Merge branch 'master-ce' into scheduled-manual-jobs

30 files changed, 828 insertions, 49 deletions

diff --git a/spec/controllers/groups_controller_spec.rb b/spec/controllers/groups_controller_spec.rb
index 65d6cd1a295..a099cdafa58 100644
--- a/spec/controllers/groups_controller_spec.rb
+++ b/spec/controllers/groups_controller_spec.rb
@@ -202,8 +202,8 @@ describe GroupsController do
   end
 
   describe 'GET #issues' do
-    let(:issue_1) { create(:issue, project: project) }
-    let(:issue_2) { create(:issue, project: project) }
+    let(:issue_1) { create(:issue, project: project, title: 'foo') }
+    let(:issue_2) { create(:issue, project: project, title: 'bar') }
 
     before do
       create_list(:award_emoji, 3, awardable: issue_2)
@@ -224,6 +224,31 @@ describe GroupsController do
         expect(assigns(:issues)).to eq [issue_2, issue_1]
       end
     end
+
+    context 'searching' do
+      # Remove as part of https://gitlab.com/gitlab-org/gitlab-ce/issues/52271
+      before do
+        stub_feature_flags(use_cte_for_group_issues_search: false)
+      end
+
+      it 'works with popularity sort' do
+        get :issues, id: group.to_param, search: 'foo', sort: 'popularity'
+
+        expect(assigns(:issues)).to eq([issue_1])
+      end
+
+      it 'works with priority sort' do
+        get :issues, id: group.to_param, search: 'foo', sort: 'priority'
+
+        expect(assigns(:issues)).to eq([issue_1])
+      end
+
+      it 'works with label priority sort' do
+        get :issues, id: group.to_param, search: 'foo', sort: 'label_priority'
+
+        expect(assigns(:issues)).to eq([issue_1])
+      end
+    end
   end
 
   describe 'GET #merge_requests' do
diff --git a/spec/controllers/projects/issues_controller_spec.rb b/spec/controllers/projects/issues_controller_spec.rb
index 5b347b1109a..44419ed6a2a 100644
--- a/spec/controllers/projects/issues_controller_spec.rb
+++ b/spec/controllers/projects/issues_controller_spec.rb
@@ -637,6 +637,18 @@ describe Projects::IssuesController do
           project_id: project,
           id: id
       end
+
+      it 'avoids (most) N+1s loading labels' do
+        label = create(:label, project: project).to_reference
+        labels = create_list(:label, 10, project: project).map(&:to_reference)
+        issue = create(:issue, project: project, description: 'Test issue')
+
+        control_count = ActiveRecord::QueryRecorder.new { issue.update(description: [issue.description, label].join(' ')) }.count
+
+        # Follow-up to get rid of this `2 * label.count` requirement: https://gitlab.com/gitlab-org/gitlab-ce/issues/52230
+        expect { issue.update(description: [issue.description, labels].join(' ')) }
+          .not_to exceed_query_limit(control_count + 2 * labels.count)
+      end
     end
 
     describe 'GET #realtime_changes' do
diff --git a/spec/controllers/projects/jobs_controller_spec.rb b/spec/controllers/projects/jobs_controller_spec.rb
index 5b09e4a082c..383d6c1a2a9 100644
--- a/spec/controllers/projects/jobs_controller_spec.rb
+++ b/spec/controllers/projects/jobs_controller_spec.rb
@@ -225,7 +225,6 @@ describe Projects::JobsController, :clean_gitlab_redis_shared_state do
           expect(response).to have_gitlab_http_status(:ok)
           expect(json_response).to match_schema('job/job_details')
           expect(json_response['deployment_status']["status"]).to eq 'creating'
-          expect(json_response['deployment_status']["icon"]).to eq 'passed'
           expect(json_response['deployment_status']["environment"]).not_to be_nil
         end
       end
diff --git a/spec/factories/projects.rb b/spec/factories/projects.rb
index 80801eb1082..e4823a5adf1 100644
--- a/spec/factories/projects.rb
+++ b/spec/factories/projects.rb
@@ -1,6 +1,8 @@
 require_relative '../support/helpers/test_env'
 
 FactoryBot.define do
+  PAGES_ACCESS_LEVEL_SCHEMA_VERSION = 20180423204600
+
   # Project without repository
   #
   # Project does not have bare repository.
@@ -23,6 +25,7 @@ FactoryBot.define do
       issues_access_level ProjectFeature::ENABLED
       merge_requests_access_level ProjectFeature::ENABLED
       repository_access_level ProjectFeature::ENABLED
+      pages_access_level ProjectFeature::ENABLED
 
       # we can't assign the delegated `#ci_cd_settings` attributes directly, as the
       # `#ci_cd_settings` relation needs to be created first
@@ -34,13 +37,20 @@ FactoryBot.define do
       builds_access_level = [evaluator.builds_access_level, evaluator.repository_access_level].min
       merge_requests_access_level = [evaluator.merge_requests_access_level, evaluator.repository_access_level].min
 
-      project.project_feature.update(
+      hash = {
         wiki_access_level: evaluator.wiki_access_level,
         builds_access_level: builds_access_level,
         snippets_access_level: evaluator.snippets_access_level,
         issues_access_level: evaluator.issues_access_level,
         merge_requests_access_level: merge_requests_access_level,
-        repository_access_level: evaluator.repository_access_level)
+        repository_access_level: evaluator.repository_access_level
+      }
+
+      if ActiveRecord::Migrator.current_version >= PAGES_ACCESS_LEVEL_SCHEMA_VERSION
+        hash.store("pages_access_level", evaluator.pages_access_level)
+      end
+
+      project.project_feature.update(hash)
 
       # Normally the class Projects::CreateService is used for creating
       # projects, and this class takes care of making sure the owner and current
@@ -244,6 +254,10 @@ FactoryBot.define do
     trait(:repository_enabled)      { repository_access_level ProjectFeature::ENABLED }
     trait(:repository_disabled)     { repository_access_level ProjectFeature::DISABLED }
     trait(:repository_private)      { repository_access_level ProjectFeature::PRIVATE }
+    trait(:pages_public)            { pages_access_level ProjectFeature::PUBLIC }
+    trait(:pages_enabled)           { pages_access_level ProjectFeature::ENABLED }
+    trait(:pages_disabled)          { pages_access_level ProjectFeature::DISABLED }
+    trait(:pages_private)           { pages_access_level ProjectFeature::PRIVATE }
 
     trait :auto_devops do
       association :auto_devops, factory: :project_auto_devops
diff --git a/spec/features/issues/gfm_autocomplete_spec.rb b/spec/features/issues/gfm_autocomplete_spec.rb
index 98e37d8011a..08bf9bc7243 100644
--- a/spec/features/issues/gfm_autocomplete_spec.rb
+++ b/spec/features/issues/gfm_autocomplete_spec.rb
@@ -5,6 +5,7 @@ describe 'GFM autocomplete', :js do
   let(:project) { create(:project) }
   let(:label) { create(:label, project: project, title: 'special+') }
   let(:issue)   { create(:issue, project: project) }
+  let!(:project_snippet) { create(:project_snippet, project: project, title: 'code snippet') }
 
   before do
     project.add_maintainer(user)
@@ -301,6 +302,16 @@ describe 'GFM autocomplete', :js do
     end
   end
 
