Add latest changes from gitlab-org/gitlab@master

23 files changed, 183 insertions, 130 deletions

diff --git a/app/helpers/search_helper.rb b/app/helpers/search_helper.rb
index fc1bf4e38d7..8fc9f5ca6fd 100644
--- a/app/helpers/search_helper.rb
+++ b/app/helpers/search_helper.rb
@@ -86,6 +86,11 @@ module SearchHelper
     }).html_safe
   end
 
+  def repository_ref(project)
+    # Always #to_s the repository_ref param in case the value is also a number
+    params[:repository_ref].to_s.presence || project.default_branch
+  end
+
   # Overridden in EE
   def search_blob_title(project, path)
     path
diff --git a/app/services/design_management/copy_design_collection/copy_service.rb b/app/services/design_management/copy_design_collection/copy_service.rb
index 7484c43a428..c7e2f955383 100644
--- a/app/services/design_management/copy_design_collection/copy_service.rb
+++ b/app/services/design_management/copy_design_collection/copy_service.rb
@@ -259,7 +259,7 @@ module DesignManagement
         oids = blobs.values.flat_map(&:values).map(&:lfs_oid)
         repository_type = LfsObjectsProject.repository_types[:design]
 
-        new_rows = LfsObject.where(oid: oids).map do |lfs_object|
+        new_rows = LfsObject.where(oid: oids).find_each(batch_size: 1000).map do |lfs_object|
           {
             project_id: target_project.id,
             lfs_object_id: lfs_object.id,
diff --git a/app/views/search/_results.html.haml b/app/views/search/_results.html.haml
index bbabdb06a0d..cfe7b45d79a 100644
--- a/app/views/search/_results.html.haml
+++ b/app/views/search/_results.html.haml
@@ -10,10 +10,9 @@
       - if @project
         - link_to_project = link_to(@project.full_name, @project, class: 'ml-md-1')
         - if @scope == 'blobs'
-          - repository_ref = params[:repository_ref].to_s.presence || @project.default_branch
           = s_("SearchCodeResults|in")
           .mx-md-1
-            = render partial: "shared/ref_switcher", locals: { ref: repository_ref, form_path: request.fullpath, field_name: 'repository_ref' }
+            = render partial: "shared/ref_switcher", locals: { ref: repository_ref(@project), form_path: request.fullpath, field_name: 'repository_ref' }
           = s_('SearchCodeResults|of %{link_to_project}').html_safe % { link_to_project: link_to_project }
         - else
           = _("in project %{link_to_project}").html_safe % { link_to_project: link_to_project }
diff --git a/app/views/search/results/_blob.html.haml b/app/views/search/results/_blob.html.haml
index 6e17a25c713..aeb37022f99 100644
--- a/app/views/search/results/_blob.html.haml
+++ b/app/views/search/results/_blob.html.haml
@@ -1,5 +1,5 @@
 - project = blob.project
 - return unless project
-- blob_link = project_blob_path(project, tree_join(blob.ref, blob.path))
+- blob_link = project_blob_path(project, tree_join(repository_ref(project), blob.path))
 
 = render partial: 'search/results/blob_data', locals: { blob: blob, project: project, path: blob.path, blob_link: blob_link }
diff --git a/app/views/shared/snippets/_snippet.html.haml b/app/views/shared/snippets/_snippet.html.haml
index 25e31fd519b..5f0ecb2ee79 100644
--- a/app/views/shared/snippets/_snippet.html.haml
+++ b/app/views/shared/snippets/_snippet.html.haml
@@ -1,7 +1,7 @@
 - link_project = local_assigns.fetch(:link_project, false)
 - notes_count = @noteable_meta_data[snippet.id].user_notes_count
 
-%li.snippet-row.py-3
+%li.snippet-row.py-3{ data: { qa_selector: 'snippet_link', qa_snippet_title: snippet.title } }
   = image_tag avatar_icon_for_user(snippet.author), class: "avatar s40 d-none d-sm-block", alt: ''
 
