Merge branch 'ce-upstream' into 'master'

CE upstream

See merge request !845

.eslintignore

+/coverage-javascript/
 /public/
 /tmp/
 /vendor/

.eslintrc

 {
   "extends": "airbnb",
+  "plugins": [
+    "filenames"
+  ],
+  "rules": {
+    "filenames/match-regex": [2, "^[a-z0-9_]+(.js)?$"]
+  },
   "globals": {
     "$": false,
     "_": false,

CONTRIBUTING.md

@@ -19,7 +19,6 @@
         - [Technical debt](#technical-debt)
     - [Merge requests](#merge-requests)
         - [Merge request guidelines](#merge-request-guidelines)
-        - [Merge request description format](#merge-request-description-format)
         - [Contribution acceptance criteria](#contribution-acceptance-criteria)
     - [Changes for Stable Releases](#changes-for-stable-releases)
     - [Definition of done](#definition-of-done)
@@ -247,13 +246,7 @@ request is as follows:
 1. Fork the project into your personal space on GitLab.com
 1. Create a feature branch, branch away from `master`
 1. Write [tests](https://gitlab.com/gitlab-org/gitlab-development-kit#running-the-tests) and code
-1. Add your changes to the [CHANGELOG.md](CHANGELOG.md):
-  1. If you are fixing a ~regression issue, you can add your entry to the next
-     patch release (e.g. `8.12.5` if current version is `8.12.4`)
-  1. Otherwise, add your entry to the next minor release (e.g. `8.13.0` if
-     current version is `8.12.4`
-  1. Please add your entry at a random place among the entries of the targeted
-     release
+1. [Generate a changelog entry with `bin/changelog`][changelog]
 1. If you are writing documentation, make sure to follow the
    [documentation styleguide][doc-styleguide]
 1. If you have multiple commits please combine them into one commit by
@@ -262,8 +255,11 @@ request is as follows:
 1. Submit a merge request (MR) to the `master` branch
 1. The MR title should describe the change you want to make
 1. The MR description should give a motive for your change and the method you
-   used to achieve it, see the [merge request description format]
-   (#merge-request-description-format)
+   used to achieve it.
+  1. If you are contributing code, fill in the template already provided in the
+     "Description" field.
+  1. If you are contributing documentation, choose `Documentation` from the
+     "Choose a template" menu and fill in the template.
 1. If the MR changes the UI it should include *Before* and *After* screenshots
 1. If the MR changes CSS classes please include the list of affected pages,
    `grep css-class ./app -R`
@@ -469,6 +465,7 @@ available at [http://contributor-covenant.org/version/1/1/0/](http://contributor
 [contributor-covenant]: http://contributor-covenant.org
 [rss-source]: https://github.com/bbatsov/ruby-style-guide/blob/master/README.md#source-code-layout
 [rss-naming]: https://github.com/bbatsov/ruby-style-guide/blob/master/README.md#naming
+[changelog]: doc/development/changelog.md "Generate a changelog entry"
 [doc-styleguide]: doc/development/doc_styleguide.md "Documentation styleguide"
 [scss-styleguide]: doc/development/scss_styleguide.md "SCSS styleguide"
 [newlines-styleguide]: doc/development/newlines_styleguide.md "Newlines styleguide"

GITLAB_SHELL_VERSION

-3.6.6
+4.0.0

Gemfile

@@ -55,7 +55,7 @@ gem 'browser', '~> 2.2'
 
 # Extracting information from a git repository
 # Provide access to Gitlab::Git library
-gem 'gitlab_git', '~> 10.6.8'
+gem 'gitlab_git', '~> 10.7.0'
 
 # LDAP Auth
 # GitLab fork with several improvements to original library. For full list of changes
@@ -127,7 +127,7 @@ gem 'truncato',           '~> 0.7.8'
 gem 'nokogiri', '~> 1.6.7', '>= 1.6.7.2'
 
 # Diffs
-gem 'diffy', '~> 3.0.3'
+gem 'diffy', '~> 3.1.0'
 
 # Application server
 group :unicorn do
@@ -206,7 +206,7 @@ gem 'loofah', '~> 2.0.3'
 gem 'licensee', '~> 8.0.0'
 
 # Protect against bruteforcing
-gem 'rack-attack', '~> 4.3.1'
+gem 'rack-attack', '~> 4.4.1'
 
 # Ace editor
 gem 'ace-rails-ap', '~> 4.1.0'

Gemfile.lock

@@ -180,7 +180,7 @@ GEM
       railties
       rotp (~> 2.0)
     diff-lcs (1.2.5)
-    diffy (3.0.7)
+    diffy (3.1.0)
     docile (1.1.5)
     doorkeeper (4.2.0)
       railties (>= 4.2)
@@ -305,7 +305,7 @@ GEM
       posix-spawn (~> 0.3)
     gitlab-license (1.0.0)
     gitlab-markup (1.5.0)
-    gitlab_git (10.6.8)
+    gitlab_git (10.7.0)
       activesupport (~> 4.0)
       charlock_holmes (~> 0.7.3)
       github-linguist (~> 4.7.0)
@@ -544,7 +544,7 @@ GEM
     rack (1.6.4)
     rack-accept (0.4.5)
       rack (>= 0.4)
-    rack-attack (4.3.1)
+    rack-attack (4.4.1)
       rack
     rack-cors (0.4.0)
     rack-mount (0.8.3)
@@ -874,7 +874,7 @@ DEPENDENCIES
   default_value_for (~> 3.0.0)
   devise (~> 4.2)
   devise-two-factor (~> 3.0.0)
-  diffy (~> 3.0.3)
+  diffy (~> 3.1.0)
   doorkeeper (~> 4.2.0)
   dropzonejs-rails (~> 0.7.1)
   elasticsearch-model
@@ -901,7 +901,7 @@ DEPENDENCIES
   gitlab-flowdock-git-hook (~> 1.0.1)
   gitlab-license (~> 1.0)
   gitlab-markup (~> 1.5.0)
-  gitlab_git (~> 10.6.8)
+  gitlab_git (~> 10.7.0)
   gitlab_omniauth-ldap (~> 1.2.1)
   gollum-lib (~> 4.2)
   gollum-rugged_adapter (~> 0.4.2)
@@ -962,7 +962,7 @@ DEPENDENCIES
   poltergeist (~> 1.9.0)
   premailer-rails (~> 1.9.0)
   pry-rails (~> 0.3.4)
-  rack-attack (~> 4.3.1)
+  rack-attack (~> 4.4.1)
   rack-cors (~> 0.4.0)
   rack-oauth2 (~> 1.2.1)
   rails (= 4.2.7.1)
@@ -1032,4 +1032,4 @@ DEPENDENCIES
   wikicloth (= 0.8.1)
 
 BUNDLED WITH
-   1.13.3
+   1.13.5

app/assets/javascripts/application.js

 /* eslint-disable */
 // This is a manifest file that'll be compiled into including all the files listed below.
-// Add new JavaScript/Coffee code in separate files in this directory and they'll automatically
+// Add new JavaScript code in separate files in this directory and they'll automatically
 // be included in the compiled file accessible from http://example.com/assets/application.js
 // It's not advisable to add code directly here, but if you do, it'll appear at the bottom of the
 // the compiled file.
@@ -13,6 +13,7 @@
 /*= require jquery-ui/sortable */
 /*= require jquery_ujs */
 /*= require jquery.endless-scroll */
+/*= require jquery.timeago */
 /*= require jquery.highlight */
 /*= require jquery.waitforimages */
 /*= require jquery.atwho */
@@ -191,6 +192,7 @@
     // Close select2 on escape
     });
     // Initialize tooltips
+    $.fn.tooltip.Constructor.DEFAULTS.trigger = 'hover';
     $body.tooltip({
       selector: '.has-tooltip, [data-toggle="tooltip"]',
       placement: function(_, el) {

app/assets/javascripts/behaviors/details_behavior.js

@@ -15,6 +15,11 @@
     return $("body").on("click", ".js-details-expand", function(e) {
       $(this).next('.js-details-content').removeClass("hide");
       $(this).hide();
+
+      var truncatedItem = $(this).siblings('.js-details-short');
+      if (truncatedItem.length) {
+        truncatedItem.addClass("hide");
+      }
       return e.preventDefault();
     });
   });

app/assets/javascripts/boards/mixins/sortable_default_options.js.es6

@@ -22,7 +22,7 @@
       fallbackClass: 'is-dragging',
       fallbackOnBody: true,
       ghostClass: 'is-ghost',
-      filter: '.has-tooltip, .btn',
+      filter: '.board-delete, .btn',
       delay: gl.issueBoards.touchEnabled ? 100 : 50,
       scrollSensitivity: gl.issueBoards.touchEnabled ? 60 : 100,
       scrollSpeed: 20,

app/assets/javascripts/dispatcher.js.es6

@@ -309,7 +309,7 @@
     };
 
     Dispatcher.prototype.initFieldErrors = function() {
-      $('.show-gl-field-errors').each((i, form) => {
+      $('.gl-show-field-errors').each((i, form) => {
         new gl.GlFieldErrors(form);
       });
     };

app/assets/javascripts/gl_dropdown.js

@@ -239,6 +239,7 @@
           this.fullData = this.options.data;
           currentIndex = -1;
           this.parseData(this.options.data);
+          this.focusTextInput();
         } else {
           this.remote = new GitLabDropdownRemote(this.options.data, {
             dataType: this.options.dataType,
@@ -247,6 +248,7 @@
               return function(data) {
                 _this.fullData = data;
                 _this.parseData(_this.fullData);
+                _this.focusTextInput();
                 if (_this.options.filterable && _this.filter && _this.filter.input) {
                   return _this.filter.input.trigger('input');
                 }
@@ -452,9 +454,8 @@
       contentHtml = $('.dropdown-content', this.dropdown).html();
       if (this.remote && contentHtml === "") {
         this.remote.execute();
-      }
-      if (this.options.filterable) {
-        this.filterInput.focus();
+      } else {
+        this.focusTextInput();
       }
 
       if (this.options.showMenuAbove) {
@@ -691,6 +692,10 @@
       return selectedObject;
     };
 
+    GitLabDropdown.prototype.focusTextInput = function() {
+      if (this.options.filterable) { this.filterInput.focus() }
+    }
+
     GitLabDropdown.prototype.addInput = function(fieldName, value, selectedObject) {
       var $input;
       // Create hidden input for form

