.browserslistrc

 #
 # This list of browsers is a conservative definition, based on
-# https://docs.gitlab.com/ee/install/requirements.html#supported-web-browsers. We
-# also use the following reasoning to choose the target versions:
-#
-# - Actual Browser usage on gitlab.com
-# - Support second latest version of Firefox ESR
-# - Support Chrome / Edge versions about the same age as the Firefox ESR version chosen
-#
-# If need be we raise versions closer to the actual supported web browsers.
-#
-# See also this epic: https://gitlab.com/groups/gitlab-org/-/epics/3957
-#
-chrome >= 103
-edge >= 103
-firefox >= 102
-safari >= 15.6
+# https://docs.gitlab.com/ee/install/requirements.html#supported-web-browsers.
+# 
+# To see what browsers this targets, go here:
+# https://browsersl.ist/#q=%3E+0.5%25%2C+last+2+versions%2C+Firefox+ESR%2C+not+dead
+# 
 
+> 0.5%
+last 2 versions
+Firefox ESR
+not dead
\ No newline at end of file

.codeclimate.yml

----
-version: "2"
-plugins:
-  bundler-audit:
-    enabled: true
-  duplication:
-    enabled: true
-    config:
-      languages:
-        - ruby
-        - javascript
-  rubocop:
-    enabled: false
-exclude_patterns:
-  - "{ee/,jh/,}config/"
-  - "{ee/,jh/,}db/"
-  - "**/log/"
-  - "**/node_modules/"
-  - "**/spec/"
-  - "**/tmp/"
-  - "**/vendor/"
-  - .yarn-cache/
-  - backups/
-  - builds/
-  - coverage/
-  - file_hooks/
-  - plugins/
-  - public/
-  - shared/
-  - webpack-report/

.eslint_todo/index.mjs

+export { default as vueNoUnusedProperties } from './vue-no-unused-properties.mjs';

.eslintignore

-/app/assets/javascripts/locale/**/app.js
-/builds/
-/coverage/
-/coverage-frontend/
-/node_modules/
-/public/
-/tmp/
-/vendor/
-/sitespeed-result/
-/fixtures/**/*.graphql
-# Storybook build artifacts
-/storybook/public
-spec/fixtures/**/*.graphql

.eslintrc.yml

-extends:
-  - plugin:@gitlab/default
-  - plugin:@gitlab/i18n
-  - plugin:no-jquery/slim
-  - plugin:no-jquery/deprecated-3.4
-  - plugin:no-unsanitized/recommended-legacy
-  - ./tooling/eslint-config/conditionally_ignore.js
-globals:
-  __webpack_public_path__: true
-  gl: false
-  gon: false
-  localStorage: false
-  IS_EE: false
-plugins:
-  - no-jquery
-  - local-rules
-settings:
-  import/resolver:
-    webpack:
-      config: './config/webpack.config.js'
-rules:
-  import/no-commonjs: error
-  import/no-default-export: off
-  no-underscore-dangle:
-    - error
-    - allow:
-        - __
-        - _links
-  import/no-unresolved:
-    - error
-    - ignore:
-        # In FOSS, these import paths are rewritten using
-        # NormalModuleReplacementPlugin, which import/no-unresolved doesn't
-        # consider. See
-        # https://gitlab.com/gitlab-org/gitlab/-/merge_requests/89831.
-        - '^(ee|jh)_component/'
-  lines-between-class-members: off
-  # all offenses of no-jquery/no-animate-toggle are false positives ( $toast.show() )
-  no-jquery/no-animate-toggle: off
-  no-jquery/no-event-shorthand: off
-  no-jquery/no-serialize: error
-  promise/always-return: off
-  promise/no-callback-in-promise: off
-  '@gitlab/no-global-event-off': error
-  '@gitlab/vue-no-new-non-primitive-in-template':
-    - error
-    - allowNames:
-        - 'class(es)?$'
-        - '^style$'
-        - '^to$'
-        - '^$'
-        - '^variables$'
-        - 'attrs?$'
-  '@gitlab/vue-no-undef-apollo-properties': error
-  '@gitlab/tailwind': error
-  '@gitlab/vue-tailwind': error
-  no-param-reassign:
-    - error
-    - props: true
-      ignorePropertyModificationsFor:
-        - acc
-        - accumulator
-        - el
-        - element
-        - state
-      ignorePropertyModificationsForRegex:
-        - '^draft'
-  import/order:
-    - error
-    - groups:
-        - builtin
-        - external
-        - internal
-        - parent
-        - sibling
-        - index
-      pathGroups:
-        - pattern: ~/**
-          group: internal
-        - pattern: emojis/**
-          group: internal
-        - pattern: '{ee_,jh_,}empty_states/**'
-          group: internal
-        - pattern: '{ee_,jh_,}icons/**'
-          group: internal
-        - pattern: '{ee_,jh_,}images/**'
-          group: internal
-        - pattern: vendor/**
-          group: internal
-        - pattern: shared_queries/**
-          group: internal
-        - pattern: '{ee_,}spec/**'
-          group: internal
-        - pattern: '{ee_,jh_,}jest/**'
-          group: internal
-        - pattern: '{ee_,jh_,any_}else_ce/**'
-          group: internal
-        - pattern: ee/**
-          group: internal
-        - pattern: '{ee_,jh_,}component/**'
-          group: internal
-        - pattern: jh_else_ee/**
-          group: internal
-        - pattern: jh/**
-          group: internal
-        - pattern: '{test_,}helpers/**'
-          group: internal
-        - pattern: test_fixtures/**
-          group: internal
-      alphabetize:
-        order: ignore
-  'no-restricted-syntax':
-    - error
-    - selector: ImportSpecifier[imported.name='GlSkeletonLoading']
-      message: 'Migrate to GlSkeletonLoader, or import GlDeprecatedSkeletonLoading.'
-    - selector: ImportSpecifier[imported.name='GlSafeHtmlDirective']
-      message: 'Use directive at ~/vue_shared/directives/safe_html.js instead.'
-    - selector: Literal[value=/docs.gitlab.+\u002Fee/]
-      message: 'No hard coded url, use `DOCS_URL_IN_EE_DIR` in `jh_else_ce/lib/utils/url_utility`'
-    - selector: TemplateElement[value.cooked=/docs.gitlab.+\u002Fee/]
-      message: 'No hard coded url, use `DOCS_URL_IN_EE_DIR` in `jh_else_ce/lib/utils/url_utility`'
-    - selector: Literal[value=/(?=.*docs.gitlab.*)(?!.*\u002Fee\b.*)/]
-      message: 'No hard coded url, use `DOCS_URL` in `jh_else_ce/lib/utils/url_utility`'
-    - selector: TemplateElement[value.cooked=/(?=.*docs.gitlab.*)(?!.*\u002Fee\b.*)/]
-      message: 'No hard coded url, use `DOCS_URL` in `jh_else_ce/lib/utils/url_utility`'
-    - selector: Literal[value=/(?=.*about.gitlab.*)(?!.*\u002Fblog\b.*)/]
-      message: 'No hard coded url, use `PROMO_URL` in `jh_else_ce/lib/utils/url_utility`'
-    - selector: TemplateElement[value.cooked=/(?=.*about.gitlab.*)(?!.*\u002Fblog\b.*)/]
-      message: 'No hard coded url, use `PROMO_URL` in `jh_else_ce/lib/utils/url_utility`'
-    - selector: TemplateLiteral[expressions.0.name=DOCS_URL] > TemplateElement[value.cooked=/\u002Fjh|\u002Fee/]
-      message: '`/ee` or `/jh` path found in docs url, use `DOCS_URL_IN_EE_DIR` in `jh_else_ce/lib/utils/url_utility`'
-    # This can be removed once GitLab is on Vue 3
-    - selector: MemberExpression[object.type='ThisExpression'][property.name=/(\$delete|\$set)/]
-      message: "Vue 2's set/delete methods are not available in Vue 3. Create/assign new objects with the desired properties instead."
-  no-restricted-properties:
-    - error
-    - object: window
-      property: open
-      message: 'Use `visitUrl` in `jh_else_ce/lib/utils/url_utility` to avoid cross-site leaks.'
-    # This can be removed once GitLab is on Vue 3
-    - object: vm
-      property: $delete
-      message: "Vue 2's set/delete methods are not available in Vue 3. Create/assign new objects with the desired properties instead."
-    # This can be removed once GitLab is on Vue 3
-    - object: Vue
-      property: delete
-      message: "Vue 2's set/delete methods are not available in Vue 3. Create/assign new objects with the desired properties instead."
-    # This can be removed once GitLab is on Vue 3
-    - object: vm
-      property: $set
-      message: "Vue 2's set/delete methods are not available in Vue 3. Create/assign new objects with the desired properties instead."
-    # This can be removed once GitLab is on Vue 3
-    - object: Vue
-      property: set
-      message: "Vue 2's set/delete methods are not available in Vue 3. Create/assign new objects with the desired properties instead."
-  no-restricted-imports:
-    - error
-    - paths:
-        - name: mousetrap
-          message: 'Import { Mousetrap } from ~/lib/mousetrap instead.'
-        - name: vuex
-          message: 'See our documentation on "Migrating from VueX" for tips on how to avoid adding new VueX stores.'
-        - name: '@sentry/browser'
-          message: Use "import * as Sentry from '~/sentry/sentry_browser_wrapper';" instead
-  unicorn/prefer-dom-node-dataset:
-    - error
-  no-unsanitized/method:
-    - error
-    - escape:
-        methods: ['sanitize']
-  no-unsanitized/property:
-    - error
-    - escape:
-        methods: ['sanitize']
-  # This rule will be enabled later.
-  unicorn/no-array-callback-reference: off
-  vue/no-undef-components:
-    - error
-    - ignorePatterns:
-        - '^router-link$'
-        - '^router-view$'
-        - '^gl-emoji$'
-  local-rules/require-valid-help-page-path: 'error'
-  local-rules/vue-require-valid-help-page-link-component: 'error'
-overrides:
-  - files:
-      - '{,ee/,jh/}spec/frontend*/**/*'
-    rules:
-      '@gitlab/require-i18n-strings': off
-      '@gitlab/no-runtime-template-compiler': off
-      '@gitlab/tailwind': off
-      '@gitlab/vue-tailwind': off
-      'require-await': error
-      'import/no-dynamic-require': off
-      'no-import-assign': off
-      'no-restricted-syntax':
-        - error
-        - selector: CallExpression[callee.object.name=/(wrapper|vm)/][callee.property.name="setData"]
-          message: 'Avoid using "setData" on VTU wrapper'
-        - selector: MemberExpression[object.type!='ThisExpression'][property.type='Identifier'][property.name='$nextTick']
-          message: 'Using $nextTick from a component instance is discouraged. Import nextTick directly from the Vue package.'
-        - selector: Identifier[name='setImmediate']
-          message: 'Prefer explicit waitForPromises (or equivalent), or jest.runAllTimers (or equivalent) to vague setImmediate calls.'
-        - selector: ImportSpecifier[imported.name='GlSkeletonLoading']
-          message: 'Migrate to GlSkeletonLoader, or import GlDeprecatedSkeletonLoading.'
-        - selector: CallExpression[arguments.length=1][arguments.0.type='Literal'] CallExpression[callee.property.name='toBe'] CallExpression[callee.property.name='attributes'][arguments.length=1][arguments.0.value='disabled']
-          message: Avoid asserting disabled attribute exact value, because Vue.js 2 and Vue.js 3 renders it differently. Use toBeDefined / toBeUndefined instead
-        - selector: MemberExpression[object.object.name='Vue'][object.property.name='config'][property.name='errorHandler']
-          message: 'Use setErrorHandler/resetVueErrorHandler from helpers/set_vue_error_handler.js instead.'
-        - selector: Literal[value=/docs.gitlab.+\u002Fee/]
-          message: 'No hard coded url, use `DOCS_URL_IN_EE_DIR` in `jh_else_ce/lib/utils/url_utility`'
-        - selector: TemplateElement[value.cooked=/docs.gitlab.+\u002Fee/]
-          message: 'No hard coded url, use `DOCS_URL_IN_EE_DIR` in `jh_else_ce/lib/utils/url_utility`'
-        - selector: Literal[value=/(?=.*docs.gitlab.*)(?!.*\u002Fee\b.*)/]
-          message: 'No hard coded url, use `DOCS_URL` in `jh_else_ce/lib/utils/url_utility`'
-        - selector: TemplateElement[value.cooked=/(?=.*docs.gitlab.*)(?!.*\u002Fee\b.*)/]
-          message: 'No hard coded url, use `DOCS_URL` in `jh_else_ce/lib/utils/url_utility`'
-        - selector: Literal[value=/(?=.*about.gitlab.*)(?!.*\u002Fblog\b.*)/]
-          message: 'No hard coded url, use `PROMO_URL` in `jh_else_ce/lib/utils/url_utility`'
-        - selector: TemplateElement[value.cooked=/(?=.*about.gitlab.*)(?!.*\u002Fblog\b.*)/]
-          message: 'No hard coded url, use `PROMO_URL` in `jh_else_ce/lib/utils/url_utility`'
-        - selector: TemplateLiteral[expressions.0.name=DOCS_URL] > TemplateElement[value.cooked=/\u002Fjh|\u002Fee/]
-          message: '`/ee` or `/jh` path found in docs url, use `DOCS_URL_IN_EE_DIR` in `jh_else_ce/lib/utils/url_utility`'
-        # This can be removed once GitLab is on Vue 3
-        - selector: CallExpression[callee.property.name=/(\$delete|\$set)/]
-          message: "Vue 2's set/delete methods are not available in Vue 3. Create/assign new objects with the desired properties instead."
-      no-restricted-properties:
-        - error
-        # This can be removed once GitLab is on Vue 3
-        - object: Vue
-          property: delete
-          message: "Vue 2's set/delete methods are not available in Vue 3. Create/assign new objects with the desired properties instead."
-        # This can be removed once GitLab is on Vue 3
-        - object: Vue
-          property: set
-          message: "Vue 2's set/delete methods are not available in Vue 3. Create/assign new objects with the desired properties instead."
-      no-unsanitized/method: off
-      no-unsanitized/property: off
-      local-rules/require-valid-help-page-path: off
-      local-rules/vue-require-valid-help-page-link-component: off
-      no-restricted-imports:
-        - error
-        - paths:
-            - name: mousetrap
-              message: 'Import { Mousetrap } from ~/lib/mousetrap instead.'
-            - name: vuex
-              message: 'See our documentation on "Migrating from VueX" for tips on how to avoid adding new VueX stores.'
-            - name: '@sentry/browser'
-              message: Use "import * as Sentry from '~/sentry/sentry_browser_wrapper';" instead
-            - name: ~/locale
-              importNames:
-                - __
-                - s__
-              message: 'Do not externalize strings in specs: https://docs.gitlab.com/ee/development/i18n/externalization.html#test-files-jest'
-  - files:
-      - 'config/**/*'
-      - 'scripts/**/*'
-      - '*.config.js'
-      - '*.config.*.js'
-      - 'jest_resolver.js'
-    rules:
-      '@gitlab/require-i18n-strings': off
-      import/no-extraneous-dependencies: off
-      import/no-commonjs: off
-      import/no-nodejs-modules: off
-      filenames/match-regex: off
-      no-console: off
-  - files:
-      - '*.stories.js'
-    rules:
-      filenames/match-regex: off
-      '@gitlab/require-i18n-strings': off
-  - files:
-      - '*.graphql'
-    plugins:
-      - '@graphql-eslint'
-    parserOptions:
-      parser: '@graphql-eslint/eslint-plugin'
-      operations: '{,ee/,jh/}app/**/*.graphql'
-      schema: './tmp/tests/graphql/gitlab_schema_apollo.graphql'
-    rules:
-      filenames/match-regex: off
-      spaced-comment: off
-      # TODO: We need a way to include this rule + support ee_else_ce fragments
-      #'@graphql-eslint/unique-fragment-name': error
-      # TODO: Uncomment these rules when then `schema` is available
-      #'@graphql-eslint/fragments-on-composite-type': error
-      #'@graphql-eslint/known-argument-names': error
-      #'@graphql-eslint/known-type-names': error
-      '@graphql-eslint/no-anonymous-operations': error
-      '@graphql-eslint/unique-operation-name': error
-      '@graphql-eslint/require-id-when-available': error
-      '@graphql-eslint/no-unused-variables': error
-      '@graphql-eslint/no-unused-fragments': error
-      '@graphql-eslint/no-duplicate-fields': error
-  - files:
-      - '{,ee/}spec/contracts/consumer/**/*'
-    rules:
-      '@gitlab/require-i18n-strings': off
-  - files:
-      - 'app/assets/javascripts/projects/settings/branch_rules/queries/branch_rules_details.query.graphql'
-      - 'app/assets/javascripts/projects/settings/repository/branch_rules/graphql/mutations/create_branch_rule.mutation.graphql'
-      - 'app/assets/javascripts/projects/settings/repository/branch_rules/graphql/queries/branch_rules.query.graphql'
-      - 'ee/app/assets/javascripts/projects/settings/branch_rules/queries/branch_rules_details.query.graphql'
-      - 'ee/app/assets/javascripts/projects/settings/repository/branch_rules/graphql/queries/branch_rules.query.graphql'
-    rules:
-      '@graphql-eslint/require-id-when-available': off
-  - files:
-      - '{,spec/}tooling/**/*'
-    rules:
-      'no-undef': off
-      'import/no-commonjs': off
-      'import/no-extraneous-dependencies': off
-      'no-restricted-syntax': off
-      '@gitlab/require-i18n-strings': off

