Add latest changes from gitlab-org/gitlab@master

Author: GitLab Bot

.gitlab-ci.yml

@@ -35,6 +35,8 @@ default:
 .default-branch-incident-variables: &default-branch-incident-variables
   CREATE_INCIDENT_FOR_PIPELINE_FAILURE: "true"
   NOTIFY_PIPELINE_FAILURE_CHANNEL: "master-broken"
+  BROKEN_BRANCH_INCIDENTS_PROJECT: "gitlab-org/quality/engineering-productivity/master-broken-incidents"
+  BROKEN_BRANCH_INCIDENTS_PROJECT_TOKEN: "${BROKEN_MASTER_INCIDENTS_PROJECT_TOKEN}"
 
 workflow:
   name: '$PIPELINE_NAME'
@@ -107,6 +109,9 @@ workflow:
         <<: *ruby2-variables
         NOTIFY_PIPELINE_FAILURE_CHANNEL: "releases"
         PIPELINE_NAME: 'Ruby 2 $CI_COMMIT_BRANCH branch pipeline'
+        CREATE_INCIDENT_FOR_PIPELINE_FAILURE: "true"
+        BROKEN_BRANCH_INCIDENTS_PROJECT: "gitlab-org/release/tasks"
+        BROKEN_BRANCH_INCIDENTS_PROJECT_TOKEN: "${BROKEN_STABLE_INCIDENTS_PROJECT_TOKEN}"
     - if: '$CI_COMMIT_BRANCH =~ /^\d+-\d+-auto-deploy-\d+$/'
       variables:
         <<: *ruby2-variables

.gitlab/ci/notify.gitlab-ci.yml

@@ -43,8 +43,9 @@ notify-pipeline-failure:
     - .notify:rules:notify-pipeline-failure
   image: ${GITLAB_DEPENDENCY_PROXY_ADDRESS}ruby:${RUBY_VERSION}
   variables:
-    BROKEN_MASTER_INCIDENTS_PROJECT: "gitlab-org/quality/engineering-productivity/master-broken-incidents"
-    BROKEN_MASTER_INCIDENT_JSON: "${CI_PROJECT_DIR}/incident.json"
+    INCIDENT_PROJECT: "#{BROKEN_BRANCH_INCIDENTS_PROJECT}"
+    BROKEN_BRANCH_PROJECT_TOKEN: "${BROKEN_BRANCH_INCIDENTS_PROJECT_TOKEN}"
+    INCIDENT_JSON: "${CI_PROJECT_DIR}/incident.json"
     SLACK_CHANNEL: "${NOTIFY_PIPELINE_FAILURE_CHANNEL}"
     FAILED_PIPELINE_SLACK_MESSAGE_FILE: "${CI_PROJECT_DIR}/failed_pipeline_slack_message.json"
   before_script:
@@ -54,17 +55,17 @@ notify-pipeline-failure:
   script:
     - |
       if [[ "${CREATE_INCIDENT_FOR_PIPELINE_FAILURE}" == "true" ]]; then
-        scripts/create-pipeline-failure-incident.rb -p ${BROKEN_MASTER_INCIDENTS_PROJECT} -f ${BROKEN_MASTER_INCIDENT_JSON} -t ${BROKEN_MASTER_INCIDENTS_PROJECT_TOKEN};
-        echosuccess "Created incident $(jq '.web_url' ${BROKEN_MASTER_INCIDENT_JSON})";
+        scripts/create-pipeline-failure-incident.rb -p ${INCIDENT_PROJECT} -f ${INCIDENT_JSON} -t ${BROKEN_BRANCH_PROJECT_TOKEN};
+        echosuccess "Created incident $(jq '.web_url' ${INCIDENT_JSON})";
       fi
     - |
-      scripts/generate-failed-pipeline-slack-message.rb -i ${BROKEN_MASTER_INCIDENT_JSON} -f ${FAILED_PIPELINE_SLACK_MESSAGE_FILE};
+      scripts/generate-failed-pipeline-slack-message.rb -i ${INCIDENT_JSON} -f ${FAILED_PIPELINE_SLACK_MESSAGE_FILE};
       curl -X POST -H 'Content-Type: application/json' --data @${FAILED_PIPELINE_SLACK_MESSAGE_FILE} "$CI_SLACK_WEBHOOK_URL" ||
         scripts/slack ${SLACK_CHANNEL} "☠️  Broken pipeline notification failed! ☠️  See ${CI_JOB_URL}" ci_failing "Failed pipeline reporter"
 
