fix conflictdocs-refactor-dev-guides

24 files changed, 863 insertions, 166 deletions

diff --git a/lib/api/access_requests.rb b/lib/api/access_requests.rb
index 60ae5e6b9a2..ae13c248171 100644
--- a/lib/api/access_requests.rb
+++ b/lib/api/access_requests.rb
@@ -53,7 +53,10 @@ module API
         put ':id/access_requests/:user_id/approve' do
           source = find_source(source_type, params[:id])
 
-          member = ::Members::ApproveAccessRequestService.new(source, current_user, declared_params).execute
+          access_requester = source.requesters.find_by!(user_id: params[:user_id])
+          member = ::Members::ApproveAccessRequestService
+            .new(current_user, declared_params)
+            .execute(access_requester)
 
           status :created
           present member, with: Entities::Member
@@ -70,8 +73,7 @@ module API
           member = source.requesters.find_by!(user_id: params[:user_id])
 
           destroy_conditionally!(member) do
-            ::Members::DestroyService.new(source, current_user, params)
-              .execute(:requesters)
+            ::Members::DestroyService.new(current_user).execute(member)
           end
         end
       end
diff --git a/lib/api/api.rb b/lib/api/api.rb
index 754549f72f0..62ffebeacb0 100644
--- a/lib/api/api.rb
+++ b/lib/api/api.rb
@@ -108,6 +108,7 @@ module API
     mount ::API::AccessRequests
     mount ::API::Applications
     mount ::API::AwardEmoji
+    mount ::API::Badges
     mount ::API::Boards
     mount ::API::Branches
     mount ::API::BroadcastMessages
@@ -120,6 +121,7 @@ module API
     mount ::API::Events
     mount ::API::Features
     mount ::API::Files
+    mount ::API::GroupBoards
     mount ::API::Groups
     mount ::API::GroupMilestones
     mount ::API::Internal
@@ -134,10 +136,12 @@ module API
     mount ::API::MergeRequests
     mount ::API::Namespaces
     mount ::API::Notes
+    mount ::API::Discussions
     mount ::API::NotificationSettings
     mount ::API::PagesDomains
     mount ::API::Pipelines
     mount ::API::PipelineSchedules
+    mount ::API::ProjectExport
     mount ::API::ProjectImport
     mount ::API::ProjectHooks
     mount ::API::Projects
diff --git a/lib/api/badges.rb b/lib/api/badges.rb
new file mode 100644
index 00000000000..334948b2995
--- /dev/null
+++ b/lib/api/badges.rb
@@ -0,0 +1,134 @@
+module API
+  class Badges < Grape::API
+    include PaginationParams
+
+    before { authenticate_non_get! }
+
+    helpers ::API::Helpers::BadgesHelpers
+
+    helpers do
+      def find_source_if_admin(source_type)
+        source = find_source(source_type, params[:id])
+
+        authorize_admin_source!(source_type, source)
+
+        source
+      end
+    end
+
+    %w[group project].each do |source_type|
+      params do
+        requires :id, type: String, desc: "The ID of a #{source_type}"
+      end
+      resource source_type.pluralize, requirements: API::PROJECT_ENDPOINT_REQUIREMENTS do
+        desc "Gets a list of #{source_type} badges viewable by the authenticated user." do
+          detail 'This feature was introduced in GitLab 10.6.'
+          success Entities::Badge
+        end
+        params do
+          use :pagination
+        end
+        get ":id/badges" do
+          source = find_source(source_type, params[:id])
+
+          present_badges(source, paginate(source.badges))
+        end
+
+        desc "Preview a badge from a #{source_type}." do
+          detail 'This feature was introduced in GitLab 10.6.'
+          success Entities::BasicBadgeDetails
+        end
+        params do
+          requires :link_url, type: String, desc: 'URL of the badge link'
+          requires :image_url, type: String, desc: 'URL of the badge image'
+        end
+        get ":id/badges/render" do
+          authenticate!
+
+          source = find_source_if_admin(source_type)
+
+          badge = ::Badges::BuildService.new(declared_params(include_missing: false))
+                                        .execute(source)
+
+          if badge.valid?
+            present_badges(source, badge, with: Entities::BasicBadgeDetails)
+          else
+            render_validation_error!(badge)
+          end
+        end
+
+        desc "Gets a badge of a #{source_type}." do
+          detail 'This feature was introduced in GitLab 10.6.'
+          success Entities::Badge
+        end
+        params do
+          requires :badge_id, type: Integer, desc: 'The badge ID'
+        end
+        get ":id/badges/:badge_id" do
+          source = find_source(source_type, params[:id])
+          badge = find_badge(source)
+
+          present_badges(source, badge)
+        end
+
+        desc "Adds a badge to a #{source_type}." do
+          detail 'This feature was introduced in GitLab 10.6.'
+          success Entities::Badge
+        end
+        params do
+          requires :link_url, type: String, desc: 'URL of the badge link'
+          requires :image_url, type: String, desc: 'URL of the badge image'
+        end
+        post ":id/badges" do
+          source = find_source_if_admin(source_type)
+
+          badge = ::Badges::CreateService.new(declared_params(include_missing: false)).execute(source)
+
+          if badge.persisted?
+            present_badges(source, badge)
+          else
+            render_validation_error!(badge)
+          end
+        end
+
+        desc "Updates a badge of a #{source_type}." do
+          detail 'This feature was introduced in GitLab 10.6.'
+          success Entities::Badge
+        end
+        params do
+          optional :link_url, type: String, desc: 'URL of the badge link'
+          optional :image_url, type: String, desc: 'URL of the badge image'
+        end
+        put ":id/badges/:badge_id" do
+          source = find_source_if_admin(source_type)
+
+          badge = ::Badges::UpdateService.new(declared_params(include_missing: false))
+                                         .execute(find_badge(source))
+
+          if badge.valid?
+            present_badges(source, badge)
+          else
+            render_validation_error!(badge)
+          end
+        end
+
+        desc 'Removes a badge from a project or group.' do
+          detail 'This feature was introduced in GitLab 10.6.'
+        end
+        params do
+          requires :badge_id, type: Integer, desc: 'The badge ID'
+        end
+        delete ":id/badges/:badge_id" do
+          source = find_source_if_admin(source_type)
+          badge = find_badge(source)
+
+          if badge.is_a?(GroupBadge) && source.is_a?(Project)
+            error!('To delete a Group badge please use the Group endpoint', 403)
+          end
+
+          destroy_conditionally!(badge)
+        end
+      end
+    end
+  end
+end
diff --git a/lib/api/branches.rb b/lib/api/branches.rb
index 1794207e29b..13cfba728fa 100644
--- a/lib/api/branches.rb
+++ b/lib/api/branches.rb
@@ -16,6 +16,10 @@ module API
           render_api_error!('The branch refname is invalid', 400)
         end
       end
+
+      params :filter_params do
+        optional :search, type: String, desc: 'Return list of branches matching the search criteria'
+      end
     end
 
     params do
@@ -27,15 +31,23 @@ module API
       end
       params do
         use :pagination
+        use :filter_params
       end
       get ':id/repository/branches' do
         Gitlab::QueryLimiting.whitelist('https://gitlab.com/gitlab-org/gitlab-ce/issues/42329')
 
         repository = user_project.repository
-        branches = ::Kaminari.paginate_array(repository.branches.sort_by(&:name))
+
+        branches = BranchesFinder.new(repository, declared_params(include_missing: false)).execute
+
         merged_branch_names = repository.merged_branch_names(branches.map(&:name))
 
