Merge branch '10-6-stable-patch-1' into '10-6-stable'

Gemfile

@@ -218,7 +218,7 @@ gem 'sanitize', '~> 2.0'
 gem 'babosa', '~> 1.0.2'
 
 # Sanitizes SVG input
-gem 'loofah', '~> 2.0.3'
+gem 'loofah', '~> 2.2'
 
 # Working with license
 gem 'licensee', '~> 8.7.0'

Gemfile.lock

@@ -142,6 +142,7 @@ GEM
     connection_pool (2.2.1)
     crack (0.4.3)
       safe_yaml (~> 1.0.0)
+    crass (1.0.3)
     creole (0.5.0)
     css_parser (1.5.0)
       addressable
@@ -488,7 +489,8 @@ GEM
       actionpack (>= 4, < 5.2)
       activesupport (>= 4, < 5.2)
       railties (>= 4, < 5.2)
-    loofah (2.0.3)
+    loofah (2.2.2)
+      crass (~> 1.0.2)
       nokogiri (>= 1.5.9)
     mail (2.7.0)
       mini_mime (>= 0.1.1)
@@ -685,8 +687,8 @@ GEM
       activesupport (>= 4.2.0.beta, < 5.0)
       nokogiri (~> 1.6)
       rails-deprecated_sanitizer (>= 1.0.1)
-    rails-html-sanitizer (1.0.3)
-      loofah (~> 2.0)
+    rails-html-sanitizer (1.0.4)
+      loofah (~> 2.2, >= 2.2.2)
     rails-i18n (4.0.9)
       i18n (~> 0.7)
       railties (~> 4.0)
@@ -1100,7 +1102,7 @@ DEPENDENCIES
   license_finder (~> 3.1)
   licensee (~> 8.7.0)
   lograge (~> 0.5)
-  loofah (~> 2.0.3)
+  loofah (~> 2.2)
   mail_room (~> 0.9.1)
   method_source (~> 0.8)
   minitest (~> 5.7.0)

app/models/ci/build.rb

@@ -140,7 +140,11 @@ module Ci
         next if build.retries_max.zero?
 
         if build.retries_count < build.retries_max
-          Ci::Build.retry(build, build.user)
+          begin
+            Ci::Build.retry(build, build.user)
+          rescue Gitlab::Access::AccessDeniedError => ex
+            Rails.logger.error "Unable to auto-retry job #{build.id}: #{ex}"
+          end
         end
       end
 
@@ -328,8 +332,7 @@ module Ci
     end
 
     def erase_old_trace!
-      write_attribute(:trace, nil)
-      save
+      update_column(:trace, nil)
     end
 
     def needs_touch?

app/models/group.rb

@@ -230,13 +230,13 @@ class Group < Namespace
       end
 
     GroupMember
-      .active_without_invites
+      .active_without_invites_and_requests
       .where(source_id: source_ids)
   end
 
   def members_with_descendants
     GroupMember
-      .active_without_invites
+      .active_without_invites_and_requests
       .where(source_id: self_and_descendants.reorder(nil).select(:id))
   end
 

app/models/member.rb

@@ -52,7 +52,7 @@ class Member < ActiveRecord::Base
   end
 
   # Like active, but without invites. For when a User is required.
-  scope :active_without_invites, -> do
+  scope :active_without_invites_and_requests, -> do
     left_join_users
       .where(users: { state: 'active' })
       .non_request

app/services/notification_service.rb

@@ -208,9 +208,9 @@ class NotificationService
   def new_access_request(member)
     return true unless member.notifiable?(:subscription)
 
-    recipients = member.source.members.active_without_invites.owners_and_masters
+    recipients = member.source.members.active_without_invites_and_requests.owners_and_masters
     if fallback_to_group_owners_masters?(recipients, member)
-      recipients = member.source.group.members.active_without_invites.owners_and_masters
+      recipients = member.source.group.members.active_without_invites_and_requests.owners_and_masters
     end
 
     recipients.each { |recipient| deliver_access_request_email(recipient, member) }

changelogs/unreleased/44232-docs-for-runner-ip-address.yml

+---
+title: Add documentation for runner IP address (#44232)
+merge_request: 17837
+author:
+type: other

changelogs/unreleased/44564-error-500-while-attempting-to-resolve-conflicts-due-to-utf-8-conversion-error.yml

