Add latest changes from gitlab-org/gitlab@14-3-stable-eev14.3.0-rc42

14 files changed, 274 insertions, 149 deletions

diff --git a/.gitlab/ci/docs.gitlab-ci.yml b/.gitlab/ci/docs.gitlab-ci.yml
index ea3e3ac450b..c585047f916 100644
--- a/.gitlab/ci/docs.gitlab-ci.yml
+++ b/.gitlab/ci/docs.gitlab-ci.yml
@@ -53,7 +53,7 @@ docs-lint markdown:
 docs-lint links:
   extends:
     - .docs:rules:docs-lint
-  image: registry.gitlab.com/gitlab-org/gitlab-docs/lint-html:alpine-3.13-ruby-2.7.2-d2b92621
+  image: registry.gitlab.com/gitlab-org/gitlab-docs/lint-html:alpine-3.14-ruby-2.7.4-db71f027
   stage: test
   needs: []
   script:
@@ -75,3 +75,17 @@ ui-docs-links lint:
   needs: []
   script:
     - bundle exec haml-lint -i DocumentationLinks
+
+deprecations-doc check:
+  variables:
+    SETUP_DB: "false"
+  extends:
+    - .default-retry
+    - .rails-cache
+    - .default-before_script
+    - .docs:rules:deprecations
+  stage: test
+  needs: []
+  script:
+    - bundle exec rake gitlab:docs:check_deprecations
+  allow_failure: true
diff --git a/.gitlab/ci/frontend.gitlab-ci.yml b/.gitlab/ci/frontend.gitlab-ci.yml
index bfc38e73bb5..48f85219ff4 100644
--- a/.gitlab/ci/frontend.gitlab-ci.yml
+++ b/.gitlab/ci/frontend.gitlab-ci.yml
@@ -11,7 +11,7 @@
     - .default-retry
     - .default-before_script
     - .assets-compile-cache
-  image: registry.gitlab.com/gitlab-org/gitlab-build-images:ruby-2.7.2-git-2.31-lfs-2.9-node-14.15-yarn-1.22-graphicsmagick-1.3.36
+  image: registry.gitlab.com/gitlab-org/gitlab-build-images:ruby-2.7-git-2.31-lfs-2.9-node-14.15-yarn-1.22-graphicsmagick-1.3.36
   variables:
     SETUP_DB: "false"
     WEBPACK_VENDOR_DLL: "true"
@@ -132,6 +132,7 @@ rspec frontend_fixture:
   extends:
     - .frontend-fixtures-base
     - .frontend:rules:default-frontend-jobs
+  parallel: 2
 
 rspec frontend_fixture as-if-foss:
   extends:
@@ -171,6 +172,8 @@ graphql-schema-dump:
     # Disable warnings in browserslist which can break on backports
     # https://github.com/browserslist/browserslist/blob/a287ec6/node.js#L367-L384
     BROWSERSLIST_IGNORE_OLD_DATA: "true"
+  before_script:
+    - *yarn-install
   stage: test
 
 eslint-as-if-foss:
@@ -180,55 +183,19 @@ eslint-as-if-foss:
     - .as-if-foss
   needs: []
   script:
-    - *yarn-install
     - run_timed_command "yarn run lint:eslint:all"
 
-.karma-base:
-  extends: .frontend-test-base
-  script:
-    - export BABEL_ENV=coverage CHROME_LOG_FILE=chrome_debug.log
-    - *yarn-install
-    - run_timed_command "yarn karma"
-
-karma:
-  extends:
-    - .karma-base
-    - .frontend:rules:default-frontend-jobs
-  needs:
-    - job: "rspec frontend_fixture"
-    - job: "rspec-ee frontend_fixture"
-      optional: true
-  coverage: '/^Statements *: (\d+\.\d+%)/'
-  artifacts:
-    name: coverage-javascript
-    expire_in: 31d
-    when: always
-    paths:
-      - chrome_debug.log
-      - coverage-javascript/
-      - tmp/tests/frontend/
-    reports:
-      junit: junit_karma.xml
-      cobertura: coverage-javascript/cobertura-coverage.xml
-
-karma-as-if-foss:
-  extends:
-    - .karma-base
-    - .frontend:rules:default-frontend-jobs-as-if-foss
-    - .as-if-foss
-  needs: ["rspec frontend_fixture as-if-foss"]
-
 .jest-base:
   extends: .frontend-test-base
   script:
-    - *yarn-install
-    - run_timed_command "yarn jest --ci --coverage --testSequencer ./scripts/frontend/parallel_ci_sequencer.js"
+    - run_timed_command "yarn jest:ci"
 
 jest:
   extends:
     - .jest-base
-    - .frontend:rules:default-frontend-jobs
+    - .frontend:rules:jest
   needs:
+    - job: "detect-tests"
     - job: "rspec frontend_fixture"
     - job: "rspec-ee frontend_fixture"
       optional: true
@@ -244,12 +211,18 @@ jest:
       junit: junit_jest.xml
   parallel: 5
 
+jest minimal:
+  extends:
+    - jest
+    - .frontend:rules:jest:minimal
+  script:
+    - run_timed_command "yarn jest:ci:minimal"
+
 jest-integration:
   extends:
     - .frontend-test-base
     - .frontend:rules:default-frontend-jobs
   script:
-    - *yarn-install
     - run_timed_command "yarn jest:integration --ci"
   needs:
     - job: "rspec frontend_fixture"
@@ -270,7 +243,11 @@ coverage-frontend:
     - .default-retry
     - .yarn-cache
     - .frontend:rules:ee-mr-and-default-branch-only
-  needs: ["jest"]
+  needs:
+    - job: "jest"
+      optional: true
+    - job: "jest minimal"
+      optional: true
   stage: post-test
   before_script:
     - *yarn-install
@@ -298,9 +275,13 @@ coverage-frontend:
     - *yarn-install
     - run_timed_command "retry yarn run webpack-prod"
 
