Automatic merge of gitlab-org/gitlab master

app/assets/javascripts/lib/utils/text_utility.js

@@ -283,7 +283,7 @@ const unicodeConversion = [
   [/[ÌÍÎÏĨĪĬĮİ]/g, 'I'],
   [/[Ððĥħ]/g, 'h'],
   [/[ÑŃŅŇʼn]/g, 'N'],
-  [/[ÒÓÔÕÖØŌŎŐ]/g, 'O'],
+  [/[ÒÓÔÕØŌŎŐ]/g, 'O'],
   [/[ÙÚÛŨŪŬŮŰŲ]/g, 'U'],
   [/[ÝŶŸ]/g, 'Y'],
   [/[Þñþńņň]/g, 'n'],
@@ -293,7 +293,7 @@ const unicodeConversion = [
   [/[çćĉċč]/g, 'c'],
   [/[èéêëēĕėęě]/g, 'e'],
   [/[ìíîïĩīĭį]/g, 'i'],
-  [/[òóôõöøōŏő]/g, 'o'],
+  [/[òóôõøōŏő]/g, 'o'],
   [/[ùúûũūŭůűų]/g, 'u'],
   [/[ýÿŷ]/g, 'y'],
   [/[ĎĐ]/g, 'D'],

ee/app/assets/javascripts/dast_profiles/components/dast_profiles.vue

 <script>
 import * as Sentry from '@sentry/browser';
-import { GlButton, GlTab, GlTabs } from '@gitlab/ui';
+import { GlDropdown, GlDropdownItem, GlTab, GlTabs } from '@gitlab/ui';
 import { s__ } from '~/locale';
+import glFeatureFlagMixin from '~/vue_shared/mixins/gl_feature_flags_mixin';
 import ProfilesList from './dast_profiles_list.vue';
 import dastSiteProfilesQuery from '../graphql/dast_site_profiles.query.graphql';
 import dastSiteProfilesDelete from '../graphql/dast_site_profiles_delete.mutation.graphql';
 import * as cacheUtils from '../graphql/cache_utils';
+import { getProfileSettings } from '../settings/profiles';
 
 export default {
   components: {
-    GlButton,
+    GlDropdown,
+    GlDropdownItem,
     GlTab,
     GlTabs,
     ProfilesList,
   },
+  mixins: [glFeatureFlagMixin()],
   props: {
-    newDastSiteProfilePath: {
-      type: String,
+    createNewProfilePaths: {
+      type: Object,
       required: true,
+      validator: ({ scannerProfile, siteProfile }) =>
+        Boolean(scannerProfile) && Boolean(siteProfile),
     },
     projectFullPath: {
       type: String,
@@ -60,6 +66,16 @@ export default {
     },
   },
   computed: {
+    profileSettings() {
+      const { glFeatures, createNewProfilePaths } = this;
+
+      return getProfileSettings(
+        {
+          createNewProfilePaths,
+        },
+        glFeatures,
+      );
+    },
     hasMoreSiteProfiles() {
       return this.siteProfilesPageInfo.hasNextPage;
     },
@@ -152,6 +168,11 @@ export default {
   },
   profilesPerPage: 10,
   i18n: {
+    heading: s__('DastProfiles|Manage Profiles'),
+    newProfileDropdownLabel: s__('DastProfiles|New Profile'),
+    subHeading: s__(
+      'DastProfiles|Save commonly used configurations for target sites and scan specifications as profiles. Use these with an on-demand scan.',
+    ),
     errorMessages: {
       fetchNetworkError: s__(
         'DastProfiles|Could not fetch site profiles. Please refresh the page, or try again later.',
@@ -170,23 +191,25 @@ export default {
     <header>
       <div class="gl-display-flex gl-align-items-center gl-pt-6 gl-pb-4">
         <h2 class="my-0">
-          {{ s__('DastProfiles|Manage Profiles') }}
+          {{ $options.i18n.heading }}
         </h2>
-        <gl-button
-          :href="newDastSiteProfilePath"
-          category="primary"
+        <gl-dropdown
+          :text="$options.i18n.newProfileDropdownLabel"
           variant="success"
+          right
           class="gl-ml-auto"
         >
-          {{ s__('DastProfiles|New Site Profile') }}
-        </gl-button>
+          <gl-dropdown-item
+            v-for="{ i18n, createNewProfilePath, key } in profileSettings"
+            :key="key"
+            :href="createNewProfilePath"
+          >
+            {{ i18n.title }}
+          </gl-dropdown-item>
+        </gl-dropdown>
       </div>
       <p>
-        {{
-          s__(
-            'DastProfiles|Save commonly used configurations for target sites and scan specifications as profiles. Use these with an on-demand scan.',
-          )
-        }}
+        {{ $options.i18n.subHeading }}
       </p>
     </header>
 

