Add latest changes from gitlab-org/gitlab@13-9-stable-eev13.9.0-rc42

26 files changed, 192 insertions, 73 deletions

diff --git a/app/controllers/projects/badges_controller.rb b/app/controllers/projects/badges_controller.rb
index 855965ca6e1..f75ab5cdbf2 100644
--- a/app/controllers/projects/badges_controller.rb
+++ b/app/controllers/projects/badges_controller.rb
@@ -9,7 +9,7 @@ class Projects::BadgesController < Projects::ApplicationController
   feature_category :continuous_integration
 
   def pipeline
-    pipeline_status = Gitlab::Badge::Pipeline::Status
+    pipeline_status = Gitlab::Ci::Badge::Pipeline::Status
       .new(project, params[:ref], opts: {
         ignore_skipped: params[:ignore_skipped],
         key_text: params[:key_text],
@@ -20,7 +20,7 @@ class Projects::BadgesController < Projects::ApplicationController
   end
 
   def coverage
-    coverage_report = Gitlab::Badge::Coverage::Report
+    coverage_report = Gitlab::Ci::Badge::Coverage::Report
       .new(project, params[:ref], opts: {
         job: params[:job],
         key_text: params[:key_text],
diff --git a/app/controllers/projects/blob_controller.rb b/app/controllers/projects/blob_controller.rb
index 8c66f45dd79..3bb00978aac 100644
--- a/app/controllers/projects/blob_controller.rb
+++ b/app/controllers/projects/blob_controller.rb
@@ -35,7 +35,7 @@ class Projects::BlobController < Projects::ApplicationController
     record_experiment_user(:ci_syntax_templates, namespace_id: @project.namespace_id) if params[:file_name] == @project.ci_config_path_or_default
   end
 
-  track_redis_hll_event :create, :update, name: 'g_edit_by_sfe', feature: :track_editor_edit_actions, feature_default_enabled: true
+  track_redis_hll_event :create, :update, name: 'g_edit_by_sfe'
 
   feature_category :source_code_management
 
diff --git a/app/controllers/projects/boards_controller.rb b/app/controllers/projects/boards_controller.rb
index 51c9bf3699a..d2e5d319f96 100644
--- a/app/controllers/projects/boards_controller.rb
+++ b/app/controllers/projects/boards_controller.rb
@@ -15,6 +15,28 @@ class Projects::BoardsController < Projects::ApplicationController
 
   private
 
+  def board_klass
+    Board
+  end
+
+  def boards_finder
+    strong_memoize :boards_finder do
+      Boards::ListService.new(parent, current_user)
+    end
+  end
+
+  def board_finder
+    strong_memoize :board_finder do
+      Boards::ListService.new(parent, current_user, board_id: params[:id])
+    end
+  end
+
+  def board_create_service
+    strong_memoize :board_create_service do
+      Boards::CreateService.new(parent, current_user)
+    end
+  end
+
   def assign_endpoint_vars
     @boards_endpoint = project_boards_path(project)
     @bulk_issues_path = bulk_update_project_issues_path(project)
diff --git a/app/controllers/projects/branches_controller.rb b/app/controllers/projects/branches_controller.rb
index a753d5705aa..6f3c96fa654 100644
--- a/app/controllers/projects/branches_controller.rb
+++ b/app/controllers/projects/branches_controller.rb
@@ -177,10 +177,8 @@ class Projects::BranchesController < Projects::ApplicationController
   def fetch_branches_by_mode
     return fetch_branches_for_overview if @mode == 'overview'
 
