Commit d0d54215 authored by 徐豪's avatar 徐豪
Browse files

init

parents

Too many changes to show.

To preserve performance only 330 of 330+ files are displayed.
review-cleanup:
timeout: 15min
extends:
- .default-retry
- .review:rules:review-cleanup
image: ${REVIEW_APPS_IMAGE}
stage: prepare
needs: []
environment:
name: review/regular-cleanup
action: access
variables:
GIT_DEPTH: 1
before_script:
- source scripts/utils.sh
- !reference [".use-kube-context", before_script]
- install_gitlab_gem
- setup_gcloud
script:
- scripts/review_apps/automated_cleanup.rb --dry-run="${DRY_RUN:-false}" || (scripts/slack review-apps-monitoring "☠️ \`${CI_JOB_NAME}\` failed! ☠️ See ${CI_JOB_URL} - <https://gitlab.com/gitlab-org/quality/engineering-productivity/team/-/blob/main/runbooks/review-apps.md#review-cleanup-job-failed|📗 RUNBOOK 📕>" warning "GitLab Bot" && exit 1);
review-stop:
extends:
- review-cleanup
- .review:rules:review-stop
environment:
name: review/${CI_COMMIT_REF_SLUG}${SCHEDULE_TYPE} # No separator for SCHEDULE_TYPE so it's compatible as before and looks nice without it
action: stop
resource_group: review/${CI_COMMIT_REF_SLUG}${SCHEDULE_TYPE} # CI_ENVIRONMENT_SLUG is not available here and we want this to be the same as the environment
before_script:
- source ./scripts/utils.sh
- source ./scripts/review_apps/review-apps.sh
- !reference [".use-kube-context", before_script]
script:
- retry delete_helm_release
.base-review-checks:
extends:
- .default-retry
image: ${REVIEW_APPS_IMAGE}
stage: prepare
before_script:
- source scripts/utils.sh
- setup_gcloud
- !reference [".use-kube-context", before_script]
review-k8s-resources-count-checks:
extends:
- .base-review-checks
- .review:rules:review-k8s-resources-count-checks
needs:
- job: review-cleanup
optional: true
environment:
name: review/k8s-resources-count-checks
action: verify
script:
- scripts/review_apps/k8s-resources-count-checks.sh || (scripts/slack review-apps-monitoring "☠️ \`${CI_JOB_NAME}\` failed! ☠️ See ${CI_JOB_URL} - <https://gitlab.com/gitlab-org/quality/engineering-productivity/team/-/blob/main/runbooks/review-apps.md#review-k8s-resources-count-checks-job-failed|📗 RUNBOOK 📕>" warning "GitLab Bot" && exit 1);
review-gcp-quotas-checks:
extends:
- .base-review-checks
- .review:rules:review-gcp-quotas-checks
needs: []
environment:
name: review/gcp-quotas-checks
action: verify
script:
- ruby scripts/review_apps/gcp-quotas-checks.rb || (scripts/slack review-apps-monitoring "☠️ \`${CI_JOB_NAME}\` failed! ☠️ See ${CI_JOB_URL} - <https://gitlab.com/gitlab-org/quality/engineering-productivity/team/-/blob/main/runbooks/review-apps.md#review-gcp-quotas-checks-job-failed|📗 RUNBOOK 📕>" warning "GitLab Bot" && exit 1);
start-review-app-pipeline:
extends:
- .review:rules:start-review-app-pipeline
resource_group: review/${CI_COMMIT_REF_SLUG}${SCHEDULE_TYPE} # CI_ENVIRONMENT_SLUG is not available here and we want this to be the same as the environment
stage: review
needs:
- job: rails-production-server-boot-puma-example
optional: true
- job: rails-production-server-boot-puma-cng
optional: true
- job: build-assets-image
artifacts: false
# We do not want to have ALL global variables passed as trigger variables,
# as they cannot be overridden. See this issue for more context:
#
# https://gitlab.com/gitlab-org/gitlab/-/issues/387183
inherit:
variables:
- REGISTRY_GROUP
- REGISTRY_HOST
- REVIEW_APPS_DOMAIN
- REVIEW_APPS_GCP_PROJECT
- REVIEW_APPS_GCP_REGION
- REVIEW_APPS_IMAGE
- RUBY_VERSION_DEFAULT
- RUBY_VERSION_NEXT
- RUBY_VERSION
- BUILD_OS
- OS_VERSION
- DOCKER_VERSION
- CHROME_VERSION
# These variables are set in the pipeline schedules.
# They need to be explicitly passed on to the child pipeline.
# https://docs.gitlab.com/ee/ci/pipelines/multi_project_pipelines.html#pass-cicd-variables-to-a-downstream-pipeline-by-using-the-variables-keyword
variables:
# This is needed by `review-build-cng-env` (`.gitlab/ci/review-apps/main.gitlab-ci.yml`).
PARENT_PIPELINE_ID: $CI_PIPELINE_ID
SCHEDULE_TYPE: $SCHEDULE_TYPE
DAST_RUN: $DAST_RUN
trigger:
strategy: depend
include:
- local: .gitlab/ci/review-apps/main.gitlab-ci.yml
##############
# Conditions #
##############
.if-not-canonical-namespace: &if-not-canonical-namespace
if: '$CI_PROJECT_NAMESPACE !~ /^gitlab(-org|-cn)?($|\/)/'
.if-not-ee: &if-not-ee
# Only consider FOSS not EE
if: '$CI_PROJECT_NAME !~ /^gitlab(-ee)?$/ && $CI_PROJECT_NAME !~ /^gitlab-jh/'
.if-not-foss: &if-not-foss
if: '$CI_PROJECT_NAME != "gitlab-foss" && $CI_PROJECT_NAME != "gitlab-ce" && $CI_PROJECT_NAME != "gitlabhq"'
.if-jh: &if-jh
# Matches these two projects:
# https://jihulab.com/gitlab-cn/gitlab
# https://gitlab.com/gitlab-org-sandbox/gitlab-jh-validation
if: '$CI_PROJECT_PATH == "gitlab-cn/gitlab" || $CI_PROJECT_PATH == "gitlab-org-sandbox/gitlab-jh-validation"'
.if-force-ci: &if-force-ci
if: '$FORCE_GITLAB_CI'
.if-default-refs: &if-default-refs
if: '$CI_COMMIT_REF_NAME == $CI_DEFAULT_BRANCH || $CI_COMMIT_REF_NAME =~ /^[\d-]+-stable(-ee)?$/ || $CI_COMMIT_REF_NAME =~ /^\d+-\d+-auto-deploy-\d+$/ || $CI_COMMIT_REF_NAME =~ /^security\// || $CI_COMMIT_REF_NAME =~ /^ruby\d+(_\d)*$/ || ($CI_MERGE_REQUEST_EVENT_TYPE == "merged_result" || $CI_MERGE_REQUEST_EVENT_TYPE == "detached") || $CI_COMMIT_TAG || $FORCE_GITLAB_CI'
.if-default-branch-refs: &if-default-branch-refs
if: '$CI_COMMIT_REF_NAME == $CI_DEFAULT_BRANCH && $CI_MERGE_REQUEST_IID == null'
.if-auto-deploy-branches: &if-auto-deploy-branches
if: '$CI_COMMIT_BRANCH =~ /^\d+-\d+-auto-deploy-\d+$/'
.if-default-branch-or-tag: &if-default-branch-or-tag
if: '($CI_COMMIT_REF_NAME == $CI_DEFAULT_BRANCH && $CI_MERGE_REQUEST_IID == null) || $CI_COMMIT_TAG'
.if-tag: &if-tag
if: '$CI_COMMIT_TAG'
.if-merge-request: &if-merge-request
if: '$CI_MERGE_REQUEST_EVENT_TYPE == "merged_result" || $CI_MERGE_REQUEST_EVENT_TYPE == "detached"'
.if-not-merge-request: &if-not-merge-request
if: '$CI_MERGE_REQUEST_EVENT_TYPE == null'
# Once https://gitlab.com/gitlab-org/gitlab/-/issues/373904 is implemented, we should be able to change this back to
# if: '($CI_MERGE_REQUEST_EVENT_TYPE == "merged_result" || $CI_MERGE_REQUEST_EVENT_TYPE == "detached") && $CI_MERGE_REQUEST_APPROVALS_COUNT > 0'
# or any similar condition to check that the MR has *any* approval (not just required approval).
.if-merge-request-approved: &if-merge-request-approved
if: '($CI_MERGE_REQUEST_EVENT_TYPE == "merged_result" || $CI_MERGE_REQUEST_EVENT_TYPE == "detached") && $CI_MERGE_REQUEST_LABELS =~ /pipeline:mr-approved/'
.if-merge-request-not-approved: &if-merge-request-not-approved
if: '($CI_MERGE_REQUEST_EVENT_TYPE == "merged_result" || $CI_MERGE_REQUEST_EVENT_TYPE == "detached") && $CI_MERGE_REQUEST_LABELS !~ /pipeline:mr-approved/'
.if-merge-request-and-specific-devops-stage: &if-merge-request-and-specific-devops-stage
if: '($CI_MERGE_REQUEST_EVENT_TYPE == "merged_result" || $CI_MERGE_REQUEST_EVENT_TYPE == "detached") && $CI_MERGE_REQUEST_LABELS =~ /devops::(create|govern|manage|plan|verify|package|monitor|data stores|fulfillment|systems)/'
.if-merge-request-and-devops-fulfillment: &if-merge-request-and-devops-fulfillment
if: '($CI_MERGE_REQUEST_EVENT_TYPE == "merged_result" || $CI_MERGE_REQUEST_EVENT_TYPE == "detached") && $CI_MERGE_REQUEST_LABELS =~ /devops::fulfillment/'
.if-automated-merge-request: &if-automated-merge-request
if: '($CI_MERGE_REQUEST_EVENT_TYPE == "merged_result" || $CI_MERGE_REQUEST_EVENT_TYPE == "detached") && ($CI_MERGE_REQUEST_SOURCE_BRANCH_NAME == "release-tools/update-gitaly" || $CI_MERGE_REQUEST_TARGET_BRANCH_NAME =~ /stable-(ee|jh)$/)'
.if-merge-request-targeting-stable-branch: &if-merge-request-targeting-stable-branch
if: '($CI_MERGE_REQUEST_EVENT_TYPE == "merged_result" || $CI_MERGE_REQUEST_EVENT_TYPE == "detached") && $CI_MERGE_REQUEST_TARGET_BRANCH_NAME =~ /^[\d-]+-stable(-ee|-jh)?$/'
.if-merge-request-labels-as-if-foss: &if-merge-request-labels-as-if-foss
if: '($CI_MERGE_REQUEST_EVENT_TYPE == "merged_result" || $CI_MERGE_REQUEST_EVENT_TYPE == "detached") && $CI_MERGE_REQUEST_LABELS =~ /pipeline:run-as-if-foss/'
.if-merge-request-labels-as-if-jh: &if-merge-request-labels-as-if-jh
if: '($CI_MERGE_REQUEST_EVENT_TYPE == "merged_result" || $CI_MERGE_REQUEST_EVENT_TYPE == "detached") && $CI_MERGE_REQUEST_LABELS =~ /pipeline:run-as-if-jh/'
.if-merge-request-labels-force-as-if-jh: &if-merge-request-labels-force-as-if-jh
if: '($CI_MERGE_REQUEST_EVENT_TYPE == "merged_result" || $CI_MERGE_REQUEST_EVENT_TYPE == "detached") && $CI_MERGE_REQUEST_LABELS =~ /pipeline:force-run-as-if-jh/'
.if-merge-request-labels-update-caches: &if-merge-request-labels-update-caches
if: '($CI_MERGE_REQUEST_EVENT_TYPE == "merged_result" || $CI_MERGE_REQUEST_EVENT_TYPE == "detached") && $CI_MERGE_REQUEST_LABELS =~ /pipeline:update-cache/'
.if-merge-request-labels-run-all-rspec: &if-merge-request-labels-run-all-rspec
if: '($CI_MERGE_REQUEST_EVENT_TYPE == "merged_result" || $CI_MERGE_REQUEST_EVENT_TYPE == "detached") && $CI_MERGE_REQUEST_LABELS =~ /pipeline:run-all-rspec/'
.if-merge-request-labels-run-all-jest: &if-merge-request-labels-run-all-jest
if: '($CI_MERGE_REQUEST_EVENT_TYPE == "merged_result" || $CI_MERGE_REQUEST_EVENT_TYPE == "detached") && $CI_MERGE_REQUEST_LABELS =~ /pipeline:run-all-jest/'
.if-merge-request-labels-run-all-e2e: &if-merge-request-labels-run-all-e2e
if: '($CI_MERGE_REQUEST_EVENT_TYPE == "merged_result" || $CI_MERGE_REQUEST_EVENT_TYPE == "detached") && $CI_MERGE_REQUEST_LABELS =~ /pipeline:run-all-e2e/'
.if-merge-request-labels-run-single-db: &if-merge-request-labels-run-single-db
if: '($CI_MERGE_REQUEST_EVENT_TYPE == "merged_result" || $CI_MERGE_REQUEST_EVENT_TYPE == "detached") && $CI_MERGE_REQUEST_LABELS =~ /pipeline:run-single-db/'
.if-merge-request-labels-run-clusterwide-db: &if-merge-request-labels-run-clusterwide-db
if: '($CI_MERGE_REQUEST_EVENT_TYPE == "merged_result" || $CI_MERGE_REQUEST_EVENT_TYPE == "detached") && $CI_MERGE_REQUEST_LABELS =~ /pipeline:run-clusterwide-db/'
.if-merge-request-labels-run-review-app: &if-merge-request-labels-run-review-app
if: '($CI_MERGE_REQUEST_EVENT_TYPE == "merged_result" || $CI_MERGE_REQUEST_EVENT_TYPE == "detached") && $CI_MERGE_REQUEST_LABELS =~ /pipeline:run-review-app/'
.if-merge-request-labels-run-cs-evaluation: &if-merge-request-labels-run-cs-evaluation
if: '($CI_MERGE_REQUEST_EVENT_TYPE == "merged_result" || $CI_MERGE_REQUEST_EVENT_TYPE == "detached") && $CI_MERGE_REQUEST_LABELS =~ /pipeline:run-CS-evaluation/'
.if-merge-request-labels-skip-undercoverage: &if-merge-request-labels-skip-undercoverage
if: '($CI_MERGE_REQUEST_EVENT_TYPE == "merged_result" || $CI_MERGE_REQUEST_EVENT_TYPE == "detached") && $CI_MERGE_REQUEST_LABELS =~ /pipeline:skip-undercoverage/'
.if-merge-request-labels-jh-contribution: &if-merge-request-labels-jh-contribution
if: '($CI_MERGE_REQUEST_EVENT_TYPE == "merged_result" || $CI_MERGE_REQUEST_EVENT_TYPE == "detached") && $CI_MERGE_REQUEST_LABELS =~ /JiHu contribution/'
.if-merge-request-labels-group-global-search: &if-merge-request-labels-group-global-search
if: '($CI_MERGE_REQUEST_EVENT_TYPE == "merged_result" || $CI_MERGE_REQUEST_EVENT_TYPE == "detached") && $CI_MERGE_REQUEST_LABELS =~ /group::global search/'
.if-merge-request-labels-pipeline-expedite: &if-merge-request-labels-pipeline-expedite
if: '($CI_MERGE_REQUEST_EVENT_TYPE == "merged_result" || $CI_MERGE_REQUEST_EVENT_TYPE == "detached") && ($CI_MERGE_REQUEST_LABELS =~ /pipeline::expedited/ || $CI_MERGE_REQUEST_LABELS =~ /pipeline:expedite/)'
.if-merge-request-labels-frontend-and-feature-flag: &if-merge-request-labels-frontend-and-feature-flag
if: '($CI_MERGE_REQUEST_EVENT_TYPE == "merged_result" || $CI_MERGE_REQUEST_EVENT_TYPE == "detached") && $CI_MERGE_REQUEST_LABELS =~ /frontend/ && $CI_MERGE_REQUEST_LABELS =~ /feature flag/'
.if-merge-request-labels-run-praefect-with-db: &if-merge-request-labels-run-praefect-with-db
if: '($CI_MERGE_REQUEST_EVENT_TYPE == "merged_result" || $CI_MERGE_REQUEST_EVENT_TYPE == "detached") && $CI_MERGE_REQUEST_LABELS =~ /pipeline:run-praefect-with-db/'
.if-merge-request-labels-run-without-gitaly-transactions: &if-merge-request-labels-run-without-gitaly-transactions
if: '($CI_MERGE_REQUEST_EVENT_TYPE == "merged_result" || $CI_MERGE_REQUEST_EVENT_TYPE == "detached") && $CI_MERGE_REQUEST_LABELS =~ /run-without-gitaly-transactions/'
.if-security-merge-request: &if-security-merge-request
if: '($CI_MERGE_REQUEST_EVENT_TYPE == "merged_result" || $CI_MERGE_REQUEST_EVENT_TYPE == "detached") && $CI_PROJECT_NAMESPACE == "gitlab-org/security"'
.if-fork-merge-request: &if-fork-merge-request
if: '($CI_MERGE_REQUEST_EVENT_TYPE == "merged_result" || $CI_MERGE_REQUEST_EVENT_TYPE == "detached") && $CI_PROJECT_NAMESPACE !~ /^gitlab(-org)?($|\/)/ && $CI_MERGE_REQUEST_LABELS !~ /pipeline:run-all-rspec/'
.if-merge-request-no-tier: &if-merge-request-no-tier
if: '($CI_MERGE_REQUEST_EVENT_TYPE == "merged_result" || $CI_MERGE_REQUEST_EVENT_TYPE == "detached") && $CI_MERGE_REQUEST_LABELS !~ /pipeline::tier-/'
.if-merge-request-tier-1: &if-merge-request-tier-1
if: '($CI_MERGE_REQUEST_EVENT_TYPE == "merged_result" || $CI_MERGE_REQUEST_EVENT_TYPE == "detached") && $CI_MERGE_REQUEST_LABELS =~ /pipeline::tier-1/'
.if-merge-request-tier-2: &if-merge-request-tier-2
if: '($CI_MERGE_REQUEST_EVENT_TYPE == "merged_result" || $CI_MERGE_REQUEST_EVENT_TYPE == "detached") && $CI_MERGE_REQUEST_LABELS =~ /pipeline::tier-2/'
.if-merge-request-tier-3: &if-merge-request-tier-3
if: '($CI_MERGE_REQUEST_EVENT_TYPE == "merged_result" || $CI_MERGE_REQUEST_EVENT_TYPE == "detached") && $CI_MERGE_REQUEST_LABELS =~ /pipeline::tier-3/'
.if-schedule-pipeline: &if-schedule-pipeline
if: '$CI_PIPELINE_SOURCE == "schedule"'
.if-schedule-maintenance: &if-schedule-maintenance
if: '$CI_PIPELINE_SOURCE == "schedule" && $SCHEDULE_TYPE == "maintenance"'
.if-default-branch-schedule-nightly: &if-default-branch-schedule-nightly
if: '$CI_COMMIT_BRANCH == $CI_DEFAULT_BRANCH && $CI_PIPELINE_SOURCE == "schedule" && $SCHEDULE_TYPE == "nightly"'
.if-ruby-branch-schedule-nightly: &if-ruby-branch-schedule-nightly
if: '$CI_COMMIT_BRANCH =~ /^ruby\d+(_\d)*$/ && $CI_PIPELINE_SOURCE == "schedule" && $SCHEDULE_TYPE == "nightly"'
.if-security-schedule: &if-security-schedule
if: '$CI_PROJECT_NAMESPACE == "gitlab-org/security" && $CI_PIPELINE_SOURCE == "schedule"'
.if-foss-schedule: &if-foss-schedule
if: '$CI_PROJECT_PATH == "gitlab-org/gitlab-foss" && $CI_PIPELINE_SOURCE == "schedule"'
.if-foss-default-branch: &if-foss-default-branch
if: '$CI_PROJECT_PATH == "gitlab-org/gitlab-foss" && $CI_COMMIT_REF_NAME == $CI_DEFAULT_BRANCH'
.if-not-dot-com-gitlab-org-and-not-jihulab: &if-not-dot-com-gitlab-org-and-not-jihulab
if: '($CI_SERVER_HOST != "gitlab.com" || $CI_PROJECT_NAMESPACE != "gitlab-org") && ($CI_SERVER_HOST != "jihulab.com" || $CI_PROJECT_NAMESPACE != "gitlab-cn")'
.if-dot-com-gitlab-org-schedule: &if-dot-com-gitlab-org-schedule
if: '$CI_SERVER_HOST == "gitlab.com" && $CI_PROJECT_NAMESPACE == "gitlab-org" && $CI_PIPELINE_SOURCE == "schedule"'
.if-dot-com-ee-schedule-default-branch-maintenance: &if-dot-com-ee-schedule-default-branch-maintenance
if: '$CI_SERVER_HOST == "gitlab.com" && $CI_PROJECT_PATH == "gitlab-org/gitlab" && $CI_COMMIT_BRANCH == $CI_DEFAULT_BRANCH && $CI_PIPELINE_SOURCE == "schedule" && $SCHEDULE_TYPE == "maintenance"'
.if-dot-com-gitlab-org-default-branch: &if-dot-com-gitlab-org-default-branch
if: '$CI_SERVER_HOST == "gitlab.com" && $CI_PROJECT_NAMESPACE == "gitlab-org" && $CI_COMMIT_REF_NAME == $CI_DEFAULT_BRANCH'
.if-dot-com-gitlab-org-merge-request: &if-dot-com-gitlab-org-merge-request
if: '($CI_MERGE_REQUEST_EVENT_TYPE == "merged_result" || $CI_MERGE_REQUEST_EVENT_TYPE == "detached") && $CI_SERVER_HOST == "gitlab.com" && $CI_PROJECT_NAMESPACE == "gitlab-org"'
.if-dot-com-gitlab-org-and-subgroups-merge-train: &if-dot-com-gitlab-org-and-subgroups-merge-train
if: '$CI_MERGE_REQUEST_EVENT_TYPE == "merge_train" && $CI_SERVER_HOST == "gitlab.com" && $CI_PROJECT_NAMESPACE =~ /^gitlab-org/'
.if-dot-com-gitlab-org-ee-tag: &if-dot-com-gitlab-org-ee-tag
if: '$CI_SERVER_HOST == "gitlab.com" && $CI_PROJECT_PATH == "gitlab-org/gitlab" && $CI_COMMIT_TAG =~ /^v?[\d]+\.[\d]+\.[\d]+[\d\w-]*-ee$/'
.if-dot-com-gitlab-org-security-ee-tag: &if-dot-com-gitlab-org-security-ee-tag
if: '$CI_SERVER_HOST == "gitlab.com" && $CI_PROJECT_PATH == "gitlab-org/security/gitlab" && $CI_COMMIT_TAG =~ /^v?[\d]+\.[\d]+\.[\d]+[\d\w-]*-ee$/'
.if-ruby-branch: &if-ruby-branch
if: '$CI_COMMIT_BRANCH =~ /^ruby\d+(_\d)*$/ || (($CI_MERGE_REQUEST_EVENT_TYPE == "merged_result" || $CI_MERGE_REQUEST_EVENT_TYPE == "detached") && $CI_MERGE_REQUEST_LABELS =~ /pipeline:run-in-ruby\d+(_\d)*/)'
####################
# Changes patterns #
####################
.ci-patterns: &ci-patterns
- "{,jh/}.gitlab-ci.yml"
- "{,jh/}.gitlab/ci/**/*"
- "scripts/rspec_helpers.sh"
.ci-build-images-patterns: &ci-build-images-patterns
- ".gitlab-ci.yml"
- ".gitlab/ci/build-images.gitlab-ci.yml"
.ci-review-patterns: &ci-review-patterns
- ".gitlab-ci.yml"
- ".gitlab/ci/frontend.gitlab-ci.yml"
- ".gitlab/ci/build-images.gitlab-ci.yml"
- ".gitlab/ci/review.gitlab-ci.yml"
- ".gitlab/ci/cng/**/*"
- ".gitlab/ci/review-apps/**/*"
- "scripts/review_apps/**/*"
- "scripts/trigger-build.rb"
- "{,ee/,jh/}{bin,config}/**/*.rb"
.ci-templates-patterns: &ci-templates-patterns
- ".gitlab/ci/static-analysis.gitlab-ci.yml"
- "lib/gitlab/ci/templates/**/*.gitlab-ci.yml"
.ci-qa-patterns: &ci-qa-patterns
- ".gitlab-ci.yml"
- ".gitlab/ci/frontend.gitlab-ci.yml"
- ".gitlab/ci/build-images.gitlab-ci.yml"
- ".gitlab/ci/qa.gitlab-ci.yml"
- ".gitlab/ci/package-and-test/*.yml"
- ".gitlab/ci/review-apps/qa.gitlab-ci.yml"
- ".gitlab/ci/review-apps/rules.gitlab-ci.yml"
- ".gitlab/ci/test-on-gdk/*.yml"
.gitaly-patterns: &gitaly-patterns
- "GITALY_SERVER_VERSION"
- "lib/gitlab/setup_helper.rb"
.workhorse-patterns: &workhorse-patterns
- ".gitlab/ci/workhorse.gitlab-ci.yml"
- "GITLAB_WORKHORSE_VERSION"
- "workhorse/**/*"
- "scripts/gitaly-test-build"
- "scripts/gitaly-test-spawn"
- "spec/support/gitlab-git-test.git/**/*"
- "spec/support/helpers/gitaly_setup.rb"
# Verify that Gitaly does not break Workhorse
- "GITALY_SERVER_VERSION"
- "lib/gitlab/setup_helper.rb"
.yaml-lint-patterns: &yaml-lint-patterns
- "**/*.{yml,yaml}{,.*}"
.lint-pipeline-yaml-patterns: &lint-pipeline-yaml-patterns
- ".gitlab-ci.yml"
- ".gitlab/ci/**/*.yml"
- "lib/gitlab/ci/templates/**/*.yml"
- "data/deprecations/**/*.yml"
- "data/whats_new/**/*.yml"
.lint-metrics-yaml-patterns: &lint-metrics-yaml-patterns
- "config/metrics/**/*.yml"
.docs-patterns: &docs-patterns
- ".gitlab/ci/docs.gitlab-ci.yml"
- ".gitlab/route-map.yml"
- ".markdownlint-cli2.yaml"
- "doc/**/*"
- "scripts/lint-doc.sh"
- "scripts/lint/check_mermaid.mjs"
.docs-blueprints-patterns: &docs-blueprints-patterns
- "doc/architecture/blueprints/**/*"
- "scripts/lint-docs-blueprints.rb"
- ".gitlab/ci/docs.gitlab-ci.yml"
.docs-deprecations-and-removals-patterns: &docs-deprecations-and-removals-patterns
- "doc/update/deprecations.md"
- "data/deprecations/**/*"
- "tooling/docs/**/*"
- "lib/tasks/gitlab/docs/compile_deprecations.rake"
.bundler-patterns: &bundler-patterns
- '{Gemfile.lock,*/Gemfile.lock,*/*/Gemfile.lock}'
.nodejs-patterns: &nodejs-patterns
- '{package.json,*/package.json,*/*/package.json}'
- '{yarn.lock,*/yarn.lock,*/*/yarn.lock}'
.python-patterns: &python-patterns
- '{Pipfile,*/Pipfile,*/*/Pipfile}'
.dependency-patterns: &dependency-patterns
- '{Gemfile.lock,*/Gemfile.lock,*/*/Gemfile.lock}'
- '{go.sum,*/go.sum,*/*/go.sum}'
- '{yarn.lock,*/yarn.lock,*/*/yarn.lock}'
.frontend-dependency-patterns: &frontend-dependency-patterns
- "{package.json,yarn.lock}"
- "config/webpack.config.js"
- "config/helpers/*.js"
.frontend-build-patterns: &frontend-build-patterns
- "{package.json,yarn.lock}"
- ".browserslistrc"
- "babel.config.js"
- "config/webpack.config.js"
- "config/**/*.js"
- "{,ee/,jh/}app/assets/**/*"
- "vendor/assets/**/*"
# This list should match the list in Tasks::Gitlab::Assets.assets_impacting_compilation
.assets-compilation-patterns: &assets-compilation-patterns
- "{package.json,yarn.lock}"
- "{Gemfile,Gemfile.lock}"
- ".browserslistrc"
- "babel.config.js"
- "config/webpack.config.js"
- "*.js"
- "config/**/*.js"
- "locale/**/gitlab.po"
- "{,ee/,jh/}app/assets/**/*"
- "fixtures/emojis/**/*"
- "vendor/assets/**/*"
.initializers-patterns: &initializers-patterns
- "{,ee/,jh/}config/initializers/**/*"
.controllers-patterns: &controllers-patterns
- "{,ee/,jh/}{app/controllers}/**/*"
.models-patterns: &models-patterns
- "{,ee/,jh/}{app/models}/**/*"
.decomposed-db-models-patterns: &decomposed-db-models-patterns
- "{,ee/,jh/}app/models/{ci,geo}/**/*"
.lib-gitlab-patterns: &lib-gitlab-patterns
- "{,ee/,jh/}lib/{,ee/,jh/}gitlab/**/*"
# Patterns to match pure Ruby code
.ruby-patterns: &ruby-patterns
- "**/Rakefile"
- "**/Dangerfile"
- "**/Gemfile"
- "**/Guardfile"
- "**/*.rake"
- "**/*.rb"
- "**/*.ru"
# Backend patterns + .ci-patterns
.backend-patterns: &backend-patterns
- "{,jh/}Gemfile{,.lock}"
- "Rakefile"
- "config.ru"
- "keeps/**/*"