ee/app/assets/javascripts/dast_profiles/dast_profiles_bundle.js

@@ -10,11 +10,14 @@ export default () => {
   }
 
   const {
-    dataset: { newDastSiteProfilePath, projectFullPath },
+    dataset: { newDastScannerProfilePath, newDastSiteProfilePath, projectFullPath },
   } = el;
 
   const props = {
-    newDastSiteProfilePath,
+    createNewProfilePaths: {
+      scannerProfile: newDastScannerProfilePath,
+      siteProfile: newDastSiteProfilePath,
+    },
     projectFullPath,
   };
 

ee/app/assets/javascripts/dast_profiles/settings/profiles.js

+import { s__ } from '~/locale';
+
+const hasNoFeatureFlagOrIsEnabled = glFeatures => ([, { featureFlag }]) => {
+  if (!featureFlag) {
+    return true;
+  }
+
+  return Boolean(glFeatures[featureFlag]);
+};
+
+export const getProfileSettings = ({ createNewProfilePaths }, glFeatures) => {
+  const settings = {
+    siteProfiles: {
+      key: 'siteProfiles',
+      createNewProfilePath: createNewProfilePaths.siteProfile,
+      i18n: {
+        title: s__('DastProfiles|Site Profile'),
+      },
+    },
+    scannerProfiles: {
+      key: 'scannerProfiles',
+      createNewProfilePath: createNewProfilePaths.scannerProfile,
+      featureFlag: 'securityOnDemandScansScannerProfiles',
+      i18n: {
+        title: s__('DastProfiles|Scanner Profile'),
+      },
+    },
+  };
+
+  return Object.fromEntries(
+    Object.entries(settings).filter(hasNoFeatureFlagOrIsEnabled(glFeatures)),
+  );
+};

ee/app/controllers/projects/dast_profiles_controller.rb

@@ -3,6 +3,9 @@
 module Projects
   class DastProfilesController < Projects::ApplicationController
     before_action :authorize_read_on_demand_scans!
+    before_action do
+      push_frontend_feature_flag(:security_on_demand_scans_scanner_profiles, project, default_enabled: false)
+    end
 
     def index
     end

ee/app/views/projects/dast_profiles/index.html.haml

@@ -2,5 +2,6 @@
 - breadcrumb_title s_('DastProfiles|Manage profiles')
 - page_title s_('DastProfiles|Manage profiles')
 
-.js-dast-profiles{ data: { new_dast_site_profile_path: new_namespace_project_dast_site_profile_path(namespace_id: @project.namespace, project_id: @project.path),
- project_full_path: @project.path_with_namespace } }
+.js-dast-profiles{ data: { new_dast_site_profile_path: new_project_dast_site_profile_path(@project),
+  new_dast_scanner_profile_path: new_project_dast_scanner_profile_path(@project),
+  project_full_path: @project.path_with_namespace } }

ee/changelogs/unreleased/241362-dast-scanner-profile-library-implementation-iteration-1-add-new.yml

+---
+title: 'DAST Scanner Profile Library: change new-profile button to dropdown'
+merge_request: 40469
+author:
+type: changed

ee/spec/frontend/dast_profiles/components/dast_profiles_spec.js

 import { mount, shallowMount } from '@vue/test-utils';
 import { within } from '@testing-library/dom';
 import { merge } from 'lodash';
+import { GlDropdown } from '@gitlab/ui';
 import DastProfiles from 'ee/dast_profiles/components/dast_profiles.vue';
 import DastProfilesList from 'ee/dast_profiles/components/dast_profiles_list.vue';
 
+const TEST_NEW_DAST_SCANNER_PROFILE_PATH = '/-/on_demand_scans/scanner_profiles/new';
 const TEST_NEW_DAST_SITE_PROFILE_PATH = '/-/on_demand_scans/site_profiles/new';
 const TEST_PROJECT_FULL_PATH = '/namespace/project';
 