+---
+title: Fix 500 error when trying to resolve non-ASCII conflicts in the editor
+merge_request: 17962
+author:
+type: fixed

changelogs/unreleased/ab-44446-add-indexes-for-user-activity-queries.yml

+---
+title: Add indexes for user activity queries.
+merge_request: 17890
+author:
+type: performance

changelogs/unreleased/fix-ci-job-auto-retry.yml

+---
+title: Prevent auto-retry AccessDenied error from stopping transition to failed
+merge_request: 17862
+author:
+type: fixed

changelogs/unreleased/sh-update-loofah.yml

+---
+title: Bump rails-html-sanitizer to 1.0.4
+merge_request:
+author:
+type: security

db/migrate/20180320182229_add_indexes_for_user_activity_queries.rb

+class AddIndexesForUserActivityQueries < ActiveRecord::Migration
+  include Gitlab::Database::MigrationHelpers
+
+  DOWNTIME = false
+
+  disable_ddl_transaction!
+
+  def up
+    add_concurrent_index :events, [:author_id, :project_id] unless index_exists?(:events, [:author_id, :project_id])
+    add_concurrent_index :user_interacted_projects, :user_id unless index_exists?(:user_interacted_projects, :user_id)
+  end
+
+  def down
+    remove_concurrent_index :events, [:author_id, :project_id] if index_exists?(:events, [:author_id, :project_id])
+
+    patch_foreign_keys do
+      remove_concurrent_index :user_interacted_projects, :user_id if index_exists?(:user_interacted_projects, :user_id)
+    end
+  end
+
+  private
+
+  def patch_foreign_keys
+    return yield if Gitlab::Database.postgresql?
+
+    # MySQL doesn't like to remove the index with a foreign key using it.
+    remove_foreign_key :user_interacted_projects, :users if fk_exists?(:user_interacted_projects, :user_id)
+
+    yield
+
+    # Let's re-add the foreign key using the existing index on (user_id, project_id)
+    add_concurrent_foreign_key :user_interacted_projects, :users, column: :user_id unless fk_exists?(:user_interacted_projects, :user_id)
+  end
+
+  def fk_exists?(table, column)
+    foreign_keys(table).any? do |key|
+      key.options[:column] == column.to_s
+    end
+  end
+end

db/schema.rb

@@ -11,7 +11,7 @@
 #
 # It's strongly recommended that you check this file into your version control system.
 
-ActiveRecord::Schema.define(version: 20180309160427) do
+ActiveRecord::Schema.define(version: 20180320182229) do
 
   # These are extensions that must be enabled in order to support this database
   enable_extension "plpgsql"
@@ -728,6 +728,7 @@ ActiveRecord::Schema.define(version: 20180309160427) do
   end
 
   add_index "events", ["action"], name: "index_events_on_action", using: :btree
+  add_index "events", ["author_id", "project_id"], name: "index_events_on_author_id_and_project_id", using: :btree
   add_index "events", ["author_id"], name: "index_events_on_author_id", using: :btree
   add_index "events", ["project_id", "id"], name: "index_events_on_project_id_and_id", using: :btree
   add_index "events", ["target_type", "target_id"], name: "index_events_on_target_type_and_target_id", using: :btree
@@ -1856,6 +1857,7 @@ ActiveRecord::Schema.define(version: 20180309160427) do
   end
 
   add_index "user_interacted_projects", ["project_id", "user_id"], name: "index_user_interacted_projects_on_project_id_and_user_id", unique: true, using: :btree
+  add_index "user_interacted_projects", ["user_id"], name: "index_user_interacted_projects_on_user_id", using: :btree
 
   create_table "user_synced_attributes_metadata", force: :cascade do |t|
     t.boolean "name_synced", default: false

doc/ci/README.md

@@ -65,7 +65,8 @@ learn how to leverage its potential even more.
   environments and use them for different purposes like testing, building and
   deploying
 - [Job artifacts](../user/project/pipelines/job_artifacts.md)
-- [Git submodules](git_submodules.md): How to run your CI jobs when Git
+- [Caching dependencies](caching/index.md)
+- [Git submodules](git_submodules.md) - How to run your CI jobs when Git
   submodules are involved
 - [Use SSH keys in your build environment](ssh_keys/README.md)
 - [Trigger pipelines through the GitLab API](triggers/README.md)

doc/ci/runners/README.md

@@ -146,24 +146,7 @@ To protect/unprotect Runners:
 
