Add latest changes from gitlab-org/gitlab@master

29 files changed, 530 insertions, 89 deletions

diff --git a/app/controllers/jira_connect/public_keys_controller.rb b/app/controllers/jira_connect/public_keys_controller.rb
index 2d767cda699..4505ab16926 100644
--- a/app/controllers/jira_connect/public_keys_controller.rb
+++ b/app/controllers/jira_connect/public_keys_controller.rb
@@ -10,7 +10,7 @@ module JiraConnect
     skip_before_action :authenticate_user!
 
     def show
-      return render_404 unless Gitlab.config.jira_connect.enable_public_keys_storage
+      return render_404 unless public_key_storage_enabled?
 
       render plain: public_key.key
     end
@@ -20,5 +20,11 @@ module JiraConnect
     def public_key
       JiraConnect::PublicKey.find(params[:id])
     end
+
+    def public_key_storage_enabled?
+      return true if Gitlab.config.jira_connect.enable_public_keys_storage
+
+      Gitlab::CurrentSettings.jira_connect_public_key_storage_enabled?
+    end
   end
 end
diff --git a/app/graphql/resolvers/notes/synthetic_note_resolver.rb b/app/graphql/resolvers/notes/synthetic_note_resolver.rb
new file mode 100644
index 00000000000..d4eafcd2c49
--- /dev/null
+++ b/app/graphql/resolvers/notes/synthetic_note_resolver.rb
@@ -0,0 +1,35 @@
+# frozen_string_literal: true
+
+module Resolvers
+  module Notes
+    class SyntheticNoteResolver < BaseResolver
+      include Gitlab::Graphql::Authorize::AuthorizeResource
+
+      authorize :read_note
+
+      type Types::Notes::NoteType, null: true
+
+      argument :sha, GraphQL::Types::String,
+        required: true,
+        description: 'Global ID of the note.'
+
+      argument :noteable_id, ::Types::GlobalIDType[::Noteable],
+        required: true,
+        description: 'Global ID of the resource to search synthetic note on.'
+
+      def resolve(noteable_id:, sha:)
+        noteable = authorized_find!(id: noteable_id)
+
+        synthetic_notes = ResourceEvents::MergeIntoNotesService.new(
+          noteable, current_user, paginated_notes: nil
+        ).execute
+
+        synthetic_notes.find { |note| note.discussion_id == sha }
+      end
+
+      def find_object(id:)
+        GitlabSchema.find_by_gid(id)
+      end
+    end
+  end
+end
diff --git a/app/graphql/types/query_type.rb b/app/graphql/types/query_type.rb
index 759819ba34b..41724fd71c9 100644
--- a/app/graphql/types/query_type.rb
+++ b/app/graphql/types/query_type.rb
@@ -76,6 +76,15 @@ module Types
           null: true,
           resolver: Resolvers::NamespaceResolver,
           description: "Find a namespace."
+    field :note,
+          ::Types::Notes::NoteType,
+          null: true,
+          description: 'Find a note.',
+          alpha: { milestone: '15.9' } do
+            argument :id, ::Types::GlobalIDType[::Note],
+              required: true,
+              description: 'Global ID of the note.'
+          end
     field :package,
           description: 'Find a package. This field can only be resolved for one query in any single request. Returns `null` if a package has no `default` status.',
           resolver: Resolvers::PackageDetailsResolver
@@ -108,6 +117,12 @@ module Types
           null: true,
           resolver: Resolvers::SnippetsResolver,
           description: 'Find Snippets visible to the current user.'
+    field :synthetic_note,
+          Types::Notes::NoteType,
+          null: true,
+          description: 'Find a synthetic note',
+          resolver: ::Resolvers::Notes::SyntheticNoteResolver,
+          alpha: { milestone: '15.9' }
     field :timelogs, Types::TimelogType.connection_type,
           null: true,
           description: 'Find timelogs visible to the current user.',
@@ -147,6 +162,10 @@ module Types
       GitlabSchema.find_by_gid(id)
     end
 
+    def note(id:)
+      GitlabSchema.find_by_gid(id)
+    end
+
     def merge_request(id:)
       GitlabSchema.find_by_gid(id)
     end
diff --git a/app/helpers/application_settings_helper.rb b/app/helpers/application_settings_helper.rb
index 49a98b9af1c..084e44e1e2e 100644
--- a/app/helpers/application_settings_helper.rb
+++ b/app/helpers/application_settings_helper.rb
@@ -305,6 +305,7 @@ module ApplicationSettingsHelper
       :inactive_projects_send_warning_email_after_months,
       :invisible_captcha_enabled,
       :jira_connect_application_key,
+      :jira_connect_public_key_storage_enabled,
       :jira_connect_proxy_url,
       :max_artifacts_size,
       :max_attachment_size,
diff --git a/app/helpers/jira_connect_helper.rb b/app/helpers/jira_connect_helper.rb
index ef8e516a4d1..50e3c3cc5fe 100644
--- a/app/helpers/jira_connect_helper.rb
+++ b/app/helpers/jira_connect_helper.rb
@@ -12,7 +12,7 @@ module JiraConnectHelper
       users_path: current_user ? nil : jira_connect_users_path, # users_path is used to determine if user is signed in
       gitlab_user_path: current_user ? user_path(current_user) : nil,
       oauth_metadata: Feature.enabled?(:jira_connect_oauth, current_user) ? jira_connect_oauth_data(installation).to_json : nil,
-      public_key_storage_enabled: Gitlab.config.jira_connect.enable_public_keys_storage
+      public_key_storage_enabled: Gitlab.config.jira_connect.enable_public_keys_storage || Gitlab::CurrentSettings.jira_connect_public_key_storage_enabled?
     }
   end
 