   .title
diff --git a/changelogs/unreleased/254932-fix-search-results-blob-link-to-branch.yml b/changelogs/unreleased/254932-fix-search-results-blob-link-to-branch.yml
new file mode 100644
index 00000000000..7e3e2d05ac1
--- /dev/null
+++ b/changelogs/unreleased/254932-fix-search-results-blob-link-to-branch.yml
@@ -0,0 +1,5 @@
+---
+title: Ensure code search results link to searched ref
+merge_request: 43510
+author:
+type: fixed
diff --git a/config/feature_flags/development/release_mr_issue_urls.yml b/config/feature_flags/development/release_mr_issue_urls.yml
index f6abf50f535..3f9c81b8fe9 100644
--- a/config/feature_flags/development/release_mr_issue_urls.yml
+++ b/config/feature_flags/development/release_mr_issue_urls.yml
@@ -1,7 +1,7 @@
 ---
 name: release_mr_issue_urls
-introduced_by_url: 
-rollout_issue_url: 
-group: 
+introduced_by_url: https://gitlab.com/gitlab-org/gitlab/-/merge_requests/18727
+rollout_issue_url:
+group: group::release management
 type: development
 default_enabled: false
diff --git a/config/feature_flags/development/safezip_use_rubyzip.yml b/config/feature_flags/development/safezip_use_rubyzip.yml
deleted file mode 100644
index 139283d93d2..00000000000
--- a/config/feature_flags/development/safezip_use_rubyzip.yml
+++ /dev/null
@@ -1,7 +0,0 @@
----
-name: safezip_use_rubyzip
-introduced_by_url: 
-rollout_issue_url: 
-group: 
-type: development
-default_enabled: true
diff --git a/doc/ci/docker/using_docker_build.md b/doc/ci/docker/using_docker_build.md
index 045fcd39c4d..34ca7f8ea7c 100644
--- a/doc/ci/docker/using_docker_build.md
+++ b/doc/ci/docker/using_docker_build.md
@@ -90,7 +90,6 @@ GitLab Runner then executes job scripts as the `gitlab-runner` user.
 
 1. You can now use `docker` command (and **install** `docker-compose` if needed).
 
-NOTE: **Note:**
 By adding `gitlab-runner` to the `docker` group you are effectively granting `gitlab-runner` full root permissions.
 For more information please read [On Docker security: `docker` group considered harmful](https://www.andreas-jung.com/contents/on-docker-security-docker-group-considered-harmful).
 
@@ -101,7 +100,6 @@ The second approach is to use the special Docker-in-Docker (dind)
 (`docker`) and run the job script in context of that
 image in privileged mode.
 
-NOTE: **Note:**
 `docker-compose` is not part of Docker-in-Docker (dind). To use `docker-compose` in your
 CI builds, follow the `docker-compose`
 [installation instructions](https://docs.docker.com/compose/install/).
@@ -149,20 +147,16 @@ released.
 
 #### TLS enabled
 
-NOTE: **Note:**
-Requires GitLab Runner 11.11 or later, but is not supported if GitLab
-Runner is installed using the [Helm
-chart](https://docs.gitlab.com/runner/install/kubernetes.html). See the
-[related
-issue](https://gitlab.com/gitlab-org/charts/gitlab-runner/-/issues/83) for
-details.
-
 The Docker daemon supports connection over TLS and it's done by default
 for Docker 19.03.12 or higher. This is the **suggested** way to use the
 Docker-in-Docker service and
 [GitLab.com shared runners](../../user/gitlab_com/index.md#shared-runners)
 support this.
 
+GitLab Runner 11.11 or later is required, but it is not supported if GitLab
+Runner is installed using the [Helm chart](https://docs.gitlab.com/runner/install/kubernetes.html).
+See the [related issue](https://gitlab.com/gitlab-org/charts/gitlab-runner/-/issues/83) for details.
+
 1. Install [GitLab Runner](https://docs.gitlab.com/runner/install/).
 
 1. Register GitLab Runner from the command line to use `docker` and `privileged`
@@ -225,7 +219,7 @@ support this.
      # The 'docker' hostname is the alias of the service container as described at
      # https://docs.gitlab.com/ee/ci/docker/using_docker_images.html#accessing-the-services.
      #
-     # Note that if you're using GitLab Runner 12.7 or earlier with the Kubernetes executor and Kubernetes 1.6 or earlier,
+     # If you're using GitLab Runner 12.7 or earlier with the Kubernetes executor and Kubernetes 1.6 or earlier,
      # the variable must be set to tcp://localhost:2376 because of how the
      # Kubernetes executor connects services to the job container
      # DOCKER_HOST: tcp://localhost:2376
@@ -287,7 +281,7 @@ variables:
   # The 'docker' hostname is the alias of the service container as described at
   # https://docs.gitlab.com/ee/ci/docker/using_docker_images.html#accessing-the-services
   #
-  # Note that if you're using GitLab Runner 12.7 or earlier with the Kubernetes executor and Kubernetes 1.6 or earlier,
+  # If you're using GitLab Runner 12.7 or earlier with the Kubernetes executor and Kubernetes 1.6 or earlier,
   # the variable must be set to tcp://localhost:2375 because of how the
   # Kubernetes executor connects services to the job container
   # DOCKER_HOST: tcp://localhost:2375
@@ -506,7 +500,6 @@ environment = ["DOCKER_DRIVER=overlay2"]
 
 If you're running multiple runners, you have to modify all configuration files.
 