 ## Manually clearing the Runners cache
 
-> [Introduced](https://gitlab.com/gitlab-org/gitlab-ce/issues/41249) in GitLab 10.4.
-
-GitLab Runners use [cache](../yaml/README.md#cache) to speed up the execution
-of your jobs by reusing existing data. This however, can sometimes lead to an
-inconsistent behavior.
-
-To start with a fresh copy of the cache, you can easily do it via GitLab's UI:
-
-1. Navigate to your project's **CI/CD > Pipelines** page.
-1. Click on the **Clear Runner caches** to clean up the cache.
-1. On the next push, your CI/CD job will use a new cache.
-
-That way, you don't have to change the [cache key](../yaml/README.md#cache-key)
-in your `.gitlab-ci.yml`.
-
-Behind the scenes, this works by increasing a counter in the database, and the
-value of that counter is used to create the key for the cache. After a push, a
-new key is generated and the old cache is not valid anymore.
+Read [clearing the cache](../caching/index.md#clearing-the-cache).
 
 ## How shared Runners pick jobs
 
@@ -227,15 +210,16 @@ that it may encounter on the projects it's shared over. This would be
 problematic for large amounts of projects, if it wasn't for tags.
 
 By tagging a Runner for the types of jobs it can handle, you can make sure
-shared Runners will only run the jobs they are equipped to run.
+shared Runners will [only run the jobs they are equipped to run](../yaml/README.md#tags).
 
 For instance, at GitLab we have Runners tagged with "rails" if they contain
 the appropriate dependencies to run Rails test suites.
 
 ### Preventing Runners with tags from picking jobs without tags
 
-You can configure a Runner to prevent it from picking jobs with tags when
-the Runner does not have tags assigned. This setting can be enabled the first
+You can configure a Runner to prevent it from picking
+[jobs with tags](../yaml/README.md#tags) when the Runner does not have tags
+assigned. This setting can be enabled the first
 time you [register a Runner][register] and can be changed afterwards under
 each Runner's settings.
 
@@ -280,3 +264,36 @@ We're always looking for contributions that can mitigate these
 [register]: http://docs.gitlab.com/runner/register/
 [protected branches]: ../../user/project/protected_branches.md
 [protected tags]: ../../user/project/protected_tags.md
+
+## Determining the IP address of a Runner
+
+> [Introduced](https://gitlab.com/gitlab-org/gitlab-ce/merge_requests/17286) in GitLab 10.6.
+
+It may be useful to know the IP address of a Runner so you can troubleshoot
+issues with that Runner. GitLab stores and displays the IP address by viewing
+the source of the HTTP requests it makes to GitLab when polling for jobs. The
+IP address is always kept up to date so if the Runner IP changes it will be
+automatically updated in GitLab.
+
+The IP address for shared Runners and specific Runners can be found in
+different places.
+
+### Shared Runners
+
+To view the IP address of a shared Runner you must have admin access to
+the GitLab instance. To determine this:
+
+1. Visit **Admin area ➔ Overview ➔ Runners**
+1. Look for the Runner in the table and you should see a column for "IP Address"
+
+![shared Runner IP address](img/shared_runner_ip_address.png)
+
+### Specific Runners
+
+You can find the IP address of a Runner for a specific project by:
+
+1. Visit your project's **Settings ➔ CI/CD**
+1. Find the Runner and click on it's ID which links you to the details page
+1. On the details page you should see a row for "IP Address"
+
+![specific Runner IP address](img/specific_runner_ip_address.png)

doc/ci/yaml/README.md

@@ -849,6 +849,185 @@ The `stop_review_app` job is **required** to have the following keywords defined
 - `stage` should be the same as the `review_app` in order for the environment
   to stop automatically when the branch is deleted
 