-        present paginate(branches), with: Entities::Branch, project: user_project, merged_branch_names: merged_branch_names
+        present(
+          paginate(::Kaminari.paginate_array(branches)),
+          with: Entities::Branch,
+          project: user_project,
+          merged_branch_names: merged_branch_names
+        )
       end
 
       resource ':id/repository/branches/:branch', requirements: BRANCH_ENDPOINT_REQUIREMENTS do
diff --git a/lib/api/commits.rb b/lib/api/commits.rb
index 3d6e78d2d80..982f45425a3 100644
--- a/lib/api/commits.rb
+++ b/lib/api/commits.rb
@@ -18,25 +18,28 @@ module API
         optional :since,    type: DateTime, desc: 'Only commits after or on this date will be returned'
         optional :until,    type: DateTime, desc: 'Only commits before or on this date will be returned'
         optional :path,     type: String, desc: 'The file path'
+        optional :all,      type: Boolean, desc: 'Every commit will be returned'
         use :pagination
       end
       get ':id/repository/commits' do
         path   = params[:path]
         before = params[:until]
         after  = params[:since]
-        ref    = params[:ref_name] || user_project.try(:default_branch) || 'master'
+        ref    = params[:ref_name] || user_project.try(:default_branch) || 'master' unless params[:all]
         offset = (params[:page] - 1) * params[:per_page]
+        all    = params[:all]
 
         commits = user_project.repository.commits(ref,
                                                   path: path,
                                                   limit: params[:per_page],
                                                   offset: offset,
                                                   before: before,
-                                                  after: after)
+                                                  after: after,
+                                                  all: all)
 
         commit_count =
-          if path || before || after
-            user_project.repository.count_commits(ref: ref, path: path, before: before, after: after)
+          if all || path || before || after
+            user_project.repository.count_commits(ref: ref, path: path, before: before, after: after, all: all)
           else
             # Cacheable commit count.
             user_project.repository.commit_count_for_ref(ref)
diff --git a/lib/api/discussions.rb b/lib/api/discussions.rb
new file mode 100644
index 00000000000..6abd575b6ad
--- /dev/null
+++ b/lib/api/discussions.rb
@@ -0,0 +1,195 @@
+module API
+  class Discussions < Grape::API
+    include PaginationParams
+    helpers ::API::Helpers::NotesHelpers
+
+    before { authenticate! }
+
+    NOTEABLE_TYPES = [Issue, Snippet].freeze
+
+    NOTEABLE_TYPES.each do |noteable_type|
+      parent_type = noteable_type.parent_class.to_s.underscore
+      noteables_str = noteable_type.to_s.underscore.pluralize
+
+      params do
+        requires :id, type: String, desc: "The ID of a #{parent_type}"
+      end
+      resource parent_type.pluralize.to_sym, requirements: API::PROJECT_ENDPOINT_REQUIREMENTS do
+        desc "Get a list of #{noteable_type.to_s.downcase} discussions" do
+          success Entities::Discussion
+        end
+        params do
+          requires :noteable_id, type: Integer, desc: 'The ID of the noteable'
+          use :pagination
+        end
+        get ":id/#{noteables_str}/:noteable_id/discussions" do
+          noteable = find_noteable(parent_type, noteables_str, params[:noteable_id])
+
+          return not_found!("Discussions") unless can?(current_user, noteable_read_ability_name(noteable), noteable)
+
+          notes = noteable.notes
+            .inc_relations_for_view
+            .includes(:noteable)
+            .fresh
+
+          notes = notes.reject { |n| n.cross_reference_not_visible_for?(current_user) }
+          discussions = Kaminari.paginate_array(Discussion.build_collection(notes, noteable))
+
+          present paginate(discussions), with: Entities::Discussion
+        end
+
+        desc "Get a single #{noteable_type.to_s.downcase} discussion" do
+          success Entities::Discussion
+        end
+        params do
+          requires :discussion_id, type: String, desc: 'The ID of a discussion'
+          requires :noteable_id, type: Integer, desc: 'The ID of the noteable'
+        end
+        get ":id/#{noteables_str}/:noteable_id/discussions/:discussion_id" do
+          noteable = find_noteable(parent_type, noteables_str, params[:noteable_id])
+          notes = readable_discussion_notes(noteable, params[:discussion_id])
+
+          if notes.empty? || !can?(current_user, noteable_read_ability_name(noteable), noteable)
+            return not_found!("Discussion")
+          end
+
+          discussion = Discussion.build(notes, noteable)
+
+          present discussion, with: Entities::Discussion
+        end
+
+        desc "Create a new #{noteable_type.to_s.downcase} discussion" do
+          success Entities::Discussion
+        end
+        params do
+          requires :noteable_id, type: Integer, desc: 'The ID of the noteable'
+          requires :body, type: String, desc: 'The content of a note'
+          optional :created_at, type: String, desc: 'The creation date of the note'
+        end
+        post ":id/#{noteables_str}/:noteable_id/discussions" do
+          noteable = find_noteable(parent_type, noteables_str, params[:noteable_id])
+
+          opts = {
+            note: params[:body],
+            created_at: params[:created_at],
+            type: 'DiscussionNote',
+            noteable_type: noteables_str.classify,
+            noteable_id: noteable.id
+          }
+
+          note = create_note(noteable, opts)
+
+          if note.valid?
+            present note.discussion, with: Entities::Discussion
+          else
+            bad_request!("Note #{note.errors.messages}")
+          end
+        end
+
+        desc "Get comments in a single #{noteable_type.to_s.downcase} discussion" do
+          success Entities::Discussion
+        end
+        params do
+          requires :discussion_id, type: String, desc: 'The ID of a discussion'
+          requires :noteable_id, type: Integer, desc: 'The ID of the noteable'
+        end
+        get ":id/#{noteables_str}/:noteable_id/discussions/:discussion_id/notes" do
+          noteable = find_noteable(parent_type, noteables_str, params[:noteable_id])
+          notes = readable_discussion_notes(noteable, params[:discussion_id])
+
+          if notes.empty? || !can?(current_user, noteable_read_ability_name(noteable), noteable)
+            return not_found!("Notes")
+          end
+
+          present notes, with: Entities::Note
+        end
+
+        desc "Add a comment to a #{noteable_type.to_s.downcase} discussion" do
+          success Entities::Note
+        end
+        params do
+          requires :noteable_id, type: Integer, desc: 'The ID of the noteable'
+          requires :discussion_id, type: String, desc: 'The ID of a discussion'
+          requires :body, type: String, desc: 'The content of a note'
+          optional :created_at, type: String, desc: 'The creation date of the note'
+        end
+        post ":id/#{noteables_str}/:noteable_id/discussions/:discussion_id/notes" do
+          noteable = find_noteable(parent_type, noteables_str, params[:noteable_id])
+          notes = readable_discussion_notes(noteable, params[:discussion_id])
+
+          return not_found!("Discussion") if notes.empty?
+          return bad_request!("Discussion is an individual note.") unless notes.first.part_of_discussion?
+
+          opts = {
+            note: params[:body],
+            type: 'DiscussionNote',
+            in_reply_to_discussion_id: params[:discussion_id],
+            created_at: params[:created_at]
+          }
+          note = create_note(noteable, opts)
+
+          if note.valid?
+            present note, with: Entities::Note
+          else
+            bad_request!("Note #{note.errors.messages}")
+          end
+        end
+
+        desc "Get a comment in a #{noteable_type.to_s.downcase} discussion" do
+          success Entities::Note
+        end
+        params do
+          requires :noteable_id, type: Integer, desc: 'The ID of the noteable'
+          requires :discussion_id, type: String, desc: 'The ID of a discussion'
+          requires :note_id, type: Integer, desc: 'The ID of a note'
+        end
+        get ":id/#{noteables_str}/:noteable_id/discussions/:discussion_id/notes/:note_id" do
+          noteable = find_noteable(parent_type, noteables_str, params[:noteable_id])
+
+          get_note(noteable, params[:note_id])
+        end
+
+        desc "Edit a comment in a #{noteable_type.to_s.downcase} discussion" do
+          success Entities::Note
+        end
+        params do
+          requires :noteable_id, type: Integer, desc: 'The ID of the noteable'
+          requires :discussion_id, type: String, desc: 'The ID of a discussion'
+          requires :note_id, type: Integer, desc: 'The ID of a note'
+          requires :body, type: String, desc: 'The content of a note'
+        end
+        put ":id/#{noteables_str}/:noteable_id/discussions/:discussion_id/notes/:note_id" do
+          noteable = find_noteable(parent_type, noteables_str, params[:noteable_id])
+
+          update_note(noteable, params[:note_id])
+        end
+
+        desc "Delete a comment in a #{noteable_type.to_s.downcase} discussion" do
+          success Entities::Note
+        end
+        params do
+          requires :noteable_id, type: Integer, desc: 'The ID of the noteable'
+          requires :discussion_id, type: String, desc: 'The ID of a discussion'
+          requires :note_id, type: Integer, desc: 'The ID of a note'
+        end
+        delete ":id/#{noteables_str}/:noteable_id/discussions/:discussion_id/notes/:note_id" do
+          noteable = find_noteable(parent_type, noteables_str, params[:noteable_id])
+
+          delete_note(noteable, params[:note_id])
+        end
+      end
+    end
+
+    helpers do
+      def readable_discussion_notes(noteable, discussion_id)
+        notes = noteable.notes
+          .where(discussion_id: discussion_id)
+          .inc_relations_for_view
+          .includes(:noteable)
+          .fresh
+
+        notes.reject { |n| n.cross_reference_not_visible_for?(current_user) }
+      end
+    end
+  end
+end
diff --git a/lib/api/entities.rb b/lib/api/entities.rb
index 167878ba600..16147ee90c9 100644
--- a/lib/api/entities.rb
+++ b/lib/api/entities.rb
@@ -71,7 +71,7 @@ module API
     end
 