.gitignore

@@ -8,6 +8,7 @@
 .bundle
 .chef
 .directory
+.history
 .eslintcache
 /.envrc
 eslint-report.html
@@ -45,7 +46,7 @@ eslint-report.html
 /config/redis.yml
 /config/unicorn.rb
 /config/puma.rb
-/config/secrets.yml
+/config/secrets.yml*
 /config/session_store.yml
 /config/sidekiq.yml
 /config/click_house.yml

.gitlab-ci.yml

@@ -16,6 +16,7 @@ stages:
   - notify
   - release-environments
   - benchmark
+  - ai-gateway
 
 # always use `gitlab-org` runners, however
 # in cases where jobs require Docker-in-Docker, the job
@@ -31,11 +32,11 @@ default:
 
 .default-ruby-variables: &default-ruby-variables
   RUBY_VERSION: "${RUBY_VERSION_DEFAULT}"
-  OMNIBUS_GITLAB_CACHE_EDITION: "GITLAB_RUBY3_1"
+  OMNIBUS_GITLAB_CACHE_EDITION: "GITLAB_RUBY3_2"
 
 .next-ruby-variables: &next-ruby-variables
   RUBY_VERSION: "${RUBY_VERSION_NEXT}"
-  OMNIBUS_GITLAB_CACHE_EDITION: "GITLAB_RUBY3_2"
+  OMNIBUS_GITLAB_CACHE_EDITION: "GITLAB_RUBY3_3"
 
 .default-branch-pipeline-failure-variables: &default-branch-pipeline-failure-variables
   CREATE_RAILS_FLAKY_TEST_ISSUES: "true"
@@ -47,6 +48,7 @@ default:
   ADD_SLOW_TEST_NOTE_TO_MERGE_REQUEST: "true"
   FF_NETWORK_PER_BUILD: "true"
   FF_TIMESTAMPS: "true"
+  FF_USE_FASTZIP: "true"
 
