Merge branch 'master' into feature/gb/manual-actions-protected-branches-permissions

* master: (641 commits)
  Revert "Fix registry for projects with uppercases in path"
  Fix registry for projects with uppercases in path
  Move event icons into events_helper
  Reset New branch button when issue state changes
  Add link to environments on kubernetes.md
  Indent system notes on desktop screens
  Improve webpack-dev-server compatibility with non-localhost setups.
  Add changelog entry
  Fix recent searches icon alignment in Safari
  Use preload to avoid Rails using JOIN
  Fix NUMBER_OF_TRUNCATED_DIFF_LINES re-definition error
  Prepare for zero downtime migrations
  Fix filtered search input width for IE
  Fix the `gitlab:gitlab_shell:check` task
  Fixed random failures with Poll spec
  Include CONTRIBUTING.md file when importing .gitlab-ci.yml templates
  Let uses hide verbose output by default
  Separate examples for each other
  Collapse similar sibling scenarios
  Use empty_project for resources that are independent of the repo
  ...

Conflicts:
	app/views/projects/ci/builds/_build.html.haml

19 files changed, 522 insertions, 166 deletions

diff --git a/spec/services/auth/container_registry_authentication_service_spec.rb b/spec/services/auth/container_registry_authentication_service_spec.rb
index b91234ddb1e..e273dfe1552 100644
--- a/spec/services/auth/container_registry_authentication_service_spec.rb
+++ b/spec/services/auth/container_registry_authentication_service_spec.rb
@@ -6,14 +6,15 @@ describe Auth::ContainerRegistryAuthenticationService, services: true do
   let(:current_params) { {} }
   let(:rsa_key) { OpenSSL::PKey::RSA.generate(512) }
   let(:payload) { JWT.decode(subject[:token], rsa_key).first }
+
   let(:authentication_abilities) do
-    [
-      :read_container_image,
-      :create_container_image
-    ]
+    [:read_container_image, :create_container_image]
   end
 
-  subject { described_class.new(current_project, current_user, current_params).execute(authentication_abilities: authentication_abilities) }
+  subject do
+    described_class.new(current_project, current_user, current_params)
+      .execute(authentication_abilities: authentication_abilities)
+  end
 
   before do
     allow(Gitlab.config.registry).to receive_messages(enabled: true, issuer: 'rspec', key: nil)
@@ -40,13 +41,11 @@ describe Auth::ContainerRegistryAuthenticationService, services: true do
     end
   end
 
-  shared_examples 'a accessible' do
+  shared_examples 'an accessible' do
     let(:access) do
-      [{
-         'type' => 'repository',
+      [{ 'type' => 'repository',
          'name' => project.path_with_namespace,
-         'actions' => actions,
-       }]
+         'actions' => actions }]
     end
 
     it_behaves_like 'a valid token'
@@ -59,19 +58,19 @@ describe Auth::ContainerRegistryAuthenticationService, services: true do
   end
 
   shared_examples 'a pullable' do
-    it_behaves_like 'a accessible' do
+    it_behaves_like 'an accessible' do
       let(:actions) { ['pull'] }
     end
   end
 
   shared_examples 'a pushable' do
-    it_behaves_like 'a accessible' do
+    it_behaves_like 'an accessible' do
       let(:actions) { ['push'] }
     end
   end
 
   shared_examples 'a pullable and pushable' do
-    it_behaves_like 'a accessible' do
+    it_behaves_like 'an accessible' do
       let(:actions) { %w(pull push) }
     end
   end
@@ -81,15 +80,30 @@ describe Auth::ContainerRegistryAuthenticationService, services: true do
     it { is_expected.not_to include(:token) }
   end
 
+  shared_examples 'container repository factory' do
+    it 'creates a new container repository resource' do
+      expect { subject }
+        .to change { project.container_repositories.count }.by(1)
+    end
+  end
+
+  shared_examples 'not a container repository factory' do
+    it 'does not create a new container repository resource' do
+      expect { subject }.not_to change { ContainerRepository.count }
+    end
+  end
+
   describe '#full_access_token' do
     let(:project) { create(:empty_project) }
     let(:token) { described_class.full_access_token(project.path_with_namespace) }
 
     subject { { token: token } }
 
-    it_behaves_like 'a accessible' do
+    it_behaves_like 'an accessible' do
       let(:actions) { ['*'] }
     end
+
+    it_behaves_like 'not a container repository factory'
   end
 
   context 'user authorization' do
@@ -110,16 +124,20 @@ describe Auth::ContainerRegistryAuthenticationService, services: true do
         end
 
         it_behaves_like 'a pushable'
+        it_behaves_like 'container repository factory'
       end
 
       context 'allow reporter to pull images' do
         before { project.team << [current_user, :reporter] }
 
-        let(:current_params) do
-          { scope: "repository:#{project.path_with_namespace}:pull" }
-        end
+        context 'when pulling from root level repository' do
+          let(:current_params) do
+            { scope: "repository:#{project.path_with_namespace}:pull" }
+          end
 
-        it_behaves_like 'a pullable'
+          it_behaves_like 'a pullable'
+          it_behaves_like 'not a container repository factory'
+        end
       end
 
       context 'return a least of privileges' do
@@ -130,6 +148,7 @@ describe Auth::ContainerRegistryAuthenticationService, services: true do
         end
 
         it_behaves_like 'a pullable'
+        it_behaves_like 'not a container repository factory'
       end
 
       context 'disallow guest to pull or push images' do
@@ -140,6 +159,7 @@ describe Auth::ContainerRegistryAuthenticationService, services: true do
         end
 
         it_behaves_like 'an inaccessible'
+        it_behaves_like 'not a container repository factory'
       end
     end
 
@@ -152,6 +172,7 @@ describe Auth::ContainerRegistryAuthenticationService, services: true do
         end
 
         it_behaves_like 'a pullable'
+        it_behaves_like 'not a container repository factory'
       end
 
       context 'disallow anyone to push images' do
@@ -160,6 +181,16 @@ describe Auth::ContainerRegistryAuthenticationService, services: true do
         end
 
         it_behaves_like 'an inaccessible'
+        it_behaves_like 'not a container repository factory'
+      end
+
+      context 'when repository name is invalid' do
+        let(:current_params) do
+          { scope: 'repository:invalid:push' }
+        end
+
+        it_behaves_like 'an inaccessible'
+        it_behaves_like 'not a container repository factory'
       end
     end
 