@@ -12,7 +14,10 @@ describe('EE - DastProfiles', () => {
 
   const createComponentFactory = (mountFn = shallowMount) => (options = {}) => {
     const defaultProps = {
-      newDastSiteProfilePath: TEST_NEW_DAST_SITE_PROFILE_PATH,
+      createNewProfilePaths: {
+        scannerProfile: TEST_NEW_DAST_SCANNER_PROFILE_PATH,
+        siteProfile: TEST_NEW_DAST_SITE_PROFILE_PATH,
+      },
       projectFullPath: TEST_PROJECT_FULL_PATH,
     };
 
@@ -43,28 +48,68 @@ describe('EE - DastProfiles', () => {
   const createComponent = createComponentFactory();
   const createFullComponent = createComponentFactory(mount);
 
+  const withFeatureFlag = (featureFlagName, { enabled, disabled }) => {
+    it.each([true, false])(`with ${featureFlagName} enabled: "%s"`, featureFlagStatus => {
+      createComponent({
+        provide: {
+          glFeatures: {
+            [featureFlagName]: featureFlagStatus,
+          },
+        },
+      });
+
+      if (featureFlagStatus) {
+        enabled();
+      } else {
+        disabled();
+      }
+    });
+  };
+
   const withinComponent = () => within(wrapper.element);
   const getSiteProfilesComponent = () => wrapper.find(DastProfilesList);
+  const getDropdownComponent = () => wrapper.find(GlDropdown);
+  const getSiteProfilesDropdownItem = text =>
+    within(getDropdownComponent().element).queryByText(text);
 
   afterEach(() => {
     wrapper.destroy();
   });
 
   describe('header', () => {
-    beforeEach(() => {
+    it('shows a heading that describes the purpose of the page', () => {
       createFullComponent();
-    });
 
-    it('shows a heading that describes the purpose of the page', () => {
       const heading = withinComponent().getByRole('heading', { name: /manage profiles/i });
 
       expect(heading).not.toBe(null);
     });
 
-    it(`shows a "New Site Profile" anchor that links to ${TEST_NEW_DAST_SITE_PROFILE_PATH}`, () => {
-      const newProfileButton = withinComponent().getByRole('link', { name: /new site profile/i });
+    it('has a "New Profile" dropdown menu', () => {
+      createComponent();
+
+      expect(getDropdownComponent().props('text')).toBe('New Profile');
+    });
+
+    it(`shows a "Site Profile" dropdown item that links to ${TEST_NEW_DAST_SITE_PROFILE_PATH}`, () => {
+      createComponent();
 
-      expect(newProfileButton.getAttribute('href')).toBe(TEST_NEW_DAST_SITE_PROFILE_PATH);
+      expect(getSiteProfilesDropdownItem('Site Profile').getAttribute('href')).toBe(
+        TEST_NEW_DAST_SITE_PROFILE_PATH,
+      );
+    });
+
+    describe(`shows a "Scanner Profile" dropdown item that links to ${TEST_NEW_DAST_SCANNER_PROFILE_PATH}`, () => {
+      withFeatureFlag('securityOnDemandScansScannerProfiles', {
+        enabled: () => {
+          expect(getSiteProfilesDropdownItem('Scanner Profile').getAttribute('href')).toBe(
+            TEST_NEW_DAST_SCANNER_PROFILE_PATH,
+          );
+        },
+        disabled: () => {
+          expect(getSiteProfilesDropdownItem('Scanner Profile')).toBe(null);
+        },
+      });
     });
   });
 

ee/spec/views/projects/dast_profiles/index.html.haml_spec.rb

@@ -16,6 +16,10 @@ RSpec.describe "projects/dast_profiles/index", type: :view do
     expect(rendered).to include '/on_demand_scans/profiles/dast_site_profiles/new'
   end
 
+  it 'passes new dast scanner profile path' do
+    expect(rendered).to include '/on_demand_scans/profiles/dast_scanner_profiles/new'
+  end
+
   it 'passes project\'s full path' do
     expect(rendered).to include @project.path_with_namespace
   end

locale/gitlab.pot

@@ -7752,10 +7752,10 @@ msgstr ""
 msgid "DastProfiles|Manage profiles"
 msgstr ""
 
