Add latest changes from gitlab-org/gitlab@master

app/models/group_group_link.rb

@@ -20,4 +20,8 @@ class GroupGroupLink < ApplicationRecord
   def self.default_access
     Gitlab::Access::DEVELOPER
   end
+
+  def human_access
+    Gitlab::Access.human_access(self.group_access)
+  end
 end

app/models/project_group_link.rb

@@ -21,6 +21,8 @@ class ProjectGroupLink < ApplicationRecord
   after_commit :refresh_group_members_authorized_projects
+  alias_method :shared_with_group, :group
+
   def self.access_options
     Gitlab::Access.options
   end

app/views/admin/application_settings/_gitaly.html.haml

@@ -8,6 +8,9 @@
       .form-text.text-muted
         Timeout for Gitaly calls from the GitLab application (in seconds). This timeout is not enforced
         for git fetch/push operations or Sidekiq jobs.
+        This timeout should be less than the worker timeout. If a Gitaly call timeout would exceed the
+        worker timeout, the remaining time from the worker timeout would be used to avoid having to terminate
+        the worker.
     .form-group
       = f.label :gitaly_timeout_fast, 'Fast Timeout Period', class: 'label-bold'
       = f.number_field :gitaly_timeout_fast, class: 'form-control'

app/views/groups/group_members/_new_group_member.html.haml

-= form_for @group_member, url: group_group_members_path(@group), html: { class: 'users-project-form users-group-form' } do |f|
-  .row
-    .col-md-4.col-lg-6
-      = users_select_tag(:user_ids, group_member_select_options)
-      .form-text.text-muted.append-bottom-10
-        Search for members by name, username, or email, or invite new ones using their email address.
-
-    .col-md-3.col-lg-2
-      = select_tag :access_level, options_for_select(GroupMember.access_level_roles, @group_member.access_level), class: "form-control project-access-select"
-      .form-text.text-muted.append-bottom-10
-        = link_to "Read more", help_page_path("user/permissions")
-        about role permissions
-
-    .col-md-3.col-lg-2
-      .clearable-input
-        = text_field_tag :expires_at, nil, class: 'form-control js-access-expiration-date', placeholder: 'Expiration date'
-        %i.clear-icon.js-clear-input
-      .form-text.text-muted.append-bottom-10
-        On this date, the member(s) will automatically lose access to this group and all of its projects.
-
-    .col-md-2
-      = f.submit 'Add to group', class: "btn btn-success btn-block", data: { qa_selector: 'add_to_group_button' }