-qa-frontend-node:10:
+qa-frontend-node:12:
+  extends: .qa-frontend-node
+  image: ${GITLAB_DEPENDENCY_PROXY}node:12
+
+qa-frontend-node:14:
   extends: .qa-frontend-node
-  image: ${GITLAB_DEPENDENCY_PROXY}node:dubnium
+  image: ${GITLAB_DEPENDENCY_PROXY}node:14
 
 qa-frontend-node:latest:
   extends:
@@ -351,7 +332,6 @@ bundle-size-review:
   extends:
     - .frontend-test-base
   script:
-    - *yarn-install
     - run_timed_command "yarn generate:startup_css"
     - yarn check:startup_css
 
@@ -379,7 +359,6 @@ startup-css-check as-if-foss:
     - .frontend-test-base
     - .storybook-yarn-cache
   script:
-    - *yarn-install  # storybook depends on the global webpack config, so we must install global deps.
     - *storybook-yarn-install
     - yarn run storybook:build
 
diff --git a/.gitlab/ci/global.gitlab-ci.yml b/.gitlab/ci/global.gitlab-ci.yml
index 860397b9437..d9978a44ffb 100644
--- a/.gitlab/ci/global.gitlab-ci.yml
+++ b/.gitlab/ci/global.gitlab-ci.yml
@@ -200,7 +200,7 @@
     - *storybook-node-modules-cache-push
 
 .use-pg11:
-  image: "registry.gitlab.com/gitlab-org/gitlab-build-images:ruby-2.7.2.patched-golang-1.16-git-2.31-lfs-2.9-chrome-89-node-14.15-yarn-1.22-postgresql-11-graphicsmagick-1.3.36"
+  image: "registry.gitlab.com/gitlab-org/gitlab-build-images:ruby-2.7.patched-golang-1.16-git-2.31-lfs-2.9-chrome-89-node-14.15-yarn-1.22-postgresql-11-graphicsmagick-1.3.36"
   services:
     - name: postgres:11.6
       command: ["postgres", "-c", "fsync=off", "-c", "synchronous_commit=off", "-c", "full_page_writes=off"]
@@ -209,7 +209,7 @@
     POSTGRES_HOST_AUTH_METHOD: trust
 
 .use-pg12:
-  image: "registry.gitlab.com/gitlab-org/gitlab-build-images:ruby-2.7.2.patched-golang-1.16-git-2.31-lfs-2.9-chrome-89-node-14.15-yarn-1.22-postgresql-12-graphicsmagick-1.3.36"
+  image: "registry.gitlab.com/gitlab-org/gitlab-build-images:ruby-2.7.patched-golang-1.16-git-2.31-lfs-2.9-chrome-89-node-14.15-yarn-1.22-postgresql-12-graphicsmagick-1.3.36"
   services:
     - name: postgres:12
       command: ["postgres", "-c", "fsync=off", "-c", "synchronous_commit=off", "-c", "full_page_writes=off"]
@@ -218,7 +218,7 @@
     POSTGRES_HOST_AUTH_METHOD: trust
 
 .use-pg13:
-  image: "registry.gitlab.com/gitlab-org/gitlab-build-images:ruby-2.7.2.patched-golang-1.16-git-2.31-lfs-2.9-chrome-89-node-14.15-yarn-1.22-postgresql-13-graphicsmagick-1.3.36"
+  image: "registry.gitlab.com/gitlab-org/gitlab-build-images:ruby-2.7.patched-golang-1.16-git-2.31-lfs-2.9-chrome-89-node-14.15-yarn-1.22-postgresql-13-graphicsmagick-1.3.36"
   services:
     - name: postgres:13
       command: ["postgres", "-c", "fsync=off", "-c", "synchronous_commit=off", "-c", "full_page_writes=off"]
@@ -227,7 +227,7 @@
     POSTGRES_HOST_AUTH_METHOD: trust
 
 .use-pg11-ee:
-  image: "registry.gitlab.com/gitlab-org/gitlab-build-images:ruby-2.7.2.patched-golang-1.16-git-2.31-lfs-2.9-chrome-89-node-14.15-yarn-1.22-postgresql-11-graphicsmagick-1.3.36"
+  image: "registry.gitlab.com/gitlab-org/gitlab-build-images:ruby-2.7.patched-golang-1.16-git-2.31-lfs-2.9-chrome-89-node-14.15-yarn-1.22-postgresql-11-graphicsmagick-1.3.36"
   services:
     - name: postgres:11.6
       command: ["postgres", "-c", "fsync=off", "-c", "synchronous_commit=off", "-c", "full_page_writes=off"]
@@ -238,7 +238,7 @@
     POSTGRES_HOST_AUTH_METHOD: trust
 
 .use-pg12-ee:
-  image: "registry.gitlab.com/gitlab-org/gitlab-build-images:ruby-2.7.2.patched-golang-1.16-git-2.31-lfs-2.9-chrome-89-node-14.15-yarn-1.22-postgresql-12-graphicsmagick-1.3.36"
+  image: "registry.gitlab.com/gitlab-org/gitlab-build-images:ruby-2.7.patched-golang-1.16-git-2.31-lfs-2.9-chrome-89-node-14.15-yarn-1.22-postgresql-12-graphicsmagick-1.3.36"
   services:
     - name: postgres:12
       command: ["postgres", "-c", "fsync=off", "-c", "synchronous_commit=off", "-c", "full_page_writes=off"]
@@ -249,7 +249,7 @@
     POSTGRES_HOST_AUTH_METHOD: trust
 