   artifacts:
     paths:
-      - ${BROKEN_MASTER_INCIDENT_JSON}
+      - ${INCIDENT_JSON}
       - ${FAILED_PIPELINE_SLACK_MESSAGE_FILE}
     when: always
     expire_in: 2 days

.gitlab/ci/rules.gitlab-ci.yml

@@ -2096,7 +2096,7 @@
       changes: *code-patterns
       when: manual
       allow_failure: true
-    - <<: *if-dot-com-gitlab-org-schedule
+    - <<: *if-dot-com-ee-schedule-default-branch-maintenance
       allow_failure: true
 
 .review:rules:review-k8s-resources-count-checks:

.rubocop_todo/performance/string_include.yml

@@ -1 +1 @@
-4e200026c03189abe2c60b071204340c4af5cf35
+6eb7389db0d54ef9ba3622eb7d1412f71e9deb2f

GITALY_SERVER_VERSION

@@ -6,6 +6,8 @@ import getIssueStateQuery from '~/issues/show/queries/get_issue_state.query.grap
 import createDefaultClient from '~/lib/graphql';
 import typeDefs from '~/work_items/graphql/typedefs.graphql';
 import { WIDGET_TYPE_NOTES } from '~/work_items/constants';
+import getWorkItemLinksQuery from '~/work_items/graphql/work_item_links.query.graphql';
+import { findHierarchyWidgetChildren } from '~/work_items/utils';
 
 export const config = {
   typeDefs,
@@ -143,6 +145,28 @@ export const config = {
 
 export const resolvers = {
   Mutation: {
+    addHierarchyChild: (_, { id, workItem }, { cache }) => {
+      const queryArgs = { query: getWorkItemLinksQuery, variables: { id } };
+      const sourceData = cache.readQuery(queryArgs);
+
+      const data = produce(sourceData, (draftState) => {
+        findHierarchyWidgetChildren(draftState.workItem).push(workItem);
+      });
+
+      cache.writeQuery({ ...queryArgs, data });
+    },
+    removeHierarchyChild: (_, { id, workItem }, { cache }) => {
+      const queryArgs = { query: getWorkItemLinksQuery, variables: { id } };
+      const sourceData = cache.readQuery(queryArgs);
+
+      const data = produce(sourceData, (draftState) => {
+        const hierarchyChildren = findHierarchyWidgetChildren(draftState.workItem);
+        const index = hierarchyChildren.findIndex((child) => child.id === workItem.id);
+        hierarchyChildren.splice(index, 1);
+      });
+
+      cache.writeQuery({ ...queryArgs, data });
+    },
     updateIssueState: (_, { issueType = undefined, isDirty = false }, { cache }) => {
       const sourceData = cache.readQuery({ query: getIssueStateQuery });
       const data = produce(sourceData, (draftData) => {

app/assets/javascripts/graphql_shared/issuable_client.js

@@ -1,14 +1,14 @@
 import Vue from 'vue';
 import { mapGetters } from 'vuex';
 import errorTrackingStore from '~/error_tracking/store';
+import { apolloProvider } from '~/graphql_shared/issuable_client';
 import { parseBoolean } from '~/lib/utils/common_utils';
 import { scrollToTargetOnResize } from '~/lib/utils/resize_observer';
 import IssueApp from './components/app.vue';
 import HeaderActions from './components/header_actions.vue';
 import IncidentTabs from './components/incidents/incident_tabs.vue';
 import SentryErrorStackTrace from './components/sentry_error_stack_trace.vue';
 import { INCIDENT_TYPE, issueState } from './constants';
-import apolloProvider from './graphql';
 import getIssueStateQuery from './queries/get_issue_state.query.graphql';
 
