Add latest changes from gitlab-org/gitlab@14-2-stable-eev14.2.0-rc42

13 files changed, 196 insertions, 160 deletions

diff --git a/scripts/api/cancel_pipeline.rb b/scripts/api/cancel_pipeline.rb
index 0965877a69a..2de50dcee80 100755
--- a/scripts/api/cancel_pipeline.rb
+++ b/scripts/api/cancel_pipeline.rb
@@ -1,39 +1,32 @@
 #!/usr/bin/env ruby
 # frozen_string_literal: true
 
-require 'rubygems'
 require 'gitlab'
 require 'optparse'
-require_relative 'get_job_id'
+require_relative 'default_options'
 
 class CancelPipeline
-  DEFAULT_OPTIONS = {
-    project: ENV['CI_PROJECT_ID'],
-    pipeline_id: ENV['CI_PIPELINE_ID'],
-    api_token: ENV['GITLAB_BOT_MULTI_PROJECT_PIPELINE_POLLING_TOKEN']
-  }.freeze
-
   def initialize(options)
     @project = options.delete(:project)
     @pipeline_id = options.delete(:pipeline_id)
 
-    Gitlab.configure do |config|
-      config.endpoint = 'https://gitlab.com/api/v4'
-      config.private_token = options.delete(:api_token)
-    end
+    @client = Gitlab.client(
+      endpoint: options.delete(:endpoint) || API::DEFAULT_OPTIONS[:endpoint],
+      private_token: options.delete(:api_token)
+    )
   end
 
   def execute
-    Gitlab.cancel_pipeline(project, pipeline_id)
+    client.cancel_pipeline(project, pipeline_id)
   end
 
   private
 
-  attr_reader :project, :pipeline_id
+  attr_reader :project, :pipeline_id, :client
 end
 
 if $0 == __FILE__
-  options = CancelPipeline::DEFAULT_OPTIONS.dup
+  options = API::DEFAULT_OPTIONS.dup
 
   OptionParser.new do |opts|
     opts.on("-p", "--project PROJECT", String, "Project where to find the job (defaults to $CI_PROJECT_ID)") do |value|
@@ -44,10 +37,14 @@ if $0 == __FILE__
       options[:pipeline_id] = value
     end
 
-    opts.on("-t", "--api-token API_TOKEN", String, "A value API token with the `read_api` scope") do |value|
+    opts.on("-t", "--api-token API_TOKEN", String, "A value API token with the `api` scope") do |value|
       options[:api_token] = value
     end
 
+    opts.on("-E", "--endpoint ENDPOINT", String, "The API endpoint for the API token. (defaults to $CI_API_V4_URL and fallback to https://gitlab.com/api/v4)") do |value|
+      options[:endpoint] = value
+    end
+
     opts.on("-h", "--help", "Prints this help") do
       puts opts
       exit
diff --git a/scripts/api/default_options.rb b/scripts/api/default_options.rb
new file mode 100644
index 00000000000..70fb9683733
--- /dev/null
+++ b/scripts/api/default_options.rb
@@ -0,0 +1,11 @@
+# frozen_string_literal: true
+
+module API
+  DEFAULT_OPTIONS = {
+    project: ENV['CI_PROJECT_ID'],
+    pipeline_id: ENV['CI_PIPELINE_ID'],
+    # Default to "CI scripts API usage" at https://gitlab.com/gitlab-org/gitlab/-/settings/access_tokens
+    api_token: ENV['PROJECT_TOKEN_FOR_CI_SCRIPTS_API_USAGE'],
+    endpoint: ENV['CI_API_V4_URL'] || 'https://gitlab.com/api/v4'
+  }.freeze
+end
diff --git a/scripts/api/download_job_artifact.rb b/scripts/api/download_job_artifact.rb
index 8e2207c6fa7..23202ad3912 100755
--- a/scripts/api/download_job_artifact.rb
+++ b/scripts/api/download_job_artifact.rb
@@ -1,30 +1,26 @@
 #!/usr/bin/env ruby
 # frozen_string_literal: true
 
