Add latest changes from gitlab-org/gitlab@13-7-stable-eev13.7.0-rc42

9 files changed, 344 insertions, 22 deletions

diff --git a/.gitlab/ci/dev-fixtures.gitlab-ci.yml b/.gitlab/ci/dev-fixtures.gitlab-ci.yml
index 4141cc7f071..c19dce7e4a9 100644
--- a/.gitlab/ci/dev-fixtures.gitlab-ci.yml
+++ b/.gitlab/ci/dev-fixtures.gitlab-ci.yml
@@ -8,9 +8,9 @@
   needs: ["setup-test-env"]
   variables:
     FIXTURE_PATH: "db/fixtures/development"
-    SEED_CYCLE_ANALYTICS: "true"
+    SEED_VSA: "true"
     SEED_PRODUCTIVITY_ANALYTICS: "true"
-    CYCLE_ANALYTICS_ISSUE_COUNT: 1
+    VSA_ISSUE_COUNT: 1
     SIZE: 0  # number of external projects to fork, requires network connection
     # SEED_NESTED_GROUPS: "false" # requires network connection
 
diff --git a/.gitlab/ci/docs.gitlab-ci.yml b/.gitlab/ci/docs.gitlab-ci.yml
index b258eb73515..d6dc709a11a 100644
--- a/.gitlab/ci/docs.gitlab-ci.yml
+++ b/.gitlab/ci/docs.gitlab-ci.yml
@@ -53,7 +53,7 @@ docs-lint links:
   extends:
     - .default-retry
     - .docs:rules:docs-lint
-  image: "registry.gitlab.com/gitlab-org/gitlab-docs/lint:ruby-2.7.2-alpine-3.12-vale-2.4.3-markdownlint-0.24.0"
+  image: "registry.gitlab.com/gitlab-org/gitlab-docs/lint-html:alpine-3.12-ruby-2.7.2"
   stage: test
   needs: []
   script:
@@ -66,6 +66,13 @@ docs-lint links:
     - bundle exec nanoc
     # Check the internal links
     - bundle exec nanoc check internal_links
+    # Delete the redirect files, rebuild, and check internal links again, to see if we are linking to redirects.
+    # Don't delete the documentation/index.md, which is a false positive for the simple grep.
+    - grep -rl "redirect_to:" /tmp/gitlab-docs/content/ee/ | grep -v "development/documentation/index.md" | xargs rm -f
+    - bundle exec nanoc
+    - echo -e "\e[1;96mThe following test fails when a doc links to a redirect file."
+    - echo -e "\e[1;96mMake sure all links point to the correct page."
+    - bundle exec nanoc check internal_links
     # Check the internal anchor links
     - bundle exec nanoc check internal_anchors
 
diff --git a/.gitlab/ci/rails.gitlab-ci.yml b/.gitlab/ci/rails.gitlab-ci.yml
index 14b07dd4a2a..2818b6be176 100644
--- a/.gitlab/ci/rails.gitlab-ci.yml
+++ b/.gitlab/ci/rails.gitlab-ci.yml
@@ -14,6 +14,10 @@
   - run_timed_command "scripts/gitaly-test-spawn"
   - source ./scripts/rspec_helpers.sh
 
+.minimal-rspec-tests:
+  variables:
+    RSPEC_TESTS_MAPPING_ENABLED: "true"
+
 .rspec-base:
   extends: .rails-job-base
   stage: test
@@ -21,7 +25,8 @@
     RUBY_GC_MALLOC_LIMIT: 67108864
     RUBY_GC_MALLOC_LIMIT_MAX: 134217728
     CRYSTALBALL: "true"
-  needs: ["setup-test-env", "retrieve-tests-metadata", "compile-test-assets"]
+    RECORD_DEPRECATIONS: "true"
+  needs: ["setup-test-env", "retrieve-tests-metadata", "compile-test-assets", "detect-tests"]
   script:
     - *base-script
     - rspec_paralellized_job "--tag ~quarantine --tag ~geo --tag ~level:migration"
@@ -31,6 +36,7 @@
     paths:
       - coverage/
       - crystalball/
+      - deprecations/
       - knapsack/
       - rspec_flaky/
       - rspec_profiling/
@@ -62,7 +68,7 @@
     - .rspec-base
     - .as-if-foss
     - .use-pg11
-  needs: ["setup-test-env", "retrieve-tests-metadata", "compile-test-assets as-if-foss"]
+  needs: ["setup-test-env", "retrieve-tests-metadata", "compile-test-assets as-if-foss", "detect-tests"]
 