+  it 'shows project snippets' do
+    page.within '.timeline-content-form' do
+      find('#note-body').native.send_keys('$')
+    end
+
+    page.within '.atwho-container' do
+      expect(page).to have_content(project_snippet.title)
+    end
+  end
+
   private
 
   def expect_to_wrap(should_wrap, item, note, value)
diff --git a/spec/finders/issues_finder_spec.rb b/spec/finders/issues_finder_spec.rb
index d78451112ec..0689c843104 100644
--- a/spec/finders/issues_finder_spec.rb
+++ b/spec/finders/issues_finder_spec.rb
@@ -125,6 +125,14 @@ describe IssuesFinder do
         end
       end
 
+      context 'filtering by any milestone' do
+        let(:params) { { milestone_title: Milestone::Any.title } }
+
+        it 'returns issues with any assigned milestone' do
+          expect(issues).to contain_exactly(issue1)
+        end
+      end
+
       context 'filtering by upcoming milestone' do
         let(:params) { { milestone_title: Milestone::Upcoming.name } }
 
diff --git a/spec/fixtures/api/schemas/job/deployment_status.json b/spec/fixtures/api/schemas/job/deployment_status.json
index a90b8b35654..83b1899fdf3 100644
--- a/spec/fixtures/api/schemas/job/deployment_status.json
+++ b/spec/fixtures/api/schemas/job/deployment_status.json
@@ -2,7 +2,6 @@
   "type": "object",
   "required": [
     "status",
-    "icon",
     "environment"
   ],
   "properties": {
@@ -20,7 +19,6 @@
         { "type": "null" }
       ]
     },
-    "icon": { "type": "string" },
     "environment": { "$ref": "../environment.json" }
   },
   "additionalProperties": false
diff --git a/spec/graphql/types/permission_types/project_spec.rb b/spec/graphql/types/permission_types/project_spec.rb
index 89eecef096e..927153adc5b 100644
--- a/spec/graphql/types/permission_types/project_spec.rb
+++ b/spec/graphql/types/permission_types/project_spec.rb
@@ -10,7 +10,7 @@ describe Types::PermissionTypes::Project do
       :read_commit_status, :request_access, :create_pipeline, :create_pipeline_schedule,
       :create_merge_request_from, :create_wiki, :push_code, :create_deployment, :push_to_delete_protected_branch,
       :admin_wiki, :admin_project, :update_pages, :admin_remote_mirror, :create_label,
-      :update_wiki, :destroy_wiki, :create_pages, :destroy_pages
+      :update_wiki, :destroy_wiki, :create_pages, :destroy_pages, :read_pages_content
     ]
 
     expect(described_class).to have_graphql_fields(expected_permissions)
diff --git a/spec/helpers/application_helper_spec.rb b/spec/helpers/application_helper_spec.rb
index 1238cfbd1e7..4135f31e051 100644
--- a/spec/helpers/application_helper_spec.rb
+++ b/spec/helpers/application_helper_spec.rb
@@ -174,9 +174,7 @@ describe ApplicationHelper do
 
     it 'returns paths for autocomplete_sources_controller' do
       sources = helper.autocomplete_data_sources(project, noteable_type)
-
-      expect(sources.keys).to match_array([:members, :issues, :mergeRequests, :labels, :milestones, :commands])
-
+      expect(sources.keys).to match_array([:members, :issues, :mergeRequests, :labels, :milestones, :commands, :snippets])
       sources.keys.each do |key|
         expect(sources[key]).not_to be_nil
       end
diff --git a/spec/javascripts/gfm_auto_complete_spec.js b/spec/javascripts/gfm_auto_complete_spec.js
index 4f9cacf2724..b57c4943c01 100644
--- a/spec/javascripts/gfm_auto_complete_spec.js
+++ b/spec/javascripts/gfm_auto_complete_spec.js
@@ -103,7 +103,7 @@ describe('GfmAutoComplete', function () {
       gfmAutoCompleteCallbacks.matcher.call(context, flag, subtext)
     );
 
-    const flagsUseDefaultMatcher = ['@', '#', '!', '~', '%'];
+    const flagsUseDefaultMatcher = ['@', '#', '!', '~', '%', '$'];
     const otherFlags = ['/', ':'];
     const flags = flagsUseDefaultMatcher.concat(otherFlags);
 
diff --git a/spec/lib/banzai/cross_project_reference_spec.rb b/spec/lib/banzai/cross_project_reference_spec.rb
index aadfe7637dd..ba995e16be7 100644
--- a/spec/lib/banzai/cross_project_reference_spec.rb
+++ b/spec/lib/banzai/cross_project_reference_spec.rb
@@ -1,16 +1,21 @@
 require 'spec_helper'
 
 describe Banzai::CrossProjectReference do
-  include described_class
+  let(:including_class) { Class.new.include(described_class).new }
+
+  before do
+    allow(including_class).to receive(:context).and_return({})
+    allow(including_class).to receive(:parent_from_ref).and_call_original
+  end
 
   describe '#parent_from_ref' do
     context 'when no project was referenced' do
       it 'returns the project from context' do
         project = double
 
-        allow(self).to receive(:context).and_return({ project: project })
+        allow(including_class).to receive(:context).and_return({ project: project })
 
-        expect(parent_from_ref(nil)).to eq project
+        expect(including_class.parent_from_ref(nil)).to eq project
       end
     end
 
@@ -18,15 +23,15 @@ describe Banzai::CrossProjectReference do
       it 'returns the group from context' do
         group = double
 
-        allow(self).to receive(:context).and_return({ group: group })
+        allow(including_class).to receive(:context).and_return({ group: group })
 
-        expect(parent_from_ref(nil)).to eq group
+        expect(including_class.parent_from_ref(nil)).to eq group
       end
     end
 
     context 'when referenced project does not exist' do
       it 'returns nil' do
-        expect(parent_from_ref('invalid/reference')).to be_nil
+        expect(including_class.parent_from_ref('invalid/reference')).to be_nil
       end
     end
 