app/assets/javascripts/gl_field_error.js.es6

+/* eslint-disable no-param-reassign */
+((global) => {
+  /*
+   * This class overrides the browser's validation error bubbles, displaying custom
+   * error messages for invalid fields instead. To begin validating any form, add the
+   * class `gl-show-field-errors` to the form element, and ensure error messages are
+   * declared in each inputs' `title` attribute. If no title is declared for an invalid
+   * field the user attempts to submit, "This field is required." will be shown by default.
+   *
+   * Opt not to validate certain fields by adding the class `gl-field-error-ignore` to the input.
+   *
+   * Set a custom error anchor for error message to be injected after with the
+   * class `gl-field-error-anchor`
+   *
+   * Examples:
+   *
+   * Basic:
+   *
+   * <form class='gl-show-field-errors'>
+   *  <input type='text' name='username' title='Username is required.'/>
+   * </form>
+   *
+   * Ignore specific inputs (e.g. UsernameValidator):
+   *
+   * <form class='gl-show-field-errors'>
+   *   <div class="form-group>
+   *     <input type='text' class='gl-field-errors-ignore' pattern='[a-zA-Z0-9-_]+'/>
+   *   </div>
+   *   <div class="form-group">
+   *      <input type='text' name='username' title='Username is required.'/>
+   *    </div>
+   * </form>
+   *
+   * Custom Error Anchor (allows error message to be injected after specified element):
+   *
+   * <form class='gl-show-field-errors'>
+   *  <div class="form-group gl-field-error-anchor">
+   *    <input type='text' name='username' title='Username is required.'/>
+   *    // Error message typically injected here
+   *  </div>
+   *  // Error message now injected here
+   * </form>
+   *
+    * */
+
+  /*
+    * Regex Patterns in use:
+    *
+    * Only alphanumeric: : "[a-zA-Z0-9]+"
+    * No special characters : "[a-zA-Z0-9-_]+",
+    *
+    * */
+
+  const errorMessageClass = 'gl-field-error';
+  const inputErrorClass = 'gl-field-error-outline';
+  const errorAnchorSelector = '.gl-field-error-anchor';
+  const ignoreInputSelector = '.gl-field-error-ignore';
+
+  class GlFieldError {
+    constructor({ input, formErrors }) {
+      this.inputElement = $(input);
+      this.inputDomElement = this.inputElement.get(0);
+      this.form = formErrors;
+      this.errorMessage = this.inputElement.attr('title') || 'This field is required.';
+      this.fieldErrorElement = $(`<p class='${errorMessageClass} hide'>${this.errorMessage}</p>`);
+
+      this.state = {
+        valid: false,
+        empty: true,
+      };
+
+      this.initFieldValidation();
+    }
+
+    initFieldValidation() {
+      const customErrorAnchor = this.inputElement.parents(errorAnchorSelector);
+      const errorAnchor = customErrorAnchor.length ? customErrorAnchor : this.inputElement;
+
+      // hidden when injected into DOM
+      errorAnchor.after(this.fieldErrorElement);
+      this.inputElement.off('invalid').on('invalid', this.handleInvalidSubmit.bind(this));
+      this.scopedSiblings = this.safelySelectSiblings();
+    }
+
+    safelySelectSiblings() {
+      // Apply `ignoreSelector` in markup to siblings whose visibility should not be toggled
+      const unignoredSiblings = this.inputElement.siblings(`p:not(${ignoreInputSelector})`);
+      const parentContainer = this.inputElement.parent('.form-group');
+
+      // Only select siblings when they're scoped within a form-group with one input
+      const safelyScoped = parentContainer.length && parentContainer.find('input').length === 1;
+
+      return safelyScoped ? unignoredSiblings : this.fieldErrorElement;
+    }
+
+    renderValidity() {
+      this.renderClear();
+
+      if (this.state.valid) {
+        this.renderValid();
+      } else if (this.state.empty) {
+        this.renderEmpty();
+      } else if (!this.state.valid) {
+        this.renderInvalid();
+      }
+    }
+
+    handleInvalidSubmit(event) {
+      event.preventDefault();
+      const currentValue = this.accessCurrentValue();
+      this.state.valid = false;
+      this.state.empty = currentValue === '';
+
+      this.renderValidity();
+      this.form.focusOnFirstInvalid.apply(this.form);
+      // For UX, wait til after first invalid submission to check each keyup
+      this.inputElement.off('keyup.fieldValidator')
+        .on('keyup.fieldValidator', this.updateValidity.bind(this));
+    }
+
+    /* Get or set current input value */
+    accessCurrentValue(newVal) {
+      return newVal ? this.inputElement.val(newVal) : this.inputElement.val();
+    }
+
+    getInputValidity() {
+      return this.inputDomElement.validity.valid;
+    }
+
+    updateValidity() {
+      const inputVal = this.accessCurrentValue();
+      this.state.empty = !inputVal.length;
+      this.state.valid = this.getInputValidity();
+      this.renderValidity();
+    }
+
+    renderValid() {
+      return this.renderClear();
+    }
+
+    renderEmpty() {
+      return this.renderInvalid();
+    }
+
+    renderInvalid() {
+      this.inputElement.addClass(inputErrorClass);
+      this.scopedSiblings.hide();
+      return this.fieldErrorElement.show();
+    }
+
+    renderClear() {
+      const inputVal = this.accessCurrentValue();
+      if (!inputVal.split(' ').length) {
+        const trimmedInput = inputVal.trim();
+        this.accessCurrentValue(trimmedInput);
+      }
+      this.inputElement.removeClass(inputErrorClass);
+      this.scopedSiblings.hide();
+      this.fieldErrorElement.hide();
+    }
+  }
+
+  global.GlFieldError = GlFieldError;
+})(window.gl || (window.gl = {}));

app/assets/javascripts/gl_field_errors.js.es6

 /* eslint-disable */
-((global) => {
-  /*
-   * This class overrides the browser's validation error bubbles, displaying custom
-   * error messages for invalid fields instead. To begin validating any form, add the
-   * class `show-gl-field-errors` to the form element, and ensure error messages are
-   * declared in each inputs' title attribute.
-   *
-   * Example:
-   *
-   * <form class='show-gl-field-errors'>
-   *  <input type='text' name='username' title='Username is required.'/>
-   *</form>
-   *
-    * */
-
-  const errorMessageClass = 'gl-field-error';
-  const inputErrorClass = 'gl-field-error-outline';
-
-  class GlFieldError {
-    constructor({ input, formErrors }) {
-      this.inputElement = $(input);
-      this.inputDomElement = this.inputElement.get(0);
-      this.form = formErrors;
-      this.errorMessage = this.inputElement.attr('title') || 'This field is required.';
-      this.fieldErrorElement = $(`<p class='${errorMessageClass} hide'>${ this.errorMessage }</p>`);
-
-      this.state = {
-        valid: false,
-        empty: true
-      };
-
-      this.initFieldValidation();
-    }
-
-    initFieldValidation() {
-      // hidden when injected into DOM
-      this.inputElement.after(this.fieldErrorElement);
-      this.inputElement.off('invalid').on('invalid', this.handleInvalidSubmit.bind(this));
-      this.scopedSiblings = this.safelySelectSiblings();
-    }
-
-    safelySelectSiblings() {
-      // Apply `ignoreSelector` in markup to siblings whose visibility should not be toggled with input validity
-      const ignoreSelector = '.validation-ignore';
-      const unignoredSiblings = this.inputElement.siblings(`p:not(${ignoreSelector})`);
-      const parentContainer = this.inputElement.parent('.form-group');
 
-      // Only select siblings when they're scoped within a form-group with one input
-      const safelyScoped = parentContainer.length && parentContainer.find('input').length === 1;
-
-      return safelyScoped ? unignoredSiblings : this.fieldErrorElement;
-    }
-
-    renderValidity() {
-      this.renderClear();
-
-      if (this.state.valid) {
-        return this.renderValid();
-      }
-
-      if (this.state.empty) {
-        return this.renderEmpty();
-      }
-
-      if (!this.state.valid) {
-        return this.renderInvalid();
-      }
-
-    }
+//= require gl_field_error
 
-    handleInvalidSubmit(event) {
-      event.preventDefault();
-      const currentValue = this.accessCurrentValue();
-      this.state.valid = false;
-      this.state.empty = currentValue === '';
-
-      this.renderValidity();
-      this.form.focusOnFirstInvalid.apply(this.form);
-      // For UX, wait til after first invalid submission to check each keyup
-      this.inputElement.off('keyup.field_validator')
-        .on('keyup.field_validator', this.updateValidity.bind(this));
-
-    }
-
-    /* Get or set current input value */
-    accessCurrentValue(newVal) {
-      return newVal ? this.inputElement.val(newVal) : this.inputElement.val();
-    }
-
-    getInputValidity() {
-      return this.inputDomElement.validity.valid;
-    }
-
-    updateValidity() {
-      const inputVal = this.accessCurrentValue();
-      this.state.empty = !inputVal.length;
-      this.state.valid = this.getInputValidity();
-      this.renderValidity();
-    }
-
-    renderValid() {
-      return this.renderClear();
-    }
-
-    renderEmpty() {
-      return this.renderInvalid();
-    }
-
-    renderInvalid() {
-      this.inputElement.addClass(inputErrorClass);
-      this.scopedSiblings.hide();
-      return this.fieldErrorElement.show();
-    }
-
-    renderClear() {
-      const inputVal = this.accessCurrentValue();
-      if (!inputVal.split(' ').length) {
-        const trimmedInput = inputVal.trim();
-        this.accessCurrentValue(trimmedInput);
-      }
-      this.inputElement.removeClass(inputErrorClass);
-      this.scopedSiblings.hide();
-      this.fieldErrorElement.hide();
-    }
-  }
-
-  const customValidationFlag = 'no-gl-field-errors';
+((global) => {
+  const customValidationFlag = 'gl-field-error-ignore';
 
   class GlFieldErrors {
     constructor(form) {
@@ -144,7 +22,7 @@
 
       this.state.inputs = this.form.find(validateSelectors).toArray()
         .filter((input) => !input.classList.contains(customValidationFlag))
-        .map((input) => new GlFieldError({ input, formErrors: this }));
+        .map((input) => new global.GlFieldError({ input, formErrors: this }));
 
       this.form.on('submit', this.catchInvalidFormSubmit);
     }

app/assets/javascripts/graphs/graphs_bundle.js

 /* eslint-disable */
 // This is a manifest file that'll be compiled into including all the files listed below.
-// Add new JavaScript/Coffee code in separate files in this directory and they'll automatically
+// Add new JavaScript code in separate files in this directory and they'll automatically
 // be included in the compiled file accessible from http://example.com/assets/application.js
 // It's not advisable to add code directly here, but if you do, it'll appear at the bottom of the
 // the compiled file.

app/assets/javascripts/issue.js

@@ -95,7 +95,11 @@
       return $.ajax({
         type: 'PATCH',
         url: $('form.js-issuable-update').attr('action'),
-        data: patchData
+        data: patchData,
+        success: function(issue) {
+          document.querySelector('#task_status').innerText = issue.task_status;
+          document.querySelector('#task_status_short').innerText = issue.task_status_short;
+        }
       });
     // TODO (rspeicher): Make the issue description inline-editable like a note so
     // that we can re-use its form here

app/assets/javascripts/merge_request.js

@@ -97,7 +97,11 @@
       return $.ajax({
         type: 'PATCH',
         url: $('form.js-issuable-update').attr('action'),
-        data: patchData
+        data: patchData,
+        success: function(mergeRequest) {
+          document.querySelector('#task_status').innerText = mergeRequest.task_status;
+          document.querySelector('#task_status_short').innerText = mergeRequest.task_status_short;
+        }
       });
     // TODO (rspeicher): Make the merge request description inline-editable like a
     // note so that we can re-use its form here

app/assets/javascripts/merge_request_tabs.js

@@ -238,8 +238,11 @@
               _this.expandViewContainer();
             }
             _this.diffsLoaded = true;
-            _this.scrollToElement("#diffs");
-            _this.highlighSelectedLine();
+            var anchoredDiff = gl.utils.getLocationHash();
+            if (anchoredDiff) _this.openAnchoredDiff(anchoredDiff, function() {
+              _this.scrollToElement("#diffs");
+              _this.highlighSelectedLine();
+            });
             _this.filesCommentButton = $('.files .diff-file').filesCommentButton();
             return $(document).off('click', '.diff-line-num a').on('click', '.diff-line-num a', function(e) {
               e.preventDefault();
@@ -252,6 +255,17 @@
       });
     };
 
+    MergeRequestTabs.prototype.openAnchoredDiff = function(anchoredDiff, cb) {
+      var diffTitle = $('#file-path-' + anchoredDiff);
+      var diffFile = diffTitle.closest('.diff-file');
+      var nothingHereBlock = $('.nothing-here-block:visible', diffFile);
+      if (nothingHereBlock.length) {
+        diffFile.singleFileDiff(true, cb);
+      } else {
+        cb();
+      }
+    };
+
     MergeRequestTabs.prototype.highlighSelectedLine = function() {
       var $diffLine, diffLineTop, hashClassString, locationHash, navBarHeight;
       $('.hll').removeClass('hll');

app/assets/javascripts/network/network_bundle.js

 /* eslint-disable */
 // This is a manifest file that'll be compiled into including all the files listed below.
-// Add new JavaScript/Coffee code in separate files in this directory and they'll automatically
+// Add new JavaScript code in separate files in this directory and they'll automatically
 // be included in the compiled file accessible from http://example.com/assets/application.js
 // It's not advisable to add code directly here, but if you do, it'll appear at the bottom of the
 // the compiled file.

app/assets/javascripts/single_file_diff.js

@@ -13,7 +13,7 @@
 
     COLLAPSED_HTML = '<div class="nothing-here-block diff-collapsed">This diff is collapsed. <a class="click-to-expand">Click to expand it.</a></div>';
 