# List explicitly all the app/ dirs that are backend (i.e. all except app/assets).
- "{,ee/,jh/}{app/channels,app/components,app/controllers,app/finders,app/graphql,app/helpers,app/mailers,app/models,app/policies,app/presenters,app/serializers,app/services,app/uploaders,app/validators,app/views,app/workers}/**/*"
- "{,ee/,jh/}{bin,config,db,elastic,gems,generator_templates,lib}/**/*"
- "{,ee/,jh/}spec/**/*"
# CI changes
- "{,jh/}.gitlab-ci.yml"
- "{,jh/}.gitlab/ci/**/*"
- "*_VERSION"
- "scripts/rspec_helpers.sh"
# Mapped patterns (see tests.yml)
- "data/whats_new/*.yml"
- "doc/index.md"
.search-backend-patterns: &search-backend-patterns
- "{,jh/}Gemfile.lock"
- "GITLAB_ELASTICSEARCH_INDEXER_VERSION"
# List explicitly all the app/ dirs that are backend (i.e. all except app/assets).
- "{,ee/,jh/}{app/channels,app/components,app/controllers,app/finders,app/graphql,app/helpers,app/mailers,app/models,app/policies,app/presenters,app/serializers,app/services,app/uploaders,app/validators,app/views,app/workers}/**/*"
- "{,ee/,jh/}{bin,config,db,elastic,gems,generator_templates,lib}/**/*"
- "{,ee/,jh/}spec/**/*"
# Redis patterns
.redis-patterns: &redis-patterns
- "{,ee/,jh/}{,spec/}app/models/concerns/redis_cacheable{,_spec}.rb"
- "{,ee/,jh/}{,spec/}app/models/ci/build_trace_chunks/redis{,_base,_trace_chunks}{,_spec}.rb"
- "{,ee/,jh/}{,spec/}lib/{,ee/,jh/}gitlab/usage_data_counters/{hll_redis_counter,redis_counter}{,_spec}.rb"
- "{,ee/,jh/}{,spec/}lib/{,ee/,jh/}gitlab/usage/metrics/instrumentations/redis{_metric,hll_metric}{,_spec}.rb"
- "{,ee/,jh/}{,spec/}lib/{,ee/,jh/}gitlab/merge_requests/mergeability/redis_interface{,_spec}.rb"
- "{,ee/,jh/}{,spec/}lib/{,ee/,jh/}gitlab/markdown_cache/redis/*.rb"
- "{,ee/,jh/}{,spec/}lib/{,ee/,jh/}gitlab/redis/**/*.rb"
- "{,ee/,jh/}{,spec/}lib/{,ee/,jh/}gitlab/instrumentation/*.rb"
- "{,ee/,jh/}{,spec/}lib/{,ee/,jh/}gitlab/redis.rb"
- "{,ee/,jh/}config/initializers/7_redis.rb"
# AI patterns:
.ai-patterns: &ai-patterns
- "{ee/,jh/}lib/gitlab/llm/**/*"
- "{ee/,jh/}{,spec/}lib/gitlab/llm/**/*"
- "{ee/,jh/}lib/gitlab/duo/**/*"
# For AI Gateway image update
- .gitlab/ci/global.gitlab-ci.yml
# DB patterns + .ci-patterns
.db-patterns: &db-patterns
- "{,ee/,jh/}{,spec/}{db,migrations}/**/*"
- "{,ee/,jh/}{,spec/}lib/{,ee/,jh/}gitlab/background_migration{,_spec}.rb"
- "{,ee/,jh/}{,spec/}lib/{,ee/,jh/}gitlab/background_migration/**/*"
- "{,ee/,jh/}{,spec/}lib/{,ee/,jh/}gitlab/database{,_spec}.rb"
- "{,ee/,jh/}{,spec/}lib/{,ee/,jh/}gitlab/database/**/*"
- "{,ee/,jh/}spec/support/db_cleaner.rb"
- "{,ee/,jh/}spec/support/helpers/database/**/*"
- "{,ee/,jh/}spec/support/helpers/migrations_helpers/**/*"
- "lib/api/admin/batched_background_migrations.rb"
- "lib/gitlab/markdown_cache/active_record/**/*"
- "spec/requests/api/admin/batched_background_migrations_spec.rb"
- "spec/support/database_cleaner.rb"
- "config/prometheus/common_metrics.yml" # Used by Gitlab::DatabaseImporters::CommonMetrics::Importer
- "{,ee/,jh/}app/models/project_statistics.rb" # Used to calculate sizes in migration specs
- "{,ee/,jh/}app/{,models/,services/,workers/}loose_foreign_keys/**/*"
# Gitaly has interactions with background migrations: https://gitlab.com/gitlab-org/gitlab/-/issues/336538
- "GITALY_SERVER_VERSION"
- "lib/gitlab/setup_helper.rb"
# Test-gap from https://gitlab.com/gitlab-org/quality/engineering-productivity/team/-/issues/275
- "{,ee/,jh/}lib/tasks/gitlab/seed/*.rake"
# DB backup patterns
.db-backup-patterns: &db-backup-patterns
- "lib/backup/**/*"
- "lib/tasks/gitlab/backup.rake"
.db-library-patterns: &db-library-patterns
- "{,ee/,jh/}{,spec/}lib/{,ee/,jh/}gitlab/database/**/*"
- "{,ee/,jh/}{,spec/}lib/{,ee/,jh/}gitlab/database{,_spec}.rb"
- "{,ee/,jh/}spec/support/helpers/database/**/*"
.backstage-patterns: &backstage-patterns
- "Dangerfile"
- "danger/**/*"
- "{,ee/,jh/}fixtures/**/*"
- "{,ee/,jh/}rubocop/**/*"
- "{,ee/,jh/}spec/**/*"
- "scripts/**/*"
- "{,spec/}tooling/**/*"
.qa-patterns: &qa-patterns
- ".dockerignore"
- "{,jh/}qa/**/*"
- ".gitlab/ci/{package-and-test,qa-common,test-on-cng,test-on-gdk}/*"
# See https://gitlab.com/gitlab-org/quality/engineering-productivity/team/-/issues/470
# for the reasons why we only match those patterns.
.frontend-predictive-patterns: &frontend-predictive-patterns
- "{,ee/,jh/}{app/assets/javascripts,spec/frontend}/**/*"
# Frontend view patterns + .qa-patterns
.frontend-qa-patterns: &frontend-qa-patterns
- "{,ee/,jh/}{app/assets,app/components,app/helpers,app/presenters,app/views}/**/*"
# QA changes
- "{,jh/}qa/**/*"
# Code patterns + .ci-patterns
.code-patterns: &code-patterns
- ".{eslintrc.yml,eslintignore,gitattributes,nvmrc,prettierrc,stylelintrc,yamllint}"
- ".browserslistrc"
- ".stylelintrc"
- "{,ee/,jh/}{app,bin,config,db,elastic,generator_templates,gems,haml_lint,lib,locale,public,scripts,sidekiq_cluster,storybook,symbol,vendor}/**/*"
- "{,jh/}Gemfile{,.lock}"
- "{package.json,yarn.lock}"
- "*_VERSION"
- "lib/gitlab/redis/*"
- "babel.config.js"
- "config.ru"
- "Dockerfile.assets"
- "jest.config.{base,integration,unit}.js"
- "keeps/**/*"
- "Rakefile"
- "tests.yml"
- "vendor/assets/**/*"
# Auto-generated files
- "doc/api/graphql/reference/*"
# CI changes
- "{,jh/}.gitlab-ci.yml"
- "{,jh/}.gitlab/ci/**/*"
# Mapped patterns (see tests.yml)
- "data/whats_new/*.yml"
- "doc/index.md"
# .code-patterns + .backstage-patterns
.code-backstage-patterns: &code-backstage-patterns
- ".{eslintrc.yml,eslintignore,gitattributes,nvmrc,prettierrc,stylelintrc,yamllint}"
- ".browserslistrc"
- ".stylelintrc"
- "{,ee/,jh/}{app,bin,config,db,elastic,generator_templates,gems,haml_lint,lib,locale,public,scripts,sidekiq_cluster,storybook,symbol,vendor}/**/*"
- "{,jh/}Gemfile{,.lock}"
- "{package.json,yarn.lock}"
- "*_VERSION"
- "babel.config.js"
- "config.ru"
- "Dockerfile.assets"
- "jest.config.{base,integration,unit}.js"
- "keeps/**/*"
- "Rakefile"
- "tests.yml"
- "vendor/assets/**/*"
# Auto-generated files
- "doc/api/graphql/reference/*"
# CI changes
- "{,jh/}.gitlab-ci.yml"
- "{,jh/}.gitlab/ci/**/*"
# Mapped patterns (see tests.yml)
- "data/whats_new/*.yml"
- "doc/index.md"
# Backstage changes
- "Dangerfile"
- "danger/**/*"
- "{,ee/,jh/}fixtures/**/*"
- "{,ee/,jh/}rubocop/**/*"
- "{,ee/,jh/}spec/**/*"
- "{,spec/}tooling/**/*"
# .code-patterns + .qa-patterns
.code-qa-patterns: &code-qa-patterns
- ".{eslintrc.yml,eslintignore,gitattributes,nvmrc,prettierrc,stylelintrc,yamllint}"
- ".browserslistrc"
- ".stylelintrc"
- "{,ee/,jh/}{app,bin,config,db,elastic,generator_templates,gems,haml_lint,lib,locale,public,scripts,sidekiq_cluster,storybook,symbol,vendor}/**/*"
- "{,jh/}Gemfile{,.lock}"
- "{package.json,yarn.lock}"
- "*_VERSION"
- "babel.config.js"
- "config.ru"
- "Dockerfile.assets"
- "jest.config.{base,integration,unit}.js"
- "keeps/**/*"
- "Rakefile"
- "tests.yml"
- "vendor/assets/**/*"
# Auto-generated files
- "doc/api/graphql/reference/*"
# CI changes
- "{,jh/}.gitlab-ci.yml"
- "{,jh/}.gitlab/ci/**/*"
# Mapped patterns (see tests.yml)
- "data/whats_new/*.yml"
- "doc/index.md"
# QA changes
- ".dockerignore"
- "{,jh/}qa/**/*"
# .code-patterns + .backstage-patterns + .qa-patterns
.code-backstage-qa-patterns: &code-backstage-qa-patterns
- ".{eslintrc.yml,eslintignore,gitattributes,nvmrc,prettierrc,stylelintrc,yamllint}"
- ".browserslistrc"
- ".stylelintrc"
- "{,ee/,jh/}{app,bin,config,db,elastic,generator_templates,gems,haml_lint,lib,locale,public,scripts,sidekiq_cluster,storybook,symbol,vendor}/**/*"
- "{,jh/}Gemfile{,.lock}"
- "{package.json,yarn.lock}"
- "*_VERSION"
- "babel.config.js"
- "config.ru"
- "Dockerfile.assets"
- "jest.config.{base,integration,unit}.js"
- "keeps/**/*"
- "Rakefile"
- "tests.yml"
- "vendor/assets/**/*"
# Auto-generated files
- "doc/api/graphql/reference/*"
# CI changes
- "{,jh/}.gitlab-ci.yml"
- "{,jh/}.gitlab/ci/**/*"
# Backstage changes
- "Dangerfile"
- "danger/**/*"
- "{,ee/,jh/}fixtures/**/*"
- "{,ee/,jh/}rubocop/**/*"
- "{,ee/,jh/}spec/**/*"
- "{,spec/}tooling/**/*"
# QA changes
- ".dockerignore"
- "{,jh/}qa/**/*"
# Mapped patterns (see tests.yml)
- "data/whats_new/*.yml"
- "doc/index.md"
# .code-backstage-qa-patterns + .workhorse-patterns
# NOTE: `setup-test-env-patterns` intentionally does not include docs files, because this would
# result in docs-only pipelines having failures of jobs which use `setup-test-env-patterns`
# in their rules and thus require `setup-test-env`, which isn't present in docs-only pipelines.
.setup-test-env-patterns: &setup-test-env-patterns
- "{package.json,yarn.lock}"
- ".browserslistrc"
- "babel.config.js"
- "jest.config.{base,integration,unit}.js"
- ".stylelintrc"
- "Dockerfile.assets"
- "vendor/assets/**/*"
- ".{eslintrc.yml,eslintignore,gitattributes,nvmrc,prettierrc,stylelintrc,yamllint}"
- "*_VERSION"
- "{,jh/}Gemfile{,.lock}"
- "keeps/**/*"
- "Rakefile"
- "tests.yml"
- "config.ru"
- "{,ee/,jh/}{app,bin,config,db,elastic,generator_templates,gems,haml_lint,lib,locale,public,scripts,sidekiq_cluster,storybook,symbol,vendor}/**/*"
# Auto-generated files
- "doc/api/graphql/reference/*"
# CI changes
- "{,jh/}.gitlab-ci.yml"
- "{,jh/}.gitlab/ci/**/*"
# Mapped patterns (see tests.yml)
- "data/whats_new/*.yml"
- "doc/index.md"
# Backstage changes
- "Dangerfile"
- "danger/**/*"
- "{,ee/,jh/}fixtures/**/*"
- "{,ee/,jh/}rubocop/**/*"
- "{,ee/,jh/}spec/**/*"
- "{,spec/}tooling/**/*"
# QA changes
- ".dockerignore"
- "{,jh/}qa/**/*"
# Workhorse changes
- ".gitlab/ci/workhorse.gitlab-ci.yml"
- "GITLAB_WORKHORSE_VERSION"
- "workhorse/**/*"
- "scripts/gitaly-test-build"
- "scripts/gitaly-test-spawn"
- "spec/support/gitlab-git-test.git/**/*"
- "spec/support/helpers/gitaly_setup.rb"
- "GITALY_SERVER_VERSION"
- "lib/gitlab/setup_helper.rb"
# CI Templates changes
- "scripts/lint_templates_bash.rb"
- "lib/gitlab/ci/templates/**/*.gitlab-ci.yml"
# GLFM specification changes
- "glfm_specification/**/*"
.static-analysis-patterns: &static-analysis-patterns
- ".{codeclimate,eslintrc,haml-lint,haml-lint_todo}.yml"
.rubocop-patterns: &rubocop-patterns
- ".{rubocop,rubocop_todo}.yml"
- ".rubocop_todo/**/*.yml"
- "{,ee/,jh/}rubocop/**/*" # We might be changing custom cops
- "{,ee/,jh/}Gemfile.lock" # This should include gitlab-styles, rubocop itself, and any plugins we might be using
- "lib/gitlab_edition.rb" # This is required in RuboCop::CodeReuseHelpers
- ".gitlab/ci/static-analysis.gitlab-ci.yml"
- "config/feature_categories.yml" # Used by RSpec/FeatureCategory
.danger-patterns: &danger-patterns
- "Dangerfile"
- "danger/**/*"
- "tooling/danger/**/*"
.core-backend-patterns: &core-backend-patterns
- "{,jh/}Gemfile{,.lock}"
- "{,ee/,jh/}config/**/*.rb"
.core-frontend-patterns: &core-frontend-patterns
- "{package.json,yarn.lock}"
- "babel.config.js"
- "jest.config.{base,integration,unit}.js"
- "config/helpers/**/*.js"
- "vendor/assets/javascripts/**/*"
.feature-flag-development-config-patterns: &feature-flag-development-config-patterns
- "{,ee/,jh/}config/feature_flags/**/*.yml"
.glfm-patterns: &glfm-patterns
- ".gitlab/ci/rules.gitlab-ci.yml"
- "glfm_specification/**/*"
- "scripts/glfm/**/*"
- "scripts/lib/glfm/**/*"
.gdk-component-patterns: &gdk-component-patterns
- qa/gdk/**/*
- Gemfile.lock
- yarn.lock
- scripts/build_gdk_image
- scripts/frontend/postinstall.js
- workhorse/**/*
- vendor/gems/**/*
- gems/**/*
- VERSION
- GITLAB_WORKHORSE_VERSION
- GITLAB_SHELL_VERSION
- GITALY_SERVER_VERSION
.audit-events-patterns: &audit-events-patterns
- "{,ee/}config/audit_events/types/*.yml"
- "doc/user/compliance/audit_event_types.md"
- "tooling/audit_events/docs/templates/audit_event_types.md.erb"
- "lib/tasks/gitlab/audit_event_types/audit_event_types.rake"
- "lib/tasks/gitlab/audit_event_types/check_docs_task.rb"
- "lib/gitlab/audit/type/definition.rb"
- "ee/lib/ee/gitlab/audit/type/definition.rb"
.custom-roles-patterns: &custom-roles-patterns
- "ee/config/custom_abilities/*.yml"
- "doc/user/custom_roles/abilities.md"
- "tooling/custom_roles/docs/templates/custom_abilities.md.erb"
- "ee/{lib/,spec/}tasks/gitlab/custom_roles/*"
.cng-orchestrator-patterns: &cng-orchestrator-patterns
- qa/gems/gitlab-cng/**/*.rb
##################
# Conditions set #
##################
.strict-ee-only-rules:
rules:
- <<: *if-not-ee
when: never
- <<: *if-jh
when: never
.rails:rules:run-search-tests:
rules:
- !reference [".rails:rules:default-branch-schedule-nightly--code-backstage-ee-only", rules]
- <<: *if-merge-request-labels-group-global-search
changes: *search-backend-patterns
- <<: *if-merge-request-labels-group-global-search
changes: *ci-patterns
.rails:rules:ee-and-foss-default-rules:
rules:
- <<: *if-fork-merge-request
changes: *code-backstage-patterns
when: never
- <<: *if-merge-request-labels-pipeline-expedite
when: never
- <<: *if-merge-request-labels-run-all-rspec
- <<: *if-merge-request
changes: *core-backend-patterns
- <<: *if-automated-merge-request
changes: *backend-patterns
- <<: *if-security-merge-request
changes: *backend-patterns
- <<: *if-merge-request-not-approved
when: never
.rails:rules:system-default-rules:
rules:
- <<: *if-merge-request-labels-pipeline-expedite
when: never
- <<: *if-merge-request-labels-run-all-rspec
- <<: *if-merge-request
changes: *core-backend-patterns
- <<: *if-merge-request
changes: *workhorse-patterns
- <<: *if-automated-merge-request
changes: *code-backstage-patterns
- <<: *if-security-merge-request
changes: *code-backstage-patterns
- <<: *if-merge-request-not-approved
when: never
.rails:rules:previous-failed-tests-default-rules:
rules:
- <<: *if-merge-request-labels-pipeline-expedite
when: never
- <<: *if-security-merge-request
when: never
- <<: *if-merge-request-labels-run-all-rspec
- <<: *if-merge-request
changes: *code-backstage-patterns
###########################
# Conditions set for JiHu #
###########################
.rails:rules:predictive-default-rules:
rules:
- <<: *if-merge-request-approved
when: never
- <<: *if-automated-merge-request
when: never
- <<: *if-security-merge-request
when: never
.rails:rules:as-if-foss-migration-unit-integration:predictive-default-rules:
rules:
- <<: *if-merge-request
changes: *core-backend-patterns
when: never
- <<: *if-merge-request
changes: *ci-patterns
when: never
.rails:rules:unit-integration:predictive-default-rules:
rules:
- <<: *if-merge-request-labels-run-all-rspec
when: never
- !reference [".rails:rules:as-if-foss-migration-unit-integration:predictive-default-rules", rules]
.rails:rules:system:predictive-default-rules:
rules:
- <<: *if-merge-request-labels-run-all-rspec
when: never
- <<: *if-merge-request
changes: *core-backend-patterns
when: never
- <<: *if-merge-request
changes: *workhorse-patterns
when: never
- <<: *if-merge-request
changes: *ci-patterns
when: never
- <<: *if-merge-request
changes: *code-backstage-patterns
.rails:rules:ee-and-foss-migration:predictive:
rules:
- <<: *if-fork-merge-request
changes: *db-patterns
- !reference [".rails:rules:predictive-default-rules", rules]
- !reference [".rails:rules:unit-integration:predictive-default-rules", rules]
# When DB schema changes, many migrations spec may be affected. However, the test mapping from Crystalball does not map db change to a specific migration spec well.
# See https://gitlab.com/gitlab-org/gitlab/-/merge_requests/68840.
- <<: *if-merge-request
changes: *db-patterns
when: never
.rails:rules:ee-and-foss-background-migration:predictive:
rules:
- !reference [".rails:rules:ee-and-foss-migration:predictive", rules]
- <<: *if-merge-request
changes: *backend-patterns
.rails:rules:ee-and-foss-unit:predictive:
rules:
- <<: *if-fork-merge-request
changes: *backend-patterns
- !reference [".rails:rules:predictive-default-rules", rules]
- !reference [".rails:rules:unit-integration:predictive-default-rules", rules]
- <<: *if-merge-request
changes: *backend-patterns
- <<: *if-merge-request
changes: *backstage-patterns
.rails:rules:ee-and-foss-integration:predictive:
rules:
- <<: *if-fork-merge-request
changes: *backend-patterns
- !reference [".rails:rules:predictive-default-rules", rules]
- !reference [".rails:rules:unit-integration:predictive-default-rules", rules]
- <<: *if-merge-request
changes: *backend-patterns
.rails:rules:ee-and-foss-system:predictive:
rules:
- <<: *if-fork-merge-request
changes: *code-backstage-patterns
- !reference [".rails:rules:predictive-default-rules", rules]
- !reference [".rails:rules:system:predictive-default-rules", rules]
.rails:rules:ee-only-migration:predictive:
rules:
- <<: *if-not-ee
when: never
- !reference [".rails:rules:predictive-default-rules", rules]
- !reference [".rails:rules:unit-integration:predictive-default-rules", rules]
# When DB schema changes, many migrations spec may be affected. However, the test mapping from Crystalball does not map db change to a specific migration spec well.