@@ -37,7 +42,7 @@ describe Banzai::CrossProjectReference do
         expect(Project).to receive(:find_by_full_path)
           .with('cross/reference').and_return(project2)
 
-        expect(parent_from_ref('cross/reference')).to eq project2
+        expect(including_class.parent_from_ref('cross/reference')).to eq project2
       end
     end
   end
diff --git a/spec/lib/banzai/filter/commit_range_reference_filter_spec.rb b/spec/lib/banzai/filter/commit_range_reference_filter_spec.rb
index e1af5a15371..cbff2fdab14 100644
--- a/spec/lib/banzai/filter/commit_range_reference_filter_spec.rb
+++ b/spec/lib/banzai/filter/commit_range_reference_filter_spec.rb
@@ -60,6 +60,7 @@ describe Banzai::Filter::CommitRangeReferenceFilter do
       exp = act = "See #{commit1.id.reverse}...#{commit2.id}"
 
       allow(project.repository).to receive(:commit).with(commit1.id.reverse)
+      allow(project.repository).to receive(:commit).with(commit2.id)
       expect(reference_filter(act).to_html).to eq exp
     end
 
diff --git a/spec/lib/gitlab/ci/build/policy/changes_spec.rb b/spec/lib/gitlab/ci/build/policy/changes_spec.rb
new file mode 100644
index 00000000000..ab401108c84
--- /dev/null
+++ b/spec/lib/gitlab/ci/build/policy/changes_spec.rb
@@ -0,0 +1,107 @@
+require 'spec_helper'
+
+describe Gitlab::Ci::Build::Policy::Changes do
+  set(:project) { create(:project) }
+
+  describe '#satisfied_by?' do
+    describe 'paths matching matching' do
+      let(:pipeline) do
+        build(:ci_empty_pipeline, project: project,
+                                  ref: 'master',
+                                  source: :push,
+                                  sha: '1234abcd',
+                                  before_sha: '0123aabb')
+      end
+
+      let(:ci_build) do
+        build(:ci_build, pipeline: pipeline, project: project, ref: 'master')
+      end
+
+      let(:seed) { double('build seed', to_resource: ci_build) }
+
+      before do
+        allow(pipeline).to receive(:modified_paths) do
+          %w[some/modified/ruby/file.rb some/other_file.txt some/.dir/file]
+        end
+      end
+
+      it 'is satisfied by matching literal path' do
+        policy = described_class.new(%w[some/other_file.txt])
+
+        expect(policy).to be_satisfied_by(pipeline, seed)
+      end
+
+      it 'is satisfied by matching simple pattern' do
+        policy = described_class.new(%w[some/*.txt])
+
+        expect(policy).to be_satisfied_by(pipeline, seed)
+      end
+
+      it 'is satisfied by matching recusive pattern' do
+        policy = described_class.new(%w[some/**/*.rb])
+
+        expect(policy).to be_satisfied_by(pipeline, seed)
+      end
+
+      it 'is satisfied by matching a pattern with a dot' do
+        policy = described_class.new(%w[some/*/file])
+
+        expect(policy).to be_satisfied_by(pipeline, seed)
+      end
+
+      it 'is not satisfied when pattern does not match path' do
+        policy = described_class.new(%w[some/*.rb])
+
+        expect(policy).not_to be_satisfied_by(pipeline, seed)
+      end
+
+      it 'is not satisfied when pattern does not match' do
+        policy = described_class.new(%w[invalid/*.md])
+
+        expect(policy).not_to be_satisfied_by(pipeline, seed)
+      end
+
+      context 'when pipelines does not run for a branch update' do
+        before do
+          pipeline.before_sha = Gitlab::Git::BLANK_SHA
+        end
+
+        it 'is always satisfied' do
+          policy = described_class.new(%w[invalid/*])
+
+          expect(policy).to be_satisfied_by(pipeline, seed)
+        end
+      end
+    end
+
+    describe 'gitaly integration' do
+      set(:project) { create(:project, :repository) }
+
+      let(:pipeline) do
+        create(:ci_empty_pipeline, project: project,
+                                   ref: 'master',
+                                   source: :push,
+                                   sha: '498214d',
+                                   before_sha: '281d3a7')
+      end
+
+      let(:build) do
+        create(:ci_build, pipeline: pipeline, project: project, ref: 'master')
+      end
+
+      let(:seed) { double('build seed', to_resource: build) }
+
+      it 'is satisfied by changes introduced by a push' do
+        policy = described_class.new(['with space/*.md'])
+
+        expect(policy).to be_satisfied_by(pipeline, seed)
+      end
+
+      it 'is not satisfied by changes that are not in the push' do
+        policy = described_class.new(%w[files/js/commit.js])
+
+        expect(policy).not_to be_satisfied_by(pipeline, seed)
+      end
+    end
+  end
+end
diff --git a/spec/lib/gitlab/ci/config/entry/policy_spec.rb b/spec/lib/gitlab/ci/config/entry/policy_spec.rb
index 83d39b82068..bef93fe7af7 100644
--- a/spec/lib/gitlab/ci/config/entry/policy_spec.rb
+++ b/spec/lib/gitlab/ci/config/entry/policy_spec.rb
@@ -1,4 +1,5 @@
-require 'spec_helper'
+require 'fast_spec_helper'
+require_dependency 'active_model'
 
 describe Gitlab::Ci::Config::Entry::Policy do
   let(:entry) { described_class.new(config) }
@@ -124,6 +125,23 @@ describe Gitlab::Ci::Config::Entry::Policy do
       end
     end
 
+    context 'when specifying a valid changes policy' do
+      let(:config) { { changes: %w[some/* paths/**/*.rb] } }
+
+      it 'is a correct configuraton' do
+        expect(entry).to be_valid
+        expect(entry.value).to eq(config)
+      end
+    end
+
+    context 'when changes policy is invalid' do
+      let(:config) { { changes: [1, 2] } }
+
+      it 'returns errors' do
+        expect(entry.errors).to include /changes should be an array of strings/
+      end
+    end
+
     context 'when specifying unknown policy' do
       let(:config) { { refs: ['master'], invalid: :something } }
 
diff --git a/spec/lib/gitlab/ci/yaml_processor_spec.rb b/spec/lib/gitlab/ci/yaml_processor_spec.rb
index d75c473eb66..85b23edce9f 100644
--- a/spec/lib/gitlab/ci/yaml_processor_spec.rb
+++ b/spec/lib/gitlab/ci/yaml_processor_spec.rb
@@ -1369,7 +1369,7 @@ module Gitlab
           end.to raise_error(Gitlab::Ci::YamlProcessor::ValidationError, "jobs:rspec dependencies should be an array of strings")
         end
 