 .if-merge-request-security-canonical-sync: &if-merge-request-security-canonical-sync
   if: '$CI_MERGE_REQUEST_SOURCE_PROJECT_PATH == "gitlab-org/security/gitlab" && $CI_MERGE_REQUEST_SOURCE_BRANCH_NAME == $CI_DEFAULT_BRANCH && $CI_MERGE_REQUEST_TARGET_BRANCH_NAME == $CI_DEFAULT_BRANCH'
@@ -60,6 +62,9 @@ default:
 workflow:
   name: '$PIPELINE_NAME'
   rules:
+    # https://gitlab.com/gitlab-org/gitlab/-/issues/514740
+    - if: '$GITLAB_USER_LOGIN == "gitlab-crowdin-bot" && $CI_PIPELINE_SOURCE == "merge_request_event" && $CI_MERGE_REQUEST_APPROVED != "true"'
+      when: never
     - if: '$CI_PIPELINE_SOURCE == "pipeline" && $GITALY_TEST'
       variables:
         <<: *default-ruby-variables
@@ -80,7 +85,7 @@ workflow:
     # they serve no purpose and will run anyway when the changes are merged.
     - if: '$CI_MERGE_REQUEST_SOURCE_BRANCH_NAME =~ /^release-tools\/\d+\.\d+\.\d+-rc\d+$/ && $CI_MERGE_REQUEST_TARGET_BRANCH_NAME =~ /^[\d-]+-stable(-ee)?$/ && $CI_PROJECT_PATH == "gitlab-org/gitlab"'
       when: never
-    - if: '$CI_MERGE_REQUEST_LABELS =~ /pipeline:run-in-ruby3_1/ || $CI_MERGE_REQUEST_TARGET_BRANCH_NAME =~ /^[\d-]+-stable(-ee)?$/'
+    - if: '$CI_MERGE_REQUEST_LABELS =~ /pipeline:run-in-ruby3_2/ || $CI_MERGE_REQUEST_TARGET_BRANCH_NAME =~ /^[\d-]+-stable(-ee)?$/'
       variables:
         <<: [*default-ruby-variables, *default-merge-request-variables]
         PIPELINE_NAME: 'Ruby $RUBY_VERSION MR'
@@ -108,18 +113,30 @@ workflow:
       variables:
         <<: [*next-ruby-variables, *default-merge-request-variables]
         BUNDLE_GEMFILE: Gemfile.next
+    # This variable can be specified in manual or scheduled pipelines to run CI with the next Rails version.
+    # Specifying BUNDLE_GEMFILE: Gemfile.next wouldn't work because QA jobs require
+    # BUNDLE_GEMFILE to be Gemfile even with the next Rails version pipelines.
+    - if: '$CI_COMMIT_BRANCH == "rails-next" && $CI_PIPELINE_SOURCE == "schedule"'
+      variables:
+        <<: *next-ruby-variables
+        BUNDLE_GEMFILE: Gemfile.next
+        PIPELINE_NAME: 'Rails next version (Gemfile.next)'
     # For (detached) merge request pipelines.
     - if: '$CI_MERGE_REQUEST_IID'
       variables:
         <<: [*next-ruby-variables, *default-merge-request-variables]
         PIPELINE_NAME: 'Ruby $RUBY_VERSION MR'
     # For the scheduled pipelines, we set specific variables.
+    - if: '$CI_COMMIT_BRANCH == $CI_DEFAULT_BRANCH && $CI_PIPELINE_SOURCE == "schedule" && $BUILD_WITH_NEXT_RUBY_VERSION == "true"'
+      variables:
+        <<: *next-ruby-variables
+        PIPELINE_NAME: 'Scheduled Ruby $RUBY_VERSION $CI_COMMIT_BRANCH branch'
     - if: '$CI_COMMIT_BRANCH == $CI_DEFAULT_BRANCH && $CI_PIPELINE_SOURCE == "schedule"'
       variables:
         <<: [*default-ruby-variables, *default-branch-pipeline-failure-variables]
         CRYSTALBALL: "true"
         PIPELINE_NAME: 'Scheduled Ruby $RUBY_VERSION $CI_COMMIT_BRANCH branch'
-    - if: '$CI_COMMIT_BRANCH == "ruby3_2" && $CI_PIPELINE_SOURCE == "schedule"'
+    - if: '$CI_COMMIT_BRANCH == "ruby-next" && $CI_PIPELINE_SOURCE == "schedule"'
       variables:
         <<: *next-ruby-variables
         PIPELINE_NAME: 'Scheduled Ruby $RUBY_VERSION $CI_COMMIT_BRANCH branch'
@@ -169,8 +186,8 @@ variables:
   PG_VERSION: "14"
   DEFAULT_CI_IMAGE: "${REGISTRY_HOST}/${REGISTRY_GROUP}/gitlab-build-images/${BUILD_OS}-${OS_VERSION}-ruby-${RUBY_VERSION}-golang-${GO_VERSION}-rust-${RUST_VERSION}-node-${NODE_VERSION}-postgresql-${PG_VERSION}:rubygems-${RUBYGEMS_VERSION}-git-${GIT_VERSION}-lfs-${LFS_VERSION}-chrome-${CHROME_VERSION}-yarn-${YARN_VERSION}-graphicsmagick-${GRAPHICSMAGICK_VERSION}"
   DEFAULT_JOB_TAG: "gitlab-org"
-  GITLAB_LARGE_RUNNER_OPTIONAL: "gitlab-org" # overridden just in gitlab-org/gitlab
-  DEFAULT_RSPEC_PREDICTIVE_JOB_TAGS: "${DEFAULT_JOB_TAG}" # Separated by commas, overridden in JiHu
+  GITLAB_LARGE_RUNNER_OPTIONAL: "gitlab-org"  # overridden just in gitlab-org/gitlab
+  DEFAULT_RSPEC_PREDICTIVE_JOB_TAGS: "${DEFAULT_JOB_TAG}"  # Separated by commas, overridden in JiHu
   # We set $GITLAB_DEPENDENCY_PROXY to another variable (since it's set at the group level and has higher precedence than .gitlab-ci.yml)
   # so that we can override $GITLAB_DEPENDENCY_PROXY_ADDRESS in workflow rules.
   GITLAB_DEPENDENCY_PROXY_ADDRESS: "${GITLAB_DEPENDENCY_PROXY}"
@@ -181,7 +198,7 @@ variables:
   BUNDLE_FROZEN: "true"
   BUNDLE_GEMFILE: Gemfile
   # we override the max_old_space_size to prevent OOM errors
-  NODE_OPTIONS: --max_old_space_size=5120
+  NODE_OPTIONS: --max-old-space-size=10240
   GIT_DEPTH: "20"
   # 'GIT_STRATEGY: clone' optimizes the pack-objects cache hit ratio
   GIT_STRATEGY: "clone"
@@ -213,6 +230,7 @@ variables:
   RSPEC_TESTS_MAPPING_ALT_PATH: crystalball/mapping-alt.json
   RSPEC_VIEWS_INCLUDING_PARTIALS_PATH: rspec/views_including_partials.txt
   RSPEC_AUTO_EXPLAIN_LOG_PATH: auto_explain/auto_explain.ndjson.gz
+  RUBYOPT: "--yjit"
   TMP_TEST_FOLDER: "${CI_PROJECT_DIR}/tmp/tests"
   TMP_TEST_GITLAB_WORKHORSE_PATH: "${TMP_TEST_FOLDER}/${GITLAB_WORKHORSE_FOLDER}"
 
@@ -224,8 +242,8 @@ variables:
   RETRY_FAILED_TESTS_IN_NEW_PROCESS: "true"
   # Run with decomposed databases by default
   DECOMPOSED_DB: "true"
+  SEC_DECOMPOSED_DB: "true"
 
-  DOCS_REVIEW_APPS_DOMAIN: "docs.gitlab-review.app"
   DOCS_GITLAB_REPO_SUFFIX: "ee"
 
   REVIEW_APPS_IMAGE: "${REGISTRY_HOST}/${REGISTRY_GROUP}/gitlab-build-images/${BUILD_OS}-${OS_VERSION}-ruby-${RUBY_VERSION}:gcloud-${GCLOUD_VERSION}-kubectl-1.30-helm-${HELM_VERSION}"

.gitlab/ci/aigw-tagging.gitlab-ci.yml

+trigger-ai-gateway-tagging:
+  stage: ai-gateway
+  image: curlimages/curl:latest
+  script:
+    - |
+      curl -X POST --fail \
+        --header "PRIVATE-TOKEN: $AIGW_TAGGING_ACCESS_TOKEN" \
+        "https://gitlab.com/api/v4/projects/39903947/repository/tags?tag_name=self-hosted-${CI_COMMIT_TAG}&ref=main"
+  extends:
+    - .ai-gateway:rules:tagging
+  allow_failure: true

.gitlab/ci/benchmark.gitlab-ci.yml

@@ -2,7 +2,7 @@ benchmark-markdown:
   extends:
     - .single-db-ci-connection
     - .rails-job-base
-    - .use-pg14
+    - .use-pg16
     - .benchmark:rules:benchmark-markdown
   stage: benchmark
   needs:

.gitlab/ci/build-images.gitlab-ci.yml

@@ -12,7 +12,7 @@
 
 # This image is used by:
 # - The `e2e:test-on-omnibus` child pipeline test stage jobs
-# See https://docs.gitlab.com/ee/development/testing_guide/end_to_end/index.html#testing-code-in-merge-requests for more details.
+# See https://docs.gitlab.com/ee/development/testing_guide/end_to_end/#testing-code-in-merge-requests for more details.
 build-qa-image:
   extends:
     - .base-image-build-buildx
@@ -28,13 +28,6 @@ build-qa-image as-if-foss:
     - .as-if-foss
     - .qa:rules:test-on-omnibus-ce:follow-up
 
-follow-up:build-qa-image:
-  extends:
-    - build-qa-image
-    - .qa:rules:follow-up-e2e
-  needs:
-    - manual:e2e-test-pipeline-generate
-
 retag-gdk-image:
   extends:
     - .base-image-build
@@ -55,13 +48,14 @@ build-gdk-image:
     - .base-image-build-buildx
     - .build-images:rules:build-gdk-image
   tags:
-    - docker
+    - $GITLAB_LARGE_RUNNER_OPTIONAL
   stage: build-images
   needs:
+    - job: gdk:compile-test-assets
     - job: retag-gdk-image
       optional: true
   script:
-    - run_timed_command "scripts/build_gdk_image"
+    - run_with_custom_exit_code run_timed_command "scripts/build_gdk_image"
 
 # NOTE: release-tools verifies the presence on this job for a commit that is
 # candidate to an auto-deploy package. This job name can't be changed without
@@ -88,9 +82,3 @@ build-assets-image as-if-foss:
     - .as-if-foss
     - .qa:rules:test-on-omnibus-ce:follow-up
   needs: ["compile-production-assets as-if-foss"]
-
-follow-up:build-assets-image:
-  extends:
-    - build-assets-image
-    - .qa:rules:follow-up-e2e
-  needs: ["follow-up:compile-production-assets"]

