Add latest changes from gitlab-org/gitlab@14-7-stable-eev14.7.0-rc42

13 files changed, 123 insertions, 41 deletions

diff --git a/app/models/concerns/ci/contextable.rb b/app/models/concerns/ci/contextable.rb
index 12ddbc2cc40..ed3b422251f 100644
--- a/app/models/concerns/ci/contextable.rb
+++ b/app/models/concerns/ci/contextable.rb
@@ -13,6 +13,8 @@ module Ci
       track_duration do
         variables = pipeline.variables_builder.scoped_variables(self, environment: environment, dependencies: dependencies)
 
+        next variables if pipeline.use_variables_builder_definitions?
+
         variables.concat(project.predefined_variables)
         variables.concat(pipeline.predefined_variables)
         variables.concat(runner.predefined_variables) if runnable? && runner
@@ -60,49 +62,27 @@ module Ci
     end
 
     def user_variables
-      Gitlab::Ci::Variables::Collection.new.tap do |variables|
-        break variables if user.blank?
-
-        variables.append(key: 'GITLAB_USER_ID', value: user.id.to_s)
-        variables.append(key: 'GITLAB_USER_EMAIL', value: user.email)
-        variables.append(key: 'GITLAB_USER_LOGIN', value: user.username)
-        variables.append(key: 'GITLAB_USER_NAME', value: user.name)
-      end
+      pipeline.variables_builder.user_variables(user)
     end
 
     def kubernetes_variables
-      ::Gitlab::Ci::Variables::Collection.new.tap do |collection|
-        # Should get merged with the cluster kubeconfig in deployment_variables, see
-        # https://gitlab.com/gitlab-org/gitlab/-/issues/335089
-        template = ::Ci::GenerateKubeconfigService.new(self).execute
-
-        if template.valid?
-          collection.append(key: 'KUBECONFIG', value: template.to_yaml, public: false, file: true)
-        end
-      end
+      pipeline.variables_builder.kubernetes_variables(self)
     end
 
     def deployment_variables(environment:)
-      return [] unless environment
-
-      project.deployment_variables(
-        environment: environment,
-        kubernetes_namespace: expanded_kubernetes_namespace
-      )
+      pipeline.variables_builder.deployment_variables(job: self, environment: environment)
     end
 
     def secret_instance_variables
-      project.ci_instance_variables_for(ref: git_ref)
+      pipeline.variables_builder.secret_instance_variables(ref: git_ref)
     end
 
     def secret_group_variables(environment: expanded_environment_name)
-      return [] unless project.group
-
-      project.group.ci_variables_for(git_ref, project, environment: environment)
+      pipeline.variables_builder.secret_group_variables(environment: environment, ref: git_ref)
     end
 
     def secret_project_variables(environment: expanded_environment_name)
-      project.ci_variables_for(ref: git_ref, environment: environment)
+      pipeline.variables_builder.secret_project_variables(environment: environment, ref: git_ref)
     end
   end
 end
diff --git a/app/models/concerns/ci/metadatable.rb b/app/models/concerns/ci/metadatable.rb
index 611b27c722b..aa9669ee208 100644
--- a/app/models/concerns/ci/metadatable.rb
+++ b/app/models/concerns/ci/metadatable.rb
@@ -18,13 +18,19 @@ module Ci
 
       delegate :timeout, to: :metadata, prefix: true, allow_nil: true
       delegate :interruptible, to: :metadata, prefix: false, allow_nil: true
-      delegate :has_exposed_artifacts?, to: :metadata, prefix: false, allow_nil: true
       delegate :environment_auto_stop_in, to: :metadata, prefix: false, allow_nil: true
       delegate :set_cancel_gracefully, to: :metadata, prefix: false, allow_nil: false
-      delegate :cancel_gracefully?, to: :metadata, prefix: false, allow_nil: false
       before_create :ensure_metadata
     end
 
