Merge remote-tracking branch 'origin/master' into 18608-lock-issues

16 files changed, 204 insertions, 119 deletions

diff --git a/spec/requests/api/access_requests_spec.rb b/spec/requests/api/access_requests_spec.rb
index 6bd17697c33..50d0f72f6bc 100644
--- a/spec/requests/api/access_requests_spec.rb
+++ b/spec/requests/api/access_requests_spec.rb
@@ -1,12 +1,12 @@
 require 'spec_helper'
 
 describe API::AccessRequests do
-  let(:master) { create(:user) }
-  let(:developer) { create(:user) }
-  let(:access_requester) { create(:user) }
-  let(:stranger) { create(:user) }
+  set(:master) { create(:user) }
+  set(:developer) { create(:user) }
+  set(:access_requester) { create(:user) }
+  set(:stranger) { create(:user) }
 
-  let(:project) do
+  set(:project) do
     create(:project, :public, :access_requestable, creator_id: master.id, namespace: master.namespace) do |project|
       project.team << [developer, :developer]
       project.team << [master, :master]
@@ -14,7 +14,7 @@ describe API::AccessRequests do
     end
   end
 
-  let(:group) do
+  set(:group) do
     create(:group, :public, :access_requestable) do |group|
       group.add_developer(developer)
       group.add_owner(master)
diff --git a/spec/requests/api/award_emoji_spec.rb b/spec/requests/api/award_emoji_spec.rb
index 593068b8cd7..7a0765c1fae 100644
--- a/spec/requests/api/award_emoji_spec.rb
+++ b/spec/requests/api/award_emoji_spec.rb
@@ -1,13 +1,13 @@
 require 'spec_helper'
 
 describe API::AwardEmoji do
-  let(:user)            { create(:user) }
-  let!(:project)        { create(:project) }
-  let(:issue)           { create(:issue, project: project) }
-  let!(:award_emoji)    { create(:award_emoji, awardable: issue, user: user) }
-  let!(:merge_request)  { create(:merge_request, source_project: project, target_project: project) }
-  let!(:downvote)       { create(:award_emoji, :downvote, awardable: merge_request, user: user) }
-  let!(:note)           { create(:note, project: project, noteable: issue) }
+  set(:user)           { create(:user) }
+  set(:project)        { create(:project) }
+  set(:issue)          { create(:issue, project: project) }
+  set(:award_emoji)    { create(:award_emoji, awardable: issue, user: user) }
+  let!(:merge_request) { create(:merge_request, source_project: project, target_project: project) }
+  let!(:downvote)      { create(:award_emoji, :downvote, awardable: merge_request, user: user) }
+  set(:note)          { create(:note, project: project, noteable: issue) }
 
   before do
     project.team << [user, :master]
diff --git a/spec/requests/api/boards_spec.rb b/spec/requests/api/boards_spec.rb
index f698d5dddb3..fcfa4ddfbfe 100644
--- a/spec/requests/api/boards_spec.rb
+++ b/spec/requests/api/boards_spec.rb
@@ -1,34 +1,34 @@
 require 'spec_helper'
 
 describe API::Boards do
-  let(:user)        { create(:user) }
-  let(:user2)       { create(:user) }
-  let(:non_member)  { create(:user) }
-  let(:guest)       { create(:user) }
-  let(:admin)       { create(:user, :admin) }
-  let!(:project)    { create(:project, :public, creator_id: user.id, namespace: user.namespace ) }
-
-  let!(:dev_label) do
+  set(:user)        { create(:user) }
+  set(:user2)       { create(:user) }
+  set(:non_member)  { create(:user) }
+  set(:guest)       { create(:user) }
+  set(:admin)       { create(:user, :admin) }
+  set(:project)    { create(:project, :public, creator_id: user.id, namespace: user.namespace ) }
+
+  set(:dev_label) do
     create(:label, title: 'Development', color: '#FFAABB', project: project)
   end
 
-  let!(:test_label) do
+  set(:test_label) do
     create(:label, title: 'Testing', color: '#FFAACC', project: project)
   end
 
-  let!(:ux_label) do
+  set(:ux_label) do
     create(:label, title: 'UX', color: '#FF0000', project: project)
   end
 
-  let!(:dev_list) do
+  set(:dev_list) do
     create(:list, label: dev_label, position: 1)
   end
 
-  let!(:test_list) do
+  set(:test_list) do
     create(:list, label: test_label, position: 2)
   end
 