.gitlab/ci/caching.gitlab-ci.yml

@@ -9,12 +9,18 @@ cache-workhorse:
   variables:
     SETUP_DB: "false"
   script:
-    - source scripts/gitlab_component_helpers.sh
-    - 'gitlab_workhorse_archive_doesnt_exist || { echoinfo "INFO: Exiting early as package exists."; exit 0; }'
-    - run_timed_command "scripts/setup-test-env"
-    - run_timed_command "select_gitlab_workhorse_essentials"
-    - run_timed_command "create_gitlab_workhorse_package"
-    - run_timed_command "upload_gitlab_workhorse_package"
+    - |
+      function cache_workhorse() {
+        source scripts/gitlab_component_helpers.sh
+        gitlab_workhorse_archive_doesnt_exist || { echoinfo "INFO: Exiting early as package exists."; exit 0; }
+        run_timed_command "scripts/setup-test-env"
+        run_timed_command "select_gitlab_workhorse_essentials"
+        run_timed_command "create_gitlab_workhorse_package"
+        run_timed_command "upload_gitlab_workhorse_package"
+      }
+
+      run_with_custom_exit_code cache_workhorse
+
   artifacts:
     expire_in: 7d
     paths:
@@ -29,14 +35,22 @@ cache-workhorse:
   variables:
     WEBPACK_REPORT: "false"
   script:
-    - yarn_install_script
-    - export GITLAB_ASSETS_HASH=$(bundle exec rake gitlab:assets:hash_sum)
-    - source scripts/gitlab_component_helpers.sh
-    - 'gitlab_assets_archive_doesnt_exist || { echoinfo "INFO: Exiting early as package exists."; exit 0; }'
-    - assets_compile_script
-    - echo -n "${GITLAB_ASSETS_HASH}" > "cached-assets-hash.txt"
-    - run_timed_command "create_gitlab_assets_package"
-    - run_timed_command "upload_gitlab_assets_package"
+    - |
+      function cache_assets() {
+        yarn_install_script
+
+        # GITLAB_ASSETS_HASH must be defined before loading scripts/gitlab_component_helpers.sh
+        export GITLAB_ASSETS_HASH=$(bundle exec rake gitlab:assets:hash_sum)
+        source scripts/gitlab_component_helpers.sh
+
+        gitlab_assets_archive_doesnt_exist || { echoinfo "INFO: Exiting early as package exists."; exit 0; }
+        assets_compile_script
+        echo -n "${GITLAB_ASSETS_HASH}" > "cached-assets-hash.txt"
+        run_timed_command "create_gitlab_assets_package"
+        run_timed_command "upload_gitlab_assets_package"
+      }
+
+      run_with_custom_exit_code cache_assets
 
 cache-assets:test:
   extends: .cache-assets-base
@@ -45,6 +59,8 @@ cache-assets:production:
   extends:
     - .cache-assets-base
     - .production
+  tags:
+    - $GITLAB_LARGE_RUNNER_OPTIONAL
 
 packages-cleanup:
   extends:

.gitlab/ci/cng/main.gitlab-ci.yml

@@ -69,10 +69,19 @@ include:
     CACHE_BUSTER: "false"
     # link component version shas to current project instead of default CI_PIPELINE_CREATED_AT which forces rebuilds on each pipeline run
     CONTAINER_VERSION_SUFFIX: "${CI_PROJECT_NAME}"
-    # skip no-op final-list pipeline stage
-    SKIP_JOB_REGEX: final-list
+    # skip no-op final-images-listing job
+    SKIP_JOB_REGEX: /final-images-listing/
     # disable buildx cluster while it's not supported on mirrors
     DISABLE_BUILDX_CLUSTER: "true"
+    # disable external gem caching and rely on docker layer caching
+    RAILS_DISABLE_VENDOR_CACHE: "true"
+    # skip short lived dev image signing and verification to save time
+    SKIP_IMAGE_SIGNING: "true"
+    SKIP_IMAGE_VERIFICATION: "true"
+    # set specific arch list
+    ARCH_LIST: amd64
+    # use larger runner for complex rails build jobs
+    HIGH_CAPACITY_RUNNER_TAG: high-cpu
   trigger:
     project: '${CI_PROJECT_NAMESPACE}/$[[ inputs.cng_path ]]'
     branch: $TRIGGER_BRANCH

.gitlab/ci/database.gitlab-ci.yml

 include:
   - local: .gitlab/ci/rails/shared.gitlab-ci.yml
 
+db:setup pg16:
+  stage: prepare
+  needs: []
+  extends:
+    - .use-pg16
+    - .default-before_script
+    - .ruby-cache
+    - .rails:rules:setup-test-env
+  script:
+    - source scripts/utils.sh
+    - run_with_custom_exit_code run_timed_command "pg_dumpall -h postgres -U postgres > pg_dumpall.sql"
+  artifacts:
+    paths:
+      - pg_dumpall.sql
+
 db:rollback single-db-ci-connection:
   extends:
     - db:rollback
@@ -31,13 +46,48 @@ db:backup_and_restore single-db-ci-connection:
     - .single-db-ci-connection
     - .rails:rules:db-backup
 
+db:rollback single-db-sec-connection:
+  extends:
+    - db:rollback
+    - .single-db-sec-connection
+    - .rails:rules:single-db-sec-connection
+
+db:migrate:reset single-db-sec-connection:
+  extends:
+    - db:migrate:reset
+    - .single-db-sec-connection
+    - .rails:rules:single-db-sec-connection
+
+db:check-schema-single-db-sec-connection:
+  extends:
+    - db:check-schema
+    - .single-db-sec-connection
+    - .rails:rules:single-db-sec-connection
+
+db:post_deployment_migrations_validator-single-db-sec-connection:
+  extends:
+    - db:post_deployment_migrations_validator
+    - .single-db-sec-connection
+    - .rails:rules:db:check-migrations-single-db-sec-connection
+
+db:backup_and_restore single-db-sec-connection:
+  extends:
+    - db:backup_and_restore
+    - .single-db-sec-connection
+    - .rails:rules:db-backup
+
 db:rollback:
   extends:
     - .db-job-base
     - .rails:rules:db-rollback
   script:
-    - bundle exec rake db:migrate VERSION=20230718020825  # 16.3 First migration
-    - bundle exec rake db:migrate
+    - |
+      function db_rollback() {
+        bundle exec rake db:migrate VERSION=20231220225325 # First 16-9-stable-ee migration
+        bundle exec rake db:migrate
+      }
+
+      run_with_custom_exit_code db_rollback
 
 db:rollback single-db:
   extends:
@@ -51,24 +101,31 @@ db:migrate:multi-version-upgrade:
     - .single-db
     - .db-job-base
     - .rails:rules:db:migrate:multi-version-upgrade
+  variables:
+    UPGRADE_STOP_DUMP_URL: "https://gitlab.com/gitlab-org/quality/pg-dump-generator/-/raw/main/pg_dumps/ee/latest_upgrade_stop.gz"
   script:
-    - curl -o latest_upgrade_stop.gz https://gitlab.com/gitlab-org/quality/pg-dump-generator/-/raw/main/pg_dumps/ee/latest_upgrade_stop.gz
-    - gunzip -c latest_upgrade_stop.gz > gitlabhq_production
-    - bundle exec rake db:drop db:create
-    - apt-get update -qq && apt-get install -y -qq postgresql-client
-    - psql --output /dev/null -v "ON_ERROR_STOP=1" -h postgres -U postgres -d gitlabhq_test < gitlabhq_production
-    - bundle exec rake gitlab:db:configure
+    - |
+      function db_migrate_multi_version_upgrade() {
+        curl -o latest_upgrade_stop.gz $UPGRADE_STOP_DUMP_URL
+        gunzip -c latest_upgrade_stop.gz > gitlabhq_production
+        bundle exec rake db:drop db:create
+        apt-get update -qq && apt-get install -y -qq postgresql-client
+        psql --output /dev/null -v "ON_ERROR_STOP=1" -h postgres -U postgres -d gitlabhq_test < gitlabhq_production
+        bundle exec rake gitlab:db:configure
+      }
+
+      run_with_custom_exit_code db_migrate_multi_version_upgrade
 
 # Validate minimum PG version supported by GitLab
-db:migrate:multi-version-upgrade-pg13:
+db:migrate:multi-version-upgrade-pg14:
   extends:
     - db:migrate:multi-version-upgrade
-    - .use-pg13
+    - .use-pg14
 
 db:migrate:reset:
   extends: .db-job-base
   script:
-    - bundle exec rake db:migrate:reset
+    - run_with_custom_exit_code bundle exec rake db:migrate:reset
 
 db:migrate:reset single-db:
   extends:
@@ -79,9 +136,15 @@ db:migrate:reset single-db:
 db:check-schema:
   extends:
     - .db-job-base
-    - .rails:rules:ee-mr-and-default-branch-only
+    - .rails:rules:db:check-schema
   script:
-    - run_timed_command "bundle exec rake db:drop db:create db:migrate"
+    - |
+      function db_check_schema() {
+        run_timed_command "bundle exec rake db:drop db:create db:migrate"
+        run_timed_command "scripts/validate_migration_timestamps"
+      }
+
+      run_with_custom_exit_code db_check_schema
 
 db:check-schema-single-db:
   extends:
@@ -95,8 +158,13 @@ db:check-migrations:
     - .use-pg14  # Should match the db same version used by GDK
     - .rails:rules:ee-and-foss-mr-with-migration
   script:
-    - git fetch origin $CI_MERGE_REQUEST_TARGET_BRANCH_NAME:$CI_MERGE_REQUEST_TARGET_BRANCH_NAME --depth 20
-    - scripts/validate_migration_schema
+    - |
+      function db_check_migrations() {
+        git fetch origin $CI_MERGE_REQUEST_TARGET_BRANCH_NAME:$CI_MERGE_REQUEST_TARGET_BRANCH_NAME --depth 20
+        scripts/validate_migration_schema
+      }
+
+      run_with_custom_exit_code db_check_migrations
 