-    # active/stale/all view mode
-    @branches = BranchesFinder.new(@repository, params.merge(sort: @sort)).execute
-    @branches = @branches.select { |b| b.state.to_s == @mode } if %w[active stale].include?(@mode)
-    @branches = Kaminari.paginate_array(@branches).page(params[:page])
+    @branches, @prev_path, @next_path =
+      Projects::BranchesByModeService.new(@project, params.merge(sort: @sort, mode: @mode)).execute
   end
 
   def fetch_branches_for_overview
diff --git a/app/controllers/projects/ci/daily_build_group_report_results_controller.rb b/app/controllers/projects/ci/daily_build_group_report_results_controller.rb
index d05ab1b4977..aabcb74cefa 100644
--- a/app/controllers/projects/ci/daily_build_group_report_results_controller.rb
+++ b/app/controllers/projects/ci/daily_build_group_report_results_controller.rb
@@ -40,7 +40,25 @@ class Projects::Ci::DailyBuildGroupReportResultsController < Projects::Applicati
   end
 
   def report_results
-    Ci::DailyBuildGroupReportResultsFinder.new(**finder_params).execute
+    if ::Gitlab::Ci::Features.use_coverage_data_new_finder?(project)
+      ::Ci::Testing::DailyBuildGroupReportResultsFinder.new(
+        params: new_finder_params,
+        current_user: current_user
+      ).execute
+    else
+      Ci::DailyBuildGroupReportResultsFinder.new(**finder_params).execute
+    end
+  end
+
+  def new_finder_params
+    {
+      project: project,
+      coverage: true,
+      start_date: start_date,
+      end_date: end_date,
+      ref_path: params[:ref_path],
+      sort: true
+    }
   end
 
   def finder_params
diff --git a/app/controllers/projects/ci/pipeline_editor_controller.rb b/app/controllers/projects/ci/pipeline_editor_controller.rb
index ef9025ae52f..3552915b561 100644
--- a/app/controllers/projects/ci/pipeline_editor_controller.rb
+++ b/app/controllers/projects/ci/pipeline_editor_controller.rb
@@ -4,6 +4,7 @@ class Projects::Ci::PipelineEditorController < Projects::ApplicationController
   before_action :check_can_collaborate!
   before_action do
     push_frontend_feature_flag(:ci_config_visualization_tab, @project, default_enabled: :yaml)
+    push_frontend_feature_flag(:ci_config_merged_tab, @project, default_enabled: :yaml)
   end
 
   feature_category :pipeline_authoring
diff --git a/app/controllers/projects/ci/prometheus_metrics/histograms_controller.rb b/app/controllers/projects/ci/prometheus_metrics/histograms_controller.rb
new file mode 100644
index 00000000000..003441d4b91
--- /dev/null
+++ b/app/controllers/projects/ci/prometheus_metrics/histograms_controller.rb
@@ -0,0 +1,25 @@
+# frozen_string_literal: true
+
+module Projects
+  module Ci
+    module PrometheusMetrics
+      class HistogramsController < Projects::ApplicationController
+        feature_category :pipeline_authoring
+
+        respond_to :json, only: [:create]
+
+        def create
+          result = ::Ci::PrometheusMetrics::ObserveHistogramsService.new(project, permitted_params).execute
+
+          render json: result.payload, status: result.http_status
+        end
+
+        private
+
+        def permitted_params
+          params.permit(histograms: [:name, :value])
+        end
+      end
+    end
+  end
+end
diff --git a/app/controllers/projects/commit_controller.rb b/app/controllers/projects/commit_controller.rb
index 2e48f2f0e45..ffdd9fca95b 100644
--- a/app/controllers/projects/commit_controller.rb
+++ b/app/controllers/projects/commit_controller.rb
@@ -18,8 +18,12 @@ class Projects::CommitController < Projects::ApplicationController
   before_action :define_commit_vars, only: [:show, :diff_for_path, :diff_files, :pipelines, :merge_requests]
   before_action :define_note_vars, only: [:show, :diff_for_path, :diff_files]
   before_action :authorize_edit_tree!, only: [:revert, :cherry_pick]
+  before_action only: [:pipelines] do
+    push_frontend_feature_flag(:ci_mini_pipeline_gl_dropdown, @project, type: :development, default_enabled: :yaml)
+  end
 
