16 files changed, 100 insertions, 38 deletions

diff --git a/app/controllers/projects/pipelines_controller.rb b/app/controllers/projects/pipelines_controller.rb
index 10a6d2d3f26..477ba36e9d1 100644
--- a/app/controllers/projects/pipelines_controller.rb
+++ b/app/controllers/projects/pipelines_controller.rb
@@ -199,12 +199,7 @@ class Projects::PipelinesController < Projects::ApplicationController
   end
 
   def latest_pipeline
-    ref = params['ref'].presence || @project.default_branch
-    sha = @project.commit(ref)&.sha
-
-    @project.ci_pipelines
-            .newest_first(ref: ref, sha: sha)
-            .first
+    @project.latest_pipeline_for_ref(params['ref'])
             &.present(current_user: current_user)
   end
 
diff --git a/app/finders/issuable_finder.rb b/app/finders/issuable_finder.rb
index 8ed6ff56e2b..2364777cdc5 100644
--- a/app/finders/issuable_finder.rb
+++ b/app/finders/issuable_finder.rb
@@ -46,10 +46,13 @@ class IssuableFinder
   # This is used in unassigning users
   NONE = '0'
 
+  NEGATABLE_PARAMS_HELPER_KEYS = %i[include_subgroups in].freeze
+
   attr_accessor :current_user, :params
 
-  def self.scalar_params
-    @scalar_params ||= %i[
+  class << self
+    def scalar_params
+      @scalar_params ||= %i[
       assignee_id
       assignee_username
       author_id
@@ -60,14 +63,30 @@ class IssuableFinder
       search
       in
     ]
-  end
+    end
 
-  def self.array_params
-    @array_params ||= { label_name: [], assignee_username: [] }
-  end
+    def array_params
+      @array_params ||= { label_name: [], assignee_username: [] }
+    end
+
+    # This should not be used in controller strong params!
+    def negatable_scalar_params
+      @negatable_scalar_params ||= scalar_params + %i[project_id group_id]
+    end
+
+    # This should not be used in controller strong params!
+    def negatable_array_params
+      @negatable_array_params ||= array_params.keys.append(:iids)
+    end
 
-  def self.valid_params
-    @valid_params ||= scalar_params + [array_params]
+    # This should not be used in controller strong params!
+    def negatable_params
+      @negatable_params ||= negatable_scalar_params + negatable_array_params
+    end
+
+    def valid_params
+      @valid_params ||= scalar_params + [array_params] + [{ not: [] }]
+    end
   end
 
   def initialize(current_user, params = {})
@@ -79,6 +98,9 @@ class IssuableFinder
     items = init_collection
     items = filter_items(items)
 
+    # Let's see if we have to negate anything
+    items = by_negation(items)
+
     # This has to be last as we use a CTE as an optimization fence
     # for counts by passing the force_cte param and enabling the
     # attempt_group_search_optimizations feature flag
@@ -366,6 +388,33 @@ class IssuableFinder
     Array(value).last.to_sym
   end
 
+  # Negates all params found in `negatable_params`
+  # rubocop: disable CodeReuse/ActiveRecord
+  def by_negation(items)
+    not_params = params[:not].dup
+    # API endpoints send in `nil` values so we test if there are any non-nil
+    return items unless not_params.present? && not_params.values.any?
+
+    not_params.keep_if { |_k, v| v.present? }.each do |(key, value)|
+      # These aren't negatable params themselves, but rather help other searches, so we skip them.
+      # They will be added into all the NOT searches.
+      next if NEGATABLE_PARAMS_HELPER_KEYS.include?(key.to_sym)
+      next unless self.class.negatable_params.include?(key.to_sym)
+
+      # These are "helper" params that are required inside the NOT to get the right results. They usually come in
+      # at the top-level params, but if they do come in inside the `:not` params, they should take precedence.
+      not_helpers = params.slice(*NEGATABLE_PARAMS_HELPER_KEYS).merge(params[:not].slice(*NEGATABLE_PARAMS_HELPER_KEYS))
+      not_param = { key => value }.with_indifferent_access.merge(not_helpers)
+
+      items_to_negate = self.class.new(current_user, not_param).execute
+
+      items = items.where.not(id: items_to_negate)
+    end
+
+    items
+  end
+  # rubocop: enable CodeReuse/ActiveRecord
+
   # rubocop: disable CodeReuse/ActiveRecord
   def by_scope(items)
     return items.none if current_user_related? && !current_user
diff --git a/app/helpers/page_layout_helper.rb b/app/helpers/page_layout_helper.rb
index ec1d8577f36..46e2c9ce56e 100644
--- a/app/helpers/page_layout_helper.rb
+++ b/app/helpers/page_layout_helper.rb
@@ -1,4 +1,3 @@
-# coding: utf-8
 # frozen_string_literal: true
 
