Merge branch 'master' of gitlab.com:gitlab-org/gitlab-ee into fix/git-annex-githooks

.csscomb.json

+{
+    "always-semicolon": true,
+    "color-case": "lower",
+    "block-indent": "  ",
+    "color-shorthand": true,
+    "element-case": "lower",
+    "space-before-colon": "",
+    "space-after-colon": " ",
+    "space-before-combinator": " ",
+    "space-after-combinator": " ",
+    "space-between-declarations": "\n",
+    "space-before-opening-brace": " ",
+    "space-after-opening-brace": "\n",
+    "space-before-closing-brace": "\n",
+    "unitless-zero": true
+}

.gitlab-ci.yml

@@ -125,6 +125,14 @@ rubocop:
     - ruby
     - mysql
 
+scss-lint:
+  stage: test
+  script:
+    - bundle exec rake scss_lint
+  tags:
+    - ruby
+  allow_failure: true
+
 brakeman:
   stage: test
   script:
@@ -151,6 +159,8 @@ flay:
 
 bundler:audit:
   stage: test
+  only:
+    - master
   script:
     - "bundle exec bundle-audit update"
     - "bundle exec bundle-audit check --ignore OSVDB-115941"
@@ -164,7 +174,7 @@ spec:feature:ruby22:
   stage: test
   image: ruby:2.2
   only:
-  - master
+    - master
   script:
     - RAILS_ENV=test bundle exec rake assets:precompile 2>/dev/null
     - RAILS_ENV=test SIMPLECOV=true bundle exec rake spec:feature

.scss-lint.yml

+# Linter Documentation:
+# https://github.com/brigade/scss-lint/blob/master/lib/scss_lint/linter/README.md
+
+scss_files: 'app/assets/stylesheets/**/*.scss'
+
+exclude:
+  - 'app/assets/stylesheets/pages/emojis.scss'
+
+linters:
+  BangFormat:
+    enabled: false
+  
+  BorderZero:
+    enabled: false
+  
+  ColorKeyword:
+    enabled: false
+  
+  ColorVariable:
+    enabled: false
+  
+  Comment:
+    enabled: false
+  
+  DeclarationOrder:
+    enabled: false
+
+  # `scss-lint:disable` control comments should be preceded by a comment
+  # explaining why these linters are being disabled for this file.
+  # See https://github.com/brigade/scss-lint#disabling-linters-via-source for
+  # more information.
+  DisableLinterReason:
+    enabled: true
+  
+  DuplicateProperty:
+    enabled: false
+  
+  EmptyLineBetweenBlocks:
+    enabled: false
+  
+  EmptyRule:
+    enabled: false
+  
+  FinalNewline:
+    enabled: false
+  
+  # HEX colors should use three-character values where possible.
+  HexLength:
+    enabled: true
+  
+  # HEX color values should use lower-case colors to differentiate between
+  # letters and numbers, e.g. `#E3E3E3` vs. `#e3e3e3`.
+  HexNotation:
+    enabled: true
+  
+  IdSelector:
+    enabled: false
+  
+  ImportPath:
+    enabled: false
+  
+  ImportantRule:
+    enabled: false
+  
+  # Indentation should always be done in increments of 2 spaces.
+  Indentation:
+    enabled: true
+    width: 2
+  
+  LeadingZero:
+    enabled: false
+  
+  MergeableSelector:
+    enabled: false
+  
+  NameFormat:
+    enabled: false
+  
+  NestingDepth:
+    enabled: false
+
+  PlaceholderInExtend:
+    enabled: false
+
+  PropertySortOrder:
+    enabled: false
+  
+  PropertySpelling:
+    enabled: false
+  
+  PseudoElement:
+    enabled: false
+  
+  QualifyingElement:
+    enabled: false
+  
+  SelectorDepth:
+    enabled: false
+  
+  # Selectors should always use hyphenated-lowercase, rather than camelCase or
+  # snake_case.
+  SelectorFormat:
+    enabled: true
+    convention: hyphenated_lowercase
+  
+  # Prefer the shortest shorthand form possible for properties that support it.
+  Shorthand:
+    enabled: true
+  
+  # Each property should have its own line, except in the special case of
+  # single line rulesets.
+  SingleLinePerProperty:
+    enabled: true
+    allow_single_line_rule_sets: true
+
+  SingleLinePerSelector:
+    enabled: false
+  
+  SpaceAfterComma:
+    enabled: false
+  
+  # Properties should be formatted with a single space separating the colon
+  # from the property's value.
+  SpaceAfterPropertyColon:
+    enabled: true
+
+  # Properties should be formatted with no space between the name and the
+  # colon.
+  SpaceAfterPropertyName:
+    enabled: true
+  
+  SpaceAroundOperator:
+    enabled: false
+  
+  SpaceBeforeBrace:
+    enabled: false
+  
+  StringQuotes:
+    enabled: false
+
+  TrailingSemicolon:
+    enabled: false
+
+  TrailingWhitespace:
+    enabled: false
+
+  UnnecessaryMantissa:
+    enabled: false
+
+  UnnecessaryParentReference:
+    enabled: false
+
+  VendorPrefix:
+    enabled: false
+
+  # Omit length units on zero values, e.g. `0px` vs. `0`.
+  ZeroUnit:
+    enabled: true

CHANGELOG

@@ -10,7 +10,6 @@ v 8.6.0 (unreleased)
     setup. A password can be provided during setup (see installation docs), or
     GitLab will ask the user to create a new one upon first visit.
   - Fix issue when pushing to projects ending in .wiki
-  - Fix avatar stretching by providing a cropping feature (Johann Pardanaud)
   - Don't load all of GitLab in mail_room
   - Update `omniauth-saml` to 1.5.0 to allow for custom response attributes to be set
   - Memoize @group in Admin::GroupsController (Yatish Mehta)
@@ -25,11 +24,14 @@ v 8.6.0 (unreleased)
   - Allow to pass name of created artifacts archive in `.gitlab-ci.yml`
   - Refactor and greatly improve search performance
   - Add support for cross-project label references
+  - Ensure "new SSH key" email do not ends up as dead Sidekiq jobs
   - Update documentation to reflect Guest role not being enforced on internal projects
   - Allow search for logged out users
   - Allow to define on which builds the current one depends on
+  - Allow user subscription to a label: get notified for issues/merge requests related to that label (Timothy Andrew)
   - Fix bug where Bitbucket `closed` issues were imported as `opened` (Iuri de Silvio)
   - Don't show Issues/MRs from archived projects in Groups view
+  - Fix wrong "iid of max iid" in Issuable sidebar for some merged MRs
   - Increase the notes polling timeout over time (Roberto Dip)
   - Add shortcut to toggle markdown preview (Florent Baldino)
   - Show labels in dashboard and group milestone views
@@ -39,6 +41,9 @@ v 8.6.0 (unreleased)
   - Move group activity to separate page
   - Continue parameters are checked to ensure redirection goes to the same instance
 
+v 8.5.6
+  - Obtain a lease before querying LDAP
+
 v 8.5.5
   - Ensure removing a project removes associated Todo entries
   - Prevent a 500 error in Todos when author was removed

CHANGELOG-EE

@@ -12,6 +12,12 @@ v 8.6.0 (unreleased)
   - [Elastic] Fix: Don't index newly created system messages and awards
   - [Elastic] Fixed exception on branch removing
 
+v 8.5.7
+  - No EE-specific changes
+
+v 8.5.6
+  - No changes
+
 v 8.5.5
   - GitLab Geo: Repository synchronization between primary and secondary nodes
   - Add documentation for GitLab Pages

CONTRIBUTING.md

@@ -427,6 +427,7 @@ merge request:
 1.  [Rails](https://github.com/bbatsov/rails-style-guide)
 1.  [Testing](https://github.com/thoughtbot/guides/tree/master/style/testing)
 1.  [CoffeeScript](https://github.com/thoughtbot/guides/tree/master/style/coffeescript)
+1.  [SCSS styleguide][scss-styleguide]
 1.  [Shell commands](doc/development/shell_commands.md) created by GitLab
     contributors to enhance security
 1.  [Database Migrations](doc/development/migration_style_guide.md)
@@ -494,6 +495,7 @@ available at [http://contributor-covenant.org/version/1/1/0/](http://contributor
 [rss-source]: https://github.com/bbatsov/ruby-style-guide/blob/master/README.md#source-code-layout
 [rss-naming]: https://github.com/bbatsov/ruby-style-guide/blob/master/README.md#naming
 [doc-styleguide]: doc/development/doc_styleguide.md "Documentation styleguide"
+[scss-styleguide]: doc/development/scss_styleguide.md "SCSS styleguide"
 [gitlab-design]: https://gitlab.com/gitlab-org/gitlab-design
 [free Antetype viewer (Mac OSX only)]: https://itunes.apple.com/us/app/antetype-viewer/id824152298?mt=12
 [`gitlab1.atype` file]: https://gitlab.com/gitlab-org/gitlab-design/tree/master/gitlab1.atype/

Gemfile

@@ -82,9 +82,6 @@ gem "haml-rails", '~> 0.9.0'
 # Files attachments
 gem "carrierwave", '~> 0.10.0'
 
-# Image editing
-gem "mini_magick", '~> 4.4.0'
-
 # Drag and Drop UI
 gem 'dropzonejs-rails', '~> 0.7.1'
 
@@ -296,6 +293,7 @@ group :development, :test do
   gem 'spring-commands-teaspoon', '~> 0.0.2'
 
   gem 'rubocop', '~> 0.35.0', require: false
+  gem 'scss_lint', '~> 0.47.0', require: false
   gem 'coveralls',  '~> 0.8.2', require: false
   gem 'simplecov', '~> 0.10.0', require: false
   gem 'flog', require: false

Gemfile.lock

@@ -493,7 +493,6 @@ GEM
     method_source (0.8.2)
     mime-types (1.25.1)
     mimemagic (0.3.0)
-    mini_magick (4.4.0)
     mini_portile2 (2.0.0)
     minitest (5.7.0)
     mousetrap-rails (1.4.6)
@@ -742,6 +741,9 @@ GEM
     sawyer (0.6.0)
       addressable (~> 2.3.5)
       faraday (~> 0.8, < 0.10)
+    scss_lint (0.47.1)
+      rake (>= 0.9, < 11)
+      sass (~> 3.4.15)
     sdoc (0.3.20)
       json (>= 1.1.3)
       rdoc (~> 3.10)
@@ -989,7 +991,6 @@ DEPENDENCIES
   loofah (~> 2.0.3)
   mail_room (~> 0.6.1)
   method_source (~> 0.8)
-  mini_magick (~> 4.4.0)
   minitest (~> 5.7.0)
   mousetrap-rails (~> 1.4.6)
   mysql2 (~> 0.3.16)
@@ -1042,6 +1043,7 @@ DEPENDENCIES
   ruby-fogbugz (~> 0.2.1)
   sanitize (~> 2.0)
   sass-rails (~> 5.0.0)
+  scss_lint (~> 0.47.0)
   sdoc (~> 0.3.20)
   seed-fu (~> 2.3.5)
   select2-rails (~> 3.5.9)

app/assets/javascripts/application.js.coffee

@@ -43,7 +43,6 @@
 #= require jquery.nicescroll
 #= require_tree .
 #= require fuzzaldrin-plus
-#= require cropper.js
 
 window.slugify = (text) ->
   text.replace(/[^-a-zA-Z0-9]+/g, '_').toLowerCase()

app/assets/javascripts/breakpoints.coffee

@@ -10,7 +10,6 @@ class @Breakpoints
     setup: ->
       allDeviceSelector = BREAKPOINTS.map (breakpoint) ->
         ".device-#{breakpoint}"
-
       return if $(allDeviceSelector.join(",")).length
 
       # Create all the elements
@@ -18,12 +17,17 @@ class @Breakpoints
         "<div class='device-#{breakpoint} visible-#{breakpoint}'></div>"
       $("body").append els.join('')
 
-    getBreakpointSize: ->
+    visibleDevice: ->
       allDeviceSelector = BREAKPOINTS.map (breakpoint) ->
         ".device-#{breakpoint}"
+      $(allDeviceSelector.join(",")).filter(":visible")
 
-      $visibleDevice = $(allDeviceSelector.join(",")).filter(":visible")
-
+    getBreakpointSize: ->
+      $visibleDevice = @visibleDevice
+      # the page refreshed via turbolinks
+      if not $visibleDevice().length
+        @setup()
+      $visibleDevice = @visibleDevice()
       return $visibleDevice.attr("class").split("visible-")[1]
 
   @get: ->

app/assets/javascripts/profile.js.coffee

@@ -17,52 +17,14 @@ class @Profile
     $('.update-notifications').on 'ajax:complete', ->
       $(this).find('.btn-save').enable()
 