@@ -173,6 +204,7 @@ describe Auth::ContainerRegistryAuthenticationService, services: true do
           end
 
           it_behaves_like 'a pullable'
+          it_behaves_like 'not a container repository factory'
         end
 
         context 'disallow anyone to push images' do
@@ -181,6 +213,7 @@ describe Auth::ContainerRegistryAuthenticationService, services: true do
           end
 
           it_behaves_like 'an inaccessible'
+          it_behaves_like 'not a container repository factory'
         end
       end
 
@@ -191,6 +224,7 @@ describe Auth::ContainerRegistryAuthenticationService, services: true do
         end
 
         it_behaves_like 'an inaccessible'
+        it_behaves_like 'not a container repository factory'
       end
     end
   end
@@ -198,11 +232,9 @@ describe Auth::ContainerRegistryAuthenticationService, services: true do
   context 'build authorized as user' do
     let(:current_project) { create(:empty_project) }
     let(:current_user) { create(:user) }
+
     let(:authentication_abilities) do
-      [
-        :build_read_container_image,
-        :build_create_container_image
-      ]
+      [:build_read_container_image, :build_create_container_image]
     end
 
     before do
@@ -219,6 +251,10 @@ describe Auth::ContainerRegistryAuthenticationService, services: true do
       it_behaves_like 'a pullable and pushable' do
         let(:project) { current_project }
       end
+
+      it_behaves_like 'container repository factory' do
+        let(:project) { current_project }
+      end
     end
 
     context 'for other projects' do
@@ -231,11 +267,13 @@ describe Auth::ContainerRegistryAuthenticationService, services: true do
           let(:project) { create(:empty_project, :public) }
 
           it_behaves_like 'a pullable'
+          it_behaves_like 'not a container repository factory'
         end
 
         shared_examples 'pullable for being team member' do
           context 'when you are not member' do
             it_behaves_like 'an inaccessible'
+            it_behaves_like 'not a container repository factory'
           end
 
           context 'when you are member' do
@@ -244,12 +282,14 @@ describe Auth::ContainerRegistryAuthenticationService, services: true do
             end
 
             it_behaves_like 'a pullable'
+            it_behaves_like 'not a container repository factory'
           end
 
           context 'when you are owner' do
             let(:project) { create(:empty_project, namespace: current_user.namespace) }
 
             it_behaves_like 'a pullable'
+            it_behaves_like 'not a container repository factory'
           end
         end
 
@@ -263,6 +303,7 @@ describe Auth::ContainerRegistryAuthenticationService, services: true do
 
             context 'when you are not member' do
               it_behaves_like 'an inaccessible'
+              it_behaves_like 'not a container repository factory'
             end
 
             context 'when you are member' do
@@ -271,12 +312,14 @@ describe Auth::ContainerRegistryAuthenticationService, services: true do
               end
 
               it_behaves_like 'a pullable'
+              it_behaves_like 'not a container repository factory'
             end
 
             context 'when you are owner' do
               let(:project) { create(:empty_project, namespace: current_user.namespace) }
 
               it_behaves_like 'a pullable'
+              it_behaves_like 'not a container repository factory'
             end
           end
         end
@@ -296,12 +339,14 @@ describe Auth::ContainerRegistryAuthenticationService, services: true do
             end
 
             it_behaves_like 'an inaccessible'
+            it_behaves_like 'not a container repository factory'
           end
 
           context 'when you are owner' do
             let(:project) { create(:empty_project, :public, namespace: current_user.namespace) }
 
             it_behaves_like 'an inaccessible'
+            it_behaves_like 'not a container repository factory'
           end
         end
       end
@@ -318,6 +363,7 @@ describe Auth::ContainerRegistryAuthenticationService, services: true do
         end
 
         it_behaves_like 'an inaccessible'
+        it_behaves_like 'not a container repository factory'
       end
     end
   end
@@ -325,6 +371,7 @@ describe Auth::ContainerRegistryAuthenticationService, services: true do
   context 'unauthorized' do
     context 'disallow to use scope-less authentication' do
       it_behaves_like 'a forbidden'
+      it_behaves_like 'not a container repository factory'
     end
 
     context 'for invalid scope' do
@@ -333,6 +380,7 @@ describe Auth::ContainerRegistryAuthenticationService, services: true do
       end
 
       it_behaves_like 'a forbidden'
+      it_behaves_like 'not a container repository factory'
     end
 
     context 'for private project' do
@@ -354,6 +402,7 @@ describe Auth::ContainerRegistryAuthenticationService, services: true do
         end
 
         it_behaves_like 'a pullable'
+        it_behaves_like 'not a container repository factory'
       end
 
       context 'when pushing' do
@@ -362,6 +411,7 @@ describe Auth::ContainerRegistryAuthenticationService, services: true do
         end
 
         it_behaves_like 'a forbidden'
+        it_behaves_like 'not a container repository factory'
       end
     end
   end
diff --git a/spec/services/ci/create_pipeline_service_spec.rb b/spec/services/ci/create_pipeline_service_spec.rb
index d2f0337c260..fa5014cee07 100644
--- a/spec/services/ci/create_pipeline_service_spec.rb
+++ b/spec/services/ci/create_pipeline_service_spec.rb
@@ -9,72 +9,140 @@ describe Ci::CreatePipelineService, services: true do
   end
 
   describe '#execute' do
-    def execute(params)
+    def execute_service(after: project.commit.id, message: 'Message', ref: 'refs/heads/master')
+      params = { ref: ref,
+                 before: '00000000',
+                 after: after,
+                 commits: [{ message: message }] }
+
       described_class.new(project, user, params).execute
     end
 