 .use-pg13-ee:
-  image: "registry.gitlab.com/gitlab-org/gitlab-build-images:ruby-2.7.2.patched-golang-1.16-git-2.31-lfs-2.9-chrome-89-node-14.15-yarn-1.22-postgresql-13-graphicsmagick-1.3.36"
+  image: "registry.gitlab.com/gitlab-org/gitlab-build-images:ruby-2.7.patched-golang-1.16-git-2.31-lfs-2.9-chrome-89-node-14.15-yarn-1.22-postgresql-13-graphicsmagick-1.3.36"
   services:
     - name: postgres:13
       command: ["postgres", "-c", "fsync=off", "-c", "synchronous_commit=off", "-c", "full_page_writes=off"]
diff --git a/.gitlab/ci/pages.gitlab-ci.yml b/.gitlab/ci/pages.gitlab-ci.yml
index 2f43e974cf6..6f96d84b8e3 100644
--- a/.gitlab/ci/pages.gitlab-ci.yml
+++ b/.gitlab/ci/pages.gitlab-ci.yml
@@ -12,7 +12,6 @@ pages:
   needs:
     - job: "rspec:coverage"
     - job: "coverage-frontend"
-    - job: "karma"
     - job: "compile-production-assets"
     - job: "compile-storybook"
     # `update-tests-metadata` only runs on GitLab.com's EE schedules pipelines
@@ -27,7 +26,6 @@ pages:
     - mkdir -p public/$(dirname "$KNAPSACK_RSPEC_SUITE_REPORT_PATH") public/$(dirname "$FLAKY_RSPEC_SUITE_REPORT_PATH") public/$(dirname "$RSPEC_PACKED_TESTS_MAPPING_PATH")
     - mv coverage/ public/coverage-ruby/ || true
     - mv coverage-frontend/ public/coverage-frontend/ || true
-    - mv coverage-javascript/ public/coverage-javascript/ || true
     - mv storybook/public public/storybook || true
     - cp .public/assets/application-*.css public/application.css || true
     - mv $KNAPSACK_RSPEC_SUITE_REPORT_PATH public/$KNAPSACK_RSPEC_SUITE_REPORT_PATH || true
diff --git a/.gitlab/ci/qa.gitlab-ci.yml b/.gitlab/ci/qa.gitlab-ci.yml
index c3e6de76894..88e732c2e75 100644
--- a/.gitlab/ci/qa.gitlab-ci.yml
+++ b/.gitlab/ci/qa.gitlab-ci.yml
@@ -7,6 +7,7 @@
   variables:
     USE_BUNDLE_INSTALL: "false"
     SETUP_DB: "false"
+    QA_EXPORT_TEST_METRICS: "false"
   before_script:
     - !reference [.default-before_script, before_script]
     - cd qa/
diff --git a/.gitlab/ci/rails.gitlab-ci.yml b/.gitlab/ci/rails.gitlab-ci.yml
index f4b001ed1ba..00f65ab7ca8 100644
--- a/.gitlab/ci/rails.gitlab-ci.yml
+++ b/.gitlab/ci/rails.gitlab-ci.yml
@@ -23,6 +23,10 @@
   variables:
     RSPEC_TESTS_MAPPING_ENABLED: "true"
 
+.decomposed-database-rspec:
+  variables:
+    DECOMPOSED_DB: "true"
+
 .rspec-base:
   extends: .rails-job-base
   stage: test
@@ -225,65 +229,6 @@ update-gitaly-binaries-cache:
     SETUP_DB: "false"
     USE_BUNDLE_INSTALL: "false"
 
-.static-analysis-base:
-  extends:
-    - .default-retry
-    - .default-before_script
-    - .static-analysis-cache
-  needs: []
-  variables:
-    SETUP_DB: "false"
-    ENABLE_SPRING: "1"
-    # Disable warnings in browserslist which can break on backports
-    # https://github.com/browserslist/browserslist/blob/a287ec6/node.js#L367-L384
-    BROWSERSLIST_IGNORE_OLD_DATA: "true"
-
-update-static-analysis-cache:
-  extends:
-    - .static-analysis-base
-    - .static-analysis-cache-push
-    - .shared:rules:update-cache
-  stage: prepare
-  script:
-    - run_timed_command "bundle exec rubocop --parallel"  # For the moment we only cache `tmp/rubocop_cache` so we don't need to run all the tasks.
-
-static-analysis:
-  extends:
-    - .static-analysis-base
-    - .static-analysis:rules:ee-and-foss
-  stage: test
-  parallel: 4
-  script:
-    - run_timed_command "retry yarn install --frozen-lockfile"
-    - scripts/static-analysis
-  artifacts:
-    expire_in: 31d
-    when: always
-    paths:
-      - tmp/feature_flags/
-
-static-analysis as-if-foss:
-  extends:
-    - static-analysis
-    - .static-analysis:rules:as-if-foss
-    - .as-if-foss
-
-zeitwerk-check:
-  extends:
-    - .rails-cache
-    - .default-before_script
-    - .rails:rules:ee-and-foss-unit
-  variables:
-    BUNDLE_WITHOUT: ""
-    SETUP_DB: "false"
-  needs: []
-  stage: test
-  script:
-    - sed -i -e "s/config\.autoloader = :classic/config\.autoloader = :zeitwerk/" config/application.rb
-    - RAILS_ENV=test bundle exec rake zeitwerk:check
-    - RAILS_ENV=development bundle exec rake zeitwerk:check
-    - RAILS_ENV=production bundle exec rake zeitwerk:check
-
 rspec migration pg12:
   extends:
     - .rspec-base-pg12
@@ -296,6 +241,12 @@ rspec migration pg12 minimal:
     - .minimal-rspec-tests
     - .rails:rules:ee-and-foss-migration:minimal
 
