Add latest changes from gitlab-org/gitlab@master

doc/development/documentation/index.md

@@ -67,8 +67,6 @@ This document was moved to [another location](path/to/new_doc.md).
 where `path/to/new_doc.md` is the relative path to the root directory `doc/`.
----
-
 For example, if you move `doc/workflow/lfs/lfs_administration.md` to
 `doc/administration/lfs.md`, then the steps would be:

doc/development/documentation/styleguide.md

@@ -604,9 +604,6 @@ Inside the document:
 - Always use a proper description for what the image is about. That way, when a
   browser fails to show the image, this text will be used as an alternative
   description.
-- If there are consecutive images with little text between them, always add
-  three dashes (`---`) between the image and the text to create a horizontal
-  line for better clarity.
 - If a heading is placed right after an image, always add three dashes (`---`)
   between the image and the heading.

doc/install/openshift_and_gitlab/index.md

@@ -23,8 +23,6 @@ tools that will help us achieve our goal.
 For a video demonstration on installing GitLab on OpenShift, check the article [In 13 minutes from Kubernetes to a complete application development tool](https://about.gitlab.com/blog/2016/11/14/idea-to-production/).
----
-
 ## Prerequisites
 CAUTION: **Caution:** This information is no longer up to date, as the current versions

doc/user/admin_area/settings/continuous_integration.md

@@ -134,6 +134,19 @@ Once that time passes, the jobs will be archived and no longer able to be
 retried. Make it empty to never expire jobs. It has to be no less than 1 day,
 for example: <code>15 days</code>, <code>1 month</code>, <code>2 years</code>.
+## Default CI configuration path
+
+> [Introduced](https://gitlab.com/gitlab-org/gitlab/merge_requests/18073) in GitLab 12.5.
+
+The default CI configuration file path for new projects can be set in the Admin
+area of your GitLab instance (`.gitlab-ci.yml` if not set):
+
+1. Go to **Admin area > Settings > Continuous Integration and Deployment**.
+1. Input the new path in the **Default CI configuration path** field.
+1. Hit **Save changes** for the changes to take effect.
+
+It is also possible to specify a [custom CI configuration path for a specific project](../../project/pipelines/settings.md#custom-ci-configuration-path).
+
 <!-- ## Troubleshooting
 Include any troubleshooting steps that you can foresee. If you know beforehand what issues

doc/user/clusters/applications.md

@@ -263,7 +263,7 @@ This feature:
   For example:
   ```sh
-  kubectl -n gitlab-managed-apps exec -it $(kubectl get pods -n gitlab-managed-apps | grep 'ingress-controller' | awk '{print $1}') -- tail -f /var/log/modsec_audit.log
+  kubectl -n gitlab-managed-apps exec -it $(kubectl get pods -n gitlab-managed-apps | grep 'ingress-controller' | awk '{print $1}') -- tail -f /var/log/modsec/audit.log
   ```
 There is a small performance overhead by enabling `modsecurity`. However, if this is

doc/user/permissions.md

@@ -73,7 +73,7 @@ The following table depicts the various user permission levels in a project.
 | See a commit status                               |         | ✓          | ✓           | ✓        | ✓      |
 | See a container registry                          |         | ✓          | ✓           | ✓        | ✓      |
 | See environments                                  |         | ✓          | ✓           | ✓        | ✓      |
-| See a list of merge requests                      | ✓ (*1*) | ✓          | ✓           | ✓        | ✓      |
+| See a list of merge requests                      |         | ✓          | ✓           | ✓        | ✓      |
 | View project statistics                           |         | ✓          | ✓           | ✓        | ✓      |
 | View Error Tracking list                          |         | ✓          | ✓           | ✓        | ✓      |
 | Pull from [Conan repository](packages/conan_repository/index.md), [Maven repository](packages/maven_repository/index.md), or [NPM registry](packages/npm_registry/index.md) **(PREMIUM)** |         | ✓          | ✓           | ✓        | ✓      |
@@ -83,7 +83,7 @@ The following table depicts the various user permission levels in a project.
 | Push to non-protected branches                    |         |            | ✓           | ✓        | ✓      |
 | Force push to non-protected branches              |         |            | ✓           | ✓        | ✓      |
 | Remove non-protected branches                     |         |            | ✓           | ✓        | ✓      |
-| Create new merge request                          | ✓ (*1*) | ✓          | ✓           | ✓        | ✓      |
+| Create new merge request                          |         | ✓          | ✓           | ✓        | ✓      |
 | Assign merge requests                             |         |            | ✓           | ✓        | ✓      |
 | Label merge requests                              |         |            | ✓           | ✓        | ✓      |
 | Lock merge request threads                        |         |            | ✓           | ✓        | ✓      |

doc/user/profile/notifications.md

@@ -77,7 +77,7 @@ To select a notification level for a project, use either of these methods:
 1. Locate the project in the **Projects** section.
 1. Select the desired [notification level](#notification-levels).
----
+Or:
 1. Navigate to the project's page.
 1. Click the notification dropdown, marked with a bell icon.