diff --git a/app/models/application_setting_implementation.rb b/app/models/application_setting_implementation.rb
index db2c053d12c..a5f262f2e1e 100644
--- a/app/models/application_setting_implementation.rb
+++ b/app/models/application_setting_implementation.rb
@@ -106,6 +106,7 @@ module ApplicationSettingImplementation
         invisible_captcha_enabled: false,
         issues_create_limit: 300,
         jira_connect_application_key: nil,
+        jira_connect_public_key_storage_enabled: false,
         jira_connect_proxy_url: nil,
         local_markdown_version: 0,
         login_recaptcha_protection_enabled: false,
diff --git a/app/services/resource_events/synthetic_milestone_notes_builder_service.rb b/app/services/resource_events/synthetic_milestone_notes_builder_service.rb
index 0e2b171e192..18c32ef1152 100644
--- a/app/services/resource_events/synthetic_milestone_notes_builder_service.rb
+++ b/app/services/resource_events/synthetic_milestone_notes_builder_service.rb
@@ -18,7 +18,7 @@ module ResourceEvents
     def milestone_change_events
       return [] unless resource.respond_to?(:resource_milestone_events)
 
-      events = resource.resource_milestone_events.includes(user: :status) # rubocop: disable CodeReuse/ActiveRecord
+      events = resource.resource_milestone_events.includes(:milestone, user: :status) # rubocop: disable CodeReuse/ActiveRecord
       apply_common_filters(events)
     end
 
diff --git a/app/views/admin/application_settings/_jira_connect.html.haml b/app/views/admin/application_settings/_jira_connect.html.haml
index ad0660797ee..235b6855123 100644
--- a/app/views/admin/application_settings/_jira_connect.html.haml
+++ b/app/views/admin/application_settings/_jira_connect.html.haml
@@ -8,7 +8,12 @@
       = expanded ? _('Collapse') : _('Expand')
     %p
       = s_('JiraConnect|Configure your Jira Connect Application ID.')
-      = link_to sprite_icon('question-o'), 'https://marketplace.atlassian.com/apps/1221011/gitlab-com-for-jira-cloud', target: '_blank', rel: "noopener noreferrer", class: 'has-tooltip', title: _('More information'), aria: { label: _('GitLab for Jira Cloud') }
+      = link_to sprite_icon('question-o'),
+          help_page_path('integration/jira/connect-app',
+          aria: { label: _('GitLab for Jira Cloud') },
+          class: 'has-tooltip',
+          anchor: 'connect-the-gitlab-for-jira-cloud-app-for-self-managed-instances'),
+          title: _('More information')
 
   .settings-content
     = gitlab_ui_form_for @application_setting, url: general_admin_application_settings_path(anchor: 'js-jira-connect-application-id-settings'), html: { class: 'fieldset-form', id: 'jira-connect-application-id-settings' } do |f|
@@ -24,4 +29,8 @@
           = f.label :jira_connect_proxy_url, s_('JiraConnect|Jira Connect Proxy URL'), class: 'label-bold'
           = f.text_field :jira_connect_proxy_url, class: 'form-control gl-form-input'
 
+      %fieldset
+        .form-group
+          = f.gitlab_ui_checkbox_component :jira_connect_public_key_storage_enabled, s_('JiraConnect|Enable public key storage')
+
       = f.submit _('Save changes'), pajamas_button: true
diff --git a/app/workers/database/batched_background_migration/execution_worker.rb b/app/workers/database/batched_background_migration/execution_worker.rb
index b59e4bd1f86..37b40c73ca6 100644
--- a/app/workers/database/batched_background_migration/execution_worker.rb
+++ b/app/workers/database/batched_background_migration/execution_worker.rb
@@ -11,7 +11,7 @@ module Database
 
       INTERVAL_VARIANCE = 5.seconds.freeze
       LEASE_TIMEOUT_MULTIPLIER = 3
-      MAX_RUNNING_MIGRATIONS = 2
+      MAX_RUNNING_MIGRATIONS = 4
 
       included do
         data_consistency :always
diff --git a/db/migrate/20230126210436_add_jira_connect_public_key_storage_enabled_setting.rb b/db/migrate/20230126210436_add_jira_connect_public_key_storage_enabled_setting.rb
new file mode 100644
index 00000000000..1d8ac03f9df
--- /dev/null
+++ b/db/migrate/20230126210436_add_jira_connect_public_key_storage_enabled_setting.rb
@@ -0,0 +1,7 @@
+# frozen_string_literal: true
+
+class AddJiraConnectPublicKeyStorageEnabledSetting < Gitlab::Database::Migration[2.1]
+  def change
+    add_column :application_settings, :jira_connect_public_key_storage_enabled, :boolean, default: false, null: false
+  end
+end
diff --git a/db/schema_migrations/20230126210436 b/db/schema_migrations/20230126210436
new file mode 100644
index 00000000000..7bdd4c12f69
--- /dev/null
+++ b/db/schema_migrations/20230126210436
@@ -0,0 +1 @@
+fc4716b37e18eed2e352ba56fff2c1bb685385336b75144745925a11c4c4f3cd
\ No newline at end of file
diff --git a/db/structure.sql b/db/structure.sql
index 0c9612dc425..0f59e43a95e 100644
--- a/db/structure.sql
+++ b/db/structure.sql
@@ -11666,6 +11666,7 @@ CREATE TABLE application_settings (
     search_max_docs_denominator integer DEFAULT 5000000 NOT NULL,
     search_min_docs_before_rollover integer DEFAULT 100000 NOT NULL,
     deactivation_email_additional_text text,
+    jira_connect_public_key_storage_enabled boolean DEFAULT false NOT NULL,
     git_rate_limit_users_alertlist integer[] DEFAULT '{}'::integer[] NOT NULL,
     CONSTRAINT app_settings_container_reg_cleanup_tags_max_list_size_positive CHECK ((container_registry_cleanup_tags_service_max_list_size >= 0)),
     CONSTRAINT app_settings_container_registry_pre_import_tags_rate_positive CHECK ((container_registry_pre_import_tags_rate >= (0)::numeric)),
diff --git a/doc/api/graphql/reference/index.md b/doc/api/graphql/reference/index.md
index 6a0f731f6ad..7a8c383a341 100644
--- a/doc/api/graphql/reference/index.md
+++ b/doc/api/graphql/reference/index.md
@@ -351,6 +351,22 @@ Returns [`Namespace`](#namespace).
 | ---- | ---- | ----------- |
 | <a id="querynamespacefullpath"></a>`fullPath` | [`ID!`](#id) | Full path of the project, group, or namespace. For example, `gitlab-org/gitlab-foss`. |
 