+rspec migration pg12 decomposed:
+  extends:
+    - rspec migration pg12
+    - .decomposed-database-rspec
+    - .rails:rules:decomposed-databases
+
 rspec unit pg12:
   extends:
     - .rspec-base-pg12
@@ -308,6 +259,12 @@ rspec unit pg12 minimal:
     - .minimal-rspec-tests
     - .rails:rules:ee-and-foss-unit:minimal
 
+rspec unit pg12 decomposed:
+  extends:
+    - rspec unit pg12
+    - .decomposed-database-rspec
+    - .rails:rules:decomposed-databases
+
 rspec integration pg12:
   extends:
     - .rspec-base-pg12
@@ -320,6 +277,12 @@ rspec integration pg12 minimal:
     - .minimal-rspec-tests
     - .rails:rules:ee-and-foss-integration:minimal
 
+rspec integration pg12 decomposed:
+  extends:
+    - rspec integration pg12
+    - .decomposed-database-rspec
+    - .rails:rules:decomposed-databases
+
 rspec system pg12:
   extends:
     - .rspec-base-pg12
@@ -332,6 +295,12 @@ rspec system pg12 minimal:
     - .minimal-rspec-tests
     - .rails:rules:ee-and-foss-system:minimal
 
+rspec system pg12 decomposed:
+  extends:
+    - rspec system pg12
+    - .decomposed-database-rspec
+    - .rails:rules:decomposed-databases
+
 # Dedicated job to test DB library code against PG11.
 # Note that these are already tested against PG12 in the `rspec unit pg12` / `rspec-ee unit pg12` jobs.
 rspec db-library-code pg11:
@@ -382,18 +351,12 @@ db:migrate-from-previous-major-version:
     USE_BUNDLE_INSTALL: "false"
     SETUP_DB: "false"
     PROJECT_TO_CHECKOUT: "gitlab-foss"
-    TAG_TO_CHECKOUT: "v12.10.14"
+    TAG_TO_CHECKOUT: "v13.12.9"
   script:
     - '[[ -d "ee/" ]] || export PROJECT_TO_CHECKOUT="gitlab"'
     - '[[ -d "ee/" ]] || export TAG_TO_CHECKOUT="${TAG_TO_CHECKOUT}-ee"'
     - retry 'git fetch https://gitlab.com/gitlab-org/$PROJECT_TO_CHECKOUT.git $TAG_TO_CHECKOUT'
     - git checkout -f FETCH_HEAD
-    # Patch Gemfile of the previous major version for compatibility.
-    - sed -i -e "s/gem 'grpc', '~> 1.24.0'/gem 'grpc', '~> 1.30.2'/" Gemfile  # Update gRPC for Ruby 2.7
-    - sed -i -e "s/gem 'google-protobuf', '~> 3.8.0'/gem 'google-protobuf', '~> 3.12'/" Gemfile
-    - sed -i -e "s/gem 'nokogiri', '~> 1.10.5'/gem 'nokogiri', '~> 1.11.0'/" Gemfile
-    - sed -i -e "s/gem 'mimemagic', '~> 0.3.2'/gem 'ruby-magic', '~> 0.4.0'/" Gemfile
-    - run_timed_command "bundle update --bundler google-protobuf nokogiri grpc mimemagic bootsnap"
     - SETUP_DB=false USE_BUNDLE_INSTALL=true bash scripts/prepare_build.sh
     - run_timed_command "bundle exec rake db:drop db:create db:structure:load db:migrate db:seed_fu"
     - git checkout -f $CI_COMMIT_SHA
@@ -554,6 +517,12 @@ rspec migration pg12-as-if-foss minimal:
     - .minimal-rspec-tests
     - .rails:rules:as-if-foss-migration:minimal
 
+rspec migration pg12-as-if-foss decomposed:
+  extends:
+    - rspec migration pg12-as-if-foss
+    - .decomposed-database-rspec
+    - .rails:rules:decomposed-databases
+
 rspec unit pg12-as-if-foss:
   extends:
     - .rspec-base-pg12-as-if-foss
@@ -566,6 +535,12 @@ rspec unit pg12-as-if-foss minimal:
     - .minimal-rspec-tests
     - .rails:rules:as-if-foss-unit:minimal
 
+rspec unit pg12-as-if-foss decomposed:
+  extends:
+    - rspec unit pg12-as-if-foss
+    - .decomposed-database-rspec
+    - .rails:rules:decomposed-databases
+
 rspec integration pg12-as-if-foss:
   extends:
     - .rspec-base-pg12-as-if-foss
@@ -578,6 +553,12 @@ rspec integration pg12-as-if-foss minimal:
     - .minimal-rspec-tests
     - .rails:rules:as-if-foss-integration:minimal
 
+rspec integration pg12-as-if-foss decomposed:
+  extends:
+    - rspec integration pg12-as-if-foss
+    - .decomposed-database-rspec
+    - .rails:rules:decomposed-databases
+
 rspec system pg12-as-if-foss:
   extends:
     - .rspec-base-pg12-as-if-foss
@@ -590,6 +571,12 @@ rspec system pg12-as-if-foss minimal:
     - .minimal-rspec-tests
     - .rails:rules:as-if-foss-system:minimal
 