-    function SingleFileDiff(file) {
+    function SingleFileDiff(file, forceLoad, cb) {
       this.file = file;
       this.toggleDiff = bind(this.toggleDiff, this);
       this.content = $('.diff-content', this.file);
@@ -32,9 +32,12 @@
         this.$toggleIcon.addClass('fa-caret-down');
       }
       $('.file-title, .click-to-expand', this.file).on('click', this.toggleDiff);
+      if (forceLoad) {
+        this.toggleDiff(null, cb);
+      }
     }
 
-    SingleFileDiff.prototype.toggleDiff = function(e) {
+    SingleFileDiff.prototype.toggleDiff = function(e, cb) {
       var $target = $(e.target);
       if (!$target.hasClass('file-title') && !$target.hasClass('click-to-expand') && !$target.hasClass('diff-toggle-caret')) return;
       this.isOpen = !this.isOpen;
@@ -54,11 +57,11 @@
         }
       } else {
         this.$toggleIcon.addClass('fa-caret-down').removeClass('fa-caret-right');
-        return this.getContentHTML();
+        return this.getContentHTML(cb);
       }
     };
 
-    SingleFileDiff.prototype.getContentHTML = function() {
+    SingleFileDiff.prototype.getContentHTML = function(cb) {
       this.collapsedContent.hide();
       this.loadingContent.show();
       $.get(this.diffForPath, (function(_this) {
@@ -76,6 +79,8 @@
           if (typeof DiffNotesApp !== 'undefined') {
             DiffNotesApp.compileComponents();
           }
+
+          if (cb) cb();
         };
       })(this));
     };
@@ -84,10 +89,10 @@
 
   })();
 
-  $.fn.singleFileDiff = function() {
+  $.fn.singleFileDiff = function(forceLoad, cb) {
     return this.each(function() {
-      if (!$.data(this, 'singleFileDiff')) {
-        return $.data(this, 'singleFileDiff', new SingleFileDiff(this));
+      if (!$.data(this, 'singleFileDiff') || forceLoad) {
+        return $.data(this, 'singleFileDiff', new SingleFileDiff(this, forceLoad, cb));
       }
     });
   };

app/assets/javascripts/star.js

@@ -11,11 +11,9 @@
           $this.parent().find('.star-count').text(data.star_count);
           if (isStarred) {
             $starSpan.removeClass('starred').text('Star');
-            gl.utils.updateTooltipTitle($this, 'Star project');
             $starIcon.removeClass('fa-star').addClass('fa-star-o');
           } else {
             $starSpan.addClass('starred').text('Unstar');
-            gl.utils.updateTooltipTitle($this, 'Unstar project');
             $starIcon.removeClass('fa-star-o').addClass('fa-star');
           }
         };

app/assets/stylesheets/framework/avatar.scss

-.avatar {
+@mixin avatar-size($size, $margin-right) {
+  width: $size;
+  height: $size;
+  margin-right: $margin-right;
+}
+
+.avatar-container {
   float: left;
-  margin-right: 12px;
+  margin-right: 15px;
+  border-radius: $avatar_radius;
+  border: 1px solid rgba(0, 0, 0, .1);
+  &.s16 { @include avatar-size(16px, 6px); }
+  &.s20 { @include avatar-size(20px, 7px); }
+  &.s24 { @include avatar-size(24px, 8px); }
+  &.s26 { @include avatar-size(26px, 8px); }
+  &.s32 { @include avatar-size(32px, 10px); }
+  &.s36 { @include avatar-size(36px, 10px); }
+  &.s40 { @include avatar-size(40px, 10px); }
+  &.s46 { @include avatar-size(46px, 15px); }
+  &.s48 { @include avatar-size(48px, 10px); }
+  &.s60 { @include avatar-size(60px, 12px); }
+  &.s70 { @include avatar-size(70px, 14px); }
+  &.s90 { @include avatar-size(90px, 15px); }
+  &.s110 { @include avatar-size(110px, 15px); }
+  &.s140 { @include avatar-size(140px, 15px); }
+  &.s160 { @include avatar-size(160px, 20px); }
+}
+
+.avatar {
+  @extend .avatar-container;
   width: 40px;
   height: 40px;
   padding: 0;
-  border-radius: $avatar_radius;
-  border: 1px solid rgba(0, 0, 0, .1);
 
   &.avatar-inline {
     float: none;
@@ -20,22 +45,6 @@
     border-radius: 0;
     border: none;
   }
-
-  &.s16 { width: 16px; height: 16px; margin-right: 6px; }
-  &.s20 { width: 20px; height: 20px; margin-right: 7px; }
-  &.s24 { width: 24px; height: 24px; margin-right: 8px; }
-  &.s26 { width: 26px; height: 26px; margin-right: 8px; }
-  &.s32 { width: 32px; height: 32px; margin-right: 10px; }
-  &.s36 { width: 36px; height: 36px; margin-right: 10px; }
-  &.s40 { width: 40px; height: 40px; margin-right: 10px; }
-  &.s46 { width: 46px; height: 46px; margin-right: 15px; }
-  &.s48 { width: 48px; height: 48px; margin-right: 10px; }
-  &.s60 { width: 60px; height: 60px; margin-right: 12px; }
-  &.s70 { width: 70px; height: 70px; margin-right: 14px; }
-  &.s90 { width: 90px; height: 90px; margin-right: 15px; }
-  &.s110 { width: 110px; height: 110px; margin-right: 15px; }
-  &.s140 { width: 140px; height: 140px; margin-right: 20px; }
-  &.s160 { width: 160px; height: 160px; margin-right: 20px; }
 }
 
 .identicon {
@@ -54,3 +63,17 @@
   &.s140 { font-size: 72px; line-height: 138px; }
   &.s160 { font-size: 96px; line-height: 158px; }
 }
+
+.image-container {
+  @extend .avatar-container;
+  overflow: hidden;
+  display: flex;
+
+  .avatar {
+    border-radius: 0;
+    border: none;
+    height: auto;
+    margin: 0;
+    align-self: center;
+  }
+}
\ No newline at end of file

app/assets/stylesheets/framework/buttons.scss

@@ -216,7 +216,7 @@
   svg,
   .fa {
     &:not(:last-child) {
-      margin-right: 3px;
+      margin-right: 5px;
     }
   }
 }

app/assets/stylesheets/framework/forms.scss

@@ -136,3 +136,35 @@ label {
   color: $red-normal;
 }
 
+.gl-show-field-errors {
+  .gl-field-success-outline {
+    border: 1px solid $green-normal;
+
+    &:focus {
+      box-shadow: 0 0 0 1px $green-normal inset, 0 1px 1px rgba(0, 0, 0, 0.075) inset, 0 0 4px 0 $green-normal;
+      border: 0 none;
+    }
+  }
+
+  .gl-field-error-outline {
+    border: 1px solid $red-normal;
+
+    &:focus {
+      box-shadow: 0 0 0 1px $red-normal inset, 0 1px 1px rgba(0, 0, 0, 0.075) inset, 0 0 4px 0 rgba(210, 40, 82, 0.6);
+      border: 0 none;
+    }
+  }
+
+  .gl-field-success-message {
+    color: $green-normal;
+  }
+
+  .gl-field-error-message {
+    color: $red-normal;
+  }
+
+  .gl-field-hint {
+    color: $gl-text-color;
+  }
+}
+

app/assets/stylesheets/framework/gitlab-theme.scss

@@ -21,57 +21,66 @@
       background: $color-darker;
     }
 
-    .nav-sidebar li {
-      a {
-        color: $color-light;
-
-        &:hover,
-        &:focus,
-        &:active {
-          background: $color-dark;
-        }
+    .sidebar-header,
+    .sidebar-action-buttons {
+      color: $color-light;
+      background-color: lighten($color-darker, 5%);
+    }
 
-        i {
+    .nav-sidebar {
+      li {
+        a {
           color: $color-light;
-        }
-
-        path,
-        polygon {
-          fill: $color-light;
-        }
 
-        .count {
-          color: $color-light;
-          background: $color-dark;
+          &:hover,
+          &:focus,
+          &:active {
+            background: $color-dark;
+          }
+
+          i {
+            color: $color-light;
+          }
+
+          path,
+          polygon {
+            fill: $color-light;
+          }
+
+          .count {
+            color: $color-light;
+            background: $color-dark;
+          }
+
+          svg {
+            position: relative;
+            top: 3px;
+          }
         }
 
-        svg {
-          position: relative;
-          top: 3px;
+        &.separate-item {
+          border-top: 1px solid $color;
         }
-      }
-
-      &.separate-item {
-        border-top: 1px solid $color;
-      }
 
-      &.active a {
-        color: $white-light;
-        background: $color-dark;
+        &.active a {
+          color: $white-light;
+          background: $color-dark;
 
-        &.no-highlight {
-          border: none;
-        }
+          &.no-highlight {
+            border: none;
+          }
 
-        i {
-          color: $white-light;
-        }
+          i {
+            color: $white-light;
+          }
 
-        path,
-        polygon {
-          fill: $white-light;
+          path,
+          polygon {
+            fill: $white-light;
+          }
         }
       }
+
     }
   }
 }

app/assets/stylesheets/framework/header.scss

@@ -49,12 +49,16 @@ header {
         font-size: 18px;
         padding: 0;
         margin: ($header-height - 28) / 2 0;
-        margin-left: 10px;
+        margin-left: 8px;
         height: 28px;
         min-width: 28px;
         line-height: 28px;
         text-align: center;
 
+        &.header-user-dropdown-toggle {
+          margin-left: 14px;
+        }
+
         &:hover,
         &:focus,
         &:active {

app/assets/stylesheets/framework/lists.scss

@@ -142,10 +142,6 @@ ul.content-list {
       }
     }
 
-    .avatar {
-      margin-right: 15px;
-    }
-
     .controls {
       float: right;
 

app/assets/stylesheets/framework/pagination.scss

@@ -7,8 +7,70 @@
   .pagination {
     padding: 0;
   }
+
+  .gap,
+  .gap:hover {
+    background-color: $gray-light;
+    padding: $gl-vert-padding;
+    cursor: default;
+  }
 }
 
 .panel > .gl-pagination {
   margin: 0;
 }
+
+/**
+ * Extra-small screen pagination.
+ */
+@media (max-width: 320px) {
+  .gl-pagination {
+    .first,
+    .last {
+      display: none;
+    }
+
+    .page {
+      display: none;
+
+      &.active {
+        display: inline;
+      }
+    }
+  }
+}
+
+/**
+ * Small screen pagination
+ */
+@media (max-width: $screen-xs) {
+  .gl-pagination {
+    .pagination li a {
+      padding: 6px 10px;
+    }
+
+    .page {
+      display: none;
+
+      &.active {
+        display: inline;
+      }
+    }
+  }
+}
+
+/**
+ * Medium screen pagination
+ */
+@media (min-width: $screen-xs) and (max-width: $screen-md-max) {
+  .gl-pagination {
+    .page {
+      display: none;
+
+      &.active,
+      &.sibling {
+        display: inline;
+      }
+    }
+  }
+}

app/assets/stylesheets/framework/sidebar.scss

@@ -59,6 +59,11 @@
     padding: 0 !important;
   }
 
+  .sidebar-header {
+    padding: 11px 22px 12px;
+    font-size: 20px;
+  }
+
   li {
     &.separate-item {
       padding-top: 10px;
@@ -164,6 +169,18 @@
       padding-left: $sidebar_width;
     }
   }
+
+  .merge-request-tabs-holder.affix {
+    @media (min-width: $sidebar-breakpoint) {
+      left: $sidebar_width;
+    }
+  }
+
+  &.right-sidebar-expanded {
+    .line-resolve-all-container {
+      display: none;
+    }
+  }
 }
 
 header.header-sidebar-pinned {

app/assets/stylesheets/framework/variables.scss

@@ -90,6 +90,8 @@ $table-border-color: #f0f0f0;
 $background-color: $gray-light;
 $dark-background-color: #f5f5f5;
 $table-text-gray: #8f8f8f;
+$widget-expand-item: #e8f2f7;
+$widget-inner-border: #eef0f2;
 
 /*
  * Text

app/assets/stylesheets/pages/awards.scss

 .awards {
   .emoji-icon {
-    width: 20px;
-    height: 20px;
+    width: 19px;
+    height: 19px;
   }
 }
 