 db:check-migrations-single-db:
   extends:
@@ -109,8 +177,13 @@ db:post_deployment_migrations_validator:
     - .db-job-base
     - .rails:rules:ee-and-foss-mr-with-migration
   script:
-    - git fetch origin $CI_MERGE_REQUEST_TARGET_BRANCH_NAME:$CI_MERGE_REQUEST_TARGET_BRANCH_NAME --depth 20
-    - scripts/post_deployment_migrations_validator
+    - |
+      function db_post_deployment_migrations_validator() {
+        git fetch origin $CI_MERGE_REQUEST_TARGET_BRANCH_NAME:$CI_MERGE_REQUEST_TARGET_BRANCH_NAME --depth 20
+        scripts/post_deployment_migrations_validator
+      }
+
+      run_with_custom_exit_code db_post_deployment_migrations_validator
   allow_failure: true
 
 db:post_deployment_migrations_validator-single-db:
@@ -124,7 +197,7 @@ db:migrate-non-superuser:
     - .db-job-base
     - .rails:rules:ee-and-foss-mr-with-migration
   script:
-    - bundle exec rake gitlab:db:reset_as_non_superuser
+    - run_with_custom_exit_code bundle exec rake gitlab:db:reset_as_non_superuser
 
 db:gitlabcom-database-testing:
   extends: .rails:rules:db:gitlabcom-database-testing
@@ -134,8 +207,13 @@ db:gitlabcom-database-testing:
   allow_failure: true
   script:
     - source scripts/utils.sh
-    - install_gitlab_gem
-    - ./scripts/trigger-build.rb gitlab-com-database-testing
+    - |
+      function db_gitlab_com_database_testing() {
+        install_gitlab_gem
+        ./scripts/trigger-build.rb gitlab-com-database-testing
+      }
+
+      run_with_custom_exit_code db_gitlab_com_database_testing
 
 db:backup_and_restore:
   extends:
@@ -145,12 +223,17 @@ db:backup_and_restore:
     SETUP_DB: "false"
     GITLAB_ASSUME_YES: "1"
   script:
-    - . scripts/prepare_build.sh
-    - bundle exec rake db:drop db:create db:schema:load db:seed_fu
-    - mkdir -p tmp/tests/public/uploads tmp/tests/{artifacts,pages,lfs-objects,terraform_state,registry,packages,ci_secure_files,external-diffs}
-    - bundle exec rake gitlab:backup:create
-    - date
-    - bundle exec rake gitlab:backup:restore
+    - |
+      function db_back_and_restore() {
+        . scripts/prepare_build.sh
+        bundle exec rake db:drop db:create db:schema:load db:seed_fu
+        mkdir -p tmp/tests/public/uploads tmp/tests/{artifacts,pages,lfs-objects,terraform_state,registry,packages,ci_secure_files,external-diffs}
+        bundle exec rake gitlab:backup:create
+        date
+        bundle exec rake gitlab:backup:restore
+      }
+
+      run_with_custom_exit_code db_back_and_restore
 
 db:backup_and_restore single-db:
   extends:
@@ -163,5 +246,23 @@ db:rollback geo:
     - db:rollback
     - .rails:rules:ee-only-migration
   script:
-    - bundle exec rake db:migrate:geo VERSION=20170627195211
-    - bundle exec rake db:migrate:geo
+    - |
+      function db_rollback_geo() {
+        bundle exec rake db:migrate:geo VERSION=20170627195211
+        bundle exec rake db:migrate:geo
+      }
+
+      run_with_custom_exit_code db_rollback_geo
+
+db:docs-up-to-date:
+  extends:
+    - .db-job-base
+    - .db:rules:docs-up-to-date
+  script:
+    - |
+      function db_docs_up_to_date() {
+        bundle exec rake gitlab:db:dictionary:generate
+        git diff --exit-code db/docs
+      }
+
+      run_with_custom_exit_code db_docs_up_to_date

.gitlab/ci/dev-fixtures.gitlab-ci.yml

@@ -3,7 +3,7 @@
     - .default-retry
     - .ruby-cache
     - .default-before_script
-    - .use-pg14
+    - .use-pg16
   stage: test
   needs: ["setup-test-env"]
   variables:
@@ -14,7 +14,7 @@
     SEED_CI_CD_ANALYTICS: "true"
     VSA_ISSUE_COUNT: 1
     SIZE: 0  # number of external projects to fork, requires network connection
-    # SEED_NESTED_GROUPS: "false" # requires network connection
+    # SEED_NESTED_GROUPS: "false"  # requires network connection
 
 .run-dev-fixtures-script: &run-dev-fixtures-script
   - section_start "gitaly-test-spawn" "Spawning Gitaly"; scripts/gitaly-test-spawn; section_end "gitaly-test-spawn";  # Do not use 'bundle exec' here
@@ -31,7 +31,7 @@ run-dev-fixtures-ee:
   extends:
     - .run-dev-fixtures
     - .dev-fixtures:rules:ee-only
-    - .use-pg14-es7-ee
+    - .use-pg16-es7-ee
   script:
     - cp ee/db/fixtures/development/* $FIXTURE_PATH
     - *run-dev-fixtures-script

.gitlab/ci/docs.gitlab-ci.yml

@@ -6,31 +6,25 @@
   stage: review
   needs: []
   variables:
-    # We're cloning the repo instead of downloading the script for now
-    # because some repos are private and CI_JOB_TOKEN cannot access files.
-    # See https://gitlab.com/gitlab-org/gitlab/issues/191273
     GIT_DEPTH: 1
-    # By default, deploy the Review App using the `main` branch of the `gitlab-org/gitlab-docs` project
+    # By default, deploy the Review App using the `main` branch of the `gitlab-org/technical-writing/docs-gitlab-com` project
     DOCS_BRANCH: main
   environment:
     name: review-docs/mr-${CI_MERGE_REQUEST_IID}
-    # DOCS_REVIEW_APPS_DOMAIN and DOCS_GITLAB_REPO_SUFFIX are CI variables
-    # Discussion: https://gitlab.com/gitlab-org/gitlab-foss/merge_requests/14236/diffs#note_40140693
     auto_stop_in: 2 weeks
-    url: http://${DOCS_BRANCH}-${DOCS_GITLAB_REPO_SUFFIX}-${CI_MERGE_REQUEST_IID}.${DOCS_REVIEW_APPS_DOMAIN}/${DOCS_GITLAB_REPO_SUFFIX}
+    url: https://docs.gitlab.com/upstream-review-mr-${DOCS_GITLAB_REPO_SUFFIX}-${CI_MERGE_REQUEST_IID}
     on_stop: review-docs-cleanup
   before_script:
     - source ./scripts/utils.sh
     - install_gitlab_gem
 
-# Always trigger a docs build in gitlab-docs only on docs-only branches.
-# Useful to preview the docs changes live.
+# Deploy documentation review app by using GitLab Docs project (gitlab-org/technical-writing/docs-gitlab-com)
 review-docs-deploy:
   extends: .review-docs
   script:
     - ./scripts/trigger-build.rb docs deploy
 
-# Cleanup remote environment of gitlab-docs
+# Cleanup remote environment of gitlab-org/technical-writing/docs-gitlab-com
 review-docs-cleanup:
   extends: .review-docs
   environment:
@@ -41,7 +35,7 @@ review-docs-cleanup:
 
 .docs-markdown-lint-image:
   # When updating the image version here, update it in /scripts/lint-doc.sh too.
-  image: ${REGISTRY_HOST}/${REGISTRY_GROUP}/gitlab-docs/lint-markdown:alpine-3.20-vale-3.7.1-markdownlint2-0.13.0-lychee-0.15.1
+  image: ${REGISTRY_HOST}/${REGISTRY_GROUP}/technical-writing/docs-gitlab-com/lint-markdown:alpine-3.21-vale-3.9.3-markdownlint2-0.17.1-lychee-0.18.0
 
 docs-lint markdown:
   extends:
@@ -53,20 +47,15 @@ docs-lint markdown:
   needs: []
   script:
     - source ./scripts/utils.sh
-    - yarn_install_script
-    - install_gitlab_gem
-    - scripts/lint-doc.sh
-    - scripts/lint/check_mermaid.mjs
+    - |
+      function docs_lint_markdown() {
+        yarn_install_script
+        install_gitlab_gem
+        scripts/lint-doc.sh
+        scripts/lint/check_mermaid.mjs
+      }
 
-docs-lint blueprint:
-  extends:
-    - .default-retry
-    - .docs:rules:docs-blueprints-lint
-  image: ${GITLAB_DEPENDENCY_PROXY_ADDRESS}ruby:${RUBY_VERSION}-slim
-  stage: lint
-  needs: []
-  script:
-    - scripts/lint-docs-blueprints.rb
+      run_with_custom_exit_code docs_lint_markdown
 
 docs code_quality:
   extends:
@@ -86,28 +75,37 @@ docs code_quality:
     expire_in: 2 weeks
     when: always
 
+docs hugo_build:
+  image: registry.gitlab.com/gitlab-org/technical-writing/docs-gitlab-com/docs-gitlab-com-builder:hugo-0.142.0
+  extends:
+    - .default-retry
+    - .docs:rules:docs-lint
+  stage: lint
+  needs: []
+  dependencies: []
+  before_script:
+    - git clone --depth 1 --filter=tree:0 https://gitlab.com/gitlab-org/technical-writing/docs-gitlab-com.git
+    - cd docs-gitlab-com
+    - make add-latest-icons
+    # Copy the current project's docs to the appropriate location in the docs website
+    - cp -r ../doc/* content/
+  script:
+    # Test that Hugo will build
+    - hugo --gc --printPathWarnings --panicOnWarning
+    # Test for invalid index pages
+    # See https://gitlab.com/gitlab-org/technical-writing/docs-gitlab-com/-/blob/main/scripts/check-index-filenames.sh
+    - make check-index-pages SEARCH_DIR="../doc"
+
 docs-lint links:
   extends:
     - .docs:rules:docs-lint
     - .docs-markdown-lint-image
   stage: lint
   needs: []
+  before_script:
+    - source scripts/utils.sh
   script:
-    - lychee --offline --no-progress --include-fragments doc
-
-#
-# Disabled while links are being cleaned up.
-# See: https://gitlab.com/gitlab-org/gitlab/-/issues/419673
-#
-# ui-docs-links lint:
-#   extends:
-#     - .docs:rules:docs-lint
-#     - .static-analysis-base
-#     - .ruby-cache
-#   stage: lint
-#   needs: []
-#   script:
-#     - bundle exec haml-lint -i DocumentationLinks
+    - run_with_custom_exit_code lychee --offline --no-progress --include-fragments doc
 
 docs-lint deprecations-and-removals:
   variables:
@@ -120,7 +118,13 @@ docs-lint deprecations-and-removals:
   stage: lint
   needs: []
   script:
-    - bundle exec rake gitlab:docs:check_deprecations
+    - |
+      function docs_lint_deprecations_and_removals() {
+        bundle exec rake gitlab:docs:check_deprecations
+        bundle exec rake gitlab:docs:check_windows
+      }
+
+      run_with_custom_exit_code docs_lint_deprecations_and_removals
 
 docs-lint redirects:
   image: ${GITLAB_DEPENDENCY_PROXY_ADDRESS}ruby:${RUBY_VERSION}-alpine
@@ -129,5 +133,7 @@ docs-lint redirects:
     - .default-retry
     - .docs:rules:redirect-check
   needs: []
+  before_script:
+    - source scripts/utils.sh
   script:
-    - ./scripts/lint-docs-redirects.rb
+    - run_with_custom_exit_code ./scripts/lint-docs-redirects.rb