-require 'rubygems'
 require 'optparse'
 require 'fileutils'
 require 'uri'
 require 'cgi'
 require 'net/http'
+require_relative 'default_options'
 
 class ArtifactFinder
-  DEFAULT_OPTIONS = {
-    project: ENV['CI_PROJECT_ID'],
-    api_token: ENV['GITLAB_BOT_MULTI_PROJECT_PIPELINE_POLLING_TOKEN']
-  }.freeze
-
   def initialize(options)
     @project = options.delete(:project)
     @job_id = options.delete(:job_id)
     @api_token = options.delete(:api_token)
+    @endpoint = options.delete(:endpoint) || API::DEFAULT_OPTIONS[:endpoint]
     @artifact_path = options.delete(:artifact_path)
 
     warn "No API token given." unless api_token
   end
 
   def execute
-    url = "https://gitlab.com/api/v4/projects/#{CGI.escape(project)}/jobs/#{job_id}/artifacts"
+    url = "#{endpoint}/projects/#{CGI.escape(project)}/jobs/#{job_id}/artifacts"
 
     if artifact_path
       FileUtils.mkdir_p(File.dirname(artifact_path))
@@ -36,7 +32,7 @@ class ArtifactFinder
 
   private
 
-  attr_reader :project, :job_id, :api_token, :artifact_path
+  attr_reader :project, :job_id, :api_token, :endpoint, :artifact_path
 
   def fetch(uri_str, limit = 10)
     raise 'Too many HTTP redirects' if limit == 0
@@ -65,7 +61,7 @@ class ArtifactFinder
 end
 
 if $0 == __FILE__
-  options = ArtifactFinder::DEFAULT_OPTIONS.dup
+  options = API::DEFAULT_OPTIONS.dup
 
   OptionParser.new do |opts|
     opts.on("-p", "--project PROJECT", String, "Project where to find the job (defaults to $CI_PROJECT_ID)") do |value|
@@ -84,6 +80,10 @@ if $0 == __FILE__
       options[:api_token] = value
     end
 
+    opts.on("-E", "--endpoint ENDPOINT", String, "The API endpoint for the API token. (defaults to $CI_API_V4_URL and fallback to https://gitlab.com/api/v4)") do |value|
+      options[:endpoint] = value
+    end
+
     opts.on("-h", "--help", "Prints this help") do
       puts opts
       exit
diff --git a/scripts/api/get_job_id.rb b/scripts/api/get_job_id.rb
index dd0b7fbada0..166c9198951 100755
--- a/scripts/api/get_job_id.rb
+++ b/scripts/api/get_job_id.rb
@@ -1,18 +1,15 @@
 #!/usr/bin/env ruby
 # frozen_string_literal: true
 
-require 'rubygems'
 require 'gitlab'
 require 'optparse'
+require_relative 'default_options'
 
 class JobFinder
-  DEFAULT_OPTIONS = {
-    project: ENV['CI_PROJECT_ID'],
-    pipeline_id: ENV['CI_PIPELINE_ID'],
-    pipeline_query: {},
-    job_query: {},
-    api_token: ENV['GITLAB_BOT_MULTI_PROJECT_PIPELINE_POLLING_TOKEN']
-  }.freeze
+  DEFAULT_OPTIONS = API::DEFAULT_OPTIONS.merge(
+    pipeline_query: {}.freeze,
+    job_query: {}.freeze
+  ).freeze
 
   def initialize(options)
     @project = options.delete(:project)
@@ -27,10 +24,10 @@ class JobFinder
 
     warn "No API token given." if api_token.empty?
 
-    Gitlab.configure do |config|
-      config.endpoint = 'https://gitlab.com/api/v4'
-      config.private_token = api_token
-    end
+    @client = Gitlab.client(
+      endpoint: options.delete(:endpoint) || DEFAULT_OPTIONS[:endpoint],
+      private_token: api_token
+    )
   end
 
   def execute
@@ -39,13 +36,13 @@ class JobFinder
 
   private
 
-  attr_reader :project, :pipeline_query, :job_query, :pipeline_id, :job_name, :artifact_path
+  attr_reader :project, :pipeline_query, :job_query, :pipeline_id, :job_name, :artifact_path, :client
 
   def find_job_with_artifact
     return if artifact_path.nil?
 
-    Gitlab.pipelines(project, pipeline_query_params).auto_paginate do |pipeline|
-      Gitlab.pipeline_jobs(project, pipeline.id, job_query_params).auto_paginate do |job|
+    client.pipelines(project, pipeline_query_params).auto_paginate do |pipeline|
+      client.pipeline_jobs(project, pipeline.id, job_query_params).auto_paginate do |job|
         return job if found_job_with_artifact?(job) # rubocop:disable Cop/AvoidReturnFromBlocks
       end
     end
@@ -56,8 +53,8 @@ class JobFinder
   def find_job_with_filtered_pipelines
     return if pipeline_query.empty?
 