-NOTE: **Note:**
 Read more about the [runner configuration](https://docs.gitlab.com/runner/configuration/)
 and [using the OverlayFS storage driver](https://docs.docker.com/engine/userguide/storagedriver/overlayfs-driver/).
 
diff --git a/doc/ci/docker/using_docker_images.md b/doc/ci/docker/using_docker_images.md
index 8468d696838..62b87c2e858 100644
--- a/doc/ci/docker/using_docker_images.md
+++ b/doc/ci/docker/using_docker_images.md
@@ -138,7 +138,6 @@ still succeeds even if that warning was printed. For example:
 As it was mentioned before, this feature is designed to provide **network accessible**
 services. A database is the simplest example of such a service.
 
-NOTE: **Note:**
 The services feature is not designed to, and does not add any software from the
 defined `services` image(s) to the job's container.
 
@@ -186,7 +185,6 @@ access to it from your build container under two hostnames to choose from:
 - `tutum-wordpress`
 - `tutum__wordpress`
 
-NOTE: **Note:**
 Hostnames with underscores are not RFC valid and may cause problems in 3rd party
 applications.
 
@@ -364,10 +362,9 @@ For example, the following two definitions are equal:
 | `name`       | yes, when used with any other option  | 9.4 | Full name of the image that should be used. It should contain the Registry part if needed. |
 | `entrypoint` | no     | 9.4 |Command or script that should be executed as the container's entrypoint. It's translated to Docker's `--entrypoint` option while creating the container. The syntax is similar to [`Dockerfile`'s `ENTRYPOINT`](https://docs.docker.com/engine/reference/builder/#entrypoint) directive, where each shell token is a separate string in the array. |
 | `command`    | no       | 9.4 |Command or script that should be used as the container's command. It's translated to arguments passed to Docker after the image's name. The syntax is similar to [`Dockerfile`'s `CMD`](https://docs.docker.com/engine/reference/builder/#cmd) directive, where each shell token is a separate string in the array. |
-| `alias`      | no       | 9.4 |Additional alias that can be used to access the service from the job's container. Read [Accessing the services](#accessing-the-services) for more information. |
+| `alias` (1)     | no       | 9.4 |Additional alias that can be used to access the service from the job's container. Read [Accessing the services](#accessing-the-services) for more information. |
 
-NOTE: **Note:**
-Alias support for the Kubernetes executor was [introduced](https://gitlab.com/gitlab-org/gitlab-runner/-/issues/2229) in GitLab Runner 12.8, and is only available for Kubernetes version 1.7 or later.
+(1) Alias support for the Kubernetes executor was [introduced](https://gitlab.com/gitlab-org/gitlab-runner/-/issues/2229) in GitLab Runner 12.8, and is only available for Kubernetes version 1.7 or later.
 
 ### Starting multiple services from the same image
 
@@ -532,7 +529,6 @@ To define which should be used, the GitLab Runner process reads the configuratio
   If the `--user` flag is provided to run the GitLab Runner child processes as unprivileged user,
   the home directory of the main GitLab Runner process user is used.
 
-NOTE: **Note:**
 GitLab Runner reads this configuration **only** from `config.toml` and ignores it if
 it's provided as an environment variable. This is because GitLab Runner uses **only**
 `config.toml` configuration and does not interpolate **ANY** environment variables at
@@ -601,7 +597,7 @@ There are two ways to determine the value of `DOCKER_AUTH_CONFIG`:
   Open a terminal and execute the following command:
 