+### Dynamic environments
+
+>
+**Notes:**
+- [Introduced][ce-6323] in GitLab 8.12 and GitLab Runner 1.6.
+- The `$CI_ENVIRONMENT_SLUG` was [introduced][ce-7983] in GitLab 8.15.
+- The `name` and `url` parameters can use any of the defined CI variables,
+  including predefined, secure variables and `.gitlab-ci.yml` [`variables`](#variables).
+  You however cannot use variables defined under `script`.
+
+For example:
+
+```yaml
+deploy as review app:
+  stage: deploy
+  script: make deploy
+  environment:
+    name: review/$CI_COMMIT_REF_NAME
+    url: https://$CI_ENVIRONMENT_SLUG.example.com/
+```
+
+The `deploy as review app` job will be marked as deployment to dynamically
+create the `review/$CI_COMMIT_REF_NAME` environment, where `$CI_COMMIT_REF_NAME`
+is an [environment variable][variables] set by the Runner. The
+`$CI_ENVIRONMENT_SLUG` variable is based on the environment name, but suitable
+for inclusion in URLs. In this case, if the `deploy as review app` job was run
+in a branch named `pow`, this environment would be accessible with an URL like
+`https://review-pow.example.com/`.
+
+This of course implies that the underlying server which hosts the application
+is properly configured.
+
+The common use case is to create dynamic environments for branches and use them
+as Review Apps. You can see a simple example using Review Apps at
+<https://gitlab.com/gitlab-examples/review-apps-nginx/>.
+
+## `cache`
+
+>
+**Notes:**
+- Introduced in GitLab Runner v0.7.0.
+- `cache` can be set globally and per-job.
+- From GitLab 9.0, caching is enabled and shared between pipelines and jobs
+  by default.
+- From GitLab 9.2, caches are restored before [artifacts](#artifacts).
+
+TIP: **Learn more:**
+Read how caching works and find out some good practices in the
+[caching dependencies documentation](../caching/index.md).
+
+`cache` is used to specify a list of files and directories which should be
+cached between jobs. You can only use paths that are within the project
+workspace.
+
+If `cache` is defined outside the scope of jobs, it means it is set
+globally and all jobs will use that definition.
+
+### `cache:paths`
+
+Use the `paths` directive to choose which files or directories will be cached.
+Wildcards can be used as well.
+
+Cache all files in `binaries` that end in `.apk` and the `.config` file:
+
+```yaml
+rspec:
+  script: test
+  cache:
+    paths:
+    - binaries/*.apk
+    - .config
+```
+
+Locally defined cache overrides globally defined options. The following `rspec`
+job will cache only `binaries/`:
+
+```yaml
+cache:
+  paths:
+  - my/files
+
+rspec:
+  script: test
+  cache:
+    paths:
+    - binaries/
+```
+
+### `cache:key`
+
+> Introduced in GitLab Runner v1.0.0.
+
+Since the cache is shared between jobs, if you're using different
+paths for different jobs, you should also set a different `cache:key`
+otherwise cache content can be overwritten.
+
+The `key` directive allows you to define the affinity of caching between jobs,
+allowing to have a single cache for all jobs, cache per-job, cache per-branch
+or any other way that fits your workflow. This way, you can fine tune caching,
+allowing you to cache data between different jobs or even different branches.
+
+The `cache:key` variable can use any of the
+[predefined variables](../variables/README.md), and the default key, if not set,
+is `$CI_JOB_NAME-$CI_COMMIT_REF_NAME` which translates as "per-job and
+per-branch". It is the default across the project, therefore everything is
+shared between pipelines and jobs running on the same branch by default.
+
+NOTE: **Note:**
+The `cache:key` variable cannot contain the `/` character, or the equivalent
+URI-encoded `%2F`; a value made only of dots (`.`, `%2E`) is also forbidden.
+
+For example, to enable per-branch caching:
+
+```yaml
+cache:
+  key: "$CI_COMMIT_REF_SLUG"
+  paths:
+  - binaries/
+```
+
+If you use **Windows Batch** to run your shell scripts you need to replace
+`$` with `%`:
+
+```yaml
+cache:
+  key: "%CI_JOB_STAGE%-%CI_COMMIT_REF_SLUG%"
+  paths:
+  - binaries/
+```
+
+If you use **Windows PowerShell** to run your shell scripts you need to replace
+`$` with `$env:`:
+
+```yaml
+cache:
+  key: "$env:CI_JOB_STAGE-$env:CI_COMMIT_REF_SLUG"
+  paths:
+  - binaries/
+```
+
+### `cache:untracked`
+
+Set `untracked: true` to cache all files that are untracked in your Git
+repository:
+
+```yaml
+rspec:
+  script: test
+  cache:
+    untracked: true
+```
+
+Cache all Git untracked files and files in `binaries`:
+
+```yaml
+rspec:
+  script: test
+  cache:
+    untracked: true
+    paths:
+    - binaries/
+>>>>>>> 03bbd847deb... Merge branch 'docs/ci-caching' into 'master'
+```
+
+In the above example we set up the `review_app` job to deploy to the `review`
+environment, and we also defined a new `stop_review_app` job under `on_stop`.
+Once the `review_app` job is successfully finished, it will trigger the
+`stop_review_app` job based on what is defined under `when`. In this case we
+set it up to `manual` so it will need a [manual action](#manual-actions) via
+GitLab's web interface in order to run.
+
+The `stop_review_app` job is **required** to have the following keywords defined:
+
+- `when` - [reference](#when)
+- `environment:name`
+- `environment:action`
+- `stage` should be the same as the `review_app` in order for the environment
+  to stop automatically when the branch is deleted
+
 #### dynamic environments
 