-msgid "DastProfiles|New Scanner Profile"
+msgid "DastProfiles|New Profile"
 msgstr ""
 
-msgid "DastProfiles|New Site Profile"
+msgid "DastProfiles|New Scanner Profile"
 msgstr ""
 
 msgid "DastProfiles|New scanner profile"
@@ -7779,6 +7779,12 @@ msgstr ""
 msgid "DastProfiles|Save profile"
 msgstr ""
 
+msgid "DastProfiles|Scanner Profile"
+msgstr ""
+
+msgid "DastProfiles|Site Profile"
+msgstr ""
+
 msgid "DastProfiles|Site Profiles"
 msgstr ""
 

spec/frontend/lib/utils/text_utility_spec.js

@@ -218,10 +218,11 @@ describe('text_utility', () => {
 
     it('replaces Unicode characters', () => {
       expect(textUtils.convertUnicodeToAscii('Dĭd söméònê äšk fœŕ Ůnĭċődę?')).toBe(
-        'Did someone aesk foer Unicode?',
+        'Did soemeone aesk foer Unicode?',
       );
 
       expect(textUtils.convertUnicodeToAscii("Jürgen's Projekt")).toBe("Juergen's Projekt");
+      expect(textUtils.convertUnicodeToAscii('öäüÖÄÜ')).toBe('oeaeueOeAeUe');
     });
   });
 

spec/models/merge_request_spec.rb

@@ -2,13 +2,16 @@
 
 require 'spec_helper'
 
-RSpec.describe MergeRequest do
+RSpec.describe MergeRequest, factory_default: :keep do
   include RepoHelpers
   include ProjectForksHelper
   include ReactiveCachingHelpers
 
   using RSpec::Parameterized::TableSyntax
 
+  let_it_be(:namespace) { create_default(:namespace) }
+  let_it_be(:project, refind: true) { create_default(:project, :repository) }
+
   subject { create(:merge_request) }
 
   describe 'associations' do
@@ -360,7 +363,7 @@ RSpec.describe MergeRequest do
     it 'returns merge requests that match the given merge commit' do
       note = create(:track_mr_picking_note, commit_id: '456abc')
 
-      create(:track_mr_picking_note, commit_id: '456def')
+      create(:track_mr_picking_note, project: create(:project), commit_id: '456def')
 
       expect(described_class.by_cherry_pick_sha('456abc')).to eq([note.noteable])
     end
@@ -832,7 +835,7 @@ RSpec.describe MergeRequest do
     end
 
     context 'with commit diff note' do
-      let(:other_merge_request) { create(:merge_request) }
+      let(:other_merge_request) { create(:merge_request, source_project: create(:project, :repository)) }
 
       let!(:diff_note) do
         create(:diff_note_on_commit, project: merge_request.project)
@@ -1031,6 +1034,8 @@ RSpec.describe MergeRequest do
   end
 
   describe '#closes_issues' do
+    let(:project) { create(:project) }
+
     let(:issue0) { create :issue, project: subject.project }
     let(:issue1) { create :issue, project: subject.project }
 
@@ -1038,6 +1043,8 @@ RSpec.describe MergeRequest do
     let(:commit1) { double('commit1', safe_message: "Fixes #{issue0.to_reference}") }
     let(:commit2) { double('commit2', safe_message: "Fixes #{issue1.to_reference}") }
 
+    subject { create(:merge_request, source_project: project) }
+
     before do
       subject.project.add_developer(subject.author)
       allow(subject).to receive(:commits).and_return([commit0, commit1, commit2])
@@ -1088,6 +1095,8 @@ RSpec.describe MergeRequest do
     end
 
     context 'when the project has an external issue tracker' do
+      subject { create(:merge_request, source_project: create(:project, :repository)) }
+
       before do
         subject.project.add_developer(subject.author)
         commit = double(:commit, safe_message: 'Fixes TEST-3')
@@ -1254,7 +1263,8 @@ RSpec.describe MergeRequest do
   end
 
   describe "#source_branch_exists?" do
-    let(:merge_request) { subject }
+    let(:project) { create(:project, :repository) }
+    let(:merge_request) { create(:merge_request, source_project: project) }
     let(:repository) { merge_request.source_project.repository }
 
     context 'when the source project is set' do
@@ -1730,16 +1740,14 @@ RSpec.describe MergeRequest do
   describe '#has_test_reports?' do
     subject { merge_request.has_test_reports? }
 