.gitlab/ci/frontend.gitlab-ci.yml

@@ -11,7 +11,7 @@
     - .default-retry
     - .default-before_script
     - .assets-compile-cache
-  image: ${REGISTRY_HOST}/${REGISTRY_GROUP}/gitlab-build-images/${BUILD_OS}-${OS_VERSION}-ruby-${RUBY_VERSION}-node-${NODE_VERSION}:rubygems-${RUBYGEMS_VERSION}-git-${GIT_VERSION}-lfs-${LFS_VERSION}-yarn-${YARN_VERSION}-graphicsmagick-${GRAPHICSMAGICK_VERSION}
+  image: ${REGISTRY_HOST}/${REGISTRY_GROUP}/gitlab-build-images/${BUILD_OS}-${OS_VERSION}-ruby-${RUBY_VERSION}-rust-${RUST_VERSION}-node-${NODE_VERSION}:rubygems-${RUBYGEMS_VERSION}-git-${GIT_VERSION}-lfs-${LFS_VERSION}-yarn-${YARN_VERSION}-graphicsmagick-${GRAPHICSMAGICK_VERSION}
   variables:
     SETUP_DB: "false"
     WEBPACK_VENDOR_DLL: "true"
@@ -22,22 +22,29 @@
   stage: prepare
   needs: []
   script:
-    - yarn_install_script
-    - export GITLAB_ASSETS_HASH=$(bin/rake gitlab:assets:hash_sum)
-    - 'echo "CACHE_ASSETS_AS_PACKAGE: ${CACHE_ASSETS_AS_PACKAGE}"'
-    # The new strategy to cache assets as generic packages is experimental and can be disabled by removing the `CACHE_ASSETS_AS_PACKAGE` variable
     - |
-      if [[ "${CACHE_ASSETS_AS_PACKAGE}" == "true" ]]; then
-        source scripts/gitlab_component_helpers.sh
-
-        if ! gitlab_assets_archive_doesnt_exist; then
-          # We remove all assets from the native cache as they could pollute the fresh assets from the package
-          rm -rf public/assets/ app/assets/javascripts/locale/**/app.js
-          run_timed_command "retry download_and_extract_gitlab_assets"
+      function compile_assets() {
+        yarn_install_script
+        export GITLAB_ASSETS_HASH=$(bin/rake gitlab:assets:hash_sum)
+        echo "CACHE_ASSETS_AS_PACKAGE: ${CACHE_ASSETS_AS_PACKAGE}"
+
+        # The new strategy to cache assets as generic packages is experimental and
+        # can be disabled by removing the `CACHE_ASSETS_AS_PACKAGE` variable
+        if [[ "${CACHE_ASSETS_AS_PACKAGE}" == "true" ]]; then
+          source scripts/gitlab_component_helpers.sh
+
+          if ! gitlab_assets_archive_doesnt_exist; then
+            # We remove all assets from the native cache as they could pollute the fresh assets from the package
+            rm -rf public/assets/ app/assets/javascripts/locale/**/app.js
+            run_timed_command "retry download_and_extract_gitlab_assets"
+          fi
         fi
-      fi
-    - assets_compile_script
-    - echo -n "${GITLAB_ASSETS_HASH}" > "cached-assets-hash.txt"
+
+        assets_compile_script
+        echo -n "${GITLAB_ASSETS_HASH}" > "cached-assets-hash.txt"
+      }
+
+      run_with_custom_exit_code compile_assets
 
 .update-cache-base:
   after_script:
@@ -68,13 +75,6 @@ compile-production-assets as-if-foss:
     - .as-if-foss
     - .qa:rules:test-on-omnibus-ce:follow-up
 
-follow-up:compile-production-assets:
-  extends:
-    - compile-production-assets
-    - .qa:rules:follow-up-e2e
-  needs:
-    - manual:e2e-test-pipeline-generate
-
 compile-test-assets:
   extends:
     - .compile-assets-base
@@ -87,6 +87,11 @@ compile-test-assets:
       - "${WEBPACK_COMPILE_LOG_PATH}"
     when: always
 
+gdk:compile-test-assets:
+  extends:
+    - compile-test-assets
+    - .build-images:rules:build-gdk-image
+
 update-assets-compile-production-cache:
   extends:
     - compile-production-assets
@@ -125,12 +130,18 @@ retrieve-frontend-fixtures:
   script:
     - source scripts/utils.sh
     - source scripts/gitlab_component_helpers.sh
-    - install_gitlab_gem
-    - export_fixtures_sha_for_download
     - |
-      if check_fixtures_download; then
-        run_timed_command "download_and_extract_fixtures"
-      fi
+      function retrieve_frontend_fixtures() {
+        install_gitlab_gem
+        export_fixtures_sha_for_download
+
+        if check_fixtures_download; then
+          run_timed_command "download_and_extract_fixtures"
+        fi
+      }
+
+      run_with_custom_exit_code retrieve_frontend_fixtures
+
   artifacts:
     expire_in: 30 days
     paths:
@@ -143,7 +154,7 @@ retrieve-frontend-fixtures:
     - .default-retry
     - .default-before_script
     - .ruby-cache
-    - .use-pg14
+    - .use-pg16
     - .repo-from-artifacts
   stage: fixtures
   needs:
@@ -165,7 +176,7 @@ retrieve-frontend-fixtures:
         exit 0
       fi
     - !reference [.base-script, script]
-    - rspec_parallelized_job
+    - run_with_custom_exit_code rspec_parallelized_job
   artifacts:
     name: frontend-fixtures
     expire_in: 31d
@@ -205,9 +216,14 @@ upload-frontend-fixtures:
   script:
     - source scripts/gitlab_component_helpers.sh
     - export_fixtures_sha_for_upload
-    - 'fixtures_archive_doesnt_exist || { echoinfo "INFO: Exiting early as package exists."; exit 0; }'
-    - run_timed_command "create_fixtures_package"
-    - run_timed_command "upload_fixtures_package"
+    - |
+      function upload_frontend_fixtures() {
+        fixtures_archive_doesnt_exist || { echoinfo "INFO: Exiting early as package exists."; exit 0; }
+        run_timed_command "create_fixtures_package"
+        run_timed_command "upload_fixtures_package"
+      }
+
+      run_with_custom_exit_code upload_frontend_fixtures
 
 graphql-schema-dump:
   variables:
@@ -216,11 +232,11 @@ graphql-schema-dump:
     - .default-retry
     - .ruby-cache
     - .default-before_script
-    - .frontend:rules:default-frontend-jobs-with-docs-changes
+    - .frontend:rules:default-frontend-jobs
   stage: fixtures
   needs: []
   script:
-    - bundle exec rake gitlab:graphql:schema:dump
+    - run_with_custom_exit_code bundle exec rake gitlab:graphql:schema:dump
   artifacts:
     expire_in: 30 days
     name: graphql-schema
@@ -240,7 +256,7 @@ upload-graphql-schema-dump:
     - .with-graphql-schema-dump-needs
   script:
     - source scripts/gitlab_component_helpers.sh
-    - create_and_upload_graphql_schema_package
+    - run_with_custom_exit_code create_and_upload_graphql_schema_package
 
 
 .frontend-test-base:
@@ -270,7 +286,7 @@ jest-build-cache:
     paths:
       - tmp/cache/jest/
   script:
-    - run_timed_command "yarn jest:ci:build-cache"
+    - run_timed_command "scripts/frontend/warm_jest_cache.mjs"
   variables:
     # Propagate exit code correctly. See https://gitlab.com/groups/gitlab-org/-/epics/6074.
     FF_USE_NEW_BASH_EVAL_STRATEGY: 'true'
@@ -286,16 +302,18 @@ jest-build-cache:
     NODE_OPTIONS: --max-old-space-size=7680
   allow_failure: true
 
-.with-jest-build-cache-vue3-needs:
+.with-jest-build-cache-vue3-ensure-compilable-sfcs-needs:
   needs:
-    - job: jest-build-cache-vue3
+    - job: jest-build-cache-vue3-ensure-compilable-sfcs
       optional: true
 