app/views/groups/group_members/index.html.haml

-- page_title _("Members")
+- page_title _("Group members")
 - can_manage_members = can?(current_user, :admin_group_member, @group)
 - show_invited_members = can_manage_members && @invited_members.exists?
 - pending_active = params[:search_invited].present?
+- total_count = @members.count + @group.shared_with_group_links.count
 .project-members-page.prepend-top-default
   %h4
-    = _("Members")
+    = _("Group members")
   %hr
   - if can_manage_members
-    .project-members-new.append-bottom-default
-      %p.clearfix
-        = _("Add new member to %{strong_start}%{group_name}%{strong_end}").html_safe % { group_name: @group.name, strong_start: '<strong>'.html_safe, strong_end: '</strong>'.html_safe }
-      = render "new_group_member"
+    - if Feature.enabled?(:share_group_with_group)
+      %ul.nav-links.nav.nav-tabs.gitlab-tabs{ role: 'tablist' }
+        %li.nav-tab{ role: 'presentation' }
+          %a.nav-link.active{ href: '#invite-member-pane', id: 'invite-member-tab', data: { toggle: 'tab' }, role: 'tab' }= _("Invite member")
+          %li.nav-tab{ role: 'presentation' }
+            %a.nav-link{ href: '#invite-group-pane', id: 'invite-group-tab', data: { toggle: 'tab', qa_selector: 'invite_group_tab' }, role: 'tab' }= _("Invite group")
+      .tab-content.gitlab-tab-content
+        .tab-pane.active{ id: 'invite-member-pane', role: 'tabpanel' }
+          = render_invite_member_for_group(@group, @group_member.access_level)
+        - if Feature.enabled?(:share_group_with_group)
+          .tab-pane{ id: 'invite-group-pane', role: 'tabpanel' }
+            = render 'shared/members/invite_group', submit_url: group_group_links_path(@group), access_levels: GroupMember.access_level_roles, default_access_level: @group_member.access_level, group_link_field: 'shared_with_group_id', group_access_field: 'shared_group_access'
+    - else
+      = render_invite_member_for_group(@group, @group_member.access_level)
     = render 'shared/members/requests', membership_source: @group, requesters: @requesters
@@ -19,10 +30,10 @@
   %ul.nav-links.mobile-separator.nav.nav-tabs.clearfix
     %li.nav-item
-      = link_to "#existing_members", class: ["nav-link", ("active" unless pending_active)] , 'data-toggle' => 'tab' do
+      = link_to "#existing_shares", class: ["nav-link", ("active" unless pending_active)] , 'data-toggle' => 'tab' do
         %span
-          = _("Existing")
-        %span.badge.badge-pill= @members.total_count
+          = _("Existing shares")
+        %span.badge.badge-pill= total_count
     - if show_invited_members
       %li.nav-item
         = link_to "#invited_members", class: ["nav-link", ("active" if pending_active)], 'data-toggle' => 'tab' do
@@ -31,7 +42,16 @@
           %span.badge.badge-pill= @invited_members.total_count
   .tab-content
-    #existing_members.tab-pane{ :class => ("active" unless pending_active) }
+    #existing_shares.tab-pane{ :class => ("active" unless pending_active) }
+      - if @group.shared_with_group_links.any?
+        .card.card-without-border
+          .d-flex.flex-column.flex-md-row.row-content-block.second-block
+            %span.flex-grow-1.align-self-md-center.col-form-label
+              = _("Groups with access to %{strong_start}%{group_name}%{strong_end}").html_safe % { group_name: @group.name, strong_start: '<strong>'.html_safe, strong_end: '</strong>'.html_safe }
+          %ul.content-list.members-list{ data: { qa_selector: "groups_list" } }
+            - can_admin_member = can?(current_user, :admin_group_member, @group)
+            - @group.shared_with_group_links.each do |group_link|
+              = render 'shared/members/group', group_link: group_link, can_admin_member: can_admin_member, group_link_path: group_group_link_path(@group, group_link)
       .card.card-without-border
         .d-flex.flex-column.flex-md-row.row-content-block.second-block
           %span.flex-grow-1.align-self-md-center.col-form-label
@@ -46,7 +66,7 @@
                 = label_tag '2fa', '2FA', class: 'col-form-label label-bold pr-md-2'
                 = render 'shared/members/filter_2fa_dropdown'
               = render 'shared/members/sort_dropdown'
-        %ul.content-list.members-list
+        %ul.content-list.members-list{ data: { qa_selector: "members_list" } }
           = render partial: 'shared/members/member', collection: @members, as: :member
       = paginate @members, theme: 'gitlab'

app/views/projects/project_members/_groups.html.haml

@@ -3,4 +3,6 @@
     = _("Groups with access to <strong>%{project_name}</strong>").html_safe % { project_name: sanitize(@project.name, tags: []) }
     %span.badge.badge-pill= group_links.size
   %ul.content-list.members-list
-    = render partial: 'shared/members/group', collection: group_links, as: :group_link
+    - can_admin_member = can?(current_user, :admin_project_member, @project)
+    - @group_links.each do |group_link|
+      = render 'shared/members/group', group_link: group_link, can_admin_member: can_admin_member, group_link_path: project_group_link_path(@project, group_link)

