-    **approved by a [frontend maintainer][team]**.
-  1. If your merge request includes frontend and backend changes [^1], it must
-    be **approved by a [frontend and a backend maintainer][team]**.
-1. To lower the amount of merge requests maintainers need to review, you can
-  ask or assign any [reviewers][team] for a first review.
-  1. If you need some guidance (e.g. it's your first merge request), feel free
-    to ask one of the [Merge request coaches][team].
-  1. The reviewer will assign the merge request to a maintainer once the
-    reviewer is satisfied with the state of the merge request.
-
 ### Contribution acceptance criteria
 1. The change is as small as possible
@@ -416,8 +513,7 @@ There are a few rules to get your merge request accepted:
 1. If you need polling to support real-time features, please use
    [polling with ETag caching][polling-etag].
 1. Changes after submitting the merge request should be in separate commits
-   (no squashing). If necessary, you will be asked to squash when the review is
-   over, before merging.
+   (no squashing).
 1. It conforms to the [style guides](#style-guides) and the following:
     - If your change touches a line that does not follow the style, modify the
       entire line to follow it. This prevents linting tools from generating warnings.
@@ -428,19 +524,6 @@ There are a few rules to get your merge request accepted:
    See the instructions in that document for help if your MR fails the
    "license-finder" test with a "Dependencies that need approval" error.
-## Changes for Stable Releases
-
-Sometimes certain changes have to be added to an existing stable release.
-Two examples are bug fixes and performance improvements. In these cases the
-corresponding merge request should be updated to have the following:
-
-1. A milestone indicating what release the merge request should be merged into.
-1. The label "Pick into Stable"
-
-This makes it easier for release managers to keep track of what still has to be
-merged and where changes have to be merged into.
-Like all merge requests the target should be master so all bugfixes are in master.
-
 ## Definition of done
 If you contribute to GitLab please know that changes involve more than just
@@ -449,16 +532,16 @@ the feature you contribute through all of these steps.
 1. Description explaining the relevancy (see following item)
 1. Working and clean code that is commented where needed
-1. Unit and integration tests that pass on the CI server
+1. [Unit and system tests][testing] that pass on the CI server
 1. Performance/scalability implications have been considered, addressed, and tested
-1. [Documented][doc-styleguide] in the /doc directory
-1. Changelog entry added
+1. [Documented][doc-styleguide] in the `/doc` directory
+1. [Changelog entry added][changelog], if necessary
 1. Reviewed and any concerns are addressed
-1. Merged by the project lead
-1. Added to the release blog article
-1. Added to [the website](https://gitlab.com/gitlab-com/www-gitlab-com/) if relevant
+1. Merged by a project maintainer
+1. Added to the release blog article, if relevant
+1. Added to [the website](https://gitlab.com/gitlab-com/www-gitlab-com/), if relevant
 1. Community questions answered
-1. Answers to questions radiated (in docs/wiki/etc.)
+1. Answers to questions radiated (in docs/wiki/support etc.)
 If you add a dependency in GitLab (such as an operating system package) please
 consider updating the following and note the applicability of each in your
@@ -481,7 +564,7 @@ merge request:
     - string literal quoting style **Option A**: single quoted by default
 1.  [Rails](https://github.com/bbatsov/rails-style-guide)
 1.  [Newlines styleguide][newlines-styleguide]
-1.  [Testing](doc/development/testing.md)
+1.  [Testing][testing]
 1.  [JavaScript styleguide][js-styleguide]
 1.  [SCSS styleguide][scss-styleguide]
 1.  [Shell commands](doc/development/shell_commands.md) created by GitLab
@@ -558,6 +641,7 @@ available at [http://contributor-covenant.org/version/1/1/0/](http://contributor
 [license-finder-doc]: doc/development/licensing.md
 [GitLab Inc engineering workflow]: https://about.gitlab.com/handbook/engineering/workflow/#labelling-issues
 [polling-etag]: https://docs.gitlab.com/ce/development/polling.html
+[testing]: doc/development/testing.md
 [^1]: Please note that specs other than JavaScript specs are considered backend
       code.