+    def has_exposed_artifacts?
+      !!metadata&.has_exposed_artifacts?
+    end
+
+    def cancel_gracefully?
+      !!metadata&.cancel_gracefully?
+    end
+
     def ensure_metadata
       metadata || build_metadata(project: project)
     end
diff --git a/app/models/concerns/forced_email_confirmation.rb b/app/models/concerns/forced_email_confirmation.rb
new file mode 100644
index 00000000000..649400184e5
--- /dev/null
+++ b/app/models/concerns/forced_email_confirmation.rb
@@ -0,0 +1,26 @@
+# frozen_string_literal: true
+
+module ForcedEmailConfirmation
+  extend ActiveSupport::Concern
+
+  included do
+    attr_accessor :skip_confirmation_period_expiry_check
+  end
+
+  def force_confirm(args = {})
+    self.skip_confirmation_period_expiry_check = true
+    confirm(args)
+  ensure
+    self.skip_confirmation_period_expiry_check = nil
+  end
+
+  protected
+
+  # Override, from Devise::Models::Confirmable
+  # Link: https://github.com/heartcombo/devise/blob/main/lib/devise/models/confirmable.rb
+  def confirmation_period_expired?
+    return false if skip_confirmation_period_expiry_check
+
+    super
+  end
+end
diff --git a/app/models/concerns/has_wiki.rb b/app/models/concerns/has_wiki.rb
index df7bbe4dc08..89bcabafb84 100644
--- a/app/models/concerns/has_wiki.rb
+++ b/app/models/concerns/has_wiki.rb
@@ -17,7 +17,7 @@ module HasWiki
 
   def wiki
     strong_memoize(:wiki) do
-      Wiki.for_container(self, self.default_owner)
+      Wiki.for_container(self, self.first_owner)
     end
   end
 
diff --git a/app/models/concerns/import_state/sidekiq_job_tracker.rb b/app/models/concerns/import_state/sidekiq_job_tracker.rb
index 340bf4279bc..b7d0ed0f51b 100644
--- a/app/models/concerns/import_state/sidekiq_job_tracker.rb
+++ b/app/models/concerns/import_state/sidekiq_job_tracker.rb
@@ -15,7 +15,7 @@ module ImportState
       def refresh_jid_expiration
         return unless jid
 
-        Gitlab::SidekiqStatus.set(jid, Gitlab::Import::StuckImportJob::IMPORT_JOBS_EXPIRATION, value: 2)
+        Gitlab::SidekiqStatus.set(jid, Gitlab::Import::StuckImportJob::IMPORT_JOBS_EXPIRATION)
       end
 
       def self.jid_by(project_id:, status:)
diff --git a/app/models/concerns/incident_management/escalatable.rb b/app/models/concerns/incident_management/escalatable.rb
index 81eef50603a..a9e4a066e0e 100644
--- a/app/models/concerns/incident_management/escalatable.rb
+++ b/app/models/concerns/incident_management/escalatable.rb
@@ -27,6 +27,8 @@ module IncidentManagement
       ignored: 'No action will be taken'
     }.freeze
 
+    OPEN_STATUSES = [:triggered, :acknowledged].freeze
+
     included do
       validates :status, presence: true
 
@@ -34,6 +36,7 @@ module IncidentManagement
       # Descending sort order sorts statuses: Triggered > Acknowledged > Resolved > Ignored
       # https://gitlab.com/gitlab-org/gitlab/-/issues/221242#what-is-the-expected-correct-behavior
       scope :order_status, -> (sort_order) { order(status: sort_order == :asc ? :desc : :asc) }
+      scope :open, -> { with_status(OPEN_STATUSES) }
 
       state_machine :status, initial: :triggered do
         state :triggered, value: STATUSES[:triggered]
@@ -89,6 +92,10 @@ module IncidentManagement
           @status_names ||= state_machine_statuses.keys
         end
 
+        def open_status?(status)
+          OPEN_STATUSES.include?(status)
+        end
+
         private
 
         def state_machine_statuses
@@ -99,6 +106,10 @@ module IncidentManagement
       def status_event_for(status)
         self.class.state_machines[:status].events.transitions_for(self, to: status.to_s.to_sym).first&.event
       end
+
+      def open?
+        self.class.open_status?(status_name)
+      end
     end
   end
 end
diff --git a/app/models/concerns/packages/debian/distribution.rb b/app/models/concerns/packages/debian/distribution.rb
index ff52769fce8..2d46889ce6a 100644
--- a/app/models/concerns/packages/debian/distribution.rb
+++ b/app/models/concerns/packages/debian/distribution.rb
@@ -96,6 +96,15 @@ module Packages
           architectures.pluck(:name).sort
         end
 