-        it 'returns errors if pipeline variables expression is invalid' do
+        it 'returns errors if pipeline variables expression policy is invalid' do
           config = YAML.dump({ rspec: { script: 'test', only: { variables: ['== null'] } } })
 
           expect { Gitlab::Ci::YamlProcessor.new(config) }
@@ -1377,6 +1377,14 @@ module Gitlab
                             'jobs:rspec:only variables invalid expression syntax')
         end
 
+        it 'returns errors if pipeline changes policy is invalid' do
+          config = YAML.dump({ rspec: { script: 'test', only: { changes: [1] } } })
+
+          expect { Gitlab::Ci::YamlProcessor.new(config) }
+            .to raise_error(Gitlab::Ci::YamlProcessor::ValidationError,
+                            'jobs:rspec:only changes should be an array of strings')
+        end
+
         it 'returns errors if extended hash configuration is invalid' do
           config = YAML.dump({ rspec: { extends: 'something', script: 'test' } })
 
diff --git a/spec/lib/gitlab/git/diff_stats_collection_spec.rb b/spec/lib/gitlab/git/diff_stats_collection_spec.rb
index 89927cbb3a6..b07690ef39c 100644
--- a/spec/lib/gitlab/git/diff_stats_collection_spec.rb
+++ b/spec/lib/gitlab/git/diff_stats_collection_spec.rb
@@ -14,7 +14,7 @@ describe Gitlab::Git::DiffStatsCollection do
   let(:diff_stats) { [stats_a, stats_b] }
   let(:collection) { described_class.new(diff_stats) }
 
-  describe '.find_by_path' do
+  describe '#find_by_path' do
     it 'returns stats by path when found' do
       expect(collection.find_by_path('foo')).to eq(stats_a)
     end
@@ -23,4 +23,10 @@ describe Gitlab::Git::DiffStatsCollection do
       expect(collection.find_by_path('no-file')).to be_nil
     end
   end
+
+  describe '#paths' do
+    it 'returns only modified paths' do
+      expect(collection.paths).to eq %w[foo bar]
+    end
+  end
 end
diff --git a/spec/lib/gitlab/git/push_spec.rb b/spec/lib/gitlab/git/push_spec.rb
new file mode 100644
index 00000000000..566c8209504
--- /dev/null
+++ b/spec/lib/gitlab/git/push_spec.rb
@@ -0,0 +1,166 @@
+require 'spec_helper'
+
+describe Gitlab::Git::Push do
+  set(:project) { create(:project, :repository) }
+
+  let(:oldrev) { project.commit('HEAD~2').id }
+  let(:newrev) { project.commit.id }
+  let(:ref) { 'refs/heads/some-branch' }
+
+  subject { described_class.new(project, oldrev, newrev, ref) }
+
+  describe '#branch_name' do
+    context 'when it is a branch push' do
+      let(:ref) { 'refs/heads/my-branch' }
+
+      it 'returns branch name' do
+        expect(subject.branch_name).to eq 'my-branch'
+      end
+    end
+
+    context 'when it is a tag push' do
+      let(:ref) { 'refs/tags/my-branch' }
+
+      it 'returns nil' do
+        expect(subject.branch_name).to be_nil
+      end
+    end
+  end
+
+  describe '#branch_push?' do
+    context 'when pushing a branch ref' do
+      let(:ref) { 'refs/heads/my-branch' }
+
+      it { is_expected.to be_branch_push }
+    end
+
+    context 'when it is a tag push' do
+      let(:ref) { 'refs/tags/my-tag' }
+
+      it { is_expected.not_to be_branch_push }
+    end
+  end
+
+  describe '#branch_updated?' do
+    context 'when it is a branch push with correct old and new revisions' do
+      it { is_expected.to be_branch_updated }
+    end
+
+    context 'when it is not a branch push' do
+      let(:ref) { 'refs/tags/my-tag' }
+
+      it { is_expected.not_to be_branch_updated }
+    end
+
+    context 'when old revision is blank' do
+      let(:oldrev) { Gitlab::Git::BLANK_SHA }
+
+      it { is_expected.not_to be_branch_updated }
+    end
+
+    context 'when it is not a branch push' do
+      let(:newrev) { Gitlab::Git::BLANK_SHA }
+
+      it { is_expected.not_to be_branch_updated }
+    end
+
+    context 'when oldrev is nil' do
+      let(:oldrev) { nil }
+
+      it { is_expected.not_to be_branch_updated }
+    end
+  end
+
+  describe '#force_push?' do
+    context 'when old revision is an ancestor of the new revision' do
+      let(:oldrev) { 'HEAD~3' }
+      let(:newrev) { 'HEAD~1' }
+
+      it { is_expected.not_to be_force_push }
+    end
+
+    context 'when old revision is not an ancestor of the new revision' do
+      let(:oldrev) { 'HEAD~3' }
+      let(:newrev) { '123456' }
+
+      it { is_expected.to be_force_push }
+    end
+  end
+
+  describe '#branch_added?' do
+    context 'when old revision is defined' do
+      it { is_expected.not_to be_branch_added }
+    end
+
+    context 'when old revision is not defined' do
+      let(:oldrev) { Gitlab::Git::BLANK_SHA }
+
+      it { is_expected.to be_branch_added }
+    end
+  end
+
+  describe '#branch_removed?' do
+    context 'when new revision is defined' do
+      it { is_expected.not_to be_branch_removed }
+    end
+
+    context 'when new revision is not defined' do
+      let(:newrev) { Gitlab::Git::BLANK_SHA }
+
+      it { is_expected.to be_branch_removed }
+    end
+  end
+
+  describe '#modified_paths' do
+    context 'when a push is a branch update' do
+      let(:newrev) { '498214d' }
+      let(:oldrev) { '281d3a7' }
+
+      it 'returns modified paths' do
+        expect(subject.modified_paths).to eq ['bar/branch-test.txt',
+                                              'files/js/commit.coffee',
+                                              'with space/README.md']
+      end
+    end
+
+    context 'when a push is not a branch update' do
+      let(:oldrev) { Gitlab::Git::BLANK_SHA }
+
+      it 'raises an error' do
+        expect { subject.modified_paths }.to raise_error(ArgumentError)
+      end
+    end
+  end
+
+  describe '#oldrev' do
+    context 'when a valid oldrev is provided' do
+      it 'returns oldrev' do
+        expect(subject.oldrev).to eq oldrev
+      end
+    end
+
+    context 'when a nil valud is provided' do
+      let(:oldrev) { nil }
+
+      it 'returns blank SHA' do
+        expect(subject.oldrev).to eq Gitlab::Git::BLANK_SHA
+      end
+    end
+  end
+
+  describe '#newrev' do
+    context 'when valid newrev is provided' do
+      it 'returns newrev' do
+        expect(subject.newrev).to eq newrev
+      end
+    end
+
+    context 'when a nil valud is provided' do
+      let(:newrev) { nil }
+
+      it 'returns blank SHA' do
+        expect(subject.newrev).to eq Gitlab::Git::BLANK_SHA
+      end
+    end
+  end
+end
diff --git a/spec/lib/gitlab/import_export/safe_model_attributes.yml b/spec/lib/gitlab/import_export/safe_model_attributes.yml
index 1d59cff7ba8..f7935149b23 100644
--- a/spec/lib/gitlab/import_export/safe_model_attributes.yml
+++ b/spec/lib/gitlab/import_export/safe_model_attributes.yml
@@ -493,6 +493,7 @@ ProjectFeature:
 - snippets_access_level
 - builds_access_level
 - repository_access_level
+- pages_access_level
 - created_at
 - updated_at
 ProtectedBranch::MergeAccessLevel:
diff --git a/spec/migrations/add_pages_access_level_to_project_feature_spec.rb b/spec/migrations/add_pages_access_level_to_project_feature_spec.rb
new file mode 100644
index 00000000000..3946602c5be
--- /dev/null
+++ b/spec/migrations/add_pages_access_level_to_project_feature_spec.rb
@@ -0,0 +1,30 @@
+require 'spec_helper'
+require Rails.root.join('db', 'migrate', '20180423204600_add_pages_access_level_to_project_feature.rb')
+
+describe AddPagesAccessLevelToProjectFeature, :migration do
+  let(:namespaces) { table(:namespaces) }
+  let(:projects) { table(:projects) }
+  let(:features) { table(:project_features) }
+  let!(:namespace) { namespaces.create(name: 'gitlab', path: 'gitlab') }
+  let!(:first_project) { projects.create(name: 'gitlab1', path: 'gitlab1', namespace_id: namespace.id) }
+  let!(:first_project_features) { features.create(project_id: first_project.id) }
+  let!(:second_project) { projects.create(name: 'gitlab2', path: 'gitlab2', namespace_id: namespace.id) }
+  let!(:second_project_features) { features.create(project_id: second_project.id) }
+
+  it 'correctly migrate pages for old projects to be public' do
+    migrate!
+
+    # For old projects pages should be public
+    expect(first_project_features.reload.pages_access_level).to eq ProjectFeature::PUBLIC
+    expect(second_project_features.reload.pages_access_level).to eq ProjectFeature::PUBLIC
+  end
+
+  it 'after migration pages are enabled as default' do
+    migrate!
+
+    # For new project default is enabled
+    third_project = projects.create(name: 'gitlab3', path: 'gitlab3', namespace_id: namespace.id)
+    third_project_features = features.create(project_id: third_project.id)
+    expect(third_project_features.reload.pages_access_level).to eq ProjectFeature::ENABLED
+  end
+end
diff --git a/spec/models/ci/pipeline_spec.rb b/spec/models/ci/pipeline_spec.rb
index 5ca140879c3..3b01b39ecab 100644
--- a/spec/models/ci/pipeline_spec.rb
+++ b/spec/models/ci/pipeline_spec.rb
@@ -837,6 +837,57 @@ describe Ci::Pipeline, :mailer do
     end
   end
 