   ```shell
-  # Note the use of "-n" - it prevents encoding a newline in the password.
+  # The use of "-n" - prevents encoding a newline in the password.
   echo -n "my_username:my_password" | base64
 
   # Example output to copy
@@ -651,7 +647,6 @@ follow these steps:
 You can add configuration for as many registries as you want, adding more
 registries to the `"auths"` hash as described above.
 
-NOTE: **Note:**
 The full `hostname:port` combination is required everywhere
 for the runner to match the `DOCKER_AUTH_CONFIG`. For example, if
 `registry.example.com:5000/namespace/image:tag` is specified in `.gitlab-ci.yml`,
@@ -680,17 +675,15 @@ To add `DOCKER_AUTH_CONFIG` to a runner:
      environment = ["DOCKER_AUTH_CONFIG={\"auths\":{\"registry.example.com:5000\":{\"auth\":\"bXlfdXNlcm5hbWU6bXlfcGFzc3dvcmQ=\"}}}"]
    ```
 
-1. Restart the runner service.
+   - The double quotes included in the `DOCKER_AUTH_CONFIG`
+     data must be escaped with backslashes. This prevents them from being
+     interpreted as TOML.
 
-NOTE: **Note:**
-The double quotes included in the `DOCKER_AUTH_CONFIG`
-data must be escaped with backslashes. This prevents them from being
-interpreted as TOML.
+   - The `environment` option is a list. Your runner may
+     have existing entries and you should add this to the list, not replace
+     it.
 
-NOTE: **Note:**
-The `environment` option is a list. So your runner may
-have existing entries and you should add this to the list, not replace
-it.
+1. Restart the runner service.
 
 ### Using Credentials Store
 
@@ -718,10 +711,9 @@ To configure credentials store, follow these steps:
      `${GITLAB_RUNNER_HOME}/.docker/config.json`. GitLab Runner reads this configuration file
      and uses the needed helper for this specific repository.
 
-NOTE: **Note:**
 `credsStore` is used to access ALL the registries.
-If you want to use both images from private registry and public images from DockerHub,
-pulling from DockerHub would fail, because Docker daemon tries to use the same credentials for **ALL** the registries.
+If you want to use both images from private registry and public images from Docker Hub,
+pulling from Docker Hub would fail, because Docker daemon tries to use the same credentials for **ALL** the registries.
 
 ### Using Credential Helpers
 
@@ -792,7 +784,6 @@ service containers.
 For all possible configuration variables check the documentation of each image
 provided in their corresponding Docker hub page.
 
-NOTE: **Note:**
 All variables are passed to all services containers. It's not
 designed to distinguish which variable should go where.
 
diff --git a/doc/ci/pipelines/settings.md b/doc/ci/pipelines/settings.md
index 59bca0672d6..444bae68822 100644
--- a/doc/ci/pipelines/settings.md
+++ b/doc/ci/pipelines/settings.md
@@ -37,10 +37,10 @@ in `.gitlab-ci.yml`.
 > [Introduced](https://gitlab.com/gitlab-org/gitlab-foss/-/merge_requests/28919) in GitLab 12.0.
 
 NOTE: **Note:**
-As of GitLab 12.0, newly created projects will automatically have a default
+As of GitLab 12.0, newly created projects automatically have a default
 `git depth` value of `50`.
 
-It is possible to limit the number of changes that GitLab CI/CD will fetch when cloning
+It is possible to limit the number of changes that GitLab CI/CD fetches when cloning
 a repository. Setting a limit to `git depth` can speed up Pipelines execution. Maximum
 allowed value is `1000`.
 
@@ -93,11 +93,11 @@ paths and file names include:
 - `my/path/.gitlab-ci.yml`
 - `my/path/.my-custom-file.yml`
 
-If the CI configuration will be hosted on an external site, the URL link must end with `.yml`:
+If hosting the CI configuration on an external site, the URL link must end with `.yml`:
 
 - `http://example.com/generate/ci/config.yml`
 
-If the CI configuration will be hosted in a different project within GitLab, the path must be relative
+If the CI configuration is hosted in a different project within GitLab, the path must be relative
 to the root directory in the other project, with the group and project name added to the end:
 
 - `.gitlab-ci.yml@mygroup/another-project`
@@ -109,7 +109,7 @@ configuration file. For example:
 - Create a public project to host the configuration file.
 - Give write permissions on the project only to users who are allowed to edit the file.
 
-Other users and projects will be able to access the configuration file without being
+Other users and projects can access the configuration file without being
 able to edit it.
 
 ## Test coverage parsing
@@ -125,8 +125,8 @@ can use <https://rubular.com> to test your regex. The regex returns the **last**
 match found in the output.
 
 If the pipeline succeeds, the coverage is shown in the merge request widget and
-in the jobs table. If multiple jobs in the pipeline have coverage reports, they will
-be averaged.
+in the jobs table. If multiple jobs in the pipeline have coverage reports, they are
+averaged.
 
 ![MR widget coverage](img/pipelines_test_coverage_mr_widget.png)
 
@@ -150,13 +150,13 @@ you can view a graph or download a CSV file with this data. From your project:
 
 ### Removing color codes
 
-Some test coverage tools output with ANSI color codes that won't be
-parsed correctly by the regular expression and will cause coverage
+Some test coverage tools output with ANSI color codes that aren't
+parsed correctly by the regular expression and cause coverage
 parsing to fail.
 
 If your coverage tool doesn't provide an option to disable color
 codes in the output, you can pipe the output of the coverage tool through a
-small one line script that will strip the color codes off.
+small one line script that strips the color codes off.
 
 For example:
 
@@ -172,7 +172,7 @@ Pipeline visibility is determined by:
 - The **Public pipelines** project setting under your project's **Settings > CI/CD > General pipelines**.
 
 NOTE: **Note:**
-If the project visibility is set to **Private**, the [**Public pipelines** setting will have no effect](../enable_or_disable_ci.md#per-project-user-setting).
+If the project visibility is set to **Private**, the [**Public pipelines** setting has no effect](../enable_or_disable_ci.md#per-project-user-setting).
 
 This also determines the visibility of these related features:
 
@@ -213,7 +213,7 @@ you can enable this in the project settings:
 1. Check the **Auto-cancel redundant, pending pipelines** checkbox.
 1. Click **Save changes**.
 
-Note that only jobs with [interruptible](../yaml/README.md#interruptible) set to `true` will be cancelled.
+Note that only jobs with [interruptible](../yaml/README.md#interruptible) set to `true` are cancelled.
 
 ## Skip outdated deployment jobs
 
@@ -232,14 +232,14 @@ To avoid this scenario:
 1. Check the **Skip outdated deployment jobs** checkbox.
 1. Click **Save changes**.
 
-The pending deployment jobs will be skipped.
+When enabled, any older deployments job are skipped when a new deployment starts.
 
 For more information, see [Deployment safety](../environments/deployment_safety.md).
 
 ## Pipeline Badges
 
 In the pipelines settings page you can find pipeline status and test coverage
-badges for your project. The latest successful pipeline will be used to read
+badges for your project. The latest successful pipeline is used to read
 the pipeline status and test coverage values.
 
 Visit the pipelines settings page in your project to see the exact link to
@@ -276,8 +276,8 @@ https://gitlab.example.com/<namespace>/<project>/badges/<branch>/pipeline.svg?ig
 
 ### Test coverage report badge
 
-GitLab makes it possible to define the regular expression for [coverage report](#test-coverage-parsing),
-that each job log will be matched against. This means that each job in the
+GitLab makes it possible to define the regular expression for the [coverage report](#test-coverage-parsing),
+that each job log is matched against. This means that each job in the
 pipeline can have the test coverage percentage value defined.
 
 The test coverage badge can be accessed using following link:
@@ -288,7 +288,7 @@ https://gitlab.example.com/<namespace>/<project>/badges/<branch>/coverage.svg
 
 If you would like to get the coverage report from a specific job, you can add
 the `job=coverage_job_name` parameter to the URL. For example, the following
-Markdown code will embed the test coverage report badge of the `coverage` job
+Markdown code embeds the test coverage report badge of the `coverage` job
 into your `README.md`:
 