# See https://gitlab.com/gitlab-org/gitlab/-/merge_requests/68840.
- <<: *if-merge-request
changes: *db-patterns
when: never
.rails:rules:ee-only-background-migration:predictive:
rules:
- !reference [".rails:rules:ee-only-migration:predictive", rules]
- <<: *if-merge-request
changes: *backend-patterns
.rails:rules:ee-only-unit:predictive:
rules:
- <<: *if-not-ee
when: never
- <<: *if-fork-merge-request
changes: *backend-patterns
- !reference [".rails:rules:predictive-default-rules", rules]
- !reference [".rails:rules:unit-integration:predictive-default-rules", rules]
- <<: *if-merge-request
changes: *backend-patterns
.rails:rules:ee-only-integration:predictive:
rules:
- <<: *if-not-ee
when: never
- <<: *if-fork-merge-request
changes: *backend-patterns
- !reference [".rails:rules:predictive-default-rules", rules]
- !reference [".rails:rules:unit-integration:predictive-default-rules", rules]
- <<: *if-merge-request
changes: *backend-patterns
.rails:rules:ee-only-system:predictive:
rules:
- <<: *if-not-ee
when: never
- <<: *if-fork-merge-request
changes: *code-backstage-patterns
- !reference [".rails:rules:predictive-default-rules", rules]
- !reference [".rails:rules:system:predictive-default-rules", rules]
################
# Shared rules #
################
.shared:rules:update-cache:
rules:
- <<: *if-schedule-maintenance
- <<: *if-security-schedule
- <<: *if-foss-schedule
- <<: *if-merge-request-labels-update-caches
.shared:rules:update-gitaly-binaries-cache:
rules:
- <<: *if-merge-request-labels-update-caches
- <<: *if-default-refs
changes: *gitaly-patterns
######################
# Build images rules #
######################
.build-images:rules:build-qa-image-merge-requests:
rules:
- if: '$ENABLE_BUILD_QA_IMAGE == "true"'
- <<: *if-merge-request-labels-run-all-e2e
- <<: *if-merge-request-labels-run-review-app
- <<: *if-merge-request
changes: *qa-patterns
- <<: *if-merge-request-targeting-stable-branch
changes: *setup-test-env-patterns
- <<: *if-merge-request
changes: *ci-build-images-patterns
- !reference [".prevent-tier-2-and-below", rules]
- <<: *if-merge-request
changes: *code-qa-patterns
# Rules to support .qa:rules:package-and-test-ee
- <<: *if-merge-request
changes: *dependency-patterns
- <<: *if-merge-request
changes: *feature-flag-development-config-patterns
- <<: *if-merge-request
changes: *nodejs-patterns
- <<: *if-merge-request
changes: *ci-qa-patterns
.build-images:rules:build-qa-image:
rules:
- <<: *if-not-canonical-namespace
when: never
- <<: *if-merge-request-labels-pipeline-expedite
when: never
- <<: *if-ruby-branch
- <<: *if-force-ci
- <<: *if-auto-deploy-branches
variables:
ARCH: amd64,arm64
- <<: *if-default-branch-refs
variables:
ARCH: amd64,arm64
- <<: *if-tag
variables:
ARCH: amd64,arm64
# TODO: Remove once confirmed on a tag pipeline
allow_failure: true
- <<: *if-dot-com-gitlab-org-schedule
variables:
ARCH: amd64,arm64
- !reference [".build-images:rules:build-qa-image-merge-requests", rules]
- !reference [".releases:rules:canonical-dot-com-gitlab-stable-branch-only-setup-test-env", rules]
- !reference [".releases:rules:canonical-dot-com-security-gitlab-stable-branch-only-setup-test-env", rules]
.build-images:rules:build-qa-image-as-if-foss:
rules:
- <<: *if-not-canonical-namespace
when: never
- <<: *if-merge-request-labels-pipeline-expedite
when: never
- !reference [".strict-ee-only-rules", rules]
- <<: *if-default-branch-schedule-nightly
variables:
ARCH: amd64,arm64
- !reference [".build-images:rules:build-qa-image-merge-requests", rules]
# When new minor release tag is pushed, re-tag gdk image with pattern ignored by registry cleanup
.build-images:rules:retag-gdk-image:
rules:
- if: '$CI_SERVER_HOST == "gitlab.com" && $CI_PROJECT_PATH == "gitlab-org/gitlab" && $CI_COMMIT_TAG =~ /^v\d+\.\d+\.0-ee$/ && $CI_PIPELINE_SOURCE == "push"'
# In case gdk base tag is updated via backport mr, make sure we retag it with stable prefix as well
- if: '$CI_SERVER_HOST == "gitlab.com" && $CI_PROJECT_PATH == "gitlab-org/gitlab" && ($CI_MERGE_REQUEST_EVENT_TYPE == "merged_result" || $CI_MERGE_REQUEST_EVENT_TYPE == "detached") && $CI_MERGE_REQUEST_TARGET_BRANCH_NAME =~ /^[\d-]+-stable-ee$/'
changes:
- qa/gdk/Dockerfile.gdk
# This has to match ".qa:rules:e2e:test-on-gdk" otherwise there won't be an image available to run GDK in the test jobs.
# Unfortunately, we can't just include ".qa:rules:e2e:test-on-gdk" because some of the conditions are manual
# Since the smoke test job is not allowed to fail, the `build-gdk-image` job is also not allowed to fail.
# It's better to fail early and avoid wasting resources running test jobs that would just fail anyway.
.build-images:rules:build-gdk-image:
rules:
- !reference [".qa:rules:package-and-test-never-run", rules]
- <<: *if-default-branch-schedule-nightly # already executed in the 2-hourly schedule
when: never
- <<: *if-default-branch-refs
- <<: *if-merge-request-labels-run-all-e2e
- <<: *if-merge-request-labels-run-cs-evaluation
- <<: *if-force-ci
when: manual
# The rest is included to be consistent with .qa:rules:e2e:test-on-gdk
# Run tests automatically for MRs that touch QA files
- <<: *if-merge-request
changes: *qa-patterns
# Run tests automatically for MRs that touch GITALY_SERVER_VERSION
- <<: *if-merge-request
changes: *gitaly-patterns
# Otherwise, only run in pipeline::tier-2 and above
- !reference [".prevent-tier-1", rules]
- <<: *if-merge-request-targeting-stable-branch
changes: *setup-test-env-patterns
- <<: *if-ruby-branch
# We include the job under the matching conditions below, but unlike in .qa:rules:e2e:test-on-gdk we don't need to
# set OMNIBUS_GITLAB_BUILD_ON_ALL_OS when testing against GDK
- <<: *if-merge-request
changes: *gdk-component-patterns
- <<: *if-merge-request
changes: *dependency-patterns
- <<: *if-merge-request
changes: *feature-flag-development-config-patterns
- <<: *if-merge-request
changes: *initializers-patterns
- <<: *if-merge-request
changes: *nodejs-patterns
- <<: *if-merge-request
changes: *ci-qa-patterns
- <<: *if-merge-request
changes: *code-qa-patterns
.build-images:rules:build-assets-image:
rules:
- <<: *if-not-canonical-namespace
when: never
- <<: *if-merge-request-labels-pipeline-expedite
when: never
- if: '$ENABLE_BUILD_ASSETS_IMAGE == "true"'
- !reference [".frontend:rules:assets-shared", rules]
.build-images:rules:build-assets-image-as-if-foss:
rules:
- <<: *if-not-ee
when: never
- !reference [".build-images:rules:build-assets-image", "rules"]
#################
# Caching rules #
#################
.caching:rules:cache-workhorse:
rules:
- <<: *if-not-ee
when: never
# That would run for any project that has a "maintenance" pipeline schedule
# but in fact, the cache package is only uploaded for gitlab.com/gitlab-org/gitlab and jihulab.com/gitlab-cn/gitlab
- <<: *if-schedule-maintenance
- <<: *if-dot-com-gitlab-org-default-branch
changes: ["workhorse/**/*"]
- <<: *if-dot-com-gitlab-org-merge-request
changes:
- ".gitlab/ci/caching.gitlab-ci.yml"
- "scripts/gitlab_component_helpers.sh"
when: manual
allow_failure: true
.caching:rules:cache-assets:
rules:
# The new strategy to cache assets as generic packages is experimental and can be disabled by removing the `CACHE_ASSETS_AS_PACKAGE` variable
- if: '$CACHE_ASSETS_AS_PACKAGE != "true"'
when: never
- <<: *if-not-dot-com-gitlab-org-and-not-jihulab
when: never
# That would run for any project that has a "maintenance" pipeline schedule
# but in fact, the cache package is only uploaded for gitlab.com/gitlab-org/gitlab and jihulab.com/gitlab-cn/gitlab
- <<: *if-schedule-maintenance
- <<: *if-dot-com-gitlab-org-default-branch
changes: *assets-compilation-patterns
- <<: *if-dot-com-gitlab-org-merge-request
changes:
- ".gitlab/ci/caching.gitlab-ci.yml"
- "scripts/gitlab_component_helpers.sh"
- "lib/tasks/gitlab/assets.rake"
when: manual
allow_failure: true
- if: '$ENABLE_CACHE_ASSETS == "true"'
when: manual
allow_failure: true
.caching:rules:packages-cleanup:
rules:
# The new strategy to cache assets as generic packages is experimental and can be disabled by removing the `CACHE_ASSETS_AS_PACKAGE` variable
- if: '$CACHE_ASSETS_AS_PACKAGE != "true"'
when: never
- <<: *if-not-ee
when: never
# That would run for any project that has a "maintenance" pipeline schedule
# but in fact, the cache package is only uploaded for gitlab.com/gitlab-org/gitlab and jihulab.com/gitlab-cn/gitlab
- <<: *if-schedule-maintenance
- <<: *if-dot-com-gitlab-org-merge-request
changes:
- ".gitlab/ci/caching.gitlab-ci.yml"
- "scripts/packages/automated_cleanup.rb"
when: manual
allow_failure: true
######################
# CI Templates Rules #
######################
.ci-templates:rules:shellcheck:
rules:
- <<: *if-default-refs
changes: *ci-templates-patterns
- <<: *if-default-refs
changes:
- scripts/lint_templates_bash.rb
######################
# Dev fixtures rules #
######################
.dev-fixtures:rules:ee-and-foss:
rules:
- <<: *if-merge-request-labels-pipeline-expedite
when: never
- <<: *if-default-refs
changes: *code-backstage-patterns
.dev-fixtures:rules:ee-only:
rules:
- <<: *if-not-ee
when: never
- <<: *if-merge-request-labels-pipeline-expedite
when: never
- <<: *if-default-refs
changes: *code-backstage-patterns
##############
# Docs rules #
##############
.docs:rules:review-docs:
rules:
- <<: *if-dot-com-gitlab-org-merge-request
changes: *docs-patterns
when: manual
allow_failure: true
.docs:rules:redirect-check:
rules:
- <<: *if-dot-com-gitlab-org-merge-request
changes: *docs-patterns
.docs:rules:docs-lint:
rules:
- <<: *if-default-refs
changes: *docs-patterns
.docs:rules:docs-blueprints-lint:
rules:
- <<: *if-default-refs
changes: *docs-blueprints-patterns
.docs:rules:deprecations-and-removals:
rules:
- <<: *if-default-refs
changes: *docs-deprecations-and-removals-patterns
##################
# GLFM rules #
##################
.glfm:rules:glfm-verify:
# NOTES ON RULES:
# 1. We only run this job in EE because some of the markdown examples in the generated files depend
# on EE-only features. This means that it may fail when it is first run in a full EE pipeline.
# 2. We run this job for the `.setup-test-env-patterns` subset of file changes because:
# A. There are potentially many different source files within the codebase which could
# change the contents of the generated GLFM files, and it is therefore safer to always
# run this job to ensure that no changes are missed.
# B. The `.setup-test-env-patterns` restriction is needed because the job `needs` the
# `setup-test-env` job.
# See more context on each rule in the inline comments below:
rules:
# The `glfm-verify` job has dependencies on EE, so only run it for EE
- !reference [".strict-ee-only-rules", rules]
- <<: *if-merge-request-labels-pipeline-expedite
when: never
# If any of the files that are DIRECTLY related to generating or managing the GLFM specification change,
# run `glfm-verify` to get quick feedback on any needed updates, even if the MR is not yet approved
- <<: *if-default-refs
changes: *glfm-patterns
# Otherwise do not run `glfm-verify` if the MR is not approved
- <<: *if-merge-request-not-approved
when: never
# If we passed all the previous rules, run `glfm-verify` if there are any changes that could impact `glfm-verify`.
# This could potentially be a wide range of files, so we reuse `setup-test-env-patterns`, which includes
# almost all app files except docs files.
- <<: *if-default-refs
changes: *setup-test-env-patterns
# If we are forcing all rspec to run, run this job too.
- <<: *if-merge-request-labels-run-all-rspec
##################
# GraphQL rules #
##################
.graphql:rules:graphql-verify:
rules:
- <<: *if-not-ee
when: never
- <<: *if-default-refs
changes: *code-backstage-qa-patterns
############################
# Audit event types rules #
############################
.audit-event-types:rules:audit-event-types-verify:
rules:
- <<: *if-not-ee
when: never
- <<: *if-default-refs
changes: *audit-events-patterns
############################
# Custom roles rules #
############################
.custom-roles:rules:custom-roles-verify:
rules:
- <<: *if-not-ee
when: never
- <<: *if-default-refs
changes: *custom-roles-patterns
##################
# Frontend rules #
##################
.frontend:rules:predictive-default-rules:
rules:
- <<: *if-merge-request-approved
when: never
- <<: *if-automated-merge-request
when: never
- <<: *if-security-merge-request
when: never
- <<: *if-merge-request-labels-pipeline-expedite
when: never
- <<: *if-merge-request-labels-run-all-jest
when: never
.frontend:rules:assets-shared:
rules:
- <<: *if-auto-deploy-branches
- <<: *if-ruby-branch
- <<: *if-force-ci
- <<: *if-merge-request-labels-run-all-e2e
- <<: *if-merge-request-labels-run-review-app
- <<: *if-merge-request
changes: *qa-patterns
- <<: *if-merge-request-targeting-stable-branch
changes: *setup-test-env-patterns
- <<: *if-default-refs
changes: *ci-build-images-patterns
- <<: *if-default-refs
changes: *workhorse-patterns
- !reference [".prevent-tier-2-and-below", rules]
# Rules to support .qa:rules:package-and-test
- <<: *if-merge-request
changes: *dependency-patterns
- <<: *if-default-refs
changes: *code-qa-patterns
- <<: *if-merge-request
changes: *cng-orchestrator-patterns
.frontend:rules:compile-production-assets:
rules:
- <<: *if-not-canonical-namespace
when: never
- <<: *if-merge-request-labels-pipeline-expedite
when: never
- if: '$ENABLE_COMPILE_PRODUCTION_ASSETS == "true"'
- !reference [".frontend:rules:assets-shared", rules]
.frontend:rules:compile-production-assets-as-if-foss:
rules:
- <<: *if-not-canonical-namespace
when: never
- !reference [".strict-ee-only-rules", rules]
- !reference [.frontend:rules:compile-production-assets, rules]
.frontend:rules:compile-test-assets:
rules:
- if: '$ENABLE_COMPILE_TEST_ASSETS == "true"'
- if: '$ENABLE_RSPEC == "true"'
- <<: *if-merge-request-labels-run-all-rspec
- <<: *if-merge-request
changes: *backend-patterns
- <<: *if-default-refs
changes: *code-backstage-qa-patterns
- <<: *if-default-refs
changes: *workhorse-patterns
.frontend:rules:default-frontend-jobs:
rules:
- <<: *if-merge-request-labels-pipeline-expedite
when: never
- if: '$ENABLE_JEST_INTEGRATION == "true"'
- if: '$ENABLE_RSPEC_FRONTEND_FIXTURE == "true"'
- if: '$ENABLE_ESLINT == "true"'
- if: '$ENABLE_COMPILE_STORYBOOK == "true"'
- if: '$ENABLE_GRAPHQL_SCHEMA_DUMP == "true"'
- if: '$ENABLE_GENERATE_APOLLO_GRAPHQL_SCHEMA == "true"'
- <<: *if-merge-request-labels-run-all-rspec
- <<: *if-merge-request-labels-frontend-and-feature-flag
- <<: *if-default-refs
changes: *code-backstage-patterns
# .frontend:rules:default-frontend-jobs, with a additional rules when MR is not approved
.frontend:rules:frontend_fixture:
rules:
# From .frontend:rules:default-frontend-jobs
- <<: *if-merge-request-labels-pipeline-expedite
when: never
- <<: *if-fork-merge-request
changes: *code-backstage-patterns
- if: '$ENABLE_RSPEC_FRONTEND_FIXTURE == "true"'
- <<: *if-merge-request-labels-run-all-rspec
# From .frontend:rules:jest
- <<: *if-automated-merge-request
changes: *code-backstage-patterns
- <<: *if-security-merge-request
changes: *code-backstage-patterns
- <<: *if-merge-request-labels-run-all-jest
- <<: *if-merge-request-labels-frontend-and-feature-flag
- <<: *if-merge-request
changes: *frontend-dependency-patterns
- <<: *if-merge-request
changes: [".gitlab/ci/frontend.gitlab-ci.yml"]
# From .frontend:rules:jest-snapshot-vue3
- <<: *if-merge-request
changes: [".gitlab/ci/rules.gitlab-ci.yml", ".gitlab/ci/frontend.gitlab-ci.yml"]
# Rules for `jest predictive` jobs
- <<: *if-merge-request-not-approved
changes: *frontend-predictive-patterns
- <<: *if-merge-request-not-approved
when: never
# From .frontend:rules:default-frontend-jobs
- <<: *if-default-refs
changes: *code-backstage-patterns
# .frontend:rules:default-frontend-jobs, with a additional rules when MR is not approved
.frontend:rules:compile-storybook:
rules:
# From .frontend:rules:default-frontend-jobs
- <<: *if-merge-request-labels-pipeline-expedite
when: never
- if: '$ENABLE_COMPILE_STORYBOOK == "true"'
- <<: *if-merge-request-labels-run-all-rspec
- <<: *if-merge-request-labels-frontend-and-feature-flag
# If the MR isn't approved, only run when jest predictive jobs would
- <<: *if-merge-request-not-approved
changes: *frontend-predictive-patterns
- <<: *if-merge-request-not-approved
when: never
# From .frontend:rules:default-frontend-jobs
- <<: *if-default-refs
changes: *code-backstage-patterns
.frontend:rules:upload-frontend-fixtures:
rules:
# The new strategy to upload fixtures as generic packages is experimental and can be disabled by removing the `REUSE_FRONTEND_FIXTURES_ENABLED` variable
- if: '$REUSE_FRONTEND_FIXTURES_ENABLED != "true"'
when: never
- <<: *if-not-ee
when: never
- <<: *if-merge-request-labels-pipeline-expedite
when: never
- <<: *if-dot-com-gitlab-org-default-branch
changes: *code-backstage-patterns
- <<: *if-merge-request-not-approved
when: never
- <<: *if-dot-com-gitlab-org-merge-request
changes:
- ".gitlab/ci/frontend.gitlab-ci.yml"
- "scripts/gitlab_component_helpers.sh"
when: manual
allow_failure: true
.frontend:rules:jest:
rules:
- <<: *if-merge-request-labels-pipeline-expedite
when: never
- <<: *if-fork-merge-request
when: never
- if: '$ENABLE_JEST == "true"'
- <<: *if-automated-merge-request
changes: *code-backstage-patterns
- <<: *if-security-merge-request
changes: *code-backstage-patterns
- <<: *if-merge-request-labels-run-all-jest
- <<: *if-merge-request-labels-frontend-and-feature-flag
- <<: *if-merge-request
changes: *frontend-dependency-patterns
- <<: *if-merge-request
changes: [".gitlab/ci/frontend.gitlab-ci.yml"]
- <<: *if-merge-request-not-approved
when: never
- <<: *if-default-refs
changes: *code-backstage-patterns
.frontend:rules:jest:predictive:
rules:
- <<: *if-fork-merge-request
changes: *code-backstage-patterns
- !reference [".frontend:rules:predictive-default-rules", rules]
- <<: *if-merge-request-labels-frontend-and-feature-flag
when: never
- <<: *if-merge-request
changes: *frontend-dependency-patterns
when: never
- if: '$ENABLE_JEST_PREDICTIVE == "true"'
- <<: *if-merge-request
changes: [".gitlab/ci/frontend.gitlab-ci.yml"] # When this file is modified, we run full Jest jobs
when: never
- <<: *if-merge-request
changes: *frontend-predictive-patterns
# .frontend:rules:default-frontend-jobs, with a additional rules when MR is not approved
.frontend:rules:jest-integration:
rules:
# From .frontend:rules:default-frontend-jobs
- <<: *if-merge-request-labels-pipeline-expedite
when: never
- if: '$ENABLE_JEST_INTEGRATION == "true"'
- <<: *if-merge-request-labels-run-all-rspec
- <<: *if-merge-request-labels-frontend-and-feature-flag
# If the MR isn't approved, only run when jest predictive jobs would
- <<: *if-merge-request-not-approved
changes: *frontend-predictive-patterns
- <<: *if-merge-request-not-approved
when: never
# From .frontend:rules:default-frontend-jobs
- <<: *if-default-refs
changes: *code-backstage-patterns
.frontend:rules:coverage-frontend:
rules:
- <<: *if-not-ee
when: never
- <<: *if-merge-request-labels-pipeline-expedite
when: never
- <<: *if-merge-request
changes: *code-backstage-patterns
- <<: *if-default-branch-refs
changes: *code-backstage-patterns
.frontend:rules:bundle-size-review:
rules:
- <<: *if-not-canonical-namespace
when: never
- <<: *if-merge-request-labels-pipeline-expedite
when: never
- <<: *if-default-branch-refs
changes: *frontend-build-patterns
allow_failure: true
- if: '$DANGER_GITLAB_API_TOKEN && ($CI_MERGE_REQUEST_EVENT_TYPE == "merged_result" || $CI_MERGE_REQUEST_EVENT_TYPE == "detached") && $CI_MERGE_REQUEST_TARGET_BRANCH_NAME == $CI_DEFAULT_BRANCH'
changes: *frontend-build-patterns
allow_failure: true
.frontend:rules:jest-snapshot-vue3:
rules:
- <<: *if-merge-request-labels-pipeline-expedite
when: never
- <<: *if-fork-merge-request
when: never
- <<: *if-merge-request-labels-run-all-jest
when: manual
allow_failure: true
- <<: *if-merge-request-labels-frontend-and-feature-flag
when: manual
allow_failure: true
- <<: *if-merge-request
changes: *frontend-dependency-patterns
when: manual
allow_failure: true
- <<: *if-merge-request
changes: [".gitlab/ci/rules.gitlab-ci.yml", ".gitlab/ci/frontend.gitlab-ci.yml"]
allow_failure: true
.frontend:rules:jest-vue3:
rules:
- <<: *if-default-branch-schedule-nightly
################
# Memory rules #
################
.memory:rules:
rules:
- <<: *if-merge-request-labels-pipeline-expedite
when: never
- <<: *if-default-refs
changes: *code-patterns
##########
# Notify #
##########
.notify:rules:notify-package-and-test-failure:
rules:
- <<: *if-not-canonical-namespace
when: never
- <<: *if-security-merge-request
when: never
- <<: *if-merge-request-targeting-stable-branch
changes: *setup-test-env-patterns
when: always
###############
# Pages rules #
###############
.pages:rules:
rules:
- <<: *if-dot-com-ee-schedule-default-branch-maintenance
############
# QA rules #
############
.qa:rules:update-gem-cache:
rules:
- if: '$CI_COMMIT_REF_NAME == $CI_DEFAULT_BRANCH || $CI_COMMIT_REF_NAME =~ /^[\d-]+-stable(-ee)?$/ || $CI_COMMIT_REF_NAME =~ /^\d+-\d+-auto-deploy-\d+$/ || $CI_COMMIT_REF_NAME =~ /^security\//'
changes:
- qa/Gemfile.lock
- <<: *if-schedule-maintenance
- <<: *if-security-schedule
- <<: *if-foss-schedule
- <<: *if-merge-request-labels-update-caches
.qa:rules:update-gem-cache-e2e:
rules:
- <<: *if-not-dot-com-gitlab-org-and-not-jihulab
when: never
- !reference [.qa:rules:update-gem-cache, rules]
.qa:rules:metadata-lint:
rules:
- <<: *if-default-refs
changes: *qa-patterns
- <<: *if-default-refs
changes: *ci-qa-patterns
.qa:rules:gitlab-cng:
rules:
- <<: *if-default-refs
changes: *cng-orchestrator-patterns
.qa:rules:code-merge-request:
rules:
- <<: *if-merge-request
changes: *code-patterns
.qa:rules:code-merge-request-allowed-to-fail:
rules:
- <<: *if-merge-request
changes: *code-patterns
allow_failure: true
.qa:rules:code-merge-request-manual:
rules:
- <<: *if-merge-request
changes: *code-patterns
when: manual
allow_failure: true
.qa:rules:internal:
rules:
- if: '$ENABLE_QA_INTERNAL == "true"'
- <<: *if-default-refs
changes: *qa-patterns
.qa:rules:selectors:
rules:
- if: '$ENABLE_QA_SELECTORS == "true"'
- <<: *if-default-refs
changes: *code-qa-patterns
.qa:rules:determine-e2e-tests:
rules:
- <<: *if-not-ee
when: never
- <<: *if-merge-request-labels-pipeline-expedite
when: never
- <<: *if-ruby-branch
allow_failure: true
- <<: *if-merge-request-labels-run-all-e2e
allow_failure: true
- <<: *if-merge-request-targeting-stable-branch
changes: *setup-test-env-patterns
allow_failure: true
# Run tests automatically for MRs that touch GITALY_SERVER_VERSION
- <<: *if-merge-request
changes: *gitaly-patterns
- <<: *if-merge-request
# Certain components trigger a rebuild of the e2e GDK image so we want to test it too
changes: *gdk-component-patterns
- <<: *if-merge-request
changes: *code-backstage-qa-patterns
allow_failure: true
- <<: *if-dot-com-gitlab-org-schedule
allow_failure: true
# Rules to support .qa:rules:package-and-test-ee
- <<: *if-merge-request
changes: *dependency-patterns
allow_failure: true
- <<: *if-merge-request
changes: *feature-flag-development-config-patterns
allow_failure: true
- <<: *if-merge-request
changes: *nodejs-patterns
allow_failure: true
- <<: *if-merge-request
changes: *ci-qa-patterns
allow_failure: true
- <<: *if-force-ci
allow_failure: true
.qa:rules:package-and-test-never-run:
rules:
- <<: *if-not-canonical-namespace
when: never
- <<: *if-not-ee
when: never
- <<: *if-merge-request-labels-pipeline-expedite
when: never
.qa:rules:package-and-test-common:
rules:
- !reference [".qa:rules:package-and-test-never-run", rules]
- <<: *if-merge-request-labels-run-all-e2e
# Run tests automatically for MRs that touch QA files
- <<: *if-merge-request
changes: *qa-patterns
# Otherwise, only run tests in pipeline::tier-3 and above
- !reference [".prevent-tier-2-and-below", rules]
- <<: *if-merge-request
changes: *dependency-patterns
variables:
OMNIBUS_GITLAB_BUILD_ON_ALL_OS: 'true'