 module PageLayoutHelper
diff --git a/app/helpers/projects_helper.rb b/app/helpers/projects_helper.rb
index 3fb39a19cf0..5ed95311767 100644
--- a/app/helpers/projects_helper.rb
+++ b/app/helpers/projects_helper.rb
@@ -562,7 +562,7 @@ module ProjectsHelper
       allowedVisibilityOptions: project_allowed_visibility_levels(project),
       visibilityHelpPath: help_page_path('public_access/public_access'),
       registryAvailable: Gitlab.config.registry.enabled,
-      registryHelpPath: help_page_path('user/project/container_registry'),
+      registryHelpPath: help_page_path('user/packages/container_registry/index'),
       lfsAvailable: Gitlab.config.lfs.enabled,
       lfsHelpPath: help_page_path('workflow/lfs/manage_large_binaries_with_git_lfs'),
       pagesAvailable: Gitlab.config.pages.enabled,
diff --git a/app/models/ci/artifact_blob.rb b/app/models/ci/artifact_blob.rb
index d87d6a5cb2f..ef00ad75683 100644
--- a/app/models/ci/artifact_blob.rb
+++ b/app/models/ci/artifact_blob.rb
@@ -4,7 +4,7 @@ module Ci
   class ArtifactBlob
     include BlobLike
 
-    EXTENSIONS_SERVED_BY_PAGES = %w[.html .htm .txt .json .log].freeze
+    EXTENSIONS_SERVED_BY_PAGES = %w[.html .htm .txt .json .xml .log].freeze
 
     attr_reader :entry
 
diff --git a/app/models/clusters/cluster.rb b/app/models/clusters/cluster.rb
index 7855fb69bd6..7a61622b139 100644
--- a/app/models/clusters/cluster.rb
+++ b/app/models/clusters/cluster.rb
@@ -37,13 +37,18 @@ module Clusters
 
     has_one :platform_kubernetes, class_name: 'Clusters::Platforms::Kubernetes', inverse_of: :cluster, autosave: true
 
-    has_one :application_helm, class_name: 'Clusters::Applications::Helm'
-    has_one :application_ingress, class_name: 'Clusters::Applications::Ingress'
-    has_one :application_cert_manager, class_name: 'Clusters::Applications::CertManager'
-    has_one :application_prometheus, class_name: 'Clusters::Applications::Prometheus'
-    has_one :application_runner, class_name: 'Clusters::Applications::Runner'
-    has_one :application_jupyter, class_name: 'Clusters::Applications::Jupyter'
-    has_one :application_knative, class_name: 'Clusters::Applications::Knative'
+    def self.has_one_cluster_application(name) # rubocop:disable Naming/PredicateName
+      application = APPLICATIONS[name.to_s]
+      has_one application.association_name, class_name: application.to_s # rubocop:disable Rails/ReflectionClassName
+    end
+
+    has_one_cluster_application :helm
+    has_one_cluster_application :ingress
+    has_one_cluster_application :cert_manager
+    has_one_cluster_application :prometheus
+    has_one_cluster_application :runner
+    has_one_cluster_application :jupyter
+    has_one_cluster_application :knative
 
     has_many :kubernetes_namespaces
 
@@ -127,15 +132,9 @@ module Clusters
     end
 
     def applications
-      [
-        application_helm || build_application_helm,
-        application_ingress || build_application_ingress,
-        application_cert_manager || build_application_cert_manager,
-        application_prometheus || build_application_prometheus,
-        application_runner || build_application_runner,
-        application_jupyter || build_application_jupyter,
-        application_knative || build_application_knative
-      ]
+      APPLICATIONS.values.map do |application_class|
+        public_send(application_class.association_name) || public_send("build_#{application_class.association_name}") # rubocop:disable GitlabSecurity/PublicSend
+      end
     end
 
     def provider
diff --git a/app/models/clusters/concerns/application_core.rb b/app/models/clusters/concerns/application_core.rb
index 803a65726d3..d1b57a21a7d 100644
--- a/app/models/clusters/concerns/application_core.rb
+++ b/app/models/clusters/concerns/application_core.rb
@@ -32,6 +32,10 @@ module Clusters
           self.to_s.demodulize.underscore
         end
 
+        def self.association_name
+          :"application_#{application_name}"
+        end
+
         def name
           self.class.application_name
         end
diff --git a/app/models/commit.rb b/app/models/commit.rb
index 1470b50f396..a442f607fbf 100644
--- a/app/models/commit.rb
+++ b/app/models/commit.rb
@@ -1,4 +1,3 @@
-# coding: utf-8
 # frozen_string_literal: true
 
 class Commit
diff --git a/app/models/project.rb b/app/models/project.rb
index 59c187fac31..57f1ca98ee2 100644
--- a/app/models/project.rb
+++ b/app/models/project.rb
@@ -753,6 +753,15 @@ class Project < ApplicationRecord
     latest_successful_build_for_ref(job_name, ref) || raise(ActiveRecord::RecordNotFound.new("Couldn't find job #{job_name}"))
   end
 