+### `Query.note`
+
+Find a note.
+
+WARNING:
+**Introduced** in 15.9.
+This feature is in Alpha. It can be changed or removed at any time.
+
+Returns [`Note`](#note).
+
+#### Arguments
+
+| Name | Type | Description |
+| ---- | ---- | ----------- |
+| <a id="querynoteid"></a>`id` | [`NoteID!`](#noteid) | Global ID of the note. |
+
 ### `Query.package`
 
 Find a package. This field can only be resolved for one query in any single request. Returns `null` if a package has no `default` status.
@@ -503,6 +519,23 @@ This field returns a [connection](#connections). It accepts the
 four standard [pagination arguments](#connection-pagination-arguments):
 `before: String`, `after: String`, `first: Int`, `last: Int`.
 
+### `Query.syntheticNote`
+
+Find a synthetic note.
+
+WARNING:
+**Introduced** in 15.9.
+This feature is in Alpha. It can be changed or removed at any time.
+
+Returns [`Note`](#note).
+
+#### Arguments
+
+| Name | Type | Description |
+| ---- | ---- | ----------- |
+| <a id="querysyntheticnotenoteableid"></a>`noteableId` | [`NoteableID!`](#noteableid) | Global ID of the resource to search synthetic note on. |
+| <a id="querysyntheticnotesha"></a>`sha` | [`String!`](#string) | Global ID of the note. |
+
 ### `Query.timelogs`
 
 Find timelogs visible to the current user.
diff --git a/doc/integration/jira/connect-app.md b/doc/integration/jira/connect-app.md
index 065b7080b7b..402efc409cb 100644
--- a/doc/integration/jira/connect-app.md
+++ b/doc/integration/jira/connect-app.md
@@ -212,6 +212,23 @@ NOTE:
 This method uses [automated updates](#update-the-gitlab-for-jira-cloud-app)
 the same way as our GitLab.com Marketplace listing.
 
+## Configure your GitLab instance to serve as a proxy for the GitLab for Jira Cloud app
+
+A GitLab instance can serve as a proxy for other GitLab instances using the GitLab for Jira Cloud app.
+This can be useful if you are managing multiple GitLab instance but only want to [manually install](#install-the-gitlab-for-jira-cloud-app-manually)
+the GitLab for Jira app once.
+
+To configure your GitLab instance to serve as a proxy:
+
+1. On the top bar, select **Main menu > Admin**.
+1. On the left sidebar, select **Settings > General** (`/admin/application_settings/general`).
+1. Expand the **GitLab for Jira App** section.
+1. Select **Enable public key storage**.
+1. Select **Save changes**.
+1. [Install the GitLab for Jira Cloud app manually](#install-the-gitlab-for-jira-cloud-app-manually)
+
+Other GitLab instances using the proxy must configure the **Jira Connect Proxy URL** setting and the [OAuth application](#set-up-oauth-authentication) **Redirect URI** to point to the proxy instance.
+
 ## Troubleshooting
 
 ### Browser displays a sign-in message when already signed in
diff --git a/doc/integration/slash_commands.md b/doc/integration/slash_commands.md
index 5eefa1138aa..a8f31da940a 100644
--- a/doc/integration/slash_commands.md
+++ b/doc/integration/slash_commands.md
@@ -13,10 +13,13 @@ working in Slack and Mattermost, you can use slash commands.
 Type the command as a message in your chat client to activate it.
 For Slack, this requires an [integration configuration](../user/project/integrations/slack_slash_commands.md).
 
-Slash commands are scoped to a project
-and require the trigger command specified during configuration.
+Slash commands are scoped to a project and require
+a specified trigger command during configuration.
+You should use the project name as the trigger command.
 
-We suggest you use the project name as the trigger command for simplicity and clarity.
+If you're using the [GitLab for Slack app](../user/project/integrations/gitlab_slack_application.md) for
+your GitLab.com projects, [add the `gitlab` keyword at the beginning of the command](../user/project/integrations/gitlab_slack_application.md#slash-commands)
+(for example, `/gitlab <project-name> issue show <id>`).
 