   BRANCH_SEARCH_LIMIT = 1000
+  COMMIT_DIFFS_PER_PAGE = 75
 
   feature_category :source_code_management
 
diff --git a/app/controllers/projects/discussions_controller.rb b/app/controllers/projects/discussions_controller.rb
index b9ab1076999..708b7a6c7ba 100644
--- a/app/controllers/projects/discussions_controller.rb
+++ b/app/controllers/projects/discussions_controller.rb
@@ -18,7 +18,7 @@ class Projects::DiscussionsController < Projects::ApplicationController
   end
 
   def unresolve
-    discussion.unresolve!
+    Discussions::UnresolveService.new(discussion, current_user).execute
 
     render_discussion
   end
diff --git a/app/controllers/projects/forks_controller.rb b/app/controllers/projects/forks_controller.rb
index 1c2930f6e9b..5576d5766c7 100644
--- a/app/controllers/projects/forks_controller.rb
+++ b/app/controllers/projects/forks_controller.rb
@@ -86,7 +86,7 @@ class Projects::ForksController < Projects::ApplicationController
 
   def fork_service
     strong_memoize(:fork_service) do
-      ::Projects::ForkService.new(project, current_user, namespace: fork_namespace)
+      ::Projects::ForkService.new(project, current_user, fork_params)
     end
   end
 
@@ -96,6 +96,12 @@ class Projects::ForksController < Projects::ApplicationController
     end
   end
 
+  def fork_params
+    params.permit(:path, :name, :description, :visibility).tap do |param|
+      param[:namespace] = fork_namespace
+    end
+  end
+
   def authorize_fork_namespace!
     access_denied! unless fork_namespace && fork_service.valid_fork_target?
   end
diff --git a/app/controllers/projects/issues_controller.rb b/app/controllers/projects/issues_controller.rb
index 3a0e40f9745..2816977277a 100644
--- a/app/controllers/projects/issues_controller.rb
+++ b/app/controllers/projects/issues_controller.rb
@@ -9,6 +9,7 @@ class Projects::IssuesController < Projects::ApplicationController
   include IssuesCalendar
   include SpammableActions
   include RecordUserLastActivity
+  include CommentAndCloseFlag
 
   ISSUES_EXCEPT_ACTIONS = %i[index calendar new create bulk_update import_csv export_csv service_desk].freeze
   SET_ISSUEABLES_INDEX_ONLY_ACTIONS = %i[index calendar service_desk].freeze
@@ -41,7 +42,6 @@ class Projects::IssuesController < Projects::ApplicationController
   before_action :create_rate_limit, only: [:create]
 
   before_action do
-    push_frontend_feature_flag(:vue_issuable_sidebar, project.group)
     push_frontend_feature_flag(:tribute_autocomplete, @project)
     push_frontend_feature_flag(:vue_issuables_list, project)
     push_frontend_feature_flag(:usage_data_design_action, project, default_enabled: true)
@@ -52,6 +52,7 @@ class Projects::IssuesController < Projects::ApplicationController
     real_time_enabled = Gitlab::ActionCable::Config.in_app? || Feature.enabled?(real_time_feature_flag, @project)
 
     push_to_gon_attributes(:features, real_time_feature_flag, real_time_enabled)
+    push_frontend_feature_flag(:confidential_notes, @project, default_enabled: :yaml)
 
     record_experiment_user(:invite_members_version_a)
     record_experiment_user(:invite_members_version_b)
@@ -60,8 +61,7 @@ class Projects::IssuesController < Projects::ApplicationController
   around_action :allow_gitaly_ref_name_caching, only: [:discussions]
 
   before_action :run_null_hypothesis_experiment,
-                only: [:index, :new, :create],
-                if: -> { Feature.enabled?(:gitlab_experiments) }
+                only: [:index, :new, :create]
 
   respond_to :html
 
@@ -106,7 +106,7 @@ class Projects::IssuesController < Projects::ApplicationController
     build_params = issue_create_params.merge(
       merge_request_to_resolve_discussions_of: params[:merge_request_to_resolve_discussions_of],
       discussion_to_resolve: params[:discussion_to_resolve],
-      confidential: !!Gitlab::Utils.to_boolean(params[:issue][:confidential])
+      confidential: !!Gitlab::Utils.to_boolean(issue_create_params[:confidential])
     )
     service = ::Issues::BuildService.new(project, current_user, build_params)
 