     context 'valid params' do
-      let(:pipeline) do
-        execute(ref: 'refs/heads/master',
-                before: '00000000',
-                after: project.commit.id,
-                commits: [{ message: "Message" }])
+      let(:pipeline) { execute_service }
+
+      let(:pipeline_on_previous_commit) do
+        execute_service(
+          after: previous_commit_sha_from_ref('master')
+        )
       end
 
       it { expect(pipeline).to be_kind_of(Ci::Pipeline) }
       it { expect(pipeline).to be_valid }
-      it { expect(pipeline).to be_persisted }
       it { expect(pipeline).to eq(project.pipelines.last) }
       it { expect(pipeline).to have_attributes(user: user) }
+      it { expect(pipeline).to have_attributes(status: 'pending') }
       it { expect(pipeline.builds.first).to be_kind_of(Ci::Build) }
+
+      context 'auto-cancel enabled' do
+        before do
+          project.update(auto_cancel_pending_pipelines: 'enabled')
+        end
+
+        it 'does not cancel HEAD pipeline' do
+          pipeline
+          pipeline_on_previous_commit
+
+          expect(pipeline.reload).to have_attributes(status: 'pending', auto_canceled_by_id: nil)
+        end
+
+        it 'auto cancel pending non-HEAD pipelines' do
+          pipeline_on_previous_commit
+          pipeline
+
+          expect(pipeline_on_previous_commit.reload).to have_attributes(status: 'canceled', auto_canceled_by_id: pipeline.id)
+        end
+
+        it 'does not cancel running outdated pipelines' do
+          pipeline_on_previous_commit.run
+          execute_service
+
+          expect(pipeline_on_previous_commit.reload).to have_attributes(status: 'running', auto_canceled_by_id: nil)
+        end
+
+        it 'cancel created outdated pipelines' do
+          pipeline_on_previous_commit.update(status: 'created')
+          pipeline
+
+          expect(pipeline_on_previous_commit.reload).to have_attributes(status: 'canceled', auto_canceled_by_id: pipeline.id)
+        end
+
+        it 'does not cancel pipelines from the other branches' do
+          pending_pipeline = execute_service(
+            ref: 'refs/heads/feature',
+            after: previous_commit_sha_from_ref('feature')
+          )
+          pipeline
+
+          expect(pending_pipeline.reload).to have_attributes(status: 'pending', auto_canceled_by_id: nil)
+        end
+      end
+
+      context 'auto-cancel disabled' do
+        before do
+          project.update(auto_cancel_pending_pipelines: 'disabled')
+        end
+
+        it 'does not auto cancel pending non-HEAD pipelines' do
+          pipeline_on_previous_commit
+          pipeline
+
+          expect(pipeline_on_previous_commit.reload)
+            .to have_attributes(status: 'pending', auto_canceled_by_id: nil)
+        end
+      end
+
+      def previous_commit_sha_from_ref(ref)
+        project.commit(ref).parent.sha
+      end
     end
 
     context "skip tag if there is no build for it" do
       it "creates commit if there is appropriate job" do
-        result = execute(ref: 'refs/heads/master',
-                         before: '00000000',
-                         after: project.commit.id,
-                         commits: [{ message: "Message" }])
-        expect(result).to be_persisted
+        expect(execute_service).to be_persisted
       end
 
       it "creates commit if there is no appropriate job but deploy job has right ref setting" do
         config = YAML.dump({ deploy: { script: "ls", only: ["master"] } })
         stub_ci_pipeline_yaml_file(config)
-        result = execute(ref: 'refs/heads/master',
-                         before: '00000000',
-                         after: project.commit.id,
-                         commits: [{ message: "Message" }])
 
-        expect(result).to be_persisted
+        expect(execute_service).to be_persisted
       end
     end
 
     it 'skips creating pipeline for refs without .gitlab-ci.yml' do
       stub_ci_pipeline_yaml_file(nil)
-      result = execute(ref: 'refs/heads/master',
-                       before: '00000000',
-                       after: project.commit.id,
-                       commits: [{ message: 'Message' }])
 
-      expect(result).not_to be_persisted
+      expect(execute_service).not_to be_persisted
       expect(Ci::Pipeline.count).to eq(0)
     end
 
-    it 'fails commits if yaml is invalid' do
-      message = 'message'
-      allow_any_instance_of(Ci::Pipeline).to receive(:git_commit_message) { message }
-      stub_ci_pipeline_yaml_file('invalid: file: file')
-      commits = [{ message: message }]
-      pipeline = execute(ref: 'refs/heads/master',
-                         before: '00000000',
-                         after: project.commit.id,
-                         commits: commits)
-
-      expect(pipeline).to be_persisted
-      expect(pipeline.builds.any?).to be false
-      expect(pipeline.status).to eq('failed')
-      expect(pipeline.yaml_errors).not_to be_nil
+    shared_examples 'a failed pipeline' do
+      it 'creates failed pipeline' do
+        stub_ci_pipeline_yaml_file(ci_yaml)
+
+        pipeline = execute_service(message: message)
+
+        expect(pipeline).to be_persisted
+        expect(pipeline.builds.any?).to be false
+        expect(pipeline.status).to eq('failed')
+        expect(pipeline.yaml_errors).not_to be_nil
+      end
+    end
+
+    context 'when yaml is invalid' do
+      let(:ci_yaml) { 'invalid: file: fiile' }
+      let(:message) { 'Message' }
+
+      it_behaves_like 'a failed pipeline'
+
+      context 'when receive git commit' do
+        before do
+          allow_any_instance_of(Ci::Pipeline).to receive(:git_commit_message) { message }
+        end
+
+        it_behaves_like 'a failed pipeline'
+      end
     end
 
     context 'when commit contains a [ci skip] directive' do
@@ -97,11 +165,7 @@ describe Ci::CreatePipelineService, services: true do
 
       ci_messages.each do |ci_message|
         it "skips builds creation if the commit message is #{ci_message}" do
-          commits = [{ message: ci_message }]
-          pipeline = execute(ref: 'refs/heads/master',
-                             before: '00000000',
-                             after: project.commit.id,
-                             commits: commits)
+          pipeline = execute_service(message: ci_message)
 
           expect(pipeline).to be_persisted
           expect(pipeline.builds.any?).to be false
@@ -109,58 +173,34 @@ describe Ci::CreatePipelineService, services: true do
         end
       end
 