- <<: *if-merge-request
changes: *feature-flag-development-config-patterns
- <<: *if-merge-request
changes: *initializers-patterns
- <<: *if-merge-request
changes: *nodejs-patterns
- <<: *if-merge-request
changes: *ci-qa-patterns
- <<: *if-security-merge-request
changes: *code-patterns
- <<: *if-merge-request-and-specific-devops-stage
changes: *code-patterns
- <<: *if-merge-request-targeting-stable-branch
changes: *setup-test-env-patterns
- <<: *if-ruby-branch
# .qa:rules:e2e-blocking-base-* are similar to .qa:rules:package-and-test-common, but not allowed to fail.
# It's named `e2e` instead of `package-and-test` because it's used for e2e tests on GDK/CNG
.qa:rules:e2e-blocking-base-before:
rules:
- !reference [".qa:rules:package-and-test-never-run", rules]
- <<: *if-merge-request-labels-run-all-e2e
# Run tests automatically for MRs that touch QA files
- <<: *if-merge-request
changes: *qa-patterns
# Run tests automatically for MRs that touch GITALY_SERVER_VERSION
- <<: *if-merge-request
changes: *gitaly-patterns
.qa:rules:e2e-blocking-base-after:
rules:
- <<: *if-merge-request-targeting-stable-branch
changes: *setup-test-env-patterns
- <<: *if-ruby-branch
- <<: *if-force-ci
when: manual
- <<: *if-merge-request
changes: *code-patterns
variables:
MR_CODE_PATTERNS: "true"
.qa:e2e-test-schedule-variables: &qa-e2e-test-schedule-variables
variables:
CREATE_TEST_FAILURE_ISSUES: "true"
PROCESS_TEST_RESULTS: "true"
KNAPSACK_GENERATE_REPORT: "true"
QA_SAVE_TEST_METRICS: "true"
QA_EXPORT_TEST_METRICS: "false" # on main runs, metrics are exported to separate bucket via rake task for better consistency
.qa:rules:e2e-schedule-blocking:
rules:
- <<: [*if-dot-com-gitlab-org-schedule, *qa-e2e-test-schedule-variables]
.qa:rules:code-suggestions-eval-base:
rules:
- !reference [".strict-ee-only-rules", rules]
- !reference [".qa:rules:package-and-test-never-run", rules]
- <<: *if-fork-merge-request
when: never
- <<: *if-merge-request-targeting-stable-branch
when: never
- <<: *if-merge-request-labels-run-cs-evaluation
# Otherwise, only run in pipeline::tier-2 and above
- !reference [".prevent-tier-1", rules]
.qa:rules:code-suggestions-eval:
rules:
- !reference [".qa:rules:code-suggestions-eval-base", rules]
- <<: *if-merge-request
changes: *code-patterns
when: manual
allow_failure: true
.qa:rules:code-suggestions-eval-results:
rules:
- !reference [".qa:rules:code-suggestions-eval-base", rules]
- <<: *if-merge-request
changes: *code-patterns
# Note: If any changes are made to this rule, the following should also be updated - .qa:rules:post-run-e2e-message
.qa:rules:package-and-test-ee:
rules:
- !reference [".qa:rules:package-and-test-common", rules]
- !reference [".qa:rules:e2e-schedule-blocking", rules]
.qa:rules:package-and-test-ce:
rules:
- !reference [".qa:rules:package-and-test-never-run", rules]
- <<: *if-security-merge-request
changes: *qa-patterns
when: manual
allow_failure: true
- !reference [".prevent-tier-2-and-below", rules]
- <<: *if-security-merge-request
changes: *code-patterns
when: manual
allow_failure: true
- <<: *if-default-branch-schedule-nightly
allow_failure: true
variables:
CREATE_TEST_FAILURE_ISSUES: "true"
PROCESS_TEST_RESULTS: "true"
QA_SAVE_TEST_METRICS: "true"
QA_EXPORT_TEST_METRICS: "false"
.qa:rules:e2e:test-on-gdk:
rules:
- if: '$QA_RUN_TESTS_ON_GDK =~ /false|no|0/i'
when: never
- <<: *if-default-branch-schedule-nightly # already executed in the 2-hourly schedule
when: never
- !reference [".qa:rules:e2e-blocking-base-before", rules]
- !reference [".prevent-tier-1", rules]
- !reference [".qa:rules:e2e-blocking-base-after", rules]
# Certain components trigger a rebuild of the e2e GDK image so we want to test it too
- <<: *if-merge-request
changes: *gdk-component-patterns
- <<: *if-dot-com-gitlab-org-schedule
variables:
CREATE_TEST_FAILURE_ISSUES: "true"
PROCESS_TEST_RESULTS: "true"
KNAPSACK_GENERATE_REPORT: "true"
QA_SAVE_TEST_METRICS: "true"
QA_EXPORT_TEST_METRICS: "false"
COVERBAND_ENABLED: "true"
.qa:rules:e2e:test-on-cng:
rules:
- <<: *if-dot-com-gitlab-org-schedule
variables:
KNAPSACK_GENERATE_REPORT: "true"
QA_SAVE_TEST_METRICS: "true"
QA_EXPORT_TEST_METRICS: "false"
allow_failure: true
.qa:rules:package-and-test-nightly:
rules:
- !reference [".qa:rules:package-and-test-never-run", rules]
- <<: *if-default-branch-schedule-nightly
allow_failure: true
variables:
KNAPSACK_GENERATE_REPORT: "true"
PROCESS_TEST_RESULTS: "true"
CREATE_TEST_FAILURE_ISSUES: "true"
QA_SAVE_TEST_METRICS: "true"
QA_EXPORT_TEST_METRICS: "false"
# These provide a manual way to trigger follow-up:e2e:package-and-test-ee
# It is fine if they're overlapping with the automatic ones.
# It'll not hurt and it can simplify the rules, decoupling them.
# If any changes are made to this rule, the following should also be updated:
# 1) .qa:rules:follow-up-e2e
# 2) .qa:rules:post-run-e2e-message
.qa:rules:manual-e2e:
rules:
- !reference [".qa:rules:package-and-test-never-run", rules]
- <<: *if-merge-request-and-specific-devops-stage
when: never
- !reference [".qa:rules:code-merge-request-manual", rules]
# These are based on `.qa:rules:manual-e2e` but with manual jobs changed to automatic.
# If any changes are made to this rule, the following should also be updated:
# 1) .qa:rules:manual-e2e
.qa:rules:follow-up-e2e:
rules:
- !reference [".qa:rules:package-and-test-never-run", rules]
- <<: *if-merge-request-and-specific-devops-stage
when: never
- !reference [".qa:rules:code-merge-request-allowed-to-fail", rules]
# These are based on `qa:rules:package-and-test-ee` but with when:never in all except for code-patterns in merge requests
.qa:rules:post-run-e2e-message:
rules:
# From .qa:rules:package-and-test-common
- !reference [".qa:rules:package-and-test-never-run", rules]
- <<: *if-ruby-branch
when: never
- <<: *if-merge-request-labels-run-all-e2e
when: never
- <<: *if-merge-request
changes: *qa-patterns
when: never
- <<: *if-merge-request-targeting-stable-branch
changes: *setup-test-env-patterns
when: never
- !reference [".prevent-tier-2-and-below", rules]
- <<: *if-merge-request
changes: *dependency-patterns
when: never
- <<: *if-merge-request
changes: *feature-flag-development-config-patterns
when: never
- <<: *if-merge-request
changes: *initializers-patterns
when: never
- <<: *if-merge-request
changes: *nodejs-patterns
when: never
- <<: *if-merge-request
changes: *ci-qa-patterns
when: never
- <<: *if-security-merge-request
changes: *code-patterns
when: never
- <<: *if-merge-request-and-specific-devops-stage
when: never
# From .qa:rules:package-and-test-schedule
- <<: *if-dot-com-gitlab-org-schedule
when: never
# From .qa:rules:manual-e2e
- !reference [".qa:rules:code-merge-request-allowed-to-fail", rules]
.qa:rules:fulfillment-e2e-quarantine-report:
rules:
- <<: *if-not-ee
when: never
- <<: *if-merge-request-and-devops-fulfillment
changes: *code-patterns
allow_failure: true
###############
# Rails rules #
###############
.rails:rules:setup-test-env:
rules:
- if: '$ENABLE_RSPEC == "true"'
- <<: *if-default-refs
changes: *setup-test-env-patterns
- <<: *if-merge-request-labels-run-all-rspec
.rails:rules:clusterwide-db:
rules:
- <<: *if-merge-request-labels-run-clusterwide-db
.rails:rules:single-redis:
rules:
- <<: *if-merge-request-labels-run-single-db
- <<: *if-merge-request-labels-pipeline-expedite
when: never
- if: '$ENABLE_RSPEC_SINGLE_REDIS == "true"'
- <<: *if-merge-request
changes: *redis-patterns
- <<: *if-merge-request-not-approved
when: never
- <<: *if-merge-request
changes: *feature-flag-development-config-patterns
- <<: *if-default-branch-schedule-nightly
.rails:rules:single-redis-ee:
rules:
- <<: *if-not-ee
when: never
- !reference [".rails:rules:single-redis", "rules"]
.rails:rules:single-db:
rules:
- <<: *if-default-branch-schedule-nightly
- <<: *if-merge-request-labels-run-single-db
- <<: *if-merge-request-labels-pipeline-expedite
when: never
- if: '$ENABLE_RSPEC_SINGLE_DB == "true"'
- <<: *if-merge-request-not-approved
when: never
- <<: *if-merge-request
changes: *db-patterns
- <<: *if-merge-request
changes: *decomposed-db-models-patterns
.rails:rules:single-db-ee:
rules:
- <<: *if-not-ee
when: never
- !reference [".rails:rules:single-db", "rules"]
.rails:rules:db:check-migrations-single-db:
rules:
- <<: *if-merge-request-labels-run-single-db
- <<: *if-merge-request-labels-pipeline-expedite
when: never
- <<: *if-merge-request
changes: *db-patterns
- <<: *if-merge-request
changes: *decomposed-db-models-patterns
.rails:rules:single-db-ci-connection:
rules:
- <<: *if-default-branch-schedule-nightly
- <<: *if-merge-request-labels-run-single-db
- <<: *if-merge-request-labels-pipeline-expedite
when: never
- if: '$ENABLE_RSPEC_SINGLE_DB_CI_CONNECTION == "true"'
- <<: *if-merge-request-not-approved
when: never
- <<: *if-merge-request
changes: *db-patterns
- <<: *if-merge-request
changes: *decomposed-db-models-patterns
.rails:rules:single-db-ci-connection-ee:
rules:
- <<: *if-not-ee
when: never
- !reference [".rails:rules:single-db-ci-connection", "rules"]
.rails:rules:db:check-migrations-single-db-ci-connection:
rules:
- <<: *if-merge-request-labels-run-single-db
- <<: *if-merge-request-labels-pipeline-expedite
when: never
- <<: *if-merge-request
changes: *db-patterns
- <<: *if-merge-request
changes: *decomposed-db-models-patterns
.rails:rules:db:migrate:multi-version-upgrade:
rules:
- if: '$DISABLE_DB_MULTI_VERSION_UPGRADE =~ /true|yes|1/i'
when: never
- !reference [".rails:rules:ee-and-foss-migration", rules]
.rails:rules:db-backup:
rules:
- <<: *if-merge-request-labels-pipeline-expedite
when: never
- <<: *if-merge-request-labels-run-all-rspec
- <<: *if-default-refs
changes: *db-backup-patterns
- <<: *if-merge-request-not-approved
when: never
- <<: *if-default-refs
changes: *db-patterns
.rails:rules:db-rollback:
rules:
- !reference [".rails:rules:ee-and-foss-migration", rules]
- <<: *if-default-refs
changes: *initializers-patterns
- <<: *if-default-refs
changes:
- "{,ee/,jh/}{,spec/}lib/{,ee/,jh/}gitlab/content_security_policy/config_loader{,_spec}.rb"
.rails:rules:praefect-with-db:
rules:
- if: '$ENABLE_RSPEC_PRAEFECT == "true"'
allow_failure: true
- <<: *if-merge-request-labels-run-praefect-with-db
allow_failure: true
.rails:rules:gitaly-without-transactions:
rules:
- <<: *if-schedule-maintenance
- <<: *if-merge-request-labels-run-without-gitaly-transactions
.rails:rules:ee-and-foss-migration:
rules:
- <<: *if-fork-merge-request
when: never
- <<: *if-merge-request-labels-pipeline-expedite
when: never
- if: '$ENABLE_RSPEC_MIGRATION == "true"'
- <<: *if-merge-request-labels-run-all-rspec
- <<: *if-merge-request
changes: *core-backend-patterns
# When DB schema changes, many migrations spec may be affected. However, the test mapping from Crystalball does not map db change to a specific migration spec well.
# See https://gitlab.com/gitlab-org/gitlab/-/merge_requests/68840.
- <<: *if-merge-request
changes: *db-patterns
- <<: *if-merge-request-not-approved
when: never
- <<: *if-default-refs
changes: *db-patterns
# Union rules of:
# .rails:rules:rspec-predictive
# .rails:rules:rspec-predictive:single-db
# .rails:rules:rspec-predictive:single-db-ci-connection
.rails:rules:rspec-predictive:pipeline-generate:
rules:
- <<: *if-fork-merge-request
changes: *code-backstage-patterns
- <<: *if-merge-request-labels-pipeline-expedite
when: never
- if: '$ENABLE_RSPEC_PREDICTIVE_PIPELINE_GENERATE == "true"'
- <<: *if-merge-request
changes: *db-patterns
- <<: *if-merge-request
changes: *decomposed-db-models-patterns
- <<: *if-merge-request-labels-run-all-rspec
when: never
- <<: *if-merge-request
changes: *core-backend-patterns
when: never
- <<: *if-automated-merge-request
changes: *backend-patterns
when: never
- <<: *if-security-merge-request
changes: *backend-patterns
when: never
- <<: *if-merge-request-approved
when: never
- <<: *if-merge-request
changes: *code-backstage-patterns
# Inverse rules compared to .rails:rules:ee-and-foss-default-rules
#
# See CI specs in spec/dot_gitlab_ci/rules_spec.rb for details.
.rails:rules:rspec-predictive:
rules:
- <<: *if-fork-merge-request
changes: *code-backstage-patterns
- <<: *if-merge-request-labels-pipeline-expedite
when: never
- if: '$ENABLE_RSPEC_PREDICTIVE_TRIGGER == "true"'
- <<: *if-merge-request-labels-run-all-rspec
when: never
- <<: *if-merge-request
changes: *core-backend-patterns
when: never
- <<: *if-automated-merge-request
changes: *backend-patterns
when: never
- <<: *if-security-merge-request
changes: *backend-patterns
when: never
- <<: *if-merge-request-approved
when: never
- <<: *if-merge-request
changes: *code-backstage-patterns
# Inverse rules compared to .rails:rules:single-db
#
# See CI specs in spec/dot_gitlab_ci/rules_spec.rb for details.
.rails:rules:rspec-predictive:single-db:
rules:
- <<: *if-default-branch-schedule-nightly
when: never
- <<: *if-merge-request-labels-run-single-db
when: never
- <<: *if-merge-request-labels-pipeline-expedite
when: never
- if: '$ENABLE_RSPEC_PREDICTIVE_TRIGGER_SINGLE_DB == "true"'
- <<: *if-merge-request-approved
when: never
- <<: *if-merge-request
changes: *db-patterns
- <<: *if-merge-request
changes: *decomposed-db-models-patterns
# Inverse rules compared to .rails:rules:single-db-ci-connection
#
# See CI specs in spec/dot_gitlab_ci/rules_spec.rb for details.
.rails:rules:rspec-predictive:single-db-ci-connection:
rules:
- <<: *if-default-branch-schedule-nightly
when: never
- <<: *if-merge-request-labels-run-single-db
when: never
- <<: *if-merge-request-labels-pipeline-expedite
when: never
- if: '$ENABLE_RSPEC_PREDICTIVE_TRIGGER_SINGLE_DB_CI_CONNECTION == "true"'
- <<: *if-merge-request-approved
when: never
- <<: *if-merge-request
changes: *db-patterns
- <<: *if-merge-request
changes: *decomposed-db-models-patterns
.rails:rules:ee-and-foss-background-migration:
rules:
- if: '$ENABLE_RSPEC_BACKGROUND_MIGRATION == "true"'
- !reference [".rails:rules:ee-and-foss-migration", rules]
- <<: *if-default-refs
changes: *backend-patterns
.rails:rules:ee-and-foss-mr-with-migration:
rules:
- <<: *if-merge-request-labels-pipeline-expedite
when: never
- <<: *if-merge-request
changes: *db-patterns
- <<: *if-merge-request-labels-run-all-rspec
.rails:rules:db:gitlabcom-database-testing:
rules:
- if: '$GITLABCOM_DATABASE_TESTING_TRIGGER_TOKEN == null'
when: never
- <<: *if-merge-request
changes: *db-patterns
when: manual
.rails:rules:ee-and-foss-unit:
rules:
- <<: *if-fork-merge-request
when: never
- if: '$ENABLE_RSPEC_UNIT == "true"'
- !reference [".rails:rules:ee-and-foss-default-rules", rules]
- <<: *if-default-refs
changes: *backend-patterns
- <<: *if-default-refs
changes: *backstage-patterns
.rails:rules:clickhouse-changes:
rules:
- <<: *if-fork-merge-request
when: never
- if: '$ENABLE_RSPEC_UNIT == "true"'
- !reference [".rails:rules:ee-and-foss-default-rules", rules]
- <<: *if-default-refs
changes: *backend-patterns
.rails:rules:ee-only-clickhouse-changes:
rules:
- <<: *if-not-ee
when: never
- !reference [".rails:rules:clickhouse-changes", rules]
.rails:rules:ee-and-foss-integration:
rules:
- <<: *if-fork-merge-request
when: never
- if: '$ENABLE_RSPEC_INTEGRATION == "true"'
- !reference [".rails:rules:ee-and-foss-default-rules", rules]
- <<: *if-default-refs
changes: *backend-patterns
.rails:rules:ee-and-foss-system:
rules:
- <<: *if-fork-merge-request
when: never
- if: '$ENABLE_RSPEC_SYSTEM == "true"'
- !reference [".rails:rules:system-default-rules", rules]
- <<: *if-default-refs
changes: *code-backstage-patterns
.rails:rules:ee-and-foss-fast_spec_helper:
rules:
- if: '$ENABLE_RSPEC_FAST_SPEC_HELPER == "true"'
- <<: *if-merge-request-labels-run-all-rspec
- <<: *if-merge-request
changes: *backend-patterns
- <<: *if-default-refs
changes: *core-backend-patterns
.rails:rules:code-backstage-qa:
rules:
- <<: *if-default-refs
changes: *code-backstage-qa-patterns
- <<: *if-merge-request-labels-run-all-rspec
.rails:rules:ee-only-migration:
rules:
- <<: *if-not-ee
when: never
- <<: *if-fork-merge-request
when: never
- <<: *if-merge-request-labels-pipeline-expedite
when: never
- <<: *if-merge-request-labels-run-all-rspec
- <<: *if-merge-request
changes: *core-backend-patterns
# When DB schema changes, many migrations spec may be affected. However, the test mapping from Crystalball does not map db change to a specific migration spec well.