-    Gitlab.pipelines(project, pipeline_query_params).auto_paginate do |pipeline|
-      Gitlab.pipeline_jobs(project, pipeline.id, job_query_params).auto_paginate do |job|
+    client.pipelines(project, pipeline_query_params).auto_paginate do |pipeline|
+      client.pipeline_jobs(project, pipeline.id, job_query_params).auto_paginate do |job|
         return job if found_job_by_name?(job) # rubocop:disable Cop/AvoidReturnFromBlocks
       end
     end
@@ -68,7 +65,7 @@ class JobFinder
   def find_job_in_pipeline
     return unless pipeline_id
 
-    Gitlab.pipeline_jobs(project, pipeline_id, job_query_params).auto_paginate do |job|
+    client.pipeline_jobs(project, pipeline_id, job_query_params).auto_paginate do |job|
       return job if found_job_by_name?(job) # rubocop:disable Cop/AvoidReturnFromBlocks
     end
 
@@ -76,7 +73,7 @@ class JobFinder
   end
 
   def found_job_with_artifact?(job)
-    artifact_url = "https://gitlab.com/api/v4/projects/#{CGI.escape(project)}/jobs/#{job.id}/artifacts/#{artifact_path}"
+    artifact_url = "#{client.endpoint}/projects/#{CGI.escape(project)}/jobs/#{job.id}/artifacts/#{artifact_path}"
     response = HTTParty.head(artifact_url) # rubocop:disable Gitlab/HTTParty
     response.success?
   end
@@ -107,11 +104,13 @@ if $0 == __FILE__
     end
 
     opts.on("-q", "--pipeline-query pipeline_query", String, "Query to pass to the Pipeline API request") do |value|
-      options[:pipeline_query].merge!(Hash[*value.split('=')])
+      options[:pipeline_query] =
+        options[:pipeline_query].merge(Hash[*value.split('=')])
     end
 
     opts.on("-Q", "--job-query job_query", String, "Query to pass to the Job API request") do |value|
-      options[:job_query].merge!(Hash[*value.split('=')])
+      options[:job_query] =
+        options[:job_query].merge(Hash[*value.split('=')])
     end
 
     opts.on("-j", "--job-name job_name", String, "A job name that needs to exist in the found pipeline") do |value|
@@ -126,6 +125,10 @@ if $0 == __FILE__
       options[:api_token] = value
     end
 