-      it "does not skips builds creation if there is no [ci skip] or [skip ci] tag in commit message" do
-        allow_any_instance_of(Ci::Pipeline).to receive(:git_commit_message) { "some message" }
+      shared_examples 'creating a pipeline' do
+        it 'does not skip pipeline creation' do
+          allow_any_instance_of(Ci::Pipeline).to receive(:git_commit_message) { commit_message }
 
-        commits = [{ message: "some message" }]
-        pipeline = execute(ref: 'refs/heads/master',
-                           before: '00000000',
-                           after: project.commit.id,
-                           commits: commits)
+          pipeline = execute_service(message: commit_message)
 
-        expect(pipeline).to be_persisted
-        expect(pipeline.builds.first.name).to eq("rspec")
+          expect(pipeline).to be_persisted
+          expect(pipeline.builds.first.name).to eq("rspec")
+        end
       end
 
-      it "does not skip builds creation if the commit message is nil" do
-        allow_any_instance_of(Ci::Pipeline).to receive(:git_commit_message) { nil }
-
-        commits = [{ message: nil }]
-        pipeline = execute(ref: 'refs/heads/master',
-                           before: '00000000',
-                           after: project.commit.id,
-                           commits: commits)
+      context 'when commit message does not contain [ci skip] nor [skip ci]' do
+        let(:commit_message) { 'some message' }
 
-        expect(pipeline).to be_persisted
-        expect(pipeline.builds.first.name).to eq("rspec")
+        it_behaves_like 'creating a pipeline'
       end
 
-      it "fails builds creation if there is [ci skip] tag in commit message and yaml is invalid" do
-        stub_ci_pipeline_yaml_file('invalid: file: fiile')
-        commits = [{ message: message }]
-        pipeline = execute(ref: 'refs/heads/master',
-                           before: '00000000',
-                           after: project.commit.id,
-                           commits: commits)
+      context 'when commit message is nil' do
+        let(:commit_message) { nil }
 
-        expect(pipeline).to be_persisted
-        expect(pipeline.builds.any?).to be false
-        expect(pipeline.status).to eq("failed")
-        expect(pipeline.yaml_errors).not_to be_nil
+        it_behaves_like 'creating a pipeline'
       end
-    end
 
-    it "creates commit with failed status if yaml is invalid" do
-      stub_ci_pipeline_yaml_file('invalid: file')
-      commits = [{ message: "some message" }]
-      pipeline = execute(ref: 'refs/heads/master',
-                         before: '00000000',
-                         after: project.commit.id,
-                         commits: commits)
-
-      expect(pipeline).to be_persisted
-      expect(pipeline.status).to eq("failed")
-      expect(pipeline.builds.any?).to be false
+      context 'when there is [ci skip] tag in commit message and yaml is invalid' do
+        let(:ci_yaml) { 'invalid: file: fiile' }
+
+        it_behaves_like 'a failed pipeline'
+      end
     end
 
     context 'when there are no jobs for this pipeline' do
@@ -170,10 +210,7 @@ describe Ci::CreatePipelineService, services: true do
       end
 
       it 'does not create a new pipeline' do
-        result = execute(ref: 'refs/heads/master',
-                         before: '00000000',
-                         after: project.commit.id,
-                         commits: [{ message: 'some msg' }])
+        result = execute_service
 
         expect(result).not_to be_persisted
         expect(Ci::Build.all).to be_empty
@@ -188,10 +225,7 @@ describe Ci::CreatePipelineService, services: true do
       end
 
       it 'does not create a new pipeline' do
-        result = execute(ref: 'refs/heads/master',
-                         before: '00000000',
-                         after: project.commit.id,
-                         commits: [{ message: 'some msg' }])
+        result = execute_service
 
         expect(result).to be_persisted
         expect(result.manual_actions).not_to be_empty
@@ -205,10 +239,7 @@ describe Ci::CreatePipelineService, services: true do
       end
 
       it 'creates the environment' do
-        result = execute(ref: 'refs/heads/master',
-                         before: '00000000',
-                         after: project.commit.id,
-                         commits: [{ message: 'some msg' }])
+        result = execute_service
 
         expect(result).to be_persisted
         expect(Environment.find_by(name: "review/master")).not_to be_nil
diff --git a/spec/services/ci/expire_pipeline_cache_service_spec.rb b/spec/services/ci/expire_pipeline_cache_service_spec.rb
new file mode 100644
index 00000000000..166c6dfc93e
--- /dev/null
+++ b/spec/services/ci/expire_pipeline_cache_service_spec.rb
@@ -0,0 +1,27 @@
+require 'spec_helper'
+
+describe Ci::ExpirePipelineCacheService, services: true do
+  let(:user) { create(:user) }
+  let(:project) { create(:empty_project) }
+  let(:pipeline) { create(:ci_pipeline, project: project) }
+  subject { described_class.new(project, user) }
+
+  describe '#execute' do
+    it 'invalidate Etag caching for project pipelines path' do
+      pipelines_path = "/#{project.full_path}/pipelines.json"
+      new_mr_pipelines_path = "/#{project.full_path}/merge_requests/new.json"
+
+      expect_any_instance_of(Gitlab::EtagCaching::Store).to receive(:touch).with(pipelines_path)
+      expect_any_instance_of(Gitlab::EtagCaching::Store).to receive(:touch).with(new_mr_pipelines_path)
+
+      subject.execute(pipeline)
+    end
+
+    it 'updates the cached status for a project' do
+      expect(Gitlab::Cache::Ci::ProjectPipelineStatus).to receive(:update_for_pipeline).
+                                                            with(pipeline)
+
+      subject.execute(pipeline)
+    end
+  end
+end
diff --git a/spec/services/ci/process_pipeline_service_spec.rb b/spec/services/ci/process_pipeline_service_spec.rb
index 7df6a81b0ab..cf773866a6f 100644
--- a/spec/services/ci/process_pipeline_service_spec.rb
+++ b/spec/services/ci/process_pipeline_service_spec.rb
@@ -469,7 +469,9 @@ describe Ci::ProcessPipelineService, '#execute', :services do
     builds.find_by(name: name).play(user)
   end
 