 Assuming `project-name` is the trigger command, the slash commands are:
 
@@ -32,9 +35,6 @@ Assuming `project-name` is the trigger command, the slash commands are:
 | `/project-name deploy <from> to <to>` | [Deploys](#deploy-command) from the `<from>` environment to the `<to>` environment. |
 | `/project-name run <job name> <arguments>` | Executes the [ChatOps](../ci/chatops/index.md) job `<job name>` on the default branch. |
 
-If you are using the [GitLab for Slack app](../user/project/integrations/gitlab_slack_application.md) for
-your GitLab.com projects, [add the `gitlab` keyword at the beginning of the command](../user/project/integrations/gitlab_slack_application.md#usage).
-
 ## Issue commands
 
 You can create a new issue, display issue details, and search up to 5 issues.
diff --git a/doc/user/admin_area/settings/index.md b/doc/user/admin_area/settings/index.md
index 262c6eef6df..5a550f15a41 100644
--- a/doc/user/admin_area/settings/index.md
+++ b/doc/user/admin_area/settings/index.md
@@ -86,7 +86,7 @@ The **Integrations** settings contain:
   to receive invite email bounce events from Mailgun, if it is your email provider.
 - [PlantUML](../../../administration/integration/plantuml.md) - Allow rendering of PlantUML
   diagrams in documents.
-- [Slack application](../../../user/project/integrations/gitlab_slack_application.md#configuration) -
+- [Slack application](../../../user/project/integrations/gitlab_slack_application.md) -
   Slack integration allows you to interact with GitLab via slash commands in a chat window.
   This option is only available on GitLab.com, though it may be
   [available for self-managed instances in the future](https://gitlab.com/gitlab-org/gitlab/-/issues/28164).
diff --git a/doc/user/project/integrations/gitlab_slack_application.md b/doc/user/project/integrations/gitlab_slack_application.md
index 50b52421a5a..3db7d2cc97a 100644
--- a/doc/user/project/integrations/gitlab_slack_application.md
+++ b/doc/user/project/integrations/gitlab_slack_application.md
@@ -16,7 +16,9 @@ for our plans to make the app configurable for all GitLab installations.
 Slack provides a native application that you can enable with your project's
 integrations on GitLab.com.
 
-## Slack App Directory
+## Installation
+
+### Through the Slack App Directory
 
 To enable the GitLab for Slack app for your workspace,
 install the [GitLab application](https://slack-platform.slack.com/apps/A676ADMV5-gitlab)
@@ -25,7 +27,7 @@ from the [Slack App Directory](https://slack.com/apps).
 On the [GitLab for Slack app landing page](https://gitlab.com/-/profile/slack/edit),
 you can select a GitLab project to link with your Slack workspace.
 
-## Configuration
+### Through GitLab project settings
 
 Alternatively, you can configure the GitLab for Slack app with your project's
 integration settings.
@@ -44,9 +46,44 @@ To enable the GitLab integration for your Slack workspace:
 You can also select **Reinstall GitLab for Slack app** to update the app in your Slack workspace
 to the latest version. See [Version history](#version-history) for details.
 
-## Create a project alias for Slack
+## Slash commands
+
+After installing the GitLab for Slack app, everyone in your Slack workspace can use slash commands.
+
+Replace `<project>` with the project full path, or create a shorter [project alias](#create-a-project-alias-for-slash-commands) for the slash commands.
+
+| Command | Effect |
+| ------- | ------ |
+| `/gitlab help` | Shows all available slash commands. |
+| `/gitlab <project> issue new <title> <shift+return> <description>` | Creates a new issue with the title `<title>` and description `<description>`. |
+| `/gitlab <project> issue show <id>` | Shows the issue with the ID `<id>`. |
+| `/gitlab <project> issue close <id>` | Closes the issue with the ID `<id>`. |
+| `/gitlab <project> issue search <query>` | Shows up to 5 issues matching `<query>`. |
+| `/gitlab <project> issue move <id> to <project>` | Moves the issue with the ID `<id>` to `<project>`. |
+| `/gitlab <project> issue comment <id> <shift+return> <comment>` | Adds a new comment with the comment body `<comment>` to the issue with the ID `<id>`. |
+| `/gitlab <project> deploy <from> to <to>` | [Deploys](#the-deploy-slash-command) from the `<from>` environment to the `<to>` environment. |
+| `/gitlab <project> run <job name> <arguments>` | Executes the [ChatOps](../../../ci/chatops/index.md) job `<job name>` on the default branch. |
+
+### The deploy slash command
+
+To deploy to an environment, GitLab tries to find a deployment
+manual action in the pipeline.
+
+If there's only one action for a given environment, it is triggered.
+If more than one action is defined, GitLab finds an action
+name that matches the environment name to deploy to.
+
+The command returns an error if no matching action is found.
+
+### User authorization
+
+When you perform your first slash command, you must
+authorize your Slack user on GitLab.com.
+
+### Create a project alias for slash commands
 
-To create a project alias on GitLab.com for Slack integration:
+By default, slash commands expect a project full path. To use a shorter alias
+instead:
 
 1. Go to your project's home page.
 1. Go to **Settings > Integrations** (only visible on GitLab.com).
@@ -55,43 +92,107 @@ To create a project alias on GitLab.com for Slack integration:
    select **Edit**.
 1. Enter your desired alias, and select **Save changes**.
 
-Some Slack commands require a project alias and fail with the following error
-if the project alias is incorrect or missing from the command:
+## Slack notifications
 
-```plaintext
-GitLab error: project or alias not found
-```
+> [Introduced](https://gitlab.com/gitlab-org/gitlab/-/issues/381012) in GitLab 15.7.
 
-## Usage
+With Slack notifications, GitLab can send messages to Slack workspace channels for certain GitLab [events](#events-for-slack-notifications) (for example, when an issue is created).
 