+    opts.on("-E", "--endpoint ENDPOINT", String, "The API endpoint for the API token. (defaults to $CI_API_V4_URL and fallback to https://gitlab.com/api/v4)") do |value|
+      options[:endpoint] = value
+    end
+
     opts.on("-h", "--help", "Prints this help") do
       puts opts
       exit
diff --git a/scripts/api/play_job.rb b/scripts/api/play_job.rb
deleted file mode 100755
index 408dfdf1ef0..00000000000
--- a/scripts/api/play_job.rb
+++ /dev/null
@@ -1,63 +0,0 @@
-#!/usr/bin/env ruby
-# frozen_string_literal: true
-
-require 'rubygems'
-require 'gitlab'
-require 'optparse'
-require_relative 'get_job_id'
-
-class PlayJob
-  DEFAULT_OPTIONS = {
-    project: ENV['CI_PROJECT_ID'],
-    pipeline_id: ENV['CI_PIPELINE_ID'],
-    api_token: ENV['GITLAB_BOT_MULTI_PROJECT_PIPELINE_POLLING_TOKEN']
-  }.freeze
-
-  def initialize(options)
-    @options = options
-
-    Gitlab.configure do |config|
-      config.endpoint = 'https://gitlab.com/api/v4'
-      config.private_token = options.fetch(:api_token)
-    end
-  end
-
-  def execute
-    job = JobFinder.new(options.slice(:project, :api_token, :pipeline_id, :job_name).merge(scope: 'manual')).execute
-
-    Gitlab.job_play(project, job.id)
-  end
-
-  private
-
-  attr_reader :options
-
-  def project
-    options[:project]
-  end
-end
-
-if $0 == __FILE__
-  options = PlayJob::DEFAULT_OPTIONS.dup
-
-  OptionParser.new do |opts|
-    opts.on("-p", "--project PROJECT", String, "Project where to find the job (defaults to $CI_PROJECT_ID)") do |value|
-      options[:project] = value
-    end
-
-    opts.on("-j", "--job-name JOB_NAME", String, "A job name that needs to exist in the found pipeline") do |value|
-      options[:job_name] = value
-    end
-
-    opts.on("-t", "--api-token API_TOKEN", String, "A value API token with the `read_api` scope") do |value|
-      options[:api_token] = value
-    end
-
-    opts.on("-h", "--help", "Prints this help") do
-      puts opts
-      exit
-    end
-  end.parse!
-
-  PlayJob.new(options).execute
-end
diff --git a/scripts/frontend/startup_css/constants.js b/scripts/frontend/startup_css/constants.js
index 5f6189d9e59..8f183e63659 100644
--- a/scripts/frontend/startup_css/constants.js
+++ b/scripts/frontend/startup_css/constants.js
@@ -49,8 +49,6 @@ const createMainOutput = ({ outFile, cssKeys, type }) => ({
   outFile,
   htmlPaths: [
     path.join(FIXTURES_ROOT, `startup_css/project-${type}.html`),
-    path.join(FIXTURES_ROOT, `startup_css/project-${type}-legacy-menu.html`),
-    path.join(FIXTURES_ROOT, `startup_css/project-${type}-legacy-sidebar.html`),
     path.join(FIXTURES_ROOT, `startup_css/project-${type}-signed-out.html`),
   ],
   cssKeys,
diff --git a/scripts/lint-doc.sh b/scripts/lint-doc.sh
index 33a46e73ee2..0157f0c0812 100755
--- a/scripts/lint-doc.sh
+++ b/scripts/lint-doc.sh
@@ -21,11 +21,9 @@ fi
 # Documentation pages need front matter for tracking purposes.
 echo '=> Checking documentation for front matter...'
 echo
-no_frontmatter=$(find doc -name "*.md" -exec head -n1 {} \; | grep -v  --count -- ---)
-if [ $no_frontmatter -ne 0 ]
+if ! scripts/lint-docs-metadata.sh
 then
   echo '✖ ERROR: These documentation pages need front matter. See https://docs.gitlab.com/ee/development/documentation/index.html#stage-and-group-metadata for how to add it.' >&2
-  find doc -name "*.md" -exec sh -c 'if (head -n 1 "{}" | grep -v -- --- >/dev/null); then echo "{}"; fi' \; 2>&1
   echo
   ((ERRORCODE++))
 fi
@@ -68,8 +66,8 @@ then
 fi
 