 .rspec-ee-base-pg11:
   extends:
@@ -238,24 +244,48 @@ rspec migration pg11:
     - .rspec-base-migration
     - .rspec-migration-parallel
 
+rspec migration pg11 minimal:
+  extends:
+    - rspec migration pg11
+    - .minimal-rspec-tests
+    - .rails:rules:ee-and-foss-migration:minimal
+
 rspec unit pg11:
   extends:
     - .rspec-base-pg11
     - .rails:rules:ee-and-foss-unit
     - .rspec-unit-parallel
 
+rspec unit pg11 minimal:
+  extends:
+    - rspec unit pg11
+    - .minimal-rspec-tests
+    - .rails:rules:ee-and-foss-unit:minimal
+
 rspec integration pg11:
   extends:
     - .rspec-base-pg11
     - .rails:rules:ee-and-foss-integration
     - .rspec-integration-parallel
 
+rspec integration pg11 minimal:
+  extends:
+    - rspec integration pg11
+    - .minimal-rspec-tests
+    - .rails:rules:ee-and-foss-integration:minimal
+
 rspec system pg11:
   extends:
     - .rspec-base-pg11
     - .rails:rules:ee-and-foss-system
     - .rspec-system-parallel
 
+rspec system pg11 minimal:
+  extends:
+    - rspec system pg11
+    - .minimal-rspec-tests
+    - .rails:rules:ee-and-foss-system:minimal
+
 rspec fast_spec_helper:
   extends:
     - .rspec-base-pg11
@@ -263,6 +293,12 @@ rspec fast_spec_helper:
   script:
     - bin/rspec spec/fast_spec_helper.rb
 
+rspec fast_spec_helper minimal:
+  extends:
+    - rspec fast_spec_helper
+    - .minimal-rspec-tests
+    - .rails:rules:ee-and-foss-fast_spec_helper:minimal
+
 db:migrate:reset:
   extends: .db-job-base
   script:
@@ -284,7 +320,7 @@ db:migrate-from-v12.10.0:
     - export TAG_TO_CHECKOUT="v12.10.0-ee"
     - '[[ -d "ee/" ]] || export PROJECT_TO_CHECKOUT="gitlab-foss"'
     - '[[ -d "ee/" ]] || export TAG_TO_CHECKOUT="v12.10.0"'
-    - git fetch https://gitlab.com/gitlab-org/$PROJECT_TO_CHECKOUT.git $TAG_TO_CHECKOUT
+    - retry 'git fetch https://gitlab.com/gitlab-org/$PROJECT_TO_CHECKOUT.git $TAG_TO_CHECKOUT'
     - git checkout -f FETCH_HEAD
     - sed -i -e "s/gem 'grpc', '~> 1.24.0'/gem 'grpc', '~> 1.30.2'/" Gemfile  # Update gRPC for Ruby 2.7
     - sed -i -e "s/gem 'google-protobuf', '~> 3.8.0'/gem 'google-protobuf', '~> 3.12.0'/" Gemfile
@@ -382,6 +418,7 @@ rspec:feature-flags:
     - .coverage-base
     - .rails:rules:rspec-feature-flags
   stage: post-test
+  allow_failure: true
   # We cannot use needs since it would mean needing 84 jobs (since most are parallelized)
   # so we use `dependencies` here.
   dependencies:
@@ -401,7 +438,8 @@ rspec:feature-flags:
     - memory-on-boot
   script:
     - run_timed_command "bundle install --jobs=$(nproc) --path=vendor --retry=3 --quiet --without default development test production puma unicorn kerberos metrics omnibus ed25519"
-    - run_timed_command "bundle exec scripts/used-feature-flags"
+    - 'run_timed_command "bundle exec scripts/used-feature-flags" || (scripts/slack master-broken "☠️ \`${CI_JOB_NAME}\` failed! ☠️ See ${CI_JOB_URL}" ci_failing "GitLab Bot" && exit 1)'
+
 # EE/FOSS: default refs (MRs, master, schedules) jobs #
 #######################################################
 