doc/user/project/import/gitea.md

@@ -75,7 +75,5 @@ You also can:
 ![Gitea importer page](img/import_projects_from_gitea_importer_v12_3.png)
----
-
 You can also choose a different name for the project and a different namespace,
 if you have the privileges to do so.

doc/user/project/merge_requests/merge_request_approvals.md

@@ -219,8 +219,6 @@ and the project level approvers are changed after a merge request is created,
 the merge request retains the previous approvers.
 However, the approvers can be changed by [editing the merge request](#overriding-the-merge-request-approvals-default-settings).
----
-
 The default approval settings can now be overridden when creating a
 [merge request](index.md) or by editing it after it's been created:

lib/api/settings.rb

@@ -42,6 +42,7 @@ module API
       optional :asset_proxy_whitelist, type: Array[String], coerce_with: Validations::Types::CommaSeparatedToArray.coerce, desc: 'Assets that match these domain(s) will NOT be proxied. Wildcards allowed. Your GitLab installation URL is automatically whitelisted.'
       optional :container_registry_token_expire_delay, type: Integer, desc: 'Authorization token duration (minutes)'
       optional :default_artifacts_expire_in, type: String, desc: "Set the default expiration time for each job's artifacts"
+      optional :default_ci_config_path, type: String, desc: 'The instance default CI configuration path for new projects'
       optional :default_project_creation, type: Integer, values: ::Gitlab::Access.project_creation_values, desc: 'Determine if developers can create projects in the group'
       optional :default_branch_protection, type: Integer, values: ::Gitlab::Access.protection_values, desc: 'Determine if developers can push to master'
       optional :default_group_visibility, type: String, values: Gitlab::VisibilityLevel.string_values, desc: 'The default group visibility'

locale/gitlab.pot

@@ -5241,6 +5241,9 @@ msgstr ""
 msgid "Default Branch"
 msgstr ""
+msgid "Default CI configuration path"
+msgstr ""
+
 msgid "Default artifacts expiration"
 msgstr ""
@@ -16840,6 +16843,9 @@ msgstr ""
 msgid "The content of this page is not encoded in UTF-8. Edits can only be made via the Git repository."
 msgstr ""
+msgid "The default CI configuration path for new projects."
+msgstr ""
+
 msgid "The dependency list details information about the components used within your project."
 msgstr ""

spec/lib/gitlab/import_export/all_models.yml

@@ -120,6 +120,7 @@ merge_requests:
 - pipelines_for_merge_request
 - merge_request_assignees
 - suggestions
+- unresolved_notes
 - assignees
 - reviews
 - approval_rules

spec/models/clusters/applications/ingress_spec.rb

@@ -165,6 +165,12 @@ describe Clusters::Applications::Ingress do
         expect(subject.values).to include('extraVolumes')
         expect(subject.values).to include('extraVolumeMounts')
       end
+
+      it 'includes modsecurity sidecar container' do
+        expect(subject.values).to include('modsecurity-log-volume')
+
+        expect(subject.values).to include('extraContainers')
+      end
     end
     context 'when ingress_modsecurity is disabled' do
@@ -190,6 +196,12 @@ describe Clusters::Applications::Ingress do
         expect(subject.values).not_to include('extraVolumes')
         expect(subject.values).not_to include('extraVolumeMounts')
       end
+
+      it 'excludes modsecurity sidecar container' do
+        expect(subject.values).not_to include('modsecurity-log-volume')
+
+        expect(subject.values).not_to include('extraContainers')
+      end
     end
   end
 end

spec/models/concerns/noteable_spec.rb

@@ -177,50 +177,6 @@ describe Noteable do
       end
     end
-    describe "#discussions_to_be_resolved?" do
-      context "when discussions are not resolvable" do
-        before do
-          allow(subject).to receive(:discussions_resolvable?).and_return(false)
-        end
-
-        it "returns false" do
-          expect(subject.discussions_to_be_resolved?).to be false
-        end
-      end
-
-      context "when discussions are resolvable" do
-        before do
-          allow(subject).to receive(:discussions_resolvable?).and_return(true)
-
-          allow(first_discussion).to receive(:resolvable?).and_return(true)
-          allow(second_discussion).to receive(:resolvable?).and_return(false)
-          allow(third_discussion).to receive(:resolvable?).and_return(true)
-        end
-
-        context "when all resolvable discussions are resolved" do
-          before do
-            allow(first_discussion).to receive(:resolved?).and_return(true)
-            allow(third_discussion).to receive(:resolved?).and_return(true)
-          end
-
-          it "returns false" do
-            expect(subject.discussions_to_be_resolved?).to be false
-          end
-        end
-
-        context "when some resolvable discussions are not resolved" do
-          before do
-            allow(first_discussion).to receive(:resolved?).and_return(true)
-            allow(third_discussion).to receive(:resolved?).and_return(false)
-          end
-
-          it "returns true" do
-            expect(subject.discussions_to_be_resolved?).to be true
-          end
-        end
-      end
-    end
-
     describe "#discussions_to_be_resolved" do
       before do
         allow(first_discussion).to receive(:to_be_resolved?).and_return(true)