 # Do not use 'README.md', instead use 'index.md'
-# Number of 'README.md's as of 2021-06-21
-NUMBER_READMES=15
+# Number of 'README.md's as of 2021-08-17
+NUMBER_READMES=13
 FIND_READMES=$(find doc/ -name "README.md" | wc -l)
 echo '=> Checking for new README.md files...'
 echo
diff --git a/scripts/lint-docs-metadata.sh b/scripts/lint-docs-metadata.sh
new file mode 100755
index 00000000000..4212adfd3f1
--- /dev/null
+++ b/scripts/lint-docs-metadata.sh
@@ -0,0 +1,75 @@
+#!/usr/bin/env bash
+set -euo pipefail
+IFS=$'\n\t'
+
+COLOR_RED="\e[31m"
+COLOR_GREEN="\e[32m"
+COLOR_RESET="\e[39m"
+VERBOSE=false
+CHECK_ALL=true
+
+FAILING_FILES=0
+TOTAL_FILES=0
+
+# Parse arguments
+for arg in "$@"; do
+  case $arg in
+
+  --verbose)
+    VERBOSE=true
+    ;;
+  --help | -h)
+    cat <<EOF
+usage: lint-docs-metadata.sh [--help][--verbose] <file...>
+
+If no files are provided, all markdown files in doc/ are checked.
+EOF
+    exit 0
+    ;;
+  *)
+    CHECK_ALL=false
+    ;;
+
+  esac
+done
+
+function check_file {
+  local file
+  file="$1"
+  TOTAL_FILES=$((TOTAL_FILES + 1))
+  if [ "$(head -n1 "$file")" != "---" ]; then
+    printf "${COLOR_RED}Documentation metadata missing in %s.${COLOR_RESET}\n" "$file" >&2
+    FAILING_FILES=$((FAILING_FILES + 1))
+  elif [ "$VERBOSE" == "true" ]; then
+    printf "Documentation metadata found in %s.\n" "$file"
+  fi
+}
+
+function check_all_files {
+  while IFS= read -r -d '' file; do
+    check_file "$file"
+  done < <(find "doc" -name "*.md" -type f -print0)
+}
+
+if [[ "$CHECK_ALL" = "true" ]]; then
+  # shellcheck disable=SC2059
+  printf "No files supplied. Checking all markdown files in doc/.\n"
+  check_all_files
+else
+  # Takes a list of Markdown files as a parameter
+  for file in "$@"; do
+    # Skipping parameters
+    [[ $file = --* ]] && continue
+    check_file "$file"
+  done
+fi
+
+if [ "$FAILING_FILES" -gt 0 ]; then
+  # shellcheck disable=SC2059
+  printf "\n${COLOR_RED}Documentation metadata is missing in ${FAILING_FILES} of ${TOTAL_FILES} documentation files.${COLOR_RESET} For more information, see https://docs.gitlab.com/ee/development/documentation/#metadata.\n" >&2
+  exit 1
+else
+  # shellcheck disable=SC2059
+  printf "${COLOR_GREEN}Documentation metadata found in ${TOTAL_FILES} documentation files.${COLOR_RESET}\n"
+  exit 0
+fi
diff --git a/scripts/review_apps/base-config.yaml b/scripts/review_apps/base-config.yaml
index 981a8b51674..3480b7e8bec 100644
--- a/scripts/review_apps/base-config.yaml
+++ b/scripts/review_apps/base-config.yaml
@@ -10,6 +10,8 @@ global:
       secretName: review-apps-tls
   initialRootPassword:
     secret: shared-gitlab-initial-root-password
+  nodeSelector:
+    preemptible: "true"
 certmanager:
   install: false
 gitlab:
@@ -24,6 +26,8 @@ gitlab:
     persistence:
       size: 10G
       storageClass: ssd
+    nodeSelector:
+      preemptible: "false"
   gitlab-exporter:
     enabled: false
   mailroom:
@@ -63,10 +67,10 @@ gitlab:
     resources:
       requests:
         cpu: 300m
-        memory: 800M
+        memory: 1927M
       limits:
         cpu: 450m
-        memory: 1200M
+        memory: 2890M
   webservice:
     resources:
       requests:
@@ -100,6 +104,8 @@ gitlab-runner:
     limits:
       cpu: 1015m
       memory: 150M
+  nodeSelector:
+    preemptible: "true"
 minio:
   resources:
     requests:
@@ -108,6 +114,8 @@ minio:
     limits:
       cpu: 15m
       memory: 280M
+  nodeSelector:
+    preemptible: "true"
 nginx-ingress:
   controller:
     config:
@@ -125,6 +133,8 @@ nginx-ingress:
       timeoutSeconds: 5
     readinessProbe:
       timeoutSeconds: 5
+    nodeSelector:
+      preemptible: "true"
   defaultBackend:
     resources:
       requests:
@@ -133,6 +143,8 @@ nginx-ingress:
       limits:
         cpu: 10m
         memory: 24M
+    nodeSelector:
+      preemptible: "true"
 postgresql:
   metrics:
     enabled: false
@@ -143,6 +155,9 @@ postgresql:
     limits:
       cpu: 1300m
       memory: 1500M
+  master:
+    nodeSelector:
+      preemptible: "true"
 prometheus:
   install: false
 redis:
@@ -155,6 +170,9 @@ redis:
     limits:
       cpu: 200m
       memory: 130M
+  master:
+    nodeSelector:
+      preemptible: "true"
 registry:
   hpa:
     minReplicas: 1
@@ -165,3 +183,5 @@ registry:
     limits:
       cpu: 200m
       memory: 45M
+  nodeSelector:
+    preemptible: "true"
diff --git a/scripts/review_apps/review-apps.sh b/scripts/review_apps/review-apps.sh
index a799f8cd925..641bf6a5d10 100755
--- a/scripts/review_apps/review-apps.sh
+++ b/scripts/review_apps/review-apps.sh
@@ -247,7 +247,7 @@ function deploy() {
   gitlab_migrations_image_repository="${IMAGE_REPOSITORY}/gitlab-rails-ee"
   gitlab_sidekiq_image_repository="${IMAGE_REPOSITORY}/gitlab-sidekiq-ee"
   gitlab_webservice_image_repository="${IMAGE_REPOSITORY}/gitlab-webservice-ee"
-  gitlab_task_runner_image_repository="${IMAGE_REPOSITORY}/gitlab-task-runner-ee"
+  gitlab_task_runner_image_repository="${IMAGE_REPOSITORY}/gitlab-toolbox-ee"
   gitlab_gitaly_image_repository="${IMAGE_REPOSITORY}/gitaly"
   gitaly_image_tag=$(parse_gitaly_image_tag)
   gitlab_shell_image_repository="${IMAGE_REPOSITORY}/gitlab-shell"
diff --git a/scripts/rspec_helpers.sh b/scripts/rspec_helpers.sh
index 0484cabca82..0714ecfce80 100644
--- a/scripts/rspec_helpers.sh
+++ b/scripts/rspec_helpers.sh
@@ -10,14 +10,14 @@ function retrieve_tests_metadata() {
   local test_metadata_job_id
 