-    let(:project) { create(:project, :repository) }
-
     context 'when head pipeline has test reports' do
-      let(:merge_request) { create(:merge_request, :with_test_reports, source_project: project) }
+      let(:merge_request) { create(:merge_request, :with_test_reports) }
 
       it { is_expected.to be_truthy }
     end
 
     context 'when head pipeline does not have test reports' do
-      let(:merge_request) { create(:merge_request, source_project: project) }
+      let(:merge_request) { create(:merge_request) }
 
       it { is_expected.to be_falsey }
     end
@@ -1748,16 +1756,14 @@ RSpec.describe MergeRequest do
   describe '#has_accessibility_reports?' do
     subject { merge_request.has_accessibility_reports? }
 
-    let(:project) { create(:project, :repository) }
-
     context 'when head pipeline has an accessibility reports' do
-      let(:merge_request) { create(:merge_request, :with_accessibility_reports, source_project: project) }
+      let(:merge_request) { create(:merge_request, :with_accessibility_reports) }
 
       it { is_expected.to be_truthy }
     end
 
     context 'when head pipeline does not have accessibility reports' do
-      let(:merge_request) { create(:merge_request, source_project: project) }
+      let(:merge_request) { create(:merge_request) }
 
       it { is_expected.to be_falsey }
     end
@@ -1766,27 +1772,23 @@ RSpec.describe MergeRequest do
   describe '#has_coverage_reports?' do
     subject { merge_request.has_coverage_reports? }
 
-    let(:project) { create(:project, :repository) }
-
     context 'when head pipeline has coverage reports' do
-      let(:merge_request) { create(:merge_request, :with_coverage_reports, source_project: project) }
+      let(:merge_request) { create(:merge_request, :with_coverage_reports) }
 
       it { is_expected.to be_truthy }
     end
 
     context 'when head pipeline does not have coverage reports' do
-      let(:merge_request) { create(:merge_request, source_project: project) }
+      let(:merge_request) { create(:merge_request) }
 
       it { is_expected.to be_falsey }
     end
   end
 
   describe '#has_terraform_reports?' do
-    let_it_be(:project) { create(:project, :repository) }
-
     context 'when head pipeline has terraform reports' do
       it 'returns true' do
-        merge_request = create(:merge_request, :with_terraform_reports, source_project: project)
+        merge_request = create(:merge_request, :with_terraform_reports)
 
         expect(merge_request.has_terraform_reports?).to be_truthy
       end
@@ -1794,7 +1796,7 @@ RSpec.describe MergeRequest do
 
     context 'when head pipeline does not have terraform reports' do
       it 'returns false' do
-        merge_request = create(:merge_request, source_project: project)
+        merge_request = create(:merge_request)
 
         expect(merge_request.has_terraform_reports?).to be_falsey
       end
@@ -1802,8 +1804,7 @@ RSpec.describe MergeRequest do
   end
 
   describe '#calculate_reactive_cache' do
-    let(:project) { create(:project, :repository) }
-    let(:merge_request) { create(:merge_request, source_project: project) }
+    let(:merge_request) { create(:merge_request) }
 
     subject { merge_request.calculate_reactive_cache(service_class_name) }
 
@@ -2131,6 +2132,8 @@ RSpec.describe MergeRequest do
   end
 
   describe '#can_be_reverted?' do
+    subject { create(:merge_request, source_project: create(:project, :repository)) }
+
     context 'when there is no merge_commit for the MR' do
       before do
         subject.metrics.update!(merged_at: Time.current.utc)
@@ -2319,8 +2322,6 @@ RSpec.describe MergeRequest do
   end
 
   describe '#participants' do
-    let(:project) { create(:project, :public) }
-
     let(:mr) do
       create(:merge_request, source_project: project, target_project: project)
     end
@@ -2428,9 +2429,7 @@ RSpec.describe MergeRequest do
   end
 
   describe '#mergeable?' do
-    let(:project) { create(:project) }
-
-    subject { create(:merge_request, source_project: project) }
+    subject { build_stubbed(:merge_request) }
 
     it 'returns false if #mergeable_state? is false' do
       expect(subject).to receive(:mergeable_state?) { false }
@@ -2500,9 +2499,7 @@ RSpec.describe MergeRequest do
   end
 