 ```markdown
diff --git a/doc/development/testing_guide/end_to_end/best_practices.md b/doc/development/testing_guide/end_to_end/best_practices.md
index 36cb49256a6..866a949d795 100644
--- a/doc/development/testing_guide/end_to_end/best_practices.md
+++ b/doc/development/testing_guide/end_to_end/best_practices.md
@@ -310,3 +310,56 @@ end
 # Using native mouse click events in the case of a mask/overlay
 click_element_coordinates(:title)
 ```
+
+## Ensure `expect` statements wait efficiently
+
+In general, we use an `expect` statement to check that something _is_ as we expect it. For example:
+
+```ruby
+Page::Project::Pipeline::Show.perform do |pipeline|
+  expect(pipeline).to have_job("a_job")
+end
+```
+
+### Ensure `expect` checks for negation efficiently
+
+However, sometimes we want to check that something is _not_ as we _don't_ want it to be. In other
+words, we want to make sure something is absent. In such a case we should use an appropriate
+predicate method that returns quickly, rather than waiting for a state that won't appear.
+
+It's most efficient to use a predicate method that returns immediately when there is no job, or waits
+until it disappears:
+
+```ruby
+# Good
+Page::Project::Pipeline::Show.perform do |pipeline|
+  expect(pipeline).to have_no_job("a_job")
+end
+```
+
+### Problematic alternatives
+
+Alternatively, if we want to check that a job doesn't exist it might be tempting to use `not_to`:
+
+```ruby
+# Bad
+Page::Project::Pipeline::Show.perform do |pipeline|
+  expect(pipeline).not_to have_job("a_job")
+end
+```
+
+For this statement to pass, `have_job("a_job")` has to return `false` so that `not_to` can negate it.
+The problem is that `have_job("a_job")` waits up to ten seconds for `"a job"` to appear before
+returning `false`. Under the expected condition this test will take ten seconds longer than it needs to.
+
+Instead, we could force no wait:
+
+```ruby
+# Not as bad but potentially flaky
+Page::Project::Pipeline::Show.perform do |pipeline|
+  expect(pipeline).not_to have_job("a_job", wait: 0)
+end
+```
+
+The problem is that if `"a_job"` is present and we're waiting for it to disappear, this statement
+will fail.
diff --git a/doc/user/application_security/dast/index.md b/doc/user/application_security/dast/index.md
index 9cb00fbfd97..fc2664d3b0a 100644
--- a/doc/user/application_security/dast/index.md
+++ b/doc/user/application_security/dast/index.md
@@ -438,7 +438,9 @@ variables:
 ```
 
