Merge branch 'master' into 11-10-stable

app/serializers/variable_entity.rb

@@ -6,4 +6,5 @@ class VariableEntity < Grape::Entity
   expose :value
   expose :protected?, as: :protected
+  expose :masked?, as: :masked
 end

app/services/git/tag_push_service.rb

@@ -13,7 +13,6 @@ module Git
       EventCreateService.new.push(project, current_user, push_data)
       Ci::CreatePipelineService.new(project, current_user, push_data).execute(:push, pipeline_options)
-      SystemHooksService.new.execute_hooks(build_system_push_data, :tag_push_hooks)
       project.execute_hooks(push_data.dup, :tag_push_hooks)
       project.execute_services(push_data.dup, :tag_push_hooks)
@@ -50,17 +49,6 @@ module Git
         push_options: params[:push_options] || [])
     end
-    def build_system_push_data
-      Gitlab::DataBuilder::Push.build(
-        project,
-        current_user,
-        params[:oldrev],
-        params[:newrev],
-        params[:ref],
-        [],
-        '')
-    end
-
     def pipeline_options
       {} # to be overridden in EE
     end

app/services/quick_actions/interpret_service.rb

@@ -96,14 +96,27 @@ module QuickActions
     end
     def find_labels(labels_params = nil)
+      extract_references(labels_params, :label) | find_labels_by_name_no_tilde(labels_params)
+    end
+
+    def find_labels_by_name_no_tilde(labels_params)
+      return Label.none if label_with_tilde?(labels_params)
+
       finder_params = { include_ancestor_groups: true }
       finder_params[:project_id] = project.id if project
       finder_params[:group_id] = group.id if group
-      finder_params[:name] = labels_params.split if labels_params
-      result = LabelsFinder.new(current_user, finder_params).execute
-      extract_references(labels_params, :label) | result
+      finder_params[:name] = extract_label_names(labels_params) if labels_params
+      LabelsFinder.new(current_user, finder_params).execute
+    end
+
+    def label_with_tilde?(labels_params)
+      labels_params&.include?('~')
+    end
+    def extract_label_names(labels_params)
+      # '"A" "A B C" A B' => ["A", "A B C", "A", "B"]
+      labels_params.scan(/"([^"]+)"|([^ ]+)/).flatten.compact
     end
     def find_label_references(labels_param)

app/views/ci/variables/_content.html.haml

-= _('Environment variables are applied to environments via the runner. They can be protected by only exposing them to protected branches or tags. You can use environment variables for passwords, secret keys, or whatever you want.')
+= _('Environment variables are applied to environments via the runner. They can be protected by only exposing them to protected branches or tags. Additionally, they will be masked by default so they are hidden in job logs, though they must match certain regexp requirements to do so. You can use environment variables for passwords, secret keys, or whatever you want.')
 = _('You may also add variables that are made available to the running application by prepending the variable key with <code>K8S_SECRET_</code>.').html_safe
 = link_to _('More information'), help_page_path('ci/variables/README', anchor: 'variables')

app/views/ci/variables/_header.html.haml

 - expanded = local_assigns.fetch(:expanded)
 %h4
-  = _('Environment variables')
+  = _('Variables')
   = link_to icon('question-circle'), help_page_path('ci/variables/README', anchor: 'variables'), target: '_blank', rel: 'noopener noreferrer'
 %button.btn.btn-default.js-settings-toggle{ type: 'button' }

app/views/ci/variables/_variable_row.html.haml

@@ -7,12 +7,15 @@
 - value = variable&.value
 - is_protected_default = ci_variable_protected_by_default?
 - is_protected = ci_variable_protected?(variable, only_key_value)
+- is_masked_default = true
+- is_masked = ci_variable_masked?(variable, only_key_value)
 - id_input_name = "#{form_field}[variables_attributes][][id]"
 - destroy_input_name = "#{form_field}[variables_attributes][][_destroy]"
 - key_input_name = "#{form_field}[variables_attributes][][key]"
 - value_input_name = "#{form_field}[variables_attributes][][secret_value]"
 - protected_input_name = "#{form_field}[variables_attributes][][protected]"
+- masked_input_name = "#{form_field}[variables_attributes][][masked]"
 %li.js-row.ci-variable-row{ data: { is_persisted: "#{!id.nil?}" } }
   .ci-variable-row-body
@@ -22,7 +25,7 @@
       name: key_input_name,
       value: key,
       placeholder: s_('CiVariables|Input variable key') }
-    .ci-variable-body-item
+    .ci-variable-body-item.gl-show-field-errors
       .form-control.js-secret-value-placeholder.qa-ci-variable-input-value{ class: ('hide' unless id) }
         = '*' * 20
       %textarea.js-ci-variable-input-value.js-secret-value.qa-ci-variable-input-value.form-control{ class: ('hide' if id),
@@ -30,6 +33,7 @@
         name: value_input_name,
         placeholder: s_('CiVariables|Input variable value') }
         = value
+      %p.masking-validation-error.gl-field-error.hide= s_("CiVariables|This variable will not be masked")
     - unless only_key_value
       .ci-variable-body-item.ci-variable-protected-item
         .append-right-default
@@ -45,6 +49,20 @@
           %span.toggle-icon
             = sprite_icon('status_success_borderless', size: 16, css_class: 'toggle-icon-svg toggle-status-checked')
             = sprite_icon('status_failed_borderless', size: 16, css_class: 'toggle-icon-svg toggle-status-unchecked')
+      .ci-variable-body-item.ci-variable-masked-item
+        .append-right-default
+          = s_("CiVariable|Masked")
+        %button{ type: 'button',
+          class: "js-project-feature-toggle project-feature-toggle #{'is-checked' if is_masked}",
+          "aria-label": s_("CiVariable|Toggle masked") }
+          %input{ type: "hidden",
+            class: 'js-ci-variable-input-masked js-project-feature-toggle-input',
+            name: masked_input_name,
+            value: is_masked,
+            data: { default: is_masked_default.to_s } }
+          %span.toggle-icon
+            = sprite_icon('status_success_borderless', size: 16, css_class: 'toggle-icon-svg toggle-status-checked')
+            = sprite_icon('status_failed_borderless', size: 16, css_class: 'toggle-icon-svg toggle-status-unchecked')
       = render_if_exists 'ci/variables/environment_scope', form_field: form_field, variable: variable
   %button.js-row-remove-button.ci-variable-row-remove-button{ type: 'button', 'aria-label': s_('CiVariables|Remove variable row') }
     = icon('minus-circle')