@@ -414,24 +452,48 @@ rspec migration pg11-as-if-foss:
     - .rails:rules:as-if-foss-migration
     - .rspec-migration-parallel
 
+rspec migration pg11-as-if-foss minimal:
+  extends:
+    - rspec migration pg11-as-if-foss
+    - .minimal-rspec-tests
+    - .rails:rules:as-if-foss-migration:minimal
+
 rspec unit pg11-as-if-foss:
   extends:
     - .rspec-base-pg11-as-if-foss
     - .rails:rules:as-if-foss-unit
     - .rspec-unit-parallel
 
+rspec unit pg11-as-if-foss minimal:
+  extends:
+    - rspec unit pg11-as-if-foss
+    - .minimal-rspec-tests
+    - .rails:rules:as-if-foss-unit:minimal
+
 rspec integration pg11-as-if-foss:
   extends:
     - .rspec-base-pg11-as-if-foss
     - .rails:rules:as-if-foss-integration
     - .rspec-integration-parallel
 
+rspec integration pg11-as-if-foss minimal:
+  extends:
+    - rspec integration pg11-as-if-foss
+    - .minimal-rspec-tests
+    - .rails:rules:as-if-foss-integration:minimal
+
 rspec system pg11-as-if-foss:
   extends:
     - .rspec-base-pg11-as-if-foss
     - .rails:rules:as-if-foss-system
     - .rspec-system-parallel
 
+rspec system pg11-as-if-foss minimal:
+  extends:
+    - rspec system pg11-as-if-foss
+    - .minimal-rspec-tests
+    - .rails:rules:as-if-foss-system:minimal
+
 rspec-ee migration pg11:
   extends:
     - .rspec-ee-base-pg11
@@ -439,40 +501,82 @@ rspec-ee migration pg11:
     - .rails:rules:ee-only-migration
     - .rspec-ee-migration-parallel
 
+rspec-ee migration pg11 minimal:
+  extends:
+    - rspec-ee migration pg11
+    - .minimal-rspec-tests
+    - .rails:rules:ee-only-migration:minimal
+
 rspec-ee unit pg11:
   extends:
     - .rspec-ee-base-pg11
     - .rails:rules:ee-only-unit
     - .rspec-ee-unit-parallel
 
+rspec-ee unit pg11 minimal:
+  extends:
+    - rspec-ee unit pg11
+    - .minimal-rspec-tests
+    - .rails:rules:ee-only-unit:minimal
+
 rspec-ee integration pg11:
   extends:
     - .rspec-ee-base-pg11
     - .rails:rules:ee-only-integration
     - .rspec-ee-integration-parallel
 
+rspec-ee integration pg11 minimal:
+  extends:
+    - rspec-ee integration pg11
+    - .minimal-rspec-tests
+    - .rails:rules:ee-only-integration:minimal
+
 rspec-ee system pg11:
   extends:
     - .rspec-ee-base-pg11
     - .rails:rules:ee-only-system
     - .rspec-ee-system-parallel
 
+rspec-ee system pg11 minimal:
+  extends:
+    - rspec-ee system pg11
+    - .minimal-rspec-tests
+    - .rails:rules:ee-only-system:minimal
+
 rspec-ee unit pg11 geo:
   extends:
     - .rspec-ee-base-geo-pg11
     - .rails:rules:ee-only-unit
     - .rspec-ee-unit-geo-parallel
 