-After installing the app, everyone in your Slack workspace can
-use the [slash commands](../../../integration/slash_commands.md).
-When you perform your first slash command, you are asked to
-authorize your Slack user on GitLab.com.
+### Configure notifications
 
-The only difference with the [manually configurable Slack slash commands](slack_slash_commands.md)
-is that you must prefix all commands with the `/gitlab` keyword. For example,
-to show the issue number `1001` under the `gitlab-org/gitlab`
-project, you must run the following command:
+To configure Slack notifications:
 
-```plaintext
-/gitlab gitlab-org/gitlab issue show 1001
-```
+1. On the top bar, select **Main menu > Projects** and find a project for which the GitLab for Slack app has been [installed](#installation).
+1. On the left sidebar, select **Settings > Integrations**.
+1. Select **GitLab for Slack app**.
+1. In the **Trigger** section, select the checkbox for each GitLab
+   event you want to receive a notification for in Slack. For a full list, see
+   [Events for Slack notifications](#events-for-slack-notifications).
+1. For each checkbox you select, enter the name of the channel that receives the notifications (for example, `#my-channel`).
+    - To send notifications to multiple Slack channels, enter up to 10 channel names separated by commas (for example, `#channel-one, #channel-two`).
 
-## Version history
+   NOTE:
+   If the channel is private, you must also [add the GitLab for Slack app to the private channel](#receive-notifications-to-a-private-channel).
+
+1. Select the **Notify only broken pipelines** checkbox to notify only on failures.
+1. From the **Branches for which notifications are to be sent** dropdown list, select which branches you want to receive notifications (if relevant to your events).
+1. Leave the **Labels to be notified** text box blank to receive all notifications, or
+   add labels the issue or merge request must have to trigger a
+   notification.
+1. Select **Save changes**.
+
+Your Slack workspace can now start receiving GitLab event notifications.
+
+### Receive notifications to a private channel
 
-In GitLab 15.0 and later, the GitLab for Slack app is updated to [Slack's new granular permissions model](https://medium.com/slack-developer-blog/more-precision-less-restrictions-a3550006f9c3). While there is no change in functionality, you should reinstall the app.
+To receive notifications to a private Slack channel, you must add the GitLab for Slack app to the channel:
+
+1. Mention the app in the channel by typing `@GitLab` and pressing <kbd>Enter</kbd>.
+1. Select **Add to Channel**.
+
+### Events for Slack notifications
+
+The following events are available for Slack notifications:
+
+| Event name                                                             | Description                                        |
+|--------------------------------------------------------------------------|------------------------------------------------------|
+| **Push**                                                                 | A push to the repository.                            |
+| **Issue**                                                                | An issue is created, updated, or closed.             |
+| **Confidential issue**                                                   | A confidential issue is created, updated, or closed. |
+| **Merge request**                                                        | A merge request is created, updated, or merged.      |
+| **Note**                                                                 | A comment is added.                                  |
+| **Confidential note**                                                    | A confidential note is added.                        |
+| **Tag push**                                                             | A new tag is pushed to the repository.               |
+| **Pipeline**                                                             | A pipeline status changed.                           |
+| **Wiki page**                                                            | A wiki page is created or updated.                   |
+| **Deployment**                                                           | A deployment starts or finishes.                     |
+| **Alert**                                                                | A new, unique alert is recorded.                     |
+| [**Vulnerability**](../../application_security/vulnerabilities/index.md) | A new, unique vulnerability is recorded.             |
 
 ## Troubleshooting
 
-When you work with the GitLab for Slack app, the
-[App Home](https://api.slack.com/start/overview#app_home) might not display properly.
-As a workaround, ensure your app is up to date.
+### Update the GitLab for Slack app
+
+New releases of the app might require permissions to be authorized before some features work in your Slack workspace. You should ensure the app is up to date in your Slack workspace to enjoy all the latest features.
 
-To update an existing Slack integration:
+To update your GitLab for Slack app:
 
-1. Go to your [chat settings](https://gitlab.com/-/profile/chat_names).
-1. Next to your project, select **GitLab for Slack app**.
+1. On the top bar, select **Main menu > Projects** and find a project for which the GitLab for Slack app has been configured.
+1. On the left sidebar, select **Settings > Integrations**.
+1. Select **GitLab for Slack app**.
 1. Select **Reinstall GitLab for Slack app**.
 
+The GitLab for Slack app is updated for all projects that use the integration.
+
 Alternatively, you can [configure a new Slack integration](https://about.gitlab.com/solutions/slack/).
+
+### Project or alias not found
+
+Some Slack commands must have a project full path or alias and fail with the following error
+if the project cannot be found:
+
+```plaintext
+GitLab error: project or alias not found
+```
+
+As a workaround, ensure:
+
+- The project full path is correct.
+- If using a [project alias](#create-a-project-alias-for-slash-commands), the alias is correct.
+- The GitLab for Slack app integration is [enabled for the project](#through-gitlab-project-settings).
+
+### Notifications are not received to a channel
+
+If you're not receiving notifications to a Slack channel, ensure:
+
+- The channel name you configured is correct.
+- If the channel is private, you've [added the GitLab for Slack app to the channel](#receive-notifications-to-a-private-channel).
+
+### The App Home does not display properly
+
+If the [App Home](https://api.slack.com/start/overview#app_home) does not display properly, ensure your [app is up to date](#update-the-gitlab-for-slack-app).
+
+## Version history
+
+In GitLab 15.0 and later, the GitLab for Slack app is updated to [Slack's new granular permissions model](https://medium.com/slack-developer-blog/more-precision-less-restrictions-a3550006f9c3).
+Although there is no change in functionality, you should [reinstall the app](#update-the-gitlab-for-slack-app).
diff --git a/doc/user/project/integrations/slack.md b/doc/user/project/integrations/slack.md
index e3256dc270d..9932e782ff4 100644
--- a/doc/user/project/integrations/slack.md
+++ b/doc/user/project/integrations/slack.md
@@ -6,6 +6,12 @@ info: To determine the technical writer assigned to the Stage/Group associated w
 