     class ProjectHook < Hook
-      expose :project_id, :issues_events
+      expose :project_id, :issues_events, :confidential_issues_events
       expose :note_events, :pipeline_events, :wiki_page_events
       expose :job_events
     end
@@ -91,6 +91,21 @@ module API
       expose :created_at
     end
 
+    class ProjectExportStatus < ProjectIdentity
+      include ::API::Helpers::RelatedResourcesHelpers
+
+      expose :export_status
+      expose :_links, if: lambda { |project, _options| project.export_status == :finished } do
+        expose :api_url do |project|
+          expose_url(api_v4_projects_export_download_path(id: project.id))
+        end
+
+        expose :web_url do |project|
+          Gitlab::Routing.url_helpers.download_export_project_url(project)
+        end
+      end
+    end
+
     class ProjectImportStatus < ProjectIdentity
       expose :import_status
 
@@ -481,6 +496,10 @@ module API
       expose :id
     end
 
+    class PipelineBasic < Grape::Entity
+      expose :id, :sha, :ref, :status
+    end
+
     class MergeRequestSimple < ProjectEntity
       expose :title
       expose :web_url do |merge_request, options|
@@ -528,6 +547,7 @@ module API
       expose :discussion_locked
       expose :should_remove_source_branch?, as: :should_remove_source_branch
       expose :force_remove_source_branch?, as: :force_remove_source_branch
+      expose :allow_maintainer_to_push, if: -> (merge_request, _) { merge_request.for_fork? }
 
       expose :web_url do |merge_request, options|
         Gitlab::UrlBuilder.build(merge_request)
@@ -546,6 +566,42 @@ module API
       expose :changes_count do |merge_request, _options|
         merge_request.merge_request_diff.real_size
       end
+
+      expose :merged_by, using: Entities::UserBasic do |merge_request, _options|
+        merge_request.metrics&.merged_by
+      end
+
+      expose :merged_at do |merge_request, _options|
+        merge_request.metrics&.merged_at
+      end
+
+      expose :closed_by, using: Entities::UserBasic do |merge_request, _options|
+        merge_request.metrics&.latest_closed_by
+      end
+
+      expose :closed_at do |merge_request, _options|
+        merge_request.metrics&.latest_closed_at
+      end
+
+      expose :latest_build_started_at, if: -> (_, options) { build_available?(options) } do |merge_request, _options|
+        merge_request.metrics&.latest_build_started_at
+      end
+
+      expose :latest_build_finished_at, if: -> (_, options) { build_available?(options) } do |merge_request, _options|
+        merge_request.metrics&.latest_build_finished_at
+      end
+
+      expose :first_deployed_to_production_at, if: -> (_, options) { build_available?(options) } do |merge_request, _options|
+        merge_request.metrics&.first_deployed_to_production_at
+      end
+
+      expose :pipeline, using: Entities::PipelineBasic, if: -> (_, options) { build_available?(options) } do |merge_request, _options|
+        merge_request.metrics&.pipeline
+      end
+
+      def build_available?(options)
+        options[:project]&.feature_available?(:builds, options[:current_user])
+      end
     end
 
     class MergeRequestChanges < MergeRequest
@@ -589,6 +645,7 @@ module API
       NOTEABLE_TYPES_WITH_IID = %w(Issue MergeRequest).freeze
 
       expose :id
+      expose :type
       expose :note, as: :body
       expose :attachment_identifier, as: :attachment
       expose :author, using: Entities::UserBasic
@@ -600,6 +657,12 @@ module API
       expose(:noteable_iid) { |note| note.noteable.iid if NOTEABLE_TYPES_WITH_IID.include?(note.noteable_type) }
     end
 
+    class Discussion < Grape::Entity
+      expose :id
+      expose :individual_note?, as: :individual_note
+      expose :notes, using: Entities::Note
+    end
+
     class AwardEmoji < Grape::Entity
       expose :id
       expose :name
@@ -909,10 +972,6 @@ module API
       expose :filename, :size
     end
 