   # Ruby
-  test_metadata_job_id=$(scripts/api/get_job_id.rb --project "${project_path}" -q "status=success" -q "ref=${artifact_branch}" -q "username=gitlab-bot" -Q "scope=success" --job-name "update-tests-metadata")
+  test_metadata_job_id=$(scripts/api/get_job_id.rb --endpoint "https://gitlab.com/api/v4" --project "${project_path}" -q "status=success" -q "ref=${artifact_branch}" -q "username=gitlab-bot" -Q "scope=success" --job-name "update-tests-metadata")
 
   if [[ ! -f "${KNAPSACK_RSPEC_SUITE_REPORT_PATH}" ]]; then
-    scripts/api/download_job_artifact.rb --project "${project_path}" --job-id "${test_metadata_job_id}" --artifact-path "${KNAPSACK_RSPEC_SUITE_REPORT_PATH}" || echo "{}" > "${KNAPSACK_RSPEC_SUITE_REPORT_PATH}"
+    scripts/api/download_job_artifact.rb --endpoint "https://gitlab.com/api/v4" --project "${project_path}" --job-id "${test_metadata_job_id}" --artifact-path "${KNAPSACK_RSPEC_SUITE_REPORT_PATH}" || echo "{}" > "${KNAPSACK_RSPEC_SUITE_REPORT_PATH}"
   fi
 
   if [[ ! -f "${FLAKY_RSPEC_SUITE_REPORT_PATH}" ]]; then
-    scripts/api/download_job_artifact.rb --project "${project_path}" --job-id "${test_metadata_job_id}" --artifact-path "${FLAKY_RSPEC_SUITE_REPORT_PATH}" || echo "{}" > "${FLAKY_RSPEC_SUITE_REPORT_PATH}"
+    scripts/api/download_job_artifact.rb --endpoint "https://gitlab.com/api/v4" --project "${project_path}" --job-id "${test_metadata_job_id}" --artifact-path "${FLAKY_RSPEC_SUITE_REPORT_PATH}" || echo "{}" > "${FLAKY_RSPEC_SUITE_REPORT_PATH}"
   fi
 }
 
@@ -48,10 +48,10 @@ function retrieve_tests_mapping() {
   local artifact_branch="master"
   local test_metadata_with_mapping_job_id
 
-  test_metadata_with_mapping_job_id=$(scripts/api/get_job_id.rb --project "${project_path}" -q "status=success" -q "ref=${artifact_branch}" -q "username=gitlab-bot" -Q "scope=success" --job-name "update-tests-metadata" --artifact-path "${RSPEC_PACKED_TESTS_MAPPING_PATH}.gz")
+  test_metadata_with_mapping_job_id=$(scripts/api/get_job_id.rb --endpoint "https://gitlab.com/api/v4" --project "${project_path}" -q "status=success" -q "ref=${artifact_branch}" -q "username=gitlab-bot" -Q "scope=success" --job-name "update-tests-metadata" --artifact-path "${RSPEC_PACKED_TESTS_MAPPING_PATH}.gz")
 