-    # Avatar management
-
-    $avatarInput = $('.js-user-avatar-input')
-    $filename = $('.js-avatar-filename')
-    $modalCrop = $('.modal-profile-crop')
-    $modalCropImg = $('.modal-profile-crop-image')
-
-    $('.js-choose-user-avatar-button').on "click", ->
-      $form = $(this).closest("form")
-      $form.find(".js-user-avatar-input").click()
-
-    $modalCrop.on 'shown.bs.modal', ->
-      setTimeout ( -> # The cropper must be asynchronously initialized
-        $modalCropImg.cropper
-          aspectRatio: 1
-          modal: false
-          scalable: false
-          rotatable: false
-          zoomable: false
-
-          crop: (event) ->
-            ['x', 'y'].forEach (key) ->
-              $("#user_avatar_crop_#{key}").val(Math.floor(event[key]))
-            $("#user_avatar_crop_size").val(Math.floor(event.width))
-      ), 0
-
-    $modalCrop.on 'hidden.bs.modal', ->
-      $modalCropImg.attr('src', '').cropper('destroy')
-      $avatarInput.val('')
-      $filename.text($filename.data('label'))
-
-    $('.js-upload-user-avatar').on 'click', ->
-      $('.edit-user').submit()
+    $('.js-choose-user-avatar-button').bind "click", ->
+      form = $(this).closest("form")
+      form.find(".js-user-avatar-input").click()
 
-    $avatarInput.on "change", ->
+    $('.js-user-avatar-input').bind "change", ->
       form = $(this).closest("form")
       filename = $(this).val().replace(/^.*[\\\/]/, '')
-      $filename.data('label', $filename.text()).text(filename)
-
-      reader = new FileReader
-
-      reader.onload = (event) ->
-        $modalCrop.modal('show')
-        $modalCropImg.attr('src', event.target.result)
-
-      fileData = reader.readAsDataURL(this.files[0])
+      form.find(".js-avatar-filename").text(filename)
 
 $ ->
   # Extract the SSH Key title from its comment

app/assets/javascripts/subscription.js.coffee

 class @Subscription
-  constructor: (url) ->
-    $(".subscribe-button").unbind("click").click (event)=>
-      btn = $(event.currentTarget)
-      action = btn.find("span").text()
-      current_status = $(".subscription-status").attr("data-status")
-      btn.prop("disabled", true)
-      
-      $.post url, =>
-        btn.prop("disabled", false)
-        status = if current_status == "subscribed" then "unsubscribed" else "subscribed"
-        $(".subscription-status").attr("data-status", status)
-        action = if status == "subscribed" then "Unsubscribe" else "Subscribe"
-        btn.find("span").text(action)
-        $(".subscription-status>div").toggleClass("hidden")
+  constructor: (container) ->
+    $container = $(container)
+    @url = $container.attr('data-url')
+    @subscribe_button = $container.find('.subscribe-button')
+    @subscription_status = $container.find('.subscription-status')
+    @subscribe_button.unbind('click').click(@toggleSubscription)
 
-    
+  toggleSubscription: (event) =>
+    btn = $(event.currentTarget)
+    action = btn.find('span').text()
+    current_status = @subscription_status.attr('data-status')
+    btn.prop('disabled', true)
+
+    $.post @url, =>
+      btn.prop('disabled', false)
+      status = if current_status == 'subscribed' then 'unsubscribed' else 'subscribed'
+      @subscription_status.attr('data-status', status)
+      action = if status == 'subscribed' then 'Unsubscribe' else 'Subscribe'
+      btn.find('span').text(action)
+      @subscription_status.find('>div').toggleClass('hidden')

app/assets/stylesheets/application.scss

@@ -9,7 +9,6 @@
  *= require_self
  *= require dropzone/basic
  *= require cal-heatmap
- *= require cropper.css
 */
 
 /*

app/assets/stylesheets/framework/blocks.scss

@@ -120,6 +120,10 @@
   .cover-desc {
     padding: 0 $gl-padding 3px;
     color: $gl-text-color;
+
+    &.username:last-child {
+      padding-bottom: $gl-padding;
+    }
   }
 
   .cover-controls {

app/assets/stylesheets/framework/mixins.scss

@@ -41,12 +41,6 @@
   transition: $transition;
 }
 
-@mixin transform($transform) {
-  -webkit-transform: $transform;
-  -ms-transform: $transform;
-  transform: $transform;
-}
-
 /**
  * Prefilled mixins
  * Mixins with fixed values

app/assets/stylesheets/framework/variables.scss

@@ -103,6 +103,10 @@ $border-red-dark: #CA264F;
 $help-well-bg: #FAFAFA;
 $help-well-border: #E5E5E5;
 
+$warning-message-bg: #FBF2D9;
+$warning-message-color: #9E8E60;
+$warning-message-border: #F0E2BB;
+
 /* header */
 $light-grey-header: #faf9f9;
 

app/assets/stylesheets/pages/labels.scss

@@ -41,3 +41,7 @@
 .color-label {
   padding: 3px 4px;
 }
+
+.label-subscription {
+  display: inline-block;
+}

app/assets/stylesheets/pages/profile.scss

@@ -109,42 +109,6 @@
   }
 }
 
-.modal-profile-crop {
-  .modal-dialog {
-    width: 500px;
-  }
-
-  .modal-body {
-    p {
-      display: table;
-      margin: auto;
-      overflow: hidden;
-    }
-
-    img {
-      display: block;
-      max-width: 400px;
-      max-height: 400px;
-    }
-
-    .cropper-bg {
-      background: none;
-    }
-
-    .cropper-crop-box {
-      box-sizing: content-box;
-      border: 999px solid transparentize(#ccc, 0.5);
-      @include transform(translate(-999px, -999px));
-    }
-  }
-}
-
-@media (max-width: 520px) {
-  .modal-profile-crop .modal-dialog {
-    width: auto;
-  }
-}
-
 .key-list-item {
   .key-list-item-info {
     @media (min-width: $screen-sm-min) {
@@ -215,3 +179,21 @@
     color: $provider-btn-not-active-color;
   }
 }
+
+.profile-settings-message {
+  line-height: 32px;
+  color: $warning-message-color;
+  background-color: $warning-message-bg;
+  border: 1px solid $warning-message-border;
+  border-radius: $border-radius-base;
+}
+
+.oauth-applications {
+  form {
+    display: inline-block;
+  }
+
+  .last-heading {
+    width: 105px;
+  }
+}

app/controllers/concerns/toggle_subscription_action.rb

+module ToggleSubscriptionAction
+  extend ActiveSupport::Concern
+
+  def toggle_subscription
+    return unless current_user
+
+    subscribable_resource.toggle_subscription(current_user)
+
+    render nothing: true
+  end
+
+  private
+
+  def subscribable_resource
+    raise NotImplementedError
+  end
+end

app/controllers/groups/hooks_controller.rb

@@ -53,6 +53,8 @@ class Groups::HooksController < Groups::ApplicationController
   end
 
   def hook_params
-    params.require(:hook).permit(:url, :push_events, :issues_events, :merge_requests_events, :tag_push_events)
+    params.require(:hook).permit(:url, :push_events, :issues_events,
+      :merge_requests_events, :tag_push_events, :note_events,
+      :build_events, :enable_ssl_verification)
   end
 end

app/controllers/oauth/applications_controller.rb

@@ -8,7 +8,7 @@ class Oauth::ApplicationsController < Doorkeeper::ApplicationsController
   layout 'profile'
 
   def index
-    head :forbidden and return
+    set_index_vars
   end
 
   def create
@@ -20,18 +20,11 @@ class Oauth::ApplicationsController < Doorkeeper::ApplicationsController
       flash[:notice] = I18n.t(:notice, scope: [:doorkeeper, :flash, :applications, :create])
       redirect_to oauth_application_url(@application)
     else
-      render :new
+      set_index_vars
+      render :index
     end
   end
 
-  def destroy
-    if @application.destroy
-      flash[:notice] = I18n.t(:notice, scope: [:doorkeeper, :flash, :applications, :destroy])
-    end
-
-    redirect_to applications_profile_url
-  end
-
   private
 
   def verify_user_oauth_applications_enabled
@@ -40,6 +33,17 @@ class Oauth::ApplicationsController < Doorkeeper::ApplicationsController
     redirect_to applications_profile_url
   end
 
+  def set_index_vars
+    @applications = current_user.oauth_applications
+    @authorized_tokens = current_user.oauth_authorized_tokens
+    @authorized_anonymous_tokens = @authorized_tokens.reject(&:application)
+    @authorized_apps = @authorized_tokens.map(&:application).uniq.reject(&:nil?)
+
+    # Don't overwrite a value possibly set by `create`
+    @application ||= Doorkeeper::Application.new
+  end
+
+  # Override Doorkeeper to scope to the current user
   def set_application
     @application = current_user.oauth_applications.find(params[:id])
   end

app/controllers/profiles_controller.rb

@@ -8,13 +8,6 @@ class ProfilesController < Profiles::ApplicationController
   def show
   end
 
-  def applications
-    @applications = current_user.oauth_applications
-    @authorized_tokens = current_user.oauth_authorized_tokens
-    @authorized_anonymous_tokens = @authorized_tokens.reject(&:application)
-    @authorized_apps = @authorized_tokens.map(&:application).uniq - [nil]
-  end
-
   def update
     user_params.except!(:email) if @user.ldap_user?
 
@@ -65,9 +58,6 @@ class ProfilesController < Profiles::ApplicationController
 
   def user_params
     params.require(:user).permit(
-      :avatar_crop_x,
-      :avatar_crop_y,
-      :avatar_crop_size,
       :avatar,
       :bio,
       :email,

app/controllers/projects/issues_controller.rb

 class Projects::IssuesController < Projects::ApplicationController
+  include ToggleSubscriptionAction
+
   before_action :module_enabled
-  before_action :issue, only: [:edit, :update, :show, :toggle_subscription]
+  before_action :issue, only: [:edit, :update, :show]
 
   # Allow read any issue
   before_action :authorize_read_issue!
@@ -116,12 +118,6 @@ class Projects::IssuesController < Projects::ApplicationController
     redirect_back_or_default(default: { action: 'index' }, options: { notice: "#{result[:count]} issues updated" })
   end
 
-  def toggle_subscription
-    @issue.toggle_subscription(current_user)
-
-    render nothing: true
-  end
-
   def closed_by_merge_requests
     @closed_by_merge_requests ||= @issue.closed_by_merge_requests(current_user)
   end
@@ -135,6 +131,7 @@ class Projects::IssuesController < Projects::ApplicationController
                  redirect_old
                end
   end
+  alias_method :subscribable_resource, :issue
 
   def authorize_update_issue!
     return render_404 unless can?(current_user, :update_issue, @issue)

app/controllers/projects/labels_controller.rb

 class Projects::LabelsController < Projects::ApplicationController
+  include ToggleSubscriptionAction
+
   before_action :module_enabled
   before_action :label, only: [:edit, :update, :destroy]
   before_action :authorize_read_label!
-  before_action :authorize_admin_labels!, except: [:index]
+  before_action :authorize_admin_labels!, only: [
+    :new, :create, :edit, :update, :generate, :destroy
+  ]
 
   respond_to :js, :html
 
@@ -73,8 +77,9 @@ class Projects::LabelsController < Projects::ApplicationController
   end
 
   def label
-    @label = @project.labels.find(params[:id])
+    @label ||= @project.labels.find(params[:id])
   end
+  alias_method :subscribable_resource, :label
 
   def authorize_admin_labels!
     return render_404 unless can?(current_user, :admin_label, @project)

app/controllers/projects/merge_requests_controller.rb

 class Projects::MergeRequestsController < Projects::ApplicationController
+  include ToggleSubscriptionAction
   include DiffHelper
 
   before_action :module_enabled
   before_action :merge_request, only: [
     :edit, :update, :show, :diffs, :commits, :builds, :merge, :merge_check,
-    :ci_status, :toggle_subscription, :approve, :rebase, :cancel_merge_when_build_succeeds
+    :ci_status, :approve, :rebase, :cancel_merge_when_build_succeeds
   ]
   before_action :closes_issues, only: [:edit, :update, :show, :diffs, :commits, :builds]
   before_action :validates_merge_request, only: [:show, :diffs, :commits, :builds]
@@ -247,23 +248,14 @@ class Projects::MergeRequestsController < Projects::ApplicationController
     render json: response
   end
 
-  def toggle_subscription
-    @merge_request.toggle_subscription(current_user)
-
-    render nothing: true
-  end
-
   def approve
     unless @merge_request.can_approve?(current_user)
       return render_404
     end
 