+rspec-ee unit pg11 geo minimal:
+  extends:
+    - rspec-ee unit pg11 geo
+    - .minimal-rspec-tests
+    - .rails:rules:ee-only-unit:minimal
+
 rspec-ee integration pg11 geo:
   extends:
     - .rspec-ee-base-geo-pg11
     - .rails:rules:ee-only-integration
 
+rspec-ee integration pg11 geo minimal:
+  extends:
+    - rspec-ee integration pg11 geo
+    - .minimal-rspec-tests
+    - .rails:rules:ee-only-integration:minimal
+
 rspec-ee system pg11 geo:
   extends:
     - .rspec-ee-base-geo-pg11
     - .rails:rules:ee-only-system
 
+rspec-ee system pg11 geo minimal:
+  extends:
+    - rspec-ee system pg11 geo
+    - .minimal-rspec-tests
+    - .rails:rules:ee-only-system:minimal
+
 db:rollback geo:
   extends:
     - db:rollback
diff --git a/.gitlab/ci/reports.gitlab-ci.yml b/.gitlab/ci/reports.gitlab-ci.yml
index 565ed93967c..85aec070557 100644
--- a/.gitlab/ci/reports.gitlab-ci.yml
+++ b/.gitlab/ci/reports.gitlab-ci.yml
@@ -145,6 +145,10 @@ dependency_scanning:
         --volume "$PWD:/code" \
         --volume /var/run/docker.sock:/var/run/docker.sock \
         "registry.gitlab.com/gitlab-org/security-products/dependency-scanning:$DS_MAJOR_VERSION" /code
+    # Post-processing: This will be an after_script once this job will use the Dependency Scanning CI template
+    - apk add jq
+    # Lower execa severity based on https://gitlab.com/gitlab-org/gitlab/-/issues/223859#note_452922390
+    - jq '(.vulnerabilities[] | select (.cve == "yarn.lock:execa:gemnasium:05cfa2e8-2d0c-42c1-8894-638e2f12ff3d")).severity = "Medium"' gl-dependency-scanning-report.json > temp.json && mv temp.json gl-dependency-scanning-report.json
   artifacts:
     paths:
       - gl-dependency-scanning-report.json  # GitLab-specific
diff --git a/.gitlab/ci/review.gitlab-ci.yml b/.gitlab/ci/review.gitlab-ci.yml
index d3069657e88..f1bd173ff6d 100644
--- a/.gitlab/ci/review.gitlab-ci.yml
+++ b/.gitlab/ci/review.gitlab-ci.yml
@@ -38,7 +38,7 @@ review-build-cng:
     - BUILD_TRIGGER_TOKEN=$REVIEW_APPS_BUILD_TRIGGER_TOKEN ./scripts/trigger-build cng
     # When the job is manual, review-deploy is also manual and we don't want people
     # to have to manually start the jobs in sequence, so we do it for them.
-    - '[ -z $CI_JOB_MANUAL ] || play_job "review-deploy"'
+    - '[ -z $CI_JOB_MANUAL ] || scripts/api/play_job --job-name "review-deploy"'
 
 .review-workflow-base:
   extends:
@@ -78,8 +78,8 @@ review-deploy:
     - disable_sign_ups || (delete_release && exit 1)
     # When the job is manual, review-qa-smoke is also manual and we don't want people
     # to have to manually start the jobs in sequence, so we do it for them.
-    - '[ -z $CI_JOB_MANUAL ] || play_job "review-qa-smoke"'
-    - '[ -z $CI_JOB_MANUAL ] || play_job "review-performance"'
+    - '[ -z $CI_JOB_MANUAL ] || scripts/api/play_job --job-name "review-qa-smoke"'
+    - '[ -z $CI_JOB_MANUAL ] || scripts/api/play_job --job-name "review-performance"'
   after_script:
     # Run seed-dast-test-data.sh only when DAST_RUN is set to true. This is to pupulate review app with data for DAST scan.
     # Set DAST_RUN to true when jobs are manually scheduled.
diff --git a/.gitlab/ci/rules.gitlab-ci.yml b/.gitlab/ci/rules.gitlab-ci.yml
index 7f469221da2..159defc83c3 100644
--- a/.gitlab/ci/rules.gitlab-ci.yml
+++ b/.gitlab/ci/rules.gitlab-ci.yml
@@ -46,6 +46,9 @@
 .if-security-merge-request: &if-security-merge-request
   if: '$CI_PROJECT_NAMESPACE == "gitlab-org/security" && $CI_MERGE_REQUEST_IID'
 