-    class PipelineBasic < Grape::Entity
-      expose :id, :sha, :ref, :status
-    end
-
     class JobBasic < Grape::Entity
       expose :id, :status, :stage, :name, :ref, :tag, :coverage
       expose :created_at, :started_at, :finished_at
@@ -1199,5 +1258,23 @@ module API
       expose :startline
       expose :project_id
     end
+
+    class BasicBadgeDetails < Grape::Entity
+      expose :link_url
+      expose :image_url
+      expose :rendered_link_url do |badge, options|
+        badge.rendered_link_url(options.fetch(:project, nil))
+      end
+      expose :rendered_image_url do |badge, options|
+        badge.rendered_image_url(options.fetch(:project, nil))
+      end
+    end
+
+    class Badge < BasicBadgeDetails
+      expose :id
+      expose :kind do |badge|
+        badge.type == 'ProjectBadge' ? 'project' : 'group'
+      end
+    end
   end
 end
diff --git a/lib/api/group_boards.rb b/lib/api/group_boards.rb
new file mode 100644
index 00000000000..aa9fff25fc8
--- /dev/null
+++ b/lib/api/group_boards.rb
@@ -0,0 +1,117 @@
+module API
+  class GroupBoards < Grape::API
+    include BoardsResponses
+    include PaginationParams
+
+    before do
+      authenticate!
+    end
+
+    helpers do
+      def board_parent
+        user_group
+      end
+    end
+
+    params do
+      requires :id, type: String, desc: 'The ID of a group'
+    end
+
+    resource :groups, requirements: API::PROJECT_ENDPOINT_REQUIREMENTS do
+      segment ':id/boards' do
+        desc 'Find a group board' do
+          detail 'This feature was introduced in 10.6'
+          success ::API::Entities::Board
+        end
+        get '/:board_id' do
+          present board, with: ::API::Entities::Board
+        end
+
+        desc 'Get all group boards' do
+          detail 'This feature was introduced in 10.6'
+          success Entities::Board
+        end
+        params do
+          use :pagination
+        end
+        get '/' do
+          present paginate(board_parent.boards), with: Entities::Board
+        end
+      end
+
+      params do
+        requires :board_id, type: Integer, desc: 'The ID of a board'
+      end
+      segment ':id/boards/:board_id' do
+        desc 'Get the lists of a group board' do
+          detail 'Does not include backlog and closed lists. This feature was introduced in 10.6'
+          success Entities::List
+        end
+        params do
+          use :pagination
+        end
+        get '/lists' do
+          present paginate(board_lists), with: Entities::List
+        end
+
+        desc 'Get a list of a group board' do
+          detail 'This feature was introduced in 10.6'
+          success Entities::List
+        end
+        params do
+          requires :list_id, type: Integer, desc: 'The ID of a list'
+        end
+        get '/lists/:list_id' do
+          present board_lists.find(params[:list_id]), with: Entities::List
+        end
+
+        desc 'Create a new board list' do
+          detail 'This feature was introduced in 10.6'
+          success Entities::List
+        end
+        params do
+          requires :label_id, type: Integer, desc: 'The ID of an existing label'
+        end
+        post '/lists' do
+          unless available_labels_for(board_parent).exists?(params[:label_id])
+            render_api_error!({ error: 'Label not found!' }, 400)
+          end
+
+          authorize!(:admin_list, user_group)
+
+          create_list
+        end
+
+        desc 'Moves a board list to a new position' do
+          detail 'This feature was introduced in 10.6'
+          success Entities::List
+        end
+        params do
+          requires :list_id,  type: Integer, desc: 'The ID of a list'
+          requires :position, type: Integer, desc: 'The position of the list'
+        end
+        put '/lists/:list_id' do
+          list = board_lists.find(params[:list_id])
+
+          authorize!(:admin_list, user_group)
+
+          move_list(list)
+        end
+
+        desc 'Delete a board list' do
+          detail 'This feature was introduced in 10.6'
+          success Entities::List
+        end
+        params do
+          requires :list_id, type: Integer, desc: 'The ID of a board list'
+        end
+        delete "/lists/:list_id" do
+          authorize!(:admin_list, user_group)
+          list = board_lists.find(params[:list_id])
+
+          destroy_list(list)
+        end
+      end
+    end
+  end
+end
diff --git a/lib/api/helpers/badges_helpers.rb b/lib/api/helpers/badges_helpers.rb
new file mode 100644
index 00000000000..1f8afbf3c90
--- /dev/null
+++ b/lib/api/helpers/badges_helpers.rb
@@ -0,0 +1,28 @@
+module API
+  module Helpers
+    module BadgesHelpers
+      include ::API::Helpers::MembersHelpers
+
+      def find_badge(source)
+        source.badges.find(params[:badge_id])
+      end
+
+      def present_badges(source, records, options = {})
+        entity_type = options[:with] || Entities::Badge
+        badge_params = badge_source_params(source).merge(with: entity_type)
+
+        present records, badge_params
+      end
+
+      def badge_source_params(source)
+        project = if source.is_a?(Project)
+                    source
+                  else
+                    GroupProjectsFinder.new(group: source, current_user: current_user).execute.first
+                  end
+
+        { project: project }
+      end
+    end
+  end
+end
diff --git a/lib/api/helpers/internal_helpers.rb b/lib/api/helpers/internal_helpers.rb
index cd59da6fc70..4b564cfdef2 100644
--- a/lib/api/helpers/internal_helpers.rb
+++ b/lib/api/helpers/internal_helpers.rb
@@ -111,13 +111,6 @@ module API
       def gitaly_payload(action)
         return unless %w[git-receive-pack git-upload-pack].include?(action)
 
-        if action == 'git-receive-pack'
-          return unless Gitlab::GitalyClient.feature_enabled?(
-            :ssh_receive_pack,
-            status: Gitlab::GitalyClient::MigrationStatus::OPT_OUT
-          )
-        end
-
         {
           repository: repository.gitaly_repository,
           address: Gitlab::GitalyClient.address(project.repository_storage),
diff --git a/lib/api/helpers/notes_helpers.rb b/lib/api/helpers/notes_helpers.rb
new file mode 100644
index 00000000000..cd91df1ecd8
--- /dev/null
+++ b/lib/api/helpers/notes_helpers.rb
@@ -0,0 +1,76 @@
+module API
+  module Helpers
+    module NotesHelpers
+      def update_note(noteable, note_id)
+        note = noteable.notes.find(params[:note_id])
+
+        authorize! :admin_note, note
+
+        opts = {
+          note: params[:body]
+        }
+        parent = noteable_parent(noteable)
+        project = parent if parent.is_a?(Project)
+
+        note = ::Notes::UpdateService.new(project, current_user, opts).execute(note)
+
+        if note.valid?
+          present note, with: Entities::Note
+        else
+          bad_request!("Failed to save note #{note.errors.messages}")
+        end
+      end
+
+      def delete_note(noteable, note_id)
+        note = noteable.notes.find(note_id)
+
+        authorize! :admin_note, note
+
+        parent = noteable_parent(noteable)
+        project = parent if parent.is_a?(Project)
+        destroy_conditionally!(note) do |note|
+          ::Notes::DestroyService.new(project, current_user).execute(note)
+        end
+      end
+
+      def get_note(noteable, note_id)
+        note = noteable.notes.with_metadata.find(params[:note_id])
+        can_read_note = can?(current_user, noteable_read_ability_name(noteable), noteable) && !note.cross_reference_not_visible_for?(current_user)
+
+        if can_read_note
+          present note, with: Entities::Note
+        else
+          not_found!("Note")
+        end
+      end
+
+      def noteable_read_ability_name(noteable)
+        "read_#{noteable.class.to_s.underscore}".to_sym
+      end
+
+      def find_noteable(parent, noteables_str, noteable_id)
+        public_send("find_#{parent}_#{noteables_str.singularize}", noteable_id) # rubocop:disable GitlabSecurity/PublicSend
+      end
+
+      def noteable_parent(noteable)
+        public_send("user_#{noteable.class.parent_class.to_s.underscore}") # rubocop:disable GitlabSecurity/PublicSend
+      end
+
+      def create_note(noteable, opts)
+        noteables_str = noteable.model_name.to_s.underscore.pluralize
+
+        return not_found!(noteables_str) unless can?(current_user, noteable_read_ability_name(noteable), noteable)
+
+        authorize! :create_note, noteable
+
+        parent = noteable_parent(noteable)
+        if opts[:created_at]
+          opts.delete(:created_at) unless current_user.admin? || parent.owner == current_user
+        end
+
+        project = parent if parent.is_a?(Project)
+        ::Notes::CreateService.new(project, current_user, opts).execute
+      end
+    end
+  end
+end
diff --git a/lib/api/helpers/runner.rb b/lib/api/helpers/runner.rb
index fbe30192a16..35ac0b4cbca 100644
--- a/lib/api/helpers/runner.rb
+++ b/lib/api/helpers/runner.rb
@@ -9,16 +9,22 @@ module API
                                                                   Gitlab::CurrentSettings.runners_registration_token)
       end
 