-  delegate :manual_actions, to: :pipeline
+  def manual_actions
+    pipeline.manual_actions(true)
+  end
 
   def create_build(name, **opts)
     create(:ci_build, :created, pipeline: pipeline, name: name, **opts)
diff --git a/spec/services/ci/retry_build_service_spec.rb b/spec/services/ci/retry_build_service_spec.rb
index 8567817147b..b2d37657770 100644
--- a/spec/services/ci/retry_build_service_spec.rb
+++ b/spec/services/ci/retry_build_service_spec.rb
@@ -16,20 +16,21 @@ describe Ci::RetryBuildService, :services do
     %i[id status user token coverage trace runner artifacts_expire_at
        artifacts_file artifacts_metadata artifacts_size created_at
        updated_at started_at finished_at queued_at erased_by
-       erased_at].freeze
+       erased_at auto_canceled_by].freeze
 
   IGNORE_ACCESSORS =
     %i[type lock_version target_url base_tags
        commit_id deployments erased_by_id last_deployment project_id
        runner_id tag_taggings taggings tags trigger_request_id
-       user_id].freeze
+       user_id auto_canceled_by_id].freeze
 
   shared_examples 'build duplication' do
     let(:build) do
       create(:ci_build, :failed, :artifacts_expired, :erased,
              :queued, :coverage, :tags, :allowed_to_fail, :on_tag,
              :teardown_environment, :triggered, :trace,
-             description: 'some build', pipeline: pipeline)
+             description: 'some build', pipeline: pipeline,
+             auto_canceled_by: create(:ci_empty_pipeline))
     end
 
     describe 'clone accessors' do
diff --git a/spec/services/discussions/resolve_service_spec.rb b/spec/services/discussions/resolve_service_spec.rb
index 12c3cdf28c6..ab8df7b74cd 100644
--- a/spec/services/discussions/resolve_service_spec.rb
+++ b/spec/services/discussions/resolve_service_spec.rb
@@ -2,7 +2,7 @@ require 'spec_helper'
 
 describe Discussions::ResolveService do
   describe '#execute' do
-    let(:discussion) { Discussion.for_diff_notes([create(:diff_note_on_merge_request)]).first }
+    let(:discussion) { create(:diff_note_on_merge_request).to_discussion }
     let(:project) { merge_request.project }
     let(:merge_request) { discussion.noteable }
     let(:user) { create(:user) }
@@ -41,7 +41,7 @@ describe Discussions::ResolveService do
     end
 
     it 'can resolve multiple discussions at once' do
-      other_discussion = Discussion.for_diff_notes([create(:diff_note_on_merge_request, noteable: discussion.noteable, project: discussion.noteable.source_project)]).first
+      other_discussion = create(:diff_note_on_merge_request, noteable: discussion.noteable, project: discussion.noteable.source_project).to_discussion
 
       service.execute([discussion, other_discussion])
 
diff --git a/spec/services/issues/build_service_spec.rb b/spec/services/issues/build_service_spec.rb
index 17990f41b3b..55d635235b0 100644
--- a/spec/services/issues/build_service_spec.rb
+++ b/spec/services/issues/build_service_spec.rb
@@ -11,7 +11,7 @@ describe Issues::BuildService, services: true do
   context 'for a single discussion' do
     describe '#execute' do
       let(:merge_request) { create(:merge_request, title: "Hello world", source_project: project) }
-      let(:discussion) { Discussion.new([create(:diff_note_on_merge_request, project: project, noteable: merge_request, note: "Almost done")]) }
+      let(:discussion) { create(:diff_note_on_merge_request, project: project, noteable: merge_request, note: "Almost done").to_discussion }
       let(:service) { described_class.new(project, user, merge_request_to_resolve_discussions_of: merge_request.iid, discussion_to_resolve: discussion.id) }
 
       it 'references the noteable title in the issue title' do
@@ -47,7 +47,7 @@ describe Issues::BuildService, services: true do
       let(:service) { described_class.new(project, user, merge_request_to_resolve_discussions_of: merge_request.iid) }
 
       it 'mentions the author of the note' do
-        discussion = Discussion.new([create(:diff_note_on_merge_request, author: create(:user, username: 'author'))])
+        discussion = create(:diff_note_on_merge_request, author: create(:user, username: 'author')).to_discussion
         expect(service.item_for_discussion(discussion)).to include('@author')
       end
 
@@ -60,7 +60,7 @@ describe Issues::BuildService, services: true do
         note_result = "    > This is a string\n"\
                       "    > > with a blockquote\n"\
                       "    > > > That has a quote\n"
-        discussion = Discussion.new([create(:diff_note_on_merge_request, note: note_text)])
+        discussion = create(:diff_note_on_merge_request, note: note_text).to_discussion
         expect(service.item_for_discussion(discussion)).to include(note_result)
       end
     end
@@ -91,25 +91,23 @@ describe Issues::BuildService, services: true do
       end
 
       describe 'with multiple discussions' do
-        before do
-          create(:diff_note_on_merge_request, noteable: merge_request, project: merge_request.target_project, line_number: 15)
-        end
+        let!(:diff_note) { create(:diff_note_on_merge_request, noteable: merge_request, project: merge_request.target_project, line_number: 15) }
 
         it 'mentions all the authors in the description' do
-          authors = merge_request.diff_discussions.map(&:author)
+          authors = merge_request.resolvable_discussions.map(&:author)
 
           expect(issue.description).to include(*authors.map(&:to_reference))
         end
 
         it 'has a link for each unresolved discussion in the description' do
-          notes = merge_request.diff_discussions.map(&:first_note)
+          notes = merge_request.resolvable_discussions.map(&:first_note)
           links = notes.map { |note| Gitlab::UrlBuilder.build(note) }
 
           expect(issue.description).to include(*links)
         end
 
         it 'mentions additional notes' do
-          create_list(:diff_note_on_merge_request, 2, noteable: merge_request, project: merge_request.target_project, line_number: 15)
+          create_list(:diff_note_on_merge_request, 2, noteable: merge_request, project: merge_request.target_project, in_reply_to: diff_note)
 