@@ -131,7 +131,7 @@ class Projects::IssuesController < Projects::ApplicationController
     service = ::Issues::CreateService.new(project, current_user, create_params)
     @issue = service.execute
 
-    create_vulnerability_issue_link(issue)
+    create_vulnerability_issue_feedback(issue)
 
     if service.discussions_to_resolve.count(&:resolved?) > 0
       flash[:notice] = if service.discussion_to_resolve_id
@@ -145,9 +145,6 @@ class Projects::IssuesController < Projects::ApplicationController
       format.html do
         recaptcha_check_with_fallback { render :new }
       end
-      format.js do
-        @link = @issue.attachment.url.to_js
-      end
     end
   end
 
@@ -403,7 +400,7 @@ class Projects::IssuesController < Projects::ApplicationController
   end
 
   # Overridden in EE
-  def create_vulnerability_issue_link(issue); end
+  def create_vulnerability_issue_feedback(issue); end
 end
 
 Projects::IssuesController.prepend_if_ee('EE::Projects::IssuesController')
diff --git a/app/controllers/projects/jobs_controller.rb b/app/controllers/projects/jobs_controller.rb
index d2703f5cc38..8a2ea51ba9d 100644
--- a/app/controllers/projects/jobs_controller.rb
+++ b/app/controllers/projects/jobs_controller.rb
@@ -15,9 +15,6 @@ class Projects::JobsController < Projects::ApplicationController
   before_action :verify_api_request!, only: :terminal_websocket_authorize
   before_action :authorize_create_proxy_build!, only: :proxy_websocket_authorize
   before_action :verify_proxy_request!, only: :proxy_websocket_authorize
-  before_action only: :index do
-    frontend_experimentation_tracking_data(:jobs_empty_state, 'click_button')
-  end
 
   layout 'project'
 
diff --git a/app/controllers/projects/learn_gitlab_controller.rb b/app/controllers/projects/learn_gitlab_controller.rb
new file mode 100644
index 00000000000..162ba9bd5cb
--- /dev/null
+++ b/app/controllers/projects/learn_gitlab_controller.rb
@@ -0,0 +1,19 @@
+# frozen_string_literal: true
+
+class Projects::LearnGitlabController < Projects::ApplicationController
+  before_action :authenticate_user!
+  before_action :check_experiment_enabled?
+
+  feature_category :users
+
+  def index
+    push_frontend_experiment(:learn_gitlab_a, subject: current_user)
+    push_frontend_experiment(:learn_gitlab_b, subject: current_user)
+  end
+
+  private
+
+  def check_experiment_enabled?
+    return access_denied! unless helpers.learn_gitlab_experiment_enabled?(project)
+  end
+end
diff --git a/app/controllers/projects/merge_requests/application_controller.rb b/app/controllers/projects/merge_requests/application_controller.rb
index 9cac9f37eb7..e74717a44ab 100644
--- a/app/controllers/projects/merge_requests/application_controller.rb
+++ b/app/controllers/projects/merge_requests/application_controller.rb
@@ -20,7 +20,7 @@ class Projects::MergeRequests::ApplicationController < Projects::ApplicationCont
   end
 
   def preloadable_mr_relations
-    [:metrics, :assignees, { author: :status }]
+    [:metrics, { assignees: :status }, { author: :status }]
   end
 
   def merge_request_params
diff --git a/app/controllers/projects/merge_requests/creations_controller.rb b/app/controllers/projects/merge_requests/creations_controller.rb
index 858bdc066c1..e79c19c3b67 100644
--- a/app/controllers/projects/merge_requests/creations_controller.rb
+++ b/app/controllers/projects/merge_requests/creations_controller.rb
@@ -12,9 +12,7 @@ class Projects::MergeRequests::CreationsController < Projects::MergeRequests::Ap
   before_action :build_merge_request, except: [:create]
 
   before_action do
-    push_frontend_feature_flag(:merge_request_reviewers, @project, default_enabled: true)
     push_frontend_feature_flag(:mr_collapsed_approval_rules, @project)
-    push_frontend_feature_flag(:reviewer_approval_rules, @project, default_enabled: :yaml)
   end
 
   def new
diff --git a/app/controllers/projects/merge_requests/diffs_controller.rb b/app/controllers/projects/merge_requests/diffs_controller.rb
index 9180b3f6b62..98ef9d918ae 100644
--- a/app/controllers/projects/merge_requests/diffs_controller.rb
+++ b/app/controllers/projects/merge_requests/diffs_controller.rb
@@ -122,10 +122,7 @@ class Projects::MergeRequests::DiffsController < Projects::MergeRequests::Applic
       end
     end
 