@@ -94,7 +94,7 @@
 
 .award-control {
   margin: 3px 5px 3px 0;
-  padding: 6px 5px;
+  padding: 5px 6px;
   outline: 0;
 
   &:hover,
@@ -127,7 +127,7 @@
   .award-control-icon {
     float: left;
     margin-right: 5px;
-    font-size: 20px;
+    font-size: 19px;
   }
 
   .award-control-icon-loading {

app/assets/stylesheets/pages/boards.scss

@@ -12,6 +12,10 @@
   opacity: 1!important;
 
   * {
+    -webkit-user-select: none;
+    -moz-user-select: none;
+    -ms-user-select: none;
+    user-select: none;
     // !important to make sure no style can override this when dragging
     cursor: -webkit-grabbing!important;
     cursor: grabbing!important;
@@ -45,11 +49,6 @@
   .page-with-sidebar {
     padding-bottom: 0;
   }
-
-  .issues-filters {
-    position: relative;
-    z-index: 999999;
-  }
 }
 
 .boards-app {

app/assets/stylesheets/pages/builds.scss

@@ -52,10 +52,25 @@
 
 .build-header {
   position: relative;
-  padding-right: 40px;
+  padding: 0;
+  display: flex;
+  min-height: 58px;
+  align-items: center;
 
-  @media (min-width: $screen-sm-min) {
-    padding-right: 0;
+  .btn-inverted {
+    @include btn-outline($white-light, $blue-normal, $blue-normal, $blue-light, $white-light, $blue-light);
+  }
+
+  @media (max-width: $screen-sm-max) {
+    padding-right: 40px;
+
+    .btn-inverted {
+      display: none;
+    }
+  }
+
+  .header-content {
+    flex: 1;
   }
 
   a {
@@ -137,10 +152,15 @@
 
   .retry-link {
     color: $gl-link-color;
+    display: none;
 
     &:hover {
       text-decoration: underline;
     }
+
+    @media (max-width: $screen-sm-max) {
+      display: block;
+    }
   }
 
   .stage-item {

app/assets/stylesheets/pages/commit.scss

@@ -33,10 +33,8 @@
 
   &.commit-info-row-header {
     line-height: 34px;
-
-    @media (min-width: $screen-sm-min) {
-      margin-bottom: 0;
-    }
+    padding: 10px 0;
+    margin-bottom: 0;
 
     .commit-options-dropdown-caret {
       @media (max-width: $screen-sm) {
@@ -80,6 +78,58 @@
   }
 }
 
+.js-details-expand {
+  &:hover {
+    text-decoration: none;
+  }
+}
+
+.commit-info-widget {
+  background: $background-color;
+  color: $gl-gray;
+  border: 1px solid $border-color;
+  border-radius: $border-radius-default;
+
+  .widget-row {
+    padding: $gl-padding;
+
+    &:not(:last-of-type) {
+      border-bottom: 1px solid $widget-inner-border;
+    }
+
+    &.branch-info {
+      .monospace,
+      .commit-info {
+        margin-left: 4px;
+      }
+    }
+  }
+
+  .icon-container {
+    display: inline-block;
+    margin-right: 8px;
+
+    svg {
+      position: relative;
+      top: 2px;
+      height: 16px;
+      width: 16px;
+    }
+
+    &.commit-icon {
+      svg {
+        path {
+          fill: $gl-text-color;
+        }
+      }
+    }
+  }
+
+  .label.label-gray {
+    background-color: $widget-expand-item;
+  }
+}
+
 .ci-status-link {
   svg {
     overflow: visible;
@@ -88,6 +138,7 @@
 
 .commit-box {
   border-top: 1px solid $border-color;
+  padding: $gl-padding 0;
 
   .commit-title {
     margin: 0;
@@ -138,6 +189,9 @@
 }
 
 .commit-action-buttons {
+  position: relative;
+  top: -1px;
+
   i {
     color: $gl-icon-color;
     font-size: 13px;

app/assets/stylesheets/pages/commits.scss

@@ -33,21 +33,22 @@
     color: $gl-dark-link-color;
   }
 
-  .text-expander {
-    display: inline-block;
-    background: $gray-light;
-    color: $gl-placeholder-color;
-    padding: 0 5px;
-    cursor: pointer;
-    border: 1px solid $border-gray-dark;
-    border-radius: $border-radius-default;
-    margin-left: 5px;
-    line-height: 1;
-
-    &:hover {
-      background-color: darken($gray-light, 10%);
-      text-decoration: none;
-    }
+}
+
+.text-expander {
+  display: inline-block;
+  background: $gray-light;
+  color: $gl-placeholder-color;
+  padding: 0 5px;
+  cursor: pointer;
+  border: 1px solid $border-gray-dark;
+  border-radius: $border-radius-default;
+  margin-left: 5px;
+  line-height: 1;
+
+  &:hover {
+    background-color: darken($gray-light, 10%);
+    text-decoration: none;
   }
 }
 

app/assets/stylesheets/pages/dashboard.scss

@@ -36,10 +36,6 @@
   }
 }
 
-.dash-project-avatar {
-  float: left;
-}
-
 .dash-project-access-icon {
   float: left;
   margin-right: 5px;

app/assets/stylesheets/pages/groups.scss

@@ -3,6 +3,7 @@
 }
 
 .dashboard .side .panel .panel-heading .input-group {
+
   .form-control {
     height: 42px;
   }
@@ -14,6 +15,7 @@
 }
 
 .group-row {
+
   .stats {
     float: right;
     line-height: $list-text-height;
@@ -26,12 +28,14 @@
 }
 
 .ldap-group-links {
+
   .form-actions {
     margin-bottom: $gl-padding;
   }
 }
 
 .groups-cover-block {
+
   .container-fluid {
     position: relative;
   }
@@ -46,6 +50,10 @@
       background-color: $background-color;
     }
   }
+
+  .group-avatar {
+    border: 0;
+  }
 }
 
 .ldap-group-links {
@@ -55,6 +63,7 @@
 }
 
 .groups-header {
+
   @media (min-width: $screen-sm-min) {
     .nav-links {
       width: 35%;

app/assets/stylesheets/pages/login.scss

@@ -54,7 +54,6 @@
       margin: 0 0 10px;
     }
 
-
     .login-footer {
       margin-top: 10px;
 
@@ -76,43 +75,17 @@
     .login-body {
       font-size: 13px;
 
-
       input + p {
         margin-top: 5px;
       }
 
-      .gl-field-success-outline {
-        border: 1px solid $green-normal;
-
-        &:focus {
-          box-shadow: 0 0 0 1px $green-normal inset, 0 1px 1px rgba(0, 0, 0, 0.075) inset, 0 0 4px 0 $green-normal;
-          border: 0 none;
-        }
-      }
-
-      .gl-field-error-outline {
-        border: 1px solid $red-normal;
-
-        &:focus {
-          box-shadow: 0 0 0 1px $red-normal inset, 0 1px 1px rgba(0, 0, 0, 0.075) inset, 0 0 4px 0 rgba(210, 40, 82, 0.6);
-          border: 0 none;
-        }
-      }
-
-      .username .validation-success,
-      .gl-field-success-message {
+      .username .validation-success {
         color: $green-normal;
       }
 
-      .username .validation-error,
-      .gl-field-error-message {
+      .username .validation-error {
         color: $red-normal;
       }
-
-      .gl-field-hint {
-        color: $gl-text-color;
-      }
-
     }
   }
 

app/assets/stylesheets/pages/merge_requests.scss

@@ -60,7 +60,7 @@
   }
 
   .ci_widget {
-    border-bottom: 1px solid #eef0f2;
+    border-bottom: 1px solid $widget-inner-border;
 
     svg {
       margin-right: 4px;

app/assets/stylesheets/pages/notes.scss

@@ -105,11 +105,6 @@ ul.notes {
         padding: 2px;
         margin-top: 10px;
       }
-
-      .award-control {
-        font-size: 13px;
-        padding: 2px 5px;
-      }
     }
 
     .note-header {

app/assets/stylesheets/pages/pipelines.scss

@@ -573,8 +573,7 @@
     .build {
       // Remove right connecting horizontal line from first build in last stage
       &:first-child {
-        &::after,
-        &::before {
+        &::after {
           border: none;
         }
       }

app/assets/stylesheets/pages/projects.scss

@@ -96,8 +96,8 @@
 
   .project-avatar {
     float: none;
-    margin-left: auto;
-    margin-right: auto;
+    margin: 0 auto;
+    border: none;
 
     &.identicon {
       border-radius: 50%;

app/assets/stylesheets/pages/todos.scss

@@ -161,3 +161,63 @@
     }
   }
 }
+
+.todos-empty {
+  display: -webkit-flex;
+  display: flex;
+  -webkit-flex-direction: column;
+  flex-direction: column;
+  max-width: 900px;
+  margin-left: auto;
+  margin-right: auto;
+
+  @media (min-width: $screen-sm-min) {
+    -webkit-flex-direction: row;
+    flex-direction: row;
+    padding-top: 80px;
+  }
+}
+
+.todos-empty-content {
+  -webkit-align-self: center;
+  align-self: center;
+  max-width: 480px;
+  margin-right: 20px;
+}
+
+.todos-empty-hero {
+  width: 200px;
+  margin-left: auto;
+  margin-right: auto;
+
+  @media (min-width: $screen-sm-min) {
+    width: 300px;
+    margin-right: 0;
+    -webkit-order: 2;
+    order: 2;
+  }
+}
+
+.todos-all-done {
+  padding-top: 20px;
+
+  @media (min-width: $screen-sm-min) {
+    padding-top: 50px;
+  }
+
+  > svg {
+    display: block;
+    max-width: 300px;
+    margin: 0 auto 20px;
+  }
+
+  p {
+    max-width: 470px;
+    margin-left: auto;
+    margin-right: auto;
+  }
+
+  a {
+    font-weight: 600;
+  }
+}

app/controllers/admin/users_controller.rb

@@ -3,7 +3,7 @@ class Admin::UsersController < Admin::ApplicationController
 
   def index
     @users = User.order_name_asc.filter(params[:filter])
-    @users = @users.search(params[:name]) if params[:name].present?
+    @users = @users.search_with_secondary_emails(params[:search_query]) if params[:search_query].present?
     @users = @users.sort(@sort = params[:sort])
     @users = @users.page(params[:page])
   end

app/controllers/projects/issues_controller.rb

@@ -118,7 +118,7 @@ class Projects::IssuesController < Projects::ApplicationController
       end
 
       format.json do
-        render json: @issue.to_json(include: { milestone: {}, assignee: { methods: :avatar_url }, labels: { methods: :text_color } })
+        render json: @issue.to_json(include: { milestone: {}, assignee: { methods: :avatar_url }, labels: { methods: :text_color } }, methods: [:task_status, :task_status_short])
       end
     end
 

app/controllers/projects/labels_controller.rb

@@ -126,7 +126,7 @@ class Projects::LabelsController < Projects::ApplicationController
   alias_method :subscribable_resource, :label
 
   def find_labels
-    @available_labels ||= LabelsFinder.new(current_user, project_id: @project.id).execute.includes(:priorities)
+    @available_labels ||= LabelsFinder.new(current_user, project_id: @project.id).execute
   end
 
   def authorize_admin_labels!

app/controllers/projects/merge_requests_controller.rb

@@ -288,7 +288,7 @@ class Projects::MergeRequestsController < Projects::ApplicationController
                        @merge_request.target_project, @merge_request])
         end
         format.json do
-          render json: @merge_request.to_json(include: { milestone: {}, assignee: { methods: :avatar_url }, labels: { methods: :text_color } })
+          render json: @merge_request.to_json(include: { milestone: {}, assignee: { methods: :avatar_url }, labels: { methods: :text_color } }, methods: [:task_status, :task_status_short])
         end
       end
     else

app/controllers/projects/project_members_controller.rb

@@ -25,24 +25,21 @@ class Projects::ProjectMembersController < Projects::ApplicationController
   end
 
   def create
-    if params[:user_ids].blank?
-      return redirect_to(namespace_project_project_members_path(@project.namespace, @project), alert: 'No users or groups specified.')
-    end
+    status = Members::CreateService.new(@project, current_user, params).execute
 