           expect(issue.description).to include('(+2 comments)')
         end
diff --git a/spec/services/issues/create_service_spec.rb b/spec/services/issues/create_service_spec.rb
index 776cbc4296b..80bfb731550 100644
--- a/spec/services/issues/create_service_spec.rb
+++ b/spec/services/issues/create_service_spec.rb
@@ -141,7 +141,7 @@ describe Issues::CreateService, services: true do
     it_behaves_like 'new issuable record that supports slash commands'
 
     context 'resolving discussions' do
-      let(:discussion) { Discussion.for_diff_notes([create(:diff_note_on_merge_request)]).first }
+      let(:discussion) { create(:diff_note_on_merge_request).to_discussion }
       let(:merge_request) { discussion.noteable }
       let(:project) { merge_request.source_project }
 
diff --git a/spec/services/issues/resolve_discussions_spec.rb b/spec/services/issues/resolve_discussions_spec.rb
index 3a72f92383c..4a4929daefc 100644
--- a/spec/services/issues/resolve_discussions_spec.rb
+++ b/spec/services/issues/resolve_discussions_spec.rb
@@ -18,7 +18,7 @@ describe DummyService, services: true do
   end
 
   describe "for resolving discussions" do
-    let(:discussion) { Discussion.new([create(:diff_note_on_merge_request, project: project, note: "Almost done")]) }
+    let(:discussion) { create(:diff_note_on_merge_request, project: project, note: "Almost done").to_discussion }
     let(:merge_request) { discussion.noteable }
     let(:other_merge_request) { create(:merge_request, source_project: project, source_branch: "other") }
 
diff --git a/spec/services/notes/build_service_spec.rb b/spec/services/notes/build_service_spec.rb
new file mode 100644
index 00000000000..f9dd5541b10
--- /dev/null
+++ b/spec/services/notes/build_service_spec.rb
@@ -0,0 +1,40 @@
+require 'spec_helper'
+
+describe Notes::BuildService, services: true do
+  let(:note) { create(:discussion_note_on_issue) }
+  let(:project) { note.project }
+  let(:author) { note.author }
+
+  describe '#execute' do
+    context 'when in_reply_to_discussion_id is specified' do
+      context 'when a note with that original discussion ID exists' do
+        it 'sets the note up to be in reply to that note' do
+          new_note = described_class.new(project, author, note: 'Test', in_reply_to_discussion_id: note.discussion_id).execute
+          expect(new_note).to be_valid
+          expect(new_note.in_reply_to?(note)).to be_truthy
+        end
+      end
+
+      context 'when a note with that discussion ID exists' do
+        it 'sets the note up to be in reply to that note' do
+          new_note = described_class.new(project, author, note: 'Test', in_reply_to_discussion_id: note.discussion_id).execute
+          expect(new_note).to be_valid
+          expect(new_note.in_reply_to?(note)).to be_truthy
+        end
+      end
+
+      context 'when no note with that discussion ID exists' do
+        it 'sets an error' do
+          new_note = described_class.new(project, author, note: 'Test', in_reply_to_discussion_id: 'foo').execute
+          expect(new_note.errors[:base]).to include('Discussion to reply to cannot be found')
+        end
+      end
+    end
+
+    it 'builds a note without saving it' do
+      new_note = described_class.new(project, author, noteable_type: note.noteable_type, noteable_id: note.noteable_id, note: 'Test').execute
+      expect(new_note).to be_valid
+      expect(new_note).not_to be_persisted
+    end
+  end
+end
diff --git a/spec/services/notification_service_spec.rb b/spec/services/notification_service_spec.rb
index e3146a56495..989fd90cda9 100644
--- a/spec/services/notification_service_spec.rb
+++ b/spec/services/notification_service_spec.rb
@@ -439,7 +439,7 @@ describe NotificationService, services: true do
 
           notification.new_note(note)
 
-          expect(SentNotification.last.position).to eq(note.position)
+          expect(SentNotification.last.in_reply_to_discussion_id).to eq(note.discussion_id)
         end
       end
     end
@@ -1181,6 +1181,22 @@ describe NotificationService, services: true do
         should_not_email(@u_disabled)
       end
     end
+
+    describe '#project_exported' do
+      it do
+        notification.project_exported(project, @u_disabled)
+
+        should_only_email(@u_disabled)
+      end
+    end
+
+    describe '#project_not_exported' do
+      it do
+        notification.project_not_exported(project, @u_disabled, ['error'])
+
+        should_only_email(@u_disabled)
+      end
+    end
   end
 
   describe 'GroupMember' do
diff --git a/spec/services/projects/destroy_service_spec.rb b/spec/services/projects/destroy_service_spec.rb
index b1e10f4562e..4b8589b2736 100644
--- a/spec/services/projects/destroy_service_spec.rb
+++ b/spec/services/projects/destroy_service_spec.rb
@@ -7,6 +7,11 @@ describe Projects::DestroyService, services: true do
   let!(:remove_path) { path.sub(/\.git\Z/, "+#{project.id}+deleted.git") }
   let!(:async) { false } # execute or async_execute
 
+  before do
+    stub_container_registry_config(enabled: true)
+    stub_container_registry_tags(repository: :any, tags: [])
+  end
+
   shared_examples 'deleting the project' do
     it 'deletes the project' do
       expect(Project.unscoped.all).not_to include(project)
@@ -89,30 +94,64 @@ describe Projects::DestroyService, services: true do
     it_behaves_like 'deleting the project with pipeline and build'
   end
 
-  context 'container registry' do
-    before do
-      stub_container_registry_config(enabled: true)
-      stub_container_registry_tags('tag')
-    end
+  describe 'container registry' do
+    context 'when there are regular container repositories' do
+      let(:container_repository) { create(:container_repository) }
+
+      before do
+        stub_container_registry_tags(repository: project.full_path + '/image',
+                                     tags: ['tag'])
+        project.container_repositories << container_repository
+      end
+
+      context 'when image repository deletion succeeds' do
+        it 'removes tags' do
+          expect_any_instance_of(ContainerRepository)
+            .to receive(:delete_tags!).and_return(true)
+
+          destroy_project(project, user)
+        end
+      end
 