 NOTE: **Note:**
-`DAST_AUTH_EXCLUDE_URLS` are ignored when `DAST_PATHS` is set.
+
+- The `DAST_PATHS` environment variable has a limit of about 130kb. If you have a list or paths greater than this it is recommended creating multiple DAST jobs and split the paths over each.
+- The `DAST_AUTH_EXCLUDE_URLS` environment variable is ignored when `DAST_PATHS` is set.
 
 #### Full Scan
 
diff --git a/lib/safe_zip/extract.rb b/lib/safe_zip/extract.rb
index 679c021c730..ac33f0b3c2c 100644
--- a/lib/safe_zip/extract.rb
+++ b/lib/safe_zip/extract.rb
@@ -19,11 +19,7 @@ module SafeZip
     def extract(opts = {})
       params = SafeZip::ExtractParams.new(**opts)
 
-      if Feature.enabled?(:safezip_use_rubyzip, default_enabled: true)
-        extract_with_ruby_zip(params)
-      else
-        legacy_unsafe_extract_with_system_zip(params)
-      end
+      extract_with_ruby_zip(params)
     end
 
     private
@@ -53,21 +49,5 @@ module SafeZip
           .extract
       end
     end
-
-    def legacy_unsafe_extract_with_system_zip(params)
-      # Requires UnZip at least 6.00 Info-ZIP.
-      # -n  never overwrite existing files
-      args = %W(unzip -n -qq #{archive_path})
-
-      # We add * to end of directory, because we want to extract directory and all subdirectories
-      args += params.directories_wildcard
-
-      # Target directory where we extract
-      args += %W(-d #{params.extract_path})
-
-      unless system(*args)
-        raise Error, 'archive failed to extract'
-      end
-    end
   end
 end
diff --git a/qa/qa.rb b/qa/qa.rb
index 0144d889477..d0edd1936e5 100644
--- a/qa/qa.rb
+++ b/qa/qa.rb
@@ -373,6 +373,7 @@ module QA
       module Snippet
         autoload :New, 'qa/page/project/snippet/new'
         autoload :Show, 'qa/page/project/snippet/show'
+        autoload :Index, 'qa/page/project/snippet/index'
       end
     end
 
diff --git a/qa/qa/page/component/snippet.rb b/qa/qa/page/component/snippet.rb
index 702773768a8..7074d7e7649 100644
--- a/qa/qa/page/component/snippet.rb
+++ b/qa/qa/page/component/snippet.rb
@@ -122,6 +122,18 @@ module QA
           end
         end
 