# See https://gitlab.com/gitlab-org/gitlab/-/merge_requests/68840.
- <<: *if-merge-request
changes: *db-patterns
- <<: *if-automated-merge-request
changes: *db-patterns
- <<: *if-security-merge-request
changes: *db-patterns
- <<: *if-merge-request-not-approved
when: never
- <<: *if-default-refs
changes: *db-patterns
.rails:rules:ee-only-background-migration:
rules:
- !reference [".rails:rules:ee-only-migration", rules]
- <<: *if-default-refs
changes: *backend-patterns
.rails:rules:ee-only-unit:
rules:
- <<: *if-not-ee
when: never
- <<: *if-fork-merge-request
when: never
- !reference [".rails:rules:ee-and-foss-default-rules", rules]
- <<: *if-default-refs
changes: *backend-patterns
.rails:rules:ee-only-integration:
rules:
- <<: *if-not-ee
when: never
- <<: *if-fork-merge-request
when: never
- !reference [".rails:rules:ee-and-foss-default-rules", rules]
- <<: *if-default-refs
changes: *backend-patterns
.rails:rules:ee-only-system:
rules:
- <<: *if-not-ee
when: never
- <<: *if-fork-merge-request
when: never
- !reference [".rails:rules:system-default-rules", rules]
- <<: *if-default-refs
changes: *code-backstage-patterns
.rails:rules:ee-gitlab-duo-chat-base:
rules:
- !reference [".strict-ee-only-rules", rules]
- if: '$REAL_AI_REQUEST == null'
when: never
- if: '$ANTHROPIC_API_KEY == null'
when: never
- <<: *if-fork-merge-request
when: never
.rails:rules:ee-gitlab-duo-chat-optional:
rules:
- !reference [".rails:rules:ee-gitlab-duo-chat-base", rules]
- <<: *if-merge-request
changes: *backend-patterns
when: manual
allow_failure: true
.rails:rules:ee-gitlab-duo-chat-always:
rules:
- !reference [".rails:rules:ee-gitlab-duo-chat-base", rules]
- <<: *if-merge-request
changes: *ai-patterns
.rails:rules:ee-gitlab-duo-chat-qa-full:
rules:
- !reference [".rails:rules:ee-gitlab-duo-chat-optional", rules]
- <<: *if-default-branch-refs
changes: *setup-test-env-patterns
when: manual
allow_failure: true
.rails:rules:ee-and-foss-db-library-code:
rules:
- <<: *if-merge-request-labels-pipeline-expedite
when: never
- <<: *if-default-refs
changes: *db-library-patterns
- <<: *if-merge-request-labels-run-all-rspec
.rails:rules:ee-mr-and-default-branch-only:
rules:
- <<: *if-not-ee
when: never
- <<: *if-merge-request-labels-pipeline-expedite
when: never
- <<: *if-merge-request-labels-run-all-rspec
- <<: *if-merge-request
changes: *code-backstage-patterns
- <<: *if-default-branch-refs
changes: *code-backstage-patterns
.rails:rules:artifact-collector-unit:
rules:
# Always run for as-if-foss to work around not having needs.optional for
# cross project pipeline. See .gitlab/ci/artifact-collector/as-if-foss.gitlab-ci.yml
- if: '$START_AS_IF_FOSS == "true"'
- !reference [".rails:rules:ee-and-foss-unit", rules]
.rails:rules:artifact-collector-system:
rules:
- if: '$START_AS_IF_FOSS == "true"'
- !reference [".rails:rules:ee-and-foss-system", rules]
.rails:rules:artifact-collector-remainder:
rules:
- if: '$START_AS_IF_FOSS == "true"'
- !reference ['.rails:rules:ee-and-foss-integration', rules]
- !reference ['.rails:rules:ee-and-foss-migration', rules]
- !reference ['.rails:rules:ee-and-foss-background-migration', rules]
.rails:rules:detect-tests:
rules:
- if: '$ENABLE_DETECT_TESTS == "true"'
- <<: *if-merge-request-labels-run-all-rspec
- <<: *if-merge-request
changes: *code-backstage-qa-patterns
- <<: *if-merge-request
changes: *workhorse-patterns
- <<: *if-merge-request
changes: *rubocop-patterns
.rails:rules:detect-previous-failed-tests:
rules:
- !reference [".rails:rules:previous-failed-tests-default-rules", rules]
.rails:rules:rerun-previous-failed-tests:
rules:
- !reference [".rails:rules:previous-failed-tests-default-rules", rules]
.rails:rules:rspec fail-fast:
rules:
- <<: *if-not-ee
when: never
- <<: *if-security-merge-request
changes: *code-backstage-patterns
- <<: *if-dot-com-gitlab-org-merge-request
changes: *code-backstage-patterns
.rails:rules:fail-pipeline-early:
rules:
- <<: *if-not-ee
when: never
- <<: *if-security-merge-request
changes: *code-backstage-patterns
when: on_failure
- <<: *if-dot-com-gitlab-org-merge-request
changes: *code-backstage-patterns
when: on_failure
.rails:rules:rspec-coverage:
rules:
- <<: *if-not-ee
when: never
- <<: *if-merge-request-labels-pipeline-expedite
when: never
- <<: *if-merge-request
changes: *code-backstage-patterns
- <<: *if-schedule-maintenance
- <<: *if-merge-request-labels-run-all-rspec
.rails:rules:rspec-undercoverage:
rules:
- <<: *if-not-ee
when: never
- <<: *if-merge-request-labels-pipeline-expedite
when: never
- <<: *if-merge-request-labels-skip-undercoverage
when: never
- <<: *if-merge-request-labels-run-all-rspec
# We cannot get the coverage data from child pipeline so we only run undercoverage on full pipelines for now
# See https://gitlab.com/gitlab-org/gitlab/-/merge_requests/113410#note_1335422806
- <<: *if-merge-request-not-approved
when: never
- <<: *if-merge-request
changes: *backend-patterns
.rails:rules:rspec-merge-auto-explain-logs:
rules:
- <<: *if-not-ee
when: never
- <<: *if-merge-request-labels-pipeline-expedite
when: never
- <<: *if-merge-request-labels-run-all-rspec
- <<: *if-merge-request
changes: *code-backstage-patterns
- <<: *if-default-branch-refs
changes: *code-patterns
.rails:rules:default-branch-schedule-nightly--code-backstage-default-rules:
rules:
- <<: *if-merge-request-labels-pipeline-expedite
when: never
- <<: *if-default-branch-schedule-nightly
.rails:rules:default-branch-schedule-nightly--code-backstage:
rules:
- !reference [".rails:rules:default-branch-schedule-nightly--code-backstage-default-rules", rules]
.rails:rules:default-branch-schedule-nightly--code-backstage-ee-only:
rules:
- <<: *if-not-ee
when: never
- !reference [".rails:rules:default-branch-schedule-nightly--code-backstage-default-rules", rules]
.rails:rules:rspec-feature-flags:
rules:
- <<: *if-not-ee
when: never
- <<: *if-merge-request-labels-pipeline-expedite
when: never
- <<: *if-default-refs
changes: *code-backstage-patterns
.rails:rules:flaky-tests-report:
rules:
- <<: *if-not-ee
when: never
- <<: *if-merge-request
when: never
- if: '$FAST_QUARANTINE == "false" && $RETRY_FAILED_TESTS_IN_NEW_PROCESS != "true"'
when: never
- <<: *if-default-branch-refs
changes: *code-backstage-patterns
when: always
#########################
# Static analysis rules #
#########################
.static-analysis:rules:static-analysis:
rules:
- if: '$ENABLE_STATIC_ANALYSIS == "true"'
- <<: *if-default-refs
changes: *code-backstage-qa-patterns
- <<: *if-default-refs
changes: *static-analysis-patterns
.static-analysis:rules:static-verification-with-database:
rules:
- <<: *if-default-refs
changes: *code-backstage-qa-patterns
.static-analysis:rules:rubocop:
rules:
- if: '$ENABLE_RUBOCOP == "true"'
# Do not run full rubocop if the merge request isn't approved
- <<: *if-merge-request-not-approved
changes: *rubocop-patterns
variables:
RUN_ALL_RUBOCOP: "false"
- <<: *if-default-refs
changes: *rubocop-patterns
variables:
RUN_ALL_RUBOCOP: "true"
- <<: *if-default-refs
changes: *code-backstage-qa-patterns
.static-analysis:rules:haml-lint:
rules:
- <<: *if-default-refs
changes: *rubocop-patterns
- <<: *if-default-refs
changes: *static-analysis-patterns
- <<: *if-default-refs
changes: *code-backstage-qa-patterns
.static-analysis:rules:haml-lint-ee:
rules:
- <<: *if-not-ee
when: never
- <<: *if-default-refs
changes: *rubocop-patterns
- <<: *if-default-refs
changes: *static-analysis-patterns
- <<: *if-default-refs
changes: *code-backstage-qa-patterns
.semgrep-appsec-custom-rules:rules:
rules:
- <<: *if-not-ee
when: never
- <<: *if-merge-request
changes: *setup-test-env-patterns
.ping-appsec-for-sast-findings:rules:
rules:
# Requiring $CUSTOM_SAST_RULES_BOT_PAT prevents the bot from running on forks or CE
# Without it the script would fail too.
- if: "$CUSTOM_SAST_RULES_BOT_PAT == null"
when: never
- <<: *if-not-ee
when: never
- <<: *if-merge-request
changes: *setup-test-env-patterns
.ping-appsec-for-dependency-review:rules:
rules:
# Requiring $DEPENDENCY_REVIEW_PAT prevents the bot from running on forks or CE
# Without it the script would fail too.
- if: "$ENABLE_DEPSCORE != 'true'"
when: never
- if: "$DEPENDENCY_REVIEW_PAT == null"
when: never
- <<: *if-fork-merge-request
when: never
- <<: *if-not-ee
when: never
# Run only when the merge request have dependency file modifications
- <<: *if-merge-request
changes: *dependency-patterns
##################
# Releases rules #
##################
.releases:rules:canonical-dot-com-gitlab-stable-branch-only:
rules:
- if: '$CI_COMMIT_MESSAGE =~ /\[merge-train skip\]/'
when: never
- if: '$CI_SERVER_HOST == "gitlab.com" && $CI_PROJECT_PATH == "gitlab-org/gitlab" && $CI_COMMIT_REF_NAME =~ /^[\d-]+-stable-ee$/'
.releases:rules:canonical-dot-com-gitlab-stable-branch-only-setup-test-env:
rules:
- if: '$CI_COMMIT_MESSAGE =~ /\[merge-train skip\]/'
when: never
- if: '$CI_SERVER_HOST == "gitlab.com" && $CI_PROJECT_PATH == "gitlab-org/gitlab" && $CI_COMMIT_REF_NAME =~ /^[\d-]+-stable-ee$/'
changes: *setup-test-env-patterns
.releases:rules:canonical-dot-com-security-gitlab-stable-branch-only:
rules:
- if: '$CI_COMMIT_MESSAGE =~ /\[merge-train skip\]/'
when: never
- if: '$CI_SERVER_HOST == "gitlab.com" && $CI_PROJECT_PATH == "gitlab-org/security/gitlab" && $CI_COMMIT_REF_NAME =~ /^[\d-]+-stable-ee$/'
.releases:rules:canonical-dot-com-security-gitlab-stable-branch-only-setup-test-env:
rules:
- if: '$CI_COMMIT_MESSAGE =~ /\[merge-train skip\]/'
when: never
- if: '$CI_SERVER_HOST == "gitlab.com" && $CI_PROJECT_PATH == "gitlab-org/security/gitlab" && $CI_COMMIT_REF_NAME =~ /^[\d-]+-stable-ee$/'
changes: *setup-test-env-patterns
#################
# Reports rules #
#################
.reports:rules:code_quality:
rules:
- <<: *if-merge-request-labels-pipeline-expedite
when: never
- if: '$CODE_QUALITY_DISABLED'
when: never
# Run code_quality on master until https://gitlab.com/gitlab-org/gitlab/-/issues/363747 is resolved
- <<: *if-default-branch-refs
- <<: *if-default-refs
changes: *code-backstage-qa-patterns
.reports:rules:docs_code_quality:
# Similar to above, run docs code quality job in every pipeline so there is always
# a report artifact to compare against.
rules:
- !reference [".reports:rules:code_quality", rules]
- <<: *if-default-refs
changes: *docs-patterns
.reports:rules:code_quality_cache:
rules:
- <<: *if-default-branch-refs
when: never
- <<: *if-merge-request-labels-pipeline-expedite
when: never
- if: '$CODE_QUALITY_DISABLED'
when: never
- <<: *if-default-refs
changes: *code-backstage-qa-patterns
when: never
# Use the cached report in docs-only pipelines only, never in pipelines for code changes.
- <<: *if-default-refs
changes: *docs-patterns
.reports:rules:semgrep-sast:
rules:
- <<: *if-merge-request-labels-pipeline-expedite
when: never
- if: $SAST_DISABLED
when: never
- if: $SAST_EXCLUDED_ANALYZERS =~ /semgrep/
when: never
- <<: *if-default-refs
changes:
- '**/*.py'
- '**/*.js'
- '**/*.jsx'
- '**/*.ts'
- '**/*.tsx'
- '**/*.c'
- '**/*.go'
- '**/*.rb'
.reports:rules:secret_detection:
rules:
- <<: *if-merge-request-labels-pipeline-expedite
when: never
- if: '$SECRET_DETECTION_DISABLED'
when: never
# Scan each commit on master to feed the Vulnerability Reports with detected secrets
- <<: *if-default-branch-refs
- <<: *if-default-refs
changes: *code-backstage-qa-patterns
.reports:rules:gemnasium-dependency_scanning:
rules:
- <<: *if-merge-request-labels-pipeline-expedite
when: never
- if: '$DEPENDENCY_SCANNING_DISABLED || $GITLAB_FEATURES !~ /\bdependency_scanning\b/ || $DS_EXCLUDED_ANALYZERS =~ /gemnasium([^-]|$)/'
when: never
# Run Dependency Scanning on master until https://gitlab.com/gitlab-org/gitlab/-/issues/361657 is resolved
- <<: *if-default-branch-refs
- <<: *if-default-refs
changes: *dependency-patterns
.reports:rules:gemnasium-python-dependency_scanning:
rules:
- <<: *if-merge-request-labels-pipeline-expedite
when: never
- if: '$DEPENDENCY_SCANNING_DISABLED || $GITLAB_FEATURES !~ /\bdependency_scanning\b/ || $DS_EXCLUDED_ANALYZERS =~ /gemnasium-python/'
when: never
# Run Dependency Scanning on master until https://gitlab.com/gitlab-org/gitlab/-/issues/361657 is resolved
- <<: *if-default-branch-refs
- <<: *if-default-refs
changes: *python-patterns
.reports:rules:test-dast:
rules:
- <<: *if-merge-request-labels-pipeline-expedite
when: never
- if: '$DAST_DISABLED || $GITLAB_FEATURES !~ /\bdast\b/'
when: never
- <<: *if-merge-request
.reports:rules:package_hunter-yarn:
rules:
- if: "$PACKAGE_HUNTER_USER == null || $PACKAGE_HUNTER_USER == ''"
when: never
- <<: *if-schedule-maintenance
- <<: *if-merge-request
changes: ["yarn.lock"]
.reports:rules:package_hunter-bundler:
rules:
- if: "$PACKAGE_HUNTER_USER == null || $PACKAGE_HUNTER_USER == ''"
when: never
- <<: *if-schedule-maintenance
- <<: *if-merge-request
changes: ["Gemfile.lock"]
.reports:rules:x-ray:
rules:
- <<: *if-default-branch-refs
changes: *dependency-patterns
- <<: *if-merge-request
changes: *dependency-patterns
when: never
- <<: *if-merge-request
changes: [".gitlab/ci/reports.gitlab-ci.yml"]
when: manual
- when: never
.reports:rules:pajamas_adoption:
rules:
- <<: *if-not-ee
when: never
- <<: *if-jh
when: never
- <<: *if-merge-request-labels-pipeline-expedite
when: never
- <<: *if-merge-request
changes:
- '{,ee/}app/**/*.{js,vue,rb,haml}'
- <<: *if-default-branch-refs
allow_failure: true
################
# Review rules #
################
.review-change-pattern: &review-change-pattern
APP_CHANGE_TRIGGER: "true"
# The following rules needs to be the same as the one for .review:rules:review-stop
# except that:
# - most rules re automatic here (i.e. no `when: manual`) and not allowed to fail (i.e. no `allow_failure: true`) here
# - several rules have `variables: *review-change-pattern` here
.review:rules:start-review-app-pipeline:
rules:
- <<: *if-not-ee
when: never
- <<: *if-merge-request-labels-pipeline-expedite
when: never
- <<: *if-merge-request-labels-run-review-app
- if: '$CI_REVIEW_APPS_ENABLED != "true"'
when: never
- !reference [".prevent-tier-2-and-below", rules]
- <<: *if-dot-com-gitlab-org-merge-request
changes: *ci-review-patterns
- <<: *if-dot-com-gitlab-org-merge-request
changes: *frontend-build-patterns
variables: *review-change-pattern
- <<: *if-dot-com-gitlab-org-merge-request
changes: *controllers-patterns
variables: *review-change-pattern
when: manual
allow_failure: true
- <<: *if-dot-com-gitlab-org-merge-request
changes: *models-patterns
variables: *review-change-pattern
when: manual
allow_failure: true
- <<: *if-dot-com-gitlab-org-merge-request
changes: *lib-gitlab-patterns
variables: *review-change-pattern
when: manual
allow_failure: true
- <<: *if-dot-com-gitlab-org-merge-request
changes: *qa-patterns
- <<: *if-dot-com-gitlab-org-merge-request
changes: *code-patterns
when: manual
allow_failure: true
- <<: *if-dot-com-gitlab-org-schedule
allow_failure: true
variables:
QA_SAVE_TEST_METRICS: "true"
QA_EXPORT_TEST_METRICS: "false" # on main runs, metrics are exported to separate bucket via rake task for better consistency
.review:rules:review-cleanup:
rules:
- <<: *if-dot-com-gitlab-org-merge-request
changes:
- "scripts/review_apps/automated_cleanup.rb"
- "tooling/lib/tooling/helm3_client.rb"
- "tooling/lib/tooling/kubernetes_client.rb"
- <<: *if-dot-com-gitlab-org-merge-request
changes: *ci-review-patterns
when: manual
allow_failure: true
- <<: *if-dot-com-ee-schedule-default-branch-maintenance
allow_failure: true
.review:rules:review-stop:
rules:
- <<: *if-not-ee
when: never
- <<: *if-merge-request-labels-pipeline-expedite
when: never
- <<: *if-merge-request-labels-run-review-app
when: manual
allow_failure: true
- if: '$CI_REVIEW_APPS_ENABLED != "true"'
when: never
- !reference [".prevent-tier-2-and-below", rules]
- <<: *if-dot-com-gitlab-org-merge-request
changes: *ci-review-patterns
when: manual
allow_failure: true
- <<: *if-dot-com-gitlab-org-merge-request
changes: *frontend-build-patterns
when: manual
allow_failure: true
- <<: *if-dot-com-gitlab-org-merge-request
changes: *controllers-patterns
when: manual
allow_failure: true
- <<: *if-dot-com-gitlab-org-merge-request
changes: *models-patterns
when: manual
allow_failure: true
- <<: *if-dot-com-gitlab-org-merge-request
changes: *lib-gitlab-patterns
when: manual
allow_failure: true
- <<: *if-dot-com-gitlab-org-merge-request
changes: *qa-patterns
when: manual
allow_failure: true
- <<: *if-dot-com-gitlab-org-merge-request
changes: *code-patterns
when: manual
allow_failure: true
- <<: *if-dot-com-gitlab-org-schedule
when: manual
allow_failure: true
.review:rules:review-k8s-resources-count-checks:
rules:
- <<: *if-dot-com-ee-schedule-default-branch-maintenance
allow_failure: true
- <<: *if-dot-com-gitlab-org-merge-request
changes:
- "scripts/review_apps/k8s-resources-count-checks.sh"
allow_failure: true
.review:rules:review-gcp-quotas-checks:
rules:
- <<: *if-dot-com-ee-schedule-default-branch-maintenance
allow_failure: true
- <<: *if-dot-com-gitlab-org-merge-request
changes:
- "scripts/review_apps/gcp-quotas-checks.rb"
allow_failure: true
.review:rules:danger:
rules:
- <<: *if-merge-request
.review:rules:danger-local:
rules:
- <<: *if-merge-request
changes: *danger-patterns
###############
# Setup rules #
###############
.setup:rules:cache-gems:
rules:
- <<: *if-not-canonical-namespace
when: never
- <<: *if-default-branch-or-tag
changes: *code-backstage-qa-patterns
- <<: *if-dot-com-gitlab-org-merge-request
changes: [".gitlab/ci/setup.gitlab-ci.yml"]
when: manual
allow_failure: true
.setup:rules:dont-interrupt-me:
rules:
- <<: *if-default-branch-or-tag
allow_failure: true
- <<: *if-schedule-pipeline
allow_failure: true
- <<: *if-auto-deploy-branches
allow_failure: true
- when: manual
allow_failure: true
.setup:rules:clone-gitlab-repo:
rules:
- <<: *if-dot-com-gitlab-org-and-subgroups-merge-train
when: never
- if: '$CI_FETCH_REPO_GIT_STRATEGY == "none"'
.setup:rules:gitlab_git_test:
rules:
- <<: *if-merge-request-labels-pipeline-expedite
when: never
- <<: *if-default-refs
changes: *code-backstage-patterns
.setup:rules:set-pipeline-name:
rules:
- <<: *if-not-merge-request # This is only designed to run in a merge request
when: never
- if: '$PROJECT_TOKEN_FOR_CI_SCRIPTS_API_USAGE == null'
when: never
- <<: *if-merge-request
.setup:rules:verify-tests-yml:
rules:
- <<: *if-not-ee
when: never
- <<: *if-merge-request-labels-pipeline-expedite
when: never
- <<: *if-default-refs
changes: *code-backstage-patterns
.setup:rules:jh-contribution:
rules:
- <<: *if-jh
when: never
- <<: *if-merge-request-labels-jh-contribution
.setup:rules:generate-frontend-fixtures-mapping:
rules:
- <<: *if-not-ee
when: never
- <<: *if-dot-com-ee-schedule-default-branch-maintenance
- <<: *if-default-branch-refs
changes:
- ".gitlab/ci/setup.gitlab-ci.yml"
- ".gitlab/ci/test-metadata.gitlab-ci.yml"
- "scripts/rspec_helpers.sh"
###################
# Preflight rules #
###################
.preflight:rules:rails-production-server-boot:
rules:
- <<: *if-default-refs
changes: *code-patterns
.preflight:rules:ruby_syntax:
rules:
- <<: *if-default-refs
changes: *ruby-patterns
.preflight:rules:no-ee-check:
rules:
- <<: *if-not-foss
when: never
- <<: *if-default-refs
changes: *code-backstage-patterns
.preflight:rules:no-jh-check:
rules:
- <<: *if-jh
when: never
- <<: *if-default-refs
changes: *code-backstage-patterns
.preflight:rules:pipeline-tier-1:
rules:
- <<: *if-merge-request-labels-pipeline-expedite
when: never
- <<: *if-merge-request-tier-1
allow_failure: true
- !reference [".prevent-tier-2-and-above", rules]
# If we cannot find a tier label, run this job
#
# This could be the very first pipeline of a merge request if no
# pipeline tier label was added when creating the merge request.
- <<: *if-dot-com-gitlab-org-merge-request
allow_failure: true
.preflight:rules:pipeline-tier-2:
rules:
- <<: *if-merge-request-tier-2
allow_failure: true
.preflight:rules:pipeline-tier-3:
rules:
- <<: *if-merge-request-tier-3
allow_failure: true
#######################
# Test metadata rules #
#######################
.test-metadata:rules:retrieve-tests-metadata:
rules:
- if: '$ENABLE_RSPEC == "true"'
- <<: *if-default-refs
changes: *code-backstage-patterns
- <<: *if-default-refs
changes: *workhorse-patterns
- <<: *if-default-branch-refs
changes: *setup-test-env-patterns
- <<: *if-merge-request-labels-run-all-rspec
- <<: *if-merge-request-labels-frontend-and-feature-flag
- <<: *if-merge-request
changes: *backend-patterns
.test-metadata:rules:update-tests-metadata:
rules:
- <<: *if-not-ee
when: never
- <<: *if-dot-com-ee-schedule-default-branch-maintenance
when: always
- <<: *if-default-branch-refs
changes:
- ".gitlab/ci/test-metadata.gitlab-ci.yml"
- "scripts/rspec_helpers.sh"
- <<: *if-merge-request-not-approved
when: never
- <<: *if-merge-request
changes:
- "scripts/flaky_examples/prune-old-flaky-examples"
###################
# workhorse rules #
###################
.workhorse:rules:workhorse:
rules:
- <<: *if-default-refs
changes: *workhorse-patterns
###################
# yaml-lint rules #
###################
.yaml-lint:rules:
rules:
- <<: *if-default-refs
changes: *yaml-lint-patterns
.lint-pipeline-yaml:rules:
rules:
- <<: *if-default-refs
changes: *lint-pipeline-yaml-patterns
.lint-metrics-yaml:rules:
rules:
- <<: *if-default-refs
changes: *lint-metrics-yaml-patterns
####################
# as-if-foss rules #
####################
# This is a very big rules set because it's the union of all as-if-foss jobs.
# We want to start this for any FOSS jobs we want to run. For example:
# (This is not an exhaustive list and can be outdated!)
# .build-images:rules:build-qa-image-merge-requests
# .build-images:rules:build-assets-image
# .frontend:rules:compile-production-assets
# .rails:rules:single-db
# .rails:rules:single-db-ci-connection
# .rails:rules:single-redis
# .rails:rules:ee-and-foss-default-rules
# .rails:rules:system-default-rules
.as-if-foss:rules:start-as-if-foss:
rules:
- if: '$AS_IF_FOSS_TOKEN == null'
when: never
- <<: *if-not-merge-request # This is only designed to run in a merge request
when: never
- !reference [".strict-ee-only-rules", rules]
- <<: *if-merge-request-labels-as-if-foss
- <<: *if-merge-request-labels-run-all-rspec
- <<: *if-merge-request-labels-run-all-jest
- <<: *if-merge-request-labels-run-clusterwide-db
- <<: *if-merge-request-labels-run-single-db
- <<: *if-merge-request-labels-run-review-app
- <<: *if-merge-request-labels-run-all-e2e
- <<: *if-merge-request-labels-pipeline-expedite
when: never
- <<: *if-merge-request-targeting-stable-branch
changes: *setup-test-env-patterns
- <<: *if-automated-merge-request
changes: *db-patterns
- <<: *if-automated-merge-request
changes: *backend-patterns
- <<: *if-automated-merge-request
changes: *code-backstage-patterns
- <<: *if-security-merge-request
changes: *backend-patterns
- <<: *if-security-merge-request
changes: *code-backstage-qa-patterns
- <<: *if-security-merge-request
changes: *db-patterns
- <<: *if-merge-request-labels-frontend-and-feature-flag
- <<: *if-merge-request
changes: *code-backstage-qa-patterns
- <<: *if-merge-request
changes: *nodejs-patterns
- <<: *if-merge-request
changes: *static-analysis-patterns
- <<: *if-merge-request
changes: *db-patterns
- <<: *if-merge-request
changes: *workhorse-patterns
- <<: *if-merge-request
changes: *decomposed-db-models-patterns
- <<: *if-merge-request
changes: *redis-patterns
- <<: *if-merge-request
changes: *feature-flag-development-config-patterns
.as-if-foss:rules:start-as-if-foss:allow-failure:manual:
rules:
- if: '$AS_IF_FOSS_TOKEN == null'
when: never
- <<: *if-not-merge-request
when: never
- !reference [".strict-ee-only-rules", rules]
# Copy everything from .as-if-foss:rules:start-as-if-foss
# and add `allow_failure: true` and `when: manual` to all
- <<: *if-merge-request-labels-as-if-foss
allow_failure: true
when: manual
- <<: *if-merge-request-labels-run-all-rspec
allow_failure: true
when: manual
- <<: *if-merge-request-labels-run-all-jest
allow_failure: true
when: manual
- <<: *if-merge-request-labels-run-clusterwide-db
allow_failure: true
when: manual
- <<: *if-merge-request-labels-run-single-db
allow_failure: true
when: manual
- <<: *if-merge-request-labels-run-review-app
allow_failure: true
when: manual
- <<: *if-merge-request-labels-run-all-e2e
allow_failure: true
when: manual
- <<: *if-merge-request-labels-pipeline-expedite
when: never
- <<: *if-merge-request-targeting-stable-branch
changes: *setup-test-env-patterns
allow_failure: true
when: manual
- <<: *if-automated-merge-request
changes: *db-patterns
allow_failure: true
when: manual
- <<: *if-automated-merge-request
changes: *backend-patterns
allow_failure: true
when: manual
- <<: *if-automated-merge-request
changes: *code-backstage-patterns
allow_failure: true
when: manual
- <<: *if-security-merge-request
changes: *backend-patterns
allow_failure: true
when: manual
- <<: *if-security-merge-request
changes: *code-backstage-qa-patterns
allow_failure: true
when: manual
- <<: *if-security-merge-request
changes: *db-patterns
allow_failure: true
when: manual
- <<: *if-merge-request-labels-frontend-and-feature-flag
allow_failure: true
when: manual
- <<: *if-merge-request
changes: *code-backstage-qa-patterns
allow_failure: true
when: manual
- <<: *if-merge-request
changes: *nodejs-patterns
allow_failure: true
when: manual
- <<: *if-merge-request
changes: *static-analysis-patterns
allow_failure: true
when: manual
- <<: *if-merge-request
changes: *db-patterns
allow_failure: true
when: manual
- <<: *if-merge-request
changes: *workhorse-patterns
allow_failure: true
when: manual
- <<: *if-merge-request
changes: *decomposed-db-models-patterns
allow_failure: true
when: manual
- <<: *if-merge-request
changes: *redis-patterns
allow_failure: true
when: manual
- <<: *if-merge-request
changes: *feature-flag-development-config-patterns
allow_failure: true
when: manual
.as-if-foss:rules:start-as-if-foss:allow-failure:
rules:
- if: '$AS_IF_FOSS_TOKEN == null'
when: never
- <<: *if-not-merge-request
when: never
- !reference [".strict-ee-only-rules", rules]
# Copy everything from .as-if-foss:rules:start-as-if-foss
# and add `allow_failure: true` to all
- <<: *if-merge-request-labels-as-if-foss
allow_failure: true
- <<: *if-merge-request-labels-run-all-rspec
allow_failure: true
- <<: *if-merge-request-labels-run-all-jest
allow_failure: true
- <<: *if-merge-request-labels-run-clusterwide-db
allow_failure: true
- <<: *if-merge-request-labels-run-single-db
allow_failure: true
- <<: *if-merge-request-labels-run-review-app
allow_failure: true
- <<: *if-merge-request-labels-run-all-e2e
allow_failure: true
- <<: *if-merge-request-labels-pipeline-expedite
when: never
- <<: *if-merge-request-targeting-stable-branch
changes: *setup-test-env-patterns
allow_failure: true
- <<: *if-automated-merge-request
changes: *db-patterns
allow_failure: true
- <<: *if-automated-merge-request
changes: *backend-patterns
allow_failure: true
- <<: *if-automated-merge-request
changes: *code-backstage-patterns
allow_failure: true
- <<: *if-security-merge-request
changes: *backend-patterns
allow_failure: true
- <<: *if-security-merge-request
changes: *code-backstage-qa-patterns
allow_failure: true
- <<: *if-security-merge-request
changes: *db-patterns
allow_failure: true
- <<: *if-merge-request-labels-frontend-and-feature-flag
allow_failure: true
- <<: *if-merge-request
changes: *code-backstage-qa-patterns
allow_failure: true
- <<: *if-merge-request
changes: *nodejs-patterns
allow_failure: true
- <<: *if-merge-request
changes: *static-analysis-patterns
allow_failure: true
- <<: *if-merge-request
changes: *db-patterns
allow_failure: true
- <<: *if-merge-request
changes: *workhorse-patterns
allow_failure: true
- <<: *if-merge-request
changes: *decomposed-db-models-patterns
allow_failure: true
- <<: *if-merge-request
changes: *redis-patterns
allow_failure: true
- <<: *if-merge-request
changes: *feature-flag-development-config-patterns
allow_failure: true
##################
# as-if-jh rules #
##################
.as-if-jh:rules:prepare-as-if-jh:
rules:
- !reference [".strict-ee-only-rules", rules]
- <<: *if-merge-request-labels-force-as-if-jh
- if: '$CI_AS_IF_JH_ENABLED != "true"'
when: never
- <<: *if-merge-request-not-approved
when: never
- <<: *if-merge-request-labels-as-if-jh
- <<: *if-merge-request
changes: *feature-flag-development-config-patterns
# This rule should share the same logic with .as-if-jh:rules:prepare-as-if-jh
# in additionally that there are changes in dependency-patterns
# Unfortunately, we can't say it has changes in
# feature-flag-development-config-patterns
# And in
# dependency-patterns
# At the same time. Note that this can't be using OR so using a union pattern
# doesn't work either. Given that we cannot specify this, there's a gap can
# happen when:
# * The merge request does not have ~"pipeline:run-as-if-jh"
# * The merge request changes a feature flag
# * The merge request also changes dependencies
# In this case, we expect that we do run `sync-as-if-jh-branch` but it won't,
# meaning that dependencies in the JH validation pipeline will be outdated.
# To work around this issue, apply ~"pipeline:run-as-if-jh" to the merge
# request so we can force it to run `sync-as-if-jh-branch` when there are
# dependencies changes.
.as-if-jh:rules:sync-as-if-jh:
rules:
- !reference [".strict-ee-only-rules", rules]
- <<: *if-merge-request-labels-force-as-if-jh
changes: *dependency-patterns
- if: '$CI_AS_IF_JH_ENABLED != "true"'
when: never
- <<: *if-merge-request-not-approved
when: never
- <<: *if-merge-request-labels-as-if-jh
changes: *dependency-patterns
# Ideally, we should be able to do this:
# - <<: *if-dot-com-gitlab-org-merge-request
# changes: *feature-flag-development-config-patterns && *dependency-patterns
##############################
# release-environments rules #
##############################
.release-environments:rules:start-release-environments-pipeline:
rules:
- <<: *if-not-ee
when: never
- <<: *if-merge-request-labels-pipeline-expedite
when: never
- <<: *if-dot-com-gitlab-org-ee-tag
when: always
- !reference [".releases:rules:canonical-dot-com-gitlab-stable-branch-only", rules]
.release-environments:rules:start-release-environments-security-pipeline:
rules:
- <<: *if-not-ee
when: never
- <<: *if-merge-request-labels-pipeline-expedite
when: never
- <<: *if-dot-com-gitlab-org-security-ee-tag
when: always
- !reference [".releases:rules:canonical-dot-com-security-gitlab-stable-branch-only", rules]
###################
# Benchmark rules #
###################
.benchmark:rules:benchmark-markdown:
rules:
- <<: *if-default-refs
changes: *setup-test-env-patterns
when: manual
- <<: *if-merge-request-labels-run-all-rspec
when: manual
###############################
# Observability Backend rules #
###############################
.observability-backend:rules:
rules:
- <<: *if-merge-request
changes: *code-patterns
when: manual
allow_failure: true
- <<: *if-merge-request
changes: *ci-patterns
when: manual
allow_failure: true
##########################
# Pre-merge checks rules #
##########################
.pre-merge:rules:pre-merge-checks:
rules:
- <<: *if-dot-com-gitlab-org-and-subgroups-merge-train
# So that we can run the job when making change to it in non-merge train pipelines
- <<: *if-merge-request
changes:
- .gitlab/ci/pre-merge.gitlab-ci.yml
- scripts/pipeline/pre_merge_checks.rb
when: manual
allow_failure: true
########################
# Pipeline tiers rules #
########################
.prevent-tier-1:
rules:
- <<: *if-merge-request-no-tier # Assuming tier-1
when: never
- <<: *if-merge-request-tier-1
when: never
.prevent-tier-2-and-below:
rules:
- !reference [".prevent-tier-1", rules]
- <<: *if-merge-request-tier-2
when: never
.prevent-tier-3-and-below:
rules:
- !reference [".prevent-tier-2-and-below", rules]
- <<: *if-merge-request-tier-3
when: never
.prevent-tier-2-and-above:
rules:
- <<: *if-merge-request-tier-2
when: never
- !reference [".prevent-tier-3-and-above", rules]
.prevent-tier-3-and-above:
rules:
- <<: *if-merge-request-tier-3
when: never
# Insurance in case a gem needed by one of our releases gets yanked from
# rubygems.org in the future.
cache gems:
extends:
- .default-retry
- .ruby-cache
- .default-before_script
- .setup:rules:cache-gems
stage: prepare
needs: []
variables:
BUNDLE_WITHOUT: ""
BUNDLE_WITH: "production:development:test"
SETUP_DB: "false"
script:
- echo -e "\e[0Ksection_start:`date +%s`:bundle-package[collapsed=true]\r\e[0KPackaging gems"
- bundle config set cache_all true
- run_timed_command "bundle package --all-platforms"
- echo -e "\e[0Ksection_end:`date +%s`:bundle-package\r\e[0K"
artifacts:
paths:
- vendor/cache
expire_in: 31d
.predictive-job:
extends:
- .default-retry
needs: []
.absolutely-predictive-job:
extends:
- .predictive-job
image: ${GITLAB_DEPENDENCY_PROXY_ADDRESS}alpine:latest
variables:
GIT_STRATEGY: none
dont-interrupt-me:
extends:
- .absolutely-predictive-job
- .setup:rules:dont-interrupt-me
stage: sync
interruptible: false
script:
- echo "This jobs makes sure this pipeline won't be interrupted! See https://docs.gitlab.com/ee/ci/yaml/#interruptible."
clone-gitlab-repo:
extends:
- .absolutely-predictive-job
- .setup:rules:clone-gitlab-repo
stage: sync
script:
- echo OK
variables:
GIT_STRATEGY: clone
artifacts:
paths:
- '*'
expire_in: '12 hours'
set-pipeline-name:
extends:
- .predictive-job
- .setup:rules:set-pipeline-name
- .fast-no-clone-job
variables:
# We use > instead of | because we want the files to be space-separated.
FILES_TO_DOWNLOAD: >
scripts/utils.sh
scripts/pipeline/set_pipeline_name.rb
image: ${GITLAB_DEPENDENCY_PROXY_ADDRESS}ruby:${RUBY_VERSION}-alpine3.20
stage: prepare
before_script:
- apk add --no-cache --update curl # Not present in ruby-alpine, so we add it manually
- !reference [".fast-no-clone-job", before_script]
script:
- install_gitlab_gem
- chmod u+x scripts/pipeline/set_pipeline_name.rb && scripts/pipeline/set_pipeline_name.rb
allow_failure:
exit_codes:
- 3
gitlab_git_test:
extends:
- .predictive-job
- .setup:rules:gitlab_git_test
stage: test
script:
- spec/support/prepare-gitlab-git-test-for-commit --check-for-changes
verify-tests-yml:
extends:
- .setup:rules:verify-tests-yml
image: ${GITLAB_DEPENDENCY_PROXY_ADDRESS}ruby:${RUBY_VERSION}-alpine3.20
stage: preflight
needs: []
script:
- source scripts/utils.sh
- install_tff_gem
- scripts/verify-tff-mapping
verify-approvals:
extends:
- .predictive-job
- .setup:rules:jh-contribution
script:
- source scripts/utils.sh
- install_gitlab_gem
- tooling/bin/find_app_sec_approval
generate-frontend-fixtures-mapping:
extends:
- .setup:rules:generate-frontend-fixtures-mapping
- .use-pg14
- .ruby-cache
needs: ["setup-test-env"]
stage: prepare
before_script:
- !reference [.default-before_script, before_script]
- source ./scripts/rspec_helpers.sh
- section_start "gitaly-test-spawn" "Spawning Gitaly"; scripts/gitaly-test-spawn; section_end "gitaly-test-spawn"; # Do not use 'bundle exec' here
script:
- generate_frontend_fixtures_mapping
artifacts:
expire_in: 7d
paths:
- ${FRONTEND_FIXTURES_MAPPING_PATH}
detect-tests:
extends: .rails:rules:detect-tests
image: ${GITLAB_DEPENDENCY_PROXY_ADDRESS}ruby:${RUBY_VERSION}-slim
needs: []
stage: prepare
variables:
RSPEC_TESTS_MAPPING_ENABLED: "true"
before_script:
- apt update && apt install -y curl
script:
- source ./scripts/utils.sh
- source ./scripts/rspec_helpers.sh
- install_gitlab_gem
- install_tff_gem
- retrieve_tests_mapping
- retrieve_frontend_fixtures_mapping
- |
# $FIND_CHANGES_MERGE_REQUEST_IID is defined in as-if-foss.gitlab-ci.yml
if [ -n "$CI_MERGE_REQUEST_IID" ] || [ -n "$FIND_CHANGES_MERGE_REQUEST_IID" ]; then
mkdir -p $(dirname "$RSPEC_CHANGED_FILES_PATH")
tooling/bin/predictive_tests
filter_rspec_matched_foss_tests ${RSPEC_MATCHING_TESTS_PATH} ${RSPEC_MATCHING_TESTS_FOSS_PATH};
filter_rspec_matched_ee_tests ${RSPEC_MATCHING_TESTS_PATH} ${RSPEC_MATCHING_TESTS_EE_PATH};
echoinfo 'Changed files:'
echoinfo "$(tr ' ' '\n' < $RSPEC_CHANGED_FILES_PATH)"
echo ""
echoinfo 'Related FOSS RSpec tests:'
echoinfo "$(tr ' ' '\n' < $RSPEC_MATCHING_TESTS_FOSS_PATH)"
echo ""
echoinfo 'Related EE RSpec tests:'
echoinfo "$(tr ' ' '\n' < $RSPEC_MATCHING_TESTS_EE_PATH)"
echo ""
echoinfo 'Related JS files:'
echoinfo "$(tr ' ' '\n' < $RSPEC_MATCHING_JS_FILES_PATH)"
echo ""
fi
artifacts:
expire_in: 7d
paths:
- ${FRONTEND_FIXTURES_MAPPING_PATH}
- ${RSPEC_CHANGED_FILES_PATH}
- ${RSPEC_MATCHING_JS_FILES_PATH}
- ${RSPEC_MATCHING_TESTS_EE_PATH}
- ${RSPEC_MATCHING_TESTS_FOSS_PATH}
- ${RSPEC_MATCHING_TESTS_PATH}
- ${RSPEC_VIEWS_INCLUDING_PARTIALS_PATH}
detect-previous-failed-tests:
extends:
- detect-tests
- .rails:rules:detect-previous-failed-tests
variables:
PREVIOUS_FAILED_TESTS_DIR: tmp/previous_failed_tests/
script:
- source ./scripts/utils.sh
- source ./scripts/rspec_helpers.sh
- retrieve_failed_tests "${PREVIOUS_FAILED_TESTS_DIR}" "oneline" "previous"
artifacts:
expire_in: 7d
paths:
- ${PREVIOUS_FAILED_TESTS_DIR}
e2e-test-pipeline-generate:
extends:
- .qa-job-base
- .predictive-job
- .qa:rules:determine-e2e-tests
stage: prepare
variables:
ENV_FILE: $CI_PROJECT_DIR/qa_tests_vars.env
COLORIZED_LOGS: "true"
script:
- bundle exec rake "ci:detect_changes[$ENV_FILE]"
- cd $CI_PROJECT_DIR && scripts/generate-e2e-pipeline
artifacts:
expire_in: 1 day
paths:
- '*-pipeline.yml'
- "${CI_PROJECT_DIR}/qa_tests_vars.env"
# This is the manual start of the chain of E2E jobs
# After playing this, it'll follow up with:
# follow-up:compile-production-assets -> follow-up:build-assets-image --\
# \-> follow-up:e2e:package-and-test-ee
# follow-up:build-qa-image --------------------------------------------------------------------------/
manual:e2e-test-pipeline-generate:
extends:
- e2e-test-pipeline-generate
- .qa:rules:manual-e2e
.static-analysis-base:
extends:
- .default-retry
- .default-before_script
stage: lint
needs: []
variables:
SETUP_DB: "false"
ENABLE_SPRING: "1"
# Disable warnings in browserslist which can break on backports
# https://github.com/browserslist/browserslist/blob/a287ec6/node.js#L367-L384
BROWSERSLIST_IGNORE_OLD_DATA: "true"
GRAPHQL_SCHEMA_APOLLO_FILE: "tmp/tests/graphql/gitlab_schema_apollo.graphql"
update-static-analysis-cache:
extends:
- .static-analysis-base
- .rubocop-job-cache-push
- .shared:rules:update-cache
stage: prepare
script:
# Silence cop offenses for rules with "grace period".
# This will notify Slack if offenses were silenced.
# For the moment we only cache `tmp/rubocop_cache` so we don't need to run all the tasks.
- run_timed_command "fail_on_warnings bundle exec rake rubocop:check:graceful"
static-analysis:
extends:
- .static-analysis-base
- .static-analysis-cache
- .static-analysis:rules:static-analysis
parallel: 2
script:
- yarn_install_script
- fail_on_warnings scripts/static-analysis
static-verification-with-database:
extends:
- .static-analysis-base
- .rubocop-job-cache
- .static-analysis:rules:static-verification-with-database
- .use-pg14
script:
- bundle exec rake lint:static_verification_with_database
variables:
SETUP_DB: "true"
generate-apollo-graphql-schema:
extends:
- .static-analysis-base
- .frontend:rules:default-frontend-jobs
image:
name: ${REGISTRY_HOST}/${REGISTRY_GROUP}/gitlab-build-images:apollo
entrypoint: [""]
needs: ['graphql-schema-dump']
variables:
USE_BUNDLE_INSTALL: "false"
script:
- apollo client:download-schema --config=config/apollo.config.js ${GRAPHQL_SCHEMA_APOLLO_FILE}
artifacts:
expire_in: 30 days
name: graphql-schema-apollo
paths:
- "${GRAPHQL_SCHEMA_APOLLO_FILE}"
eslint:
extends:
- .static-analysis-base
- .yarn-cache
- .frontend:rules:default-frontend-jobs
needs: ['generate-apollo-graphql-schema']
variables:
USE_BUNDLE_INSTALL: "false"
script:
- yarn_install_script
- run_timed_command "yarn run lint:eslint:all"
haml-lint:
extends:
- .static-analysis-base
- .ruby-cache
- .static-analysis:rules:haml-lint
script:
- run_timed_command "bundle exec haml-lint --parallel app/views"
artifacts:
expire_in: 31d
when: always
paths:
- tmp/feature_flags/
haml-lint ee:
extends:
- "haml-lint"
- .static-analysis:rules:haml-lint-ee
script:
- run_timed_command "bundle exec haml-lint --parallel ee/app/views"
rubocop:
extends:
- .static-analysis-base
- .rubocop-job-cache
- .static-analysis:rules:rubocop
needs:
- job: detect-tests
optional: true
variables:
RUBOCOP_TARGET_FILES: "tmp/rubocop_target_files.txt"
script:
- |
# For non-merge request, or when RUN_ALL_RUBOCOP is 'true', run all RuboCop rules
if [ -z "${CI_MERGE_REQUEST_IID:-$FIND_CHANGES_MERGE_REQUEST_IID}" ] || [ "${RUN_ALL_RUBOCOP}" == "true" ]; then
# Silence cop offenses for rules with "grace period".
# We won't notify Slack if offenses were silenced to avoid frequent messages.
# Job `update-static-analysis-cache` takes care of Slack notifications every 2 hours.
unset CI_SLACK_WEBHOOK_URL
run_timed_command "fail_on_warnings bundle exec rake rubocop:check:graceful"
else
select_existing_files < "${RSPEC_CHANGED_FILES_PATH}" > "${RUBOCOP_TARGET_FILES}"
# Skip running RuboCop if there's no target files
if [ -s "${RUBOCOP_TARGET_FILES}" ]; then
run_timed_command "fail_on_warnings bundle exec rubocop --parallel --force-exclusion $(cat ${RUBOCOP_TARGET_FILES})"
else
echoinfo "Nothing interesting changed for RuboCop. Skipping."
fi
fi
feature-flags-usage:
extends:
- .static-analysis-base
- .rubocop-job-cache
- .static-analysis:rules:rubocop
script:
# We need to disable the cache for this cop since it creates files under tmp/feature_flags/*.used,
# the cache would prevent these files from being created.
- run_timed_command "fail_on_warnings bundle exec rubocop --only Gitlab/MarkUsedFeatureFlags --cache false"
artifacts:
expire_in: 31d
when: always
paths:
- tmp/feature_flags/
semgrep-appsec-custom-rules:
stage: lint
extends:
- .semgrep-appsec-custom-rules:rules
image: returntocorp/semgrep
needs: []
script:
- git fetch origin master
- git clone $CUSTOM_RULES_REPOSITORY "${CI_BUILDS_DIR}/sast-custom-rules"
# Include/exclude list isn't ideal https://github.com/returntocorp/semgrep/issues/5399
- |
rm "${CI_BUILDS_DIR}/sast-custom-rules/.gitlab-ci.yml" # semgrep fails when there are yaml files that are not rules
semgrep ci --metrics off --config "${CI_BUILDS_DIR}/sast-custom-rules" \
--include app --include lib --include workhorse \
--exclude '*_test.go' --exclude spec --exclude qa --exclude tooling --json --verbose > gl-sast-report.json || true
variables:
CUSTOM_RULES_REPOSITORY: https://gitlab.com/gitlab-com/gl-security/product-security/appsec/sast-custom-rules.git
artifacts:
expire_in: 30 days
paths:
- gl-sast-report.json
access: 'developer'
audit-event-types-verify:
variables:
SETUP_DB: "false"
extends:
- .default-retry
- .ruby-cache
- .default-before_script
- .audit-event-types:rules:audit-event-types-verify
stage: lint
needs: []
script:
- bundle exec rake gitlab:audit_event_types:check_docs
custom-roles-verify:
variables:
SETUP_DB: "false"
extends:
- .default-retry
- .ruby-cache
- .default-before_script
- .custom-roles:rules:custom-roles-verify
stage: lint
needs: []
script:
- bundle exec rake gitlab:custom_roles:check_docs
templates-shellcheck:
extends:
- .ci-templates:rules:shellcheck
- .default-before_script
- .default-retry
- .ruby-cache
- .use-pg16
stage: lint
needs:
- setup-test-env
script:
- bundle exec scripts/lint_templates_bash.rb
ping-appsec-for-sast-findings:
stage: lint
image: alpine:latest
extends:
- .ping-appsec-for-sast-findings:rules
variables:
# Project Access Token bot ID for /gitlab-com/gl-security/product-security/appsec/sast-custom-rules
BOT_USER_ID: 19650678
needs:
- semgrep-appsec-custom-rules
script:
- apk update
- apk add ruby
- ruby scripts/semgrep_result_processor.rb
ping-appsec-for-dependency-review:
stage: lint
needs: []
variables:
GIT_CHECKOUT: "false"
DISABLE_MENTIONS: "false"
DISABLE_SCORING: "true"
DISABLE_COMMENTING: "false"
DEPENDENCY_REVIEW_BOT_CI_REG: "${CI_REGISTRY}/gitlab-com/gl-security/product-security/appsec/tooling/depscore/master"
extends: [".ping-appsec-for-dependency-review:rules", ".use-docker-in-docker"]
before_script:
- apk add jq curl
- DEPENDENCY_REVIEW_BOT_UNAME=$(curl --header "PRIVATE-TOKEN:$DEPENDENCY_REVIEW_PAT" "https://gitlab.com/api/v4/user" | jq -r '.username')
- echo "$DEPENDENCY_REVIEW_PAT" | docker login --password-stdin -u "$DEPENDENCY_REVIEW_BOT_UNAME" -- "$DEPENDENCY_REVIEW_BOT_CI_REG"
script:
- docker run --interactive --rm "$DEPENDENCY_REVIEW_BOT_CI_REG:latest" -t "$DEPENDENCY_REVIEW_PAT" -p "$CI_PROJECT_ID" -m "$CI_MERGE_REQUEST_IID" -s "$DISABLE_SCORING" -a "$DISABLE_MENTIONS" -c "$DISABLE_COMMENTING"
allow_failure: true
# The template generates jobs that trigger child pipelines for gems vendored in the main GitLab project under `gems/`.
#
# Inputs:
# - `gem_name`: The name of the gem, i.e. if the gem is located at `gems/gitlab-rspec`, `gem_name` should be set to `gitlab-rspec`.