-    @approval = @merge_request.approvals.new
-    @approval.user = current_user
-
-    if @approval.save
-      SystemNoteService.approve_mr(@merge_request, current_user)
-    end
+    MergeRequests::ApprovalService.
+      new(project, current_user).
+      execute(@merge_request)
 
     redirect_to merge_request_path(@merge_request)
   end
@@ -281,6 +273,7 @@ class Projects::MergeRequestsController < Projects::ApplicationController
   def merge_request
     @merge_request ||= @project.merge_requests.find_by!(iid: params[:id])
   end
+  alias_method :subscribable_resource, :merge_request
 
   def closes_issues
     @closes_issues ||= @merge_request.closes_issues

app/controllers/projects_controller.rb

@@ -173,10 +173,15 @@ class ProjectsController < ApplicationController
   def housekeeping
     ::Projects::HousekeepingService.new(@project).execute
 
-    respond_to do |format|
-      flash[:notice] = "Housekeeping successfully started."
-      format.html { redirect_to project_path(@project) }
-    end
+    redirect_to(
+      project_path(@project),
+      notice: "Housekeeping successfully started"
+    )
+  rescue ::Projects::HousekeepingService::LeaseTaken => ex
+    redirect_to(
+      edit_project_path(@project),
+      alert: ex.to_s
+    )
   end
 
   def toggle_star

app/helpers/ci_status_helper.rb

@@ -12,9 +12,13 @@ module CiStatusHelper
     ci_label_for_status(ci_commit.status)
   end
 
-  def ci_status_with_icon(status)
-    content_tag :span, class: "ci-status ci-#{status}" do
-      ci_icon_for_status(status) + ' '.html_safe + ci_label_for_status(status)
+  def ci_status_with_icon(status, target = nil)
+    content = ci_icon_for_status(status) + ' '.html_safe + ci_label_for_status(status)
+    klass = "ci-status ci-#{status}"
+    if target
+      link_to content, target, class: klass
+    else
+      content_tag :span, content, class: klass
     end
   end
 

app/helpers/events_helper.rb

@@ -3,7 +3,7 @@ module EventsHelper
     author = event.author
 
     if author
-      link_to author.name, user_path(author.username)
+      link_to author.name, user_path(author.username), title: h(author.name)
     else
       event.author_name
     end
@@ -159,7 +159,7 @@ module EventsHelper
         link_to(
           namespace_project_commit_path(event.project.namespace, event.project,
                                         event.note_commit_id,
-                                        anchor: dom_id(event.target)),
+                                        anchor: dom_id(event.target), title: h(event.target_title)),
           class: "commit_short_id"
         ) do
           "#{event.note_target_type} #{event.note_short_commit_id}"
@@ -167,7 +167,7 @@ module EventsHelper
       elsif event.note_project_snippet?
         link_to(namespace_project_snippet_path(event.project.namespace,
                                                event.project,
-                                               event.note_target)) do
+                                               event.note_target), title: h(event.project.name)) do
           "#{event.note_target_type} #{truncate event.note_target.to_reference}"
         end
       else

app/helpers/issuables_helper.rb

@@ -31,7 +31,11 @@ module IssuablesHelper
   end
 
   def issuable_state_scope(issuable)
-    issuable.open? ? :opened : :closed
+    if issuable.respond_to?(:merged?) && issuable.merged?
+      :merged
+    else
+      issuable.open? ? :opened : :closed
+    end
   end
 
 end

app/helpers/labels_helper.rb

@@ -124,6 +124,14 @@ module LabelsHelper
     options_from_collection_for_select(grouped_labels, 'name', 'title', params[:label_name])
   end
 
+  def label_subscription_status(label)
+    label.subscribed?(current_user) ? 'subscribed' : 'unsubscribed'
+  end
+
+  def label_subscription_toggle_button_text(label)
+    label.subscribed?(current_user) ? 'Unsubscribe' : 'Subscribe'
+  end
+
   # Required for Banzai::Filter::LabelReferenceFilter
   module_function :render_colored_label, :render_colored_cross_project_label,
                   :text_color_for_bg, :escape_once

app/helpers/projects_helper.rb

@@ -8,7 +8,7 @@ module ProjectsHelper
   end
 
   def link_to_project(project)
-    link_to [project.namespace.becomes(Namespace), project] do
+    link_to [project.namespace.becomes(Namespace), project], title: h(project.name) do
       title = content_tag(:span, project.name, class: 'project-name')
 
       if project.namespace

app/helpers/todos_helper.rb

@@ -16,7 +16,7 @@ module TodosHelper
 
   def todo_target_link(todo)
     target = todo.target_type.titleize.downcase
-    link_to "#{target} #{todo.target.to_reference}", todo_target_path(todo)
+    link_to "#{target} #{todo.target.to_reference}", todo_target_path(todo), { title: h(todo.target.title) }
   end
 
   def todo_target_path(todo)

app/mailers/emails/issues.rb

@@ -16,7 +16,15 @@ module Emails
     def closed_issue_email(recipient_id, issue_id, updated_by_user_id)
       setup_issue_mail(issue_id, recipient_id)
 
-      @updated_by = User.find updated_by_user_id
+      @updated_by = User.find(updated_by_user_id)
+      mail_answer_thread(@issue, issue_thread_options(updated_by_user_id, recipient_id))
+    end
+
+    def relabeled_issue_email(recipient_id, issue_id, label_names, updated_by_user_id)
+      setup_issue_mail(issue_id, recipient_id)
+
+      @label_names = label_names
+      @labels_url = namespace_project_labels_url(@project.namespace, @project)
       mail_answer_thread(@issue, issue_thread_options(updated_by_user_id, recipient_id))
     end
 
@@ -24,20 +32,12 @@ module Emails
       setup_issue_mail(issue_id, recipient_id)
 
       @issue_status = status
-      @updated_by = User.find updated_by_user_id
+      @updated_by = User.find(updated_by_user_id)
       mail_answer_thread(@issue, issue_thread_options(updated_by_user_id, recipient_id))
     end
 
     private
 
-    def issue_thread_options(sender_id, recipient_id)
-      {
-        from: sender(sender_id),
-        to: recipient(recipient_id),
-        subject: subject("#{@issue.title} (##{@issue.iid})")
-      }
-    end
-
     def setup_issue_mail(issue_id, recipient_id)
       @issue = Issue.find(issue_id)
       @project = @issue.project
@@ -45,5 +45,13 @@ module Emails
 
       @sent_notification = SentNotification.record(@issue, recipient_id, reply_key)
     end
+
+    def issue_thread_options(sender_id, recipient_id)
+      {
+        from: sender(sender_id),
+        to: recipient(recipient_id),
+        subject: subject("#{@issue.title} (##{@issue.iid})")
+      }
+    end
   end
 end

app/mailers/emails/merge_requests.rb

@@ -3,50 +3,43 @@ module Emails
     def new_merge_request_email(recipient_id, merge_request_id)
       setup_merge_request_mail(merge_request_id, recipient_id)
 
-      mail_new_thread(@merge_request,
-                      from: sender(@merge_request.author_id),
-                      to: recipient(recipient_id),
-                      subject: subject("#{@merge_request.title} (##{@merge_request.iid})"))
+      mail_new_thread(@merge_request, merge_request_thread_options(@merge_request.author_id, recipient_id))
     end
 
     def reassigned_merge_request_email(recipient_id, merge_request_id, previous_assignee_id, updated_by_user_id)
       setup_merge_request_mail(merge_request_id, recipient_id)
 
       @previous_assignee = User.find_by(id: previous_assignee_id) if previous_assignee_id
-      mail_answer_thread(@merge_request,
-                         from: sender(updated_by_user_id),
-                         to: recipient(recipient_id),
-                         subject: subject("#{@merge_request.title} (##{@merge_request.iid})"))
+      mail_answer_thread(@merge_request, merge_request_thread_options(updated_by_user_id, recipient_id))
+    end
+
+    def relabeled_merge_request_email(recipient_id, merge_request_id, label_names, updated_by_user_id)
+      setup_merge_request_mail(merge_request_id, recipient_id)
+
+      @label_names = label_names
+      @labels_url = namespace_project_labels_url(@project.namespace, @project)
+      mail_answer_thread(@merge_request, merge_request_thread_options(updated_by_user_id, recipient_id))
     end
 
     def closed_merge_request_email(recipient_id, merge_request_id, updated_by_user_id)
       setup_merge_request_mail(merge_request_id, recipient_id)
 
-      @updated_by = User.find updated_by_user_id
-      mail_answer_thread(@merge_request,
-                         from: sender(updated_by_user_id),
-                         to: recipient(recipient_id),
-                         subject: subject("#{@merge_request.title} (##{@merge_request.iid})"))
+      @updated_by = User.find(updated_by_user_id)
+      mail_answer_thread(@merge_request, merge_request_thread_options(updated_by_user_id, recipient_id))
     end
 
     def merged_merge_request_email(recipient_id, merge_request_id, updated_by_user_id)
       setup_merge_request_mail(merge_request_id, recipient_id)
 
-      mail_answer_thread(@merge_request,
-                         from: sender(updated_by_user_id),
-                         to: recipient(recipient_id),
-                         subject: subject("#{@merge_request.title} (##{@merge_request.iid})"))
+      mail_answer_thread(@merge_request, merge_request_thread_options(updated_by_user_id, recipient_id))
     end
 
     def merge_request_status_email(recipient_id, merge_request_id, status, updated_by_user_id)
       setup_merge_request_mail(merge_request_id, recipient_id)
 
       @mr_status = status
-      @updated_by = User.find updated_by_user_id
-      mail_answer_thread(@merge_request,
-                         from: sender(updated_by_user_id),
-                         to: recipient(recipient_id),
-                         subject: subject("#{@merge_request.title} (##{@merge_request.iid})"))
+      @updated_by = User.find(updated_by_user_id)
+      mail_answer_thread(@merge_request, merge_request_thread_options(updated_by_user_id, recipient_id))
     end
 
     private
@@ -54,11 +47,17 @@ module Emails
     def setup_merge_request_mail(merge_request_id, recipient_id)
       @merge_request = MergeRequest.find(merge_request_id)
       @project = @merge_request.project
-      @target_url = namespace_project_merge_request_url(@project.namespace,
-                                                        @project,
-                                                        @merge_request)
+      @target_url = namespace_project_merge_request_url(@project.namespace, @project, @merge_request)
 
       @sent_notification = SentNotification.record(@merge_request, recipient_id, reply_key)
     end
+
+    def merge_request_thread_options(sender_id, recipient_id)
+      {
+        from: sender(sender_id),
+        to: recipient(recipient_id),
+        subject: subject("#{@merge_request.title} (##{@merge_request.iid})")
+      }
+    end
   end
 end

app/mailers/emails/profile.rb

@@ -14,7 +14,10 @@ module Emails
     end
 
     def new_ssh_key_email(key_id)
-      @key = Key.find(key_id)
+      @key = Key.find_by_id(key_id)
+
+      return unless @key
+
       @current_user = @user = @key.user
       @target_url = user_url(@user)
       mail(to: @user.notification_email, subject: subject("SSH key was added to your account"))

app/models/concerns/custom_model_naming.rb

+module CustomModelNaming
+  # Extracted from: https://github.com/stevenbarragan/spree_random_subscriptions/blob/5426ccaf8a2084c495b2cac9dfbd27e30ade0cec/lib/custom_model_naming.rb
+
+  extend ActiveSupport::Concern
+
+  included do
+    self.class_attribute :singular_route_key, :route_key, :param_key
+  end
+
+  module ClassMethods
+    def model_name
+      @_model_name ||= begin
+        namespace = self.parents.detect do |n|
+          n.respond_to?(:use_relative_model_naming?) && n.use_relative_model_naming?
+        end
+        Name.new(self, namespace)
+      end
+    end
+  end
+
+  class Name < ::ActiveModel::Name
+    def param_key
+      @klass.param_key || super
+    end
+
+    def singular_route_key
+      @klass.singular_route_key || (@klass.route_key && ActiveSupport::Inflector.singularize(@klass.route_key)) || super
+    end
+
+    def route_key
+      @klass.route_key || super
+    end
+  end
+end

app/models/concerns/issuable.rb

@@ -8,6 +8,7 @@ module Issuable
   extend ActiveSupport::Concern
   include Participable
   include Mentionable
+  include Subscribable
   include StripAttribute
 
   included do
@@ -18,7 +19,6 @@ module Issuable
     has_many :notes, as: :noteable, dependent: :destroy
     has_many :label_links, as: :target, dependent: :destroy
     has_many :labels, through: :label_links
-    has_many :subscriptions, dependent: :destroy, as: :subscribable
 
     validates :author, presence: true
     validates :title, presence: true, length: { within: 0..255 }
@@ -149,28 +149,10 @@ module Issuable
     notes.awards.where(note: "thumbsup").count
   end
 
-  def subscribed?(user)
-    subscription = subscriptions.find_by_user_id(user.id)
-
-    if subscription
-      return subscription.subscribed
-    end
-
+  def subscribed_without_subscriptions?(user)
     participants(user).include?(user)
   end
 