+rspec system pg12-as-if-foss decomposed:
+  extends:
+    - rspec system pg12-as-if-foss
+    - .decomposed-database-rspec
+    - .rails:rules:decomposed-databases
+
 rspec-ee migration pg12:
   extends:
     - .rspec-ee-base-pg12
@@ -603,6 +590,12 @@ rspec-ee migration pg12 minimal:
     - .minimal-rspec-tests
     - .rails:rules:ee-only-migration:minimal
 
+rspec-ee migration pg12 decomposed:
+  extends:
+    - rspec-ee migration pg12
+    - .decomposed-database-rspec
+    - .rails:rules:decomposed-databases
+
 rspec-ee unit pg12:
   extends:
     - .rspec-ee-base-pg12
@@ -615,6 +608,12 @@ rspec-ee unit pg12 minimal:
     - .minimal-rspec-tests
     - .rails:rules:ee-only-unit:minimal
 
+rspec-ee unit pg12 decomposed:
+  extends:
+    - rspec-ee unit pg12
+    - .decomposed-database-rspec
+    - .rails:rules:decomposed-databases
+
 rspec-ee integration pg12:
   extends:
     - .rspec-ee-base-pg12
@@ -627,6 +626,12 @@ rspec-ee integration pg12 minimal:
     - .minimal-rspec-tests
     - .rails:rules:ee-only-integration:minimal
 
+rspec-ee integration pg12 decomposed:
+  extends:
+    - rspec-ee integration pg12
+    - .decomposed-database-rspec
+    - .rails:rules:decomposed-databases
+
 rspec-ee system pg12:
   extends:
     - .rspec-ee-base-pg12
@@ -639,6 +644,12 @@ rspec-ee system pg12 minimal:
     - .minimal-rspec-tests
     - .rails:rules:ee-only-system:minimal
 
+rspec-ee system pg12 decomposed:
+  extends:
+    - rspec-ee system pg12
+    - .decomposed-database-rspec
+    - .rails:rules:decomposed-databases
+
 rspec-ee unit pg12 geo:
   extends:
     - .rspec-ee-base-geo-pg12
diff --git a/.gitlab/ci/reports.gitlab-ci.yml b/.gitlab/ci/reports.gitlab-ci.yml
index 7fb4e54c4d6..a5403073e1b 100644
--- a/.gitlab/ci/reports.gitlab-ci.yml
+++ b/.gitlab/ci/reports.gitlab-ci.yml
@@ -27,14 +27,11 @@ code_quality:
   variables:
     SAST_BRAKEMAN_LEVEL: 2  # GitLab-specific
     SAST_EXCLUDED_PATHS: "qa, spec, doc, ee/spec, config/gitlab.yml.example, tmp"  # GitLab-specific
-    SAST_EXCLUDED_ANALYZERS: bandit, flawfinder, phpcs-security-audit, pmd-apex, security-code-scan, spotbugs
+    SAST_EXCLUDED_ANALYZERS: bandit, flawfinder, phpcs-security-audit, pmd-apex, security-code-scan, spotbugs, eslint
 
 brakeman-sast:
   rules: !reference [".reports:rules:sast", rules]
 
-eslint-sast:
-  rules: !reference [".reports:rules:sast", rules]
-
 nodejs-scan-sast:
   rules: !reference [".reports:rules:sast", rules]
 
diff --git a/.gitlab/ci/review.gitlab-ci.yml b/.gitlab/ci/review.gitlab-ci.yml
index c22b468d674..f20f3276867 100644
--- a/.gitlab/ci/review.gitlab-ci.yml
+++ b/.gitlab/ci/review.gitlab-ci.yml
@@ -46,7 +46,7 @@ review-build-cng:
   variables:
     HOST_SUFFIX: "${CI_ENVIRONMENT_SLUG}"
     DOMAIN: "-${CI_ENVIRONMENT_SLUG}.${REVIEW_APPS_DOMAIN}"
-    GITLAB_HELM_CHART_REF: "v5.1.0"
+    GITLAB_HELM_CHART_REF: "v5.2.1"
   environment:
     name: review/${CI_COMMIT_REF_SLUG}${FREQUENCY}
     url: https://gitlab-${CI_ENVIRONMENT_SLUG}.${REVIEW_APPS_DOMAIN}
diff --git a/.gitlab/ci/rules.gitlab-ci.yml b/.gitlab/ci/rules.gitlab-ci.yml
index 53420dfe31a..a4a932c7dd0 100644
--- a/.gitlab/ci/rules.gitlab-ci.yml
+++ b/.gitlab/ci/rules.gitlab-ci.yml
@@ -46,6 +46,12 @@
 .if-merge-request-title-run-all-rspec: &if-merge-request-title-run-all-rspec
   if: '$CI_MERGE_REQUEST_LABELS =~ /pipeline:run-all-rspec/'
 
+.if-merge-request-title-run-all-jest: &if-merge-request-title-run-all-jest
+  if: '$CI_MERGE_REQUEST_LABELS =~ /pipeline:run-all-jest/'
+
+.if-merge-request-run-decomposed: &if-merge-request-run-decomposed
+  if: '$CI_MERGE_REQUEST_LABELS =~ /pipeline:run-decomposed/'
+
 .if-security-merge-request: &if-security-merge-request
   if: '$CI_PROJECT_NAMESPACE == "gitlab-org/security" && $CI_MERGE_REQUEST_IID'
 