+.if-security-schedule: &if-security-schedule
+  if: '$CI_PROJECT_NAMESPACE == "gitlab-org/security" && $CI_PIPELINE_SOURCE == "schedule"'
+
 .if-dot-com-gitlab-org-schedule: &if-dot-com-gitlab-org-schedule
   if: '$CI_SERVER_HOST == "gitlab.com" && $CI_PROJECT_NAMESPACE == "gitlab-org" && $CI_PIPELINE_SOURCE == "schedule"'
 
@@ -67,6 +70,9 @@
 .if-cache-credentials-schedule: &if-cache-credentials-schedule
   if: '$CI_REPO_CACHE_CREDENTIALS && $CI_PIPELINE_SOURCE == "schedule"'
 
+.if-merge-request-rspec-minimal-disabled: &if-merge-request-rspec-minimal-disabled
+  if: '$CI_MERGE_REQUEST_IID && $RSPEC_MINIMAL_ENABLED != "true"'
+
 .if-rspec-fail-fast-disabled: &if-rspec-fail-fast-disabled
   if: '$RSPEC_FAIL_FAST_ENABLED != "true"'
 
@@ -103,6 +109,10 @@
   - ".gitlab/ci/build-images.gitlab-ci.yml"
   - ".gitlab/ci/qa.gitlab-ci.yml"
 
+.workhorse-patterns: &workhorse-patterns
+  - "GITLAB_WORKHORSE_VERSION"
+  - "workhorse/**/*"
+
 .yaml-lint-patterns: &yaml-lint-patterns
   - ".gitlab-ci.yml"
   - ".gitlab/ci/**/*.yml"
@@ -154,6 +164,7 @@
   - "{,ee/}fixtures/**/*"
   - "{,ee/}rubocop/**/*"
   - "{,ee/}spec/**/*"
+  - "{,spec/}tooling/**/*"
 
 .code-patterns: &code-patterns
   - "{package.json,yarn.lock}"
@@ -200,6 +211,7 @@
   - "{,ee/}fixtures/**/*"
   - "{,ee/}rubocop/**/*"
   - "{,ee/}spec/**/*"
+  - "{,spec/}tooling/**/*"
 
 .code-qa-patterns: &code-qa-patterns
   - "{package.json,yarn.lock}"
@@ -245,6 +257,7 @@
   - "{,ee/}fixtures/**/*"
   - "{,ee/}rubocop/**/*"
   - "{,ee/}spec/**/*"
+  - "{,spec/}tooling/**/*"
   # QA changes
   - ".dockerignore"
   - "qa/**/*"
@@ -255,6 +268,7 @@
 .shared:rules:update-cache:
   rules:
     - <<: *if-master-schedule-2-hourly
+    - <<: *if-security-schedule
     - <<: *if-merge-request-title-update-caches
 
 ######################
@@ -395,6 +409,7 @@
       when: never
     - <<: *if-merge-request
       changes: *code-backstage-patterns
+      when: always
     - <<: *if-master-refs
       changes: *code-backstage-patterns
 
@@ -480,26 +495,86 @@
     - changes: *db-patterns
     - <<: *if-merge-request-title-run-all-rspec
 
+.rails:rules:ee-and-foss-migration:minimal:
+  rules:
+    - <<: *if-merge-request-rspec-minimal-disabled
+      when: never
+    - <<: *if-merge-request-title-run-all-rspec
+      when: never
+    - <<: *if-merge-request
+      changes: *ci-patterns
+      when: never
+    - <<: *if-merge-request
+      changes: *db-patterns
+
 .rails:rules:ee-and-foss-unit:
   rules:
     - changes: *backend-patterns
     - <<: *if-merge-request-title-run-all-rspec
 