-    if render_merge_ref_head_diff?
-      return CompareService.new(@project, @merge_request.merge_ref_head.sha)
-        .execute(@project, @merge_request.target_branch)
-    end
+    return @merge_request.merge_head_diff if render_merge_ref_head_diff?
 
     if @start_sha
       @merge_request_diff.compare_with(@start_sha)
diff --git a/app/controllers/projects/merge_requests_controller.rb b/app/controllers/projects/merge_requests_controller.rb
index d452a5e02e2..c9e9a34ad88 100644
--- a/app/controllers/projects/merge_requests_controller.rb
+++ b/app/controllers/projects/merge_requests_controller.rb
@@ -11,6 +11,7 @@ class Projects::MergeRequestsController < Projects::MergeRequests::ApplicationCo
   include RecordUserLastActivity
   include SourcegraphDecorator
   include DiffHelper
+  include CommentAndCloseFlag
 
   skip_before_action :merge_request, only: [:index, :bulk_update, :export_csv]
   before_action :apply_diff_view_cookie!, only: [:show]
@@ -22,37 +23,35 @@ class Projects::MergeRequestsController < Projects::MergeRequests::ApplicationCo
     :coverage_reports,
     :terraform_reports,
     :accessibility_reports,
-    :codequality_reports
+    :codequality_reports,
+    :codequality_mr_diff_reports
   ]
   before_action :set_issuables_index, only: [:index]
   before_action :authenticate_user!, only: [:assign_related_issues]
   before_action :check_user_can_push_to_source_branch!, only: [:rebase]
   before_action only: [:show] do
-    push_frontend_feature_flag(:multiline_comments, @project, default_enabled: true)
     push_frontend_feature_flag(:file_identifier_hash)
     push_frontend_feature_flag(:batch_suggestions, @project, default_enabled: true)
     push_frontend_feature_flag(:approvals_commented_by, @project, default_enabled: true)
     push_frontend_feature_flag(:merge_request_widget_graphql, @project)
     push_frontend_feature_flag(:drag_comment_selection, @project, default_enabled: true)
     push_frontend_feature_flag(:unified_diff_components, @project, default_enabled: true)
-    push_frontend_feature_flag(:default_merge_ref_for_diffs, @project)
-    push_frontend_feature_flag(:core_security_mr_widget, @project, default_enabled: true)
+    push_frontend_feature_flag(:default_merge_ref_for_diffs, @project, default_enabled: :yaml)
     push_frontend_feature_flag(:core_security_mr_widget_counts, @project)
-    push_frontend_feature_flag(:core_security_mr_widget_downloads, @project, default_enabled: true)
     push_frontend_feature_flag(:remove_resolve_note, @project, default_enabled: true)
     push_frontend_feature_flag(:diffs_gradual_load, @project, default_enabled: true)
-    push_frontend_feature_flag(:codequality_mr_diff, @project)
-    push_frontend_feature_flag(:suggestions_custom_commit, @project)
+    push_frontend_feature_flag(:codequality_backend_comparison, @project, default_enabled: :yaml)
+    push_frontend_feature_flag(:suggestions_custom_commit, @project, default_enabled: true)
+    push_frontend_feature_flag(:local_file_reviews, default_enabled: :yaml)
+    push_frontend_feature_flag(:paginated_notes, @project, default_enabled: :yaml)
+    push_frontend_feature_flag(:ci_mini_pipeline_gl_dropdown, @project, type: :development, default_enabled: :yaml)
 
     record_experiment_user(:invite_members_version_a)
     record_experiment_user(:invite_members_version_b)
   end
 