# - `gem_path_prefix`: The prefix of the gem path, i.e. if the gem is located at `vendor/gems/gitlab-rspec`, `gem_path_prefix` should be set to `vendor/gems/`. Defaults to `gems/`.
spec:
inputs:
gem_name:
gem_path_prefix:
default: "gems/"
enabled:
default: "true"
---
.gems:rules:$[[inputs.gem_name]]:
rules:
- if: "'$[[inputs.enabled]]' != 'true'"
when: never
- if: '$CI_PIPELINE_SOURCE == "schedule" && $SCHEDULE_TYPE == "maintenance"'
- if: '$CI_MERGE_REQUEST_EVENT_TYPE == "merged_result" || $CI_MERGE_REQUEST_EVENT_TYPE == "detached"'
changes:
- "$[[inputs.gem_path_prefix]]$[[inputs.gem_name]]/**/*"
- ".gitlab/ci/gitlab-gems.gitlab-ci.yml"
- ".gitlab/ci/vendored-gems.gitlab-ci.yml"
- ".gitlab/ci/templates/gem.gitlab-ci.yml"
- "scripts/validate-monorepo-gem"
# Ensure dependency updates don't fail child pipelines: https://gitlab.com/gitlab-org/gitlab/-/issues/417428
- "Gemfile.lock"
- "gems/gem.gitlab-ci.yml"
- "gems/gem-pg.gitlab-ci.yml"
# Ensure new cop in the monolith don't break internal gems Rubocop checks: https://gitlab.com/gitlab-org/gitlab/-/issues/419915
- ".rubocop.yml"
- "rubocop/**/*"
- ".rubocop_todo/**/*"
gems $[[inputs.gem_name]]:
extends: ".gems:rules:$[[inputs.gem_name]]"
needs: []
trigger:
include: "$[[inputs.gem_path_prefix]]$[[inputs.gem_name]]/.gitlab-ci.yml"
strategy: depend
inherit:
variables: false
variables:
FF_NETWORK_PER_BUILD: "true"
.tests-metadata-state:
image: ${GITLAB_DEPENDENCY_PROXY_ADDRESS}ruby:${RUBY_VERSION}
before_script:
- source scripts/utils.sh
artifacts:
expire_in: 31d
paths:
- knapsack/
- rspec/
- crystalball/
when: always
retrieve-tests-metadata:
extends:
- .tests-metadata-state
- .test-metadata:rules:retrieve-tests-metadata
# We use a smaller image for this job only (update-tests-metadata compiles some gems)
image: ${GITLAB_DEPENDENCY_PROXY_ADDRESS}ruby:${RUBY_VERSION}-slim
stage: prepare
needs: []
script:
- apt-get update && apt-get install -y curl # Not present in ruby-slim, so we add it manually
- install_gitlab_gem
- source ./scripts/rspec_helpers.sh
- retrieve_tests_metadata
update-tests-metadata:
extends:
- .tests-metadata-state
- .test-metadata:rules:update-tests-metadata
stage: post-test
dependencies:
- retrieve-tests-metadata
- generate-frontend-fixtures-mapping
- setup-test-env
- rspec migration pg14
- rspec-all frontend_fixture
- rspec unit pg14
- rspec unit clickhouse
- rspec integration pg14
- rspec system pg14
- rspec background_migration pg14
- rspec-ee migration pg14
- rspec-ee unit pg14
- rspec-ee unit clickhouse
- rspec-ee integration pg14
- rspec-ee system pg14
- rspec-ee background_migration pg14
script:
- run_timed_command "retry gem install fog-aws mime-types activesupport rspec_profiling postgres-copy --no-document"
- source ./scripts/rspec_helpers.sh
- test -f "${FLAKY_RSPEC_SUITE_REPORT_PATH}" || echo -e "\e[31m" 'Consider add ~"pipeline:run-all-rspec" to run full rspec jobs' "\e[0m"
- update_tests_metadata
- update_tests_mapping
# This pipeline runs E2E tests against CNG build which is deployed via helm chart on a job local kind kubernetes cluster
include:
- local: .gitlab/ci/cng/main.gitlab-ci.yml
- local: .gitlab/ci/qa-common/main.gitlab-ci.yml
- local: .gitlab/ci/qa-common/variables.gitlab-ci.yml
- local: .gitlab/ci/qa-common/rules.gitlab-ci.yml
workflow:
rules:
- when: always
.cng-test:
image: "${REGISTRY_HOST}/${REGISTRY_GROUP}/gitlab-build-images/${BUILD_OS}-${OS_VERSION}-ruby-${RUBY_VERSION}:git-2.36-lfs-2.9-chrome-${CHROME_VERSION}-docker-${DOCKER_VERSION}-kubectl-1.23-helm-3.14-kind-0.20"
stage: test
extends:
- .qa-cache
- .docker-in-docker
- .qa-run-e2e-with-bundler
needs:
- build-cng
tags:
- e2e
variables:
FF_NETWORK_PER_BUILD: "true"
NAMESPACE: gitlab
KUBECONFIG: /root/.kube/config
BUNDLE_WITHOUT: development
GITLAB_USERNAME: root
GITLAB_PASSWORD: 5iveL!fe
GITLAB_ADMIN_USERNAME: root
GITLAB_ADMIN_PASSWORD: 5iveL!fe
GITLAB_QA_ADMIN_ACCESS_TOKEN: $QA_ADMIN_ACCESS_TOKEN
RSPEC_LAST_RUN_RESULTS_FILE: "$CI_PROJECT_DIR/qa/tmp/examples.txt"
QA_DOCKER_NETWORK: host
QA_GENERATE_ALLURE_REPORT: "true"
QA_CAN_TEST_PRAEFECT: "false"
QA_ALLOW_LOCAL_REQUESTS: "true"
QA_SUITE_STATUS_ENV_FILE: $CI_PROJECT_DIR/suite_status.env
# disable selective test execution until pipeline setup is implemented to support it correctly
KNAPSACK_TEST_FILE_PATTERN: ""
QA_TESTS: ""
before_script:
- echo "SUITE_RAN=true" > "$QA_SUITE_STATUS_ENV_FILE"
# save extra values to be available for after_script if created dynamically
- echo "${EXTRA_DEPLOY_VALUES}" > $CI_PROJECT_DIR/EXTRA_DEPLOY_VALUES
- export GITLAB_DOMAIN="$(getent hosts docker | awk '{ print $1 }' | head -n1).nip.io"
- export QA_GITLAB_URL="http://gitlab.${GITLAB_DOMAIN}"
- cd qa && bundle install
- |
bundle exec cng create deployment "${DEPLOYMENT_TYPE}" \
--gitlab-domain "${GITLAB_DOMAIN}" \
--timeout 5m \
--admin-password "${GITLAB_ADMIN_PASSWORD}" \
--admin-token "${GITLAB_QA_ADMIN_ACCESS_TOKEN}" \
--chart-sha "${GITLAB_HELM_CHART_REF}" \
--ci \
${EXTRA_DEPLOY_VALUES}
after_script:
- |
if [ "$CI_JOB_STATUS" == "failed" ]; then
echo "SUITE_FAILED=true" >> "$QA_SUITE_STATUS_ENV_FILE"
fi
- cd qa
- bundle exec cng log events --save
- bundle exec cng log pods --save --containers all --no-fail-on-missing-pods
# This command prints all the necessary arguments to be able to recreate the same deployment as on CI
- |
bundle exec cng create deployment "${DEPLOYMENT_TYPE}" \
--chart-sha "${GITLAB_HELM_CHART_REF}" \
--ci \
--print-deploy-args \
$(cat $CI_PROJECT_DIR/EXTRA_DEPLOY_VALUES)
artifacts:
expire_in: 1 day
when: always
reports:
junit: qa/tmp/rspec-*.xml
dotenv: $QA_SUITE_STATUS_ENV_FILE
paths:
- qa/tmp
- ${CI_PROJECT_DIR}/qa/*.log
.cng-test-parallel:
extends: .cng-test
needs:
- build-cng
- download-knapsack-report
parallel: 5
# ==========================================
# Pre stage
# ==========================================
build-cng-env:
stage: .pre
extends: .build-cng-env
build-cng:
stage: .pre
extends: .build-cng
needs: [build-cng-env]
# quality specific fork, see: https://gitlab.com/gitlab-org/quality/quality-engineering/team-tasks/-/issues/2839
trigger:
project: ${CI_PROJECT_NAMESPACE}/quality/quality-engineering/CNG-mirror
branch: $TRIGGER_BRANCH
strategy: depend
download-knapsack-report:
extends:
- .download-knapsack-report
- .ruby-image
- .qa-cache
- .rules:download-knapsack
variables:
GIT_STRATEGY: clone
before_script:
- cd qa && bundle install
after_script: []
# ==========================================
# Test stage
# ==========================================
cng-instance:
extends: .cng-test-parallel
variables:
DEPLOYMENT_TYPE: kind
allow_failure: true
# Test run against environment with minimum supported redis version defined in lib/system_check/app/redis_version_check.rb
cng-qa-min-redis-version:
extends: .cng-test
variables:
DEPLOYMENT_TYPE: kind
QA_RSPEC_TAGS: --tag health_check
before_script:
- |
redis_version=$(awk -F "=" "/MIN_REDIS_VERSION =/ {print \$2}" $CI_PROJECT_DIR/lib/system_check/app/redis_version_check.rb | sed "s/['\" ]//g")
export EXTRA_DEPLOY_VALUES="--set redis.image.tag=${redis_version%.*}"
- !reference [.cng-test, before_script]
# ==========================================
# Post test stage
# ==========================================
e2e-test-report:
extends: .rules:report:allure-report
variables:
ALLURE_REPORT_RESULTS_GLOB: "qa/tmp/allure-results"
export-test-metrics:
extends:
- .export-test-metrics
- .rules:report:process-results
variables:
QA_METRICS_REPORT_FILE_PATTERN: $CI_PROJECT_DIR/qa/tmp/test-metrics-*.json
notify-slack:
extends:
- .notify-slack
- .rules:report:process-results
variables:
QA_RSPEC_XML_FILE_PATTERN: $CI_PROJECT_DIR/qa/tmp/rspec-*.xml
upload-knapsack-report:
extends:
- .upload-knapsack-report
- .rules:report:process-results
variables:
QA_KNAPSACK_REPORT_FILE_PATTERN: $CI_PROJECT_DIR/qa/tmp/knapsack/*/*.json
include:
- local: .gitlab/ci/global.gitlab-ci.yml
- local: .gitlab/ci/qa-common/main.gitlab-ci.yml
- local: .gitlab/ci/qa-common/rules.gitlab-ci.yml
- local: .gitlab/ci/qa-common/variables.gitlab-ci.yml
# code pattern changes
.code-pattern-changes: &code-pattern-changes
if: $MR_CODE_PATTERNS == "true"
.rules:gdk:qa-selective:
rules:
- <<: *code-pattern-changes
when: never
- !reference [.rules:test:qa-selective, rules]
- if: $QA_SUITES =~ /Test::Instance::Blocking/
.rules:gdk:qa-parallel:
rules:
# To account for cases where a group label is set which may trigger selective execution
# But we want to execute full blocking suite on gdk in case of code-pattern-changes
- <<: *code-pattern-changes
variables:
QA_TESTS: ""
KNAPSACK_TEST_FILE_PATTERN: ""
- !reference [.rules:test:qa-parallel, rules]
- if: $QA_SUITES =~ /Test::Instance::Blocking/
- !reference [.rules:test:manual, rules]
.rules:test:gdk-load-balancer-changes:
rules:
- when: manual
allow_failure: true
changes:
- ".gitlab/ci/test-on-gdk/**"
- "lib/gitlab/database/load_balancing/**/*"
.with-parallel:
parallel: 15
.with-gdk-log:
after_script:
- mv $CI_BUILDS_DIR/*.log $CI_PROJECT_DIR/
.gdk-qa-base:
image: "${REGISTRY_HOST}/${REGISTRY_GROUP}/gitlab-build-images/${BUILD_OS}-${OS_VERSION}-ruby-${RUBY_VERSION}:git-2.36-lfs-2.9-chrome-${CHROME_VERSION}-docker-${DOCKER_VERSION}-gcloud-383-kubectl-1.23"
extends:
- .qa-cache
- .docker-in-docker
- .gitlab-qa-report
- .qa-run-e2e-with-bundler
stage: test
services:
- name: docker:${DOCKER_VERSION}-dind
- name: ${GDK_IMAGE}
alias: gdk.test
# CI setup will tail each component in to separate file
# Override default command so we don't tail all of the logs to stdout unnecessarily
command: [gdk, tail, rails-web]
tags:
- e2e
variables:
QA_GENERATE_ALLURE_REPORT: "true"
QA_CAN_TEST_PRAEFECT: "false"
QA_INTERCEPT_REQUESTS: "false"
QA_SUITE_STATUS_ENV_FILE: "$CI_PROJECT_DIR/suite_status.env"
QA_DOCKER_NETWORK: host
QA_DISABLE_RSPEC_RETRY: "true"
QA_GITLAB_URL: http://gdk.test:3000
GITLAB_QA_ADMIN_ACCESS_TOKEN: $QA_ADMIN_ACCESS_TOKEN
FF_NETWORK_PER_BUILD: "true"
RSPEC_LAST_RUN_RESULTS_FILE: "$CI_PROJECT_DIR/qa/tmp/examples.txt"
COVERBAND_ENABLED: "$COVERBAND_ENABLED"
before_script:
- echo "SUITE_RAN=true" > "$QA_SUITE_STATUS_ENV_FILE"
- echo -e "\e[0Ksection_start:`date +%s`:install_gems[collapsed=true]\r\e[0KInstall gems"
- cd qa && bundle install
- echo -e "\e[0Ksection_end:`date +%s`:install_gems\r\e[0K"
after_script:
- !reference [.with-gdk-log, after_script]
- !reference [.gitlab-qa-report, after_script]
artifacts:
paths:
- qa/tmp
- ${CI_PROJECT_DIR}/*.log
reports:
junit: qa/tmp/rspec-*.xml
dotenv: "$QA_SUITE_STATUS_ENV_FILE"
expire_in: 7 days
when: always
# Take the existing GDK docker image and reconfigure it with Postgres load
# balancing. Adding 5s lag to 1 of the replicas to validate robustness of
# the load balancer.
.gdk-with-load-balancer-setup:
variables:
WITH_LOAD_BALANCER: "true"
# ==========================================
# Pre stage
# ==========================================
# override .download-knapsack-report job to not depend on qa-image build
download-knapsack-report:
extends:
- .download-knapsack-report
- .ruby-image
- .bundler-variables
- .qa-cache
- .rules:download-knapsack
variables:
GIT_STRATEGY: clone
before_script:
- cd qa && bundle install
after_script: []
# ==========================================
# Test stage
# ==========================================
# ------------------------------------------
# Blocking tests
# ------------------------------------------
gdk-qa-blocking:
extends:
- .gdk-qa-base
- .with-parallel
- .rules:gdk:qa-parallel
variables:
QA_SCENARIO: Test::Instance::Blocking
QA_RUN_TYPE: gdk-qa-blocking
gdk-qa-blocking-ff-inverse:
extends: gdk-qa-blocking
variables:
QA_FEATURE_FLAGS: $FEATURE_FLAGS
rules:
- !reference [.rules:test:feature-flags-set, rules]
gdk-qa-blocking-selective:
extends:
- .gdk-qa-base
- .rules:gdk:qa-selective
variables:
QA_SCENARIO: Test::Instance::Blocking
QA_RUN_TYPE: gdk-qa-blocking
# ------------------------------------------
# Non Blocking tests
# ------------------------------------------
gdk-qa-blocking-with-load-balancer:
extends:
- .gdk-qa-base
- .gdk-with-load-balancer-setup
- .with-gdk-log
- .with-parallel
variables:
QA_SCENARIO: Test::Instance::Blocking
QA_RUN_TYPE: gdk-qa-blocking
artifacts:
paths:
- log
reports:
dotenv: ""
rules:
- !reference [".rules:test:never-schedule-pipeline", rules]
- !reference [".rules:test:gdk-load-balancer-changes", rules]
gdk-qa-non-blocking:
extends:
- .gdk-qa-base
- .with-gdk-log
variables:
QA_SCENARIO: Test::Instance::NonBlocking
QA_RUN_TYPE: gdk-qa-non-blocking
parallel: 5
allow_failure: true
artifacts:
paths:
- log
reports:
dotenv: ""
rules:
# run tests on master pipelines to collect metrics and move tests to `blocking` job until `non-blocking` job
# is removed entirely
- if: '$CI_COMMIT_BRANCH == $CI_DEFAULT_BRANCH'
- when: manual
# ==========================================
# Post test stage
# ==========================================
e2e-test-report:
extends: .rules:report:allure-report
variables:
ALLURE_REPORT_RESULTS_GLOB: "qa/tmp/allure-results"
upload-knapsack-report:
extends:
- .upload-knapsack-report
- .rules:report:process-results
variables:
QA_KNAPSACK_REPORT_FILE_PATTERN: $CI_PROJECT_DIR/qa/tmp/knapsack/*/*.json
export-test-metrics:
extends:
- .export-test-metrics
- .rules:report:process-results
variables:
QA_METRICS_REPORT_FILE_PATTERN: $CI_PROJECT_DIR/qa/tmp/test-metrics-*.json
export-code-paths-mapping:
extends:
- .export-code-paths-mapping
variables:
QA_CODE_PATHS_MAPPING_FILE_PATTERN: $CI_PROJECT_DIR/qa/tmp/test-code-paths-mapping-*.json
rules:
- if: '$COVERBAND_ENABLED == "true"'
.gitlab-qa-report:
variables:
QA_RSPEC_JSON_FILE_PATTERN: $CI_PROJECT_DIR/qa/tmp/rspec-*.json
QA_SYSTEM_LOG_FILE_PATTERN: $CI_PROJECT_DIR/test_output/logs
generate-test-session:
extends:
- .generate-test-session
- .rules:report:process-results
variables:
QA_RSPEC_JSON_FILE_PATTERN: $CI_PROJECT_DIR/qa/tmp/rspec-*.json
notify-slack:
extends:
- .notify-slack
- .rules:report:process-results
variables:
QA_RSPEC_XML_FILE_PATTERN: $CI_PROJECT_DIR/qa/tmp/rspec-*.xml
include:
- local: .gitlab/ci/templates/gem.gitlab-ci.yml
inputs:
gem_name: "mail-smtp_pool"
gem_path_prefix: "vendor/gems/"
- local: .gitlab/ci/templates/gem.gitlab-ci.yml
inputs:
gem_name: "attr_encrypted"
gem_path_prefix: "vendor/gems/"
- local: .gitlab/ci/templates/gem.gitlab-ci.yml
inputs:
gem_name: "microsoft_graph_mailer"
gem_path_prefix: "vendor/gems/"
- local: .gitlab/ci/templates/gem.gitlab-ci.yml
inputs:
gem_name: "omniauth_crowd"
gem_path_prefix: "vendor/gems/"
- local: .gitlab/ci/templates/gem.gitlab-ci.yml
inputs:
gem_name: "omniauth-gitlab"
gem_path_prefix: "vendor/gems/"
- local: .gitlab/ci/templates/gem.gitlab-ci.yml
inputs:
gem_name: "omniauth-salesforce"
gem_path_prefix: "vendor/gems/"
- local: .gitlab/ci/templates/gem.gitlab-ci.yml
inputs:
gem_name: "devise-pbkdf2-encryptable"
gem_path_prefix: "vendor/gems/"
- local: .gitlab/ci/templates/gem.gitlab-ci.yml
inputs:
gem_name: "bundler-checksum"
gem_path_prefix: "vendor/gems/"
- local: .gitlab/ci/templates/gem.gitlab-ci.yml
inputs:
gem_name: "cloud_profiler_agent"
gem_path_prefix: "vendor/gems/"
- local: .gitlab/ci/templates/gem.gitlab-ci.yml
inputs:
gem_name: "sidekiq-reliable-fetch"
gem_path_prefix: "vendor/gems/"
- local: .gitlab/ci/templates/gem.gitlab-ci.yml
inputs:
gem_name: "diff_match_patch"
gem_path_prefix: "vendor/gems/"
- local: .gitlab/ci/templates/gem.gitlab-ci.yml
inputs:
gem_name: "sidekiq-7.1.6"
gem_path_prefix: "vendor/gems/"
variables:
BUILD_OS: "debian"
OS_VERSION: "bookworm"
UBI_VERSION: "8.6"
CHROME_VERSION: "123"
DOCKER_VERSION: "24.0.5"
RUBYGEMS_VERSION: "3.4"
GO_VERSION: "1.22"
NODE_VERSION: "20.12"
RUST_VERSION: "1.73"
RUBY_VERSION_DEFAULT: "3.1.5"
RUBY_VERSION_NEXT: "3.2.4"
workhorse:verify:
extends: .workhorse:rules:workhorse
image: ${GITLAB_DEPENDENCY_PROXY_ADDRESS}golang:${GO_VERSION}
stage: test
needs: []
parallel:
matrix:
- GO_VERSION: ["1.21", "1.22"]
script:
- go version
- make -C workhorse # test build
- make -C workhorse verify
.workhorse:test:
extends:
- .workhorse:rules:workhorse
- .gitaly-with-transactions
image: ${REGISTRY_HOST}/${REGISTRY_GROUP}/gitlab-build-images/${BUILD_OS}-${OS_VERSION}-ruby-${RUBY_VERSION}-golang-${GO_VERSION}-rust-${RUST_VERSION}:rubygems-${RUBYGEMS_VERSION}-git-2.36-exiftool-12.60
services:
- name: redis:${REDIS_VERSION}-alpine
variables:
GITALY_ADDRESS: "tcp://127.0.0.1:8075"
stage: test
needs:
- setup-test-env
before_script:
- source scripts/utils.sh
- export BUNDLE_WITHOUT="${BUNDLE_WITHOUT}:default:test:puma:kerberos:metrics:omnibus:ed25519"
- bundle_install_script
- go version
- scripts/gitaly-test-build
- cp workhorse/config.toml.example workhorse/config.toml
- sed -i 's|URL.*$|URL = "redis://redis:6379"|g' workhorse/config.toml
script:
- make -C workhorse test
artifacts:
expire_in: 30 days
paths:
- log/gitaly-test.log
workhorse:test go:
extends: .workhorse:test
parallel:
matrix:
- GO_VERSION: ["1.21", "1.22"]
REDIS_VERSION: ["7.0", "6.2"]
script:
- make -C workhorse test-coverage
coverage: '/\d+.\d+%/'
artifacts:
expire_in: 30 days
paths:
- workhorse/coverage.html
- log/gitaly-test.log
workhorse:test no_gitaly_transactions:
extends:
- .workhorse:test
- .gitaly-without-transactions
variables:
REDIS_VERSION: "7.0"
workhorse:test fips:
extends: .workhorse:test
needs:
- setup-test-env-fips
parallel:
matrix:
- GO_VERSION: ["1.21", "1.22"]
REDIS_VERSION: ["7.0", "6.2"]
image: ${REGISTRY_HOST}/${REGISTRY_GROUP}/gitlab-build-images/${BUILD_OS}-${OS_VERSION}-ruby-${RUBY_VERSION}-golang-${GO_VERSION}-rust-${RUST_VERSION}:rubygems-${RUBYGEMS_VERSION}-git-2.36-exiftool-12.60
variables:
FIPS_MODE: 1
BUILD_OS: "ubi"
OS_VERSION: ${UBI_VERSION}
workhorse:test race:
extends: .workhorse:test
parallel:
matrix:
- REDIS_VERSION: ["7.0", "6.2"]
script:
- make -C workhorse test-race
# Yamllint of yaml files.
# This uses rules from project root `.yamllint`.
lint-yaml:
extends:
- .default-retry
- .yaml-lint:rules
image: pipelinecomponents/yamllint:latest
stage: lint
needs: []
script:
- yamllint --strict -f colored .
# The jobs below will not use the configuration present in `.yamllint` (it's because of the -d option)
#
# Docs: https://yamllint.readthedocs.io/en/stable/configuration.html#custom-configuration-without-a-config-file
lint-pipeline-yaml:
extends:
- .default-retry
- .lint-pipeline-yaml:rules
image: pipelinecomponents/yamllint:latest
stage: lint
needs: []
variables:
LINT_PATHS: .gitlab-ci.yml .gitlab/ci lib/gitlab/ci/templates data/deprecations data/whats_new
script:
- 'yamllint -d "{extends: default, rules: {line-length: disable, document-start: disable}}" $LINT_PATHS'
lint-metrics-yaml:
extends:
- .default-retry
- .lint-metrics-yaml:rules
image: pipelinecomponents/yamllint:latest
stage: lint
needs: []
variables:
LINT_PATHS: config/metrics
script:
- 'yamllint --strict -f colored -d "{extends: default, rules: {line-length: disable, document-start: disable, indentation: {spaces: 2, indent-sequences: whatever}}}" $LINT_PATHS'
<!--
HOW TO USE THIS TEMPLATE
To propose an AI experiment, focus on completing the “Experiment” section first. As you refine the idea and gather feedback on your experiment, progress to the Beta section to define how it will evolve, when ready, progress to the “Generally Available release” section to define how it will evolve GA capability. It's important that we link Experiment to Beta to GA release. Feel free to add sections, but the existing ones must be kept and completed.
You can choose how to get started with this template. For example, the proposal can start as an issue, and then be promoted to an epic to house all the work related to the Experiment, Beta, and GA release. If you prefer to start with an epic, you have to manually apply the proposal template. Regardless, if the experiment is eventually prioritized for development, the template content will need to appear in a top-level epic so it can be tracked alongside other prioritized AI experiments.
TITLE FORMAT
🤖 [AI Proposal] {Need/outcome} {Beneficiary} {Job/Small Job}
The title should be something that is easily understood that quickly communicates the intent of the project allowing team members to easily understand and recognize the expected work that will be done. A proposal title should combine the beneficiary of the feature/UI, the job it will allow them to accomplish (see https://about.gitlab.com/handbook/product/ux/jobs-to-be-done/#how-to-write-a-jtbd), and their expected outcome when the work is delivered. Well-defined statements are concise without sacrificing the substance of the proposal so that anyone can understand it at a glance. (e.g. {Reduce the effort} {for security teams} {when prioritizing business-critical risks in their assets}).