+  describe '#branch_updated?' do
+    context 'when pipeline has before SHA' do
+      before do
+        pipeline.update_column(:before_sha, 'a1b2c3d4')
+      end
+
+      it 'runs on a branch update push' do
+        expect(pipeline.before_sha).not_to be Gitlab::Git::BLANK_SHA
+        expect(pipeline.branch_updated?).to be true
+      end
+    end
+
+    context 'when pipeline does not have before SHA' do
+      before do
+        pipeline.update_column(:before_sha, Gitlab::Git::BLANK_SHA)
+      end
+
+      it 'does not run on a branch updating push' do
+        expect(pipeline.branch_updated?).to be false
+      end
+    end
+  end
+
+  describe '#modified_paths' do
+    context 'when old and new revisions are set' do
+      let(:project) { create(:project, :repository) }
+
+      before do
+        pipeline.update(before_sha: '1234abcd', sha: '2345bcde')
+      end
+
+      it 'fetches stats for changes between commits' do
+        expect(project.repository)
+          .to receive(:diff_stats).with('1234abcd', '2345bcde')
+          .and_call_original
+
+        pipeline.modified_paths
+      end
+    end
+
+    context 'when either old or new revision is missing' do
+      before do
+        pipeline.update_column(:before_sha, Gitlab::Git::BLANK_SHA)
+      end
+
+      it 'raises an error' do
+        expect { pipeline.modified_paths }.to raise_error(ArgumentError)
+      end
+    end
+  end
+
   describe '#has_kubernetes_active?' do
     context 'when kubernetes is active' do
       shared_examples 'same behavior between KubernetesService and Platform::Kubernetes' do
diff --git a/spec/models/internal_id_spec.rb b/spec/models/internal_id_spec.rb
index f2aad455d5f..52c00a74b4b 100644
--- a/spec/models/internal_id_spec.rb
+++ b/spec/models/internal_id_spec.rb
@@ -65,7 +65,8 @@ describe InternalId do
     context 'with an insufficient schema version' do
       before do
         described_class.reset_column_information
-        expect(ActiveRecord::Migrator).to receive(:current_version).and_return(InternalId::REQUIRED_SCHEMA_VERSION - 1)
+        # Project factory will also call the current_version
+        expect(ActiveRecord::Migrator).to receive(:current_version).twice.and_return(InternalId::REQUIRED_SCHEMA_VERSION - 1)
       end
 
       let(:init) { double('block') }
diff --git a/spec/models/project_feature_spec.rb b/spec/models/project_feature_spec.rb
index cd7f77024da..fee7d65c217 100644
--- a/spec/models/project_feature_spec.rb
+++ b/spec/models/project_feature_spec.rb
@@ -17,7 +17,7 @@ describe ProjectFeature do
   end
 
   describe '#feature_available?' do
-    let(:features) { %w(issues wiki builds merge_requests snippets repository) }
+    let(:features) { %w(issues wiki builds merge_requests snippets repository pages) }
 
     context 'when features are disabled' do
       it "returns false" do
@@ -73,6 +73,22 @@ describe ProjectFeature do
         end
       end
     end
+
+    context 'when feature is disabled by a feature flag' do
+      it 'returns false' do
+        stub_feature_flags(issues: false)
+
+        expect(project.feature_available?(:issues, user)).to eq(false)
+      end
+    end
+
+    context 'when feature is enabled by a feature flag' do
+      it 'returns true' do
+        stub_feature_flags(issues: true)
+
+        expect(project.feature_available?(:issues, user)).to eq(true)
+      end
+    end
   end
 
   context 'repository related features' do
@@ -96,6 +112,19 @@ describe ProjectFeature do
     end
   end
 