-  let!(:board) do
+  set(:board) do
     create(:board, project: project, lists: [dev_list, test_list])
   end
 
@@ -187,8 +187,11 @@ describe API::Boards do
     end
 
     context "when the user is project owner" do
-      let(:owner)     { create(:user) }
-      let(:project)   { create(:project, namespace: owner.namespace) }
+      set(:owner) { create(:user) }
+
+      before do
+        project.update(namespace: owner.namespace)
+      end
 
       it "deletes the list if an admin requests it" do
         delete api("#{base_url}/#{dev_list.id}", owner)
diff --git a/spec/requests/api/branches_spec.rb b/spec/requests/api/branches_spec.rb
index cc794fad3a7..16b12446ed4 100644
--- a/spec/requests/api/branches_spec.rb
+++ b/spec/requests/api/branches_spec.rb
@@ -1,9 +1,9 @@
 require 'spec_helper'
 
 describe API::Branches do
-  let(:user) { create(:user) }
-  let(:guest) { create(:user).tap { |u| project.add_guest(u) } }
+  set(:user) { create(:user) }
   let(:project) { create(:project, :repository, creator: user, path: 'my.project') }
+  let(:guest) { create(:user).tap { |u| project.add_guest(u) } }
   let(:branch_name) { 'feature' }
   let(:branch_sha) { '0b4bc9a49b562e85de7cc9e834518ea6828729b9' }
   let(:branch_with_dot) { project.repository.find_branch('ends-with.json') }
@@ -40,7 +40,9 @@ describe API::Branches do
     end
 
     context 'when unauthenticated', 'and project is public' do
-      let(:project) { create(:project, :public, :repository) }
+      before do
+        project.update(visibility_level: Gitlab::VisibilityLevel::PUBLIC)
+      end
 
       it_behaves_like 'repository branches'
     end
@@ -118,7 +120,9 @@ describe API::Branches do
     end
 
     context 'when unauthenticated', 'and project is public' do
-      let(:project) { create(:project, :public, :repository) }
+      before do
+        project.update(visibility_level: Gitlab::VisibilityLevel::PUBLIC)
+      end
 
       it_behaves_like 'repository branch'
     end
diff --git a/spec/requests/api/broadcast_messages_spec.rb b/spec/requests/api/broadcast_messages_spec.rb
index b043a333d33..eacc575d97f 100644
--- a/spec/requests/api/broadcast_messages_spec.rb
+++ b/spec/requests/api/broadcast_messages_spec.rb
@@ -1,8 +1,9 @@
 require 'spec_helper'
 
 describe API::BroadcastMessages do
-  let(:user)  { create(:user) }
-  let(:admin) { create(:admin) }
+  set(:user)  { create(:user) }
+  set(:admin) { create(:admin) }
+  set(:message) { create(:broadcast_message) }
 
   describe 'GET /broadcast_messages' do
     it 'returns a 401 for anonymous users' do
@@ -31,8 +32,6 @@ describe API::BroadcastMessages do
   end
 
   describe 'GET /broadcast_messages/:id' do
-    let!(:message) { create(:broadcast_message) }
-
     it 'returns a 401 for anonymous users' do
       get api("/broadcast_messages/#{message.id}")
 
@@ -103,8 +102,6 @@ describe API::BroadcastMessages do
   end
 
   describe 'PUT /broadcast_messages/:id' do
-    let!(:message) { create(:broadcast_message) }
-
     it 'returns a 401 for anonymous users' do
       put api("/broadcast_messages/#{message.id}"),
         attributes_for(:broadcast_message)
@@ -155,8 +152,6 @@ describe API::BroadcastMessages do
   end
 
   describe 'DELETE /broadcast_messages/:id' do
-    let!(:message) { create(:broadcast_message) }
-
     it 'returns a 401 for anonymous users' do
       delete api("/broadcast_messages/#{message.id}"),
         attributes_for(:broadcast_message)
diff --git a/spec/requests/api/groups_spec.rb b/spec/requests/api/groups_spec.rb
index 42f0079e173..1671a046fdf 100644
--- a/spec/requests/api/groups_spec.rb
+++ b/spec/requests/api/groups_spec.rb
@@ -159,11 +159,14 @@ describe API::Groups do
 
     context 'when using owned in the request' do
       it 'returns an array of groups the user owns' do
+        group1.add_master(user2)
+
         get api('/groups', user2), owned: true
 