GITALY_SERVER_VERSION

-0.8.0
+0.10.0

GITLAB_PAGES_VERSION

-0.4.1
+0.4.2

Gemfile

@@ -145,12 +145,12 @@ gem 'acts-as-taggable-on', '~> 4.0'
 # Background jobs
 gem 'sidekiq', '~> 5.0'
-gem 'sidekiq-cron', '~> 0.4.4'
+gem 'sidekiq-cron', '~> 0.6.0'
 gem 'redis-namespace', '~> 1.5.2'
 gem 'sidekiq-limit_fetch', '~> 3.4'
 # Cron Parser
-gem 'rufus-scheduler', '~> 3.1.10'
+gem 'rufus-scheduler', '~> 3.4'
 # HTTP requests
 gem 'httparty', '~> 0.13.3'
@@ -256,6 +256,12 @@ gem 'sentry-raven', '~> 2.4.0'
 gem 'premailer-rails', '~> 1.9.0'
+# I18n
+gem 'ruby_parser', '~> 3.8.4', require: false
+gem 'gettext_i18n_rails', '~> 1.8.0'
+gem 'gettext_i18n_rails_js', '~> 1.2.0'
+gem 'gettext', '~> 3.2.2', require: false, group: :development
+
 # Metrics
 group :metrics do
   gem 'allocations', '~> 1.0', require: false, platform: :mri
@@ -361,6 +367,6 @@ gem 'vmstat', '~> 2.3.0'
 gem 'sys-filesystem', '~> 1.1.6'
 # Gitaly GRPC client
-gem 'gitaly', '~> 0.5.0'
+gem 'gitaly', '~> 0.7.0'
 gem 'toml-rb', '~> 0.3.15', require: false

Gemfile.lock

@@ -181,6 +181,8 @@ GEM
     equalizer (0.0.11)
     erubis (2.7.0)
     escape_utils (1.1.1)
+    et-orbi (1.0.3)
+      tzinfo
     eventmachine (1.0.8)
     excon (0.55.0)
     execjs (2.6.0)
@@ -198,6 +200,7 @@ GEM
     faraday_middleware-multi_json (0.0.6)
       faraday_middleware
       multi_json
+    fast_gettext (1.4.0)
     ffaker (2.4.0)
     ffi (1.9.10)
     flay (2.8.1)
@@ -251,8 +254,18 @@ GEM
     gemojione (3.0.1)
       json
     get_process_mem (0.2.0)
+    gettext (3.2.2)
+      locale (>= 2.0.5)
+      text (>= 1.3.0)
+    gettext_i18n_rails (1.8.0)
+      fast_gettext (>= 0.9.0)
+    gettext_i18n_rails_js (1.2.0)
+      gettext (>= 3.0.2)
+      gettext_i18n_rails (>= 0.7.1)
+      po_to_json (>= 1.0.0)
+      rails (>= 3.2.0)
     gherkin-ruby (0.3.2)
-    gitaly (0.5.0)
+    gitaly (0.7.0)
       google-protobuf (~> 3.1)
       grpc (~> 1.0)
     github-linguist (4.7.6)
@@ -422,7 +435,8 @@ GEM
     licensee (8.7.0)
       rugged (~> 0.24)
     little-plugger (1.1.4)