 # Slack notifications integration **(FREE)**
 
+WARNING:
+This feature was [deprecated](https://gitlab.com/gitlab-org/gitlab/-/issues/372411) for GitLab SaaS customers
+in GitLab 15.10 and is [planned for removal](https://gitlab.com/groups/gitlab-org/-/epics/8673).
+GitLab SaaS customers can use the [GitLab for Slack app](gitlab_slack_application.md) instead.
+Self-managed GitLab customers can continue to use this feature.
+
 The Slack notifications integration enables your GitLab project to send events
 (such as issue creation) to your existing Slack team as notifications. Setting up
 Slack notifications requires configuration changes for both Slack and GitLab.
diff --git a/locale/gitlab.pot b/locale/gitlab.pot
index 02dcf7d0398..4e279e58756 100644
--- a/locale/gitlab.pot
+++ b/locale/gitlab.pot
@@ -23916,6 +23916,9 @@ msgstr ""
 msgid "JiraConnect|Create branch for Jira issue %{jiraIssue}"
 msgstr ""
 
+msgid "JiraConnect|Enable public key storage"
+msgstr ""
+
 msgid "JiraConnect|Failed to create branch."
 msgstr ""
 
diff --git a/qa/qa/specs/features/browser_ui/1_manage/login/register_spec.rb b/qa/qa/specs/features/browser_ui/1_manage/login/register_spec.rb
index c92bea7bf76..3f5842d756e 100644
--- a/qa/qa/specs/features/browser_ui/1_manage/login/register_spec.rb
+++ b/qa/qa/specs/features/browser_ui/1_manage/login/register_spec.rb
@@ -67,8 +67,7 @@ module QA
               show.delete_account(user.password)
             end
 
-            # TODO: Remove retry_on_exception once https://gitlab.com/gitlab-org/gitlab/-/issues/24294 is resolved
-            Support::Waiter.wait_until(max_duration: 120, retry_on_exception: true, sleep_interval: 3) { !user.exists? }
+            Support::Waiter.wait_until(max_duration: 120, sleep_interval: 3) { !user.exists? }
           end
 
           it 'allows recreating with same credentials', :reliable, testcase: 'https://gitlab.com/gitlab-org/gitlab/-/quality/test_cases/347868' do
diff --git a/spec/controllers/registrations_controller_spec.rb b/spec/controllers/registrations_controller_spec.rb
index 51a26c351c3..b217b100349 100644
--- a/spec/controllers/registrations_controller_spec.rb
+++ b/spec/controllers/registrations_controller_spec.rb
@@ -8,6 +8,7 @@ RSpec.describe RegistrationsController, feature_category: :user_profile do
 
   before do
     stub_application_setting(require_admin_approval_after_user_signup: false)
+    stub_feature_flags(arkose_labs_signup_challenge: false)
   end
 
   describe '#new' do
diff --git a/spec/features/admin/admin_settings_spec.rb b/spec/features/admin/admin_settings_spec.rb
index 34025e9dd14..da206086663 100644
--- a/spec/features/admin/admin_settings_spec.rb
+++ b/spec/features/admin/admin_settings_spec.rb
@@ -365,11 +365,13 @@ RSpec.describe 'Admin updates settings', feature_category: :not_owned do
           page.within('#js-jira_connect-settings') do
             fill_in 'Jira Connect Application ID', with: '1234'
             fill_in 'Jira Connect Proxy URL', with: 'https://example.com'
+            check 'Enable public key storage'
             click_button 'Save changes'
           end
 
           expect(current_settings.jira_connect_application_key).to eq('1234')
           expect(current_settings.jira_connect_proxy_url).to eq('https://example.com')
+          expect(current_settings.jira_connect_public_key_storage_enabled).to eq(true)
           expect(page).to have_content "Application settings saved successfully"
         end
       end
diff --git a/spec/graphql/types/query_type_spec.rb b/spec/graphql/types/query_type_spec.rb
index f06759e30c8..100ecc94f35 100644
--- a/spec/graphql/types/query_type_spec.rb
+++ b/spec/graphql/types/query_type_spec.rb
@@ -2,49 +2,15 @@
 
 require 'spec_helper'
 
-RSpec.describe GitlabSchema.types['Query'] do
+RSpec.describe GitlabSchema.types['Query'], feature_category: :shared do
+  include_context 'with FOSS query type fields'
+
   it 'is called Query' do
     expect(described_class.graphql_name).to eq('Query')
   end
 
   it 'has the expected fields' do
-    expected_fields = [
-      :board_list,
-      :ci_application_settings,
-      :ci_config,
-      :ci_variables,
-      :container_repository,
-      :current_user,
-      :design_management,
-      :echo,
-      :gitpod_enabled,
-      :group,
-      :issue,
-      :issues,
-      :jobs,
-      :merge_request,
-      :metadata,
-      :milestone,
-      :namespace,
-      :package,
-      :project,
-      :projects,
-      :query_complexity,
-      :runner,
-      :runner_platforms,
-      :runner_setup,
-      :runners,
-      :snippets,
-      :timelogs,
-      :todo,
-      :topics,
-      :usage_trends_measurements,
-      :user,
-      :users,
-      :work_item
-    ]
-
-    expect(described_class).to have_graphql_fields(*expected_fields).at_least
+    expect(described_class).to have_graphql_fields(*expected_foss_fields).at_least
   end
 
   describe 'namespace field' do
diff --git a/spec/helpers/jira_connect_helper_spec.rb b/spec/helpers/jira_connect_helper_spec.rb
index 455120f86d5..31aeff85c70 100644
--- a/spec/helpers/jira_connect_helper_spec.rb
+++ b/spec/helpers/jira_connect_helper_spec.rb
@@ -9,7 +9,8 @@ RSpec.describe JiraConnectHelper, feature_category: :integrations do
 