-      def get_runner_version_from_params
-        return unless params['info'].present?
+      def authenticate_runner!
+        forbidden! unless current_runner
 
-        attributes_for_keys(%w(name version revision platform architecture), params['info'])
+        current_runner
+          .update_cached_info(get_runner_details_from_request)
       end
 
-      def authenticate_runner!
-        forbidden! unless current_runner
+      def get_runner_details_from_request
+        return get_runner_ip unless params['info'].present?
+
+        attributes_for_keys(%w(name version revision platform architecture), params['info'])
+          .merge(get_runner_ip)
+      end
 
-        current_runner.update_cached_info(get_runner_version_from_params)
+      def get_runner_ip
+        { ip_address: request.ip }
       end
 
       def current_runner
diff --git a/lib/api/issues.rb b/lib/api/issues.rb
index b6c278c89d0..f74b3b26802 100644
--- a/lib/api/issues.rb
+++ b/lib/api/issues.rb
@@ -32,6 +32,8 @@ module API
         optional :search, type: String, desc: 'Search issues for text present in the title or description'
         optional :created_after, type: DateTime, desc: 'Return issues created after the specified time'
         optional :created_before, type: DateTime, desc: 'Return issues created before the specified time'
+        optional :updated_after, type: DateTime, desc: 'Return issues updated after the specified time'
+        optional :updated_before, type: DateTime, desc: 'Return issues updated before the specified time'
         optional :author_id, type: Integer, desc: 'Return issues which are authored by the user with the given ID'
         optional :assignee_id, type: Integer, desc: 'Return issues which are assigned to the user with the given ID'
         optional :scope, type: String, values: %w[created-by-me assigned-to-me all],
diff --git a/lib/api/job_artifacts.rb b/lib/api/job_artifacts.rb
index 2a8fa7659bf..47e5eeab31d 100644
--- a/lib/api/job_artifacts.rb
+++ b/lib/api/job_artifacts.rb
@@ -2,20 +2,28 @@ module API
   class JobArtifacts < Grape::API
     before { authenticate_non_get! }
 
+    # EE::API::JobArtifacts would override the following helpers
+    helpers do
+      def authorize_download_artifacts!
+        authorize_read_builds!
+      end
+    end
+
     params do
       requires :id, type: String, desc: 'The ID of a project'
     end
     resource :projects, requirements: API::PROJECT_ENDPOINT_REQUIREMENTS do
-      desc 'Download the artifacts file from a job' do
+      desc 'Download the artifacts archive from a job' do
         detail 'This feature was introduced in GitLab 8.10'
       end
       params do
         requires :ref_name, type: String, desc: 'The ref from repository'
         requires :job,      type: String, desc: 'The name for the job'
       end
+      route_setting :authentication, job_token_allowed: true
       get ':id/jobs/artifacts/:ref_name/download',
         requirements: { ref_name: /.+/ } do
-        authorize_read_builds!
+        authorize_download_artifacts!
 
         builds = user_project.latest_successful_builds_for(params[:ref_name])
         latest_build = builds.find_by!(name: params[:job])
@@ -23,14 +31,15 @@ module API
         present_artifacts!(latest_build.artifacts_file)
       end
 
-      desc 'Download the artifacts file from a job' do
+      desc 'Download the artifacts archive from a job' do
         detail 'This feature was introduced in GitLab 8.5'
       end
       params do
         requires :job_id, type: Integer, desc: 'The ID of a job'
       end
+      route_setting :authentication, job_token_allowed: true
       get ':id/jobs/:job_id/artifacts' do
-        authorize_read_builds!
+        authorize_download_artifacts!
 
         build = find_build!(params[:job_id])
 
diff --git a/lib/api/members.rb b/lib/api/members.rb
index bc1de37284a..8b12986d09e 100644
--- a/lib/api/members.rb
+++ b/lib/api/members.rb
@@ -81,12 +81,16 @@ module API
           source = find_source(source_type, params.delete(:id))
           authorize_admin_source!(source_type, source)
 
-          member = source.members.find_by!(user_id: params.delete(:user_id))
+          member = source.members.find_by!(user_id: params[:user_id])
+          updated_member =
+            ::Members::UpdateService
+              .new(current_user, declared_params(include_missing: false))
+              .execute(member)
 
-          if member.update_attributes(declared_params(include_missing: false))
-            present member, with: Entities::Member
+          if updated_member.valid?
+            present updated_member, with: Entities::Member
           else
-            render_validation_error!(member)
+            render_validation_error!(updated_member)
           end
         end
 
@@ -99,7 +103,7 @@ module API
           member = source.members.find_by!(user_id: params[:user_id])
 
           destroy_conditionally!(member) do
-            ::Members::DestroyService.new(source, current_user, declared_params).execute
+            ::Members::DestroyService.new(current_user).execute(member)
           end
         end
       end
diff --git a/lib/api/merge_requests.rb b/lib/api/merge_requests.rb
index 719afa09295..3264a26f7d2 100644
--- a/lib/api/merge_requests.rb
+++ b/lib/api/merge_requests.rb
@@ -6,6 +6,32 @@ module API
 
     helpers ::Gitlab::IssuableMetadata
 
+    # EE::API::MergeRequests would override the following helpers
+    helpers do
+      params :optional_params_ee do
+      end
+
+      params :merge_params_ee do
+      end
+
+      def update_merge_request_ee(merge_request)
+      end
+    end
+
+    def self.update_params_at_least_one_of
+      %i[
+        assignee_id
+        description
+        labels
+        milestone_id
+        remove_source_branch
+        state_event
+        target_branch
+        title
+        discussion_locked
+      ]
+    end
+
     helpers do
       def find_merge_requests(args = {})
         args = declared_params.merge(args)
@@ -31,6 +57,12 @@ module API
         mr.all_pipelines
       end
 
+      def check_sha_param!(params, merge_request)
+        if params[:sha] && merge_request.diff_head_sha != params[:sha]
+          render_api_error!("SHA does not match HEAD of source branch: #{merge_request.diff_head_sha}", 409)
+        end
+      end
+
       params :merge_requests_params do
         optional :state, type: String, values: %w[opened closed merged all], default: 'all',
                          desc: 'Return opened, closed, merged, or all merge requests'
@@ -42,12 +74,16 @@ module API
         optional :labels, type: String, desc: 'Comma-separated list of label names'
         optional :created_after, type: DateTime, desc: 'Return merge requests created after the specified time'
         optional :created_before, type: DateTime, desc: 'Return merge requests created before the specified time'
+        optional :updated_after, type: DateTime, desc: 'Return merge requests updated after the specified time'
+        optional :updated_before, type: DateTime, desc: 'Return merge requests updated before the specified time'
         optional :view, type: String, values: %w[simple], desc: 'If simple, returns the `iid`, URL, title, description, and basic state of merge request'
         optional :author_id, type: Integer, desc: 'Return merge requests which are authored by the user with the given ID'
         optional :assignee_id, type: Integer, desc: 'Return merge requests which are assigned to the user with the given ID'
         optional :scope, type: String, values: %w[created-by-me assigned-to-me all],
                          desc: 'Return merge requests for the given scope: `created-by-me`, `assigned-to-me` or `all`'
         optional :my_reaction_emoji, type: String, desc: 'Return issues reacted by the authenticated user by the given emoji'
+        optional :source_branch, type: String, desc: 'Return merge requests with the given source branch'
+        optional :target_branch, type: String, desc: 'Return merge requests with the given target branch'
         optional :search, type: String, desc: 'Search merge requests for text present in the title or description'
         use :pagination
       end
@@ -102,16 +138,15 @@ module API
           render_api_error!(errors, 400)
         end
 