 >

doc/install/kubernetes/index.md

@@ -10,7 +10,7 @@ should be deployed, upgraded, and configured.
 ## Chart Overview
 
 * **[GitLab-Omnibus](gitlab_omnibus.md)**: The best way to run GitLab on Kubernetes today, suited for small deployments. The chart is in beta and will be deprecated by the [cloud native GitLab chart](#cloud-native-gitlab-chart).
-* **[Cloud Native GitLab Chart](https://gitlab.com/charts/helm.gitlab.io/blob/master/README.md)**: The next generation GitLab chart, currently in development. Will support large deployments with horizontal scaling of individual GitLab components.
+* **[Cloud Native GitLab Chart](https://gitlab.com/charts/helm.gitlab.io/blob/master/README.md)**: The next generation GitLab chart, currently in alpha. Will support large deployments with horizontal scaling of individual GitLab components.
 * Other Charts
   * [GitLab Runner Chart](gitlab_runner_chart.md): For deploying just the GitLab Runner.
   * [Advanced GitLab Installation](gitlab_chart.md): Deprecated, being replaced by the [cloud native GitLab chart](#cloud-native-gitlab-chart). Provides additional deployment options, but provides less functionality out-of-the-box.
@@ -35,7 +35,7 @@ By offering individual containers and charts, we will be able to provide a numbe
 * Potential for rolling updates and canaries within a service,
 * and plenty more.
 
-This is a large project and will be worked on over the span of multiple releases. For the most up-to-date status and release information, please see our [tracking issue](https://gitlab.com/gitlab-org/omnibus-gitlab/issues/2420). We are planning to launch this chart in beta by the end of 2017.
+Presently this chart is available in alpha for testing, and not recommended for production use. 
 
 Learn more about the [cloud native GitLab chart](https://gitlab.com/charts/helm.gitlab.io/blob/master/README.md).
 

doc/user/project/merge_requests/maintainer_access.md

 # Allow maintainer pushes for merge requests across forks
 
+> [Introduced][ce-17395] in GitLab 10.6.
+
 This feature is available for merge requests across forked projects that are
-publicly accessible. It makes it easier for maintainers of projects to collaborate
-on merge requests across forks.
+publicly accessible. It makes it easier for maintainers of projects to
+collaborate on merge requests across forks.
 
-When enabling this feature for a merge request, you give can give members with push access to the target project rights to edit files on the source branch of the merge request.
+When enabled for a merge request, members with merge access to the target
+branch of the project will be granted write permissions to the source branch
+of the merge request.
 
-The feature can only be enabled by users who already have push access to the source project. And only lasts while the merge request is open.
+The feature can only be enabled by users who already have push access to the
+source project, and only lasts while the merge request is open.
 