+.rails:rules:ee-and-foss-unit:minimal:
+  rules:
+    - <<: *if-merge-request-rspec-minimal-disabled
+      when: never
+    - <<: *if-merge-request-title-run-all-rspec
+      when: never
+    - <<: *if-merge-request
+      changes: *ci-patterns
+      when: never
+    - <<: *if-merge-request
+      changes: *backend-patterns
+
 .rails:rules:ee-and-foss-integration:
   rules:
     - changes: *backend-patterns
     - <<: *if-merge-request-title-run-all-rspec
 
+.rails:rules:ee-and-foss-integration:minimal:
+  rules:
+    - <<: *if-merge-request-rspec-minimal-disabled
+      when: never
+    - <<: *if-merge-request-title-run-all-rspec
+      when: never
+    - <<: *if-merge-request
+      changes: *ci-patterns
+      when: never
+    - <<: *if-merge-request
+      changes: *backend-patterns
+
 .rails:rules:ee-and-foss-system:
   rules:
     - changes: *code-backstage-patterns
     - <<: *if-merge-request-title-run-all-rspec
 
+.rails:rules:ee-and-foss-system:minimal:
+  rules:
+    - <<: *if-merge-request-rspec-minimal-disabled
+      when: never
+    - <<: *if-merge-request-title-run-all-rspec
+      when: never
+    - <<: *if-merge-request
+      changes: *ci-patterns
+      when: never
+    - <<: *if-merge-request
+      changes: *code-backstage-patterns
+
 .rails:rules:ee-and-foss-fast_spec_helper:
   rules:
     - changes: ["config/**/*"]
     - <<: *if-merge-request-title-run-all-rspec
 
+.rails:rules:ee-and-foss-fast_spec_helper:minimal:
+  rules:
+    - <<: *if-merge-request-rspec-minimal-disabled
+      when: never
+    - <<: *if-merge-request-title-run-all-rspec
+      when: never
+    - <<: *if-merge-request
+      changes: *ci-patterns
+      when: never
+    - <<: *if-merge-request
+      changes: ["config/**/*"]
+
 .rails:rules:default-refs-code-backstage-qa:
   rules:
     - <<: *if-default-refs
@@ -513,6 +588,20 @@
     - changes: *db-patterns
     - <<: *if-merge-request-title-run-all-rspec
 
+.rails:rules:ee-only-migration:minimal:
+  rules:
+    - <<: *if-not-ee
+      when: never
+    - <<: *if-merge-request-rspec-minimal-disabled
+      when: never
+    - <<: *if-merge-request-title-run-all-rspec
+      when: never
+    - <<: *if-merge-request
+      changes: *ci-patterns
+      when: never
+    - <<: *if-merge-request
+      changes: *db-patterns
+
 .rails:rules:ee-only-unit:
   rules:
     - <<: *if-not-ee
@@ -520,6 +609,20 @@
     - changes: *backend-patterns
     - <<: *if-merge-request-title-run-all-rspec
 
+.rails:rules:ee-only-unit:minimal:
+  rules:
+    - <<: *if-not-ee
+      when: never
+    - <<: *if-merge-request-rspec-minimal-disabled
+      when: never
+    - <<: *if-merge-request-title-run-all-rspec
+      when: never
+    - <<: *if-merge-request
+      changes: *ci-patterns
+      when: never
+    - <<: *if-merge-request
+      changes: *backend-patterns
+
 .rails:rules:ee-only-integration:
   rules:
     - <<: *if-not-ee
@@ -527,6 +630,20 @@
     - changes: *backend-patterns
     - <<: *if-merge-request-title-run-all-rspec
 