@@ -117,6 +123,7 @@
   - "scripts/review_apps/base-config.yaml"
   - "scripts/review_apps/review-apps.sh"
   - "scripts/trigger-build"
+  - "{,ee/,jh/}{bin,config}/**/*.rb"
 
 .ci-qa-patterns: &ci-qa-patterns
   - ".gitlab-ci.yml"
@@ -136,7 +143,6 @@
   - ".gitlab-ci.yml"
   - ".gitlab/ci/**/*.yml"
   - "lib/gitlab/ci/templates/**/*.yml"
-  - "{,ee/,jh/}changelogs/**/*.yml"
 
 .docs-patterns: &docs-patterns
   - ".gitlab/route-map.yml"
@@ -144,6 +150,13 @@
   - ".markdownlint.yml"
   - "scripts/lint-doc.sh"
 
+.docs-deprecations-patterns: &docs-deprecations-patterns
+  - "doc/deprecations/index.md"
+  - "data/deprecations/*.yml"
+  - "data/deprecations/templates/_deprecation_template.md.erb"
+  - "lib/tasks/gitlab/docs/compile_deprecations.rake"
+  - "tooling/deprecations/docs.rb"
+
 .bundler-patterns: &bundler-patterns
   - '{Gemfile.lock,*/Gemfile.lock,*/*/Gemfile.lock}'
 
@@ -197,7 +210,7 @@
   - "{,ee/,jh/}app/assets/stylesheets/startup/**/*"
 
 .backend-patterns: &backend-patterns
-  - "Gemfile{,.lock}"
+  - "{,jh/}Gemfile{,.lock}"
   - "Rakefile"
   - "config.ru"
   # List explicitly all the app/ dirs that are backend (i.e. all except app/assets).
@@ -216,6 +229,7 @@
   - "{,ee/,jh/}{,spec/}lib/{,ee/,jh/}gitlab/background_migration/**/*"
   - "{,ee/,jh/}{,spec/}lib/{,ee/,jh/}gitlab/background_migration{,_spec}.rb"
   - "{,ee/,jh/}spec/support/helpers/database/**/*"
+  - "lib/gitlab/markdown_cache/active_record/**/*"
   - "config/prometheus/common_metrics.yml"  # Used by Gitlab::DatabaseImporters::CommonMetrics::Importer
   - "{,ee/,jh/}app/models/project_statistics.rb"  # Used to calculate sizes in migration specs
   - "GITALY_SERVER_VERSION" # Has interactions with background migrations:https://gitlab.com/gitlab-org/gitlab/-/issues/336538
@@ -250,7 +264,7 @@
   - ".{eslintignore,gitattributes,nvmrc,prettierrc,stylelintrc,yamllint}"
   - ".{codeclimate,eslintrc,gitlab-ci,haml-lint,haml-lint_todo,rubocop,rubocop_todo,rubocop_manual_todo}.yml"
   - "*_VERSION"
-  - "Gemfile{,.lock}"
+  - "{,jh/}Gemfile{,.lock}"
   - "Rakefile"
   - "tests.yml"
   - "config.ru"
@@ -276,7 +290,7 @@
   - ".{eslintignore,gitattributes,nvmrc,prettierrc,stylelintrc,yamllint}"
   - ".{codeclimate,eslintrc,gitlab-ci,haml-lint,haml-lint_todo,rubocop,rubocop_todo,rubocop_manual_todo}.yml"
   - "*_VERSION"
-  - "Gemfile{,.lock}"
+  - "{,jh/}Gemfile{,.lock}"
   - "Rakefile"
   - "tests.yml"
   - "config.ru"
@@ -305,7 +319,7 @@
   - ".{eslintignore,gitattributes,nvmrc,prettierrc,stylelintrc,yamllint}"
   - ".{codeclimate,eslintrc,gitlab-ci,haml-lint,haml-lint_todo,rubocop,rubocop_todo,rubocop_manual_todo}.yml"
   - "*_VERSION"
-  - "Gemfile{,.lock}"
+  - "{,jh/}Gemfile{,.lock}"
   - "Rakefile"
   - "tests.yml"
   - "config.ru"
@@ -330,7 +344,7 @@
   - ".{eslintignore,gitattributes,nvmrc,prettierrc,stylelintrc,yamllint}"
   - ".{codeclimate,eslintrc,gitlab-ci,haml-lint,haml-lint_todo,rubocop,rubocop_todo,rubocop_manual_todo}.yml"
   - "*_VERSION"
-  - "Gemfile{,.lock}"
+  - "{,jh/}Gemfile{,.lock}"
   - "Rakefile"
   - "tests.yml"
   - "config.ru"
@@ -354,6 +368,14 @@
   - "danger/**/*"
   - "tooling/danger/**/*"
 
+.core-frontend-patterns: &core-frontend-patterns
+  - "{package.json,yarn.lock}"
+  - "babel.config.js"
+  - "jest.config.{base,integration,unit}.js"
+  - "config/helpers/**/*.js"
+  - "vendor/assets/javascripts/**/*"
+  - "{,ee/,jh/}app/assets/**/*.graphql"
+
 ################
 # Shared rules #
 ################
@@ -449,6 +471,12 @@
       changes: *docs-patterns
       when: on_success
 