-    context 'tags deletion succeeds' do
-      it do
-        expect_any_instance_of(ContainerRegistry::Tag).to receive(:delete).and_return(true)
+      context 'when image repository deletion fails' do
+        it 'raises an exception' do
+          expect_any_instance_of(ContainerRepository)
+            .to receive(:delete_tags!).and_return(false)
 
-        destroy_project(project, user, {})
+          expect{ destroy_project(project, user) }
+            .to raise_error(ActiveRecord::RecordNotDestroyed)
+        end
       end
     end
 
-    context 'tags deletion fails' do
-      before { expect_any_instance_of(ContainerRegistry::Tag).to receive(:delete).and_return(false) }
+    context 'when there are tags for legacy root repository' do
+      before do
+        stub_container_registry_tags(repository: project.full_path,
+                                     tags: ['tag'])
+      end
+
+      context 'when image repository tags deletion succeeds' do
+        it 'removes tags' do
+          expect_any_instance_of(ContainerRepository)
+            .to receive(:delete_tags!).and_return(true)
 
-      subject { destroy_project(project, user, {}) }
+          destroy_project(project, user)
+        end
+      end
+
+      context 'when image repository tags deletion fails' do
+        it 'raises an exception' do
+          expect_any_instance_of(ContainerRepository)
+            .to receive(:delete_tags!).and_return(false)
 
-      it { expect{subject}.to raise_error(Projects::DestroyService::DestroyError) }
+          expect { destroy_project(project, user) }
+            .to raise_error(Projects::DestroyService::DestroyError)
+        end
+      end
     end
   end
 
-  def destroy_project(project, user, params)
+  def destroy_project(project, user, params = {})
     if async
       Projects::DestroyService.new(project, user, params).async_execute
     else
diff --git a/spec/services/projects/transfer_service_spec.rb b/spec/services/projects/transfer_service_spec.rb
index f8187fefc14..29ccce59c53 100644
--- a/spec/services/projects/transfer_service_spec.rb
+++ b/spec/services/projects/transfer_service_spec.rb
@@ -29,9 +29,12 @@ describe Projects::TransferService, services: true do
   end
 
   context 'disallow transfering of project with tags' do
+    let(:container_repository) { create(:container_repository) }
+
     before do
       stub_container_registry_config(enabled: true)
-      stub_container_registry_tags('tag')
+      stub_container_registry_tags(repository: :any, tags: ['tag'])
+      project.container_repositories << container_repository
     end
 
     subject { transfer_project(project, user, group) }
diff --git a/spec/services/protected_branches/update_service_spec.rb b/spec/services/protected_branches/update_service_spec.rb
new file mode 100644
index 00000000000..62bdd49a4d7
--- /dev/null
+++ b/spec/services/protected_branches/update_service_spec.rb
@@ -0,0 +1,26 @@
+require 'spec_helper'
+
+describe ProtectedBranches::UpdateService, services: true do
+  let(:protected_branch) { create(:protected_branch) }
+  let(:project) { protected_branch.project }
+  let(:user) { project.owner }
+  let(:params) { { name: 'new protected branch name' } }
+
+  describe '#execute' do
+    subject(:service) { described_class.new(project, user, params) }
+
+    it 'updates a protected branch' do
+      result = service.execute(protected_branch)
+
+      expect(result.reload.name).to eq(params[:name])
+    end
+
+    context 'without admin_project permissions' do
+      let(:user) { create(:user) }
+
+      it "raises error" do
+        expect{ service.execute(protected_branch) }.to raise_error(Gitlab::Access::AccessDeniedError)
+      end
+    end
+  end
+end
diff --git a/spec/services/protected_tags/create_service_spec.rb b/spec/services/protected_tags/create_service_spec.rb
new file mode 100644
index 00000000000..d91a58e8de5
--- /dev/null
+++ b/spec/services/protected_tags/create_service_spec.rb
@@ -0,0 +1,21 @@
+require 'spec_helper'
+
+describe ProtectedTags::CreateService, services: true do
+  let(:project) { create(:empty_project) }
+  let(:user) { project.owner }
+  let(:params) do
+    {
+      name: 'master',
+      create_access_levels_attributes: [{ access_level: Gitlab::Access::MASTER }]
+    }
+  end
+
+  describe '#execute' do
+    subject(:service) { described_class.new(project, user, params) }
+
+    it 'creates a new protected tag' do
+      expect { service.execute }.to change(ProtectedTag, :count).by(1)
+      expect(project.protected_tags.last.create_access_levels.map(&:access_level)).to eq([Gitlab::Access::MASTER])
+    end
+  end
+end
diff --git a/spec/services/protected_tags/update_service_spec.rb b/spec/services/protected_tags/update_service_spec.rb
new file mode 100644
index 00000000000..e78fde4c48d
--- /dev/null
+++ b/spec/services/protected_tags/update_service_spec.rb
@@ -0,0 +1,26 @@
+require 'spec_helper'
+
+describe ProtectedTags::UpdateService, services: true do
+  let(:protected_tag) { create(:protected_tag) }
+  let(:project) { protected_tag.project }
+  let(:user) { project.owner }
+  let(:params) { { name: 'new protected tag name' } }
+
+  describe '#execute' do
+    subject(:service) { described_class.new(project, user, params) }
+
+    it 'updates a protected tag' do
+      result = service.execute(protected_tag)
+
+      expect(result.reload.name).to eq(params[:name])
+    end
+
+    context 'without admin_project permissions' do
+      let(:user) { create(:user) }
+
+      it "raises error" do
+        expect{ service.execute(protected_tag) }.to raise_error(Gitlab::Access::AccessDeniedError)
+      end
+    end
+  end
+end
diff --git a/spec/services/system_note_service_spec.rb b/spec/services/system_note_service_spec.rb
index 5ec1ed8237b..42d63a9f9ba 100644
--- a/spec/services/system_note_service_spec.rb
+++ b/spec/services/system_note_service_spec.rb
@@ -796,7 +796,7 @@ describe SystemNoteService, services: true do
   end
 
   describe '.discussion_continued_in_issue' do
-    let(:discussion) { Discussion.for_diff_notes([create(:diff_note_on_merge_request)]).first }
+    let(:discussion) { create(:diff_note_on_merge_request).to_discussion }
     let(:merge_request) { discussion.noteable }
     let(:project) { merge_request.source_project }
     let(:issue) { create(:issue, project: project) }
diff --git a/spec/services/users/destroy_spec.rb b/spec/services/users/destroy_service_spec.rb
index 66c61b7f8ff..43c18992d1a 100644
--- a/spec/services/users/destroy_spec.rb
+++ b/spec/services/users/destroy_service_spec.rb
@@ -46,43 +46,47 @@ describe Users::DestroyService, services: true do
         project.add_developer(user)
       end
 