+        def has_no_file_content?(file_content, file_number = nil)
+          if file_number
+            within_element_by_index(:file_content, file_number - 1) do
+              has_no_text?(file_content)
+            end
+          else
+            within_element(:file_content) do
+              has_no_text?(file_content)
+            end
+          end
+        end
+
         def has_embed_dropdown?
           has_element?(:snippet_embed_dropdown)
         end
diff --git a/qa/qa/page/project/snippet/index.rb b/qa/qa/page/project/snippet/index.rb
new file mode 100644
index 00000000000..a221abc4196
--- /dev/null
+++ b/qa/qa/page/project/snippet/index.rb
@@ -0,0 +1,29 @@
+# frozen_string_literal: true
+
+module QA
+  module Page
+    module Project
+      module Snippet
+        class Index < Page::Base
+          include Page::Component::Snippet
+
+          view 'app/views/shared/snippets/_snippet.html.haml' do
+            element :snippet_link
+          end
+
+          def has_project_snippet?(title)
+            has_element?(:snippet_link, snippet_title: title)
+          end
+
+          def click_snippet_link(title)
+            within_element(:snippet_link, text: title) do
+              click_link(title)
+            end
+          end
+        end
+      end
+    end
+  end
+end
+
+QA::Page::Project::Snippet::Index.prepend_if_ee('QA::EE::Page::Project::Snippet::Index')
diff --git a/qa/qa/specs/features/browser_ui/3_create/snippet/create_project_snippet_spec.rb b/qa/qa/specs/features/browser_ui/3_create/snippet/create_project_snippet_spec.rb
index 0a8f6e13b2e..d80fc4c5b95 100644
--- a/qa/qa/specs/features/browser_ui/3_create/snippet/create_project_snippet_spec.rb
+++ b/qa/qa/specs/features/browser_ui/3_create/snippet/create_project_snippet_spec.rb
@@ -21,8 +21,8 @@ module QA
           expect(snippet).to have_file_name('markdown_file.md')
           expect(snippet).to have_file_content('Snippet heading')
           expect(snippet).to have_file_content('Gitlab link')
-          expect(snippet).not_to have_file_content('###')
-          expect(snippet).not_to have_file_content('https://gitlab.com/')
+          expect(snippet).to have_no_file_content('###')
+          expect(snippet).to have_no_file_content('https://gitlab.com/')
         end
       end
     end
diff --git a/qa/qa/specs/features/browser_ui/4_verify/pipeline/run_pipeline_via_web_only_spec.rb b/qa/qa/specs/features/browser_ui/4_verify/pipeline/run_pipeline_via_web_only_spec.rb
index cdd4b789bf7..153ccafaa20 100644
--- a/qa/qa/specs/features/browser_ui/4_verify/pipeline/run_pipeline_via_web_only_spec.rb
+++ b/qa/qa/specs/features/browser_ui/4_verify/pipeline/run_pipeline_via_web_only_spec.rb
@@ -6,7 +6,7 @@ module QA
       # [TODO]: Developer to remove :requires_admin and :skip_live_env once FF is removed in https://gitlab.com/gitlab-org/gitlab/-/issues/229632
 
       context 'with web only rule' do
-        let(:feature_flag) { 'new_pipeline_form' }
+        let(:feature_flag) { :new_pipeline_form }
         let(:job_name) { 'test_job' }
         let(:project) do
           Resource::Project.fabricate_via_api! do |project|
@@ -37,14 +37,14 @@ module QA
         end
 
         before do
-          Runtime::Feature.enable_and_verify(feature_flag) # [TODO]: Developer to remove when feature flag is removed
+          Runtime::Feature.enable(feature_flag) # [TODO]: Developer to remove when feature flag is removed
           Flow::Login.sign_in
           project.visit!
           Page::Project::Menu.perform(&:click_ci_cd_pipelines)
         end
 
         after do
-          Runtime::Feature.disable_and_verify(feature_flag) # [TODO]: Developer to remove when feature flag is removed
+          Runtime::Feature.disable(feature_flag) # [TODO]: Developer to remove when feature flag is removed
         end
 
         it 'can trigger pipeline', testcase: 'https://gitlab.com/gitlab-org/quality/testcases/-/issues/946' do
diff --git a/spec/features/search/user_searches_for_code_spec.rb b/spec/features/search/user_searches_for_code_spec.rb
index 227e75088d2..a88043c98ac 100644
--- a/spec/features/search/user_searches_for_code_spec.rb
+++ b/spec/features/search/user_searches_for_code_spec.rb
@@ -21,6 +21,7 @@ RSpec.describe 'User searches for code' do
       expect(page).to have_selector('.results', text: 'application.js')
       expect(page).to have_selector('.file-content .code')
       expect(page).to have_selector("span.line[lang='javascript']")
+      expect(page).to have_link('application.js', href: /master\/files\/js\/application.js/)
     end
 