+.docs:rules:deprecations:
+  rules:
+    - <<: *if-default-refs
+      changes: *docs-deprecations-patterns
+      when: on_success
+
 ##################
 # GraphQL rules  #
 ##################
@@ -480,8 +508,8 @@
   rules:
     - <<: *if-not-ee
       when: never
-    - <<: *if-merge-request  # Always run for MRs since `compile-test-assets as-if-foss` is either needed by `rspec foss-impact` or the `rspec * as-if-foss` jobs.
-      changes: *code-backstage-qa-patterns
+    - changes: *code-backstage-qa-patterns
+    - <<: *if-merge-request-title-run-all-rspec
 
 .frontend:rules:default-frontend-jobs:
   rules:
@@ -508,6 +536,42 @@
     - <<: *if-merge-request
       changes: *ci-patterns
 
+.frontend:rules:jest:
+  rules:
+    - <<: *if-merge-request-title-run-all-jest
+    - <<: *if-default-refs
+      changes: *core-frontend-patterns
+    - <<: *if-merge-request
+      changes: *ci-patterns
+    - <<: *if-automated-merge-request
+      changes: *code-backstage-patterns
+    - <<: *if-default-refs
+      changes: *backend-patterns
+    - <<: *if-merge-request-not-approved
+      when: never
+    - <<: *if-default-refs
+      changes: *code-backstage-patterns
+
+.frontend:rules:jest:minimal:
+  rules:
+    - <<: *if-merge-request-approved
+      when: never
+    - <<: *if-automated-merge-request
+      when: never
+    - <<: *if-merge-request-title-run-all-jest
+      when: never
+    - <<: *if-default-refs
+      changes: *core-frontend-patterns
+      when: never
+    - <<: *if-default-refs
+      changes: *backend-patterns
+      when: never
+    - <<: *if-merge-request
+      changes: *ci-patterns
+      when: never
+    - <<: *if-merge-request
+      changes: *code-backstage-patterns
+
 .frontend:rules:eslint-as-if-foss:
   rules:
     - <<: *if-not-ee
@@ -607,11 +671,18 @@
 ###############
 # Rails rules #
 ###############
+.rails:rules:decomposed-databases:
+  rules:
+    - <<: *if-merge-request-run-decomposed
+      allow_failure: true
+
 .rails:rules:ee-and-foss-migration:
   rules:
     - <<: *if-merge-request-title-run-all-rspec
     - <<: *if-merge-request
       changes: *ci-patterns
+    - <<: *if-merge-request
+      changes: *db-patterns
     - <<: *if-automated-merge-request
       changes: *db-patterns
     - <<: *if-merge-request-not-approved
@@ -631,6 +702,7 @@
       when: never
     - <<: *if-merge-request
       changes: *db-patterns
+      when: never
 
 .rails:rules:ee-and-foss-mr-with-migration:
   rules:
@@ -758,6 +830,8 @@
     - <<: *if-merge-request-title-run-all-rspec
     - <<: *if-merge-request
       changes: *ci-patterns
+    - <<: *if-merge-request
+      changes: *db-patterns
     - <<: *if-automated-merge-request
       changes: *db-patterns
     - <<: *if-merge-request-not-approved
@@ -779,6 +853,7 @@
       when: never
     - <<: *if-merge-request
       changes: *db-patterns
+      when: never
 
 .rails:rules:ee-only-unit:
   rules:
@@ -874,14 +949,14 @@
     - <<: *if-merge-request-title-run-all-rspec
     - <<: *if-merge-request
       changes: *ci-patterns
-    - <<: *if-automated-merge-request
-      changes: *db-patterns
-    - <<: *if-merge-request-not-approved
-      when: never
     - <<: *if-security-merge-request
       changes: *db-patterns
     - <<: *if-merge-request-title-as-if-foss
       changes: *db-patterns
+    - <<: *if-automated-merge-request
+      changes: *db-patterns
+    - <<: *if-merge-request-not-approved
+      when: never
 
 .rails:rules:as-if-foss-migration:minimal:
   rules:
@@ -896,8 +971,10 @@
       when: never
     - <<: *if-security-merge-request
       changes: *db-patterns
+      when: never
     - <<: *if-merge-request-title-as-if-foss
       changes: *db-patterns
+      when: never
 
 .rails:rules:as-if-foss-unit:
   rules:
@@ -1212,7 +1289,7 @@
   rules:
     - if: '$DAST_DISABLED || $GITLAB_FEATURES !~ /\bdast\b/'
       when: never
-    - <<: *if-default-branch-schedule-nightly
+    - <<: *if-dot-com-ee-nightly-schedule
       allow_failure: true
 
 .reports:rules:package_hunter-yarn:
@@ -1405,8 +1482,6 @@
       changes: *code-qa-patterns
       when: manual
       allow_failure: true
-    - <<: *if-dot-com-gitlab-org-schedule
-      allow_failure: true
 
 .review:rules:danger:
   rules:
diff --git a/.gitlab/ci/setup.gitlab-ci.yml b/.gitlab/ci/setup.gitlab-ci.yml
index f2d5d872d64..60a1ad54cff 100644
--- a/.gitlab/ci/setup.gitlab-ci.yml
+++ b/.gitlab/ci/setup.gitlab-ci.yml
@@ -70,11 +70,16 @@ verify-tests-yml:
     - install_gitlab_gem
     - install_tff_gem
     - retrieve_tests_mapping
-    - 'if [ -n "$CI_MERGE_REQUEST_IID" ]; then tooling/bin/find_tests ${MATCHED_TESTS_FILE}; fi'
-    - 'if [ -n "$CI_MERGE_REQUEST_IID" ]; then echo "test files affected: $(cat $MATCHED_TESTS_FILE)"; fi'
+    - |
+      if [ -n "$CI_MERGE_REQUEST_IID" ]; then
+        tooling/bin/find_changes ${CHANGES_FILE};
+        tooling/bin/find_tests ${CHANGES_FILE} ${MATCHED_TESTS_FILE};
+        echo "related rspec tests: $(cat $MATCHED_TESTS_FILE)";
+      fi
   artifacts:
     expire_in: 7d
     paths:
+      - ${CHANGES_FILE}
       - ${MATCHED_TESTS_FILE}
 