   describe '#mergeable_state?' do
-    let(:project) { create(:project, :repository) }
-
-    subject { create(:merge_request, source_project: project) }
+    subject { create(:merge_request) }
 
     it 'checks if merge request can be merged' do
       allow(subject).to receive(:mergeable_ci_state?) { true }
@@ -2617,7 +2614,7 @@ RSpec.describe MergeRequest do
     let(:pipeline) { create(:ci_empty_pipeline) }
 
     context 'when it is only allowed to merge when build is green' do
-      let(:project) { create(:project, only_allow_merge_if_pipeline_succeeds: true) }
+      let_it_be(:project) { create(:project, only_allow_merge_if_pipeline_succeeds: true) }
 
       subject { build(:merge_request, target_project: project) }
 
@@ -2658,7 +2655,7 @@ RSpec.describe MergeRequest do
     end
 
     context 'when it is only allowed to merge when build is green or skipped' do
-      let(:project) { create(:project, only_allow_merge_if_pipeline_succeeds: true, allow_merge_on_skipped_pipeline: true) }
+      let_it_be(:project) { create(:project, only_allow_merge_if_pipeline_succeeds: true, allow_merge_on_skipped_pipeline: true) }
 
       subject { build(:merge_request, target_project: project) }
 
@@ -2699,7 +2696,7 @@ RSpec.describe MergeRequest do
     end
 
     context 'when merges are not restricted to green builds' do
-      let(:project) { create(:project, only_allow_merge_if_pipeline_succeeds: false) }
+      let_it_be(:project) { create(:project, only_allow_merge_if_pipeline_succeeds: false) }
 
       subject { build(:merge_request, target_project: project) }
 
@@ -2743,7 +2740,7 @@ RSpec.describe MergeRequest do
     let(:merge_request) { create(:merge_request_with_diff_notes, source_project: project) }
 
     context 'when project.only_allow_merge_if_all_discussions_are_resolved == true' do
-      let(:project) { create(:project, :repository, only_allow_merge_if_all_discussions_are_resolved: true) }
+      let_it_be(:project) { create(:project, :repository, only_allow_merge_if_all_discussions_are_resolved: true) }
 
       context 'with all discussions resolved' do
         before do
@@ -2992,6 +2989,10 @@ RSpec.describe MergeRequest do
   end
 
   describe '#branch_merge_base_commit' do
+    let(:project) { create(:project, :repository) }
+
+    subject { create(:merge_request, :with_diffs, source_project: project) }
+
     context 'source and target branch exist' do
       it { expect(subject.branch_merge_base_commit.sha).to eq('ae73cb07c9eeaf35924a10f713b364d32b2dd34f') }
       it { expect(subject.branch_merge_base_commit).to be_a(Commit) }
@@ -3011,7 +3012,9 @@ RSpec.describe MergeRequest do
 
   describe "#diff_refs" do
     context "with diffs" do
-      subject { create(:merge_request, :with_diffs) }
+      let(:project) { create(:project, :repository) }
+
+      subject { create(:merge_request, :with_diffs, source_project: project) }
 
       let(:expected_diff_refs) do
         Gitlab::Diff::DiffRefs.new(
@@ -3213,7 +3216,8 @@ RSpec.describe MergeRequest do
       pipeline
     end
 
-    let(:project)       { create(:project, :public, :repository, only_allow_merge_if_pipeline_succeeds: true) }
+    let_it_be(:project) { create(:project, :public, :repository, only_allow_merge_if_pipeline_succeeds: true) }
+
     let(:developer)     { create(:user) }
     let(:user)          { create(:user) }
     let(:merge_request) { create(:merge_request, source_project: project) }
@@ -3307,8 +3311,7 @@ RSpec.describe MergeRequest do
   end
 
   describe '#pipeline_coverage_delta' do
-    let!(:project)       { create(:project, :repository) }
-    let!(:merge_request) { create(:merge_request, source_project: project) }
+    let!(:merge_request) { create(:merge_request) }
 
     let!(:source_pipeline) do
       create(:ci_pipeline,
@@ -3414,7 +3417,9 @@ RSpec.describe MergeRequest do
   end
 