-  def toggle_subscription(user)
-    subscriptions.
-      find_or_initialize_by(user_id: user.id).
-      update(subscribed: !subscribed?(user))
-  end
-
-  def unsubscribe(user)
-    subscriptions.
-      find_or_initialize_by(user_id: user.id).
-      update(subscribed: false)
-  end
-
   def to_hook_data(user)
     hook_data = {
       object_kind: self.class.name.underscore,

app/models/concerns/subscribable.rb

+# == Subscribable concern
+#
+# Users can subscribe to these models.
+#
+# Used by Issue, MergeRequest, Label
+#
+
+module Subscribable
+  extend ActiveSupport::Concern
+
+  included do
+    has_many :subscriptions, dependent: :destroy, as: :subscribable
+  end
+
+  def subscribed?(user)
+    if subscription = subscriptions.find_by_user_id(user.id)
+      subscription.subscribed
+    else
+      subscribed_without_subscriptions?(user)
+    end
+  end
+
+  # Override this method to define custom logic to consider a subscribable as
+  # subscribed without an explicit subscription record.
+  def subscribed_without_subscriptions?(user)
+    false
+  end
+
+  def subscribers
+    subscriptions.where(subscribed: true).map(&:user)
+  end
+
+  def toggle_subscription(user)
+    subscriptions.
+      find_or_initialize_by(user_id: user.id).
+      update(subscribed: !subscribed?(user))
+  end
+
+  def unsubscribe(user)
+    subscriptions.
+      find_or_initialize_by(user_id: user.id).
+      update(subscribed: false)
+  end
+end

app/models/hooks/group_hook.rb

@@ -16,5 +16,9 @@
 #
 
 class GroupHook < ProjectHook
+  include CustomModelNaming
+
+  self.singular_route_key = :hook
+
   belongs_to :group
 end

app/models/hooks/project_hook.rb

@@ -19,6 +19,10 @@
 #
 
 class ProjectHook < WebHook
+  include CustomModelNaming
+
+  self.singular_route_key = :hook
+
   belongs_to :project
 
   scope :push_hooks, -> { where(push_events: true) }

app/models/key.rb

@@ -16,6 +16,7 @@
 require 'digest/md5'
 
 class Key < ActiveRecord::Base
+  include AfterCommitQueue
   include Sortable
 
   belongs_to :user
@@ -64,7 +65,7 @@ class Key < ActiveRecord::Base
   end
 
   def notify_user
-    NotificationService.new.new_key(self)
+    run_after_commit { NotificationService.new.new_key(self) }
   end
 
   def post_create_hook

app/models/label.rb

@@ -14,6 +14,8 @@
 
 class Label < ActiveRecord::Base
   include Referable
+  include Subscribable
+
   # Represents a "No Label" state used for filtering Issues and Merge
   # Requests that have no label assigned.
   LabelStruct = Struct.new(:title, :name)

app/models/project.rb

@@ -320,7 +320,14 @@ class Project < ActiveRecord::Base
           or(ptable[:description].matches(pattern))
       )
 
+      # We explicitly remove any eager loading clauses as they're:
+      #
+      # 1. Not needed by this query
+      # 2. Combined with .joins(:namespace) lead to all columns from the
+      #    projects & namespaces tables being selected, leading to a SQL error
+      #    due to the columns of all UNION'd queries no longer being the same.
       namespaces = select(:id).
+        except(:includes).
         joins(:namespace).
         where(ntable[:name].matches(pattern))
 
@@ -598,6 +605,7 @@ class Project < ActiveRecord::Base
   end
 
   def external_issue_tracker
+    return @external_issue_tracker if defined?(@external_issue_tracker)
     @external_issue_tracker ||=
       services.issue_trackers.active.without_defaults.first
   end

app/models/subscription.rb

@@ -15,7 +15,7 @@ class Subscription < ActiveRecord::Base
   belongs_to :user
   belongs_to :subscribable, polymorphic: true
 
-  validates :user_id, 
+  validates :user_id,
             uniqueness: { scope: [:subscribable_id, :subscribable_type] },
             presence: true
 end

app/models/user.rb

@@ -98,9 +98,6 @@ class User < ActiveRecord::Base
   # Virtual attribute for authenticating by either username or email
   attr_accessor :login
 
-  # Virtual attributes to define avatar cropping
-  attr_accessor :avatar_crop_x, :avatar_crop_y, :avatar_crop_size
-
   #
   # Relations
   #
@@ -168,11 +165,6 @@ class User < ActiveRecord::Base
   validate :owns_public_email, if: ->(user) { user.public_email_changed? }
   validates :avatar, file_size: { maximum: 200.kilobytes.to_i }
 
-  validates :avatar_crop_x, :avatar_crop_y, :avatar_crop_size,
-    numericality: { only_integer: true },
-    presence: true,
-    if: ->(user) { user.avatar? && user.avatar_changed? }
-
   before_validation :generate_password, on: :create
   before_validation :restricted_signup_domains, on: :create
   before_validation :sanitize_attrs

app/services/git_push_service.rb

@@ -49,6 +49,8 @@ class GitPushService < BaseService
     # Update merge requests that may be affected by this push. A new branch
     # could cause the last commit of a merge request to change.
     update_merge_requests
+
+    perform_housekeeping
   end
 
   def update_main_language
@@ -87,6 +89,13 @@ class GitPushService < BaseService
     )
   end
 
+  def perform_housekeeping
+    housekeeping = Projects::HousekeepingService.new(@project)
+    housekeeping.increment!
+    housekeeping.execute if housekeeping.needed?
+  rescue Projects::HousekeepingService::LeaseTaken
+  end
+
   def process_default_branch
     @push_commits = project.repository.commits(params[:newrev])
 
@@ -94,7 +103,7 @@ class GitPushService < BaseService
     project.change_head(branch_name)
 
     # Set protection on the default branch if configured
-    if (current_application_settings.default_branch_protection != PROTECTION_NONE)
+    if current_application_settings.default_branch_protection != PROTECTION_NONE
       developers_can_push = current_application_settings.default_branch_protection == PROTECTION_DEV_CAN_PUSH ? true : false
       @project.protected_branches.create({ name: @project.default_branch, developers_can_push: developers_can_push })
     end

app/services/issuable_base_service.rb

@@ -11,7 +11,10 @@ class IssuableBaseService < BaseService
       issuable, issuable.project, current_user, issuable.milestone)
   end
 
-  def create_labels_note(issuable, added_labels, removed_labels)
+  def create_labels_note(issuable, old_labels)
+    added_labels = issuable.labels - old_labels
+    removed_labels = old_labels - issuable.labels
+
     SystemNoteService.change_label(
       issuable, issuable.project, current_user, added_labels, removed_labels)
   end
@@ -71,20 +74,19 @@ class IssuableBaseService < BaseService
     end
   end
 
-  def has_changes?(issuable, options = {})
+  def has_changes?(issuable, old_labels: [])
     valid_attrs = [:title, :description, :assignee_id, :milestone_id, :target_branch]
 
     attrs_changed = valid_attrs.any? do |attr|
       issuable.previous_changes.include?(attr.to_s)
     end
 
-    old_labels = options[:old_labels]
-    labels_changed = old_labels && issuable.labels != old_labels
+    labels_changed = issuable.labels != old_labels
 
     attrs_changed || labels_changed
   end
 
-  def handle_common_system_notes(issuable, options = {})
+  def handle_common_system_notes(issuable, old_labels: [])
     if issuable.previous_changes.include?('title')
       create_title_change_note(issuable, issuable.previous_changes['title'].first)
     end
@@ -93,9 +95,6 @@ class IssuableBaseService < BaseService
       create_task_status_note(issuable)
     end
 
-    old_labels = options[:old_labels]
-    if old_labels && (issuable.labels != old_labels)
-      create_labels_note(issuable, issuable.labels - old_labels, old_labels - issuable.labels)
-    end
+    create_labels_note(issuable, old_labels) if issuable.labels != old_labels
   end
 end

app/services/issues/update_service.rb

@@ -4,8 +4,8 @@ module Issues
       update(issue)
     end
 
-    def handle_changes(issue, options = {})
-      if has_changes?(issue, options)
+    def handle_changes(issue, old_labels: [])
+      if has_changes?(issue, old_labels: old_labels)
         todo_service.mark_pending_todos_as_done(issue, current_user)
       end
 
@@ -23,6 +23,11 @@ module Issues
         notification_service.reassigned_issue(issue, current_user)
         todo_service.reassigned_issue(issue, current_user)
       end
+
+      added_labels = issue.labels - old_labels
+      if added_labels.present?
+        notification_service.relabeled_issue(issue, added_labels, current_user)
+      end
     end
 
     def reopen_service

app/services/merge_requests/approval_service.rb

+module MergeRequests
+  class ApprovalService < MergeRequests::BaseService
+    def execute(merge_request)
+      approval = merge_request.approvals.new(user: current_user)
+
+      if approval.save
+        create_approval_note(merge_request)
+
+        if merge_request.approvals_left.zero?
+          execute_hooks(merge_request, 'approved')
+        end
+      end
+    end
+
+    private
+
+    def create_approval_note(merge_request)
+      SystemNoteService.approve_mr(merge_request, current_user)
+    end
+  end
+end

app/services/merge_requests/update_service.rb

@@ -14,8 +14,8 @@ module MergeRequests
       update(merge_request)
     end
 
-    def handle_changes(merge_request, options = {})
-      if has_changes?(merge_request, options)
+    def handle_changes(merge_request, old_labels: [])
+      if has_changes?(merge_request, old_labels: old_labels)
         todo_service.mark_pending_todos_as_done(merge_request, current_user)
       end
 
@@ -44,6 +44,15 @@ module MergeRequests
           merge_request.previous_changes.include?('source_branch')
         merge_request.mark_as_unchecked
       end
+
+      added_labels = merge_request.labels - old_labels
+      if added_labels.present?
+        notification_service.relabeled_merge_request(
+          merge_request,
+          added_labels,
+          current_user
+        )
+      end
     end
 
     def reopen_service

app/services/notification_service.rb

@@ -24,16 +24,17 @@ class NotificationService
     end
   end
 
-  # When create an issue we should send next emails:
+  # When create an issue we should send an email to:
   #
   #  * issue assignee if their notification level is not Disabled
   #  * project team members with notification level higher then Participating
+  #  * watchers of the issue's labels
   #
   def new_issue(issue, current_user)
     new_resource_email(issue, issue.project, 'new_issue_email')
   end
 
-  # When we close an issue we should send next emails:
+  # When we close an issue we should send an email to:
   #
   #  * issue author if their notification level is not Disabled
   #  * issue assignee if their notification level is not Disabled
@@ -43,7 +44,7 @@ class NotificationService
     close_resource_email(issue, issue.project, current_user, 'closed_issue_email')
   end
 
-  # When we reassign an issue we should send next emails:
+  # When we reassign an issue we should send an email to:
   #
   #  * issue old assignee if their notification level is not Disabled
   #  * issue new assignee if their notification level is not Disabled
@@ -52,16 +53,25 @@ class NotificationService
     reassign_resource_email(issue, issue.project, current_user, 'reassigned_issue_email')
   end
 
+  # When we add labels to an issue we should send an email to:
+  #
+  #  * watchers of the issue's labels
+  #
+  def relabeled_issue(issue, added_labels, current_user)
+    relabeled_resource_email(issue, added_labels, current_user, 'relabeled_issue_email')
+  end
 
-  # When create a merge request we should send next emails:
+  # When create a merge request we should send an email to:
   #
   #  * mr assignee if their notification level is not Disabled
+  #  * project team members with notification level higher then Participating
+  #  * watchers of the mr's labels
   #
   def new_merge_request(merge_request, current_user)
     new_resource_email(merge_request, merge_request.target_project, 'new_merge_request_email')
   end
 
-  # When we reassign a merge_request we should send next emails:
+  # When we reassign a merge_request we should send an email to:
   #
   #  * merge_request old assignee if their notification level is not Disabled
   #  * merge_request assignee if their notification level is not Disabled
@@ -70,6 +80,14 @@ class NotificationService
     reassign_resource_email(merge_request, merge_request.target_project, current_user, 'reassigned_merge_request_email')
   end
 
+  # When we add labels to a merge request we should send an email to:
+  #
+  #  * watchers of the mr's labels
+  #
+  def relabeled_merge_request(merge_request, added_labels, current_user)
+    relabeled_resource_email(merge_request, added_labels, current_user, 'relabeled_merge_request_email')
+  end
+
   def close_mr(merge_request, current_user)
     close_resource_email(merge_request, merge_request.target_project, current_user, 'closed_merge_request_email')
   end
@@ -91,7 +109,8 @@ class NotificationService
     reopen_resource_email(
       merge_request,
       merge_request.target_project,
-      current_user, 'merge_request_status_email',
+      current_user,
+      'merge_request_status_email',
       'reopened'
     )
   end
@@ -348,19 +367,23 @@ class NotificationService
   end
 
   def add_subscribed_users(recipients, target)
-    return recipients unless target.respond_to? :subscriptions
+    return recipients unless target.respond_to? :subscribers
 