   before_action do
-    push_frontend_feature_flag(:vue_issuable_sidebar, @project.group)
-    push_frontend_feature_flag(:merge_request_reviewers, @project, default_enabled: true)
     push_frontend_feature_flag(:mr_collapsed_approval_rules, @project)
-    push_frontend_feature_flag(:reviewer_approval_rules, @project, default_enabled: :yaml)
   end
 
   around_action :allow_gitaly_ref_name_caching, only: [:index, :show, :discussions]
@@ -68,7 +67,7 @@ class Projects::MergeRequestsController < Projects::MergeRequests::ApplicationCo
                      :toggle_award_emoji, :toggle_subscription, :update
                    ]
 
-  feature_category :code_testing, [:test_reports, :coverage_reports]
+  feature_category :code_testing, [:test_reports, :coverage_reports, :codequality_mr_diff_reports]
   feature_category :accessibility_testing, [:accessibility_reports]
   feature_category :infrastructure_as_code, [:terraform_reports]
 
@@ -168,6 +167,14 @@ class Projects::MergeRequestsController < Projects::MergeRequests::ApplicationCo
     }
   end
 
+  def sast_reports
+    reports_response(merge_request.compare_sast_reports(current_user), head_pipeline)
+  end
+
+  def secret_detection_reports
+    reports_response(merge_request.compare_secret_detection_reports(current_user), head_pipeline)
+  end
+
   def context_commits
     return render_404 unless project.context_commits_enabled?
 
@@ -197,6 +204,10 @@ class Projects::MergeRequestsController < Projects::MergeRequests::ApplicationCo
     end
   end
 
+  def codequality_mr_diff_reports
+    reports_response(@merge_request.find_codequality_mr_diff_reports)
+  end
+
   def codequality_reports
     reports_response(@merge_request.compare_codequality_reports)
   end
@@ -491,7 +502,7 @@ class Projects::MergeRequestsController < Projects::MergeRequests::ApplicationCo
     params = request.query_parameters
     params[:view] = "inline"
 
-    if Feature.enabled?(:default_merge_ref_for_diffs, project)
+    if Feature.enabled?(:default_merge_ref_for_diffs, project, default_enabled: :yaml)
       params = params.merge(diff_head: true)
     end
 
diff --git a/app/controllers/projects/notes_controller.rb b/app/controllers/projects/notes_controller.rb
index 77fd7688caf..71a93701dc4 100644
--- a/app/controllers/projects/notes_controller.rb
+++ b/app/controllers/projects/notes_controller.rb
@@ -10,6 +10,7 @@ class Projects::NotesController < Projects::ApplicationController
   before_action :authorize_read_note!
   before_action :authorize_create_note!, only: [:create]
   before_action :authorize_resolve_note!, only: [:resolve, :unresolve]
+  before_action :create_rate_limit, only: [:create]
 
   feature_category :issue_tracking
 
@@ -90,4 +91,20 @@ class Projects::NotesController < Projects::ApplicationController
   def whitelist_query_limiting
     Gitlab::QueryLimiting.whitelist('https://gitlab.com/gitlab-org/gitlab-foss/issues/42383')
   end
+
+  def create_rate_limit
+    key = :notes_create
+    return unless rate_limiter.throttled?(key, scope: [current_user], users_allowlist: rate_limit_users_allowlist)
+
+    rate_limiter.log_request(request, "#{key}_request_limit".to_sym, current_user)
+    render plain: _('This endpoint has been requested too many times. Try again later.'), status: :too_many_requests
+  end
+
+  def rate_limiter
+    ::Gitlab::ApplicationRateLimiter
+  end
+
+  def rate_limit_users_allowlist
+    Gitlab::CurrentSettings.current_application_settings.notes_create_limit_allowlist
+  end
 end
diff --git a/app/controllers/projects/pipelines/tests_controller.rb b/app/controllers/projects/pipelines/tests_controller.rb
index 924d52898ea..1702783b10f 100644
--- a/app/controllers/projects/pipelines/tests_controller.rb
+++ b/app/controllers/projects/pipelines/tests_controller.rb
@@ -42,9 +42,13 @@ module Projects
       end
 