-    @project.team.add_users(
-      params[:user_ids].split(','),
-      params[:access_level],
-      expires_at: params[:expires_at],
-      current_user: current_user
-    )
+    redirect_url = namespace_project_project_members_path(@project.namespace, @project)
 
-    members = @project.project_members.where(user_id: params[:user_ids].split(','))
+    if status
+      members = @project.project_members.where(user_id: params[:user_ids].split(','))
 
-    members.each do |member|
-      log_audit_event(member, action: :create)
-    end
+      members.each do |member|
+        log_audit_event(member, action: :create)
+      end
 
-    redirect_to namespace_project_project_members_path(@project.namespace, @project), notice: 'Users were successfully added.'
+      redirect_to redirect_url, notice: 'Users were successfully added.'
+    else
+      redirect_to redirect_url, alert: 'No users or groups specified.'
+    end
   end
 
   def update

app/controllers/projects/tags_controller.rb

@@ -23,7 +23,7 @@ class Projects::TagsController < Projects::ApplicationController
     return render_404 unless @tag
 
     @release = @project.releases.find_or_initialize_by(tag: @tag.name)
-    @commit = @repository.commit(@tag.target)
+    @commit = @repository.commit(@tag.dereferenced_target)
   end
 
   def create

app/controllers/projects_controller.rb

@@ -290,7 +290,8 @@ class ProjectsController < Projects::ApplicationController
       render 'projects/empty' if @project.empty_repo?
     else
       if @project.wiki_enabled?
-        @wiki_home = @project.wiki.find_page('home', params[:version_id])
+        @project_wiki = @project.wiki
+        @wiki_home = @project_wiki.find_page('home', params[:version_id])
       elsif @project.feature_available?(:issues, current_user)
         @issues = issues_collection
         @issues = @issues.page(params[:page])

app/finders/issuable_finder.rb

@@ -127,7 +127,7 @@ class IssuableFinder
 
     @labels =
       if labels? && !filter_by_no_label?
-        LabelsFinder.new(current_user, project_ids: projects, title: label_names).execute
+        LabelsFinder.new(current_user, project_ids: projects, title: label_names).execute(skip_authorization: true)
       else
         Label.none
       end
@@ -274,7 +274,7 @@ class IssuableFinder
         items = items.with_label(label_names, params[:sort])
 
         if projects
-          label_ids = LabelsFinder.new(current_user, project_ids: projects).execute.select(:id)
+          label_ids = LabelsFinder.new(current_user, project_ids: projects).execute(skip_authorization: true).select(:id)
           items = items.where(labels: { id: label_ids })
         end
       end

app/finders/labels_finder.rb

@@ -4,9 +4,8 @@ class LabelsFinder < UnionFinder
     @params = params
   end
 
-  def execute(authorized_only: true)
-    @authorized_only = authorized_only
-
+  def execute(skip_authorization: false)
+    @skip_authorization = skip_authorization
     items = find_union(label_ids, Label)
     items = with_title(items)
     sort(items)
@@ -14,7 +13,7 @@ class LabelsFinder < UnionFinder
 
   private
 
-  attr_reader :current_user, :params, :authorized_only
+  attr_reader :current_user, :params, :skip_authorization
 
   def label_ids
     label_ids = []
@@ -70,17 +69,17 @@ class LabelsFinder < UnionFinder
   end
 
   def find_project
-    if authorized_only
-      available_projects.find_by(id: project_id)
-    else
+    if skip_authorization
       Project.find_by(id: project_id)
+    else
+      available_projects.find_by(id: project_id)
     end
   end
 
   def projects
     return @projects if defined?(@projects)
 
-    @projects = authorized_only ? available_projects : Project.all
+    @projects = skip_authorization ? Project.all : available_projects
     @projects = @projects.in_namespace(group_id) if group_id
     @projects = @projects.where(id: projects_ids) if projects_ids
     @projects = @projects.reorder(nil)

app/helpers/button_helper.rb

@@ -16,13 +16,14 @@ module ButtonHelper
   # See http://clipboardjs.com/#usage
   def clipboard_button(data = {})
     css_class = data[:class] || 'btn-clipboard btn-transparent'
+    title = data[:title] || 'Copy to Clipboard'
     data = { toggle: 'tooltip', placement: 'bottom', container: 'body' }.merge(data)
     content_tag :button,
       icon('clipboard'),
       class: "btn #{css_class}",
       data: data,
       type: :button,
-      title: 'Copy to Clipboard'
+      title: title
   end
 
   def http_clone_button(project, placement = 'right', append_link: true)

app/helpers/events_helper.rb

@@ -39,6 +39,12 @@ module EventsHelper
     end
   end
 
+  def event_filter_visible(feature_key)
+    return true unless @project
+
+    @project.feature_available?(feature_key, current_user)
+  end
+
   def event_preposition(event)
     if event.push? || event.commented? || event.target
       "at"

app/helpers/issuables_helper.rb

@@ -71,6 +71,14 @@ module IssuablesHelper
       author_output = link_to_member(project, issuable.author, size: 24, mobile_classes: "hidden-xs", tooltip: true)
       author_output << link_to_member(project, issuable.author, size: 24, by_username: true, avatar: false, mobile_classes: "hidden-sm hidden-md hidden-lg")
     end
+
+    if issuable.tasks?
+      output << "&ensp;".html_safe
+      output << content_tag(:span, issuable.task_status, id: "task_status", class: "hidden-xs")
+      output << content_tag(:span, issuable.task_status_short, id: "task_status_short", class: "hidden-sm hidden-md hidden-lg")
+    end
+
+    output
   end
 
   def issuable_todo(issuable)

app/helpers/projects_helper.rb

@@ -174,10 +174,14 @@ module ProjectsHelper
       nav_tabs << :merge_requests
     end
 
-    if can?(current_user, :read_build, project)
+    if can?(current_user, :read_pipeline, project)
       nav_tabs << :pipelines
     end
 
+    if can?(current_user, :read_build, project)
+      nav_tabs << :builds
+    end
+
     if Gitlab.config.registry.enabled && can?(current_user, :read_container_image, project)
       nav_tabs << :container_registry
     end

app/models/ci/pipeline.rb

@@ -30,23 +30,23 @@ module Ci
       end
 
       event :run do
-        transition any => :running
+        transition any - [:running] => :running
       end
 
       event :skip do
-        transition any => :skipped
+        transition any - [:skipped] => :skipped
       end
 
       event :drop do
-        transition any => :failed
+        transition any - [:failed] => :failed
       end
 
       event :succeed do
-        transition any => :success
+        transition any - [:success] => :success
       end
 
       event :cancel do
-        transition any => :canceled
+        transition any - [:canceled] => :canceled
       end
 
       # IMPORTANT
@@ -260,7 +260,7 @@ module Ci
     end
 
     def update_status
-      with_lock do
+      Gitlab::OptimisticLocking.retry_lock(self) do
         case latest_builds_status
         when 'pending' then enqueue
         when 'running' then run

app/models/commit_status.rb

@@ -73,16 +73,16 @@ class CommitStatus < ActiveRecord::Base
       transition [:created, :pending, :running] => :canceled
     end
 
-    after_transition created: [:pending, :running] do |commit_status|
-      commit_status.update_attributes queued_at: Time.now
+    before_transition created: [:pending, :running] do |commit_status|
+      commit_status.queued_at = Time.now
     end
 
-    after_transition [:created, :pending] => :running do |commit_status|
-      commit_status.update_attributes started_at: Time.now
+    before_transition [:created, :pending] => :running do |commit_status|
+      commit_status.started_at = Time.now
     end
 
-    after_transition any => [:success, :failed, :canceled] do |commit_status|
-      commit_status.update_attributes finished_at: Time.now
+    before_transition any => [:success, :failed, :canceled] do |commit_status|
+      commit_status.finished_at = Time.now
     end
 
     after_transition do |commit_status, transition|

app/models/concerns/issuable.rb

@@ -12,6 +12,7 @@ module Issuable
   include Subscribable
   include StripAttribute
   include Awardable
+  include Taskable
 
   included do
     cache_markdown_field :title, pipeline: :single_line

app/models/concerns/project_features_compatibility.rb

@@ -31,7 +31,7 @@ module ProjectFeaturesCompatibility
   def write_feature_attribute(field, value)
     build_project_feature unless project_feature
 
-    access_level = value == "true" ? ProjectFeature::ENABLED : ProjectFeature::DISABLED
+    access_level = Gitlab::Utils.to_boolean(value) ? ProjectFeature::ENABLED : ProjectFeature::DISABLED
     project_feature.update_attribute(field, access_level)
   end
 end

app/models/concerns/taskable.rb

@@ -53,10 +53,22 @@ module Taskable
 
   # Return a string that describes the current state of this Taskable's task
   # list items, e.g. "12 of 20 tasks completed"
-  def task_status
+  def task_status(short: false)
     return '' if description.blank?
 
+    prep, completed = if short
+                        ['/', '']
+                      else
+                        [' of ', ' completed']
+                      end
+
     sum = tasks.summary
-    "#{sum.complete_count} of #{sum.item_count} #{'task'.pluralize(sum.item_count)} completed"
+    "#{sum.complete_count}#{prep}#{sum.item_count} #{'task'.pluralize(sum.item_count)}#{completed}"
+  end
+
+  # Return a short string that describes the current state of this Taskable's
+  # task list items -- for small screens
+  def task_status_short
+    task_status(short: true)
   end
 end

app/models/event.rb

 class Event < ActiveRecord::Base
   include Sortable
-  default_scope { where.not(author_id: nil) }
+  default_scope { reorder(nil).where.not(author_id: nil) }
 
   CREATED   = 1
   UPDATED   = 2

app/models/group_label.rb

@@ -5,6 +5,10 @@ class GroupLabel < Label
 
   alias_attribute :subject, :group
 
+  def subject_foreign_key
+    'group_id'
+  end
+
   def to_reference(source_project = nil, target_project = nil, format: :id)
     super(source_project, target_project, format: format)
   end

app/models/issue.rb

@@ -5,7 +5,6 @@ class Issue < ActiveRecord::Base
   include Issuable
   include Referable
   include Sortable
-  include Taskable
   include Spammable
   include Elastic::IssuesSearch
   include FasterCacheKeys

app/models/label.rb

@@ -92,16 +92,23 @@ class Label < ActiveRecord::Base
     nil
   end
 
-  def open_issues_count(user = nil, project = nil)
-    issues_count(user, project_id: project.try(:id) || project_id, state: 'opened')
+  def open_issues_count(user = nil)
+    issues_count(user, state: 'opened')
   end
 
-  def closed_issues_count(user = nil, project = nil)
-    issues_count(user, project_id: project.try(:id) || project_id, state: 'closed')
+  def closed_issues_count(user = nil)
+    issues_count(user, state: 'closed')
   end
 
-  def open_merge_requests_count(user = nil, project = nil)
-    merge_requests_count(user, project_id: project.try(:id) || project_id, state: 'opened')
+  def open_merge_requests_count(user = nil)
+    params = {
+      subject_foreign_key => subject.id,
+      label_name: title,
+      scope: 'all',
+      state: 'opened'
+    }
+
+    MergeRequestsFinder.new(user, params.with_indifferent_access).execute.count
   end
 
   def prioritize!(project, value)
@@ -167,15 +174,8 @@ class Label < ActiveRecord::Base
   end
 
   def issues_count(user, params = {})
-    IssuesFinder.new(user, params.reverse_merge(label_name: title, scope: 'all'))
-                .execute
-                .count
-  end
-
-  def merge_requests_count(user, params = {})
-    MergeRequestsFinder.new(user, params.reverse_merge(label_name: title, scope: 'all'))
-                       .execute
-                       .count
+    params.merge!(subject_foreign_key => subject.id, label_name: title, scope: 'all')
+    IssuesFinder.new(user, params.with_indifferent_access).execute.count
   end
 
   def label_format_reference(format = :id)

app/models/lfs_object.rb

@@ -17,4 +17,10 @@ class LfsObject < ActiveRecord::Base
   def project_allowed_access?(project)
     projects.exists?(storage_project(project).id)
   end
+
+  def self.destroy_unreferenced
+    joins("LEFT JOIN lfs_objects_projects ON lfs_objects_projects.lfs_object_id = #{table_name}.id")
+        .where(lfs_objects_projects: { id: nil })
+        .destroy_all
+  end
 end

app/models/merge_request.rb

@@ -3,7 +3,6 @@ class MergeRequest < ActiveRecord::Base
   include Issuable
   include Referable
   include Sortable
-  include Taskable
   include Elastic::MergeRequestsSearch
   include Importable
   include Approvable
@@ -465,11 +464,11 @@ class MergeRequest < ActiveRecord::Base
   end
 
   def should_remove_source_branch?
-    merge_params['should_remove_source_branch'].present?
+    Gitlab::Utils.to_boolean(merge_params['should_remove_source_branch'])
   end
 
   def force_remove_source_branch?
-    merge_params['force_remove_source_branch'].present?
+    Gitlab::Utils.to_boolean(merge_params['force_remove_source_branch'])
   end
 
   def remove_source_branch?