app/views/projects/project_members/_team.html.haml

@@ -13,5 +13,5 @@
           %button.user-search-btn{ type: "submit", "aria-label" => _("Submit search") }
             = icon("search")
         = render 'shared/members/sort_dropdown'
-  %ul.content-list.members-list.qa-members-list
+  %ul.content-list.members-list{ data: { qa_selector: 'members_list' } }
     = render partial: 'shared/members/member', collection: members, as: :member

app/views/projects/project_members/index.html.haml

@@ -23,13 +23,13 @@
           .tab-content.gitlab-tab-content
             .tab-pane.active{ id: 'invite-member-pane', role: 'tabpanel' }
-              = render 'projects/project_members/new_project_member', tab_title: _('Invite member')
+              = render 'shared/members/invite_member', submit_url: project_project_members_path(@project), access_levels: ProjectMember.access_level_roles, default_access_level: @project_member.access_level, can_import_members?: can_import_members?, import_path: import_project_project_members_path(@project)
             .tab-pane{ id: 'invite-group-pane', role: 'tabpanel', class: ('active' if membership_locked?) }
-              = render 'projects/project_members/new_project_group', tab_title: _('Invite group')
+              = render 'shared/members/invite_group', submit_url: project_group_links_path(@project), access_levels: ProjectGroupLink.access_options, default_access_level: ProjectGroupLink.default_access, group_link_field: 'link_group_id', group_access_field: 'link_group_access'
         - elsif !membership_locked?
-          .invite-member= render 'projects/project_members/new_project_member', tab_title: _('Invite member')
+          .invite-member= render 'shared/members/invite_member', submit_url: project_project_members_path(@project), access_levels: ProjectMember.access_level_roles, default_access_level: @project_member.access_level, can_import_members?: can_import_members?, import_path: import_project_project_members_path(@project)
         - elsif @project.allowed_to_share_with_group?
-          .invite-group= render 'projects/project_members/new_project_group', tab_title: _('Invite group')
+          .invite-group= render 'shared/members/invite_group', access_levels: ProjectGroupLink.access_options, default_access_level: ProjectGroupLink.default_access, submit_url: project_group_links_path(@project), group_link_field: 'link_group_id', group_access_field: 'link_group_access'
         = render 'shared/members/requests', membership_source: @project, requesters: @requesters
         .clearfix

app/views/projects/registry/settings/_index.haml

-#js-registry-settings{ data: { project_id: @project.id, } }
+#js-registry-settings{ data: { project_id: @project.id,
+    cadence_options: cadence_options.to_json,
+    keep_n_options: keep_n_options.to_json,
+    older_than_options: older_than_options.to_json} }

app/views/shared/members/_group.html.haml

 - group_link = local_assigns[:group_link]
-- group = group_link.group
-- can_admin_member = can?(current_user, :admin_project_member, @project)
+- group = group_link.shared_with_group
+- can_admin_member = local_assigns[:can_admin_member]
+- group_link_path = local_assigns[:group_link_path]
 - dom_id = "group_member_#{group_link.id}"
 -# Note this is just for groups. For individual members please see shared/members/_member
@@ -17,7 +18,7 @@
           %span{ class: ('text-warning' if group_link.expires_soon?) }
             = _("Expires in %{expires_at}").html_safe % { expires_at: distance_of_time_in_words_to_now(group_link.expires_at) }
   .controls.member-controls.align-items-center
-    = form_tag project_group_link_path(@project, group_link), method: :put, remote: true, class: 'js-edit-member-form form-group d-sm-flex' do
+    = form_tag group_link_path, method: :put, remote: true, class: 'js-edit-member-form form-group d-sm-flex' do
       = hidden_field_tag "group_link[group_access]", group_link.group_access
       .member-form-control.dropdown.mr-sm-2.d-sm-inline-block
         %button.dropdown-menu-toggle.js-member-permissions-dropdown{ type: "button",
@@ -39,7 +40,7 @@
         = text_field_tag 'group_link[expires_at]', group_link.expires_at, class: 'form-control js-access-expiration-date js-member-update-control', placeholder: _('Expiration date'), id: "member_expires_at_#{group.id}", disabled: !can_admin_member
         %i.clear-icon.js-clear-input
     - if can_admin_member
-      = link_to project_group_link_path(@project, group_link),
+      = link_to group_link_path,
         method: :delete,
         data: { confirm: _("Are you sure you want to remove %{group_name}?") % { group_name: group.name }, qa_selector: 'delete_group_access_link' },
         class: 'btn btn-remove m-0 ml-sm-2 align-self-center' do

app/views/projects/project_members/_new_project_group.html.haml → app/views/shared/members/_invite_group.html.haml