   if [[ ! -f "${RSPEC_PACKED_TESTS_MAPPING_PATH}" ]]; then
-   (scripts/api/download_job_artifact.rb --project "${project_path}" --job-id "${test_metadata_with_mapping_job_id}" --artifact-path "${RSPEC_PACKED_TESTS_MAPPING_PATH}.gz" && gzip -d "${RSPEC_PACKED_TESTS_MAPPING_PATH}.gz") || echo "{}" > "${RSPEC_PACKED_TESTS_MAPPING_PATH}"
+   (scripts/api/download_job_artifact.rb --endpoint "https://gitlab.com/api/v4" --project "${project_path}" --job-id "${test_metadata_with_mapping_job_id}" --artifact-path "${RSPEC_PACKED_TESTS_MAPPING_PATH}.gz" && gzip -d "${RSPEC_PACKED_TESTS_MAPPING_PATH}.gz") || echo "{}" > "${RSPEC_PACKED_TESTS_MAPPING_PATH}"
   fi
 
   scripts/unpack-test-mapping "${RSPEC_PACKED_TESTS_MAPPING_PATH}" "${RSPEC_TESTS_MAPPING_PATH}"
@@ -84,10 +84,6 @@ function rspec_simple_job() {
 function rspec_db_library_code() {
   local db_files="spec/lib/gitlab/database/ spec/support/helpers/database/"
 
-  if [[ -d "ee/" ]]; then
-    db_files="${db_files} ee/spec/lib/ee/gitlab/database_spec.rb"
-  fi
-
   rspec_simple_job "-- ${db_files}"
 }
 
diff --git a/scripts/static-analysis b/scripts/static-analysis
index fc917f1b975..a1859254459 100755
--- a/scripts/static-analysis
+++ b/scripts/static-analysis
@@ -20,22 +20,20 @@ class StaticAnalysis
   # contain values that a FOSS installation won't find. To work
   # around this we will only enable this task on EE installations.
   TASKS_BY_DURATIONS_SECONDS_DESC = {
-    %w[bin/rake lint:haml] => 488,
-    (Gitlab.ee? ? %w[bin/rake gettext:updated_check] : nil) => 410,
-    # Most of the time, RuboCop finishes in 30 seconds, but sometimes it can take around 1200 seconds so we set a
-    # duration of 300 to lower the likelihood that it will run in the same job as another long task...
-    %w[bundle exec rubocop --parallel --except Gitlab/MarkUsedFeatureFlags] => 300,
+    %w[bin/rake lint:haml] => 800,
     # We need to disable the cache for this cop since it creates files under tmp/feature_flags/*.used,
     # the cache would prevent these files from being created.
     %w[bundle exec rubocop --only Gitlab/MarkUsedFeatureFlags --cache false] => 600,
-    %w[yarn run lint:eslint:all] => 264,
-    %w[yarn run lint:prettier] => 134,
-    %w[bin/rake gettext:lint] => 81,
-    %w[bundle exec license_finder] => 49,
-    %w[bin/rake lint:static_verification] => 24,
-    %w[bin/rake gitlab:sidekiq:all_queues_yml:check] => 12,
+    (Gitlab.ee? ? %w[bin/rake gettext:updated_check] : nil) => 360,
+    %w[yarn run lint:eslint:all] => 312,
+    %w[yarn run lint:prettier] => 162,
+    %w[bin/rake gettext:lint] => 65,
+    %w[bundle exec license_finder] => 61,
+    %w[bin/rake lint:static_verification] => 45,
+    %w[bundle exec rubocop --parallel] => 40,
+    %w[bin/rake config_lint] => 26,
+    %w[bin/rake gitlab:sidekiq:all_queues_yml:check] => 15,
     (Gitlab.ee? ? %w[bin/rake gitlab:sidekiq:sidekiq_queues_yml:check] : nil) => 11,
-    %w[bin/rake config_lint] => 11,
     %w[yarn run internal:stylelint] => 8,
     %w[scripts/lint-conflicts.sh] => 1,
     %w[yarn run block-dependencies] => 1,
diff --git a/scripts/trigger-build b/scripts/trigger-build
index cb235677b5d..5af45ec09f2 100755
--- a/scripts/trigger-build
+++ b/scripts/trigger-build
@@ -124,14 +124,19 @@ module Trigger
   end
 
   class Omnibus < Base
+    def self.access_token
+      # Default to "Multi-pipeline (from 'gitlab-org/gitlab' 'package-and-qa' job)" at https://gitlab.com/gitlab-org/build/omnibus-gitlab-mirror/-/settings/access_tokens
+      ENV['OMNIBUS_GITLAB_PROJECT_ACCESS_TOKEN'] || super
+    end
+
     private
 