         expect(response).to have_http_status(200)
         expect(response).to include_pagination_headers
         expect(json_response).to be_an Array
+        expect(json_response.length).to eq(1)
         expect(json_response.first['name']).to eq(group2.name)
       end
     end
diff --git a/spec/requests/api/issues_spec.rb b/spec/requests/api/issues_spec.rb
index 1583d1c2435..972e57bc373 100644
--- a/spec/requests/api/issues_spec.rb
+++ b/spec/requests/api/issues_spec.rb
@@ -22,7 +22,8 @@ describe API::Issues, :mailer do
            state: :closed,
            milestone: milestone,
            created_at: generate(:past_time),
-           updated_at: 3.hours.ago
+           updated_at: 3.hours.ago,
+           closed_at: 1.hour.ago
   end
   let!(:confidential_issue) do
     create :issue,
@@ -738,6 +739,7 @@ describe API::Issues, :mailer do
       expect(json_response['title']).to eq(issue.title)
       expect(json_response['description']).to eq(issue.description)
       expect(json_response['state']).to eq(issue.state)
+      expect(json_response['closed_at']).to be_falsy
       expect(json_response['created_at']).to be_present
       expect(json_response['updated_at']).to be_present
       expect(json_response['labels']).to eq(issue.label_names)
@@ -748,6 +750,13 @@ describe API::Issues, :mailer do
       expect(json_response['confidential']).to be_falsy
     end
 
+    it "exposes the 'closed_at' attribute" do
+      get api("/projects/#{project.id}/issues/#{closed_issue.iid}", user)
+
+      expect(response).to have_http_status(200)
+      expect(json_response['closed_at']).to be_present
+    end
+
     context 'links exposure' do
       it 'exposes related resources full URIs' do
         get api("/projects/#{project.id}/issues/#{issue.iid}", user)
diff --git a/spec/requests/api/merge_requests_spec.rb b/spec/requests/api/merge_requests_spec.rb
index 21d2c9644fb..c4f6e97b915 100644
--- a/spec/requests/api/merge_requests_spec.rb
+++ b/spec/requests/api/merge_requests_spec.rb
@@ -28,10 +28,29 @@ describe API::MergeRequests do
 
   describe 'GET /merge_requests' do
     context 'when unauthenticated' do
-      it 'returns authentication error' do
-        get api('/merge_requests')
+      it 'returns an array of all merge requests' do
+        get api('/merge_requests', user), scope: 'all'
+
+        expect(response).to have_http_status(200)
+        expect(json_response).to be_an Array
+      end
+
+      it "returns authentication error without any scope" do
+        get api("/merge_requests")
+
+        expect(response).to have_http_status(401)
+      end
+
+      it "returns authentication error  when scope is assigned-to-me" do
+        get api("/merge_requests"), scope: 'assigned-to-me'
 
-        expect(response).to have_gitlab_http_status(401)
+        expect(response).to have_http_status(401)
+      end
+
+      it "returns authentication error  when scope is created-by-me" do
+        get api("/merge_requests"), scope: 'created-by-me'
+
+        expect(response).to have_http_status(401)
       end
     end
 
@@ -134,10 +153,18 @@ describe API::MergeRequests do
 
   describe "GET /projects/:id/merge_requests" do
     context "when unauthenticated" do
-      it "returns authentication error" do
+      it 'returns merge requests for public projects' do
+        get api("/projects/#{project.id}/merge_requests")
+
+        expect(response).to have_http_status(200)
+        expect(json_response).to be_an Array
+      end
+
+      it "returns 404 for non public projects" do
+        project = create(:project, :private)
         get api("/projects/#{project.id}/merge_requests")
 
-        expect(response).to have_gitlab_http_status(401)
+        expect(response).to have_http_status(404)
       end
     end
 