-jest-build-cache-vue3:
+jest-build-cache-vue3-ensure-compilable-sfcs:
   extends:
+    - .vue3
+    # Make sure allow_failure is set by jest-build-cache rather than .vue3.
+    # Failures should not be allowed in merge requests.
     - jest-build-cache
     - .frontend:rules:jest
-    - .vue3
 
 jest:
   extends:
@@ -316,7 +334,7 @@ jest:
       junit: junit_jest.xml
   parallel: 11
   script:
-    - run_timed_command "yarn jest:ci:without-fixtures"
+    - run_with_custom_exit_code run_timed_command scripts/frontend/jest_ci.js
 
 jest-with-fixtures:
   extends:
@@ -330,7 +348,7 @@ jest-with-fixtures:
     - !reference [.with-fixtures-needs, needs]
   parallel: 2
   script:
-    - run_timed_command "yarn jest:ci:with-fixtures"
+    - run_with_custom_exit_code run_timed_command "scripts/frontend/jest_ci.js --fixtures"
 
 jest vue3:
   extends:
@@ -338,7 +356,9 @@ jest vue3:
     - .frontend:rules:jest-vue3-nightly
     - .vue3
   needs:
-    - !reference [.with-jest-build-cache-vue3-needs, needs]
+    - !reference [.with-jest-build-cache-vue3-ensure-compilable-sfcs-needs, needs]
+  script:
+    - run_timed_command "scripts/frontend/jest_ci.js --vue3 --include-vue3-quarantined"
 
 jest-with-fixtures vue3:
   extends:
@@ -350,6 +370,8 @@ jest-with-fixtures vue3:
     # it's ok to wait for the repo artifact as we're waiting for the fixtures (which wait for the repo artifact) anyway
     - !reference [.repo-from-artifacts, needs]
     - !reference [.with-fixtures-needs, needs]
+  script:
+    - run_timed_command "scripts/frontend/jest_ci.js --vue3 --fixtures --include-vue3-quarantined"
 
 jest vue3 mr:
   extends:
@@ -357,7 +379,7 @@ jest vue3 mr:
     - .frontend:rules:jest
     - .vue3
   needs:
-    - !reference [.with-jest-build-cache-vue3-needs, needs]
+    - !reference [.with-jest-build-cache-vue3-ensure-compilable-sfcs-needs, needs]
   artifacts:
     name: vue3-mr-junit
     expire_in: 31d
@@ -366,15 +388,15 @@ jest vue3 mr:
       - junit_jest.xml
   parallel: 6
   script:
-    - run_timed_command "yarn jest:ci:vue3-mr:without-fixtures"
-  allow_failure: true
+    - run_with_custom_exit_code run_timed_command "scripts/frontend/jest_ci.js --vue3"
+  allow_failure: false
 
 jest-with-fixtures vue3 mr:
   extends:
     - jest vue3 mr
     - .repo-from-artifacts
   needs:
-    - !reference [.with-jest-build-cache-vue3-needs, needs]
+    - !reference [.with-jest-build-cache-vue3-ensure-compilable-sfcs-needs, needs]
     # it's ok to wait for the repo artifact as we're waiting for the fixtures (which wait for the repo artifact) anyway
     - !reference [.repo-from-artifacts, needs]
     - !reference [.with-fixtures-needs, needs]
@@ -386,7 +408,7 @@ jest-with-fixtures vue3 mr:
       - junit_jest.xml
   parallel: 1
   script:
-    - run_timed_command "yarn jest:ci:vue3-mr:with-fixtures"
+    - run_with_custom_exit_code run_timed_command "scripts/frontend/jest_ci.js --vue3 --fixtures"
 
 jest predictive:
   extends:
@@ -396,7 +418,15 @@ jest predictive:
     - !reference [jest, needs]
     - "detect-tests"
   script:
-    - if [[ -s "$RSPEC_CHANGED_FILES_PATH" ]] || [[ -s "$RSPEC_MATCHING_JS_FILES_PATH" ]]; then run_timed_command "yarn jest:ci:predictive-without-fixtures"; fi
+    - |
+      function jest_predictive() {
+        if [[ -s "$RSPEC_CHANGED_FILES_PATH" ]] || [[ -s "$RSPEC_MATCHING_JS_FILES_PATH" ]]; then
+          run_timed_command "scripts/frontend/jest_ci.js --predictive"
+        fi
+      }
+
+      run_with_custom_exit_code jest_predictive
+
   parallel: 4
 
 jest-with-fixtures predictive:
@@ -407,7 +437,14 @@ jest-with-fixtures predictive:
     - !reference [jest-with-fixtures, needs]
     - "detect-tests"
   script:
-    - if [[ -s "$RSPEC_CHANGED_FILES_PATH" ]] || [[ -s "$RSPEC_MATCHING_JS_FILES_PATH" ]]; then run_timed_command "yarn jest:ci:predictive-with-fixtures"; fi
+    - |
+      function jest_with_fixtures_predictive() {
+        if [[ -s "$RSPEC_CHANGED_FILES_PATH" ]] || [[ -s "$RSPEC_MATCHING_JS_FILES_PATH" ]]; then
+          run_timed_command "scripts/frontend/jest_ci.js --predictive --fixtures"
+        fi
+      }
+
+      run_with_custom_exit_code jest_with_fixtures_predictive
 
 jest vue3 predictive:
   extends:
@@ -417,7 +454,14 @@ jest vue3 predictive:
     - !reference [jest vue3 mr, needs]
     - "detect-tests"
   script:
-    - if [[ -s "$RSPEC_CHANGED_FILES_PATH" ]] || [[ -s "$RSPEC_MATCHING_JS_FILES_PATH" ]]; then run_timed_command "yarn jest:ci:vue3-mr:predictive-without-fixtures"; fi
+    - |
+      function jest_vue3_predictive() {
+        if [[ -s "$RSPEC_CHANGED_FILES_PATH" ]] || [[ -s "$RSPEC_MATCHING_JS_FILES_PATH" ]]; then
+          run_timed_command "scripts/frontend/jest_ci.js --vue3 --predictive"
+        fi
+      }
+
+      run_with_custom_exit_code jest_vue3_predictive
 
 jest-with-fixtures vue3 predictive:
   extends:
@@ -427,7 +471,69 @@ jest-with-fixtures vue3 predictive:
     - !reference [jest-with-fixtures vue3 mr, needs]
     - "detect-tests"
   script:
-    - if [[ -s "$RSPEC_CHANGED_FILES_PATH" ]] || [[ -s "$RSPEC_MATCHING_JS_FILES_PATH" ]]; then run_timed_command "yarn jest:ci:vue3-mr:predictive-with-fixtures"; fi
+    - |
+      function jest_with_fixtures_vue3_predictive() {
+        if [[ -s "$RSPEC_CHANGED_FILES_PATH" ]] || [[ -s "$RSPEC_MATCHING_JS_FILES_PATH" ]]; then
+          run_timed_command "scripts/frontend/jest_ci.js --vue3 --predictive --fixtures";
+        fi
+      }
+
+      run_with_custom_exit_code jest_with_fixtures_vue3_predictive
+  allow_failure: false
+
+jest vue3 check quarantined predictive:
+  extends:
+    - jest vue3 mr
+    - .frontend:rules:jest:predictive
+  needs:
+    - !reference [jest vue3 mr, needs]
+    - "detect-tests"
+  script:
+    - |
+      function jest_vue_check_quarantined_predictive() {
+        if [[ -s "$RSPEC_CHANGED_FILES_PATH" ]] || [[ -s "$RSPEC_MATCHING_JS_FILES_PATH" ]]; then
+          run_timed_command "./scripts/frontend/check_jest_vue3_quarantine.js"
+        fi
+      }
+
+      run_with_custom_exit_code jest_vue_check_quarantined_predictive
+  parallel: 4
+  artifacts:
+    name: quarantined_tests_output
+    expire_in: 31d
+    when: always
+    paths:
+      - tmp/tests/frontend/jest_stderr
+      - tmp/tests/frontend/jest_results.json
+
+jest-with-fixtures vue3 check quarantined predictive:
+  extends:
+    - jest vue3 check quarantined predictive
+  parallel: 1
+  variables:
+    JEST_FIXTURE_JOBS_ONLY: 1
+
+jest vue3 check quarantined:
+  extends:
+    - jest vue3 check quarantined predictive
+    - .frontend:rules:jest-vue3-check-quarantined
+  parallel: 4
+  script:
+    - |
+      function jest_vue3_check_quarantined() {
+        if [[ -s "$RSPEC_CHANGED_FILES_PATH" ]] || [[ -s "$RSPEC_MATCHING_JS_FILES_PATH" ]]; then
+          run_timed_command "./scripts/frontend/check_jest_vue3_quarantine.js --all"
+        fi
+      }
+
+      run_with_custom_exit_code jest_vue3_check_quarantined
+
+jest-with-fixtures vue3 check quarantined:
+  extends:
+    - jest vue3 check quarantined
+  parallel: 1
+  variables:
+    JEST_FIXTURE_JOBS_ONLY: 1
 
 jest-integration:
   extends:
@@ -435,7 +541,7 @@ jest-integration:
     - .repo-from-artifacts
     - .frontend:rules:jest-integration
   script:
-    - run_timed_command "yarn jest:integration --ci"
+    - run_with_custom_exit_code run_timed_command "yarn jest:integration --ci"
   needs:
     # it's ok to wait for the repo artifact as we're waiting for the fixtures (which wait for the repo artifact) anyway
     - !reference [.repo-from-artifacts, needs]
@@ -487,7 +593,7 @@ jest-linters:
     - .frontend:rules:jest-linters
   needs: []
   script:
-    - run_timed_command "yarn jest:eslint --ci"
+    - run_with_custom_exit_code run_timed_command "yarn jest:eslint --ci"
 
 coverage-frontend:
   extends:

.gitlab/ci/gitlab-gems.gitlab-ci.yml

@@ -46,4 +46,4 @@ include:
       gem_name: "gitlab-housekeeper"
   - local: .gitlab/ci/templates/gem.gitlab-ci.yml
     inputs:
-      gem_name: "openbao_client"
+      gem_name: "gitlab-active-context"

.gitlab/ci/global.gitlab-ci.yml

@@ -8,6 +8,15 @@
       - scheduler_failure
       - stuck_or_timeout_failure
       - unknown_failure
+    exit_codes:
+      # https://docs.gitlab.com/ee/development/pipelines/internals.html#custom-exit-codes
+      - 110  # network connection error
+      - 111  # low free disk space
+      - 160  # failed to upload/download job artifact
+      - 162  # gitaly spawn failed
+      - 164  # Redis cluster error
+      - 165  # segmentation fault
+      - 166  # EEXIST: file already exists
 
 .default-utils-before_script:
   before_script:
@@ -16,7 +25,7 @@
     - export GOPATH=$CI_PROJECT_DIR/.go
     - mkdir -p $GOPATH
     - source scripts/utils.sh
-    - log_disk_usage before_script # https://gitlab.com/gitlab-org/gitlab/-/issues/478880
+    - log_disk_usage "true"  # https://gitlab.com/gitlab-org/gitlab/-/issues/478880
 
 .default-before_script:
   before_script:
@@ -30,7 +39,7 @@
     # If the job extending this also defines `needs`, make sure to update
     # its `needs` to include `clone-gitlab-repo` because it'll be overridden.
     - job: clone-gitlab-repo
-      optional: true # Optional so easier to switch in between
+      optional: true  # Optional so easier to switch in between
 