+  def latest_pipeline_for_ref(ref = default_branch)
+    ref = ref.presence || default_branch
+    sha = commit(ref)&.sha
+
+    return unless sha
+
+    ci_pipelines.newest_first(ref: ref, sha: sha).first
+  end
+
   def merge_base_commit(first_commit_id, second_commit_id)
     sha = repository.merge_base(first_commit_id, second_commit_id)
     commit_by(oid: sha) if sha
diff --git a/app/services/clusters/applications/base_service.rb b/app/services/clusters/applications/base_service.rb
index a9feb60be6e..67fb3ac8355 100644
--- a/app/services/clusters/applications/base_service.rb
+++ b/app/services/clusters/applications/base_service.rb
@@ -77,6 +77,10 @@ module Clusters
         params[:application]
       end
 
+      def application_class
+        Clusters::Cluster::APPLICATIONS[application_name]
+      end
+
       def create_oauth_application(application, request)
         oauth_application_params = {
           name: params[:application],
diff --git a/app/services/clusters/applications/create_service.rb b/app/services/clusters/applications/create_service.rb
index f723c42c049..2a626a402e4 100644
--- a/app/services/clusters/applications/create_service.rb
+++ b/app/services/clusters/applications/create_service.rb
@@ -10,7 +10,7 @@ module Clusters
       end
 
       def builder
-        cluster.public_send(:"application_#{application_name}") || # rubocop:disable GitlabSecurity/PublicSend
+        cluster.public_send(application_class.association_name) || # rubocop:disable GitlabSecurity/PublicSend
           cluster.public_send(:"build_application_#{application_name}") # rubocop:disable GitlabSecurity/PublicSend
       end
     end
diff --git a/app/services/clusters/applications/destroy_service.rb b/app/services/clusters/applications/destroy_service.rb
index f3a4c4f754a..d666682487b 100644
--- a/app/services/clusters/applications/destroy_service.rb
+++ b/app/services/clusters/applications/destroy_service.rb
@@ -16,7 +16,7 @@ module Clusters
       private
 
       def builder
-        cluster.public_send(:"application_#{application_name}") # rubocop:disable GitlabSecurity/PublicSend
+        cluster.public_send(application_class.association_name) # rubocop:disable GitlabSecurity/PublicSend
       end
     end
   end
diff --git a/app/services/clusters/applications/update_service.rb b/app/services/clusters/applications/update_service.rb
index 0fa937da865..7a36401f156 100644
--- a/app/services/clusters/applications/update_service.rb
+++ b/app/services/clusters/applications/update_service.rb
@@ -10,7 +10,7 @@ module Clusters
       end
 
       def builder
-        cluster.public_send(:"application_#{application_name}") # rubocop:disable GitlabSecurity/PublicSend
+        cluster.public_send(application_class.association_name) # rubocop:disable GitlabSecurity/PublicSend
       end
     end
   end
diff --git a/app/services/protected_branches/destroy_service.rb b/app/services/protected_branches/destroy_service.rb
index 7190bc2001b..acd15b0214f 100644
--- a/app/services/protected_branches/destroy_service.rb
+++ b/app/services/protected_branches/destroy_service.rb
@@ -9,3 +9,5 @@ module ProtectedBranches
     end
   end
 end
+
+ProtectedBranches::DestroyService.prepend_if_ee('EE::ProtectedBranches::DestroyService')
diff --git a/app/services/protected_branches/update_service.rb b/app/services/protected_branches/update_service.rb
index 4d7d498b8ca..226aefb64d0 100644
--- a/app/services/protected_branches/update_service.rb
+++ b/app/services/protected_branches/update_service.rb
@@ -10,3 +10,5 @@ module ProtectedBranches
     end
   end
 end
+
+ProtectedBranches::UpdateService.prepend_if_ee('EE::ProtectedBranches::UpdateService')
diff --git a/app/views/projects/registry/repositories/index.html.haml b/app/views/projects/registry/repositories/index.html.haml
index e34973f1f43..d0d06a0df7e 100644
--- a/app/views/projects/registry/repositories/index.html.haml
+++ b/app/views/projects/registry/repositories/index.html.haml
@@ -2,7 +2,7 @@
   .row.registry-placeholder.prepend-bottom-10
     .col-12
       #js-vue-registry-images{ data: { endpoint: project_container_registry_index_path(@project, format: :json),
-        "help_page_path" => help_page_path('user/project/container_registry'),
+        "help_page_path" => help_page_path('user/packages/container_registry/index'),
         "no_containers_image" => image_path('illustrations/docker-empty-state.svg'),
         "containers_error_image" => image_path('illustrations/docker-error-state.svg'),
         "repository_url" => escape_once(@project.container_registry_url),