     let(:user) { create(:user) }
     let(:client_id) { '123' }
-    let(:enable_public_keys_storage) { false }
+    let(:enable_public_keys_storage_config) { false }
+    let(:enable_public_keys_storage_setting) { false }
 
     before do
       stub_application_setting(jira_connect_application_key: client_id)
@@ -21,7 +22,9 @@ RSpec.describe JiraConnectHelper, feature_category: :integrations do
       before do
         allow(view).to receive(:current_user).and_return(nil)
         allow(Gitlab.config.gitlab).to receive(:url).and_return('http://test.host')
-        allow(Gitlab.config.jira_connect).to receive(:enable_public_keys_storage).and_return(enable_public_keys_storage)
+        allow(Gitlab.config.jira_connect).to receive(:enable_public_keys_storage)
+          .and_return(enable_public_keys_storage_config)
+        stub_application_setting(jira_connect_public_key_storage_enabled: enable_public_keys_storage_setting)
       end
 
       it 'includes Jira Connect app attributes' do
@@ -105,8 +108,16 @@ RSpec.describe JiraConnectHelper, feature_category: :integrations do
         expect(subject[:public_key_storage_enabled]).to eq(false)
       end
 
-      context 'when public_key_storage is enabled' do
-        let(:enable_public_keys_storage) { true }
+      context 'when public_key_storage is enabled via config' do
+        let(:enable_public_keys_storage_config) { true }
+
+        it 'assignes public_key_storage_enabled to true' do
+          expect(subject[:public_key_storage_enabled]).to eq(true)
+        end
+      end
+
+      context 'when public_key_storage is enabled via setting' do
+        let(:enable_public_keys_storage_setting) { true }
 
         it 'assignes public_key_storage_enabled to true' do
           expect(subject[:public_key_storage_enabled]).to eq(true)
diff --git a/spec/requests/api/graphql/notes/note_spec.rb b/spec/requests/api/graphql/notes/note_spec.rb
new file mode 100644
index 00000000000..180e54290f8
--- /dev/null
+++ b/spec/requests/api/graphql/notes/note_spec.rb
@@ -0,0 +1,103 @@
+# frozen_string_literal: true
+
+require 'spec_helper'
+
+RSpec.describe 'Query.note(id)', feature_category: :team_planning do
+  include GraphqlHelpers
+
+  let_it_be(:current_user) { create(:user) }
+  let_it_be(:project) { create(:project, :private) }
+  let_it_be(:issue) { create(:issue, project: project) }
+  let_it_be(:note) { create(:note, noteable: issue, project: project) }
+  let_it_be(:system_note) { create(:note, :system, noteable: issue, project: project) }
+
+  let(:note_params) { { 'id' => global_id_of(note) } }
+  let(:note_data) { graphql_data['note'] }
+  let(:note_fields) { all_graphql_fields_for('Note'.classify) }
+
+  let(:query) do
+    graphql_query_for('note', note_params, note_fields)
+  end
+
+  it_behaves_like 'a working graphql query' do
+    before do
+      post_graphql(query, current_user: current_user)
+    end
+  end
+
+  context 'when the user does not have access to read the note' do
+    it 'returns nil' do
+      post_graphql(query, current_user: current_user)
+
+      expect(note_data).to be nil
+    end
+
+    context 'when it is a system note' do
+      let(:note_params) { { 'id' => global_id_of(system_note) } }
+
+      it 'returns nil' do
+        post_graphql(query, current_user: current_user)
+
+        expect(note_data).to be nil
+      end
+    end
+  end
+
+  context 'when the user has access to read the note' do
+    before do
+      project.add_guest(current_user)
+    end
+
+    it 'returns note' do
+      post_graphql(query, current_user: current_user)
+
+      expect(note_data['id']).to eq(global_id_of(note).to_s)
+    end
+
+    context 'when it is a system note' do
+      let(:note_params) { { 'id' => global_id_of(system_note) } }
+
+      it 'returns note' do
+        post_graphql(query, current_user: current_user)
+
+        expect(note_data['id']).to eq(global_id_of(system_note).to_s)
+      end
+    end
+
+    context 'and notes widget is not available' do
+      before do
+        stub_const('WorkItems::Type::WIDGETS_FOR_TYPE', { issue: [::WorkItems::Widgets::Description] })
+      end
+
+      it 'returns nil' do
+        post_graphql(query, current_user: current_user)
+
+        expect(note_data).to be nil
+      end
+    end
+
+    context 'when note is internal' do
+      let_it_be(:note) { create(:note, :confidential, noteable: issue, project: project) }
+
+      it 'returns nil' do
+        post_graphql(query, current_user: current_user)
+
+        expect(note_data).to be nil
+      end
+
+      context 'and user can read confidential notes' do
+        let_it_be(:developer) { create(:user) }
+
+        before do
+          project.add_developer(developer)
+        end
+
+        it 'returns note' do
+          post_graphql(query, current_user: developer)
+
+          expect(note_data['id']).to eq(global_id_of(note).to_s)
+        end
+      end
+    end
+  end
+end
diff --git a/spec/requests/api/graphql/notes/synthetic_note_resolver_spec.rb b/spec/requests/api/graphql/notes/synthetic_note_resolver_spec.rb
new file mode 100644
index 00000000000..9b11406ae00
--- /dev/null
+++ b/spec/requests/api/graphql/notes/synthetic_note_resolver_spec.rb
@@ -0,0 +1,57 @@
+# frozen_string_literal: true
+
+require 'spec_helper'
+
+RSpec.describe 'Query.synthetic_note(noteable_id, sha)', feature_category: :team_planning do
+  include GraphqlHelpers
+
+  let_it_be(:current_user) { create(:user) }
+  let_it_be(:project) { create(:project, :private) }
+  let_it_be(:issue) { create(:issue, project: project) }
+  let_it_be(:label) { create(:label, project: project) }
+  let_it_be(:label_event, refind: true) do
+    create(:resource_label_event, user: current_user, issue: issue, label: label, action: 'add', created_at: 2.days.ago)
+  end
+
+  let(:label_note) { LabelNote.from_events([label_event]) }
+  let(:global_id) { ::Gitlab::GlobalId.build(label_note, model_name: LabelNote.to_s, id: label_note.discussion_id) }
+  let(:note_params) { { sha: label_note.discussion_id, noteable_id: global_id_of(issue) } }
+  let(:note_data) { graphql_data['syntheticNote'] }
+  let(:note_fields) { all_graphql_fields_for('Note'.classify) }
+
+  let(:query) do
+    graphql_query_for('synthetic_note', note_params, note_fields)
+  end
+
+  context 'when the user does not have access to read the note' do
+    it 'returns nil' do
+      post_graphql(query, current_user: current_user)
+
+      expect(note_data).to be nil
+    end
+  end
+
+  context 'when the user has access to read the note' do
+    before do
+      project.add_guest(current_user)
+    end
+
+    it 'returns synthetic note' do
+      post_graphql(query, current_user: current_user)
+
+      expect(note_data['id']).to eq(global_id.to_s)
+    end
+
+    context 'and notes widget is not available' do
+      before do
+        stub_const('WorkItems::Type::WIDGETS_FOR_TYPE', { issue: [::WorkItems::Widgets::Description] })
+      end
+
+      it 'returns nil' do
+        post_graphql(query, current_user: current_user)
+
+        expect(note_data).to be nil
+      end
+    end
+  end
+end
diff --git a/spec/requests/jira_connect/public_keys_controller_spec.rb b/spec/requests/jira_connect/public_keys_controller_spec.rb
index 31977f34d0f..7f0262eaf65 100644
--- a/spec/requests/jira_connect/public_keys_controller_spec.rb
+++ b/spec/requests/jira_connect/public_keys_controller_spec.rb
@@ -5,10 +5,11 @@ require 'spec_helper'
 RSpec.describe JiraConnect::PublicKeysController, feature_category: :integrations do
   describe 'GET /-/jira_connect/public_keys/:uuid' do
     let(:uuid) { non_existing_record_id }
-    let(:public_key_storage_enabled) { true }
+    let(:public_key_storage_enabled_config) { true }
 