-    subscriptions = target.subscriptions
+    recipients + target.subscribers
+  end
 
-    if subscriptions.any?
-      recipients + subscriptions.where(subscribed: true).map(&:user)
-    else
-      recipients
+  def add_labels_subscribers(recipients, target, labels: nil)
+    return recipients unless target.respond_to? :labels
+
+    (labels || target.labels).each do |label|
+      recipients += label.subscribers
     end
+
+    recipients
   end
 
   def new_resource_email(target, project, method)
-    recipients = build_recipients(target, project, target.author)
+    recipients = build_recipients(target, project, target.author, action: :new)
 
     recipients.each do |recipient|
       mailer.send(method, recipient.id, target.id).deliver_later
@@ -392,6 +415,15 @@ class NotificationService
     end
   end
 
+  def relabeled_resource_email(target, labels, current_user, method)
+    recipients = build_relabeled_recipients(target, current_user, labels: labels)
+    label_names = labels.map(&:name)
+
+    recipients.each do |recipient|
+      mailer.send(method, recipient.id, target.id, label_names, current_user.id).deliver_later
+    end
+  end
+
   def reopen_resource_email(target, project, current_user, method, status)
     recipients = build_recipients(target, project, current_user)
 
@@ -416,6 +448,11 @@ class NotificationService
 
     recipients = reject_muted_users(recipients, project)
     recipients = add_subscribed_users(recipients, target)
+
+    if action == :new
+      recipients = add_labels_subscribers(recipients, target)
+    end
+
     recipients = reject_unsubscribed_users(recipients, target)
 
     recipients.delete(current_user)
@@ -423,6 +460,13 @@ class NotificationService
     recipients.uniq
   end
 
+  def build_relabeled_recipients(target, current_user, labels:)
+    recipients = add_labels_subscribers([], target, labels: labels)
+    recipients = reject_unsubscribed_users(recipients, target)
+    recipients.delete(current_user)
+    recipients.uniq
+  end
+
   def mailer
     Notify
   end

app/services/projects/housekeeping_service.rb

@@ -9,12 +9,39 @@ module Projects
   class HousekeepingService < BaseService
     include Gitlab::ShellAdapter
 
+    LEASE_TIMEOUT = 3600
+
+    class LeaseTaken < StandardError
+      def to_s
+        "Somebody already triggered housekeeping for this project in the past #{LEASE_TIMEOUT / 60} minutes"
+      end
+    end
+
     def initialize(project)
       @project = project
     end
 
     def execute
+      raise LeaseTaken if !try_obtain_lease
+
       GitlabShellWorker.perform_async(:gc, @project.path_with_namespace)
+    ensure
+      @project.update_column(:pushes_since_gc, 0)
+    end
+
+    def needed?
+      @project.pushes_since_gc >= 10
+    end
+
+    def increment!
+      @project.increment!(:pushes_since_gc)
+    end
+
+    private
+
+    def try_obtain_lease
+      lease = ::Gitlab::ExclusiveLease.new("project_housekeeping:#{@project.id}", timeout: LEASE_TIMEOUT)
+      lease.try_obtain
     end
   end
 end

app/uploaders/avatar_uploader.rb

@@ -2,22 +2,11 @@
 
 class AvatarUploader < CarrierWave::Uploader::Base
   include UploaderHelper
-  include CarrierWave::MiniMagick
 
   storage :file
 
   after :store, :reset_events_cache
 
-  process :cropper
-
-  def cropper
-    return unless model.respond_to?(:avatar_crop_size) && model.valid?
-
-    manipulate! do |img|
-      img.crop "#{model.avatar_crop_size}x#{model.avatar_crop_size}+#{model.avatar_crop_x}+#{model.avatar_crop_y}"
-    end
-  end
-
   def store_dir
     "uploads/#{model.class.to_s.underscore}/#{mounted_as}/#{model.id}"
   end

app/views/doorkeeper/applications/_delete_form.html.haml

 - submit_btn_css ||= 'btn btn-link btn-remove btn-sm'
 = form_tag oauth_application_path(application) do
   %input{:name => "_method", :type => "hidden", :value => "delete"}/
-  = submit_tag 'Destroy', onclick: "return confirm('Are you sure?')", class: submit_btn_css
\ No newline at end of file
+  - if defined? small
+    = button_tag type: "submit", class: "btn btn-transparent", data: { confirm: "Are you sure?" } do
+      %span.sr-only
+        Destroy
+      = icon('trash')
+  - else
+    = submit_tag 'Destroy', data: { confirm: "Are you sure?" }, class: submit_btn_css

app/views/doorkeeper/applications/_form.html.haml

-= form_for application, url: doorkeeper_submit_path(application), html: {class: 'form-horizontal', role: 'form'} do |f|
+= form_for application, url: doorkeeper_submit_path(application), html: {role: 'form'} do |f|
   - if application.errors.any?
     .alert.alert-danger
       %ul
@@ -6,25 +6,20 @@
           %li= msg
 
   .form-group
-    = f.label :name, class: 'control-label'
-
-    .col-sm-10
-      = f.text_field :name, class: 'form-control', required: true
+    = f.label :name, class: 'label-light'
+    = f.text_field :name, class: 'form-control', required: true
 
   .form-group
-    = f.label :redirect_uri, class: 'control-label'
-
-    .col-sm-10
-      = f.text_area :redirect_uri, class: 'form-control', required: true
+    = f.label :redirect_uri, class: 'label-light'
+    = f.text_area :redirect_uri, class: 'form-control', required: true
 
+    %span.help-block
+      Use one line per URI
+    - if Doorkeeper.configuration.native_redirect_uri
       %span.help-block
-        Use one line per URI
-      - if Doorkeeper.configuration.native_redirect_uri
-        %span.help-block
-          Use
-          %code= Doorkeeper.configuration.native_redirect_uri
-          for local tests
+        Use
+        %code= Doorkeeper.configuration.native_redirect_uri
+        for local tests
 
-  .form-actions
-    = f.submit 'Submit', class: "btn btn-create"
-    = link_to "Cancel", applications_profile_path, class: "btn btn-cancel"
+  .prepend-top-default
+    = f.submit 'Save application', class: "btn btn-create"

app/views/doorkeeper/applications/index.html.haml

 - page_title "Applications"
-%h3.page-title Your applications
-%p= link_to 'New Application', new_oauth_application_path, class: 'btn btn-success'
+- header_title page_title, applications_profile_path
 
-.table-holder
-  %table.table.table-striped
-    %thead
-      %tr
-        %th Name
-        %th Callback URL
-        %th
-        %th
-    %tbody
-      - @applications.each do |application|
-        %tr{:id => "application_#{application.id}"}
-          %td= link_to application.name, oauth_application_path(application)
-          %td= application.redirect_uri
-          %td= link_to 'Edit', edit_oauth_application_path(application), class: 'btn btn-link'
-          %td= render 'delete_form', application: application
+.row.prepend-top-default
+  .col-lg-3.profile-settings-sidebar
+    %h4.prepend-top-0
+      = page_title
+    %p
+      - if user_oauth_applications?
+        Manage applications that can use GitLab as an OAuth provider,
+        and applications that you've authorized to use your account.
+      - else
+        Manage applications that you've authorized to use your account.
+  .col-lg-9
+    - if user_oauth_applications?
+      %h5.prepend-top-0
+        Add new application
+      = render 'form', application: @application
+      %hr
+    - if user_oauth_applications?
+      .oauth-applications
+        %h5
+          Your applications (#{@applications.size})
+        - if @applications.any?
+          .table-responsive
+            %table.table
+              %thead
+                %tr
+                  %th Name
+                  %th Callback URL
+                  %th Clients
+                  %th.last-heading
+              %tbody
+                - @applications.each do |application|
+                  %tr{id: "application_#{application.id}"}
+                    %td= link_to application.name, oauth_application_path(application)
+                    %td
+                      - application.redirect_uri.split.each do |uri|
+                        %div= uri
+                    %td= application.access_tokens.count
+                    %td
+                      = link_to edit_oauth_application_path(application), class: "btn btn-transparent append-right-5" do
+                        %span.sr-only
+                          Edit
+                        = icon('pencil')
+                      = render 'delete_form', application: application, small: true
+        - else
+          .profile-settings-message.text-center
+            You don't have any applications
+    .oauth-authorized-applications.prepend-top-20.append-bottom-default
+      - if user_oauth_applications?
+        %h5
+          Authorized applications (#{@authorized_tokens.size})
+
+      - if @authorized_tokens.any?
+        .table-responsive
+          %table.table.table-striped
+            %thead
+              %tr
+                %th Name
+                %th Authorized At
+                %th Scope
+                %th
+            %tbody
+              - @authorized_apps.each do |app|
+                - token = app.authorized_tokens.order('created_at desc').first
+                %tr{id: "application_#{app.id}"}
+                  %td= app.name
+                  %td= token.created_at
+                  %td= token.scopes
+                  %td= render 'delete_form', application: app
+              - @authorized_anonymous_tokens.each do |token|
+                %tr
+                  %td
+                    Anonymous
+                    %div.help-block
+                      %em Authorization was granted by entering your username and password in the application.
+                  %td= token.created_at
+                  %td= token.scopes
+                  %td= render 'delete_form', token: token
+      - else
+        .profile-settings-message.text-center
+          You don't have any authorized applications

app/views/events/_commit.html.haml

 %li.commit
   .commit-row-title
-    = link_to truncate_sha(commit[:id]), namespace_project_commit_path(project.namespace, project, commit[:id]), class: "commit_short_id", alt: ''
+    = link_to truncate_sha(commit[:id]), namespace_project_commit_path(project.namespace, project, commit[:id]), class: "commit_short_id", alt: '', title: truncate_sha(commit[:id])
     ·
     = markdown event_commit_title(commit[:message]), project: project, pipeline: :single_line

app/views/events/_event_last_push.html.haml

@@ -3,7 +3,7 @@
     .event-last-push
       .event-last-push-text
         %span You pushed to
-        = link_to namespace_project_commits_path(event.project.namespace, event.project, event.ref_name) do
+        = link_to namespace_project_commits_path(event.project.namespace, event.project, event.ref_name), title: h(event.project.name) do
           %strong= event.ref_name
         %span at
         %strong= link_to_project event.project

app/views/events/event/_push.html.haml

@@ -5,7 +5,7 @@
     %strong= event.ref_name
   - else
     %strong
-      = link_to event.ref_name, namespace_project_commits_path(event.project.namespace, event.project, event.ref_name)
+      = link_to event.ref_name, namespace_project_commits_path(event.project.namespace, event.project, event.ref_name), title: h(event.target_title)
   at
   = link_to_project event.project
 

app/views/groups/_projects.html.haml

-.top-area
-  .nav-controls
-    = form_tag request.original_url, method: :get, class: 'project-filter-form', id: 'project-filter-form' do |f|
-      - if @projects.present?
-        = search_field_tag :filter_projects, nil, placeholder: 'Filter by name', class: 'projects-list-filter form-control', spellcheck: false
-    = render 'shared/projects/dropdown'
-    - if can? current_user, :create_projects, @group
-      = link_to new_project_path(namespace_id: @group.id), class: 'btn btn-new pull-right' do
-        = icon('plus')
-        New Project
-
-= render 'shared/projects/list', projects: @projects, stars: false, skip_namespace: true
+= render 'shared/projects/list', projects: projects, stars: false, skip_namespace: true

app/views/groups/_shared_projects.html.haml

-- if projects.present?
-  .panel.panel-default
-    .panel-heading
-      Projects shared with
-      %strong #{@group.name}
-      (#{projects.count})
-    %ul.well-list
-      - projects.each do |project|
-        %li.project-row
-          = link_to namespace_project_path(project.namespace, project), class: dom_class(project) do
-            %span.namespace-name
-              - if project.namespace
-                = project.namespace.human_name
-                \/
-            %span.project-name
-              = truncate(project.name, length: 25)
-            %span.arrow
-              %i.icon-angle-right
+= render 'shared/projects/list', projects: projects, stars: false, skip_namespace: false