+- access_levels = local_assigns[:access_levels]
+- default_access_level = local_assigns[:default_access_level]
+- submit_url = local_assigns[:submit_url]
+- group_link_field = local_assigns[:group_link_field]
+- group_access_field = local_assigns[:group_access_field]
 .row
   .col-sm-12
-    = form_tag project_group_links_path(@project), class: 'js-requires-input', method: :post do
+    = form_tag submit_url, class: 'invite-group-form js-requires-input', method: :post do
       .form-group
-        = label_tag :link_group_id, _("Select a group to invite"), class: "label-bold"
-        = groups_select_tag(:link_group_id, data: { skip_groups: @skip_groups }, class: "input-clamp qa-group-select-field", required: true)
+        = label_tag group_link_field, _("Select a group to invite"), class: "label-bold"
+        = groups_select_tag(group_link_field, data: { skip_groups: @skip_groups }, class: 'input-clamp qa-group-select-field', required: true)
       .form-group
-        = label_tag :link_group_access, _("Max access level"), class: "label-bold"
+        = label_tag group_access_field, _("Max access level"), class: "label-bold"
         .select-wrapper
-          = select_tag :link_group_access, options_for_select(ProjectGroupLink.access_options, ProjectGroupLink.default_access), class: "form-control select-control"
+          = select_tag group_access_field, options_for_select(access_levels, default_access_level), data: { qa_selector: 'group_access_field' }, class: "form-control select-control"
           = icon('chevron-down')
         .form-text.text-muted.append-bottom-10
           - permissions_docs_path = help_page_path('user/permissions')

app/views/projects/project_members/_new_project_member.html.haml → app/views/shared/members/_invite_member.html.haml

+- access_levels = local_assigns[:access_levels]
+- default_access_level = local_assigns[:default_access_level]
+- submit_url = local_assigns[:submit_url]
+- can_import_members = local_assigns[:can_import_members?]
+- import_path = local_assigns[:import_path]
 .row
   .col-sm-12
-    = form_for @project_member, as: :project_member, url: project_project_members_path(@project), html: { class: 'users-project-form' } do |f|
+    = form_tag submit_url, class: 'invite-users-form', method: :post do
       .form-group
         = label_tag :user_ids, _("GitLab member or Email address"), class: "label-bold"
-        = users_select_tag(:user_ids, multiple: true, class: "input-clamp qa-member-select-input", scope: :all, email_user: true, placeholder: "Search for members to update or invite")
+        = users_select_tag(:user_ids, multiple: true, class: 'input-clamp qa-member-select-field', scope: :all, email_user: true, placeholder: 'Search for members to update or invite')
       .form-group
         = label_tag :access_level, _("Choose a role permission"), class: "label-bold"
         .select-wrapper
-          = select_tag :access_level, options_for_select(ProjectMember.access_level_roles, @project_member.access_level), class: "form-control project-access-select select-control"
+          = select_tag :access_level, options_for_select(access_levels, default_access_level), class: "form-control project-access-select select-control"
           = icon('chevron-down')
         .form-text.text-muted.append-bottom-10
           - permissions_docs_path = help_page_path('user/permissions')
@@ -18,6 +23,6 @@
           = label_tag :expires_at, _('Access expiration date'), class: 'label-bold'
           = text_field_tag :expires_at, nil, class: 'form-control js-access-expiration-date', placeholder: 'Expiration date'
           %i.clear-icon.js-clear-input
-      = f.submit _("Add to project"), class: "btn btn-success qa-add-member-button"
-      - if can_import_members?
-        = link_to _("Import"), import_project_project_members_path(@project), class: "btn btn-default", title: _("Import members from another project")
+      = submit_tag _("Invite"), class: "btn btn-success", data: { qa_selector: 'invite_member_button' }
+      - if can_import_members
+        = link_to _("Import"), import_path, class: "btn btn-default", title: _("Import members from another project")