spec/models/project_spec.rb

@@ -2029,24 +2029,37 @@ describe Project do
   end
   describe '#ci_config_path=' do
-    let(:project) { create(:project) }
-    it 'sets nil' do
-      project.update!(ci_config_path: nil)
-      expect(project.ci_config_path).to be_nil
+    using RSpec::Parameterized::TableSyntax
+    let(:project) { create(:project) }
+    where(:default_ci_config_path, :project_ci_config_path, :expected_ci_config_path) do
+      nil           | :notset            | :default
+      nil           | nil                | :default
+      nil           | ''                 | :default
+      nil           | "cust\0om/\0/path" | 'custom//path'
+      ''            | :notset            | :default
+      ''            | nil                | :default
+      ''            | ''                 | :default
+      ''            | "cust\0om/\0/path" | 'custom//path'
+      'global/path' | :notset            | 'global/path'
+      'global/path' | nil                | :default
+      'global/path' | ''                 | :default
+      'global/path' | "cust\0om/\0/path" | 'custom//path'
     end
-    it 'sets a string' do
-      project.update!(ci_config_path: 'foo/.gitlab_ci.yml')
-
-      expect(project.ci_config_path).to eq('foo/.gitlab_ci.yml')
-    end
-    it 'sets a string but removes all null characters' do
-      project.update!(ci_config_path: "f\0oo/\0/.gitlab_ci.yml")
-      expect(project.ci_config_path).to eq('foo//.gitlab_ci.yml')
+    with_them do
+      before do
+        stub_application_setting(default_ci_config_path: default_ci_config_path)
+        if project_ci_config_path != :notset
+          project.ci_config_path = project_ci_config_path
+        end
+      end
+      it 'returns the correct path' do
+        expect(project.ci_config_path.presence || :default).to eq(expected_ci_config_path)
+      end
     end
   end

spec/requests/api/merge_requests_spec.rb

@@ -701,16 +701,20 @@ describe API::MergeRequests do
       expect(json_response.first['id']).to eq merge_request_closed.id
     end
-    it 'avoids N+1 queries' do
-      control = ActiveRecord::QueryRecorder.new do
-        get api("/projects/#{project.id}/merge_requests", user)
-      end.count
-      create(:merge_request, author: user, assignees: [user], source_project: project, target_project: project, created_at: base_time)
-      expect do
-        get api("/projects/#{project.id}/merge_requests", user)
-      end.not_to exceed_query_limit(control)
+    context 'a project which enforces all discussions to be resolved' do
+      let!(:project) { create(:project, :repository, only_allow_merge_if_all_discussions_are_resolved: true) }
+      it 'avoids N+1 queries' do
+        control = ActiveRecord::QueryRecorder.new do
+          get api("/projects/#{project.id}/merge_requests", user)
+        end.count
+        create(:merge_request, author: user, assignees: [user], source_project: project, target_project: project, created_at: base_time)
+
+        expect do
+          get api("/projects/#{project.id}/merge_requests", user)
+        end.not_to exceed_query_limit(control)
+      end
     end
   end

spec/requests/api/settings_spec.rb

@@ -18,6 +18,7 @@ describe API::Settings, 'Settings' do
       expect(json_response['password_authentication_enabled']).to be_truthy
       expect(json_response['plantuml_enabled']).to be_falsey
       expect(json_response['plantuml_url']).to be_nil
+      expect(json_response['default_ci_config_path']).to be_nil
       expect(json_response['default_project_visibility']).to be_a String
       expect(json_response['default_snippet_visibility']).to be_a String
       expect(json_response['default_group_visibility']).to be_a String
@@ -49,6 +50,7 @@ describe API::Settings, 'Settings' do
       it "updates application settings" do
         put api("/application/settings", admin),
           params: {
+            default_ci_config_path: 'debian/salsa-ci.yml',
             default_projects_limit: 3,
             default_project_creation: 2,
             password_authentication_enabled_for_web: false,
@@ -80,6 +82,7 @@ describe API::Settings, 'Settings' do
           }
         expect(response).to have_gitlab_http_status(200)
+        expect(json_response['default_ci_config_path']).to eq('debian/salsa-ci.yml')
         expect(json_response['default_projects_limit']).to eq(3)
         expect(json_response['default_project_creation']).to eq(::Gitlab::Access::DEVELOPER_MAINTAINER_PROJECT_ACCESS)
         expect(json_response['password_authentication_enabled_for_web']).to be_falsey

vendor/ingress/modsecurity.conf

@@ -236,7 +236,8 @@ SecAuditLogParts ABIJDEFHZ
 # assumes that you will use the audit log only ocassionally.
 #
 # SecAuditLogType Serial
-SecAuditLog /var/log/modsec_audit.log
+SecAuditLogFormat JSON
+SecAuditLog /var/log/modsec/audit.log
 # Specify the path for concurrent audit logging.
 #SecAuditLogStorageDir /opt/modsecurity/var/audit/