 .production:
   variables:
@@ -136,17 +145,13 @@
 
 .qa-ruby-gems-cache: &qa-ruby-gems-cache
   key:
-    prefix: "qa-ruby-gems-${BUILD_OS}-${OS_VERSION}-ruby-${RUBY_VERSION}-gemfile-${BUNDLE_GEMFILE}"
+    prefix: "qa-ruby-gems-${BUILD_OS}-${OS_VERSION}-ruby-${RUBY_VERSION}"
     files:
       - qa/Gemfile.lock
   paths:
     - qa/vendor/ruby
   policy: pull
 
-.qa-ruby-gems-cache-push: &qa-ruby-gems-cache-push
-  <<: *qa-ruby-gems-cache
-  policy: pull-push
-
 .setup-test-env-cache:
   cache:
     - *ruby-gems-cache
@@ -197,21 +202,44 @@
     - *node-modules-cache
 
 .qa-bundler-variables: &qa-bundler-variables
-  variables:
-    BUNDLE_SUPPRESS_INSTALL_USING_MESSAGES: "true"
-    BUNDLE_SILENCE_ROOT_WARNING: "true"
-    BUNDLE_PATH: vendor
-    BUNDLE_WITHOUT: development
+  BUNDLE_SUPPRESS_INSTALL_USING_MESSAGES: "true"
+  BUNDLE_SILENCE_ROOT_WARNING: "true"
+  BUNDLE_PATH: vendor
+  BUNDLE_WITHOUT: development
+
+.cng-helm-cache: &cng-helm-cache
+  key: cng-helm-cache-${GITLAB_HELM_CHART_REF}
+  paths:
+    - $CNG_HELM_REPOSITORY_CACHE
+  policy: pull
 
 .qa-cache:
-  <<: *qa-bundler-variables
+  variables: *qa-bundler-variables
   cache:
     - *qa-ruby-gems-cache
 
 .qa-cache-push:
-  <<: *qa-bundler-variables
+  variables: *qa-bundler-variables
   cache:
-    - *qa-ruby-gems-cache-push
+    - <<: *qa-ruby-gems-cache
+      policy: pull-push
+
+.cng-qa-cache:
+  variables:
+    CNG_HELM_REPOSITORY_CACHE: $CI_PROJECT_DIR/qa/tmp/helm-cng
+    <<: *qa-bundler-variables
+  cache:
+    - *qa-ruby-gems-cache
+    - *cng-helm-cache
+
+.cng-qa-cache-push:
+  variables:
+    CNG_HELM_REPOSITORY_CACHE: $CI_PROJECT_DIR/qa/tmp/helm-cng
+    <<: *qa-bundler-variables
+  cache:
+    - *qa-ruby-gems-cache
+    - <<: *cng-helm-cache
+      policy: pull-push
 
 .yarn-cache:
   cache:
@@ -239,25 +267,9 @@
     - *node-modules-cache  # We don't push this cache as it's already rebuilt by `update-assets-compile-*-cache`
     - *storybook-node-modules-cache-push
 
-.code-quality-cache: &code-quality-cache
-  paths:
-    - gl-code-quality-report.json
-
-.code-quality-cache-push:
-  cache:
-    - key: $CI_COMMIT_BRANCH-code-quality-cache
-      <<: *code-quality-cache
-      policy: push
-
-.code-quality-cache-master-pull:
-  cache:
-    - key: master-code-quality-cache
-      <<: *code-quality-cache
-      policy: pull  # Docs pipelines can save time by pulling a copy of the code quality report from the latest master pipeline.
-
 .redis-services:
   services:
-    - name: ${REGISTRY_HOST}/${REGISTRY_GROUP}/gitlab-build-images:redis-cluster-6.2.12
+    - name: ${REGISTRY_HOST}/${REGISTRY_GROUP}/gitlab-build-images:redis-cluster-${REDIS_CLUSTER_VERSION}
       alias: rediscluster  # configure connections in config/redis.yml
     - name: redis:${REDIS_VERSION}-alpine
 
@@ -307,7 +319,7 @@
 
 .zoekt-services:
   services:
-    - name: ${REGISTRY_HOST}/${REGISTRY_GROUP}/gitlab-build-images:zoekt-ci-image-1.8
+    - name: ${REGISTRY_HOST}/${REGISTRY_GROUP}/gitlab-build-images:zoekt-ci-image-1.9
       alias: zoekt-ci-image
 
 .ai-gateway-variables:
@@ -319,21 +331,34 @@
     AIGW_FASTAPI__OPENAPI_URL: "/openapi.json"
     AIGW_FASTAPI__API_PORT: 5052
     ANTHROPIC_API_KEY: $ANTHROPIC_API_KEY_FOR_SERVICE
-    # CI_DEBUG_SERVICES: "true" # Enable this variable when you debug ai-gateway boot failure.
+    # CI_DEBUG_SERVICES: "true"  # Enable this variable when you debug ai-gateway boot failure.
 
 .ai-gateway-services:
   services:
-    - name: registry.gitlab.com/gitlab-org/modelops/applied-ml/code-suggestions/ai-assist/model-gateway:v1.15.0
+    - name: registry.gitlab.com/gitlab-org/modelops/applied-ml/code-suggestions/ai-assist/model-gateway:v1.18.0
       alias: ai-gateway
 
-.use-pg13:
-  extends:
-    - .pg-base-variables
-  services:
-    - !reference [.db-services, services]
+.litellm-proxy-variables:
   variables:
-    PG_VERSION: "13"
-    REDIS_VERSION: "6.2"
+    LITELLM_CONFIG_CONTENT: |
+      model_list:
+        - model_name: codestral
+          litellm_params:
+            model: ollama/codestral
+            mock_response: "Mock response from codestral"
+        - model_name: mistral
+          litellm_params:
+            model: ollama/mistral
+            mock_response: "Mock response from mistral"
+
+.litellm-proxy-services:
+  services:
+    - name: ghcr.io/berriai/litellm:main-latest
+      alias: litellm-proxy
+      entrypoint: ["/bin/sh", "-c"]
+      command:
+        - |
+          mkdir -p /tmp && echo "${LITELLM_CONFIG_CONTENT}" > /tmp/config.yaml && litellm --config /tmp/config.yaml
 
 .use-pg14:
   extends:
@@ -342,7 +367,8 @@
     - !reference [.db-services-with-auto-explain, services]
   variables:
     PG_VERSION: "14"
-    REDIS_VERSION: "6.2"
+    REDIS_VERSION: "6.0"
+    REDIS_CLUSTER_VERSION: "6.0"
 
 .use-pg15:
   extends:
@@ -352,6 +378,7 @@
   variables:
     PG_VERSION: "15"
     REDIS_VERSION: "7.0"
+    REDIS_CLUSTER_VERSION: "7.0.11"
 
 .use-pg16:
   extends:
@@ -361,6 +388,17 @@
   variables:
     PG_VERSION: "16"
     REDIS_VERSION: "7.0"
+    REDIS_CLUSTER_VERSION: "7.0.11"
+
+.use-pg17:
+  extends:
+    - .pg-base-variables
+  services:
+    - !reference [.db-services-with-auto-explain, services]
+  variables:
+    PG_VERSION: "17"
+    REDIS_VERSION: "7.0"
+    REDIS_CLUSTER_VERSION: "7.0.11"
 
 .es7-services:
   services:
@@ -373,10 +411,12 @@
     - .use-pg14
     - .zoekt-variables
     - .ai-gateway-variables
+    - .litellm-proxy-variables
   services:
     - !reference [.db-services-with-auto-explain, services]
     - !reference [.es7-services, services]
     - !reference [.ai-gateway-services, services]
+    - !reference [.litellm-proxy-services, services]
 
 .use-pg15-es7-ee:
   extends:
@@ -394,6 +434,14 @@
     - !reference [.db-services-with-auto-explain, services]
     - !reference [.es7-services, services]
 
+.use-pg17-es7-ee:
+  extends:
+    - .use-pg17
+    - .zoekt-variables
+  services:
+    - !reference [.db-services-with-auto-explain, services]
+    - !reference [.es7-services, services]
+
 .es8-services:
   services:
     - !reference [.zoekt-services, services]
@@ -405,7 +453,6 @@
     ES_SETTING_XPACK_SECURITY_ENABLED: "false"
     ES_SETTING_CLUSTER_ROUTING_ALLOCATION_DISK_THRESHOLD__ENABLED: "false"
 
-
 .use-pg14-es8-ee:
   extends:
     - .use-pg14
@@ -433,6 +480,15 @@
     - !reference [.db-services-with-auto-explain, services]
     - !reference [.es8-services, services]
 
+.use-pg17-es8-ee:
+  extends:
+    - .use-pg17
+    - .zoekt-variables
+    - .es8-variables
+  services:
+    - !reference [.db-services-with-auto-explain, services]
+    - !reference [.es8-services, services]
+
 .os1-services:
   services:
     - !reference [.zoekt-services, services]
@@ -464,6 +520,14 @@
     - !reference [.db-services-with-auto-explain, services]
     - !reference [.os1-services, services]
 
+.use-pg17-opensearch1-ee:
+  extends:
+    - .use-pg17
+    - .zoekt-variables
+  services:
+    - !reference [.db-services-with-auto-explain, services]
+    - !reference [.os1-services, services]
+
 .os2-services:
   services:
     - !reference [.zoekt-services, services]
@@ -495,15 +559,22 @@
     - !reference [.db-services-with-auto-explain, services]
     - !reference [.os2-services, services]
 
-.use-pg14-clickhouse23:
-  extends: .use-pg14
+.use-pg17-opensearch2-ee:
+  extends:
+    - .use-pg17
+    - .zoekt-variables
+  services:
+    - !reference [.db-services-with-auto-explain, services]
+    - !reference [.os2-services, services]
+
+.use-pg16-clickhouse23:
+  extends: .use-pg16
   services:
     - !reference [.db-services-with-auto-explain, services]
     - name: clickhouse/clickhouse-server:23.11.3.23-alpine
       alias: clickhouse
   variables:
-    CLICKHOUSE_USER: clickhouse
-    CLICKHOUSE_PASSWORD: clickhouse
+    CLICKHOUSE_USER: default
     CLICKHOUSE_DEFAULT_ACCESS_MANAGEMENT: 1
     CLICKHOUSE_DB: gitlab_clickhouse_test