+.rails:rules:ee-only-integration:minimal:
+  rules:
+    - <<: *if-not-ee
+      when: never
+    - <<: *if-merge-request-rspec-minimal-disabled
+      when: never
+    - <<: *if-merge-request-title-run-all-rspec
+      when: never
+    - <<: *if-merge-request
+      changes: *ci-patterns
+      when: never
+    - <<: *if-merge-request
+      changes: *backend-patterns
+
 .rails:rules:ee-only-system:
   rules:
     - <<: *if-not-ee
@@ -534,6 +651,20 @@
     - changes: *code-backstage-patterns
     - <<: *if-merge-request-title-run-all-rspec
 
+.rails:rules:ee-only-system:minimal:
+  rules:
+    - <<: *if-not-ee
+      when: never
+    - <<: *if-merge-request-rspec-minimal-disabled
+      when: never
+    - <<: *if-merge-request-title-run-all-rspec
+      when: never
+    - <<: *if-merge-request
+      changes: *ci-patterns
+      when: never
+    - <<: *if-merge-request
+      changes: *code-backstage-patterns
+
 .rails:rules:as-if-foss-migration:
   rules:
     - <<: *if-not-ee
@@ -545,6 +676,20 @@
     - <<: *if-merge-request
       changes: *ci-patterns
 
+.rails:rules:as-if-foss-migration:minimal:
+  rules:
+    - <<: *if-not-ee
+      when: never
+    - <<: *if-merge-request-rspec-minimal-disabled
+      when: never
+    - <<: *if-merge-request
+      changes: *ci-patterns
+      when: never
+    - <<: *if-security-merge-request
+      changes: *db-patterns
+    - <<: *if-merge-request-title-as-if-foss
+      changes: *db-patterns
+
 .rails:rules:as-if-foss-unit:
   rules:
     - <<: *if-not-ee
@@ -556,6 +701,20 @@
     - <<: *if-merge-request
       changes: *ci-patterns
 
+.rails:rules:as-if-foss-unit:minimal:
+  rules:
+    - <<: *if-not-ee
+      when: never
+    - <<: *if-merge-request-rspec-minimal-disabled
+      when: never
+    - <<: *if-merge-request
+      changes: *ci-patterns
+      when: never
+    - <<: *if-security-merge-request
+      changes: *backend-patterns
+    - <<: *if-merge-request-title-as-if-foss
+      changes: *backend-patterns
+
 .rails:rules:as-if-foss-integration:
   rules:
     - <<: *if-not-ee
@@ -567,6 +726,20 @@
     - <<: *if-merge-request
       changes: *ci-patterns
 
+.rails:rules:as-if-foss-integration:minimal:
+  rules:
+    - <<: *if-not-ee
+      when: never
+    - <<: *if-merge-request-rspec-minimal-disabled
+      when: never
+    - <<: *if-merge-request
+      changes: *ci-patterns
+      when: never
+    - <<: *if-security-merge-request
+      changes: *backend-patterns
+    - <<: *if-merge-request-title-as-if-foss
+      changes: *backend-patterns
+
 .rails:rules:as-if-foss-system:
   rules:
     - <<: *if-not-ee
@@ -578,6 +751,20 @@
     - <<: *if-merge-request
       changes: *ci-patterns
 
+.rails:rules:as-if-foss-system:minimal:
+  rules:
+    - <<: *if-not-ee
+      when: never
+    - <<: *if-merge-request-rspec-minimal-disabled
+      when: never
+    - <<: *if-merge-request
+      changes: *ci-patterns
+      when: never
+    - <<: *if-security-merge-request
+      changes: *code-backstage-patterns
+    - <<: *if-merge-request-title-as-if-foss
+      changes: *code-backstage-patterns
+
 .rails:rules:ee-mr-and-master-only:
   rules:
     - <<: *if-not-ee
@@ -590,12 +777,9 @@
 
 .rails:rules:detect-tests:
   rules:
-    - <<: *if-not-ee
-      when: never
-    - <<: *if-security-merge-request
-      changes: *code-backstage-patterns
-    - <<: *if-dot-com-gitlab-org-merge-request
+    - <<: *if-default-refs
       changes: *code-backstage-patterns
+    - <<: *if-merge-request-title-run-all-rspec
 