-    logging (2.1.0)
+    locale (2.1.2)
+    logging (2.2.2)
       little-plugger (~> 1.1)
       multi_json (~> 1.10)
     loofah (2.0.3)
@@ -525,6 +539,8 @@ GEM
       ast (~> 2.2)
     path_expander (1.0.1)
     pg (0.18.4)
+    po_to_json (1.0.1)
+      json (>= 1.6.0)
     poltergeist (1.9.0)
       capybara (~> 2.1)
       cliver (~> 0.3.1)
@@ -683,7 +699,8 @@ GEM
     rubyntlm (0.5.2)
     rubypants (0.2.0)
     rubyzip (1.2.1)
-    rufus-scheduler (3.1.10)
+    rufus-scheduler (3.4.0)
+      et-orbi (~> 1.0)
     rugged (0.25.1.1)
     safe_yaml (1.0.4)
     sanitize (2.1.0)
@@ -720,9 +737,8 @@ GEM
       connection_pool (~> 2.2, >= 2.2.0)
       rack-protection (>= 1.5.0)
       redis (~> 3.3, >= 3.3.3)
-    sidekiq-cron (0.4.4)
-      redis-namespace (>= 1.5.2)
-      rufus-scheduler (>= 2.0.24)
+    sidekiq-cron (0.6.0)
+      rufus-scheduler (>= 3.3.0)
       sidekiq (>= 4.2.1)
     sidekiq-limit_fetch (3.4.0)
       sidekiq (>= 4)
@@ -777,6 +793,7 @@ GEM
     temple (0.7.7)
     test_after_commit (1.1.0)
       activerecord (>= 3.2)
+    text (1.3.1)
     thin (1.7.0)
       daemons (~> 1.0, >= 1.0.9)
       eventmachine (~> 1.0, >= 1.0.4)
@@ -904,7 +921,10 @@ DEPENDENCIES
   fuubar (~> 2.0.0)
   gemnasium-gitlab-service (~> 0.2)
   gemojione (~> 3.0)
-  gitaly (~> 0.5.0)
+  gettext (~> 3.2.2)
+  gettext_i18n_rails (~> 1.8.0)
+  gettext_i18n_rails_js (~> 1.2.0)
+  gitaly (~> 0.7.0)
   github-linguist (~> 4.7.0)
   gitlab-flowdock-git-hook (~> 1.0.1)
   gitlab-markup (~> 1.5.1)
@@ -994,7 +1014,8 @@ DEPENDENCIES
   rubocop-rspec (~> 1.15.0)
   ruby-fogbugz (~> 0.2.1)
   ruby-prof (~> 0.16.2)
-  rufus-scheduler (~> 3.1.10)
+  ruby_parser (~> 3.8.4)
+  rufus-scheduler (~> 3.4)
   rugged (~> 0.25.1.1)
   sanitize (~> 2.0)
   sass-rails (~> 5.0.6)
@@ -1006,7 +1027,7 @@ DEPENDENCIES
   sham_rack (~> 1.3.6)
   shoulda-matchers (~> 2.8.0)
   sidekiq (~> 5.0)
-  sidekiq-cron (~> 0.4.4)
+  sidekiq-cron (~> 0.6.0)
   sidekiq-limit_fetch (~> 3.4)
   simplecov (~> 0.14.0)
   slack-notifier (~> 1.5.1)