app/views/groups/hooks/index.html.haml

-- page_title "Web Hooks"
-%h3.page-title
-  Web hooks
-
-%p.light
-  #{link_to "Web hooks ", help_page_path("web_hooks", "web_hooks"), class: "vlink"} can be
-  used for binding events when something is happening within any project inside this group.
-
-%hr.clearfix
-
-= form_for [@group, @hook], as: :hook, url: group_hooks_path(@group), html: { class: 'form-horizontal' } do |f|
-  -if @hook.errors.any?
-    .alert.alert-danger
-      - @hook.errors.full_messages.each do |msg|
-        %p= msg
-  .form-group
-    = f.label :url, "URL", class: 'control-label'
-    .col-sm-10
-      = f.text_field :url, class: "form-control", placeholder: 'http://example.com/trigger-ci.json'
-  .form-group
-    = f.label :url, "Trigger", class: 'control-label'
-    .col-sm-10
-      %div
-        = f.check_box :push_events, class: 'pull-left'
-        .prepend-left-20
-          = f.label :push_events, class: 'list-label' do
-            %strong Push events
-          %p.light
-            This url will be triggered by a push to the repository
-      %div
-        = f.check_box :tag_push_events, class: 'pull-left'
-        .prepend-left-20
-          = f.label :tag_push_events, class: 'list-label' do
-            %strong Tag push events
-          %p.light
-            This url will be triggered when a new tag is pushed to the repository
-      %div
-        = f.check_box :issues_events, class: 'pull-left'
-        .prepend-left-20
-          = f.label :issues_events, class: 'list-label' do
-            %strong Issues events
-          %p.light
-            This url will be triggered when an issue is created
-      %div
-        = f.check_box :merge_requests_events, class: 'pull-left'
-        .prepend-left-20
-          = f.label :merge_requests_events, class: 'list-label' do
-            %strong Merge Request events
-          %p.light
-            This url will be triggered when a merge request is created
-  .form-actions
-    = f.submit "Add Web Hook", class: "btn btn-create"
-
--if @hooks.any?
-  .panel.panel-default
-    .panel-heading
-      Web hooks (#{@hooks.count})
-    %ul.well-list
-      - @hooks.each do |hook|
-        %li
-          .pull-right
-            = link_to 'Test Hook', test_group_hook_path(@group, hook), class: "btn btn-small btn-grouped"
-            = link_to 'Remove', group_hook_path(@group, hook), data: { confirm: 'Are you sure?'}, method: :delete, class: "btn btn-remove btn-small btn-grouped"
-          .clearfix
-            %span.monospace= hook.url
-          %p
-            - %w(push_events tag_push_events issues_events merge_requests_events).each do |trigger|
-              - if hook.send(trigger)
-                %span.label.label-gray= trigger.titleize
+= render 'shared/web_hooks/form', hook: @hook, hooks: @hooks, url_components: [@group]

app/views/groups/show.html.haml

@@ -27,26 +27,35 @@
     .cover-desc.description
       = markdown(@group.description, pipeline: :description)
 
-
-  %ul.nav-links
-    %li.active
-      = link_to "#projects", 'data-toggle' => 'tab' do
-        Projects
-    - if @shared_projects.present?
-      %li
-        = link_to "#shared", 'data-toggle' => 'tab' do
-          Shared Projects
-
 - if can?(current_user, :read_group, @group)
   %div{ class: container_class }
+    .top-area
+      %ul.nav-links
+        %li.active
+          = link_to "#projects", 'data-toggle' => 'tab' do
+            All Projects
+        - if @shared_projects.present?
+          %li
+            = link_to "#shared", 'data-toggle' => 'tab' do
+              Shared Projects
+      .nav-controls
+        = form_tag request.original_url, method: :get, class: 'project-filter-form', id: 'project-filter-form' do |f|
+          = search_field_tag :filter_projects, nil, placeholder: 'Filter by name', class: 'projects-list-filter form-control', spellcheck: false
+        = render 'shared/projects/dropdown'
+        - if can? current_user, :create_projects, @group
+          = link_to new_project_path(namespace_id: @group.id), class: 'btn btn-new pull-right' do
+            = icon('plus')
+            New Project
+
     .tab-content
       .tab-pane.active#projects
         = render "projects", projects: @projects
       .tab-pane#shared
         = render "shared_projects", projects: @shared_projects
 
-      .tab-pane#shared
-        = render "shared_projects", projects: @shared_projects
+      - if @shared_projects.present?
+        .tab-pane#shared
+          = render "shared_projects", projects: @shared_projects
 
 - else
   %p.nav-links.no-top

app/views/layouts/nav/_profile.html.haml

@@ -17,7 +17,7 @@
       = icon('gear fw')
       %span
         Account
-  = nav_link(path: ['profiles#applications', 'applications#edit', 'applications#show', 'applications#new', 'applications#create']) do
+  = nav_link(controller: 'oauth/applications') do
     = link_to applications_profile_path, title: 'Applications' do
       = icon('cloud fw')
       %span

app/views/layouts/notify.html.haml

@@ -42,12 +42,15 @@
           - else
             #{link_to "View it on GitLab", @target_url}.
           %br
-          -# Don't link the host is the line below, one link in the email is easier to quickly click than two.
+          -# Don't link the host in the line below, one link in the email is easier to quickly click than two.
           You're receiving this email because of your account on #{Gitlab.config.gitlab.host}.
           If you'd like to receive fewer emails, you can
-          - if @sent_notification && @sent_notification.unsubscribable?
-            = link_to "unsubscribe", unsubscribe_sent_notification_url(@sent_notification)
-            from this thread or
-          adjust your notification settings.
+          - if @labels_url
+            adjust your #{link_to 'label subscriptions', @labels_url}.
+          - else
+            - if @sent_notification && @sent_notification.unsubscribable?
+              = link_to "unsubscribe", unsubscribe_sent_notification_url(@sent_notification)
+              from this thread or
+            adjust your notification settings.
 
           = email_action @target_url

app/views/notify/_reassigned_issuable_email.text.erb

 Reassigned <%= issuable.class.model_name.human.titleize %> <%= issuable.iid %>
 
-<%= url_for([issuable.project.namespace.becomes(Namespace), issuable.project, issuable, {only_path: false}]) %>
+<%= url_for([issuable.project.namespace.becomes(Namespace), issuable.project, issuable, { only_path: false }]) %>
 
 Assignee changed <%= "from #{@previous_assignee.name}" if @previous_assignee -%>
  to <%= "#{issuable.assignee_id ? issuable.assignee_name : 'Unassigned'}" %>

app/views/notify/_relabeled_issuable_email.html.haml

+%p
+  #{'Label'.pluralize(@label_names.size)} added:
+  %em= @label_names.to_sentence

app/views/notify/_relabeled_issuable_email.text.erb

+<%= 'Label'.pluralize(@label_names.size) %> added: <%= @label_names.to_sentence %>
+
+<%= url_for([issuable.project.namespace.becomes(Namespace), issuable.project, issuable, { only_path: false }]) %>

app/views/notify/relabeled_issue_email.html.haml

+= render 'relabeled_issuable_email', issuable: @issue

app/views/notify/relabeled_issue_email.text.erb

+<%= render 'relabeled_issuable_email', issuable: @issue %>

app/views/notify/relabeled_merge_request_email.html.haml

+= render 'relabeled_issuable_email', issuable: @merge_request

app/views/notify/relabeled_merge_request_email.text.erb

+<%= render 'relabeled_issuable_email', issuable: @merge_request %>

app/views/profiles/applications.html.haml

-- page_title "Applications"
-- header_title page_title, applications_profile_path
-
-.alert.alert-help.prepend-top-default
-  - if user_oauth_applications?
-    Manage applications that can use GitLab as an OAuth provider,
-    and applications that you've authorized to use your account.
-  - else
-    Manage applications that you've authorized to use your account.
-
-- if user_oauth_applications?
-  .oauth-applications
-    %h3
-      Your applications
-      .pull-right
-        = link_to 'New Application', new_oauth_application_path, class: 'btn btn-success'
-    - if @applications.any?
-      .table-holder
-        %table.table.table-striped
-          %thead
-            %tr
-              %th Name
-              %th Callback URL
-              %th Clients
-              %th
-              %th
-          %tbody
-            - @applications.each do |application|
-              %tr{:id => "application_#{application.id}"}
-                %td= link_to application.name, oauth_application_path(application)
-                %td
-                  - application.redirect_uri.split.each do |uri|
-                    %div= uri
-                %td= application.access_tokens.count
-                %td= link_to 'Edit', edit_oauth_application_path(application), class: 'btn btn-link btn-sm'
-                %td= render 'doorkeeper/applications/delete_form', application: application
-
-.oauth-authorized-applications.prepend-top-20
-  - if user_oauth_applications?
-    %h3
-      Authorized applications
-
-  - if @authorized_tokens.any?
-    .table-holder
-      %table.table.table-striped
-        %thead
-          %tr
-            %th Name
-            %th Authorized At
-            %th Scope
-            %th
-        %tbody
-          - @authorized_apps.each do |app|
-            - token = app.authorized_tokens.order('created_at desc').first
-            %tr{:id => "application_#{app.id}"}
-              %td= app.name
-              %td= token.created_at
-              %td= token.scopes
-              %td= render 'doorkeeper/authorized_applications/delete_form', application: app
-          - @authorized_anonymous_tokens.each do |token|
-            %tr
-              %td
-                Anonymous
-                %div.help-block
-                  %em Authorization was granted by entering your username and password in the application.
-              %td= token.created_at
-              %td= token.scopes
-              %td= render 'doorkeeper/authorized_applications/delete_form', token: token
-  - else
-    %p.light You don't have any authorized applications

app/views/profiles/show.html.haml

 = form_for @user, url: profile_path, method: :put, html: { multipart: true, class: "edit-user prepend-top-default" }, authenticity_token: true do |f|
-  = f.hidden_field :avatar_crop_x
-  = f.hidden_field :avatar_crop_y
-  = f.hidden_field :avatar_crop_size
   -if @user.errors.any?
     %div.alert.alert-danger
       %ul
@@ -97,19 +94,3 @@
       .prepend-top-default.append-bottom-default
         = f.submit 'Update profile settings', class: "btn btn-success"
         = link_to "Cancel", user_path(current_user), class: "btn btn-cancel"
-
-.modal.modal-profile-crop
-  .modal-dialog
-    .modal-content
-      .modal-header
-        %button.close{type: 'button', data: {dismiss: 'modal'}}
-          %span
-            ×
-        %h4.modal-title
-          Crop your new profile picture
-      .modal-body
-        %p
-          %img.modal-profile-crop-image
-      .modal-footer
-        %button.btn.btn-primary.js-upload-user-avatar{:type => "button"}
-          Set new profile picture

app/views/projects/ci/builds/_build.html.haml

 %tr.build
   %td.status
     - if can?(current_user, :read_build, build)
-      = link_to namespace_project_build_url(build.project.namespace, build.project, build), class: "ci-status ci-#{build.status}" do
-        = ci_status_with_icon(build.status)
+      = ci_status_with_icon(build.status, namespace_project_build_url(build.project.namespace, build.project, build))
     - else
       = ci_status_with_icon(build.status)
 

app/views/projects/generic_commit_statuses/_generic_commit_status.html.haml

 %tr.generic_commit_status
   %td.status
     - if can?(current_user, :read_commit_status, generic_commit_status) && generic_commit_status.target_url
-      = link_to generic_commit_status.target_url, class: "ci-status ci-#{generic_commit_status.status}" do
-        = ci_status_with_icon(generic_commit_status.status)
+      = ci_status_with_icon(generic_commit_status.status, generic_commit_status.target_url)
     - else
       = ci_status_with_icon(generic_commit_status.status)
 