 .rails:rules:rspec-foss-impact:
   rules:
@@ -647,8 +831,10 @@
       when: never
     - <<: *if-merge-request
       changes: *code-backstage-patterns
+      when: always
     - <<: *if-master-schedule-2-hourly
     - <<: *if-merge-request-title-run-all-rspec
+      when: always
 
 .rails:rules:rspec-feature-flags:
   rules:
@@ -913,6 +1099,14 @@
       changes: *code-backstage-patterns
 
 ###################
+# workhorse rules #
+###################
+.workhorse:rules:workhorse:
+  rules:
+    - <<: *if-default-refs
+      changes: *workhorse-patterns
+
+###################
 # yaml-lint rules #
 ###################
 .yaml-lint:rules:
diff --git a/.gitlab/ci/setup.gitlab-ci.yml b/.gitlab/ci/setup.gitlab-ci.yml
index abe7625c740..74510a0a03a 100644
--- a/.gitlab/ci/setup.gitlab-ci.yml
+++ b/.gitlab/ci/setup.gitlab-ci.yml
@@ -61,15 +61,17 @@ verify-tests-yml:
     - scripts/verify-tff-mapping
 
 .detect-test-base:
-  image: ruby:2.7-alpine
+  image: ruby:2.7
   needs: []
   stage: prepare
   script:
-    - source scripts/utils.sh
+    - source ./scripts/utils.sh
+    - source ./scripts/rspec_helpers.sh
     - install_gitlab_gem
     - install_tff_gem
-    - tooling/bin/find_foss_tests ${MATCHED_TESTS_FILE}
-    - 'echo "test files affected: $(cat $MATCHED_TESTS_FILE)"'
+    - retrieve_tests_mapping
+    - 'if [ -n "$CI_MERGE_REQUEST_IID" ]; then tooling/bin/find_tests ${MATCHED_TESTS_FILE}; fi'
+    - 'if [ -n "$CI_MERGE_REQUEST_IID" ]; then echo "test files affected: $(cat $MATCHED_TESTS_FILE)"; fi'
   artifacts:
     expire_in: 7d
     paths:
@@ -80,6 +82,7 @@ detect-tests:
     - .detect-test-base
     - .rails:rules:detect-tests
   variables:
+    RSPEC_TESTS_MAPPING_ENABLED: "true"
     MATCHED_TESTS_FILE: tmp/matching_tests.txt
 
 detect-tests as-if-foss:
diff --git a/.gitlab/ci/test-metadata.gitlab-ci.yml b/.gitlab/ci/test-metadata.gitlab-ci.yml
index e4b7047ef71..aec0a1640f1 100644
--- a/.gitlab/ci/test-metadata.gitlab-ci.yml
+++ b/.gitlab/ci/test-metadata.gitlab-ci.yml
@@ -1,6 +1,5 @@
 .tests-metadata-state:
-  variables:
-    TESTS_METADATA_S3_BUCKET: "gitlab-ce-cache"
+  image: ruby:2.7
   before_script:
     - source scripts/utils.sh
   artifacts:
@@ -17,7 +16,8 @@ retrieve-tests-metadata:
     - .test-metadata:rules:retrieve-tests-metadata
   stage: prepare
   script:
-    - source scripts/rspec_helpers.sh
+    - install_gitlab_gem
+    - source ./scripts/rspec_helpers.sh
     - retrieve_tests_metadata
 
 update-tests-metadata:
diff --git a/.gitlab/ci/workhorse.gitlab-ci.yml b/.gitlab/ci/workhorse.gitlab-ci.yml
new file mode 100644
index 00000000000..29131159876
--- /dev/null
+++ b/.gitlab/ci/workhorse.gitlab-ci.yml
@@ -0,0 +1,10 @@
+workhorse:
+  extends: .workhorse:rules:workhorse
+  image: golang:1.14
+  stage: test
+  needs: []
+  script:
+    - rm .git/hooks/post-checkout
+    - git checkout .
+    - scripts/update-workhorse check
+    - make -C workhorse