 const bootstrapApollo = (state = {}) => {

app/assets/javascripts/issues/show/graphql.js

@@ -1,5 +1,5 @@
 import Vue from 'vue';
-import apolloProvider from '~/issues/show/graphql';
+import { apolloProvider } from '~/graphql_shared/issuable_client';
 import { parseBoolean } from '~/lib/utils/common_utils';
 import RelatedIssuesRoot from './components/related_issues_root.vue';
 

app/assets/javascripts/issues/show/index.js

@@ -1,6 +1,5 @@
 <script>
 import { GlDropdown, GlDropdownItem, GlIcon, GlLoadingIcon, GlTooltipDirective } from '@gitlab/ui';
-import { produce } from 'immer';
 import { isEmpty } from 'lodash';
 import { s__ } from '~/locale';
 import { convertToGraphQLId, getIdFromGraphQLId } from '~/graphql_shared/utils';
@@ -18,6 +17,8 @@ import {
   WORK_ITEM_STATUS_TEXT,
 } from '../../constants';
 import getWorkItemLinksQuery from '../../graphql/work_item_links.query.graphql';
+import addHierarchyChildMutation from '../../graphql/add_hierarchy_child.mutation.graphql';
+import removeHierarchyChildMutation from '../../graphql/remove_hierarchy_child.mutation.graphql';
 import updateWorkItemMutation from '../../graphql/update_work_item.mutation.graphql';
 import workItemQuery from '../../graphql/work_item.query.graphql';
 import workItemByIidQuery from '../../graphql/work_item_by_iid.query.graphql';
@@ -177,10 +178,6 @@ export default {
     hideAddForm() {
       this.isShownAddForm = false;
     },
-    addChild(child) {
-      const { defaultClient: client } = this.$apollo.provider.clients;
-      this.toggleChildFromCache(child, child.id, client);
-    },
     openChild(child, e) {
       if (isMetaKey(e)) {
         return;
@@ -194,9 +191,8 @@ export default {
       this.activeChild = {};
       this.updateWorkItemIdUrlQuery();
     },
-    handleWorkItemDeleted(childId) {
-      const { defaultClient: client } = this.$apollo.provider.clients;
-      this.toggleChildFromCache(null, childId, client);
+    handleWorkItemDeleted(child) {
+      this.removeHierarchyChild(child);
       this.activeToast = this.$toast.show(s__('WorkItem|Task deleted'));
     },
     updateWorkItemIdUrlQuery({ id, iid } = {}) {
@@ -205,38 +201,31 @@ export default {
         : { work_item_id: getIdFromGraphQLId(id) };
       updateHistory({ url: setUrlParams(params), replace: true });
     },
-    toggleChildFromCache(workItem, childId, store) {
-      const sourceData = store.readQuery({
-        query: getWorkItemLinksQuery,
-        variables: { id: this.issuableGid },
-      });
-
-      const newData = produce(sourceData, (draftState) => {
-        const widgetHierarchy = draftState.workItem.widgets.find(
-          (widget) => widget.type === WIDGET_TYPE_HIERARCHY,
-        );
-
-        const index = widgetHierarchy.children.nodes.findIndex((child) => child.id === childId);
-
-        if (index >= 0) {
-          widgetHierarchy.children.nodes.splice(index, 1);
-        } else {
-          widgetHierarchy.children.nodes.push(workItem);
-        }
+    async addHierarchyChild(workItem) {
+      return this.$apollo.mutate({
+        mutation: addHierarchyChildMutation,
+        variables: { id: this.issuableGid, workItem },
       });
-
-      store.writeQuery({
-        query: getWorkItemLinksQuery,
-        variables: { id: this.issuableGid },
-        data: newData,
+    },
+    async removeHierarchyChild(workItem) {
+      return this.$apollo.mutate({
+        mutation: removeHierarchyChildMutation,
+        variables: { id: this.issuableGid, workItem },
       });
     },
     async updateWorkItem(workItem, childId, parentId) {
-      return this.$apollo.mutate({
+      const response = await this.$apollo.mutate({
         mutation: updateWorkItemMutation,
         variables: { input: { id: childId, hierarchyWidget: { parentId } } },
-        update: (store) => this.toggleChildFromCache(workItem, childId, store),
       });
+
+      if (parentId === null) {
+        await this.removeHierarchyChild(workItem);
+      } else {
+        await this.addHierarchyChild(workItem);
+      }
+
+      return response;
     },
     async undoChildRemoval(workItem, childId) {
       const { data } = await this.updateWorkItem(workItem, childId, this.issuableGid);
@@ -246,7 +235,7 @@ export default {
       }
     },
     async removeChild(childId) {
-      const { data } = await this.updateWorkItem(null, childId, null);
+      const { data } = await this.updateWorkItem({ id: childId }, childId, null);
 