       def test_suite
-        builds.map do |build|
+        suite = builds.map do |build|
           build.collect_test_reports!(Gitlab::Ci::Reports::TestReports.new)
         end.sum
+
+        Gitlab::Ci::Reports::TestFailureHistory.new(suite.failed.values, project).load!
+
+        suite
       end
       # rubocop: enable CodeReuse/ActiveRecord
     end
diff --git a/app/controllers/projects/pipelines_controller.rb b/app/controllers/projects/pipelines_controller.rb
index ae8b3d9b51d..59b14bbb91d 100644
--- a/app/controllers/projects/pipelines_controller.rb
+++ b/app/controllers/projects/pipelines_controller.rb
@@ -13,15 +13,14 @@ class Projects::PipelinesController < Projects::ApplicationController
   before_action :authorize_create_pipeline!, only: [:new, :create, :config_variables]
   before_action :authorize_update_pipeline!, only: [:retry, :cancel]
   before_action do
-    push_frontend_feature_flag(:dag_pipeline_tab, project, default_enabled: true)
     push_frontend_feature_flag(:pipelines_security_report_summary, project)
     push_frontend_feature_flag(:new_pipeline_form, project, default_enabled: true)
-    push_frontend_feature_flag(:graphql_pipeline_header, project, type: :development, default_enabled: false)
-    push_frontend_feature_flag(:graphql_pipeline_details, project, type: :development, default_enabled: false)
-    push_frontend_feature_flag(:new_pipeline_form_prefilled_vars, project, type: :development, default_enabled: true)
+    push_frontend_feature_flag(:graphql_pipeline_details, project, type: :development, default_enabled: :yaml)
+    push_frontend_feature_flag(:graphql_pipeline_details_users, current_user, type: :development, default_enabled: :yaml)
+    push_frontend_feature_flag(:ci_mini_pipeline_gl_dropdown, project, type: :development, default_enabled: :yaml)
+    push_frontend_feature_flag(:jira_for_vulnerabilities, project, type: :development, default_enabled: :yaml)
   end
   before_action :ensure_pipeline, only: [:show]
-  before_action :push_experiment_to_gon, only: :index, if: :html_request?
 
   # Will be removed with https://gitlab.com/gitlab-org/gitlab/-/issues/225596
   before_action :redirect_for_legacy_scope_filter, only: [:index], if: -> { request.format.html? }
@@ -46,11 +45,7 @@ class Projects::PipelinesController < Projects::ApplicationController
     @pipelines_count = limited_pipelines_count(project)
 
     respond_to do |format|
-      format.html do
-        record_empty_pipeline_experiment
-
-        render :index
-      end
+      format.html
       format.json do
         Gitlab::PollingInterval.set_header(response, interval: POLLING_INTERVAL)
 
@@ -301,20 +296,6 @@ class Projects::PipelinesController < Projects::ApplicationController
   def index_params
     params.permit(:scope, :username, :ref, :status)
   end
-
-  def record_empty_pipeline_experiment
-    return unless @pipelines_count.to_i == 0
-    return if helpers.has_gitlab_ci?(@project)
-
-    record_experiment_user(:pipelines_empty_state)
-  end
-
-  def push_experiment_to_gon
-    return unless current_user
-
-    push_frontend_experiment(:pipelines_empty_state, subject: current_user)
-    frontend_experimentation_tracking_data(:pipelines_empty_state, 'view', project.namespace_id, subject: current_user)
-  end
 end
 
 Projects::PipelinesController.prepend_if_ee('EE::Projects::PipelinesController')
diff --git a/app/controllers/projects/project_members_controller.rb b/app/controllers/projects/project_members_controller.rb
index 5972b29a298..a7c7839dc9f 100644
--- a/app/controllers/projects/project_members_controller.rb
+++ b/app/controllers/projects/project_members_controller.rb
@@ -8,6 +8,10 @@ class Projects::ProjectMembersController < Projects::ApplicationController
   # Authorize
   before_action :authorize_admin_project_member!, except: [:index, :leave, :request_access]
 
