Automatic merge of gitlab-org/gitlab master

.markdownlint.yml

@@ -139,6 +139,8 @@ proper-names:
     "unicorn-worker-killer",
     "URL",
     "WebdriverIO",
+    "Workload Identity Pool",
+    "Workload Identity Provider",
     "YAML",
     "YouTrack"
   ]

doc/api/status_checks.md

@@ -31,7 +31,7 @@ GET /projects/:id/merge_requests/:merge_request_iid/status_checks
         "id": 2,
         "name": "Rule 1",
         "external_url": "https://gitlab.com/test-endpoint",
-        "status": "approved"
+        "status": "pass"
     },
     {
         "id": 1,
@@ -61,6 +61,7 @@ POST /projects/:id/merge_requests/:merge_request_iid/status_check_responses
 | `merge_request_iid`        | integer | yes      | IID of a merge request                |
 | `sha`                      | string  | yes      | SHA at `HEAD` of the source branch    |
 | `external_status_check_id` | integer | yes      | ID of an external status check        |
+| `status`                   | string  | no       | Set to `pass` to pass the check       |
 
 NOTE:
 `sha` must be the SHA at the `HEAD` of the merge request's source branch.

doc/integration/oauth_provider.md

@@ -105,6 +105,8 @@ Existing:
   **Expire access tokens** to enable them.
 - Tokens must be [revoked](../api/oauth2.md#revoke-a-token) or they don't expire.
 
+When applications are deleted, all grants and tokens associated with the application are also deleted.
+
 ## Authorized applications
 
 Every application you authorize with your GitLab credentials is shown

ee/spec/models/ee/vulnerability_spec.rb

@@ -29,6 +29,8 @@ RSpec.describe Vulnerability do
   let_it_be(:vulnerability) { create(:vulnerability, :sast, :confirmed, :low, project: project) }
   let_it_be(:finding) { create(:vulnerabilities_finding, vulnerability: vulnerability) }
 
+  it { is_expected.to have_locked_schema('f2d19034bdc7733dad8451dbb26250298f7de27895e99a2a0932f6d728f3cc27').reference('https://gitlab.com/gitlab-org/gitlab/-/issues/349315') }
+
   describe 'enums' do
     it { is_expected.to define_enum_for(:state).with_values(state_values) }
     it { is_expected.to define_enum_for(:severity).with_values(severity_values).with_prefix(:severity) }

ee/spec/models/vulnerabilities/finding_spec.rb

@@ -7,6 +7,8 @@ RSpec.describe Vulnerabilities::Finding do
   it { is_expected.to define_enum_for(:severity) }
   it { is_expected.to define_enum_for(:detection_method) }
 
+  it { is_expected.to have_locked_schema('be0977fb3642f60c0c04b2197fe55d109d27f9630a011f9a64fd31b9716a7c7f').reference('https://gitlab.com/gitlab-org/gitlab/-/issues/349315') }
+
   where(vulnerability_finding_signatures: [true, false])
   with_them do
     before do

ee/spec/support/matchers/locked_schema.rb

+# frozen_string_literal: true
+
+class SchemaVersion # rubocop:disable Gitlab/NamespacedClass
+  def initialize(model)
+    @model = model
+  end
+
+  def current
+    (column_names + index_names).sort
+                                .join('-')
+                                .then { |s| Digest::SHA256.hexdigest(s) }
+  end
+
+  private
+
+  attr_reader :model
+
+  delegate :table_name, :connection, to: :model, private: true
+
+  def column_names
+    connection.columns(table_name).map(&:name)
+  end
+
+  def index_names
+    connection.indexes(table_name).map(&:name)
+  end
+end
+
+RSpec::Matchers.define :have_locked_schema do |locked_version|
+  LOCKED_SCHEMA_ERROR_MESSAGE = <<~TEXT
+    Schema of the "%<table_name>s" table has been locked and does not match
+    with the current version "%<current_schema_version>s".
+
+    Please see "%<reference>s" for more details.
+  TEXT
+
+  chain(:reference) do |value|
+    @reference = value
+  end
+
+  match do
+    @table_name = described_class.table_name
+    @current_schema_version = SchemaVersion.new(described_class).current
+
+    @current_schema_version == locked_version
+  end
+
+  failure_message do
+    format(LOCKED_SCHEMA_ERROR_MESSAGE, table_name: @table_name, current_schema_version: @current_schema_version, reference: @reference)
+  end
+end

qa/qa/specs/features/browser_ui/5_package/package_registry/maven_gradle_repository_spec.rb

@@ -13,10 +13,10 @@ module QA
       let(:package_version) { '1.3.7' }
       let(:package_type) { 'maven_gradle' }
 
-      where(:authentication_token_type, :maven_header_name, :testcase) do
-        :personal_access_token | 'Private-Token' | 'https://gitlab.com/gitlab-org/gitlab/-/quality/test_cases/347601'
-        :ci_job_token          | 'Job-Token' | 'https://gitlab.com/gitlab-org/gitlab/-/quality/test_cases/347603'
-        :project_deploy_token  | 'Deploy-Token' | 'https://gitlab.com/gitlab-org/gitlab/-/quality/test_cases/347602'
+      where(:case_name, :authentication_token_type, :maven_header_name, :testcase) do
+        'using personal access token' | :personal_access_token | 'Private-Token' | 'https://gitlab.com/gitlab-org/gitlab/-/quality/test_cases/347601'
+        'using ci job token'          | :ci_job_token          | 'Job-Token'     | 'https://gitlab.com/gitlab-org/gitlab/-/quality/test_cases/347603'
+        'using project deploy token'  | :project_deploy_token  | 'Deploy-Token'  | 'https://gitlab.com/gitlab-org/gitlab/-/quality/test_cases/347602'
       end
 
       with_them do
@@ -31,7 +31,7 @@ module QA
           end
         end
 
-        it "pushes and pulls a maven package via gradle using #{params[:authentication_token_type]}", testcase: params[:testcase] do
+        it 'pushes and pulls a maven package via gradle', testcase: params[:testcase] do
           Support::Retrier.retry_on_exception(max_attempts: 3, sleep_interval: 2) do
             Resource::Repository::Commit.fabricate_via_api! do |commit|
               gradle_upload_yaml = ERB.new(read_fixture('package_managers/maven', 'gradle_upload_package.yaml.erb')).result(binding)