     context 'when on a project page', :js do
diff --git a/spec/helpers/search_helper_spec.rb b/spec/helpers/search_helper_spec.rb
index 594c5c11994..110741e5dfd 100644
--- a/spec/helpers/search_helper_spec.rb
+++ b/spec/helpers/search_helper_spec.rb
@@ -399,4 +399,25 @@ RSpec.describe SearchHelper do
       end
     end
   end
+
+  describe '#repository_ref' do
+    let_it_be(:project) { create(:project, :repository) }
+    let(:params) { { repository_ref: 'the-repository-ref-param' } }
+
+    subject { repository_ref(project) }
+
+    it { is_expected.to eq('the-repository-ref-param') }
+
+    context 'when the param :repository_ref is not set' do
+      let(:params) { { repository_ref: nil } }
+
+      it { is_expected.to eq(project.default_branch) }
+    end
+
+    context 'when the repository_ref param is a number' do
+      let(:params) { { repository_ref: 111111 } }
+
+      it { is_expected.to eq('111111') }
+    end
+  end
 end
diff --git a/spec/lib/safe_zip/extract_spec.rb b/spec/lib/safe_zip/extract_spec.rb
index 30b7e1cdd2c..443430b267d 100644
--- a/spec/lib/safe_zip/extract_spec.rb
+++ b/spec/lib/safe_zip/extract_spec.rb
@@ -15,11 +15,7 @@ RSpec.describe SafeZip::Extract do
   describe '#extract' do
     subject { object.extract(directories: directories, to: target_path) }
 
-    shared_examples 'extracts archive' do |param|
-      before do
-        stub_feature_flags(safezip_use_rubyzip: param)
-      end
-
+    shared_examples 'extracts archive' do
       it 'does extract archive' do
         subject
 
@@ -28,11 +24,7 @@ RSpec.describe SafeZip::Extract do
       end
     end
 
-    shared_examples 'fails to extract archive' do |param|
-      before do
-        stub_feature_flags(safezip_use_rubyzip: param)
-      end
-
+    shared_examples 'fails to extract archive' do
       it 'does not extract archive' do
         expect { subject }.to raise_error(SafeZip::Extract::Error)
       end
@@ -42,13 +34,7 @@ RSpec.describe SafeZip::Extract do
       context "when using #{name} archive" do
         let(:archive_name) { name }
 
-        context 'for RubyZip' do
-          it_behaves_like 'extracts archive', true
-        end
-
-        context 'for UnZip' do
-          it_behaves_like 'extracts archive', false
-        end
+        it_behaves_like 'extracts archive'
       end
     end
 
@@ -56,13 +42,7 @@ RSpec.describe SafeZip::Extract do
       context "when using #{name} archive" do
         let(:archive_name) { name }
 
-        context 'for RubyZip' do
-          it_behaves_like 'fails to extract archive', true
-        end
-
-        context 'for UnZip (UNSAFE)' do
-          it_behaves_like 'extracts archive', false
-        end
+        it_behaves_like 'fails to extract archive'
       end
     end
 
@@ -70,13 +50,7 @@ RSpec.describe SafeZip::Extract do
       let(:archive_name) { 'valid-simple.zip' }
       let(:directories) { %w(non/existing) }
 
-      context 'for RubyZip' do
-        it_behaves_like 'fails to extract archive', true
-      end
-
-      context 'for UnZip' do
-        it_behaves_like 'fails to extract archive', false
-      end
+      it_behaves_like 'fails to extract archive'
     end
   end
 end
diff --git a/spec/services/projects/update_pages_service_spec.rb b/spec/services/projects/update_pages_service_spec.rb
index bfb3cbb0131..b6fd72cd4f5 100644
--- a/spec/services/projects/update_pages_service_spec.rb
+++ b/spec/services/projects/update_pages_service_spec.rb
@@ -16,8 +16,6 @@ RSpec.describe Projects::UpdatePagesService do
   subject { described_class.new(project, build) }
 
   before do
-    stub_feature_flags(safezip_use_rubyzip: true)
-
     project.remove_pages
   end
 
@@ -104,10 +102,6 @@ RSpec.describe Projects::UpdatePagesService do
         let(:file) { fixture_file_upload("spec/fixtures/pages_non_writeable.zip") }
 
         context 'when using RubyZip' do
-          before do
-            stub_feature_flags(safezip_use_rubyzip: true)
-          end
-
           it 'succeeds to extract' do
             expect(execute).to eq(:success)
             expect(project.pages_metadatum).to be_deployed