 detect-tests:
@@ -83,6 +88,7 @@ detect-tests:
     - .rails:rules:detect-tests
   variables:
     RSPEC_TESTS_MAPPING_ENABLED: "true"
+    CHANGES_FILE: tmp/changed_files.txt
     MATCHED_TESTS_FILE: tmp/matching_tests.txt
 
 detect-tests as-if-foss:
@@ -91,6 +97,7 @@ detect-tests as-if-foss:
     - .rails:rules:detect-tests
     - .as-if-foss
   variables:
+    CHANGES_FILE: tmp/changed_foss_files.txt
     MATCHED_TESTS_FILE: tmp/matching_foss_tests.txt
   before_script:
     - '[ "$FOSS_ONLY" = "1" ] && rm -rf ee/ qa/spec/ee/ qa/qa/specs/features/ee/ qa/qa/ee/ qa/qa/ee.rb'
diff --git a/.gitlab/ci/static-analysis.gitlab-ci.yml b/.gitlab/ci/static-analysis.gitlab-ci.yml
new file mode 100644
index 00000000000..1394085b6e4
--- /dev/null
+++ b/.gitlab/ci/static-analysis.gitlab-ci.yml
@@ -0,0 +1,42 @@
+.static-analysis-base:
+  extends:
+    - .default-retry
+    - .default-before_script
+    - .static-analysis-cache
+  needs: []
+  variables:
+    SETUP_DB: "false"
+    ENABLE_SPRING: "1"
+    # Disable warnings in browserslist which can break on backports
+    # https://github.com/browserslist/browserslist/blob/a287ec6/node.js#L367-L384
+    BROWSERSLIST_IGNORE_OLD_DATA: "true"
+
+update-static-analysis-cache:
+  extends:
+    - .static-analysis-base
+    - .static-analysis-cache-push
+    - .shared:rules:update-cache
+  stage: prepare
+  script:
+    - run_timed_command "bundle exec rubocop --parallel"  # For the moment we only cache `tmp/rubocop_cache` so we don't need to run all the tasks.
+
+static-analysis:
+  extends:
+    - .static-analysis-base
+    - .static-analysis:rules:ee-and-foss
+  stage: test
+  parallel: 4
+  script:
+    - run_timed_command "retry yarn install --frozen-lockfile"
+    - scripts/static-analysis
+  artifacts:
+    expire_in: 31d
+    when: always
+    paths:
+      - tmp/feature_flags/
+
+static-analysis as-if-foss:
+  extends:
+    - static-analysis
+    - .static-analysis:rules:as-if-foss
+    - .as-if-foss
diff --git a/.gitlab/ci/test-metadata.gitlab-ci.yml b/.gitlab/ci/test-metadata.gitlab-ci.yml
index 135bf8b6a8c..ac719977975 100644
--- a/.gitlab/ci/test-metadata.gitlab-ci.yml
+++ b/.gitlab/ci/test-metadata.gitlab-ci.yml
@@ -26,6 +26,7 @@ update-tests-metadata:
     - .test-metadata:rules:update-tests-metadata
   stage: post-test
   dependencies:
+    - retrieve-tests-metadata
     - setup-test-env
     - rspec migration pg12
     - rspec frontend_fixture
diff --git a/.gitlab/ci/workhorse.gitlab-ci.yml b/.gitlab/ci/workhorse.gitlab-ci.yml
index ba4523f3bf7..0da0a334699 100644
--- a/.gitlab/ci/workhorse.gitlab-ci.yml
+++ b/.gitlab/ci/workhorse.gitlab-ci.yml
@@ -23,10 +23,10 @@ workhorse:verify:
     - apt-get update && apt-get -y install libimage-exiftool-perl
     - make -C workhorse test
 
-workhorse:test using go 1.15:
-  extends: .workhorse:test
-  image: ${GITLAB_DEPENDENCY_PROXY}golang:1.15
-
 workhorse:test using go 1.16:
   extends: .workhorse:test
   image: ${GITLAB_DEPENDENCY_PROXY}golang:1.16
+
+workhorse:test using go 1.17:
+  extends: .workhorse:test
+  image: ${GITLAB_DEPENDENCY_PROXY}golang:1.17
diff --git a/.gitlab/ci/yaml.gitlab-ci.yml b/.gitlab/ci/yaml.gitlab-ci.yml
index a0961866465..b25ad55e0ce 100644
--- a/.gitlab/ci/yaml.gitlab-ci.yml
+++ b/.gitlab/ci/yaml.gitlab-ci.yml
@@ -1,4 +1,4 @@
-# Yamllint of CI-related yaml and changelogs.
+# Yamllint of CI-related yaml.
 # This uses rules from project root `.yamllint`.
 lint-yaml:
   extends:
@@ -8,6 +8,6 @@ lint-yaml:
   stage: test
   needs: []
   variables:
-    LINT_PATHS: .gitlab-ci.yml .gitlab/ci lib/gitlab/ci/templates changelogs
+    LINT_PATHS: .gitlab-ci.yml .gitlab/ci lib/gitlab/ci/templates
   script:
     - yamllint -f colored $LINT_PATHS