-        params :optional_params_ce do
+        params :optional_params do
           optional :description, type: String, desc: 'The description of the merge request'
           optional :assignee_id, type: Integer, desc: 'The ID of a user to assign the merge request'
           optional :milestone_id, type: Integer, desc: 'The ID of a milestone to assign the merge request'
           optional :labels, type: String, desc: 'Comma-separated list of label names'
           optional :remove_source_branch, type: Boolean, desc: 'Remove source branch when merging'
-        end
+          optional :allow_maintainer_to_push, type: Boolean, desc: 'Whether a maintainer of the target project can push to the source project'
 
-        params :optional_params do
-          use :optional_params_ce
+          use :optional_params_ee
         end
       end
 
@@ -220,7 +255,7 @@ module API
       get ':id/merge_requests/:merge_request_iid/changes' do
         merge_request = find_merge_request_with_access(params[:merge_request_iid])
 
-        present merge_request, with: Entities::MergeRequestChanges, current_user: current_user
+        present merge_request, with: Entities::MergeRequestChanges, current_user: current_user, project: user_project
       end
 
       desc 'Get the merge request pipelines' do
@@ -236,18 +271,6 @@ module API
         success Entities::MergeRequest
       end
       params do
-        # CE
-        at_least_one_of_ce = [
-          :assignee_id,
-          :description,
-          :labels,
-          :milestone_id,
-          :remove_source_branch,
-          :state_event,
-          :target_branch,
-          :title,
-          :discussion_locked
-        ]
         optional :title, type: String, allow_blank: false, desc: 'The title of the merge request'
         optional :target_branch, type: String, allow_blank: false, desc: 'The target branch'
         optional :state_event, type: String, values: %w[close reopen],
@@ -255,7 +278,7 @@ module API
         optional :discussion_locked, type: Boolean, desc: 'Whether the MR discussion is locked'
 
         use :optional_params
-        at_least_one_of(*at_least_one_of_ce)
+        at_least_one_of(*::API::MergeRequests.update_params_at_least_one_of)
       end
       put ':id/merge_requests/:merge_request_iid' do
         Gitlab::QueryLimiting.whitelist('https://gitlab.com/gitlab-org/gitlab-ce/issues/42318')
@@ -278,13 +301,14 @@ module API
         success Entities::MergeRequest
       end
       params do
-        # CE
         optional :merge_commit_message, type: String, desc: 'Custom merge commit message'
         optional :should_remove_source_branch, type: Boolean,
                                                desc: 'When true, the source branch will be deleted if possible'
         optional :merge_when_pipeline_succeeds, type: Boolean,
                                                 desc: 'When true, this merge request will be merged when the pipeline succeeds'
         optional :sha, type: String, desc: 'When present, must have the HEAD SHA of the source branch'
+
+        use :merge_params_ee
       end
       put ':id/merge_requests/:merge_request_iid/merge' do
         Gitlab::QueryLimiting.whitelist('https://gitlab.com/gitlab-org/gitlab-ce/issues/42317')
@@ -300,9 +324,9 @@ module API
 
         render_api_error!('Branch cannot be merged', 406) unless merge_request.mergeable?(skip_ci_check: merge_when_pipeline_succeeds)
 
-        if params[:sha] && merge_request.diff_head_sha != params[:sha]
-          render_api_error!("SHA does not match HEAD of source branch: #{merge_request.diff_head_sha}", 409)
-        end
+        check_sha_param!(params, merge_request)
+
+        update_merge_request_ee(merge_request)
 
         merge_params = {
           commit_message: params[:merge_commit_message],
diff --git a/lib/api/notes.rb b/lib/api/notes.rb
index 3588dc85c9e..69f1df6b341 100644
--- a/lib/api/notes.rb
+++ b/lib/api/notes.rb
@@ -1,19 +1,23 @@
 module API
   class Notes < Grape::API
     include PaginationParams
+    helpers ::API::Helpers::NotesHelpers
 
     before { authenticate! }
 
     NOTEABLE_TYPES = [Issue, MergeRequest, Snippet].freeze
 
-    params do
-      requires :id, type: String, desc: 'The ID of a project'
-    end
-    resource :projects, requirements: API::PROJECT_ENDPOINT_REQUIREMENTS do
-      NOTEABLE_TYPES.each do |noteable_type|
+    NOTEABLE_TYPES.each do |noteable_type|
+      parent_type = noteable_type.parent_class.to_s.underscore
+      noteables_str = noteable_type.to_s.underscore.pluralize
+
+      params do
+        requires :id, type: String, desc: "The ID of a #{parent_type}"
+      end
+      resource parent_type.pluralize.to_sym, requirements: API::PROJECT_ENDPOINT_REQUIREMENTS do
         noteables_str = noteable_type.to_s.underscore.pluralize
 
-        desc 'Get a list of project +noteable+ notes' do
+        desc "Get a list of #{noteable_type.to_s.downcase} notes" do
           success Entities::Note
         end
         params do
@@ -25,7 +29,7 @@ module API
           use :pagination
         end
         get ":id/#{noteables_str}/:noteable_id/notes" do
-          noteable = find_project_noteable(noteables_str, params[:noteable_id])
+          noteable = find_noteable(parent_type, noteables_str, params[:noteable_id])
 
           if can?(current_user, noteable_read_ability_name(noteable), noteable)
             # We exclude notes that are cross-references and that cannot be viewed
@@ -46,7 +50,7 @@ module API
           end
         end
 
-        desc 'Get a single +noteable+ note' do
+        desc "Get a single #{noteable_type.to_s.downcase} note" do
           success Entities::Note
         end
         params do
@@ -54,18 +58,11 @@ module API
           requires :noteable_id, type: Integer, desc: 'The ID of the noteable'
         end
         get ":id/#{noteables_str}/:noteable_id/notes/:note_id" do
-          noteable = find_project_noteable(noteables_str, params[:noteable_id])
-          note = noteable.notes.with_metadata.find(params[:note_id])
-          can_read_note = can?(current_user, noteable_read_ability_name(noteable), noteable) && !note.cross_reference_not_visible_for?(current_user)
-
-          if can_read_note
-            present note, with: Entities::Note
-          else
-            not_found!("Note")
-          end
+          noteable = find_noteable(parent_type, noteables_str, params[:noteable_id])
+          get_note(noteable, params[:note_id])
         end
 
-        desc 'Create a new +noteable+ note' do
+        desc "Create a new #{noteable_type.to_s.downcase} note" do
           success Entities::Note
         end
         params do
@@ -74,34 +71,25 @@ module API
           optional :created_at, type: String, desc: 'The creation date of the note'
         end
         post ":id/#{noteables_str}/:noteable_id/notes" do
-          noteable = find_project_noteable(noteables_str, params[:noteable_id])
+          noteable = find_noteable(parent_type, noteables_str, params[:noteable_id])
 
           opts = {
             note: params[:body],
             noteable_type: noteables_str.classify,
-            noteable_id: noteable.id
+            noteable_id: noteable.id,
+            created_at: params[:created_at]
           }
 