       if (data.workItemUpdate.errors.length === 0) {
         this.activeToast = this.$toast.show(s__('WorkItem|Child removed'), {
@@ -365,7 +354,7 @@ export default {
           :form-type="formType"
           :parent-work-item-type="workItem.workItemType.name"
           @cancel="hideAddForm"
-          @addWorkItemChild="addChild"
+          @addWorkItemChild="addHierarchyChild"
         />
         <work-item-link-child
           v-for="child in children"
@@ -384,7 +373,7 @@ export default {
           :work-item-id="activeChild.id"
           :work-item-iid="activeChild.iid"
           @close="closeModal"
-          @workItemDeleted="handleWorkItemDeleted(activeChild.id)"
+          @workItemDeleted="handleWorkItemDeleted(activeChild)"
         />
       </template>
     </template>

app/assets/javascripts/related_issues/index.js

@@ -0,0 +1,3 @@
+mutation addHierarchyChild($id: WorkItemID!, $workItem: WorkItem!) {
+  addHierarchyChild(id: $id, workItem: $workItem) @client
+}

app/assets/javascripts/work_items/components/work_item_links/work_item_links.vue

@@ -0,0 +1,3 @@
+mutation removeHierarchyChild($id: WorkItemID!, $workItem: WorkItem!) {
+  removeHierarchyChild(id: $id, workItem: $workItem) @client
+}

app/assets/javascripts/work_items/graphql/add_hierarchy_child.mutation.graphql

@@ -1,3 +1,4 @@
+import { WIDGET_TYPE_HIERARCHY } from '~/work_items/constants';
 import workItemQuery from './graphql/work_item.query.graphql';
 import workItemByIidQuery from './graphql/work_item_by_iid.query.graphql';
 import workItemNotesIdQuery from './graphql/work_item_notes.query.graphql';
@@ -10,3 +11,6 @@ export function getWorkItemQuery(isFetchedByIid) {
 export function getWorkItemNotesQuery(isFetchedByIid) {
   return isFetchedByIid ? workItemNotesByIidQuery : workItemNotesIdQuery;
 }
+
+export const findHierarchyWidgetChildren = (workItem) =>
+  workItem.widgets.find((widget) => widget.type === WIDGET_TYPE_HIERARCHY).children.nodes;

app/assets/javascripts/work_items/graphql/remove_hierarchy_child.mutation.graphql

@@ -24,12 +24,12 @@ def serializable_hash(options = nil)
 
     options[:except].concat self.class.attributes_exempt_from_serializable_hash
 
-    if self.class.respond_to?(:encrypted_attributes)
-      options[:except].concat self.class.encrypted_attributes.keys
+    if self.class.respond_to?(:attr_encrypted_attributes)
+      options[:except].concat self.class.attr_encrypted_attributes.keys
 