app/views/projects/hooks/index.html.haml

-- page_title "Webhooks"
-%h3.page-title
-  Webhooks
-
-%p.light
-  #{link_to "Webhooks ", help_page_path("web_hooks", "web_hooks"), class: "vlink"} can be
-  used for binding events when something is happening within the project.
-
-%hr.clearfix
-
-= form_for [@project.namespace.becomes(Namespace), @project, @hook], as: :hook, url: namespace_project_hooks_path(@project.namespace, @project), html: { class: 'form-horizontal' } do |f|
-  -if @hook.errors.any?
-    .alert.alert-danger
-      - @hook.errors.full_messages.each do |msg|
-        %p= msg
-  .form-group
-    = f.label :url, "URL", class: 'control-label'
-    .col-sm-10
-      = f.text_field :url, class: "form-control", placeholder: 'http://example.com/trigger-ci.json'
-  .form-group
-    = f.label :url, "Trigger", class: 'control-label'
-    .col-sm-10.prepend-top-10
-      %div
-        = f.check_box :push_events, class: 'pull-left'
-        .prepend-left-20
-          = f.label :push_events, class: 'list-label' do
-            %strong Push events
-          %p.light
-            This url will be triggered by a push to the repository
-      %div
-        = f.check_box :tag_push_events, class: 'pull-left'
-        .prepend-left-20
-          = f.label :tag_push_events, class: 'list-label' do
-            %strong Tag push events
-          %p.light
-            This url will be triggered when a new tag is pushed to the repository
-      %div
-        = f.check_box :note_events, class: 'pull-left'
-        .prepend-left-20
-          = f.label :note_events, class: 'list-label' do
-            %strong Comments
-          %p.light
-            This url will be triggered when someone adds a comment
-      %div
-        = f.check_box :issues_events, class: 'pull-left'
-        .prepend-left-20
-          = f.label :issues_events, class: 'list-label' do
-            %strong Issues events
-          %p.light
-            This url will be triggered when an issue is created/updated/merged
-      %div
-        = f.check_box :merge_requests_events, class: 'pull-left'
-        .prepend-left-20
-          = f.label :merge_requests_events, class: 'list-label' do
-            %strong Merge Request events
-          %p.light
-            This url will be triggered when a merge request is created/updated/merged
-      %div
-        = f.check_box :build_events, class: 'pull-left'
-        .prepend-left-20
-          = f.label :build_events, class: 'list-label' do
-            %strong Build events
-          %p.light
-            This url will be triggered when the build status changes
-  .form-group
-    = f.label :enable_ssl_verification, "SSL verification", class: 'control-label checkbox'
-    .col-sm-10
-      .checkbox
-        = f.label :enable_ssl_verification do
-          = f.check_box :enable_ssl_verification
-          %strong Enable SSL verification
-  .form-actions
-    = f.submit "Add Webhook", class: "btn btn-create"
-
--if @hooks.any?
-  .panel.panel-default
-    .panel-heading
-      Webhooks (#{@hooks.count})
-    %ul.well-list
-      - @hooks.each do |hook|
-        %li
-          .pull-right
-            = link_to 'Test Hook', test_namespace_project_hook_path(@project.namespace, @project, hook), class: "btn btn-sm btn-grouped"
-            = link_to 'Remove', namespace_project_hook_path(@project.namespace, @project, hook), data: { confirm: 'Are you sure?'}, method: :delete, class: "btn btn-remove btn-sm btn-grouped"
-          .clearfix
-            %span.monospace= hook.url
-          %p
-            - %w(push_events tag_push_events issues_events note_events merge_requests_events build_events).each do |trigger|
-              - if hook.send(trigger)
-                %span.label.label-gray= trigger.titleize
-            SSL Verification: #{hook.enable_ssl_verification ? "enabled" : "disabled"}
+= render 'shared/web_hooks/form', hook: @hook, hooks: @hooks, url_components: [@project.namespace.becomes(Namespace), @project]

app/views/projects/labels/_label.html.haml

@@ -10,6 +10,16 @@
       = link_to_label(label) do
         = pluralize label.open_issues_count, 'open issue'
 
+    - if current_user
+      .label-subscription{data: {url: toggle_subscription_namespace_project_label_path(@project.namespace, @project, label)}}
+        .subscription-status{data: {status: label_subscription_status(label)}}
+        %button.btn.btn-sm.btn-info.subscribe-button
+          %span= label_subscription_toggle_button_text(label)
+
     - if can? current_user, :admin_label, @project
       = link_to 'Edit', edit_namespace_project_label_path(@project.namespace, @project, label), class: 'btn btn-sm'
       = link_to 'Delete', namespace_project_label_path(@project.namespace, @project, label), class: 'btn btn-sm btn-remove remove-row', method: :delete, remote: true, data: {confirm: "Remove this label? Are you sure?"}
+
+- if current_user
+  :javascript
+    new Subscription('##{dom_id(label)} .label-subscription');

app/views/shared/issuable/_sidebar.html.haml

@@ -122,7 +122,7 @@
       %hr
       - if current_user
         - subscribed = issuable.subscribed?(current_user)
-        .block.light
+        .block.light.subscription{data: {url: toggle_subscription_path(issuable)}}
           .sidebar-collapsed-icon
             = icon('rss')
           .title.hide-collapsed
@@ -148,5 +148,5 @@
           = clipboard_button(clipboard_text: project_ref)
 
     :javascript
-      new Subscription("#{toggle_subscription_path(issuable)}");
+      new Subscription('.subscription');
       new IssuableContext();

app/views/shared/web_hooks/_form.html.haml

+- page_title "Webhooks"
+- context_title = @project ? 'project' : 'group'
+
+%h3.page-title
+
+  Webhooks
+
+%p.light
+  #{link_to "Webhooks ", help_page_path("web_hooks", "web_hooks"), class: "vlink"} can be
+  used for binding events when something is happening within the #{context_title}.
+
+%hr.clearfix
+
+= form_for hook, as: :hook, url: polymorphic_path(url_components + [:hooks]), html: { class: 'form-horizontal' } do |f|
+  -if hook.errors.any?
+    .alert.alert-danger
+      - hook.errors.full_messages.each do |msg|
+        %p= msg
+  .form-group
+    = f.label :url, "URL", class: 'control-label'
+    .col-sm-10
+      = f.text_field :url, class: "form-control", placeholder: 'http://example.com/trigger-ci.json'
+  .form-group
+    = f.label :url, "Trigger", class: 'control-label'
+    .col-sm-10.prepend-top-10
+      %div
+        = f.check_box :push_events, class: 'pull-left'
+        .prepend-left-20
+          = f.label :push_events, class: 'list-label' do
+            %strong Push events
+          %p.light
+            This url will be triggered by a push to the repository
+      %div
+        = f.check_box :tag_push_events, class: 'pull-left'
+        .prepend-left-20
+          = f.label :tag_push_events, class: 'list-label' do
+            %strong Tag push events
+          %p.light
+            This url will be triggered when a new tag is pushed to the repository
+      %div
+        = f.check_box :note_events, class: 'pull-left'
+        .prepend-left-20
+          = f.label :note_events, class: 'list-label' do
+            %strong Comments
+          %p.light
+            This url will be triggered when someone adds a comment
+      %div
+        = f.check_box :issues_events, class: 'pull-left'
+        .prepend-left-20
+          = f.label :issues_events, class: 'list-label' do
+            %strong Issues events
+          %p.light
+            This url will be triggered when an issue is created/updated/merged
+      %div
+        = f.check_box :merge_requests_events, class: 'pull-left'
+        .prepend-left-20
+          = f.label :merge_requests_events, class: 'list-label' do
+            %strong Merge Request events
+          %p.light
+            This url will be triggered when a merge request is created/updated/merged
+      %div
+        = f.check_box :build_events, class: 'pull-left'
+        .prepend-left-20
+          = f.label :build_events, class: 'list-label' do
+            %strong Build events
+          %p.light
+            This url will be triggered when the build status changes
+  .form-group
+    = f.label :enable_ssl_verification, "SSL verification", class: 'control-label checkbox'
+    .col-sm-10
+      .checkbox
+        = f.label :enable_ssl_verification do
+          = f.check_box :enable_ssl_verification
+          %strong Enable SSL verification
+  .form-actions
+    = f.submit "Add Webhook", class: "btn btn-create"
+
+-if hooks.any?
+  .panel.panel-default
+    .panel-heading
+      Webhooks (#{hooks.count})
+    %ul.well-list
+      - hook_types = %w(push_events tag_push_events note_events issues_events merge_requests_events build_events)
+
+      - hooks.each do |hook|
+        %li
+          .pull-right
+            = link_to 'Test Hook', polymorphic_path(url_components + [hook], action: :test), class: "btn btn-sm btn-grouped"
+            = link_to 'Remove', polymorphic_path(url_components + [hook]), data: { confirm: 'Are you sure?'}, method: :delete, class: "btn btn-remove btn-sm btn-grouped"
+          .clearfix
+            %span.monospace= hook.url
+          %p
+            - hook_types.each do |hook_type|
+              - if hook.send(hook_type)
+                %span.label.label-gray= hook_type.titleize
+            SSL Verification: #{hook.enable_ssl_verification ? "enabled" : "disabled"}

config/routes.rb

@@ -312,7 +312,7 @@ Rails.application.routes.draw do
   resource :profile, only: [:show, :update] do
     member do
       get :audit_log
-      get :applications
+      get :applications, to: 'oauth/applications#index'
 
       put :reset_private_token
       put :update_username
@@ -727,6 +727,10 @@ Rails.application.routes.draw do
           collection do
             post :generate
           end
+
+          member do
+            post :toggle_subscription
+          end
         end
 
         resources :issues, constraints: { id: /\d+/ }, except: [:destroy] do

db/migrate/20160314143402_projects_add_pushes_since_gc.rb

+class ProjectsAddPushesSinceGc < ActiveRecord::Migration
+  def change
+    add_column :projects, :pushes_since_gc, :integer, default: 0
+  end
+end

db/migrate/20160316124047_git_hooks_project_id_index.rb

+class GitHooksProjectIdIndex < ActiveRecord::Migration
+  disable_ddl_transaction!
+
+  def change
+    args = [:git_hooks, :project_id]
+
+    if Gitlab::Database.postgresql?
+      args << { algorithm: :concurrently }
+    end
+
+    add_index(*args)
+  end
+end

db/schema.rb

@@ -11,7 +11,7 @@
 #
 # It's strongly recommended that you check this file into your version control system.
 
-ActiveRecord::Schema.define(version: 20160309140734) do
+ActiveRecord::Schema.define(version: 20160316124047) do
 
   # These are extensions that must be enabled in order to support this database
   enable_extension "plpgsql"
@@ -440,6 +440,8 @@ ActiveRecord::Schema.define(version: 20160309140734) do
     t.integer  "max_file_size",        default: 0,     null: false
   end
 
+  add_index "git_hooks", ["project_id"], name: "index_git_hooks_on_project_id", using: :btree
+
   create_table "historical_data", force: :cascade do |t|
     t.date     "date",              null: false
     t.integer  "active_user_count"
@@ -827,6 +829,7 @@ ActiveRecord::Schema.define(version: 20160309140734) do
     t.boolean  "pending_delete",                   default: false
     t.boolean  "public_builds",                    default: true,     null: false
     t.string   "main_language"
+    t.integer  "pushes_since_gc",        default: 0
   end
 
   add_index "projects", ["builds_enabled", "shared_runners_enabled"], name: "index_projects_on_builds_enabled_and_shared_runners_enabled", using: :btree

doc/ci/examples/test-and-deploy-ruby-application-to-heroku.md

 ## Test and Deploy a ruby application
-This example will guide you how to run tests in your Ruby application and deploy it automatiacally as Heroku application.
+This example will guide you how to run tests in your Ruby application and deploy it automatically as Heroku application.
 
 You can checkout the example [source](https://gitlab.com/ayufan/ruby-getting-started) and check [CI status](https://gitlab.com/ayufan/ruby-getting-started/builds?scope=all).
 

doc/ci/yaml/README.md

@@ -399,7 +399,7 @@ The above script will:
 >**Notes:**
 >
 > - Introduced in GitLab Runner v0.7.0 for non-Windows platforms.
-> - Limited Windows support was added in GitLab Runner v.1.0.0.
+> - Windows support was added in GitLab Runner v.1.0.0.
 > - Currently not all executors are supported.
 > - Build artifacts are only collected for successful builds.
 

doc/development/scss_styleguide.md

+# SCSS styleguide
+
+This style guide recommends best practices for SCSS to make styles easy to read,
+easy to maintain, and performant for the end-user.
+
+## Rules
+
+### Naming
+
+CSS classes should use the `lowercase-hyphenated` format rather than
+`snake_case` or `camelCase`.
+
+```scss
+// Bad
+.class_name {
+  color: #fff;
+}
+
+// Bad
+.className {
+  color: #fff;
+}
+
+// Good
+.class-name {
+  color: #fff;
+}
+```
+
+### Formatting
+
+You should always use a space before a brace, braces should be on the same
+line, each property should each get its own line, and there should be a space
+between the property and its value.
+
+```scss
+// Bad
+.container-item { 
+  width: 100px; height: 100px;
+  margin-top: 0;
+}
+
+// Bad
+.container-item
+{
+  width: 100px;
+  height: 100px;
+  margin-top: 0;
+}
+
+// Bad
+.container-item{
+  width:100px;
+  height:100px;
+  margin-top:0;
+}
+
+// Good
+.container-item {
+  width: 100px;
+  height: 100px;
+  margin-top: 0;
+}
+```
+
+Note that there is an exception for single-line rulesets, although these are 
+not typically recommended.
+
+```scss
+p { margin: 0; padding: 0; }
+```
+
+### Colors
+
+HEX (hexadecimal) colors short-form should use shortform where possible, and 
+should use lower case letters to differenciate between letters and numbers, e.
+g. `#E3E3E3` vs. `#e3e3e3`.
+
+```scss
+// Bad
+p {
+  color: #ffffff;
+}
+
+// Bad
+p {
+  color: #FFFFFF;
+}
+
+// Good
+p {
+  color: #fff;
+}
+```
+
+### Indentation
+
+Indentation should always use two spaces for each indentation level.
+
+```scss
+// Bad, four spaces
+p {
+    color: #f00;
+}
+
+// Good
+p {
+  color: #f00;
+}
+```
+
+### Semicolons
+
+Always include semicolons after every property. When the stylesheets are 
+minified, the semicolons will be removed automatically.
+
+```scss
+// Bad
+.container-item {
+  width: 100px;
+  height: 100px
+}
+
+// Good
+.container-item {
+  width: 100px;
+  height: 100px;
+}
+```
+
+### Shorthand
+
+The shorthand form should be used for properties that support it.
+
+```scss
+// Bad
+margin: 10px 15px 10px 15px;
+padding: 10px 10px 10px 10px;
+
+// Good
+margin: 10px 15px;
+padding: 10px;
+```
+
+### Zero Units
+
+Omit length units on zero values, they're unnecessary and not including them 
+is slightly more performant.
+
+```scss
+// Bad
+.item-with-padding {
+  padding: 0px;
+}
+
+// Good
+.item-with-padding {
+  padding: 0;
+}
+```
+
+### Selectors with a `js-` Prefix
+Do not use any selector prefixed with `js-` for styling purposes. These 
+selectors are intended for use only with JavaScript to allow for removal or 
+renaming without breaking styling.
+
+## Linting
+
+We use [SCSS Lint][scss-lint] to check for style guide conformity. It uses the 
+ruleset in `.scss-lint.yml`, which is located in the home directory of the 
+project.
+
+To check if any warnings will be produced by your changes, you can run `rake 
+scss_lint` in the GitLab directory. SCSS Lint will also run in GitLab CI to 
+catch any warnings.
+
+If the Rake task is throwing warnings you don't understand, SCSS Lint's 
+documentation includes [a full list of their linters][scss-lint-documentation].
+
+### Fixing issues
+
+If you want to automate changing a large portion of the codebase to conform to 
+the SCSS style guide, you can use [CSSComb][csscomb]. First install
+[Node][node] and [NPM][npm], then run `npm install csscomb -g` to install 
+CSSComb globally (system-wide). Run it in the GitLab directory with 
+`csscomb app/assets/stylesheets` to automatically fix issues with CSS/SCSS.
+
+Note that this won't fix every problem, but it should fix a majority.
+
+[csscomb]: https://github.com/csscomb/csscomb.js
+[node]: https://github.com/nodejs/node
+[npm]: https://www.npmjs.com/
+[scss-lint]: https://github.com/brigade/scss-lint
+[scss-lint-documentation]: https://github.com/brigade/scss-lint/blob/master/lib/scss_lint/linter/README.md