PROCESS.md

-# GitLab Contributing Process
+## GitLab Core Team & GitLab Inc. Contribution Process
+
+---
+
+<!-- START doctoc generated TOC please keep comment here to allow auto update -->
+<!-- DON'T EDIT THIS SECTION, INSTEAD RE-RUN doctoc TO UPDATE -->
+**Table of Contents**  *generated with [DocToc](https://github.com/thlorenz/doctoc)*
+
+- [Purpose of describing the contributing process](#purpose-of-describing-the-contributing-process)
+- [Common actions](#common-actions)
+  - [Merge request coaching](#merge-request-coaching)
+- [Assigning issues](#assigning-issues)
+- [Be kind](#be-kind)
+- [Feature freeze on the 7th for the release on the 22nd](#feature-freeze-on-the-7th-for-the-release-on-the-22nd)
+  - [Between the 1st and the 7th](#between-the-1st-and-the-7th)
+  - [On the 7th](#on-the-7th)
+  - [After the 7th](#after-the-7th)
+- [Release retrospective and kickoff](#release-retrospective-and-kickoff)
+  - [Retrospective](#retrospective)
+  - [Kickoff](#kickoff)
+- [Copy & paste responses](#copy--paste-responses)
+  - [Improperly formatted issue](#improperly-formatted-issue)
+  - [Issue report for old version](#issue-report-for-old-version)
+  - [Support requests and configuration questions](#support-requests-and-configuration-questions)
+  - [Code format](#code-format)
+  - [Issue fixed in newer version](#issue-fixed-in-newer-version)
+  - [Improperly formatted merge request](#improperly-formatted-merge-request)
+  - [Inactivity close of an issue](#inactivity-close-of-an-issue)
+  - [Inactivity close of a merge request](#inactivity-close-of-a-merge-request)
+  - [Accepting merge requests](#accepting-merge-requests)
+  - [Only accepting merge requests with green tests](#only-accepting-merge-requests-with-green-tests)
+  - [Closing down the issue tracker on GitHub](#closing-down-the-issue-tracker-on-github)
+
+<!-- END doctoc generated TOC please keep comment here to allow auto update -->
+
+---
 ## Purpose of describing the contributing process
-Below we describe the contributing process to GitLab for two reasons. So that
-contributors know what to expect from maintainers (possible responses, friendly
-treatment, etc.). And so that maintainers know what to expect from contributors
-(use the latest version, ensure that the issue is addressed, friendly treatment,
-etc.).
+Below we describe the contributing process to GitLab for two reasons:
+
+1. Contributors know what to expect from maintainers (possible responses, friendly
+  treatment, etc.)
+1. Maintainers know what to expect from contributors (use the latest version,
+  ensure that the issue is addressed, friendly treatment, etc.).
 - [GitLab Inc engineers should refer to the engineering workflow document](https://about.gitlab.com/handbook/engineering/workflow/)
 ## Common actions
-### Issue triaging
-
-Our issue triage policies are [described in our handbook]. You are very welcome
-to help the GitLab team triage issues. We also organize [issue bash events] once
-every quarter.
-
-The most important thing is making sure valid issues receive feedback from the
-development team. Therefore the priority is mentioning developers that can help
-on those issues. Please select someone with relevant experience from
-[GitLab team][team]. If there is nobody mentioned with that expertise
-look in the commit history for the affected files to find someone. Avoid
-mentioning the lead developer, this is the person that is least likely to give a
-timely response. If the involvement of the lead developer is needed the other
-core team members will mention this person.
-
-[described in our handbook]: https://about.gitlab.com/handbook/engineering/issues/issue-triage-policies/
-[issue bash events]: https://gitlab.com/gitlab-org/gitlab-ce/issues/17815
-
 ### Merge request coaching
 Several people from the [GitLab team][team] are helping community members to get
@@ -37,12 +55,6 @@ their contributions accepted by meeting our [Definition of done][done].
 What you can expect from them is described at https://about.gitlab.com/jobs/merge-request-coach/.
-## Workflow labels
-
-Labelling issues is described in the [GitLab Inc engineering workflow].
-
-[GitLab Inc engineering workflow]: https://about.gitlab.com/handbook/engineering/workflow/#labelling-issues
-
 ## Assigning issues
 If an issue is complex and needs the attention of a specific person, assignment is a good option but assigning issues might discourage other people from contributing to that issue. We need all the contributions we can get so this should never be discouraged. Also, an assigned person might not have time for a few weeks, so others should feel free to takeover.
@@ -146,6 +158,29 @@ release should have the correct milestone assigned _and_ have the label
 Merge requests without a milestone and this label will
 not be merged into any stable branches.
+## Release retrospective and kickoff
+
+### Retrospective
+
+After each release, we have a retrospective call where we discuss what went well,
+what went wrong, and what we can improve for the next release. The
+[retrospective notes] are public and you are invited to comment on them.
+If you're interested, you can even join the
+[retrospective call][retro-kickoff-call], on the first working day after the
+22nd at 6pm CET / 9am PST.
+
+### Kickoff
+
+Before working on the next release, we have a
+kickoff call to explain what we expect to ship in the next release. The
+[kickoff notes] are public and you are invited to comment on them.
+If you're interested, you can even join the [kickoff call][retro-kickoff-call],
+on the first working day after the 7th at 6pm CET / 9am PST..
+
+[retrospective notes]: https://docs.google.com/document/d/1nEkM_7Dj4bT21GJy0Ut3By76FZqCfLBmFQNVThmW2TY/edit?usp=sharing
+[kickoff notes]: https://docs.google.com/document/d/1ElPkZ90A8ey_iOkTvUs_ByMlwKK6NAB2VOK5835wYK0/edit?usp=sharing
+[retro-kickoff-call]: https://gitlab.zoom.us/j/918821206
+
 ## Copy & paste responses
 ### Improperly formatted issue