+  before_action do
+    push_frontend_feature_flag(:vue_project_members_list, @project, default_enabled: :yaml)
+  end
+
   feature_category :authentication_and_authorization
 
   def index
diff --git a/app/controllers/projects/security/configuration_controller.rb b/app/controllers/projects/security/configuration_controller.rb
new file mode 100644
index 00000000000..9366ca7b0ed
--- /dev/null
+++ b/app/controllers/projects/security/configuration_controller.rb
@@ -0,0 +1,23 @@
+# frozen_string_literal: true
+
+module Projects
+  module Security
+    class ConfigurationController < Projects::ApplicationController
+      feature_category :static_application_security_testing
+
+      def show
+        return render_404 unless feature_enabled?
+
+        render_403 unless can?(current_user, :read_security_configuration, project)
+      end
+
+      private
+
+      def feature_enabled?
+        ::Feature.enabled?(:secure_security_and_compliance_configuration_page_on_ce, @project, default_enabled: :yaml)
+      end
+    end
+  end
+end
+
+Projects::Security::ConfigurationController.prepend_if_ee('EE::Projects::Security::ConfigurationController')
diff --git a/app/controllers/projects/services_controller.rb b/app/controllers/projects/services_controller.rb
index 6ed9f74297d..b5c73f29784 100644
--- a/app/controllers/projects/services_controller.rb
+++ b/app/controllers/projects/services_controller.rb
@@ -14,7 +14,7 @@ class Projects::ServicesController < Projects::ApplicationController
   before_action only: :edit do
     push_frontend_feature_flag(:jira_issues_integration, @project, type: :licensed, default_enabled: true)
     push_frontend_feature_flag(:jira_vulnerabilities_integration, @project, type: :licensed, default_enabled: true)
-    push_frontend_feature_flag(:jira_for_vulnerabilities, @project, type: :development, default_enabled: false)
+    push_frontend_feature_flag(:jira_for_vulnerabilities, @project, type: :development, default_enabled: :yaml)
   end
 
   respond_to :html
diff --git a/app/controllers/projects/settings/ci_cd_controller.rb b/app/controllers/projects/settings/ci_cd_controller.rb
index 31533dfeea0..34b11c456b9 100644
--- a/app/controllers/projects/settings/ci_cd_controller.rb
+++ b/app/controllers/projects/settings/ci_cd_controller.rb
@@ -144,8 +144,8 @@ module Projects
       def define_badges_variables
         @ref = params[:ref] || @project.default_branch || 'master'
 
-        @badges = [Gitlab::Badge::Pipeline::Status,
-                   Gitlab::Badge::Coverage::Report]
+        @badges = [Gitlab::Ci::Badge::Pipeline::Status,
+                   Gitlab::Ci::Badge::Coverage::Report]
 
         @badges.map! do |badge|
           badge.new(@project, @ref).metadata
diff --git a/app/controllers/projects/settings/repository_controller.rb b/app/controllers/projects/settings/repository_controller.rb
index dd50ab1bc7a..821560e32ba 100644
--- a/app/controllers/projects/settings/repository_controller.rb
+++ b/app/controllers/projects/settings/repository_controller.rb
@@ -7,7 +7,6 @@ module Projects
       before_action :define_variables, only: [:create_deploy_token]
       before_action do
         push_frontend_feature_flag(:ajax_new_deploy_token, @project)
-        push_frontend_feature_flag(:deploy_keys_on_protected_branches, @project)
       end
 
       feature_category :source_code_management, [:show, :cleanup]
diff --git a/app/controllers/projects/templates_controller.rb b/app/controllers/projects/templates_controller.rb
index f4726638777..ab05c9694fd 100644
--- a/app/controllers/projects/templates_controller.rb
+++ b/app/controllers/projects/templates_controller.rb
@@ -24,10 +24,8 @@ class Projects::TemplatesController < Projects::ApplicationController
   end
 
   def names
-    templates = @template_type.dropdown_names(project)
-
     respond_to do |format|
-      format.json { render json: templates }
+      format.json { render json: TemplateFinder.all_template_names_array(project, params[:template_type].to_s.pluralize) }
     end
   end