app/models/project.rb

@@ -28,6 +28,11 @@ class Project < ActiveRecord::Base
   default_value_for :container_registry_enabled, gitlab_config_features.container_registry
   default_value_for(:repository_storage) { current_application_settings.repository_storage }
   default_value_for(:shared_runners_enabled) { current_application_settings.shared_runners_enabled }
+  default_value_for :issues_enabled, gitlab_config_features.issues
+  default_value_for :merge_requests_enabled, gitlab_config_features.merge_requests
+  default_value_for :builds_enabled, gitlab_config_features.builds
+  default_value_for :wiki_enabled, gitlab_config_features.wiki
+  default_value_for :snippets_enabled, gitlab_config_features.snippets
 
   after_create :ensure_dir_exist
   after_create :create_project_feature, unless: :project_feature
@@ -423,7 +428,7 @@ class Project < ActiveRecord::Base
     end
 
     def group_ids
-      joins(:namespace).where(namespaces: { type: 'Group' }).pluck(:namespace_id)
+      joins(:namespace).where(namespaces: { type: 'Group' }).select(:namespace_id)
     end
   end
 
@@ -833,7 +838,7 @@ class Project < ActiveRecord::Base
   def create_labels
     Label.templates.each do |label|
       params = label.attributes.except('id', 'template', 'created_at', 'updated_at')
-      Labels::FindOrCreateService.new(owner, self, params).execute
+      Labels::FindOrCreateService.new(nil, self, params).execute(skip_authorization: true)
     end
   end
 

app/models/project_label.rb

@@ -12,6 +12,10 @@ class ProjectLabel < Label
 
   alias_attribute :subject, :project
 
+  def subject_foreign_key
+    'project_id'
+  end
+
   def to_reference(target_project = nil, format: :id)
     super(project, target_project, format: format)
   end

app/models/project_services/jira_service.rb

@@ -237,7 +237,7 @@ class JiraService < IssueTrackerService
   end
 
   def resource_url(resource)
-    "#{Settings.gitlab['url'].chomp("/")}#{resource}"
+    "#{Settings.gitlab.base_url.chomp("/")}#{resource}"
   end
 
   def build_entity_url(entity_name, entity_id)

app/models/project_team.rb

@@ -127,14 +127,8 @@ class ProjectTeam
     max_member_access(user.id) == Gitlab::Access::MASTER
   end
 
-  def member?(user, min_member_access = nil)
-    member = !!find_member(user.id)
-
-    if min_member_access
-      member && max_member_access(user.id) >= min_member_access
-    else
-      member
-    end
+  def member?(user, min_member_access = Gitlab::Access::GUEST)
+    max_member_access(user.id) >= min_member_access
   end
 
   def human_max_access(user_id)

app/models/repository.rb

@@ -18,6 +18,20 @@ class Repository
 
   attr_accessor :path_with_namespace, :project
 
+  def self.storages
+    Gitlab.config.repositories.storages
+  end
+
+  def self.remove_storage_from_path(repo_path)
+    storages.find do |_, storage_path|
+      if repo_path.start_with?(storage_path)
+        return repo_path.sub(storage_path, '')
+      end
+    end
+
+    repo_path
+  end
+
   def initialize(path_with_namespace, project)
     @path_with_namespace = path_with_namespace
     @project = project
@@ -196,7 +210,7 @@ class Repository
     before_remove_branch
 
     branch = find_branch(branch_name)
-    oldrev = branch.try(:target).try(:id)
+    oldrev = branch.try(:dereferenced_target).try(:id)
     newrev = Gitlab::Git::BLANK_SHA
     ref    = Gitlab::Git::BRANCH_REF_PREFIX + branch_name
 
@@ -253,9 +267,7 @@ class Repository
 
   def remote_tags(remote)
     gitlab_shell.list_remote_tags(storage_path, path_with_namespace, remote).map do |name, target|
-      # Is the tag annotated or lightweight?
-      object = target.is_a?(Rugged::Tag::Annotation) ? target : nil
-      Gitlab::Git::Tag.new(raw_repository, object, name, target)
+      Gitlab::Git::Tag.new(raw_repository, name, target)
     end
   end
 
@@ -356,10 +368,10 @@ class Repository
       # Rugged seems to throw a `ReferenceError` when given branch_names rather
       # than SHA-1 hashes
       number_commits_behind = raw_repository.
-        count_commits_between(branch.target.sha, root_ref_hash)
+        count_commits_between(branch.dereferenced_target.sha, root_ref_hash)
 
       number_commits_ahead = raw_repository.
-        count_commits_between(root_ref_hash, branch.target.sha)
+        count_commits_between(root_ref_hash, branch.dereferenced_target.sha)
 
       { behind: number_commits_behind, ahead: number_commits_ahead }
     end
@@ -750,11 +762,11 @@ class Repository
       branches.sort_by(&:name)
     when 'updated_desc'
       branches.sort do |a, b|
-        commit(b.target).committed_date <=> commit(a.target).committed_date
+        commit(b.dereferenced_target).committed_date <=> commit(a.dereferenced_target).committed_date
       end
     when 'updated_asc'
       branches.sort do |a, b|
-        commit(a.target).committed_date <=> commit(b.target).committed_date
+        commit(a.dereferenced_target).committed_date <=> commit(b.dereferenced_target).committed_date
       end
     else
       branches
@@ -945,7 +957,7 @@ class Repository
       branch = find_branch(ref)
 
       if branch
-        last_commit = branch.target
+        last_commit = branch.dereferenced_target
         index.read_tree(last_commit.raw_commit.tree)
         parents = [last_commit.sha]
       end
@@ -1050,7 +1062,7 @@ class Repository
   end
 
   def revert(user, commit, base_branch, revert_tree_id = nil)
-    source_sha = find_branch(base_branch).target.sha
+    source_sha = find_branch(base_branch).dereferenced_target.sha
     revert_tree_id ||= check_revert_content(commit, base_branch)
 
     return false unless revert_tree_id
@@ -1067,7 +1079,7 @@ class Repository
   end
 
   def cherry_pick(user, commit, base_branch, cherry_pick_tree_id = nil)
-    source_sha = find_branch(base_branch).target.sha
+    source_sha = find_branch(base_branch).dereferenced_target.sha
     cherry_pick_tree_id ||= check_cherry_pick_content(commit, base_branch)
 
     return false unless cherry_pick_tree_id
@@ -1096,7 +1108,7 @@ class Repository
   end
 
   def check_revert_content(commit, base_branch)
-    source_sha = find_branch(base_branch).target.sha
+    source_sha = find_branch(base_branch).dereferenced_target.sha
     args       = [commit.id, source_sha]
     args << { mainline: 1 } if commit.merge_commit?
 
@@ -1110,7 +1122,7 @@ class Repository
   end
 
   def check_cherry_pick_content(commit, base_branch)
-    source_sha = find_branch(base_branch).target.sha
+    source_sha = find_branch(base_branch).dereferenced_target.sha
     args       = [commit.id, source_sha]
     args << 1 if commit.merge_commit?
 
@@ -1231,7 +1243,7 @@ class Repository
     if rugged.lookup(newrev).parent_ids.empty? || target_branch.nil?
       oldrev = Gitlab::Git::BLANK_SHA
     else
-      oldrev = rugged.merge_base(newrev, target_branch.target.sha)
+      oldrev = rugged.merge_base(newrev, target_branch.dereferenced_target.sha)
     end
 
     GitHooksService.new.execute(current_user, path_to_repo, oldrev, newrev, ref) do
@@ -1297,7 +1309,7 @@ class Repository
   end
 
   def tags_sorted_by_committed_date
-    tags.sort_by { |tag| tag.target.committed_date }
+    tags.sort_by { |tag| tag.dereferenced_target.committed_date }
   end
 
   def keep_around_ref_name(sha)

app/models/user.rb

@@ -276,6 +276,24 @@ class User < ActiveRecord::Base
       )
     end
 
+    # searches user by given pattern
+    # it compares name, email, username fields and user's secondary emails with given pattern
+    # This method uses ILIKE on PostgreSQL and LIKE on MySQL.
+
+    def search_with_secondary_emails(query)
+      table = arel_table
+      email_table = Email.arel_table
+      pattern = "%#{query}%"
+      matched_by_emails_user_ids = email_table.project(email_table[:user_id]).where(email_table[:email].matches(pattern))
+
+      where(
+        table[:name].matches(pattern).
+          or(table[:email].matches(pattern)).
+          or(table[:username].matches(pattern)).
+          or(table[:id].in(matched_by_emails_user_ids))
+      )
+    end
+
     def by_login(login)
       return nil unless login
 

app/policies/project_policy.rb

@@ -2,11 +2,11 @@ class ProjectPolicy < BasePolicy
   def rules
     team_access!(user)
 
-    owner = user.admin? ||
-            project.owner == user ||
+    owner = project.owner == user ||
             (project.group && project.group.has_owner?(user))
 
-    owner_access! if owner
+    owner_access! if user.admin? || owner
+    team_member_owner_access! if owner
 
     if project.public? || (project.internal? && !user.external?)
       guest_access!
@@ -16,7 +16,7 @@ class ProjectPolicy < BasePolicy
       can! :read_build if project.public_builds?
 
       if project.request_access_enabled &&
-         !(owner || project.team.member?(user) || project_group_member?(user))
+         !(owner || user.admin? || project.team.member?(user) || project_group_member?(user))
         can! :request_access
       end
     end
@@ -149,6 +149,10 @@ class ProjectPolicy < BasePolicy
     can! :remove_pages
   end
 
+  def team_member_owner_access!
+    team_member_reporter_access!
+  end
+
   # Push abilities on the users team role
   def team_access!(user)
     access = project.team.max_member_access(user.id)

app/services/ci/process_pipeline_service.rb

@@ -10,17 +10,14 @@ module Ci
         create_builds!
       end
 
-      @pipeline.with_lock do
-        new_builds =
-          stage_indexes_of_created_builds.map do |index|
-            process_stage(index)
-          end
+      new_builds =
+        stage_indexes_of_created_builds.map do |index|
+          process_stage(index)
+        end
 
-        @pipeline.update_status
+      @pipeline.update_status
 
-        # Return a flag if a when builds got enqueued
-        new_builds.flatten.any?
-      end
+      new_builds.flatten.any?
     end
 
     private
@@ -32,9 +29,11 @@ module Ci
     def process_stage(index)
       current_status = status_for_prior_stages(index)
 