a

+xxxxx
+
+xx
+
+xxx
+
+xxx
\ No newline at end of file

app/assets/javascripts/autosave.js

 /* eslint-disable func-names, space-before-function-paren, wrap-iife, no-param-reassign, quotes, prefer-template, no-var, one-var, no-unused-vars, one-var-declaration-per-line, no-void, consistent-return, no-empty, max-len */
+import AccessorUtilities from './lib/utils/accessor';
 window.Autosave = (function() {
   function Autosave(field, key) {
     this.field = field;
+    this.isLocalStorageAvailable = AccessorUtilities.isLocalStorageAccessSafe();
+
     if (key.join != null) {
       key = key.join("/");
     }
@@ -17,16 +20,12 @@ window.Autosave = (function() {
   }
   Autosave.prototype.restore = function() {
-    var e, text;
-    if (window.localStorage == null) {
-      return;
-    }
-    try {
-      text = window.localStorage.getItem(this.key);
-    } catch (error) {
-      e = error;
-      return;
-    }
+    var text;
+
+    if (!this.isLocalStorageAvailable) return;
+
+    text = window.localStorage.getItem(this.key);
+
     if ((text != null ? text.length : void 0) > 0) {
       this.field.val(text);
     }
@@ -35,27 +34,22 @@ window.Autosave = (function() {
   Autosave.prototype.save = function() {
     var text;
-    if (window.localStorage == null) {
-      return;
-    }
     text = this.field.val();
-    if ((text != null ? text.length : void 0) > 0) {
-      try {
-        return window.localStorage.setItem(this.key, text);
-      } catch (error) {}
-    } else {
-      return this.reset();
+
+    if (this.isLocalStorageAvailable && (text != null ? text.length : void 0) > 0) {
+      return window.localStorage.setItem(this.key, text);
     }
+
+    return this.reset();
   };
   Autosave.prototype.reset = function() {
-    if (window.localStorage == null) {
-      return;
-    }
-    try {
-      return window.localStorage.removeItem(this.key);
-    } catch (error) {}
+    if (!this.isLocalStorageAvailable) return;
+
+    return window.localStorage.removeItem(this.key);
   };
   return Autosave;
 })();
+
+export default window.Autosave;

app/assets/javascripts/behaviors/gl_emoji/unicode_support_map.js

+import AccessorUtilities from '../../lib/utils/accessor';
+
 const unicodeSupportTestMap = {
   // man, student (emojione does not have any of these yet), http://emojipedia.org/emoji-zwj-sequences/
   // occupationZwj: '\u{1F468}\u{200D}\u{1F393}',
@@ -140,16 +142,25 @@ function generateUnicodeSupportMap(testMap) {
 function getUnicodeSupportMap() {
   let unicodeSupportMap;
-  const userAgentFromCache = window.localStorage.getItem('gl-emoji-user-agent');
+  let userAgentFromCache;
+
+  const isLocalStorageAvailable = AccessorUtilities.isLocalStorageAccessSafe();
+
+  if (isLocalStorageAvailable) userAgentFromCache = window.localStorage.getItem('gl-emoji-user-agent');
+
   try {
     unicodeSupportMap = JSON.parse(window.localStorage.getItem('gl-emoji-unicode-support-map'));
   } catch (err) {
     // swallow
   }
+
   if (!unicodeSupportMap || userAgentFromCache !== navigator.userAgent) {
     unicodeSupportMap = generateUnicodeSupportMap(unicodeSupportTestMap);
-    window.localStorage.setItem('gl-emoji-user-agent', navigator.userAgent);
-    window.localStorage.setItem('gl-emoji-unicode-support-map', JSON.stringify(unicodeSupportMap));
+
+    if (isLocalStorageAvailable) {
+      window.localStorage.setItem('gl-emoji-user-agent', navigator.userAgent);
+      window.localStorage.setItem('gl-emoji-unicode-support-map', JSON.stringify(unicodeSupportMap));
+    }
   }
   return unicodeSupportMap;

app/assets/javascripts/behaviors/quick_submit.js

@@ -43,8 +43,8 @@ $(document).on('keydown.quick_submit', '.js-quick-submit', (e) => {
   const $submitButton = $form.find('input[type=submit], button[type=submit]');
   if (!$submitButton.attr('disabled')) {
+    $submitButton.trigger('click', [e]);
     $submitButton.disable();
-    $form.submit();
   }
 });