diff --git a/spec/requests/api/projects_spec.rb b/spec/requests/api/projects_spec.rb
index 92e7d797cbd..508df990952 100644
--- a/spec/requests/api/projects_spec.rb
+++ b/spec/requests/api/projects_spec.rb
@@ -1181,6 +1181,59 @@ describe API::Projects do
         end
       end
     end
+
+    describe 'GET /projects/:id/forks' do
+      let(:private_fork) { create(:project, :private, :empty_repo) }
+      let(:member) { create(:user) }
+      let(:non_member) { create(:user) }
+
+      before do
+        private_fork.add_developer(member)
+      end
+
+      context 'for a forked project' do
+        before do
+          post api("/projects/#{private_fork.id}/fork/#{project_fork_source.id}", admin)
+          private_fork.reload
+          expect(private_fork.forked_from_project).not_to be_nil
+          expect(private_fork.forked?).to be_truthy
+          project_fork_source.reload
+          expect(project_fork_source.forks.length).to eq(1)
+          expect(project_fork_source.forks).to include(private_fork)
+        end
+
+        context 'for a user that can access the forks' do
+          it 'returns the forks' do
+            get api("/projects/#{project_fork_source.id}/forks", member)
+
+            expect(response).to have_http_status(200)
+            expect(response).to include_pagination_headers
+            expect(json_response.length).to eq(1)
+            expect(json_response[0]['name']).to eq(private_fork.name)
+          end
+        end
+
+        context 'for a user that cannot access the forks' do
+          it 'returns an empty array' do
+            get api("/projects/#{project_fork_source.id}/forks", non_member)
+
+            expect(response).to have_http_status(200)
+            expect(response).to include_pagination_headers
+            expect(json_response.length).to eq(0)
+          end
+        end
+      end
+
+      context 'for a non-forked project' do
+        it 'returns an empty array' do
+          get api("/projects/#{project_fork_source.id}/forks")
+
+          expect(response).to have_http_status(200)
+          expect(response).to include_pagination_headers
+          expect(json_response.length).to eq(0)
+        end
+      end
+    end
   end
 
   describe "POST /projects/:id/share" do
diff --git a/spec/requests/api/users_spec.rb b/spec/requests/api/users_spec.rb
index 37cb95a16e3..5b306ec6cbf 100644
--- a/spec/requests/api/users_spec.rb
+++ b/spec/requests/api/users_spec.rb
@@ -23,8 +23,7 @@ describe API::Users do
       it "returns the user when a valid `username` parameter is passed" do
         get api("/users"), username: user.username
 
-        expect(response).to have_gitlab_http_status(200)
-        expect(json_response).to be_an Array
+        expect(response).to match_response_schema('public_api/v4/user/basics')
         expect(json_response.size).to eq(1)
         expect(json_response[0]['id']).to eq(user.id)
         expect(json_response[0]['username']).to eq(user.username)
@@ -68,7 +67,7 @@ describe API::Users do
           it "renders 200" do
             get api("/users", user)
 
-            expect(response).to have_gitlab_http_status(200)
+            expect(response).to match_response_schema('public_api/v4/user/basics')
           end
         end
 
@@ -76,7 +75,7 @@ describe API::Users do
           it "renders 200" do
             get api("/users", admin)
 
-            expect(response).to have_gitlab_http_status(200)
+            expect(response).to match_response_schema('public_api/v4/user/basics')
           end
         end
       end
@@ -84,9 +83,8 @@ describe API::Users do
       it "returns an array of users" do
         get api("/users", user)
 
-        expect(response).to have_http_status(200)
+        expect(response).to match_response_schema('public_api/v4/user/basics')
         expect(response).to include_pagination_headers
-        expect(json_response).to be_an Array
         username = user.username
         expect(json_response.detect do |user|
           user['username'] == username
@@ -99,18 +97,16 @@ describe API::Users do
 
         get api("/users?blocked=true", user)
 
-        expect(response).to have_http_status(200)
+        expect(response).to match_response_schema('public_api/v4/user/basics')
         expect(response).to include_pagination_headers
-        expect(json_response).to be_an Array
         expect(json_response).to all(include('state' => /(blocked|ldap_blocked)/))
       end
 
       it "returns one user" do
         get api("/users?username=#{omniauth_user.username}", user)
 
-        expect(response).to have_http_status(200)
+        expect(response).to match_response_schema('public_api/v4/user/basics')
         expect(response).to include_pagination_headers
-        expect(json_response).to be_an Array
         expect(json_response.first['username']).to eq(omniauth_user.username)
       end
 
@@ -123,6 +119,7 @@ describe API::Users do
       it 'does not reveal the `is_admin` flag of the user' do
         get api('/users', user)
 
+        expect(response).to match_response_schema('public_api/v4/user/basics')
         expect(json_response.first.keys).not_to include 'is_admin'
       end
     end
@@ -131,17 +128,8 @@ describe API::Users do
       it "returns an array of users" do
         get api("/users", admin)
 