 Enable this functionality while creating a merge request:
 

lib/gitlab/conflict/file_collection.rb

@@ -40,7 +40,10 @@ module Gitlab
         # when there are no conflict files.
         files.each(&:lines)
         files.any?
-      rescue Gitlab::Git::CommandError, Gitlab::Git::Conflict::Parser::UnresolvableError, Gitlab::Git::Conflict::Resolver::ConflictSideMissing
+      rescue Gitlab::Git::CommandError,
+             Gitlab::Git::Conflict::Parser::UnresolvableError,
+             Gitlab::Git::Conflict::Resolver::ConflictSideMissing,
+             Gitlab::Git::Conflict::File::UnsupportedEncoding
         false
       end
       cache_method :can_be_resolved_in_ui?

lib/gitlab/encoding_helper.rb

@@ -90,7 +90,7 @@ module Gitlab
     end
 
     def clean(message)
-      message.encode("UTF-16BE", undef: :replace, invalid: :replace, replace: "")
+      message.encode("UTF-16BE", undef: :replace, invalid: :replace, replace: "".encode("UTF-16BE"))
         .encode("UTF-8")
         .gsub("\0".encode("UTF-8"), "")
     end

lib/gitlab/git/conflict/file.rb

@@ -2,17 +2,19 @@ module Gitlab
   module Git
     module Conflict
       class File
+        UnsupportedEncoding = Class.new(StandardError)
+
         attr_reader :their_path, :our_path, :our_mode, :repository, :commit_oid
 
-        attr_accessor :content
+        attr_accessor :raw_content
 
-        def initialize(repository, commit_oid, conflict, content)
+        def initialize(repository, commit_oid, conflict, raw_content)
           @repository = repository
           @commit_oid = commit_oid
           @their_path = conflict[:theirs][:path]
           @our_path = conflict[:ours][:path]
           @our_mode = conflict[:ours][:mode]
-          @content = content
+          @raw_content = raw_content
         end
 
         def lines
@@ -29,6 +31,14 @@ module Gitlab
           end
         end
 
+        def content
+          @content ||= @raw_content.dup.force_encoding('UTF-8')
+
+          raise UnsupportedEncoding unless @content.valid_encoding?
+
+          @content
+        end
+
         def type
           lines unless @type
 

lib/gitlab/git/conflict/parser.rb

@@ -4,7 +4,6 @@ module Gitlab
       class Parser
         UnresolvableError = Class.new(StandardError)
         UnmergeableFile = Class.new(UnresolvableError)
-        UnsupportedEncoding = Class.new(UnresolvableError)
 
         # Recoverable errors - the conflict can be resolved in an editor, but not with
         # sections.
@@ -75,10 +74,6 @@ module Gitlab
           def validate_text!(text)
             raise UnmergeableFile if text.blank? # Typically a binary file
             raise UnmergeableFile if text.length > 200.kilobytes
-
-            text.force_encoding('UTF-8')
-
-            raise UnsupportedEncoding unless text.valid_encoding?
           end
 
           def validate_delimiter!(condition)

lib/gitlab/gitaly_client/conflict_files_stitcher.rb

@@ -17,7 +17,7 @@ module Gitlab
 
               current_file = file_from_gitaly_header(gitaly_file.header)
             else
-              current_file.content << gitaly_file.content
+              current_file.raw_content << gitaly_file.content
             end
           end
         end

spec/lib/gitlab/ci/trace_spec.rb

@@ -510,6 +510,28 @@ describe Gitlab::Ci::Trace do
 
           it_behaves_like 'source trace in database stays intact', error: ActiveRecord::RecordInvalid
         end
+
+        context 'when there is a validation error on Ci::Build' do
+          before do
+            allow_any_instance_of(Ci::Build).to receive(:save).and_return(false)
+            allow_any_instance_of(Ci::Build).to receive_message_chain(:errors, :full_messages)
+              .and_return(%w[Error Error])
+          end
+
+          context "when erase old trace with 'save'" do
+            before do
+              build.send(:write_attribute, :trace, nil)
+              build.save
+            end
+
+            it 'old trace is not deleted' do
+              build.reload
+              expect(build.trace.raw).to eq(trace_content)
+            end
+          end
+
+          it_behaves_like 'archive trace in database'
+        end
       end
     end
 