+  context 'public features' do
+    it "does not allow public for other than pages" do
+      features = %w(issues wiki builds merge_requests snippets repository)
+      project_feature = project.project_feature
+
+      features.each do |feature|
+        field = "#{feature}_access_level".to_sym
+        project_feature.update_attribute(field, ProjectFeature::PUBLIC)
+        expect(project_feature.valid?).to be_falsy
+      end
+    end
+  end
+
   describe '#*_enabled?' do
     let(:features) { %w(wiki builds merge_requests) }
 
diff --git a/spec/requests/api/issues_spec.rb b/spec/requests/api/issues_spec.rb
index 1e2e13a723c..9f6cf12f9a7 100644
--- a/spec/requests/api/issues_spec.rb
+++ b/spec/requests/api/issues_spec.rb
@@ -56,6 +56,7 @@ describe API::Issues do
   let!(:note) { create(:note_on_issue, author: user, project: project, noteable: issue) }
 
   let(:no_milestone_title) { URI.escape(Milestone::None.title) }
+  let(:any_milestone_title) { URI.escape(Milestone::Any.title) }
 
   before(:all) do
     project.add_reporter(user)
@@ -811,6 +812,15 @@ describe API::Issues do
       expect(json_response.first['id']).to eq(confidential_issue.id)
     end
 
+    it 'returns an array of issues with any milestone' do
+      get api("#{base_url}/issues?milestone=#{any_milestone_title}", user)
+
+      response_ids = json_response.map { |issue| issue['id'] }
+
+      expect_paginated_array_response(size: 2)
+      expect(response_ids).to contain_exactly(closed_issue.id, issue.id)
+    end
+
     it 'sorts by created_at descending by default' do
       get api("#{base_url}/issues", user)
 