-        expect(response).to have_http_status(200)
+        expect(response).to match_response_schema('public_api/v4/user/admins')
         expect(response).to include_pagination_headers
-        expect(json_response).to be_an Array
-        expect(json_response.first.keys).to include 'email'
-        expect(json_response.first.keys).to include 'organization'
-        expect(json_response.first.keys).to include 'identities'
-        expect(json_response.first.keys).to include 'can_create_project'
-        expect(json_response.first.keys).to include 'two_factor_enabled'
-        expect(json_response.first.keys).to include 'last_sign_in_at'
-        expect(json_response.first.keys).to include 'confirmed_at'
-        expect(json_response.first.keys).to include 'is_admin'
       end
 
       it "returns an array of external users" do
@@ -149,17 +137,15 @@ describe API::Users do
 
         get api("/users?external=true", admin)
 
-        expect(response).to have_http_status(200)
+        expect(response).to match_response_schema('public_api/v4/user/admins')
         expect(response).to include_pagination_headers
-        expect(json_response).to be_an Array
         expect(json_response).to all(include('external' => true))
       end
 
       it "returns one user by external UID" do
         get api("/users?extern_uid=#{omniauth_user.identities.first.extern_uid}&provider=#{omniauth_user.identities.first.provider}", admin)
 
-        expect(response).to have_http_status(200)
-        expect(json_response).to be_an Array
+        expect(response).to match_response_schema('public_api/v4/user/admins')
         expect(json_response.size).to eq(1)
         expect(json_response.first['username']).to eq(omniauth_user.username)
       end
@@ -181,7 +167,7 @@ describe API::Users do
 
         get api("/users?created_before=2000-01-02T00:00:00.060Z", admin)
 
-        expect(response).to have_http_status(200)
+        expect(response).to match_response_schema('public_api/v4/user/admins')
         expect(json_response.size).to eq(1)
         expect(json_response.first['username']).to eq(user.username)
       end
@@ -191,7 +177,7 @@ describe API::Users do
 
         get api("/users?created_before=2000-01-02T00:00:00.060Z", admin)
 
-        expect(response).to have_http_status(200)
+        expect(response).to match_response_schema('public_api/v4/user/admins')
         expect(json_response.size).to eq(0)
       end
 
@@ -200,7 +186,7 @@ describe API::Users do
 
         get api("/users?created_before=2001-01-02T00:00:00.060Z&created_after=1999-01-02T00:00:00.060", admin)
 
-        expect(response).to have_http_status(200)
+        expect(response).to match_response_schema('public_api/v4/user/admins')
         expect(json_response.size).to eq(1)
         expect(json_response.first['username']).to eq(user.username)
       end
@@ -211,22 +197,22 @@ describe API::Users do
     it "returns a user by id" do
       get api("/users/#{user.id}", user)
 
-      expect(response).to have_http_status(200)
+      expect(response).to match_response_schema('public_api/v4/user/basic')
       expect(json_response['username']).to eq(user.username)
     end
 
     it "does not return the user's `is_admin` flag" do
       get api("/users/#{user.id}", user)
 
-      expect(response).to have_http_status(200)
-      expect(json_response['is_admin']).to be_nil
+      expect(response).to match_response_schema('public_api/v4/user/basic')
+      expect(json_response.keys).not_to include 'is_admin'
     end
 
     context 'when authenticated as admin' do
       it 'includes the `is_admin` field' do
         get api("/users/#{user.id}", admin)
 
-        expect(response).to have_http_status(200)
+        expect(response).to match_response_schema('public_api/v4/user/admin')
         expect(json_response['is_admin']).to be(false)
       end
     end
@@ -235,7 +221,7 @@ describe API::Users do
       it "returns a user by id" do
         get api("/users/#{user.id}")
 
-        expect(response).to have_http_status(200)
+        expect(response).to match_response_schema('public_api/v4/user/basic')
         expect(json_response['username']).to eq(user.username)
       end
 