app/views/projects/_home_panel.html.haml

@@ -12,7 +12,7 @@
             = @project.name
             %span.visibility-icon.text-secondary.prepend-left-4.has-tooltip{ data: { container: 'body' }, title: visibility_icon_description(@project) }
               = visibility_level_icon(@project.visibility_level, fw: false, options: {class: 'icon'})
-        .home-panel-metadata.d-flex.align-items-center.text-secondary
+        .home-panel-metadata.d-flex.flex-wrap.text-secondary
           - if can?(current_user, :read_project, @project)
             %span.text-secondary
               = s_('ProjectPage|Project ID: %{project_id}') % { project_id: @project.id }
@@ -20,7 +20,7 @@
             %span.access-request-links.prepend-left-8
               = render 'shared/members/access_request_links', source: @project
           - if @project.tag_list.present?
-            %span.home-panel-topic-list.d-inline-flex.prepend-left-8
+            %span.home-panel-topic-list.mt-2.w-100.d-inline-flex
               = sprite_icon('tag', size: 16, css_class: 'icon append-right-4')
               - @project.topics_to_show.each do |topic|

app/views/projects/diffs/_replaced_image_diff.html.haml

@@ -37,7 +37,7 @@
     .swipe-frame
       .frame.deleted
         = image_tag(old_blob_raw_url, alt: diff_file.old_path, lazy: false)
-      .swipe-wrap
+      .swipe-wrap.left-oriented
         = render partial: "projects/diffs/image_diff_frame", locals: { class_name: "added js-image-frame #{class_name}", position: position, note_type: DiffNote.name, image_path: blob_raw_url, alt: diff_file.new_path }
       %span.swipe-bar
         %span.top-handle

changelogs/unreleased/13784-validate-variables-for-masking.yml

+---
+title: Add control for masking variable values in runner logs
+merge_request: 26751
+author:
+type: added

changelogs/unreleased/29249-show-download-diff-even-when-merge-request-is-closed.yml

+---
+title: Show download diff links for closed MRs
+merge_request: 26772
+author:
+type: changed

changelogs/unreleased/47234-composable-auto-devops.yml

+---
+title: Split Auto-DevOps.gitlab-ci.yml into reusable templates
+merge_request: 26520
+author:
+type: changed

changelogs/unreleased/47771-highlighting-in-diff.yml

+---
+title: Enabled text selection highlighting in diffs in Web IDE
+merge_request: 26721
+author: Isaac Smith
+type: fixed

changelogs/unreleased/52560-fix-duplicate-tag-system-hooks.yml

+---
+title: Only execute system hooks once when pushing tags
+merge_request: 26888
+author:
+type: fixed

changelogs/unreleased/53459-quick-action-adds-multiple-labels-to-issue-if-middle-words-overlap-with-existing-label.yml

+---
+title: Fix quick actions add label name middle word overlaps
+merge_request: 26602
+author: Jacopo Beschi @jacopo-beschi
+type: fixed

changelogs/unreleased/55268-exclude-system-notes-from-commits-in-mr.yml

+---
+title: Exclude system notes from commits in merge request discussions
+merge_request: 26396
+author:
+type: fixed

changelogs/unreleased/55980-remove-add-issue-on-blank-list.yml

+---
+title: Remove non-functional add issue button on welcome list
+merge_request: !26742
+author:
+type: fixed

changelogs/unreleased/59131-set-the-size-of-instance-system-message-text-12px.yml

+---
+title: Update system message banner font size to 12px
+merge_request: 26293
+author:
+type: changed

changelogs/unreleased/ekigbo-extend-timezone-dropdown.yml

+---
+title: Extend timezone dropdown
+merge_request: 26311
+author:
+type: changed

changelogs/unreleased/feature-webide_escaping.yml

+---
+title: Fixed bug with hashes in urls in WebIDE
+merge_request: 54376
+author: Kieran Andrews
+type: fixed

changelogs/unreleased/fix-issues-time-counter.yml

+---
+title: Make time counters show 'just now' for everything under one minute
+merge_request: 25992
+author: Sergiu Marton
+type: changed