diff --git a/spec/requests/api/pages/internal_access_spec.rb b/spec/requests/api/pages/internal_access_spec.rb
new file mode 100644
index 00000000000..c41eabe0a48
--- /dev/null
+++ b/spec/requests/api/pages/internal_access_spec.rb
@@ -0,0 +1,88 @@
+require 'spec_helper'
+
+describe "Internal Project Pages Access" do
+  using RSpec::Parameterized::TableSyntax
+  include AccessMatchers
+
+  set(:group) { create(:group) }
+  set(:project) { create(:project, :internal, pages_access_level: ProjectFeature::ENABLED, namespace: group) }
+
+  set(:admin) { create(:admin) }
+  set(:owner) { create(:user) }
+  set(:master) { create(:user) }
+  set(:developer) { create(:user) }
+  set(:reporter) { create(:user) }
+  set(:guest) { create(:user) }
+  set(:user) { create(:user) }
+
+  before do
+    allow(Gitlab.config.pages).to receive(:access_control).and_return(true)
+    group.add_owner(owner)
+    project.add_master(master)
+    project.add_developer(developer)
+    project.add_reporter(reporter)
+    project.add_guest(guest)
+  end
+
+  describe "Project should be internal" do
+    describe '#internal?' do
+      subject { project.internal? }
+      it { is_expected.to be_truthy }
+    end
+  end
+
+  describe "GET /projects/:id/pages_access" do
+    context 'access depends on the level' do
+      where(:pages_access_level, :with_user, :expected_result) do
+        ProjectFeature::DISABLED   |   "admin"     |  403
+        ProjectFeature::DISABLED   |   "owner"     |  403
+        ProjectFeature::DISABLED   |   "master"    |  403
+        ProjectFeature::DISABLED   |   "developer" |  403
+        ProjectFeature::DISABLED   |   "reporter"  |  403
+        ProjectFeature::DISABLED   |   "guest"     |  403
+        ProjectFeature::DISABLED   |   "user"      |  403
+        ProjectFeature::DISABLED   |   nil         |  404
+        ProjectFeature::PUBLIC     |   "admin"     |  200
+        ProjectFeature::PUBLIC     |   "owner"     |  200
+        ProjectFeature::PUBLIC     |   "master"    |  200
+        ProjectFeature::PUBLIC     |   "developer" |  200
+        ProjectFeature::PUBLIC     |   "reporter"  |  200
+        ProjectFeature::PUBLIC     |   "guest"     |  200
+        ProjectFeature::PUBLIC     |   "user"      |  200
+        ProjectFeature::PUBLIC     |   nil         |  404
+        ProjectFeature::ENABLED    |   "admin"     |  200
+        ProjectFeature::ENABLED    |   "owner"     |  200
+        ProjectFeature::ENABLED    |   "master"    |  200
+        ProjectFeature::ENABLED    |   "developer" |  200
+        ProjectFeature::ENABLED    |   "reporter"  |  200
+        ProjectFeature::ENABLED    |   "guest"     |  200
+        ProjectFeature::ENABLED    |   "user"      |  200
+        ProjectFeature::ENABLED    |   nil         |  404
+        ProjectFeature::PRIVATE    |   "admin"     |  200
+        ProjectFeature::PRIVATE    |   "owner"     |  200
+        ProjectFeature::PRIVATE    |   "master"    |  200
+        ProjectFeature::PRIVATE    |   "developer" |  200
+        ProjectFeature::PRIVATE    |   "reporter"  |  200
+        ProjectFeature::PRIVATE    |   "guest"     |  200
+        ProjectFeature::PRIVATE    |   "user"      |  403
+        ProjectFeature::PRIVATE    |   nil         |  404
+      end
+
+      with_them do
+        before do
+          project.project_feature.update(pages_access_level: pages_access_level)
+        end
+        it "correct return value" do
+          if !with_user.nil?
+            user = public_send(with_user)
+            get api("/projects/#{project.id}/pages_access", user)
+          else
+            get api("/projects/#{project.id}/pages_access")
+          end
+
+          expect(response).to have_gitlab_http_status(expected_result)
+        end
+      end
+    end
+  end
+end
diff --git a/spec/requests/api/pages/private_access_spec.rb b/spec/requests/api/pages/private_access_spec.rb
new file mode 100644
index 00000000000..d69c15b0477
--- /dev/null
+++ b/spec/requests/api/pages/private_access_spec.rb
@@ -0,0 +1,88 @@
+require 'spec_helper'
+
+describe "Private Project Pages Access"  do
+  using RSpec::Parameterized::TableSyntax
+  include AccessMatchers
+
+  set(:group) { create(:group) }
+  set(:project) { create(:project, :private, pages_access_level: ProjectFeature::ENABLED, namespace: group) }
+
+  set(:admin) { create(:admin) }
+  set(:owner) { create(:user) }
+  set(:master) { create(:user) }
+  set(:developer) { create(:user) }
+  set(:reporter) { create(:user) }
+  set(:guest) { create(:user) }
+  set(:user) { create(:user) }
+
+  before do
+    allow(Gitlab.config.pages).to receive(:access_control).and_return(true)
+    group.add_owner(owner)
+    project.add_master(master)
+    project.add_developer(developer)
+    project.add_reporter(reporter)
+    project.add_guest(guest)
+  end
+
+  describe "Project should be private" do
+    describe '#private?' do
+      subject { project.private? }
+      it { is_expected.to be_truthy }
+    end
+  end
+
+  describe "GET /projects/:id/pages_access" do
+    context 'access depends on the level' do
+      where(:pages_access_level, :with_user, :expected_result) do
+        ProjectFeature::DISABLED   |   "admin"     |  403
+        ProjectFeature::DISABLED   |   "owner"     |  403
+        ProjectFeature::DISABLED   |   "master"    |  403
+        ProjectFeature::DISABLED   |   "developer" |  403
+        ProjectFeature::DISABLED   |   "reporter"  |  403
+        ProjectFeature::DISABLED   |   "guest"     |  403
+        ProjectFeature::DISABLED   |   "user"      |  404
+        ProjectFeature::DISABLED   |   nil         |  404
+        ProjectFeature::PUBLIC     |   "admin"     |  200
+        ProjectFeature::PUBLIC     |   "owner"     |  200
+        ProjectFeature::PUBLIC     |   "master"    |  200
+        ProjectFeature::PUBLIC     |   "developer" |  200
+        ProjectFeature::PUBLIC     |   "reporter"  |  200
+        ProjectFeature::PUBLIC     |   "guest"     |  200
+        ProjectFeature::PUBLIC     |   "user"      |  404
+        ProjectFeature::PUBLIC     |   nil         |  404
+        ProjectFeature::ENABLED    |   "admin"     |  200
+        ProjectFeature::ENABLED    |   "owner"     |  200
+        ProjectFeature::ENABLED    |   "master"    |  200
+        ProjectFeature::ENABLED    |   "developer" |  200
+        ProjectFeature::ENABLED    |   "reporter"  |  200
+        ProjectFeature::ENABLED    |   "guest"     |  200
+        ProjectFeature::ENABLED    |   "user"      |  404
+        ProjectFeature::ENABLED    |   nil         |  404
+        ProjectFeature::PRIVATE    |   "admin"     |  200
+        ProjectFeature::PRIVATE    |   "owner"     |  200
+        ProjectFeature::PRIVATE    |   "master"    |  200
+        ProjectFeature::PRIVATE    |   "developer" |  200
+        ProjectFeature::PRIVATE    |   "reporter"  |  200
+        ProjectFeature::PRIVATE    |   "guest"     |  200
+        ProjectFeature::PRIVATE    |   "user"      |  404
+        ProjectFeature::PRIVATE    |   nil         |  404
+      end
+
+      with_them do
+        before do
+          project.project_feature.update(pages_access_level: pages_access_level)
+        end
+        it "correct return value" do
+          if !with_user.nil?
+            user = public_send(with_user)
+            get api("/projects/#{project.id}/pages_access", user)
+          else
+            get api("/projects/#{project.id}/pages_access")
+          end
+
+          expect(response).to have_gitlab_http_status(expected_result)
+        end
+      end
+    end
+  end
+end
diff --git a/spec/requests/api/pages/public_access_spec.rb b/spec/requests/api/pages/public_access_spec.rb
new file mode 100644
index 00000000000..882ca26ac51
--- /dev/null
+++ b/spec/requests/api/pages/public_access_spec.rb
@@ -0,0 +1,88 @@
+require 'spec_helper'
+
+describe "Public Project Pages Access"  do
+  using RSpec::Parameterized::TableSyntax
+  include AccessMatchers
+
+  set(:group) { create(:group) }
+  set(:project) { create(:project, :public, pages_access_level: ProjectFeature::ENABLED, namespace: group) }
+
+  set(:admin) { create(:admin) }
+  set(:owner) { create(:user) }
+  set(:master) { create(:user) }
+  set(:developer) { create(:user) }
+  set(:reporter) { create(:user) }
+  set(:guest) { create(:user) }
+  set(:user) { create(:user) }
+
+  before do
+    allow(Gitlab.config.pages).to receive(:access_control).and_return(true)
+    group.add_owner(owner)
+    project.add_master(master)
+    project.add_developer(developer)
+    project.add_reporter(reporter)
+    project.add_guest(guest)
+  end
+
+  describe "Project should be public" do
+    describe '#public?' do
+      subject { project.public? }
+      it { is_expected.to be_truthy }
+    end
+  end
+
+  describe "GET /projects/:id/pages_access" do
+    context 'access depends on the level' do
+      where(:pages_access_level, :with_user, :expected_result) do
+        ProjectFeature::DISABLED   |   "admin"     |  403
+        ProjectFeature::DISABLED   |   "owner"     |  403
+        ProjectFeature::DISABLED   |   "master"    |  403
+        ProjectFeature::DISABLED   |   "developer" |  403
+        ProjectFeature::DISABLED   |   "reporter"  |  403
+        ProjectFeature::DISABLED   |   "guest"     |  403
+        ProjectFeature::DISABLED   |   "user"      |  403
+        ProjectFeature::DISABLED   |   nil         |  403
+        ProjectFeature::PUBLIC     |   "admin"     |  200
+        ProjectFeature::PUBLIC     |   "owner"     |  200
+        ProjectFeature::PUBLIC     |   "master"    |  200
+        ProjectFeature::PUBLIC     |   "developer" |  200
+        ProjectFeature::PUBLIC     |   "reporter"  |  200
+        ProjectFeature::PUBLIC     |   "guest"     |  200
+        ProjectFeature::PUBLIC     |   "user"      |  200
+        ProjectFeature::PUBLIC     |   nil         |  200
+        ProjectFeature::ENABLED    |   "admin"     |  200
+        ProjectFeature::ENABLED    |   "owner"     |  200
+        ProjectFeature::ENABLED    |   "master"    |  200
+        ProjectFeature::ENABLED    |   "developer" |  200
+        ProjectFeature::ENABLED    |   "reporter"  |  200
+        ProjectFeature::ENABLED    |   "guest"     |  200
+        ProjectFeature::ENABLED    |   "user"      |  200
+        ProjectFeature::ENABLED    |   nil         |  200
+        ProjectFeature::PRIVATE    |   "admin"     |  200
+        ProjectFeature::PRIVATE    |   "owner"     |  200
+        ProjectFeature::PRIVATE    |   "master"    |  200
+        ProjectFeature::PRIVATE    |   "developer" |  200
+        ProjectFeature::PRIVATE    |   "reporter"  |  200
+        ProjectFeature::PRIVATE    |   "guest"     |  200
+        ProjectFeature::PRIVATE    |   "user"      |  403
+        ProjectFeature::PRIVATE    |   nil         |  403
+      end
+
+      with_them do
+        before do
+          project.project_feature.update(pages_access_level: pages_access_level)
+        end
+        it "correct return value" do
+          if !with_user.nil?
+            user = public_send(with_user)
+            get api("/projects/#{project.id}/pages_access", user)
+          else
+            get api("/projects/#{project.id}/pages_access")
+          end
+
+          expect(response).to have_gitlab_http_status(expected_result)
+        end
+      end
+    end
+  end
+end
diff --git a/spec/requests/api/users_spec.rb b/spec/requests/api/users_spec.rb
index b7d62df0663..09c1d016081 100644
--- a/spec/requests/api/users_spec.rb
+++ b/spec/requests/api/users_spec.rb
@@ -785,35 +785,25 @@ describe API::Users do
   end
 