@@ -251,6 +237,7 @@ describe API::Users do
 
     it "returns a 404 error if user id not found" do
       get api("/users/9999", user)
+
       expect(response).to have_http_status(404)
       expect(json_response['message']).to eq('404 User Not Found')
     end
diff --git a/spec/requests/api/v3/award_emoji_spec.rb b/spec/requests/api/v3/award_emoji_spec.rb
index 681e8e04295..36d793f505d 100644
--- a/spec/requests/api/v3/award_emoji_spec.rb
+++ b/spec/requests/api/v3/award_emoji_spec.rb
@@ -1,13 +1,13 @@
 require 'spec_helper'
 
 describe API::V3::AwardEmoji do
-  let(:user)            { create(:user) }
-  let!(:project)        { create(:project) }
-  let(:issue)           { create(:issue, project: project) }
-  let!(:award_emoji)    { create(:award_emoji, awardable: issue, user: user) }
-  let!(:merge_request)  { create(:merge_request, source_project: project, target_project: project) }
-  let!(:downvote)       { create(:award_emoji, :downvote, awardable: merge_request, user: user) }
-  let!(:note)           { create(:note, project: project, noteable: issue) }
+  set(:user)           { create(:user) }
+  set(:project)        { create(:project) }
+  set(:issue)          { create(:issue, project: project) }
+  set(:award_emoji)    { create(:award_emoji, awardable: issue, user: user) }
+  let!(:merge_request) { create(:merge_request, source_project: project, target_project: project) }
+  let!(:downvote)      { create(:award_emoji, :downvote, awardable: merge_request, user: user) }
+  set(:note)           { create(:note, project: project, noteable: issue) }
 
   before { project.team << [user, :master] }
 
diff --git a/spec/requests/api/v3/boards_spec.rb b/spec/requests/api/v3/boards_spec.rb
index b86aab2ec70..ea2627142bf 100644
--- a/spec/requests/api/v3/boards_spec.rb
+++ b/spec/requests/api/v3/boards_spec.rb
@@ -1,28 +1,28 @@
 require 'spec_helper'
 
 describe API::V3::Boards do
-  let(:user)        { create(:user) }
-  let(:guest)       { create(:user) }
-  let(:non_member)  { create(:user) }
-  let!(:project)    { create(:project, :public, creator_id: user.id, namespace: user.namespace ) }
+  set(:user)        { create(:user) }
+  set(:guest)       { create(:user) }
+  set(:non_member)  { create(:user) }
+  set(:project)    { create(:project, :public, creator_id: user.id, namespace: user.namespace ) }
 
-  let!(:dev_label) do
+  set(:dev_label) do
     create(:label, title: 'Development', color: '#FFAABB', project: project)
   end
 
-  let!(:test_label) do
+  set(:test_label) do
     create(:label, title: 'Testing', color: '#FFAACC', project: project)
   end
 
-  let!(:dev_list) do
+  set(:dev_list) do
     create(:list, label: dev_label, position: 1)
   end
 
-  let!(:test_list) do
+  set(:test_list) do
     create(:list, label: test_label, position: 2)
   end
 
-  let!(:board) do
+  set(:board) do
     create(:board, project: project, lists: [dev_list, test_list])
   end
 
@@ -98,8 +98,11 @@ describe API::V3::Boards do
     end
 
     context "when the user is project owner" do
-      let(:owner)     { create(:user) }
-      let(:project)   { create(:project, namespace: owner.namespace) }
+      set(:owner) { create(:user) }
+
+      before do
+        project.update(namespace: owner.namespace)
+      end
 
       it "deletes the list if an admin requests it" do
         delete v3_api("#{base_url}/#{dev_list.id}", owner)
diff --git a/spec/requests/api/v3/branches_spec.rb b/spec/requests/api/v3/branches_spec.rb
index c88f7788697..9cd11a67712 100644
--- a/spec/requests/api/v3/branches_spec.rb
+++ b/spec/requests/api/v3/branches_spec.rb
@@ -2,11 +2,11 @@ require 'spec_helper'
 require 'mime/types'
 
 describe API::V3::Branches do
-  let(:user) { create(:user) }
-  let(:user2) { create(:user) }
-  let!(:project) { create(:project, :repository, creator: user) }
-  let!(:master) { create(:project_member, :master, user: user, project: project) }
-  let!(:guest) { create(:project_member, :guest, user: user2, project: project) }
+  set(:user) { create(:user) }
+  set(:user2) { create(:user) }
+  set(:project) { create(:project, :repository, creator: user) }
+  set(:master) { create(:project_member, :master, user: user, project: project) }
+  set(:guest) { create(:project_member, :guest, user: user2, project: project) }
   let!(:branch_name) { 'feature' }
   let!(:branch_sha) { '0b4bc9a49b562e85de7cc9e834518ea6828729b9' }
   let!(:branch_with_dot) { CreateBranchService.new(project, user).execute("with.1.2.3", "master") }
diff --git a/spec/requests/api/v3/broadcast_messages_spec.rb b/spec/requests/api/v3/broadcast_messages_spec.rb
index 948cd78c177..d04b1c72004 100644
--- a/spec/requests/api/v3/broadcast_messages_spec.rb
+++ b/spec/requests/api/v3/broadcast_messages_spec.rb
@@ -1,11 +1,11 @@
 require 'spec_helper'
 