-      created_builds_in_stage(index).select do |build|
-        if HasStatus::COMPLETED_STATUSES.include?(current_status)
-          process_build(build, current_status)
+      if HasStatus::COMPLETED_STATUSES.include?(current_status)
+        created_builds_in_stage(index).select do |build|
+          Gitlab::OptimisticLocking.retry_lock(build) do |subject|
+            process_build(subject, current_status)
+          end
         end
       end
     end

app/services/ci/register_build_service.rb

@@ -28,17 +28,14 @@ module Ci
 
       if build
         # In case when 2 runners try to assign the same build, second runner will be declined
-        # with StateMachines::InvalidTransition in run! method.
-        build.with_lock do
-          build.runner_id = current_runner.id
-          build.save!
-          build.run!
-        end
+        # with StateMachines::InvalidTransition or StaleObjectError when doing run! or save method.
+        build.runner_id = current_runner.id
+        build.run!
       end
 
       build
 
-    rescue StateMachines::InvalidTransition
+    rescue StateMachines::InvalidTransition, ActiveRecord::StaleObjectError
       nil
     end
 

app/services/delete_branch_service.rb

@@ -42,7 +42,7 @@ class DeleteBranchService < BaseService
     Gitlab::DataBuilder::Push.build(
       project,
       current_user,
-      branch.target.sha,
+      branch.dereferenced_target.sha,
       Gitlab::Git::BLANK_SHA,
       "#{Gitlab::Git::BRANCH_REF_PREFIX}#{branch.name}",
       [])

app/services/delete_tag_service.rb

@@ -36,7 +36,7 @@ class DeleteTagService < BaseService
     Gitlab::DataBuilder::Push.build(
       project,
       current_user,
-      tag.target.sha,
+      tag.dereferenced_target.sha,
       Gitlab::Git::BLANK_SHA,
       "#{Gitlab::Git::TAG_REF_PREFIX}#{tag.name}",
       [])

app/services/git_tag_push_service.rb

@@ -27,8 +27,8 @@ class GitTagPushService < BaseService
       tag_name = Gitlab::Git.ref_name(params[:ref])
       tag = project.repository.find_tag(tag_name)
 
-      if tag && tag.object_sha == params[:newrev]
-        commit = project.commit(tag.target)
+      if tag && tag.target == params[:newrev]
+        commit = project.commit(tag.dereferenced_target)
         commits = [commit].compact
         message = tag.message
       end

app/services/labels/find_or_create_service.rb

@@ -2,21 +2,24 @@ module Labels
   class FindOrCreateService
     def initialize(current_user, project, params = {})
       @current_user = current_user
-      @group = project.group
       @project = project
       @params = params.dup
     end
 
-    def execute
+    def execute(skip_authorization: false)
+      @skip_authorization = skip_authorization
       find_or_create_label
     end
 
     private
 
-    attr_reader :current_user, :group, :project, :params
+    attr_reader :current_user, :project, :params, :skip_authorization
 
     def available_labels
-      @available_labels ||= LabelsFinder.new(current_user, project_id: project.id).execute
+      @available_labels ||= LabelsFinder.new(
+        current_user,
+        project_id: project.id
+      ).execute(skip_authorization: skip_authorization)
     end
 
     def find_or_create_label

app/services/members/create_service.rb

+module Members
+  class CreateService < BaseService
+    def execute
+      return false if params[:user_ids].blank?
+
+      project.team.add_users(
+        params[:user_ids].split(','),
+        params[:access_level],
+        expires_at: params[:expires_at],
+        current_user: current_user
+      )
+
+      true
+    end
+  end
+end

app/services/merge_requests/build_service.rb

@@ -13,20 +13,8 @@ module MergeRequests
       merge_request.target_project ||= (project.forked_from_project || project)
       merge_request.target_branch ||= merge_request.target_project.default_branch
 
-      if merge_request.target_branch.blank? || merge_request.source_branch.blank?
-        message =
-          if params[:source_branch] || params[:target_branch]
-            "You must select source and target branch"
-          end
-
-        return build_failed(merge_request, message)
-      end
-
-      if merge_request.source_project == merge_request.target_project &&
-         merge_request.target_branch == merge_request.source_branch
-
-        return build_failed(merge_request, 'You must select different branches')
-      end
+      messages = validate_branches(merge_request)
+      return build_failed(merge_request, messages) unless messages.empty?
 
       compare = CompareService.new.execute(
         merge_request.source_project,
@@ -43,6 +31,34 @@ module MergeRequests
 
     private
 
+    def validate_branches(merge_request)
+      messages = []
+
+      if merge_request.target_branch.blank? || merge_request.source_branch.blank?
+        messages <<
+          if params[:source_branch] || params[:target_branch]
+            "You must select source and target branch"
+          end
+      end
+
+      if merge_request.source_project == merge_request.target_project &&
+         merge_request.target_branch == merge_request.source_branch
+
+        messages << 'You must select different branches'
+      end
+
+      # See if source and target branches exist
+      unless merge_request.source_project.commit(merge_request.source_branch)
+        messages << "Source branch \"#{merge_request.source_branch}\" does not exist"
+      end
+
+      unless merge_request.target_project.commit(merge_request.target_branch)
+        messages << "Target branch \"#{merge_request.target_branch}\" does not exist"
+      end
+
+      messages
+    end
+
     # When your branch name starts with an iid followed by a dash this pattern will be
     # interpreted as the user wants to close that issue on this project.
     #
@@ -96,8 +112,10 @@ module MergeRequests
       merge_request
     end
 
-    def build_failed(merge_request, message)
-      merge_request.errors.add(:base, message) unless message.nil?
+    def build_failed(merge_request, messages)
+      messages.compact.each do |message|
+        merge_request.errors.add(:base, message)
+      end
       merge_request.compare_commits = []
       merge_request.can_be_created = false
       merge_request

app/services/projects/update_mirror_service.rb

@@ -36,11 +36,11 @@ module Projects
         local_branch = local_branches[name]
 
         if local_branch.nil?
-          result = CreateBranchService.new(project, current_user).execute(name, upstream_branch.target.sha)
+          result = CreateBranchService.new(project, current_user).execute(name, upstream_branch.dereferenced_target.sha)
           if result[:status] == :error
             errors << result[:message]
           end
-        elsif local_branch.target == upstream_branch.target
+        elsif local_branch.dereferenced_target == upstream_branch.dereferenced_target
           # Already up to date
         elsif repository.diverged_from_upstream?(name)
           # Cannot be updated
@@ -49,7 +49,7 @@ module Projects
           end
         else
           begin
-            repository.ff_merge(current_user, upstream_branch.target, name)
+            repository.ff_merge(current_user, upstream_branch.dereferenced_target, name)
           rescue GitHooksService::PreReceiveError, Repository::CommitError => e
             errors << e.message
           end
@@ -73,8 +73,8 @@ module Projects
 
       tags.each do |tag|
         old_tag = old_tags[tag.name]
-        tag_target = tag.target.sha
-        old_tag_target = old_tag ? old_tag.target.sha : Gitlab::Git::BLANK_SHA
+        tag_target = tag.dereferenced_target.sha
+        old_tag_target = old_tag ? old_tag.dereferenced_target.sha : Gitlab::Git::BLANK_SHA
 
         next if old_tag_target == tag_target
 
@@ -96,7 +96,7 @@ module Projects
     # In Git is possible to tag blob objects, and those blob objects don't point to a Git commit so those tags
     # have no target.
     def repository_tags_with_target
-      repository.tags.select(&:target)
+      repository.tags.select(&:dereferenced_target)
     end
   end
 end

app/services/projects/update_remote_mirror_service.rb

@@ -60,7 +60,7 @@ module Projects
       @deleted_branches ||= remote_branches.each_with_object([]) do |(name, branch), branches|
         local_branch = local_branches[name]
 
-        if local_branch.nil? && project.commit(branch.target)
+        if local_branch.nil? && project.commit(branch.dereferenced_target)
           branches << name
         end
       end
@@ -72,7 +72,7 @@ module Projects
 
         if remote_branch.nil?
           branches << name
-        elsif branch.target == remote_branch.target
+        elsif branch.dereferenced_target == remote_branch.dereferenced_target
           # Already up to date
         elsif !repository.upstream_has_diverged?(name, mirror.ref_name)
           branches << name
@@ -112,7 +112,7 @@ module Projects
       @changed_tags ||= local_tags.each_with_object([]) do |(name, tag), tags|
         remote_tag = remote_tags[name]
 
-        if remote_tag.nil? || (tag.target != remote_tag.target)
+        if remote_tag.nil? || (tag.dereferenced_target != remote_tag.dereferenced_target)
           tags << name
         end
       end

app/views/admin/appearances/preview.html.haml

 = render 'devise/shared/tab_single', tab_title: 'Sign in preview'
 .login-box
-  %form.show-gl-field-errors
+  %form.gl-show-field-errors
     .form-group
       = label_tag :login
       = text_field_tag :login, nil, class: "form-control top", title: 'Please provide your username or email address.'

app/views/admin/groups/_group.html.haml

@@ -16,7 +16,8 @@
     %span.visibility-icon.has-tooltip{data: { container: 'body', placement: 'left' }, title: visibility_icon_description(group)}
       = visibility_level_icon(group.visibility_level, fw: false)
 
-  = image_tag group_icon(group), class: "avatar s40 hidden-xs"
+  .image-container.s40
+    = image_tag group_icon(group), class: "avatar s40 hidden-xs"
   .title
     = link_to [:admin, group], class: 'group-name' do
       = group.name

app/views/admin/groups/show.html.haml

@@ -13,7 +13,8 @@
         Group info:
       %ul.well-list
         %li
-          = image_tag group_icon(@group), class: "avatar s60"
+          .image-container.s60
+            = image_tag group_icon(@group), class: "avatar s60"
         %li
           %span.light Name:
           %strong= @group.name

app/views/admin/projects/index.html.haml

@@ -76,7 +76,8 @@
             .title
               = link_to [:admin, project.namespace.becomes(Namespace), project] do
                 .dash-project-avatar
-                  = project_icon(project, alt: '', class: 'avatar project-avatar s40')
+                  .image-container.s40
+                    = project_icon(project, alt: '', class: 'avatar project-avatar s40')
                 %span.project-full-name
                   %span.namespace-name
                     - if project.namespace

app/views/admin/users/index.html.haml

@@ -10,7 +10,7 @@
           = hidden_field_tag "filter", h(params[:filter])
         .search-holder
           .search-field-holder
-            = search_field_tag :name, params[:name], placeholder: 'Search by name, email or username', class: 'form-control search-text-input js-search-input', spellcheck: false
+            = search_field_tag :search_query, params[:search_query], placeholder: 'Search by name, email or username', class: 'form-control search-text-input js-search-input', spellcheck: false
             = icon("search", class: "search-icon")
           .dropdown
             - toggle_text = if @sort.present? then sort_options_hash[@sort] else sort_title_name end

app/views/dashboard/todos/index.html.haml

 - page_title "Todos"
 - header_title "Todos", dashboard_todos_path
 
-.top-area
-  %ul.nav-links
-    - todo_pending_active = ('active' if params[:state].blank? || params[:state] == 'pending')
-    %li{class: "todos-pending #{todo_pending_active}"}
-      = link_to todos_filter_path(state: 'pending') do
-        %span
-          To do
-        %span.badge
-          = number_with_delimiter(todos_pending_count)
-    - todo_done_active = ('active' if params[:state] == 'done')
-    %li{class: "todos-done #{todo_done_active}"}
-      = link_to todos_filter_path(state: 'done') do
-        %span
-          Done
-        %span.badge
-          = number_with_delimiter(todos_done_count)
+- if current_user.todos.any?
+  .top-area
+    %ul.nav-links
+      - todo_pending_active = ('active' if params[:state].blank? || params[:state] == 'pending')
+      %li{class: "todos-pending #{todo_pending_active}"}
+        = link_to todos_filter_path(state: 'pending') do
+          %span
+            To do
+          %span.badge
+            = number_with_delimiter(todos_pending_count)
+      - todo_done_active = ('active' if params[:state] == 'done')
+      %li{class: "todos-done #{todo_done_active}"}
+        = link_to todos_filter_path(state: 'done') do
+          %span
+            Done
+          %span.badge
+            = number_with_delimiter(todos_done_count)
 
-  .nav-controls
-    - if @todos.any?(&:pending?)
-      = link_to destroy_all_dashboard_todos_path(todos_filter_params), class: 'btn btn-loading js-todos-mark-all', method: :delete do
-        Mark all as done
-        = icon('spinner spin')
+    .nav-controls
+      - if @todos.any?(&:pending?)
+        = link_to destroy_all_dashboard_todos_path(todos_filter_params), class: 'btn btn-loading js-todos-mark-all', method: :delete do
+          Mark all as done
+          = icon('spinner spin')
 