app/assets/javascripts/blob/balsamiq/balsamiq_viewer.js

+import sqljs from 'sql.js';
+import { template as _template } from 'underscore';
+
+const PREVIEW_TEMPLATE = _template(`
+  <div class="panel panel-default">
+    <div class="panel-heading"><%- name %></div>
+    <div class="panel-body">
+      <img class="img-thumbnail" src="data:image/png;base64,<%- image %>"/>
+    </div>
+  </div>
+`);
+
+class BalsamiqViewer {
+  constructor(viewer) {
+    this.viewer = viewer;
+  }
+
+  loadFile(endpoint) {
+    return new Promise((resolve, reject) => {
+      const xhr = new XMLHttpRequest();
+
+      xhr.open('GET', endpoint, true);
+      xhr.responseType = 'arraybuffer';
+      xhr.onload = loadEvent => this.fileLoaded(loadEvent, resolve, reject);
+      xhr.onerror = reject;
+
+      xhr.send();
+    });
+  }
+
+  fileLoaded(loadEvent, resolve, reject) {
+    if (loadEvent.target.status !== 200) return reject();
+
+    this.renderFile(loadEvent);
+
+    return resolve();
+  }
+
+  renderFile(loadEvent) {
+    const container = document.createElement('ul');
+
+    this.initDatabase(loadEvent.target.response);
+
+    const previews = this.getPreviews();
+    previews.forEach((preview) => {
+      const renderedPreview = this.renderPreview(preview);
+
+      container.appendChild(renderedPreview);
+    });
+
+    container.classList.add('list-inline');
+    container.classList.add('previews');
+
+    this.viewer.appendChild(container);
+  }
+
+  initDatabase(data) {
+    const previewBinary = new Uint8Array(data);
+
+    this.database = new sqljs.Database(previewBinary);
+  }
+
+  getPreviews() {
+    const thumbnails = this.database.exec('SELECT * FROM thumbnails');
+
+    return thumbnails[0].values.map(BalsamiqViewer.parsePreview);
+  }
+
+  getResource(resourceID) {
+    const resources = this.database.exec(`SELECT * FROM resources WHERE id = '${resourceID}'`);
+
+    return resources[0];
+  }
+
+  renderPreview(preview) {
+    const previewElement = document.createElement('li');
+
+    previewElement.classList.add('preview');
+    previewElement.innerHTML = this.renderTemplate(preview);
+
+    return previewElement;
+  }
+
+  renderTemplate(preview) {
+    const resource = this.getResource(preview.resourceID);
+    const name = BalsamiqViewer.parseTitle(resource);
+    const image = preview.image;
+
+    const template = PREVIEW_TEMPLATE({
+      name,
+      image,
+    });
+
+    return template;
+  }
+
+  static parsePreview(preview) {
+    return JSON.parse(preview[1]);
+  }
+
+  /*
+   * resource = {
+   *   columns: ['ID', 'BRANCHID', 'ATTRIBUTES', 'DATA'],
+   *   values: [['id', 'branchId', 'attributes', 'data']],
+   * }
+   *
+   * 'attributes' being a JSON string containing the `name` property.
+   */
+  static parseTitle(resource) {
+    return JSON.parse(resource.values[0][2]).name;
+  }
+}
+
+export default BalsamiqViewer;

app/assets/javascripts/blob/balsamiq_viewer.js

+/* global Flash */
+
+import BalsamiqViewer from './balsamiq/balsamiq_viewer';
+
+function onError() {
+  const flash = new window.Flash('Balsamiq file could not be loaded.');
+
+  return flash;
+}
+
+function loadBalsamiqFile() {
+  const viewer = document.getElementById('js-balsamiq-viewer');
+
+  if (!(viewer instanceof Element)) return;
+
+  const endpoint = viewer.dataset.endpoint;
+
+  const balsamiqViewer = new BalsamiqViewer(viewer);
+  balsamiqViewer.loadFile(endpoint).catch(onError);
+}
+
+$(loadBalsamiqFile);

app/assets/javascripts/blob/file_template_mediator.js

@@ -99,7 +99,7 @@ export default class FileTemplateMediator {
     });
   }
-  selectTemplateType(item, el, e) {
+  selectTemplateType(item, e) {
     if (e) {
       e.preventDefault();
     }
@@ -117,6 +117,10 @@ export default class FileTemplateMediator {
     this.cacheToggleText();
   }
+  selectTemplateTypeOptions(options) {
+    this.selectTemplateType(options.selectedObj, options.e);
+  }
+
   selectTemplateFile(selector, query, data) {
     selector.renderLoading();
     // in case undo menu is already already there