     before do
-      allow(Gitlab.config.jira_connect).to receive(:enable_public_keys_storage).and_return(public_key_storage_enabled)
+      allow(Gitlab.config.jira_connect).to receive(:enable_public_keys_storage)
+        .and_return(public_key_storage_enabled_config)
     end
 
     it 'renders 404' do
@@ -29,14 +30,26 @@ RSpec.describe JiraConnect::PublicKeysController, feature_category: :integration
         expect(response.body).to eq(public_key.key)
       end
 
-      context 'when public key storage disabled' do
-        let(:public_key_storage_enabled) { false }
+      context 'when public key storage config disabled' do
+        let(:public_key_storage_enabled_config) { false }
 
         it 'renders 404' do
           get jira_connect_public_key_path(id: uuid)
 
           expect(response).to have_gitlab_http_status(:not_found)
         end
+
+        context 'when public key storage setting is enabled' do
+          before do
+            stub_application_setting(jira_connect_public_key_storage_enabled: true)
+          end
+
+          it 'renders 404' do
+            get jira_connect_public_key_path(id: uuid)
+
+            expect(response).to have_gitlab_http_status(:ok)
+          end
+        end
       end
     end
   end
diff --git a/spec/support/shared_contexts/graphql/types/query_type_shared_context.rb b/spec/support/shared_contexts/graphql/types/query_type_shared_context.rb
new file mode 100644
index 00000000000..15a67661cca
--- /dev/null
+++ b/spec/support/shared_contexts/graphql/types/query_type_shared_context.rb
@@ -0,0 +1,44 @@
+# frozen_string_literal: true
+
+RSpec.shared_context 'with FOSS query type fields' do
+  # extracted these fields into a shared variable so that we can define FOSS fields once and use them on EE spec as well
+  let(:expected_foss_fields) do
+    [
+      :board_list,
+      :ci_application_settings,
+      :ci_config,
+      :ci_variables,
+      :container_repository,
+      :current_user,
+      :design_management,
+      :echo,
+      :gitpod_enabled,
+      :group,
+      :issue,
+      :issues,
+      :jobs,
+      :merge_request,
+      :metadata,
+      :milestone,
+      :namespace,
+      :note,
+      :package,
+      :project,
+      :projects,
+      :query_complexity,
+      :runner,
+      :runner_platforms,
+      :runner_setup,
+      :runners,
+      :snippets,
+      :synthetic_note,
+      :timelogs,
+      :todo,
+      :topics,
+      :usage_trends_measurements,
+      :user,
+      :users,
+      :work_item
+    ]
+  end
+end
diff --git a/spec/views/admin/application_settings/_jira_connect.html.haml_spec.rb b/spec/views/admin/application_settings/_jira_connect.html.haml_spec.rb
index 1739fb3d8b9..af411261aa0 100644
--- a/spec/views/admin/application_settings/_jira_connect.html.haml_spec.rb
+++ b/spec/views/admin/application_settings/_jira_connect.html.haml_spec.rb
@@ -20,4 +20,9 @@ RSpec.describe 'admin/application_settings/_jira_connect.html.haml', feature_cat
     render
     expect(rendered).to have_field('Jira Connect Proxy URL', type: 'text')
   end
+
+  it 'renders the enable public key storage checkbox' do
+    render
+    expect(rendered).to have_field('Enable public key storage', type: 'checkbox')
+  end
 end