changelogs/unreleased/37359-cablett-support-envelope-to.yml

+---
+title: Accept `Envelope-To` as possible location for Service Desk key
+merge_request: 22354
+author: Max Winterstein
+type: added

changelogs/unreleased/bvl-gitaly-dynamic-deadline.yml

+---
+title: Don't let Gitaly calls exceed a request time of 55 seconds
+merge_request: 21492
+author:
+type: performance

config/gitlab.yml.example

@@ -33,6 +33,9 @@ production: &base
     host: localhost
     port: 80 # Set to 443 if using HTTPS, see installation.md#using-https for additional HTTPS configuration details
     https: false # Set to true if using HTTPS, see installation.md#using-https for additional HTTPS configuration details
+    # The maximum time unicorn/puma can spend on the request. This needs to be smaller than the worker timeout.
+    # Default is 95% of the worker timeout
+    max_request_duration: 57
     # Uncomment this line below if your ssh host is different from HTTP/HTTPS one
     # (you'd obviously need to replace ssh.host_example.com with your own host).

config/initializers/1_settings.rb

@@ -209,6 +209,7 @@ Settings.gitlab['content_security_policy'] ||= Gitlab::ContentSecurityPolicy::Co
 Settings.gitlab['no_todos_messages'] ||= YAML.load_file(Rails.root.join('config', 'no_todos_messages.yml'))
 Settings.gitlab['impersonation_enabled'] ||= true if Settings.gitlab['impersonation_enabled'].nil?
 Settings.gitlab['usage_ping_enabled'] = true if Settings.gitlab['usage_ping_enabled'].nil?
+Settings.gitlab['max_request_duration_seconds'] ||= 57
 Gitlab.ee do
   Settings.gitlab['mirror_max_delay'] ||= 300

config/initializers/lograge.rb

@@ -37,7 +37,7 @@ unless Gitlab::Runtime.sidekiq?
       payload[:response] = event.payload[:response] if event.payload[:response]
       payload[Labkit::Correlation::CorrelationId::LOG_KEY] = Labkit::Correlation::CorrelationId.current_id
-      if cpu_s = Gitlab::Metrics::System.thread_cpu_duration(::Gitlab::RequestContext.start_thread_cpu_time)
+      if cpu_s = Gitlab::Metrics::System.thread_cpu_duration(::Gitlab::RequestContext.instance.start_thread_cpu_time)
         payload[:cpu_s] = cpu_s
       end

config/initializers/request_context.rb

 Rails.application.configure do |config|
-  config.middleware.insert_after RequestStore::Middleware, Gitlab::RequestContext
+  config.middleware.insert_after RequestStore::Middleware, Gitlab::Middleware::RequestContext
 end

config/routes/admin.rb

@@ -119,6 +119,8 @@ namespace :admin do
     post :create_self_monitoring_project
     get :status_create_self_monitoring_project
+    delete :delete_self_monitoring_project
+    get :status_delete_self_monitoring_project
   end
   resources :labels

doc/administration/raketasks/uploads/migrate.md

-# Uploads Migrate Rake Task
+# Uploads Migrate Rake Tasks
 ## Migrate to Object Storage
@@ -110,7 +110,15 @@ sudo -u git -H bundle exec rake "gitlab:uploads:migrate[FileUploader, MergeReque
 To migrate all uploads created by legacy uploaders, run:
-```shell
+**Omnibus Installation**
+
+```bash
+gitlab-rake gitlab:uploads:legacy:migrate
+```
+
+**Source Installation**
+
+```bash
 bundle exec rake gitlab:uploads:legacy:migrate
 ```