   describe 'GET /user/:id/keys' do
-    before do
-      admin
-    end
+    it 'returns 404 for non-existing user' do
+      user_id = not_existing_user_id
 
-    context 'when unauthenticated' do
-      it 'returns authentication error' do
-        get api("/users/#{user.id}/keys")
-        expect(response).to have_gitlab_http_status(401)
-      end
-    end
+      get api("/users/#{user_id}/keys")
 
-    context 'when authenticated' do
-      it 'returns 404 for non-existing user' do
-        get api('/users/999999/keys', admin)
-        expect(response).to have_gitlab_http_status(404)
-        expect(json_response['message']).to eq('404 User Not Found')
-      end
+      expect(response).to have_gitlab_http_status(404)
+      expect(json_response['message']).to eq('404 User Not Found')
+    end
 
-      it 'returns array of ssh keys' do
-        user.keys << key
-        user.save
+    it 'returns array of ssh keys' do
+      user.keys << key
+      user.save
 
-        get api("/users/#{user.id}/keys", admin)
+      get api("/users/#{user.id}/keys")
 
-        expect(response).to have_gitlab_http_status(200)
-        expect(response).to include_pagination_headers
-        expect(json_response).to be_an Array
-        expect(json_response.first['title']).to eq(key.title)
-      end
+      expect(response).to have_gitlab_http_status(200)
+      expect(response).to include_pagination_headers
+      expect(json_response).to be_an Array
+      expect(json_response.first['title']).to eq(key.title)
     end
   end
 
diff --git a/spec/routing/project_routing_spec.rb b/spec/routing/project_routing_spec.rb
index 56df8dddbc1..bdfb12dc5df 100644
--- a/spec/routing/project_routing_spec.rb
+++ b/spec/routing/project_routing_spec.rb
@@ -133,8 +133,9 @@ describe 'project routing' do
   # labels_namespace_project_autocomplete_sources_path         GET /:project_id/autocomplete_sources/labels(.:format)         projects/autocomplete_sources#labels
   # milestones_namespace_project_autocomplete_sources_path     GET /:project_id/autocomplete_sources/milestones(.:format)     projects/autocomplete_sources#milestones
   # commands_namespace_project_autocomplete_sources_path       GET /:project_id/autocomplete_sources/commands(.:format)       projects/autocomplete_sources#commands
+  # snippets_namespace_project_autocomplete_sources_path       GET /:project_id/autocomplete_sources/snippets(.:format)       projects/autocomplete_sources#snippets
   describe Projects::AutocompleteSourcesController, 'routing' do
-    [:members, :issues, :merge_requests, :labels, :milestones, :commands].each do |action|
+    [:members, :issues, :merge_requests, :labels, :milestones, :commands, :snippets].each do |action|
       it "to ##{action}" do
         expect(get("/gitlab/gitlabhq/autocomplete_sources/#{action}")).to route_to("projects/autocomplete_sources##{action}", namespace_id: 'gitlab', project_id: 'gitlabhq')
       end
diff --git a/spec/services/projects/update_service_spec.rb b/spec/services/projects/update_service_spec.rb
index 695b9980548..d58ff2cedc0 100644
--- a/spec/services/projects/update_service_spec.rb
+++ b/spec/services/projects/update_service_spec.rb
@@ -340,6 +340,27 @@ describe Projects::UpdateService do
         call_service
       end
     end
+
+    context 'when updating #pages_access_level' do
+      subject(:call_service) do
+        update_project(project, admin, project_feature_attributes: { pages_access_level: ProjectFeature::PRIVATE })
+      end
+
+      it 'updates the attribute' do
+        expect { call_service }
+          .to change { project.project_feature.pages_access_level }
+          .to(ProjectFeature::PRIVATE)
+      end
+
+      it 'calls Projects::UpdatePagesConfigurationService' do
+        expect(Projects::UpdatePagesConfigurationService)
+          .to receive(:new)
+          .with(project)
+          .and_call_original
+
+        call_service
+      end
+    end
   end
 
   describe '#run_auto_devops_pipeline?' do
diff --git a/spec/spec_helper.rb b/spec/spec_helper.rb
index d1337325973..cd69160be10 100644
--- a/spec/spec_helper.rb
+++ b/spec/spec_helper.rb
@@ -34,6 +34,11 @@ Rainbow.enabled = false
 # Requires supporting ruby files with custom matchers and macros, etc,
 # in spec/support/ and its subdirectories.
 # Requires helpers, and shared contexts/examples first since they're used in other support files
+
+# Load these first since they may be required by other helpers
+require Rails.root.join("spec/support/helpers/git_helpers.rb")
+
+# Then the rest
 Dir[Rails.root.join("spec/support/helpers/*.rb")].each { |f| require f }
 Dir[Rails.root.join("spec/support/shared_contexts/*.rb")].each { |f| require f }
 Dir[Rails.root.join("spec/support/shared_examples/*.rb")].each { |f| require f }