   describe '#merge_request_diff_for' do
-    subject { create(:merge_request, importing: true) }
+    let(:project) { create(:project, :repository) }
+
+    subject { create(:merge_request, importing: true, source_project: project) }
 
     let!(:merge_request_diff1) { subject.merge_request_diffs.create(head_commit_sha: '6f6d7e7ed97bb5f0054f2b1df789b39ca89b6ff9') }
     let!(:merge_request_diff2) { subject.merge_request_diffs.create(head_commit_sha: nil) }
@@ -3445,9 +3450,10 @@ RSpec.describe MergeRequest do
   end
 
   describe '#version_params_for' do
-    subject { create(:merge_request, importing: true) }
+    let(:project) { create(:project, :repository) }
+
+    subject { create(:merge_request, importing: true, source_project: project) }
 
-    let(:project) { subject.project }
     let!(:merge_request_diff1) { subject.merge_request_diffs.create(head_commit_sha: '6f6d7e7ed97bb5f0054f2b1df789b39ca89b6ff9') }
     let!(:merge_request_diff2) { subject.merge_request_diffs.create(head_commit_sha: nil) }
     let!(:merge_request_diff3) { subject.merge_request_diffs.create(head_commit_sha: '5937ac0a7beb003549fc5fd26fc247adbce4a52e') }
@@ -3478,6 +3484,10 @@ RSpec.describe MergeRequest do
   end
 
   describe '#fetch_ref!' do
+    let(:project) { create(:project, :repository) }
+
+    subject { create(:merge_request, :with_diffs, source_project: project) }
+
     it 'fetches the ref correctly' do
       expect { subject.target_project.repository.delete_refs(subject.ref_path) }.not_to raise_error
 
@@ -3500,8 +3510,10 @@ RSpec.describe MergeRequest do
   end
 
   context 'state machine transitions' do
+    let(:project) { create(:project, :repository) }
+
     describe '#unlock_mr' do
-      subject { create(:merge_request, state: 'locked', merge_jid: 123) }
+      subject { create(:merge_request, state: 'locked', source_project: project, merge_jid: 123) }
 
       it 'updates merge request head pipeline and sets merge_jid to nil', :sidekiq_might_not_need_inline do
         pipeline = create(:ci_empty_pipeline, project: subject.project, ref: subject.source_branch, sha: subject.source_branch_sha)
@@ -3518,7 +3530,7 @@ RSpec.describe MergeRequest do
       let(:notification_service) { double(:notification_service) }
       let(:todo_service) { double(:todo_service) }
 
-      subject { create(:merge_request, state, merge_status: :unchecked) }
+      subject { create(:merge_request, state, source_project: project, merge_status: :unchecked) }
 
       before do
         allow(NotificationService).to receive(:new).and_return(notification_service)
@@ -3607,7 +3619,7 @@ RSpec.describe MergeRequest do
       end
 
       context 'source branch is missing' do
-        subject { create(:merge_request, :invalid, :opened, merge_status: :unchecked, target_branch: 'master') }
+        subject { create(:merge_request, :invalid, :opened, source_project: project, merge_status: :unchecked, target_branch: 'master') }
 
         before do
           allow(subject.project.repository).to receive(:can_be_merged?).and_call_original
@@ -3640,10 +3652,8 @@ RSpec.describe MergeRequest do
   end
 
   describe '#should_be_rebased?' do
-    let(:project) { create(:project, :repository) }
-
     it 'returns false for the same source and target branches' do
-      merge_request = create(:merge_request, source_project: project, target_project: project)
+      merge_request = build_stubbed(:merge_request, source_project: project, target_project: project)
 
       expect(merge_request.should_be_rebased?).to be_falsey
     end
@@ -3658,7 +3668,7 @@ RSpec.describe MergeRequest do
     end
 
     with_them do
-      let(:merge_request) { create(:merge_request) }
+      let(:merge_request) { build_stubbed(:merge_request) }
 
       subject { merge_request.rebase_in_progress? }
 
@@ -3881,7 +3891,7 @@ RSpec.describe MergeRequest do
   describe '#cleanup_refs' do
     subject { merge_request.cleanup_refs(only: only) }
 
-    let(:merge_request) { build(:merge_request) }
+    let(:merge_request) { build(:merge_request, source_project: create(:project, :repository)) }
 
     context 'when removing all refs' do
       let(:only) { :all }