 describe API::V3::BroadcastMessages do
-  let(:user)  { create(:user) }
-  let(:admin) { create(:admin) }
+  set(:user)  { create(:user) }
+  set(:admin) { create(:admin) }
 
   describe 'DELETE /broadcast_messages/:id' do
-    let!(:message) { create(:broadcast_message) }
+    set(:message) { create(:broadcast_message) }
 
     it 'returns a 401 for anonymous users' do
       delete v3_api("/broadcast_messages/#{message.id}"),
diff --git a/spec/requests/api/v3/builds_spec.rb b/spec/requests/api/v3/builds_spec.rb
index dc95599546c..0a2ff1058e3 100644
--- a/spec/requests/api/v3/builds_spec.rb
+++ b/spec/requests/api/v3/builds_spec.rb
@@ -1,13 +1,13 @@
 require 'spec_helper'
 
 describe API::V3::Builds do
-  let(:user) { create(:user) }
+  set(:user) { create(:user) }
   let(:api_user) { user }
-  let!(:project) { create(:project, :repository, creator: user, public_builds: false) }
-  let!(:developer) { create(:project_member, :developer, user: user, project: project) }
-  let(:reporter) { create(:project_member, :reporter, project: project) }
-  let(:guest) { create(:project_member, :guest, project: project) }
-  let!(:pipeline) { create(:ci_empty_pipeline, project: project, sha: project.commit.id, ref: project.default_branch) }
+  set(:project) { create(:project, :repository, creator: user, public_builds: false) }
+  set(:developer) { create(:project_member, :developer, user: user, project: project) }
+  set(:reporter) { create(:project_member, :reporter, project: project) }
+  set(:guest) { create(:project_member, :guest, project: project) }
+  set(:pipeline) { create(:ci_empty_pipeline, project: project, sha: project.commit.id, ref: project.default_branch) }
   let!(:build) { create(:ci_build, pipeline: pipeline) }
 
   describe 'GET /projects/:id/builds ' do
diff --git a/spec/requests/api/v3/issues_spec.rb b/spec/requests/api/v3/issues_spec.rb
index 9a0e6647ebf..86768d7397a 100644
--- a/spec/requests/api/v3/issues_spec.rb
+++ b/spec/requests/api/v3/issues_spec.rb
@@ -1,13 +1,13 @@
 require 'spec_helper'
 
 describe API::V3::Issues, :mailer do
-  let(:user)        { create(:user) }
-  let(:user2)       { create(:user) }
-  let(:non_member)  { create(:user) }
-  let(:guest)       { create(:user) }
-  let(:author)      { create(:author) }
-  let(:assignee)    { create(:assignee) }
-  let(:admin)       { create(:user, :admin) }
+  set(:user)        { create(:user) }
+  set(:user2)       { create(:user) }
+  set(:non_member)  { create(:user) }
+  set(:guest)       { create(:user) }
+  set(:author)      { create(:author) }
+  set(:assignee)    { create(:assignee) }
+  set(:admin)       { create(:user, :admin) }
   let!(:project)    { create(:project, :public, creator_id: user.id, namespace: user.namespace ) }
   let!(:closed_issue) do
     create :closed_issue,
@@ -822,7 +822,8 @@ describe API::V3::Issues, :mailer do
     end
 
     context 'resolving issues in a merge request' do
-      let(:discussion) { create(:diff_note_on_merge_request).to_discussion }
+      set(:diff_note_on_merge_request) { create(:diff_note_on_merge_request) }
+      let(:discussion) { diff_note_on_merge_request.to_discussion }
       let(:merge_request) { discussion.noteable }
       let(:project) { merge_request.source_project }
       before do
@@ -1169,7 +1170,7 @@ describe API::V3::Issues, :mailer do
     end
 
     context "when the user is project owner" do
-      let(:owner)     { create(:user) }
+      set(:owner)     { create(:user) }
       let(:project)   { create(:project, namespace: owner.namespace) }
 
       it "deletes the issue if an admin requests it" do