-->
# [Experiment](https://docs.gitlab.com/ee/policy/alpha-beta-support.html#experiment)
_This section should be completed prior to beginning work on the Experiment._
## Problem to be solved
### User problem
_What user problem will this solve?_
### Solution hypothesis
_Why do you believe this AI solution is a good way to solve this problem?_
### Assumption
_What assumptions are you making about this problem and the solution?_
### Personas
_What [personas](https://handbook.gitlab.com/handbook/product/personas/#list-of-user-personas) have this problem, who is the intended user?_
## Proposal
<!-- Explain the proposed changes, including details around usage and business drivers. -->
### Success
_How will you measure whether this experiment is a success?_
**UX maturity requirements** _[Experiment to Beta](https://about.gitlab.com/handbook/product/ai/ux-maturity/#criteria-and-requirements)_
| Criteria | Minimum Requirement | Assessment for Beta |
| -------- | ------------------- | ------------------- |
| [Problem validation](https://about.gitlab.com/handbook/product/ai/ux-maturity/#validation-problem-validation)<br>How well do we understand the problem? | [Mix of evidence and assumptions](https://about.gitlab.com/handbook/product/ai/ux-maturity/#questions-to-ask) | <!-- Acceptable answers: Yes, Somewhat or Somewhat, Somewhat --> |
| [Solution validation](https://about.gitlab.com/handbook/product/ai/ux-maturity/#validation-solution-validation)<br>How usable is the solution? | [Usability testing](https://about.gitlab.com/handbook/product/ux/ux-scorecards/#option-b-perform-a-formative-evaluation), Grade C | <!-- Acceptable: >80% and grade C --> |
| [Improve](https://about.gitlab.com/handbook/product/ai/ux-maturity/#build-improve)<br>How successful is the solution? | Quality goals set by the team are reached. | <!-- Acceptable answers: :white_check_mark: Reached all quality goals for this phase. --> |
| [Design standards](https://about.gitlab.com/handbook/product/ai/ux-maturity/#design-standards) adherence<br>How compliant is the solution with our design standards? | Should adhere to ([Pajamas](https://design.gitlab.com/), [checklist](https://docs.gitlab.com/ee/development/contributing/design.html#checklist)) | <!-- Acceptable: Mostly adheres to design standards --> |
# [Beta](https://docs.gitlab.com/ee/policy/alpha-beta-support.html#beta)
_This section should be completed prior to beginning work on the Beta experience._
<!-- DO NOT REMOVE THIS SECTION
Although the initial focus is on the “Experiment” section, do not remove this “Beta” section. It's important that we link Experiment to Beta release. Fill this section in as you progress.
-->
### [Main Job story](https://about.gitlab.com/handbook/product/ux/jobs-to-be-done/#how-to-write-a-jtbd)
_What job to be done will this solve?_
<!-- What is the [Main Job story](https://about.gitlab.com/handbook/product/ux/jobs-to-be-done/#how-to-write-a-jtbd) that this proposal was derived from? (e.g. When I am on triage rotation, I want to address all the business-critical risks in my assets, So I can minimize the likelihood of my organization being compromised by a security breach.) -->
##### [Small Jobs](https://about.gitlab.com/handbook/product/ux/jobs-to-be-done/#small-jobs)
_What are the small jobs this feature is solving for?_
### Assumption
_What assumptions are you making about this problem and the solution?_
### Proposal updates/additions
<!-- Explain any changes or updates to the original proposal from the Experiment, including details around usage, business drivers, and reasonings that drove the updates/additions. -->
### Problem validation
_What validation exists that customers have this problem?_
<!-- Refer to https://about.gitlab.com/handbook/product/ux/ux-research/research-in-the-AI-space/#guideline-1-problem-validation---identify-and-understand-user-needs --- to help identify and understand user needs -->
### Business objective
_What business objective will be achieved with this proposal?_
<!-- Objectives (from a business point of view) that will be achieved upon completion. (For instance, Increase engagement by making the experience efficient while reducing the chances of users overlooking high-priority items. -->
### Requirements
_What tasks or actions should the user be capable of performing with this feature?_
<!-- Requirements can be taken from existing features or design issues used to build this proposal. Any related issues should be linked with this issue in the Feature/solution issues section below. They are more granular validated needs, goals, and additional details that the proposal encompasses. -->
### The user needs to be able to:
- ...
- ...
#### Success
_How will you measure whether this Beta is a success?_
<!-- Consider how successful the solution is by looking beyond feature usage as the success metric. Instead consider how useful, efficient, effective, satisfying, and learnable was the feature. The Product Development Flow recommends outcomes and potential activities to create a combined and ongoing quantitative and qualitative feedback loop to evaluate feature success. -->
**UX maturity requirements** _[Beta to GA](https://about.gitlab.com/handbook/product/ai/ux-maturity/#criteria-and-requirements)_
| Criteria | Minimum Requirement | Assessment for GA |
| -------- | ------------------- | ------------------- |
| [Problem validation](https://about.gitlab.com/handbook/product/ai/ux-maturity/#validation-problem-validation)<br>How well do we understand the problem? | [Mix of evidence and assumptions](https://about.gitlab.com/handbook/product/ai/ux-maturity/#questions-to-ask) | <!-- Acceptable answers: Yes, Yes --> |
| [Solution validation](https://about.gitlab.com/handbook/product/ai/ux-maturity/#validation-solution-validation)<br>How usable is the solution? | [Usability testing](https://about.gitlab.com/handbook/product/ux/ux-scorecards/#option-b-perform-a-formative-evaluation) and [Heuristic evaluation](https://about.gitlab.com/handbook/product/ux/ux-scorecards/#option-a-conduct-a-heuristic-evaluation), Avg. task pass rate >80%, Grade B | <!-- Acceptable: >80% and grade B --> |
| [Improve](https://about.gitlab.com/handbook/product/ai/ux-maturity/#build-improve)<br>How successful is the solution? | Quality goals set by the team are reached. | <!-- Acceptable answers: :white_check_mark: Reached all quality goals for this phase. --> |
| [Design standards](https://about.gitlab.com/handbook/product/ai/ux-maturity/#design-standards) adherence<br>How compliant is the solution with our design standards? | Should adhere to ([Pajamas](https://design.gitlab.com/), [checklist](https://docs.gitlab.com/ee/development/contributing/design.html#checklist)) | <!-- Acceptable: Completely adheres to design standards --> |
# [Generally Available](https://docs.gitlab.com/ee/policy/alpha-beta-support.html#generally-available-ga)
<!-- DO NOT REMOVE THIS SECTION
Although the initial focus is on the “Experiment” section, do not remove this “Generally Available” section. It's important that we link Beta to GA release. Fill this section in as you progress.
-->
### Assumption
_What assumptions are you making about this problem and the solution?_
### Proposal updates/additions
<!-- Explain any changes or updates to the original proposal from the experiment, including details around usage, business drivers, and reasonings that drove the updates/additions. -->
### Problem validation
_What validation exists that customers have this problem?_
<!-- Refer to https://about.gitlab.com/handbook/product/ux/ux-research/research-in-the-AI-space/#guideline-1-problem-validation --- to help identify and understand user needs -->
### Requirements
_What tasks or actions should the user be capable of performing with this feature?_
<!-- Requirements can be taken from existing features or design issues used to build this proposal. Any related issues should be linked with this issue in the Feature/solution issues section below. They are more granular validated needs, goals, and additional details that the proposal encompasses. -->
> ⚠️ Related feature and research issues should be linked in the related issues section (Delete this line when this is done)
#### The user needs to be able to:
- ...
- ...
## Checklist
### Experiment
<details> <summary> Issue information </summary>
- [ ] Add information to the issue body about:
- [ ] The user problem being solved
- [ ] Why the solution hypothesis solves this problem
- [ ] Your assumptions have been defined
- [ ] Who it's for, list of personas impacted
- [ ] Your proposal has been defined
- [ ] Your success metrics have been defined
- [ ] UX maturity requirements have been measured
- [ ] Add relevant designs to the Design Management area of the issue if available
- [ ] Confirm that an unexpected outage of this feature will not negatively impact the application or other features
- [ ] Add a feature flag so that this feature can be quickly disabled if/when needed
- [ ] If this experiment introduces a new service or data store, ensure it is not processing or storing [red data](https://about.gitlab.com/handbook/security/data-classification-standard.html#data-classification-levels) without a security and if needed legal review
- *NOTE*: We recommend using one of the already adopted models or data stores. If you need to use something else, be aware that using other models or data stores will require additional review during the feature stage for operational fitness and compliance.
- [ ] Completed the necessary steps to move from Experiment to Beta
- [ ] Ensure this issue has the ~wg-ai-integration label to ensure visibility to various teams working on this
</details>
### Beta
<details> <summary> Issue information </summary>
- [ ] Add information to the issue body about:
- [ ] The Main Job story and Small Jobs it's expected to satisfy have been stated
- [ ] Your assumptions have been defined
- [ ] Proposal has been updated as necessary
- [ ] Problem validation inforamtion has been added
- [ ] Business objective has been defined
- [ ] Requirements have been defined
- [ ] Success metrics have been defined
- [ ] UX maturity requirements have been measured
- [ ] Add all related feature issues to the Linked items section
- [ ] Add all relevant solution validation issues to the Linked items section that shows this proposal will solve the customer problem, or details explaining why it's not possible to provide that validation.
- [ ] Add relevant designs to the Design Management area of the issue.
- [ ] You have adhered to our [Definition of Done](https://docs.gitlab.com/ee/development/contributing/merge_request_workflow.html#definition-of-done) standards
- [ ] Completed the necessary steps to move from Beta to GA
</details>
#### Generally available
<details> <summary> Issue information </summary>
- [ ] Add information to the issue body about:
- [ ] Your assumptions have been defined
- [ ] Your proposal has been defined
- [ ] Problem validation inforamtion has been added
- [ ] Business objective has been defined
- [ ] Confidence about this feature has been assessed and defined
- [ ] Requirements have been defined
- [ ] Add all relevant solution validation issues to the Linked items section that shows this proposal will solve the customer problem, or details explaining why it's not possible to provide that validation.
- [ ] Add relevant designs to the Design Management area of the issue.
- [ ] You have adhered to our [Definition of Done](https://docs.gitlab.com/ee/development/contributing/merge_request_workflow.html#definition-of-done) standards
- [ ] Ensure this issue has the ~wg-ai-integration label to ensure visibility to various teams working on this
</details>
<details> <summary> Technical needs </summary>
- [ ] Please consider the operational aspects of the feature you are creating. A list of things to think about is in: https://gitlab.com/gitlab-org/gitlab/-/issues/403859. We will be improving this process in the future: https://gitlab.com/gitlab-org/gitlab/-/merge_requests/117637#note_1353253349.
- [ ] @ mention your [AppSec Stable Counterpart](https://about.gitlab.com/handbook/product/categories/) and read the [AI secure coding guidelines](https://docs.gitlab.com/ee/development/secure_coding_guidelines.html#artificial-intelligence-ai-features)
1. Work estimate and skills needs to build an ML viable feature: To build any ML feature depending on the work, there are many personas that contribute including Data Scientist, NLP engineer, ML Engineer, MLOps Engineer, ML Infra engineers, Fullstack engineer to integrate the ML Services with Gitlab. Post-prototype we would assess the skills needed to build a production-grade ML feature for the prototype.
2. Data Limitation: We would like to upfront validate if we have viable data for the feature including whether we can use the DataOps pipeline of ModelOps or create a custom one. We would want to understand the training data, test data, and feedback data to dial up the accuracy and the limitations of the data.
3. Model Limitation: We would want to understand if we can use an open-source pre-trained model, tune and customize it or start a model from scratch as well. Further, we would assess based on the ModelOps model evaluation framework which would be the right model to use based on the use case.
4. Cost, Scalability, Reliability: We would want to estimate the cost of hosting, serving, inference of the model, and the full end-to-end infrastructure including monitoring and observability.
5. Legal and Ethical Framework: We would want to align with legal and ethical framework like any other ModelOps features to cover the nine principles of responsible ML and any legal support needed.
</details>
<details> <summary> Dependency needs </summary>
- [ ] Please consider the operational aspects of the service you are creating. A list of things to think about is in: https://gitlab.com/gitlab-org/gitlab/-/issues/403859. We will be improving this process in the future: https://gitlab.com/gitlab-org/gitlab/-/merge_requests/117637#note_1353253349.
</details>
<details> <summary> Legal needs </summary>
- [ ] TBD
</details>
## Additional resources
- If you'd like help with technical validation, or would like to discuss UX considerations for AI mention the AI Assisted group using `@gitlab-org/modelops/applied-ml`.
- Read about our [AI Integration strategy](https://internal-handbook.gitlab.io/handbook/product/ai-strategy/ai-integration-effort/)
- [AI-human interaction guidelines](https://design.gitlab.com/usability/ai-human-interaction)
- [Highlighting feature versions guidelines](https://design.gitlab.com/usability/feature-management#highlighting-feature-versions)
- [UX maturity requirements](https://about.gitlab.com/handbook/product/ai/ux-maturity/)
- **Slack channels**
- `#wg_ai_integration` - Slack channel for the working group and the high-level alignment on getting AI ready for Production (Development, Product, UX, Legal, etc.) But from the other channels feel free to reach out and post progress here
- `#ai_integration_dev_lobby` - Channel for all implementation-related topics and discussions of actual AI features (e.g. explain the code)
- `#ai_enablement_team` - Channel for the AI Enablement Team which is building the base for all features (experimentation API, Abstraction Layer, Embeddings, etc.)
/label ~"AI Feature Proposal" ~"AI-Seeking community feedback"
/cc @tmccaslin @hbenson @pedroms @jmandell
/parent_epic &9997
## Details
- **Feature Toggle Name**: `FEATURE_NAME`
- **Required GitLab Version**: `vX.X`
--------------------------------------------------------------------------------
## 1. Preparation
- [ ] **Controllers and workers**:
1. Please link to dashboards of the workers, and the controllers and actions that can be impacted
2. ...
3. ...
## 2. Development Trial
#### Check Dev Server Versions
- [ ] GitLab: https://dev.gitlab.org/help
#### Enable on `dev.gitlab.org`:
- [ ] `/chatops feature set FEATURE_NAME true --dev` in [`#dev-gitlab`](https://gitlab.slack.com/messages/C6WQ87MU3)
Then leave running while monitoring and performing some testing through web, api or SSH.
#### Monitor
- [ ] [Monitor Using Grafana](https://dashboards.gitlab.net)
- [ ] [Inspect logs in ELK](https://log.gitlab.net/app/kibana)
- [ ] [Check for errors in GitLab Dev Sentry](https://sentry.gitlab.net/gitlab/devgitlaborg/?query=is%3Aunresolved)
## 3. Staging Trial
#### Check Staging Server Versions
- [ ] GitLab: https://staging.gitlab.com/help
#### Enable on `staging.gitlab.com`
- [ ] `/chatops run feature set FEATURE_NAME true --staging` in [`#development`](https://gitlab.slack.com/messages/C02PF508L/)
Then leave running while monitoring for at least **15 minutes** while performing some testing through web, api or SSH.
#### Monitor
- [ ] [Monitor Using Grafana](https://dashboards.gitlab.net)
- [ ] [Inspect logs in ELK](https://log.gitlab.net/app/kibana)
- [ ] [Check for errors in GitLab Sentry](https://sentry.gitlab.net/gitlab/gitlabcom/?query=is%3Aunresolved)
## 4. Production Server Version Check
- [ ] GitLab: https://gitlab.com/help
## 5. Initial Impact Check
- [ ] Enable for a subset of users, when using percentage gates: 1%.
Then leave running while monitoring for at least **15 minutes** while performing some testing through web, api or SSH.
#### Monitor
- [ ] [Monitor Using Grafana](https://dashboards.gitlab.net)
- [ ] [Inspect logs in ELK](https://log.gitlab.net/app/kibana)
- [ ] [Check for errors in GitLab Sentry](https://sentry.gitlab.net/gitlab/gitlabcom/?query=is%3Aunresolved)
## 6. Low Impact Check
- [ ] Enable for a bigger subset of users, when using percentage gates: 10%.
Then leave running while monitoring for at least **30 minutes** while performing some testing through web, api or SSH.
#### Monitor
- [ ] [Monitor Using Grafana](https://dashboards.gitlab.net)
- [ ] [Inspect logs in ELK](https://log.gitlab.net/app/kibana)
- [ ] [Check for errors in GitLab Sentry](https://sentry.gitlab.net/gitlab/gitlabcom/?query=is%3Aunresolved)
## 7. Mid Impact Trial
- [ ] Enable for a big subset of users, when using percentage gates: 50%.
Then leave running while monitoring for at least **12 hours** while performing some testing through web, api or SSH.
#### Monitor
- [ ] [Monitor Using Grafana](https://dashboards.gitlab.net)
- [ ] [Inspect logs in ELK](https://log.gitlab.net/app/kibana)
- [ ] [Check for errors in GitLab Sentry](https://sentry.gitlab.net/gitlab/gitlabcom/?query=is%3Aunresolved)
## 8. Full Impact Trial
- [ ] Enable for all users: `/chatops run feature set FEATURE_NAME true
Then leave running while monitoring for at least **1 week**.
#### Monitor
- [ ] [Monitor Using Grafana](https://dashboards.gitlab.net)
- [ ] [Inspect logs in ELK](https://log.gitlab.net/app/kibana)
- [ ] [Check for errors in GitLab Dev Sentry](https://sentry.gitlab.net/gitlab/devgitlaborg/?query=is%3Aunresolved)
#### Success?
- [ ] Remove the feature gate from the code, and close this issue with that MR.
<!-- Actionable insights must recommend an action that needs to take place. An actionable insight both defines the insight and clearly calls out action or next step required to improve based on the result of the research observation or data. Actionable insights are tracked over time and will include follow-up. Please follow the tasks outlined in this issue for best results. Learn more in the handbook here: https://about.gitlab.com/handbook/product/ux/ux-research-training/research-insights/#actionable-insights
This issue template is for an actionable insight that requires further exploration.-->
### Insight
<!-- Describe the insight itself: often the problem, finding, or observation.-->
### Supporting evidence
<!-- Describe why the problem is happening, or more details behind the finding or observation. Try to include quotes or specific data collected. Feel free to link the Actionable insight from Dovetail here if applicable instead of retyping details. -->
### Action
<!--Since this is an actionable insight that requires further exploration, ensure the action is algned to that. Describe the next step or action that needs to take place as a result of the research. The action should be clearly defined, achievable, and directly tied back to the insight. Make sure to use directive terminology, such as: conduct, explore, redesign, etc. -->
### Resources
<!--Add resources as links below or as related issues. -->
- :dove: [Dovetail project](Paste URL for Dovetail project here)
- :mag: [Research issue](Paste URL for research issue here)
- :footprints: [Follow-up issue or epic](Paste URL for follow-up issue or epic here)
### Tasks
<!--Fill out these tasks in order to consider an Actionable Insight complete. Actionable Insights are created as confidential by default, but can be made non-confidential if the insight does not include information about competitors from a Competitor Evaluation or any other confidential information. -->
- [ ] Assign this issue to the appropriate Product Manager, Product Designer, or UX Researcher.
- [ ] Add the appropriate `Group` (such as `~"group::source code"`) label to the issue. This helps identify and track actionable insights at the group level.
- [ ] Link this issue back to the original research issue in the GitLab UX Research project and the Dovetail project.
- [ ] Adjust confidentiality of this issue if applicable
/confidential
/label ~"Actionable Insight::Exploration needed"
<!-- Actionable insights must recommend an action that needs to take place. An actionable insight both defines the insight and clearly calls out action or next step required to improve based on the result of the research observation or data. Actionable insights are tracked over time and will include follow-up. Please follow the tasks outlined in this issue for best results. Learn more in the handbook here: https://about.gitlab.com/handbook/product/ux/ux-research-training/research-insights/#actionable-insights
This issue template is for an actionable insight that requires a change in the product.-->
### Insight
<!-- Describe the insight itself: often the problem, finding, or observation.-->
### Supporting evidence
<!-- Describe why the problem is happening, or more details behind the finding or observation. Try to include quotes or specific data collected. Feel free to link the Actionable insight from Dovetail here if applicable instead of retyping details. -->
### Action
<!--Since this is an actionable insight that requires a change in the product, ensure the action is algned to that. Describe the next step or action that needs to take place as a result of the research. The action should be clearly defined, achievable, and directly tied back to the insight. Make sure to use directive terminology, such as: change, update, add/remove, etc. -->
### Resources
<!--Add resources as links below or as related issues. -->
- :dove: [Dovetail project](Paste URL for Dovetail project here)
- :mag: [Research issue](Paste URL for research issue here)
- :footprints: [Follow-up issue or epic](Paste URL for follow-up issue or epic here)
### Tasks
<!--Fill out these tasks in order to consider an Actionable Insight complete. Actionable Insights are created as confidential by default, but can be made non-confidential if the insight does not include information about competitors from a Competitor Evaluation or any other confidential information. -->
- [ ] Assign this issue to the appropriate Product Manager, Product Designer, or UX Researcher.
- [ ] Add the appropriate `Group` (such as `~"group::source code"`) label to the issue. This helps identify and track actionable insights at the group level.
- [ ] Link this issue back to the original research issue in the GitLab UX Research project and the Dovetail project.
- [ ] Adjust confidentiality of this issue if applicable
/confidential
/label ~"Actionable Insight::Product change"
/label ~"SUS"
<!-- Please complete the template below as best as you can. Make sure to check if this issue has already been raised by someone else first to avoid duplication.
For each section below, please add screenshots or links or anything that may help visual learners understand the problem better, even if this takes you an extra minute or two this is a great help to some folks.
https://www.learning-styles-online.com/style/visual-spatial/
-->
## Problem
<!-- High level overview of the Incident -->
## Detection
<!-- How did we learn of the problem? System Error? User? -->
## Impact
<!-- Who was impacted and how were they impacted?
Please include Teams, Users, Automations, Processes -->
## Additional information
<!-- Please fill out any additonal information that may help with resolution -->
## Checklist
<!-- Please ensure all of the below steps are taken -->
* [ ] Assigned severity tags based on this [guidance](https://about.gitlab.com/handbook/engineering/development/analytics/analytics-instrumentation/#incident-detection)
* [ ] Assigned to PM and EM of ~"group::analytics instrumentation"
* [ ] Posted link to incident in `g_analyze_analytics_instrumentation` and tagged both PM and EM of the group
<---- TO BE FILLED BY ASSIGNEE / RESOLUTION DRI---->
<!-- The intention of this section is to give stakeholders a high level summary of the issue with whatever information we have at the point of closing the issue or providing a quick fix. For a deeper analysis of the root cause and how we can avoid such incidents in the future please use the RCA template as outlined in the handbook incident resolution guidance and link the issue here -->
## Summary
<!-- Overall summary of the issue -->
## Root Cause
<!-- To be filled by the assignee. What caused this incident? Link to RCA issue if needed -->
## Resolution
<!-- To be filled by assignee.Has the issue been resolved? How? Please include any relevant issue and/or MR links in the description -->
## Problem
<!-- The problem being addressed by this issue -->
## Desired Outcome
<!-- The desired state of the affected system after this issue has been completed -->
## Potential Solution
<!-- An outline of potential solutions to get to the desired outcome. These solution(s) can still be adjusted throughout the implementation as long as the desired outcome is achieved. -->
## How to verify
<!-- How can we verify that the desired outcome has been achieved? The instructions from this section should be used to move the issue from ~“worfklow::verification”. -->
## Further actions needed
<!-- Any further tasks that need to be completed after the main work of the issue is done, such as announcing the changes or updating documentation. -->
<!-- This section is optional. -->
<!-- Make sure to add one of the type labels (as per https://handbook.gitlab.com/handbook/engineering/metrics/#work-type-classification):-->
<!-- /label ~"type::bug" ~"type::feature" ~"type::tooling" ~"type::maintenance" -->
/label ~devops::analytics ~"group::analytics instrumentation"
<!-- Audit Event documentation: See https://docs.gitlab.com/ee/administration/audit_events.html -->
<!-- Streaming Audit Event documentation: See https://docs.gitlab.com/ee/administration/audit_event_streaming.html -->
## Audit need
<!-- Describe the real-world use case for the audit event you want to introduce, and explain the closest thing that GitLab already captures. -->
## Proposal
<!-- Describe the audit event you are proposing should be added, including any details of what should be captured, how, and why. -->
### Streaming-only event or normal event?
<!-- Should this event be a streaming-only audit event or also logged to GitLab's database? Consider the
volume of data that will be generated by the event when answering this. -->
/label ~"Category:Audit Events"
/label ~"type::feature"
/label ~"group::compliance"
<!---
This issue template is for a master pipeline is failing for a flaky reason that cannot be reliably reproduced.
Please read the below documentations for a workflow of triaging and resolving broken master.
- https://about.gitlab.com/handbook/engineering/workflow/#triage-broken-master
- https://gitlab.com/gitlab-org/quality/engineering-productivity/team/-/blob/main/runbooks/master-broken.md
- https://gitlab.com/gitlab-org/gitlab/-/blob/master/doc/development/testing_guide/flaky_tests.md
--->
### Summary
<!-- Link to the failing master build and add the build failure output in the below code block section. -->
### Steps to reproduce
<!-- If the pipeline failure is reproducible, provide steps to recreate the issue locally. Please use an ordered list. -->
Please refer to [Flaky tests documentation](https://docs.gitlab.com/ee/development/testing_guide/flaky_tests.html) to
learn more about how to reproduce them.
### Proposed Resolution
<!-- Describe the proposed change to restore master stability. -->
Please refer to the [Resolution guidance](https://about.gitlab.com/handbook/engineering/workflow/#resolution-of-broken-master) to learn more about resolution of broken master.
Once the flaky failure has been fixed on the default branch, open merge requests to cherry-pick the fix to the active stable branches.
### Logs
<!-- Add here failing job logs -->
/label ~"type::maintenance" ~"failure::flaky-test" ~"priority::3" ~"severity::3"
Markdown is supported
0% or .
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment