14 files changed, 237 insertions, 20 deletions

diff --git a/app/services/ci/destroy_pipeline_service.rb b/app/services/ci/destroy_pipeline_service.rb
index 13f892aabb8..5c4a34043c1 100644
--- a/app/services/ci/destroy_pipeline_service.rb
+++ b/app/services/ci/destroy_pipeline_service.rb
@@ -5,8 +5,6 @@ module Ci
     def execute(pipeline)
       raise Gitlab::Access::AccessDeniedError unless can?(current_user, :destroy_pipeline, pipeline)
 
-      AuditEventService.new(current_user, pipeline).security_event
-
       pipeline.destroy!
     end
   end
diff --git a/app/services/clusters/applications/base_helm_service.rb b/app/services/clusters/applications/base_helm_service.rb
index e86ca8cf1d0..8a71730d5ec 100644
--- a/app/services/clusters/applications/base_helm_service.rb
+++ b/app/services/clusters/applications/base_helm_service.rb
@@ -45,6 +45,10 @@ module Clusters
       def install_command
         @install_command ||= app.install_command
       end
+
+      def upgrade_command(new_values = "")
+        app.upgrade_command(new_values)
+      end
     end
   end
 end
diff --git a/app/services/error_tracking/list_issues_service.rb b/app/services/error_tracking/list_issues_service.rb
new file mode 100644
index 00000000000..4cc35cfa4a8
--- /dev/null
+++ b/app/services/error_tracking/list_issues_service.rb
@@ -0,0 +1,49 @@
+# frozen_string_literal: true
+
+module ErrorTracking
+  class ListIssuesService < ::BaseService
+    DEFAULT_ISSUE_STATUS = 'unresolved'
+    DEFAULT_LIMIT = 20
+
+    def execute
+      return error('not enabled') unless enabled?
+      return error('access denied') unless can_read?
+
+      result = project_error_tracking_setting
+        .list_sentry_issues(issue_status: issue_status, limit: limit)
+
+      # our results are not yet ready
+      unless result
+        return error('not ready', :no_content)
+      end
+
+      success(issues: result[:issues])
+    end
+
+    def external_url
+      project_error_tracking_setting&.sentry_external_url
+    end
+
+    private
+
+    def project_error_tracking_setting
+      project.error_tracking_setting
+    end
+
+    def issue_status
+      params[:issue_status] || DEFAULT_ISSUE_STATUS
+    end
+
+    def limit
+      params[:limit] || DEFAULT_LIMIT
+    end
+
+    def enabled?
+      project_error_tracking_setting&.enabled?
+    end
+
+    def can_read?
+      can?(current_user, :read_sentry_issue, project)
+    end
+  end
+end
diff --git a/app/services/import/base_service.rb b/app/services/import/base_service.rb
new file mode 100644
index 00000000000..2683c75e41f
--- /dev/null
+++ b/app/services/import/base_service.rb
@@ -0,0 +1,35 @@
+# frozen_string_literal: true
+
+module Import
+  class BaseService < ::BaseService
+    def initialize(client, user, params)
+      @client = client
+      @current_user = user
+      @params = params
+    end
+
+    private
+
+    def find_or_create_namespace(namespace, owner)
+      namespace = params[:target_namespace].presence || namespace
+
+      return current_user.namespace if namespace == owner
+
+      group = Groups::NestedCreateService.new(current_user, group_path: namespace).execute
+
+      group.errors.any? ? current_user.namespace : group
+    rescue => e
+      Gitlab::AppLogger.error(e)
+
+      current_user.namespace
+    end
+
+    def project_save_error(project)
+      project.errors.full_messages.join(', ')
+    end
+
+    def success(project)
+      super().merge(project: project, status: :success)
+    end
+  end
+end
diff --git a/app/services/import/github_service.rb b/app/services/import/github_service.rb
new file mode 100644
index 00000000000..a2533683da9
--- /dev/null
+++ b/app/services/import/github_service.rb
@@ -0,0 +1,48 @@
+# frozen_string_literal: true
+
+module Import
+  class GithubService < Import::BaseService
+    attr_accessor :client
+    attr_reader :params, :current_user
+
+    def execute(access_params, provider)
+      unless authorized?
+        return error('This namespace has already been taken! Please choose another one.', :unprocessable_entity)
+      end
+
+      project = Gitlab::LegacyGithubImport::ProjectCreator
+                  .new(repo, project_name, target_namespace, current_user, access_params, type: provider)
+                  .execute(extra_project_attrs)
+
+      if project.persisted?
+        success(project)
+      else
+        error(project_save_error(project), :unprocessable_entity)
+      end
+    end
+
+    def repo
+      @repo ||= client.repo(params[:repo_id].to_i)
+    end
+
+    def project_name
+      @project_name ||= params[:new_name].presence || repo.name
+    end
+
+    def namespace_path
+      @namespace_path ||= params[:target_namespace].presence || current_user.namespace_path
+    end
+
+    def target_namespace
+      @target_namespace ||= find_or_create_namespace(namespace_path, current_user.namespace_path)
+    end
+
+    def extra_project_attrs
+      {}
+    end
+
+    def authorized?
+      can?(current_user, :create_projects, target_namespace)
+    end
+  end
+end
diff --git a/app/services/issuable_base_service.rb b/app/services/issuable_base_service.rb
index c7e7bb55e4b..805bb5b510d 100644
--- a/app/services/issuable_base_service.rb
+++ b/app/services/issuable_base_service.rb
@@ -61,10 +61,10 @@ class IssuableBaseService < BaseService
     return unless milestone_id
 
     params[:milestone_id] = '' if milestone_id == IssuableFinder::NONE
-    group_ids = project.group&.self_and_ancestors&.pluck(:id)
+    groups = project.group&.self_and_ancestors&.select(:id)
 
     milestone =
-      Milestone.for_projects_and_groups([project.id], group_ids).find_by_id(milestone_id)
+      Milestone.for_projects_and_groups([project.id], groups).find_by_id(milestone_id)
 
     params[:milestone_id] = '' unless milestone
   end
diff --git a/app/services/labels/create_service.rb b/app/services/labels/create_service.rb
index fe34be41ac1..db710bac900 100644
--- a/app/services/labels/create_service.rb
+++ b/app/services/labels/create_service.rb
@@ -3,7 +3,7 @@
 module Labels
   class CreateService < Labels::BaseService
     def initialize(params = {})
-      @params = params.dup.with_indifferent_access
+      @params = params.to_h.dup.with_indifferent_access
     end
 
     # returns the created label
diff --git a/app/services/labels/update_service.rb b/app/services/labels/update_service.rb
index c3a720a1c66..e563447c64c 100644
--- a/app/services/labels/update_service.rb
+++ b/app/services/labels/update_service.rb
@@ -3,7 +3,7 @@
 module Labels
   class UpdateService < Labels::BaseService
     def initialize(params = {})
-      @params = params.dup.with_indifferent_access
+      @params = params.to_h.dup.with_indifferent_access
     end
 
     # returns the updated label
diff --git a/app/services/lfs/locks_finder_service.rb b/app/services/lfs/locks_finder_service.rb
index 4a5b2a52921..192ce3d3c2a 100644
--- a/app/services/lfs/locks_finder_service.rb
+++ b/app/services/lfs/locks_finder_service.rb
@@ -12,7 +12,7 @@ module Lfs
 
     # rubocop: disable CodeReuse/ActiveRecord
     def find_locks
-      options = params.slice(:id, :path).compact.symbolize_keys
+      options = params.slice(:id, :path).to_h.compact.symbolize_keys
 
       project.lfs_file_locks.where(options)
     end
diff --git a/app/services/milestones/promote_service.rb b/app/services/milestones/promote_service.rb
index 39071b5dc14..cbe5996e8ca 100644
--- a/app/services/milestones/promote_service.rb
+++ b/app/services/milestones/promote_service.rb
@@ -82,11 +82,9 @@ module Milestones
     end
     # rubocop: enable CodeReuse/ActiveRecord
 
-    # rubocop: disable CodeReuse/ActiveRecord
     def group_project_ids
-      @group_project_ids ||= group.projects.pluck(:id)
+      group.projects.select(:id)
     end
-    # rubocop: enable CodeReuse/ActiveRecord
 
     def raise_error(message)
       raise PromoteMilestoneError, "Promotion failed - #{message}"
diff --git a/app/services/projects/autocomplete_service.rb b/app/services/projects/autocomplete_service.rb
index 61f6402a810..3dad90188cf 100644
--- a/app/services/projects/autocomplete_service.rb
+++ b/app/services/projects/autocomplete_service.rb
@@ -14,7 +14,7 @@ module Projects
         order: { due_date: :asc, title: :asc }
       }
 
-      finder_params[:group_ids] = @project.group.self_and_ancestors_ids if @project.group
+      finder_params[:group_ids] = @project.group.self_and_ancestors.select(:id) if @project.group
 
       MilestonesFinder.new(finder_params).execute.select([:iid, :title])
     end
diff --git a/app/services/projects/protect_default_branch_service.rb b/app/services/projects/protect_default_branch_service.rb
new file mode 100644
index 00000000000..245490791bf
--- /dev/null
+++ b/app/services/projects/protect_default_branch_service.rb
@@ -0,0 +1,67 @@
+# frozen_string_literal: true
+
+module Projects
+  # Service class that can be used to execute actions necessary after creating a
+  # default branch.
+  class ProtectDefaultBranchService
+    attr_reader :project, :default_branch_protection
+
+    # @param [Project] project
+    def initialize(project)
+      @project = project
+
+      @default_branch_protection = Gitlab::Access::BranchProtection
+        .new(Gitlab::CurrentSettings.default_branch_protection)
+    end
+
+    def execute
+      protect_default_branch if default_branch
+    end
+
+    def protect_default_branch
+      # Ensure HEAD points to the default branch in case it is not master
+      project.change_head(default_branch)
+
+      create_protected_branch if protect_branch?
+    end
+
+    def create_protected_branch
+      params = {
+        name: default_branch,
+        push_access_levels_attributes: [{ access_level: push_access_level }],
+        merge_access_levels_attributes: [{ access_level: merge_access_level }]
+      }
+
+      # The creator of the project is always allowed to create protected
+      # branches, so we skip the authorization check in this service class.
+      ProtectedBranches::CreateService
+        .new(project, project.creator, params)
+        .execute(skip_authorization: true)
+    end
+
+    def protect_branch?
+      default_branch_protection.any? &&
+        !ProtectedBranch.protected?(project, default_branch)
+    end
+
+    def default_branch
+      project.default_branch
+    end
+
+    def push_access_level
+      if default_branch_protection.developer_can_push?
+        Gitlab::Access::DEVELOPER
+      else
+        Gitlab::Access::MAINTAINER
+      end
+    end
+
+    def merge_access_level
+      if default_branch_protection.developer_can_merge?
+        Gitlab::Access::DEVELOPER
+      else
+        Gitlab::Access::MAINTAINER
+      end
+    end
+  end
+end
diff --git a/app/services/suggestions/apply_service.rb b/app/services/suggestions/apply_service.rb
index d931d528c86..cc47b46b527 100644
--- a/app/services/suggestions/apply_service.rb
+++ b/app/services/suggestions/apply_service.rb
@@ -11,6 +11,10 @@ module Suggestions
         return error('Suggestion is not appliable')
       end
 
+      unless latest_diff_refs?(suggestion)
+        return error('The file has been changed')
+      end
+
       params = file_update_params(suggestion)
       result = ::Files::UpdateService.new(suggestion.project, @current_user, params).execute
 
@@ -19,30 +23,44 @@ module Suggestions
       end
 
       result
+    rescue Files::UpdateService::FileChangedError
+      error('The file has been changed')
     end
 
     private
 
-    def file_update_params(suggestion)
-      diff_file = suggestion.diff_file
+    # Checks whether the latest diff refs for the branch matches with
+    # the position refs we're using to update the file content. Since
+    # the persisted refs are updated async (for MergeRequest),
+    # it's more consistent to fetch this data directly from the repository.
+    def latest_diff_refs?(suggestion)
+      suggestion.position.diff_refs == suggestion.noteable.repository_diff_refs
+    end
 
-      file_path = diff_file.file_path
-      branch_name = suggestion.noteable.source_branch
-      file_content = new_file_content(suggestion)
+    def file_update_params(suggestion)
+      blob = suggestion.diff_file.new_blob
+      file_path = suggestion.file_path
+      branch_name = suggestion.branch
+      file_content = new_file_content(suggestion, blob)
       commit_message = "Apply suggestion to #{file_path}"
 
+      file_last_commit =
+        Gitlab::Git::Commit.last_for_path(suggestion.project.repository,
+                                          blob.commit_id,
+                                          blob.path)
+
       {
         file_path: file_path,
         branch_name: branch_name,
         start_branch: branch_name,
         commit_message: commit_message,
-        file_content: file_content
+        file_content: file_content,
+        last_commit_sha: file_last_commit&.id
       }
     end
 
-    def new_file_content(suggestion)
+    def new_file_content(suggestion, blob)
       range = suggestion.from_line_index..suggestion.to_line_index
-      blob = suggestion.diff_file.new_blob
 
       blob.load_all_data!
       content = blob.data.lines
diff --git a/app/services/users/update_service.rb b/app/services/users/update_service.rb
index af4fe1aebb9..0b00bd135eb 100644
--- a/app/services/users/update_service.rb
+++ b/app/services/users/update_service.rb
@@ -55,7 +55,7 @@ module Users
         params.reject! { |key, _| read_only.include?(key.to_sym) }
       end
 
-      @user.assign_attributes(params) if params.any?
+      @user.assign_attributes(params) unless params.empty?
     end
   end
 end