-          if can?(current_user, noteable_read_ability_name(noteable), noteable)
-            authorize! :create_note, noteable
+          note = create_note(noteable, opts)
 
-            if params[:created_at] && (current_user.admin? || user_project.owner == current_user)
-              opts[:created_at] = params[:created_at]
-            end
-
-            note = ::Notes::CreateService.new(user_project, current_user, opts).execute
-
-            if note.valid?
-              present note, with: Entities.const_get(note.class.name)
-            else
-              not_found!("Note #{note.errors.messages}")
-            end
+          if note.valid?
+            present note, with: Entities.const_get(note.class.name)
           else
-            not_found!("Note")
+            bad_request!("Note #{note.errors.messages}")
           end
         end
 
-        desc 'Update an existing +noteable+ note' do
+        desc "Update an existing #{noteable_type.to_s.downcase} note" do
           success Entities::Note
         end
         params do
@@ -110,24 +98,12 @@ module API
           requires :body, type: String, desc: 'The content of a note'
         end
         put ":id/#{noteables_str}/:noteable_id/notes/:note_id" do
-          note = user_project.notes.find(params[:note_id])
+          noteable = find_noteable(parent_type, noteables_str, params[:noteable_id])
 
-          authorize! :admin_note, note
-
-          opts = {
-            note: params[:body]
-          }
-
-          note = ::Notes::UpdateService.new(user_project, current_user, opts).execute(note)
-
-          if note.valid?
-            present note, with: Entities::Note
-          else
-            render_api_error!("Failed to save note #{note.errors.messages}", 400)
-          end
+          update_note(noteable, params[:note_id])
         end
 
-        desc 'Delete a +noteable+ note' do
+        desc "Delete a #{noteable_type.to_s.downcase} note" do
           success Entities::Note
         end
         params do
@@ -135,25 +111,11 @@ module API
           requires :note_id, type: Integer, desc: 'The ID of a note'
         end
         delete ":id/#{noteables_str}/:noteable_id/notes/:note_id" do
-          note = user_project.notes.find(params[:note_id])
-
-          authorize! :admin_note, note
+          noteable = find_noteable(parent_type, noteables_str, params[:noteable_id])
 
-          destroy_conditionally!(note) do |note|
-            ::Notes::DestroyService.new(user_project, current_user).execute(note)
-          end
+          delete_note(noteable, params[:note_id])
         end
       end
     end
-
-    helpers do
-      def find_project_noteable(noteables_str, noteable_id)
-        public_send("find_project_#{noteables_str.singularize}", noteable_id) # rubocop:disable GitlabSecurity/PublicSend
-      end
-
-      def noteable_read_ability_name(noteable)
-        "read_#{noteable.class.to_s.underscore}".to_sym
-      end
-    end
   end
 end
diff --git a/lib/api/project_export.rb b/lib/api/project_export.rb
new file mode 100644
index 00000000000..6ec2626df1a
--- /dev/null
+++ b/lib/api/project_export.rb
@@ -0,0 +1,41 @@
+module API
+  class ProjectExport < Grape::API
+    before do
+      not_found! unless Gitlab::CurrentSettings.project_export_enabled?
+      authorize_admin_project
+    end
+
+    params do
+      requires :id, type: String, desc: 'The ID of a project'
+    end
+    resource :projects, requirements: { id: %r{[^/]+} } do
+      desc 'Get export status' do
+        detail 'This feature was introduced in GitLab 10.6.'
+        success Entities::ProjectExportStatus
+      end
+      get ':id/export' do
+        present user_project, with: Entities::ProjectExportStatus
+      end
+
+      desc 'Download export' do
+        detail 'This feature was introduced in GitLab 10.6.'
+      end
+      get ':id/export/download' do
+        path = user_project.export_project_path
+
+        render_api_error!('404 Not found or has expired', 404) unless path
+
+        present_file!(path, File.basename(path), 'application/gzip')
+      end
+
+      desc 'Start export' do
+        detail 'This feature was introduced in GitLab 10.6.'
+      end
+      post ':id/export' do
+        user_project.add_export_job(current_user: current_user)
+
+        accepted!
+      end
+    end
+  end
+end
diff --git a/lib/api/project_hooks.rb b/lib/api/project_hooks.rb
index 86066e2b58f..f82241058e5 100644
--- a/lib/api/project_hooks.rb
+++ b/lib/api/project_hooks.rb
@@ -10,6 +10,7 @@ module API
         requires :url, type: String, desc: "The URL to send the request to"
         optional :push_events, type: Boolean, desc: "Trigger hook on push events"
         optional :issues_events, type: Boolean, desc: "Trigger hook on issues events"
+        optional :confidential_issues_events, type: Boolean, desc: "Trigger hook on confidential issues events"
         optional :merge_requests_events, type: Boolean, desc: "Trigger hook on merge request events"
         optional :tag_push_events, type: Boolean, desc: "Trigger hook on tag push events"
         optional :note_events, type: Boolean, desc: "Trigger hook on note(comment) events"
diff --git a/lib/api/runner.rb b/lib/api/runner.rb
index 5469cba69a6..7e6c33ec33d 100644
--- a/lib/api/runner.rb
+++ b/lib/api/runner.rb
@@ -16,7 +16,8 @@ module API
         optional :tag_list, type: Array[String], desc: %q(List of Runner's tags)
       end
       post '/' do
-        attributes = attributes_for_keys [:description, :locked, :run_untagged, :tag_list]
+        attributes = attributes_for_keys([:description, :locked, :run_untagged, :tag_list])
+          .merge(get_runner_details_from_request)
 
         runner =
           if runner_registration_token_valid?
@@ -30,7 +31,6 @@ module API
         return forbidden! unless runner
 
         if runner.id
-          runner.update(get_runner_version_from_params)
           present runner, with: Entities::RunnerRegistrationDetails
         else
           not_found!
@@ -204,6 +204,7 @@ module API
         optional 'file.path', type: String, desc: %q(path to locally stored body (generated by Workhorse))
         optional 'file.name', type: String, desc: %q(real filename as send in Content-Disposition (generated by Workhorse))
         optional 'file.type', type: String, desc: %q(real content type as send in Content-Type (generated by Workhorse))
+        optional 'file.sha256', type: String, desc: %q(sha256 checksum of the file)
         optional 'metadata.path', type: String, desc: %q(path to locally stored body (generated by Workhorse))
         optional 'metadata.name', type: String, desc: %q(filename (generated by Workhorse))
       end
@@ -224,7 +225,7 @@ module API
         expire_in = params['expire_in'] ||
           Gitlab::CurrentSettings.current_application_settings.default_artifacts_expire_in
 
-        job.build_job_artifacts_archive(project: job.project, file_type: :archive, file: artifacts, expire_in: expire_in)
+        job.build_job_artifacts_archive(project: job.project, file_type: :archive, file: artifacts, file_sha256: params['file.sha256'], expire_in: expire_in)
         job.build_job_artifacts_metadata(project: job.project, file_type: :metadata, file: metadata, expire_in: expire_in) if metadata
         job.artifacts_expire_in = expire_in
 
diff --git a/lib/api/services.rb b/lib/api/services.rb
index 51e33e2c686..6c97659166d 100644
--- a/lib/api/services.rb
+++ b/lib/api/services.rb
@@ -1,6 +1,7 @@
+# frozen_string_literal: true
 module API
   class Services < Grape::API
-    chat_notification_settings = [
+    CHAT_NOTIFICATION_SETTINGS = [
       {
         required: true,
         name: :webhook,
@@ -19,9 +20,9 @@ module API
         type: String,
         desc: 'The default chat channel'
       }
-    ]
+    ].freeze
 