doc/web_hooks/web_hooks.md

 # Webhooks
 
-_**Note:**
-Starting from GitLab 8.5:_
-
-- _the `repository` key is deprecated in favor of the `project` key_
-- _the `project.ssh_url` key is deprecated in favor of the `project.git_ssh_url` key_
-- _the `project.http_url` key is deprecated in favor of the `project.git_http_url` key_
+> **Note:** As of GitLab 8.5:
+>
+> - the `repository` key is deprecated in favor of the `project` key
+> - the `project.ssh_url` key is deprecated in favor of the `project.git_ssh_url` key
+> - the `project.http_url` key is deprecated in favor of the `project.git_http_url` key
 
 Project webhooks allow you to trigger an URL if new code is pushed or a new issue is created.
 
@@ -595,7 +594,11 @@ X-Gitlab-Event: Note Hook
 
 ## Merge request events
 
-Triggered when a new merge request is created, an existing merge request was updated/merged/closed or a commit is added in the source branch.
+Triggered when a new merge request is created, an existing merge request was
+updated/merged/closed/approved, or a commit is added in the source branch.
+
+> **Note:** A webhook for the `approved` action is only fired once the total
+> number of required approvals is met, _not_ after each individual approval.
 
 **Request header**:
 

features/profile/profile.feature

@@ -76,8 +76,7 @@ Feature: Profile
 
   Scenario: I can manage application
     Given I visit profile applications page
-    Then I click on new application button
-    And I should see application form
+    Then I should see application form
     Then I fill application form out and submit
     And I see application
     Then I click edit

features/project/labels.feature

+@labels
+Feature: Labels
+  Background:
+    Given I sign in as a user
+    And I own project "Shop"
+    And project "Shop" has labels: "bug", "feature", "enhancement"
+    When I visit project "Shop" labels page
+
+  @javascript
+  Scenario: I can subscribe to a label
+    Then I should see that I am not subscribed to the "bug" label
+    When I click button "Subscribe" for the "bug" label
+    Then I should see that I am subscribed to the "bug" label
+    When I click button "Unsubscribe" for the "bug" label
+    Then I should see that I am not subscribed to the "bug" label

features/project/merge_requests.feature

@@ -46,11 +46,18 @@ Feature: Project Merge Requests
     Then I should see "Feature NS-03" in merge requests
     And I should see "Bug NS-04" in merge requests
 
-  Scenario: I visit merge request page
+  Scenario: I visit an open merge request page
     Given I click link "Bug NS-04"
     Then I should see merge request "Bug NS-04"
     And I should see "1 of 1" in the sidebar
 
+  Scenario: I visit a merged merge request page
+    Given project "Shop" have "Feature NS-05" merged merge request
+    And I click link "Merged"
+    And I click link "Feature NS-05"
+    Then I should see merge request "Feature NS-05"
+    And I should see "3 of 3" in the sidebar
+
   Scenario: I close merge request page
     Given I click link "Bug NS-04"
     And I click link "Close"

features/steps/group_hooks.rb

@@ -34,7 +34,7 @@ class Spinach::Features::GroupHooks < Spinach::FeatureSteps
   step 'I submit new hook' do
     @url = FFaker::Internet.uri("http")
     fill_in "hook_url", with: @url
-    expect { click_button "Add Web Hook" }.to change(GroupHook, :count).by(1)
+    expect { click_button "Add Webhook" }.to change(GroupHook, :count).by(1)
   end
 
   step 'I should see newly created hook' do

features/steps/profile/profile.rb

@@ -27,7 +27,9 @@ class Spinach::Features::Profile < Spinach::FeatureSteps
   end
 
   step 'I change my avatar' do
-    attach_avatar
+    attach_file(:user_avatar, File.join(Rails.root, 'spec', 'fixtures', 'banana_sample.gif'))
+    click_button "Update profile settings"
+    @user.reload
   end
 
   step 'I should see new avatar' do
@@ -40,7 +42,9 @@ class Spinach::Features::Profile < Spinach::FeatureSteps
   end
 
   step 'I have an avatar' do
-    attach_avatar
+    attach_file(:user_avatar, File.join(Rails.root, 'spec', 'fixtures', 'banana_sample.gif'))
+    click_button "Update profile settings"
+    @user.reload
   end
 
   step 'I remove my avatar' do
@@ -180,18 +184,14 @@ class Spinach::Features::Profile < Spinach::FeatureSteps
     end
   end
 
-  step 'I click on new application button' do
-    click_on 'New Application'
-  end
-
   step 'I should see application form' do
-    expect(page).to have_content "New Application"
+    expect(page).to have_content "Add new application"
   end
 
   step 'I fill application form out and submit' do
     fill_in :doorkeeper_application_name, with: 'test'
     fill_in :doorkeeper_application_redirect_uri, with: 'https://test.com'
-    click_on "Submit"
+    click_on "Save application"
   end
 
   step 'I see application' do
@@ -211,7 +211,7 @@ class Spinach::Features::Profile < Spinach::FeatureSteps
   step 'I change name of application and submit' do
     expect(page).to have_content "Edit application"
     fill_in :doorkeeper_application_name, with: 'test_changed'
-    click_on "Submit"
+    click_on "Save application"
   end
 
   step 'I see that application was changed' do
@@ -229,16 +229,4 @@ class Spinach::Features::Profile < Spinach::FeatureSteps
   step "I see that application is removed" do
     expect(page.find(".oauth-applications")).not_to have_content "test_changed"
   end
-
-  def attach_avatar
-    attach_file :user_avatar, Rails.root.join(*%w(spec fixtures banana_sample.gif))
-
-    page.find('#user_avatar_crop_x',    visible: false).set('0')
-    page.find('#user_avatar_crop_y',    visible: false).set('0')
-    page.find('#user_avatar_crop_size', visible: false).set('256')
-
-    click_button "Update profile settings"
-
-    @user.reload
-  end
 end

features/steps/project/labels.rb

+class Spinach::Features::Labels < Spinach::FeatureSteps
+  include SharedAuthentication
+  include SharedIssuable
+  include SharedProject
+  include SharedNote
+  include SharedPaths
+  include SharedMarkdown
+
+  step 'And I visit project "Shop" labels page' do
+    visit namespace_project_labels_path(project.namespace, project)
+  end
+
+  step 'I should see that I am subscribed to the "bug" label' do
+    expect(subscribe_button).to have_content 'Unsubscribe'
+  end
+
+  step 'I should see that I am not subscribed to the "bug" label' do
+    expect(subscribe_button).to have_content 'Subscribe'
+  end
+
+  step 'I click button "Unsubscribe" for the "bug" label' do
+    subscribe_button.click
+  end
+
+  step 'I click button "Subscribe" for the "bug" label' do
+    subscribe_button.click
+  end
+
+  private
+
+  def subscribe_button
+    first('.subscribe-button span')
+  end
+end

features/steps/project/merge_requests.rb

@@ -16,10 +16,18 @@ class Spinach::Features::ProjectMergeRequests < Spinach::FeatureSteps
     click_link "Bug NS-04"
   end
 
+  step 'I click link "Feature NS-05"' do
+    click_link "Feature NS-05"
+  end
+
   step 'I click link "All"' do
     click_link "All"
   end
 
+  step 'I click link "Merged"' do
+    click_link "Merged"
+  end
+
   step 'I click link "Closed"' do
     click_link "Closed"
   end
@@ -40,6 +48,10 @@ class Spinach::Features::ProjectMergeRequests < Spinach::FeatureSteps
     expect(page).to have_content "Bug NS-04"
   end
 
+  step 'I should see merge request "Feature NS-05"' do
+    expect(page).to have_content "Feature NS-05"
+  end
+
   step 'I should not see "master" branch' do
     expect(find('.merge-request-info')).not_to have_content "master"
   end
@@ -120,6 +132,14 @@ class Spinach::Features::ProjectMergeRequests < Spinach::FeatureSteps
            author: project.users.first)
   end
 
+  step 'project "Shop" have "Feature NS-05" merged merge request' do
+    create(:merged_merge_request,
+           title: "Feature NS-05",
+           source_project: project,
+           target_project: project,
+           author: project.users.first)
+  end
+
   step 'project "Shop" have "Bug NS-07" open merge request with rebased branch' do
     create(:merge_request, :rebased,
       title: "Bug NS-07",

features/steps/shared/issuable.rb

@@ -147,6 +147,10 @@ module SharedIssuable
     expect_sidebar_content('2 of 2')
   end
 
+  step 'I should see "3 of 3" in the sidebar' do
+    expect_sidebar_content('3 of 3')
+  end
+
   step 'I click link "Next" in the sidebar' do
     page.within '.issuable-sidebar' do
       click_link 'Next'

lib/banzai/filter/sanitization_filter.rb

@@ -7,7 +7,7 @@ module Banzai
     #
     # Extends HTML::Pipeline::SanitizationFilter with a custom whitelist.
     class SanitizationFilter < HTML::Pipeline::SanitizationFilter
-      UNSAFE_PROTOCOLS = %w(javascript :javascript data vbscript).freeze
+      UNSAFE_PROTOCOLS = %w(data javascript vbscript).freeze
 
       def whitelist
         whitelist = super
@@ -64,7 +64,12 @@ module Banzai
           return unless node.name == 'a'
           return unless node.has_attribute?('href')
 
-          if node['href'].start_with?(*UNSAFE_PROTOCOLS)
+          begin
+            uri = Addressable::URI.parse(node['href'])
+            uri.scheme.strip! if uri.scheme
+
+            node.remove_attribute('href') if UNSAFE_PROTOCOLS.include?(uri.scheme)
+          rescue Addressable::URI::InvalidURIError
             node.remove_attribute('href')
           end
         end

lib/tasks/scss-lint.rake

+unless Rails.env.production?
+  require 'scss_lint/rake_task'
+
+  SCSSLint::RakeTask.new do |t|
+    t.config = '.scss-lint.yml'
+    # See https://github.com/brigade/scss-lint/issues/726
+    # Hack, otherwise linter won't respect scss_files option in config file.
+    t.files = []
+  end
+end

spec/controllers/namespaces_controller_spec.rb

 require 'spec_helper'
 
 describe NamespacesController do
-  let!(:user) { create(:user, :with_avatar) }
+  let!(:user) { create(:user, avatar: fixture_file_upload(Rails.root + "spec/fixtures/dk.png", "image/png")) }
 
   describe "GET show" do
     context "when the namespace belongs to a user" do

spec/controllers/profiles/avatars_controller_spec.rb

 require 'spec_helper'
 
 describe Profiles::AvatarsController do
-  let(:user)    { create(:user, :with_avatar) }
+  let(:user)    { create(:user, avatar: fixture_file_upload(Rails.root + "spec/fixtures/dk.png")) }
 
   before do
     sign_in(user)