+        def package_files
+          if Feature.enabled?(:packages_installable_package_files, default_enabled: :yaml)
+            ::Packages::PackageFile.installable
+                                   .for_package_ids(packages.select(:id))
+          else
+            ::Packages::PackageFile.for_package_ids(packages.select(:id))
+          end
+        end
+
         private
 
         def unique_codename_and_suite
diff --git a/app/models/concerns/packages/destructible.rb b/app/models/concerns/packages/destructible.rb
new file mode 100644
index 00000000000..a3b7d8580c1
--- /dev/null
+++ b/app/models/concerns/packages/destructible.rb
@@ -0,0 +1,15 @@
+# frozen_string_literal: true
+
+module Packages
+  module Destructible
+    extend ActiveSupport::Concern
+
+    class_methods do
+      def next_pending_destruction(order_by: nil)
+        set = pending_destruction.limit(1).lock('FOR UPDATE SKIP LOCKED')
+        set = set.order(order_by) if order_by
+        set.take
+      end
+    end
+  end
+end
diff --git a/app/models/concerns/packages/installable.rb b/app/models/concerns/packages/installable.rb
new file mode 100644
index 00000000000..e9303e55412
--- /dev/null
+++ b/app/models/concerns/packages/installable.rb
@@ -0,0 +1,16 @@
+# frozen_string_literal: true
+
+module Packages
+  # This module requires a status column.
+  # It also requires a constant INSTALLABLE_STATUSES. This should be
+  # an array that defines which values of the status column are
+  # considered as installable.
+  module Installable
+    extend ActiveSupport::Concern
+
+    included do
+      scope :with_status, ->(status) { where(status: status) }
+      scope :installable, -> { with_status(const_get(:INSTALLABLE_STATUSES, false)) }
+    end
+  end
+end
diff --git a/app/models/concerns/participable.rb b/app/models/concerns/participable.rb
index 1663aa6c886..20743ebcb52 100644
--- a/app/models/concerns/participable.rb
+++ b/app/models/concerns/participable.rb
@@ -64,8 +64,6 @@ module Participable
   #
   # Returns an Array of User instances.
   def visible_participants(user)
-    return participants(user) unless Feature.enabled?(:verify_participants_access, project, default_enabled: :yaml)
-
     filter_by_ability(raw_participants(user, verify_access: true))
   end
 
diff --git a/app/models/concerns/routable.rb b/app/models/concerns/routable.rb
index f382b3624ed..2cf95ac0dae 100644
--- a/app/models/concerns/routable.rb
+++ b/app/models/concerns/routable.rb
@@ -190,5 +190,10 @@ module Routable
     route || build_route(source: self)
     route.path = build_full_path
     route.name = build_full_name
+    route.namespace = if is_a?(Namespace)
+                        self
+                      elsif is_a?(Project)
+                        self.project_namespace
+                      end
   end
 end
diff --git a/app/models/concerns/runner_token_expiration_interval.rb b/app/models/concerns/runner_token_expiration_interval.rb
new file mode 100644
index 00000000000..f84e69e7b7d
--- /dev/null
+++ b/app/models/concerns/runner_token_expiration_interval.rb
@@ -0,0 +1,22 @@
+# frozen_string_literal: true
+
+module RunnerTokenExpirationInterval
+  extend ActiveSupport::Concern
+
+  def enforced_runner_token_expiration_interval_human_readable
+    interval = enforced_runner_token_expiration_interval
+    ChronicDuration.output(interval, format: :short) if interval
+  end
+
+  def effective_runner_token_expiration_interval
+    [
+      enforced_runner_token_expiration_interval,
+      runner_token_expiration_interval&.seconds
+    ].compact.min
+  end
+
+  def effective_runner_token_expiration_interval_human_readable
+    interval = effective_runner_token_expiration_interval
+    ChronicDuration.output(interval, format: :short) if interval
+  end
+end
diff --git a/app/models/concerns/ttl_expirable.rb b/app/models/concerns/ttl_expirable.rb
index 6d89521255c..1c2147beedd 100644
--- a/app/models/concerns/ttl_expirable.rb
+++ b/app/models/concerns/ttl_expirable.rb
@@ -7,16 +7,10 @@ module TtlExpirable
     validates :status, presence: true
     default_value_for :read_at, Time.zone.now
 
-    enum status: { default: 0, expired: 1, processing: 2, error: 3 }
+    enum status: { default: 0, pending_destruction: 1, processing: 2, error: 3 }
 
     scope :read_before, ->(number_of_days) { where("read_at <= ?", Time.zone.now - number_of_days.days) }
     scope :active, -> { where(status: :default) }
-
-    scope :lock_next_by, ->(sort) do
-      order(sort)
-        .limit(1)
-        .lock('FOR UPDATE SKIP LOCKED')
-    end
   end
 
   def read!