-.todos-filters
-  .row-content-block.second-block
-    = form_tag todos_filter_path(without: [:project_id, :author_id, :type, :action_id]), method: :get, class: 'filter-form' do
-      .filter-item.inline
-        - if params[:project_id].present?
-          = hidden_field_tag(:project_id, params[:project_id])
-        = dropdown_tag(project_dropdown_label(params[:project_id], 'Project'), options: { toggle_class: 'js-project-search js-filter-submit', title: 'Filter by project', filter: true, filterInput: 'input#project-search', dropdown_class: 'dropdown-menu-selectable dropdown-menu-project js-filter-submit',
-          placeholder: 'Search projects', data: { data: todo_projects_options } })
-      .filter-item.inline
-        - if params[:author_id].present?
-          = hidden_field_tag(:author_id, params[:author_id])
-        = dropdown_tag(user_dropdown_label(params[:author_id], 'Author'), options: { toggle_class: 'js-user-search js-filter-submit js-author-search', title: 'Filter by author', filter: true, filterInput: 'input#author-search', dropdown_class: 'dropdown-menu-user dropdown-menu-selectable dropdown-menu-author js-filter-submit',
-          placeholder: 'Search authors', data: { any_user: 'Any Author', first_user: (current_user.username if current_user), current_user: true, project_id: (@project.id if @project), selected: params[:author_id], field_name: 'author_id', default_label: 'Author' } })
-      .filter-item.inline
-        - if params[:type].present?
-          = hidden_field_tag(:type, params[:type])
-        = dropdown_tag(todo_types_dropdown_label(params[:type], 'Type'), options: { toggle_class: 'js-type-search js-filter-submit', dropdown_class: 'dropdown-menu-selectable dropdown-menu-type js-filter-submit',
-          data: { data: todo_types_options } })
-      .filter-item.inline.actions-filter
-        - if params[:action_id].present?
-          = hidden_field_tag(:action_id, params[:action_id])
-        = dropdown_tag(todo_actions_dropdown_label(params[:action_id], 'Action'), options: { toggle_class: 'js-action-search js-filter-submit', dropdown_class: 'dropdown-menu-selectable dropdown-menu-action js-filter-submit',
-          data: { data: todo_actions_options }})
-      .pull-right
-        .dropdown.inline.prepend-left-10
-          %button.dropdown-toggle.btn{type: 'button', 'data-toggle' => 'dropdown'}
-            %span.light
-            - if @sort.present?
-              = sort_options_hash[@sort]
-            - else
-              = sort_title_recently_created
-            = icon('caret-down')
-          %ul.dropdown-menu.dropdown-menu-align-right.dropdown-menu-sort
-            %li
-              = link_to todos_filter_path(sort: sort_value_priority) do
-                = sort_title_priority
-              = link_to todos_filter_path(sort: sort_value_recently_created) do
+  .todos-filters
+    .row-content-block.second-block
+      = form_tag todos_filter_path(without: [:project_id, :author_id, :type, :action_id]), method: :get, class: 'filter-form' do
+        .filter-item.inline
+          - if params[:project_id].present?
+            = hidden_field_tag(:project_id, params[:project_id])
+          = dropdown_tag(project_dropdown_label(params[:project_id], 'Project'), options: { toggle_class: 'js-project-search js-filter-submit', title: 'Filter by project', filter: true, filterInput: 'input#project-search', dropdown_class: 'dropdown-menu-selectable dropdown-menu-project js-filter-submit',
+            placeholder: 'Search projects', data: { data: todo_projects_options } })
+        .filter-item.inline
+          - if params[:author_id].present?
+            = hidden_field_tag(:author_id, params[:author_id])
+          = dropdown_tag(user_dropdown_label(params[:author_id], 'Author'), options: { toggle_class: 'js-user-search js-filter-submit js-author-search', title: 'Filter by author', filter: true, filterInput: 'input#author-search', dropdown_class: 'dropdown-menu-user dropdown-menu-selectable dropdown-menu-author js-filter-submit',
+            placeholder: 'Search authors', data: { any_user: 'Any Author', first_user: (current_user.username if current_user), current_user: true, project_id: (@project.id if @project), selected: params[:author_id], field_name: 'author_id', default_label: 'Author' } })
+        .filter-item.inline
+          - if params[:type].present?
+            = hidden_field_tag(:type, params[:type])
+          = dropdown_tag(todo_types_dropdown_label(params[:type], 'Type'), options: { toggle_class: 'js-type-search js-filter-submit', dropdown_class: 'dropdown-menu-selectable dropdown-menu-type js-filter-submit',
+            data: { data: todo_types_options } })
+        .filter-item.inline.actions-filter
+          - if params[:action_id].present?
+            = hidden_field_tag(:action_id, params[:action_id])
+          = dropdown_tag(todo_actions_dropdown_label(params[:action_id], 'Action'), options: { toggle_class: 'js-action-search js-filter-submit', dropdown_class: 'dropdown-menu-selectable dropdown-menu-action js-filter-submit',
+            data: { data: todo_actions_options }})
+        .pull-right
+          .dropdown.inline.prepend-left-10
+            %button.dropdown-toggle.btn{type: 'button', 'data-toggle' => 'dropdown'}
+              %span.light
+              - if @sort.present?
+                = sort_options_hash[@sort]
+              - else
                 = sort_title_recently_created
-              = link_to todos_filter_path(sort: sort_value_oldest_created) do
-                = sort_title_oldest_created
+              = icon('caret-down')
+            %ul.dropdown-menu.dropdown-menu-align-right.dropdown-menu-sort
+              %li
+                = link_to todos_filter_path(sort: sort_value_priority) do
+                  = sort_title_priority
+                = link_to todos_filter_path(sort: sort_value_recently_created) do
+                  = sort_title_recently_created
+                = link_to todos_filter_path(sort: sort_value_oldest_created) do
+                  = sort_title_oldest_created
 
 
 .prepend-top-default
@@ -78,5 +79,29 @@
         %ul.content-list.todos-list
           = render group[1]
     = paginate @todos, theme: "gitlab"
+  - elsif current_user.todos.any?
+    .todos-all-done
+      = render "shared/empty_states/todos_all_done.svg"
+      %h4.text-center
+        Good job! Looks like you don't have any todos left.
+      %p.text-center
+        Are you looking for things to do? Take a look at
+        = succeed "," do
+          = link_to "the opened issues", issues_dashboard_path
+        contribute to
+        = link_to "merge requests", merge_requests_dashboard_path
+        or mention someone in a comment to assign a new todo automatically.
   - else
-    .nothing-here-block You're all done!
+    .todos-empty
+      .todos-empty-hero
+        = render "shared/empty_states/todos_empty.svg"
+      .todos-empty-content
+        %h4
+          Todos let you see what you should do next.
+        %p
+          When an issue or merge request is assigned to you, or when you
+          %strong
+            @mention
+          in a comment, this will trigger a new item in your todo list, automatically.
+        %p
+          You will always know what to work on next.

app/views/devise/confirmations/new.html.haml

 = render 'devise/shared/tab_single', tab_title: 'Resend confirmation instructions'
 .login-box
   .login-body
-    = form_for(resource, as: resource_name, url: confirmation_path(resource_name), html: { method: :post, class: 'show-gl-field-errors' }) do |f|
+    = form_for(resource, as: resource_name, url: confirmation_path(resource_name), html: { method: :post, class: 'gl-show-field-errors' }) do |f|
       .devise-errors
         = devise_error_messages!
       .form-group

app/views/devise/passwords/edit.html.haml

 = render 'devise/shared/tab_single', tab_title:'Change your password'
 .login-box
   .login-body
-    = form_for(resource, as: resource_name, url: password_path(resource_name), html: { method: :put, class: 'show-gl-field-errors' }) do |f|
+    = form_for(resource, as: resource_name, url: password_path(resource_name), html: { method: :put, class: 'gl-show-field-errors' }) do |f|
       .devise-errors
         = devise_error_messages!
       = f.hidden_field :reset_password_token

app/views/devise/passwords/new.html.haml

 = render 'devise/shared/tab_single', tab_title: 'Reset Password'
 .login-box
   .login-body
-    = form_for(resource, as: resource_name, url: password_path(resource_name), html: { method: :post, class: 'show-gl-field-errors' }) do |f|
+    = form_for(resource, as: resource_name, url: password_path(resource_name), html: { method: :post, class: 'gl-show-field-errors' }) do |f|
       .devise-errors
         = devise_error_messages!
       .form-group

app/views/devise/sessions/_new_base.html.haml

-= form_for(resource, as: resource_name, url: session_path(resource_name), html: { class: 'new_user show-gl-field-errors', 'aria-live' => 'assertive'}) do |f|
+= form_for(resource, as: resource_name, url: session_path(resource_name), html: { class: 'new_user gl-show-field-errors', 'aria-live' => 'assertive'}) do |f|
   %div.form-group
     = f.label "Username or email", for: :login
     = f.text_field :login, class: "form-control top", autofocus: "autofocus", autocapitalize: "off", autocorrect: "off", required: true, title: "This field is required."

app/views/devise/sessions/_new_crowd.html.haml

-= form_tag(omniauth_authorize_path(:user, :crowd), id: 'new_crowd_user', class: 'show-gl-field-errors') do
+= form_tag(omniauth_authorize_path(:user, :crowd), id: 'new_crowd_user', class: 'gl-show-field-errors') do
   .form-group
     = label_tag :username, 'Username or email'
     = text_field_tag :username, nil, { class: "form-control top", title: "This field is required", autofocus: "autofocus", required: true }

app/views/devise/sessions/_new_ldap.html.haml

-= form_tag(omniauth_callback_path(:user, server['provider_name']), id: 'new_ldap_user', class: "show-gl-field-errors") do
+= form_tag(omniauth_callback_path(:user, server['provider_name']), id: 'new_ldap_user', class: "gl-show-field-errors") do
   .form-group
     = label_tag :username, "#{server['label']} Username"
     = text_field_tag :username, nil, {class: "form-control top", title: "This field is required.", autofocus: "autofocus", required: true }

app/views/devise/sessions/two_factor.html.haml

@@ -7,7 +7,7 @@
   .login-box
     .login-body
       - if @user.two_factor_otp_enabled?
-        = form_for(resource, as: resource_name, url: session_path(resource_name), method: :post, html: { class: 'edit_user show-gl-field-errors' }) do |f|
+        = form_for(resource, as: resource_name, url: session_path(resource_name), method: :post, html: { class: 'edit_user gl-show-field-errors' }) do |f|
           - resource_params = params[resource_name].presence || params
           = f.hidden_field :remember_me, value: resource_params.fetch(:remember_me, 0)
           %div

app/views/devise/shared/_signup_box.html.haml

 #register-pane.login-box{ role: 'tabpanel', class: 'tab-pane' }
   .login-body
-    = form_for(resource, as: "new_#{resource_name}", url: registration_path(resource_name), html: { class: "new_new_user show-gl-field-errors", "aria-live" => "assertive" }) do |f|
+    = form_for(resource, as: "new_#{resource_name}", url: registration_path(resource_name), html: { class: "new_new_user gl-show-field-errors", "aria-live" => "assertive" }) do |f|
       .devise-errors
         = devise_error_messages!
       %div.form-group
@@ -8,7 +8,7 @@
         = f.text_field :name, class: "form-control top", required: true, title: "This field is required."
       %div.username.form-group
         = f.label :username
-        = f.text_field :username, class: "form-control middle no-gl-field-error", pattern: "[a-zA-Z0-9]+", required: true, title: 'Please create a username with only alphanumeric characters.'
+        = f.text_field :username, class: "form-control middle", pattern: "[a-zA-Z0-9]+", required: true, title: 'Please create a username with only alphanumeric characters.'
         %p.validation-error.hide Username is already taken.
         %p.validation-success.hide Username is available.
         %p.validation-pending.hide Checking username availability...

app/views/devise/unlocks/new.html.haml

 = render 'devise/shared/tab_single', tab_title: 'Resend unlock instructions'
 .login-box
   .login-body
-    = form_for(resource, as: resource_name, url: unlock_path(resource_name), html: { method: :post, class: 'show-gl-field-errors' }) do |f|
+    = form_for(resource, as: resource_name, url: unlock_path(resource_name), html: { method: :post, class: 'gl-show-field-errors' }) do |f|
       .devise-errors
         = devise_error_messages!
       .form-group.append-bottom-20