-      context "for an issue the user has created" do
-        let!(:issue) { create(:issue, project: project, author: user) }
+      context "for an issue the user was assigned to" do
+        let!(:issue) { create(:issue, project: project, assignee: user) }
 
         before do
           service.execute(user)
         end
 
-        it 'does not delete the issue' do
+        it 'does not delete issues the user is assigned to' do
           expect(Issue.find_by_id(issue.id)).to be_present
         end
 
-        it 'migrates the issue so that the "Ghost User" is the issue owner' do
+        it 'migrates the issue so that it is "Unassigned"' do
           migrated_issue = Issue.find_by_id(issue.id)
 
-          expect(migrated_issue.author).to eq(User.ghost)
+          expect(migrated_issue.assignee).to be_nil
         end
+      end
+    end
 
-        it 'blocks the user before migrating issues to the "Ghost User' do
-          expect(user).to be_blocked
-        end
+    context "a deleted user's merge_requests" do
+      let(:project) { create(:project) }
+
+      before do
+        project.add_developer(user)
       end
 
-      context "for an issue the user was assigned to" do
-        let!(:issue) { create(:issue, project: project, assignee: user) }
+      context "for an merge request the user was assigned to" do
+        let!(:merge_request) { create(:merge_request, source_project: project, assignee: user) }
 
         before do
           service.execute(user)
         end
 
-        it 'does not delete issues the user is assigned to' do
-          expect(Issue.find_by_id(issue.id)).to be_present
+        it 'does not delete merge requests the user is assigned to' do
+          expect(MergeRequest.find_by_id(merge_request.id)).to be_present
         end
 
-        it 'migrates the issue so that it is "Unassigned"' do
-          migrated_issue = Issue.find_by_id(issue.id)
+        it 'migrates the merge request so that it is "Unassigned"' do
+          migrated_merge_request = MergeRequest.find_by_id(merge_request.id)
 
-          expect(migrated_issue.assignee).to be_nil
+          expect(migrated_merge_request.assignee).to be_nil
         end
       end
     end
@@ -141,5 +145,13 @@ describe Users::DestroyService, services: true do
         expect(User.exists?(user.id)).to be(false)
       end
     end
+
+    context "migrating associated records" do
+      it 'delegates to the `MigrateToGhostUser` service to move associated records to the ghost user' do
+        expect_any_instance_of(Users::MigrateToGhostUserService).to receive(:execute).once
+
+        service.execute(user)
+      end
+    end
   end
 end
diff --git a/spec/services/users/migrate_to_ghost_user_service_spec.rb b/spec/services/users/migrate_to_ghost_user_service_spec.rb
new file mode 100644
index 00000000000..8c5b7e41c15
--- /dev/null
+++ b/spec/services/users/migrate_to_ghost_user_service_spec.rb
@@ -0,0 +1,64 @@
+require 'spec_helper'
+
+describe Users::MigrateToGhostUserService, services: true do
+  let!(:user)      { create(:user) }
+  let!(:project)   { create(:project) }
+  let(:service)    { described_class.new(user) }
+
+  context "migrating a user's associated records to the ghost user" do
+    context 'issues'  do
+      include_examples "migrating a deleted user's associated records to the ghost user", Issue do
+        let(:created_record) { create(:issue, project: project, author: user) }
+        let(:assigned_record) { create(:issue, project: project, assignee: user) }
+      end
+    end
+
+    context 'merge requests' do
+      include_examples "migrating a deleted user's associated records to the ghost user", MergeRequest do
+        let(:created_record) { create(:merge_request, source_project: project, author: user, target_branch: "first") }
+        let(:assigned_record) { create(:merge_request, source_project: project, assignee: user, target_branch: 'second') }
+      end
+    end
+
+    context 'notes' do
+      include_examples "migrating a deleted user's associated records to the ghost user", Note do
+        let(:created_record) { create(:note, project: project, author: user) }
+      end
+    end
+
+    context 'abuse reports' do
+      include_examples "migrating a deleted user's associated records to the ghost user", AbuseReport do
+        let(:created_record) { create(:abuse_report, reporter: user, user: create(:user)) }
+      end
+    end
+
+    context 'award emoji' do
+      include_examples "migrating a deleted user's associated records to the ghost user", AwardEmoji do
+        let(:created_record) { create(:award_emoji, user: user) }
+        let(:author_alias) { :user }
+
+        context "when the awardable already has an award emoji of the same name assigned to the ghost user" do
+          let(:awardable) { create(:issue) }
+          let!(:existing_award_emoji) { create(:award_emoji, user: User.ghost, name: "thumbsup", awardable: awardable) }
+          let!(:award_emoji) { create(:award_emoji, user: user, name: "thumbsup", awardable: awardable) }
+
+          it "migrates the award emoji regardless" do
+            service.execute
+
+            migrated_record = AwardEmoji.find_by_id(award_emoji.id)
+
+            expect(migrated_record.user).to eq(User.ghost)
+          end
+
+          it "does not leave the migrated award emoji in an invalid state" do
+            service.execute
+
+            migrated_record = AwardEmoji.find_by_id(award_emoji.id)
+
+            expect(migrated_record).to be_valid
+          end
+        end
+      end
+    end
+  end
+end