-    chat_notification_flags = [
+    CHAT_NOTIFICATION_FLAGS = [
       {
         required: false,
         name: :notify_only_broken_pipelines,
@@ -34,9 +35,9 @@ module API
         type: Boolean,
         desc: 'Send notifications only for the default branch'
       }
-    ]
+    ].freeze
 
-    chat_notification_channels = [
+    CHAT_NOTIFICATION_CHANNELS = [
       {
         required: false,
         name: :push_channel,
@@ -85,9 +86,9 @@ module API
         type: String,
         desc: 'The name of the channel to receive wiki_page_events notifications'
       }
-    ]
+    ].freeze
 
-    chat_notification_events = [
+    CHAT_NOTIFICATION_EVENTS = [
       {
         required: false,
         name: :push_events,
@@ -136,7 +137,7 @@ module API
         type: Boolean,
         desc: 'Enable notifications for wiki_page_events'
       }
-    ]
+    ].freeze
 
     services = {
       'asana' => [
@@ -627,10 +628,10 @@ module API
         }
       ],
       'slack' => [
-        chat_notification_settings,
-        chat_notification_flags,
-        chat_notification_channels,
-        chat_notification_events
+        CHAT_NOTIFICATION_SETTINGS,
+        CHAT_NOTIFICATION_FLAGS,
+        CHAT_NOTIFICATION_CHANNELS,
+        CHAT_NOTIFICATION_EVENTS
       ].flatten,
       'microsoft-teams' => [
         {
@@ -641,10 +642,10 @@ module API
         }
       ],
       'mattermost' => [
-        chat_notification_settings,
-        chat_notification_flags,
-        chat_notification_channels,
-        chat_notification_events
+        CHAT_NOTIFICATION_SETTINGS,
+        CHAT_NOTIFICATION_FLAGS,
+        CHAT_NOTIFICATION_CHANNELS,
+        CHAT_NOTIFICATION_EVENTS
       ].flatten,
       'teamcity' => [
         {
@@ -724,7 +725,22 @@ module API
       ]
     end
 
-    trigger_services = {
+    SERVICES = services.freeze
+    SERVICE_CLASSES = service_classes.freeze
+
+    SERVICE_CLASSES.each do |service|
+      event_names = service.try(:event_names) || next
+      event_names.each do |event_name|
+        SERVICES[service.to_param.tr("_", "-")] << {
+          required: false,
+          name: event_name.to_sym,
+          type: String,
+          desc: ServicesHelper.service_event_description(event_name)
+        }
+      end
+    end
+
+    TRIGGER_SERVICES = {
       'mattermost-slash-commands' => [
         {
           name: :token,
@@ -756,22 +772,9 @@ module API
         end
       end
 
-      services.each do |service_slug, settings|
+      SERVICES.each do |service_slug, settings|
         desc "Set #{service_slug} service for project"
         params do
-          service_classes.each do |service|
-            event_names = service.try(:event_names) || next
-            event_names.each do |event_name|
-              services[service.to_param.tr("_", "-")] << {
-                required: false,
-                name: event_name.to_sym,
-                type: String,
-                desc: ServicesHelper.service_event_description(event_name)
-              }
-            end
-          end
-          services.freeze
-
           settings.each do |setting|
             if setting[:required]
               requires setting[:name], type: setting[:type], desc: setting[:desc]
@@ -794,7 +797,7 @@ module API
 
       desc "Delete a service for project"
       params do
-        requires :service_slug, type: String, values: services.keys, desc: 'The name of the service'
+        requires :service_slug, type: String, values: SERVICES.keys, desc: 'The name of the service'
       end
       delete ":id/services/:service_slug" do
         service = user_project.find_or_initialize_service(params[:service_slug].underscore)
@@ -814,7 +817,7 @@ module API
         success Entities::ProjectService
       end
       params do
-        requires :service_slug, type: String, values: services.keys, desc: 'The name of the service'
+        requires :service_slug, type: String, values: SERVICES.keys, desc: 'The name of the service'
       end
       get ":id/services/:service_slug" do
         service = user_project.find_or_initialize_service(params[:service_slug].underscore)
@@ -822,7 +825,7 @@ module API
       end
     end
 
-    trigger_services.each do |service_slug, settings|
+    TRIGGER_SERVICES.each do |service_slug, settings|
       helpers do
         def slash_command_service(project, service_slug, params)
           project.services.active.where(template: false).find do |service|
diff --git a/lib/api/v3/entities.rb b/lib/api/v3/entities.rb
index 2ccbb9da1c5..68b4d7c3982 100644
--- a/lib/api/v3/entities.rb
+++ b/lib/api/v3/entities.rb
@@ -252,8 +252,9 @@ module API
 
       class ProjectService < Grape::Entity
         expose :id, :title, :created_at, :updated_at, :active
-        expose :push_events, :issues_events, :merge_requests_events
-        expose :tag_push_events, :note_events, :pipeline_events
+        expose :push_events, :issues_events, :confidential_issues_events
+        expose :merge_requests_events, :tag_push_events, :note_events
+        expose :pipeline_events
         expose :job_events, as: :build_events
         # Expose serialized properties
         expose :properties do |service, options|
@@ -262,8 +263,9 @@ module API
       end
 
       class ProjectHook < ::API::Entities::Hook
-        expose :project_id, :issues_events, :merge_requests_events
-        expose :note_events, :pipeline_events, :wiki_page_events
+        expose :project_id, :issues_events, :confidential_issues_events
+        expose :merge_requests_events, :note_events, :pipeline_events
+        expose :wiki_page_events
         expose :job_events, as: :build_events
       end
 
diff --git a/lib/api/v3/members.rb b/lib/api/v3/members.rb
index d7bde8ceb89..88dd598f1e9 100644
--- a/lib/api/v3/members.rb
+++ b/lib/api/v3/members.rb
@@ -124,7 +124,7 @@ module API
               status(200  )
               { message: "Access revoked", id: params[:user_id].to_i }
             else
-              ::Members::DestroyService.new(source, current_user, declared_params).execute
+              ::Members::DestroyService.new(current_user).execute(member)
 
               present member, with: ::API::Entities::Member
             end
diff --git a/lib/api/v3/project_hooks.rb b/lib/api/v3/project_hooks.rb
index 51014591a93..631944150c7 100644
--- a/lib/api/v3/project_hooks.rb
+++ b/lib/api/v3/project_hooks.rb
@@ -11,6 +11,7 @@ module API
           requires :url, type: String, desc: "The URL to send the request to"
           optional :push_events, type: Boolean, desc: "Trigger hook on push events"
           optional :issues_events, type: Boolean, desc: "Trigger hook on issues events"
+          optional :confidential_issues_events, type: Boolean, desc: "Trigger hook on confidential issues events"
           optional :merge_requests_events, type: Boolean, desc: "Trigger hook on merge request events"
           optional :tag_push_events, type: Boolean, desc: "Trigger hook on tag push events"
           optional :note_events, type: Boolean, desc: "Trigger hook on note(comment) events"