       # Per https://github.com/attr-encrypted/attr_encrypted/blob/a96693e9a2a25f4f910bf915e29b0f364f277032/lib/attr_encrypted.rb#L413
-      options[:except].concat self.class.encrypted_attributes.values.map { |v| v[:attribute] }
-      options[:except].concat self.class.encrypted_attributes.values.map { |v| "#{v[:attribute]}_iv" }
+      options[:except].concat self.class.attr_encrypted_attributes.values.map { |v| v[:attribute] }
+      options[:except].concat self.class.attr_encrypted_attributes.values.map { |v| "#{v[:attribute]}_iv" }
     end
 
     super(options)

app/assets/javascripts/work_items/utils.js

@@ -12,6 +12,7 @@ class DeployKey < Key
   has_many :deploy_keys_projects_with_write_access, -> { with_write_access }, class_name: "DeployKeysProject", inverse_of: :deploy_key
   has_many :projects_with_write_access, -> { includes(:route) }, class_name: 'Project', through: :deploy_keys_projects_with_write_access, source: :project
   has_many :protected_branch_push_access_levels, class_name: '::ProtectedBranch::PushAccessLevel', inverse_of: :deploy_key
+  has_many :protected_tag_create_access_levels, class_name: '::ProtectedTag::CreateAccessLevel', inverse_of: :deploy_key
 
   scope :in_projects, ->(projects) { joins(:deploy_keys_projects).where(deploy_keys_projects: { project_id: projects }) }
   scope :with_write_access, -> { joins(:deploy_keys_projects).merge(DeployKeysProject.with_write_access) }

app/models/concerns/sensitive_serializable_hash.rb

@@ -45,7 +45,7 @@ def reset_token
   end
 
   def token
-    decrypt(:token, encrypted_token)
+    attr_decrypt(:token, encrypted_token)
   end
 
   def check_token_changes

app/models/deploy_key.rb

@@ -493,9 +493,9 @@ def to_database_hash
 
   def reencrypt_properties
     unless properties.nil? || properties.empty?
-      alg = self.class.encrypted_attributes[:properties][:algorithm]
+      alg = self.class.attr_encrypted_attributes[:properties][:algorithm]
       iv = generate_iv(alg)
-      ep = self.class.encrypt(:properties, properties, { iv: iv })
+      ep = self.class.attr_encrypt(:properties, properties, { iv: iv })
     end
 
     { 'encrypted_properties' => ep, 'encrypted_properties_iv' => iv }

app/models/grafana_integration.rb

@@ -4,9 +4,43 @@ class ProtectedTag::CreateAccessLevel < ApplicationRecord
   include Importable
   include ProtectedTagAccess
 
+  belongs_to :deploy_key
+
+  validates :access_level, uniqueness: { scope: :protected_tag_id, if: :role?,
+                                         conditions: -> { where(user_id: nil, group_id: nil, deploy_key_id: nil) } }
+  validates :deploy_key_id, uniqueness: { scope: :protected_tag_id, allow_nil: true }
+  validate :validate_deploy_key_membership
+
+  def type
+    if deploy_key.present?
+      :deploy_key
+    else
+      super
+    end
+  end
+
   def check_access(user)
     return false if access_level == Gitlab::Access::NO_ACCESS
 
+    if user && deploy_key.present?
+      return user.can?(:read_project, project) && enabled_deploy_key_for_user?(deploy_key, user)
+    end
+
     super
   end
+
+  private
+
+  def validate_deploy_key_membership
+    return unless deploy_key
+
+    return if project.deploy_keys_projects.where(deploy_key: deploy_key).exists?
+
+    errors.add(:deploy_key, 'is not enabled for this project')
+  end
+
+  def enabled_deploy_key_for_user?(deploy_key, user)
+    deploy_key.user_id == user.id &&
+      DeployKey.with_write_access_for_project(protected_tag.project, deploy_key: deploy_key).any?
+  end
 end

app/models/integration.rb

@@ -121,7 +121,7 @@ def invalid_path_error?(err)
 
   def invalid_signature_error?(err)
     err.is_a?(ArgumentError) &&
-      err.message.downcase.match?(/failed to parse signature/)
+      err.message.downcase.include?('failed to parse signature')
   end
 
   def only_rename_action?(action)