spec/lib/gitlab/encoding_helper_spec.rb

@@ -161,6 +161,11 @@ describe Gitlab::EncodingHelper do
         'removes invalid bytes from ASCII-8bit encoded multibyte string.',
         "Lorem ipsum\xC3\n dolor sit amet, xy\xC3\xA0y\xC3\xB9abcd\xC3\xB9efg".force_encoding('ASCII-8BIT'),
         "Lorem ipsum\n dolor sit amet, xyàyùabcdùefg"
+      ],
+      [
+        'handles UTF-16BE encoded strings',
+        "\xFE\xFF\x00\x41".force_encoding('ASCII-8BIT'), # An "A" prepended with UTF-16 BOM
+        "\xEF\xBB\xBFA" # An "A" prepended with UTF-8 BOM
       ]
     ].each do |description, test_string, xpect|
       it description do

spec/lib/gitlab/git/conflict/file_spec.rb

+# coding: utf-8
+require 'spec_helper'
+
+describe Gitlab::Git::Conflict::File do
+  let(:conflict) { { theirs: { path: 'foo', mode: 33188 }, ours: { path: 'foo', mode: 33188 } } }
+  let(:invalid_content) { described_class.new(nil, nil, conflict, "a\xC4\xFC".force_encoding(Encoding::ASCII_8BIT)) }
+  let(:valid_content) { described_class.new(nil, nil, conflict, "Espa\xC3\xB1a".force_encoding(Encoding::ASCII_8BIT)) }
+
+  describe '#lines' do
+    context 'when the content contains non-UTF-8 characters' do
+      it 'raises UnsupportedEncoding' do
+        expect { invalid_content.lines }
+          .to raise_error(described_class::UnsupportedEncoding)
+      end
+    end
+
+    context 'when the content can be converted to UTF-8' do
+      it 'sets lines to the lines' do
+        expect(valid_content.lines).to eq([{
+                                             full_line: 'España',
+                                             type: nil,
+                                             line_obj_index: 0,
+                                             line_old: 1,
+                                             line_new: 1
+                                           }])
+      end
+
+      it 'sets the type to text' do
+        expect(valid_content.type).to eq('text')
+      end
+    end
+  end
+
+  describe '#content' do
+    context 'when the content contains non-UTF-8 characters' do
+      it 'raises UnsupportedEncoding' do
+        expect { invalid_content.content }
+          .to raise_error(described_class::UnsupportedEncoding)
+      end
+    end
+
+    context 'when the content can be converted to UTF-8' do
+      it 'returns a valid UTF-8 string' do
+        expect(valid_content.content).to eq('España')
+        expect(valid_content.content).to be_valid_encoding
+        expect(valid_content.content.encoding).to eq(Encoding::UTF_8)
+      end
+    end
+  end
+end

spec/lib/gitlab/git/conflict/parser_spec.rb

@@ -212,13 +212,6 @@ CONFLICT
             .not_to raise_error
         end
       end
-
-      context 'when the file contains non-UTF-8 characters' do
-        it 'raises UnsupportedEncoding' do
-          expect { parse_text("a\xC4\xFC".force_encoding(Encoding::ASCII_8BIT)) }
-            .to raise_error(Gitlab::Git::Conflict::Parser::UnsupportedEncoding)
-        end
-      end
     end
   end
 end

spec/models/ci/build_spec.rb

@@ -2050,6 +2050,35 @@ describe Ci::Build do
 
         subject.drop!
       end
+
+      context 'when retry service raises Gitlab::Access::AccessDeniedError exception' do
+        let(:retry_service) { Ci::RetryBuildService.new(subject.project, subject.user) }
+
+        before do
+          allow_any_instance_of(Ci::RetryBuildService)
+            .to receive(:execute)
+            .with(subject)
+            .and_raise(Gitlab::Access::AccessDeniedError)
+          allow(Rails.logger).to receive(:error)
+        end
+
+        it 'handles raised exception' do
+          expect { subject.drop! }.not_to raise_exception(Gitlab::Access::AccessDeniedError)
+        end
+
+        it 'logs the error' do
+          subject.drop!
+
+          expect(Rails.logger)
+            .to have_received(:error)
+            .with(a_string_matching("Unable to auto-retry job #{subject.id}"))
+        end
+
+        it 'fails the job' do
+          subject.drop!
+          expect(subject.failed?).to be_truthy
+        end
+      end
     end
 
     context 'when build is not configured to be retried' do