     def downstream_project_path
-      ENV['OMNIBUS_PROJECT_PATH'] || 'gitlab-org/build/omnibus-gitlab-mirror'
+      ENV.fetch('OMNIBUS_PROJECT_PATH', 'gitlab-org/build/omnibus-gitlab-mirror')
     end
 
     def ref
-      ENV['OMNIBUS_BRANCH'] || 'master'
+      ENV.fetch('OMNIBUS_BRANCH', 'master')
     end
 
     def extra_variables
@@ -143,36 +148,33 @@ module Trigger
       {
         'GITLAB_VERSION' => source_sha,
         'IMAGE_TAG' => source_sha,
-        'QA_IMAGE' => "#{ENV['CI_REGISTRY']}/#{ENV['CI_PROJECT_PATH']}/gitlab-ee-qa:#{ENV['CI_COMMIT_REF_SLUG']}",
+        'QA_IMAGE' => ENV['QA_IMAGE'],
         'SKIP_QA_DOCKER' => 'true',
         'ALTERNATIVE_SOURCES' => 'true',
         'SECURITY_SOURCES' => Trigger.security? ? 'true' : 'false',
         'ee' => Trigger.ee? ? 'true' : 'false',
-        'QA_BRANCH' => ENV['QA_BRANCH'] || 'master'
+        'QA_BRANCH' => ENV['QA_BRANCH'] || 'master',
+        'CACHE_UPDATE' => ENV['OMNIBUS_GITLAB_CACHE_UPDATE']
       }
     end
   end
 
   class CNG < Base
+    def self.access_token
+      # Default to "Multi-pipeline (from 'gitlab-org/gitlab' 'cloud-native-image' job)" at https://gitlab.com/gitlab-org/build/CNG/-/settings/access_tokens
+      ENV['CNG_PROJECT_ACCESS_TOKEN'] || super
+    end
+
     private
 
     def downstream_project_path
-      ENV['CNG_PROJECT_PATH'] || 'gitlab-org/build/CNG-mirror'
+      ENV.fetch('CNG_PROJECT_PATH', 'gitlab-org/build/CNG')
     end
 
     def ref
-      default_ref =
-        if ENV['CI_COMMIT_REF_NAME'] =~ /^[\d-]+-stable(-ee)?$/
-          ENV['CI_COMMIT_REF_NAME']
-        else
-          'master'
-        end
-
-      ENV['CNG_BRANCH'] || default_ref
-    end
+      return ENV['CI_COMMIT_REF_NAME'] if ENV['CI_COMMIT_REF_NAME'] =~ /^[\d-]+-stable(-ee)?$/
 
-    def trigger_token
-      ENV['CI_JOB_TOKEN']
+      ENV.fetch('CNG_BRANCH', 'master')
     end
 
     def extra_variables
@@ -204,7 +206,8 @@ module Trigger
 
   class Docs < Base
     def self.access_token
-      ENV['DOCS_PROJECT_API_TOKEN']
+      # Default to "DOCS_PROJECT_API_TOKEN" at https://gitlab.com/gitlab-org/gitlab-docs/-/settings/access_tokens
+      ENV['DOCS_PROJECT_API_TOKEN'] || super
     end
 
     SUCCESS_MESSAGE = <<~MSG
@@ -253,11 +256,11 @@ module Trigger
     end
 
     def downstream_project_path
-      ENV['DOCS_PROJECT_PATH'] || 'gitlab-org/gitlab-docs'
+      ENV.fetch('DOCS_PROJECT_PATH', 'gitlab-org/gitlab-docs')
     end
 
     def ref
-      ENV['DOCS_BRANCH'] || 'main'
+      ENV.fetch('DOCS_BRANCH', 'main')
     end
 
     # `gitlab-org/gitlab-docs` pipeline trigger "Triggered from gitlab-org/gitlab 'review-docs-deploy' job"
@@ -349,7 +352,7 @@ module Trigger
     end
 
     def downstream_project_path
-      ENV['GITLABCOM_DATABASE_TESTING_PROJECT_PATH'] || 'gitlab-com/database-team/gitlab-com-database-testing'
+      ENV.fetch('GITLABCOM_DATABASE_TESTING_PROJECT_PATH', 'gitlab-com/database-team/gitlab-com-database-testing')
     end
 
     def extra_variables