Merge branch '10-3-stable-prepare-rc3' into '10-3-stable'

app/assets/javascripts/vue_merge_request_widget/services/mr_widget_service.js

@@ -6,7 +6,7 @@ Vue.use(VueResource);
 export default class MRWidgetService {
   constructor(endpoints) {
     this.mergeResource = Vue.resource(endpoints.mergePath);
-    this.mergeCheckResource = Vue.resource(endpoints.statusPath);
+    this.mergeCheckResource = Vue.resource(`${endpoints.statusPath}?serializer=widget`);
     this.cancelAutoMergeResource = Vue.resource(endpoints.cancelAutoMergePath);
     this.removeWIPResource = Vue.resource(endpoints.removeWIPPath);
     this.removeSourceBranchResource = Vue.resource(endpoints.sourceBranchPath);

app/controllers/projects/merge_requests_controller.rb

@@ -131,7 +131,7 @@ class Projects::MergeRequestsController < Projects::MergeRequests::ApplicationCo
       .new(project, current_user, wip_event: 'unwip')
       .execute(@merge_request)
 
-    render json: serializer.represent(@merge_request)
+    render json: serialize_widget(@merge_request)
   end
 
   def commit_change_content
@@ -147,7 +147,7 @@ class Projects::MergeRequestsController < Projects::MergeRequests::ApplicationCo
       .new(@project, current_user)
       .cancel(@merge_request)
 
-    render json: serializer.represent(@merge_request)
+    render json: serialize_widget(@merge_request)
   end
 
   def merge
@@ -304,6 +304,10 @@ class Projects::MergeRequestsController < Projects::MergeRequests::ApplicationCo
     end
   end
 
+  def serialize_widget(merge_request)
+    serializer.represent(merge_request, serializer: 'widget')
+  end
+
   def serializer
     MergeRequestSerializer.new(current_user: current_user, project: merge_request.project)
   end

app/helpers/issuables_helper.rb

@@ -32,7 +32,7 @@ module IssuablesHelper
     end
   end
 
-  def serialize_issuable(issuable)
+  def serialize_issuable(issuable, serializer: nil)
     serializer_klass = case issuable
                        when Issue
                          IssueSerializer
@@ -42,7 +42,7 @@ module IssuablesHelper
 
     serializer_klass
       .new(current_user: current_user, project: issuable.project)
-      .represent(issuable)
+      .represent(issuable, serializer: serializer)
       .to_json
   end
 

app/models/blob.rb

@@ -77,9 +77,15 @@ class Blob < SimpleDelegator
   end
 
   def self.lazy(project, commit_id, path)
-    BatchLoader.for(commit_id: commit_id, path: path).batch do |items, loader|
-      project.repository.blobs_at(items.map(&:values)).each do |blob|
-        loader.call({ commit_id: blob.commit_id, path: blob.path }, blob) if blob
+    BatchLoader.for({ project: project, commit_id: commit_id, path: path }).batch do |items, loader|
+      items_by_project = items.group_by { |i| i[:project] }
+
+      items_by_project.each do |project, items|
+        items = items.map { |i| i.values_at(:commit_id, :path) }
+
+        project.repository.blobs_at(items).each do |blob|
+          loader.call({ project: blob.project, commit_id: blob.commit_id, path: blob.path }, blob) if blob
+        end
       end
     end
   end

app/models/diff_discussion.rb

@@ -22,12 +22,9 @@ class DiffDiscussion < Discussion
 
   def merge_request_version_params
     return unless for_merge_request?
-    return {} if active?
 
-    if on_merge_request_commit?
-      { commit_id: commit_id }
-    else
-      noteable.version_params_for(position.diff_refs)
+    version_params.tap do |params|
+      params[:commit_id] = commit_id if on_merge_request_commit?
     end
   end
 
@@ -37,4 +34,12 @@ class DiffDiscussion < Discussion
       position: position.to_json
     )
   end
+
+  private
+
+  def version_params
+    return {} if active?
+
+    noteable.version_params_for(position.diff_refs)
+  end
 end

app/models/identity.rb

@@ -14,11 +14,11 @@ class Identity < ActiveRecord::Base
   end
 
   def ldap?
-    provider.starts_with?('ldap')
+    Gitlab::OAuth::Provider.ldap_provider?(provider)
   end
 
   def self.normalize_uid(provider, uid)
-    if provider.to_s.starts_with?('ldap')
+    if Gitlab::OAuth::Provider.ldap_provider?(provider)
       Gitlab::LDAP::Person.normalize_dn(uid)
     else
       uid.to_s

app/models/merge_request.rb

@@ -8,6 +8,7 @@ class MergeRequest < ActiveRecord::Base
   include ManualInverseAssociation
   include EachBatch
   include ThrottledTouch
+  include Gitlab::Utils::StrongMemoize
 
   ignore_column :locked_at,
                 :ref_fetched
@@ -52,6 +53,7 @@ class MergeRequest < ActiveRecord::Base
   serialize :merge_params, Hash # rubocop:disable Cop/ActiveRecordSerialize
 
   after_create :ensure_merge_request_diff, unless: :importing?
+  after_update :clear_memoized_shas
   after_update :reload_diff_if_branch_changed
 
   # When this attribute is true some MR validation is ignored
@@ -395,14 +397,18 @@ class MergeRequest < ActiveRecord::Base
   end
 
   def source_branch_head
-    return unless source_project
-
-    source_project.repository.commit(source_branch_ref) if source_branch_ref
+    strong_memoize(:source_branch_head) do
+      if source_project && source_branch_ref
+        source_project.repository.commit(source_branch_ref)
+      end
+    end
   end
 
   def target_branch_head
+    strong_memoize(:target_branch_head) do
       target_project.repository.commit(target_branch_ref)
     end
+  end
 
   def branch_merge_base_commit
     start_sha = target_branch_sha
@@ -533,6 +539,13 @@ class MergeRequest < ActiveRecord::Base
     end
   end
 
+  def clear_memoized_shas
+    @target_branch_sha = @source_branch_sha = nil
+
+    clear_memoization(:source_branch_head)
+    clear_memoization(:target_branch_head)
+  end
+
   def reload_diff_if_branch_changed
     if (source_branch_changed? || target_branch_changed?) &&
         (source_branch_head && target_branch_head)

app/models/merge_request_diff.rb

@@ -104,19 +104,19 @@ class MergeRequestDiff < ActiveRecord::Base
   def base_commit
     return unless base_commit_sha
 
-    project.commit(base_commit_sha)
+    project.commit_by(oid: base_commit_sha)
   end
 
   def start_commit
     return unless start_commit_sha
 
-    project.commit(start_commit_sha)
+    project.commit_by(oid: start_commit_sha)
   end
 
   def head_commit
     return unless head_commit_sha
 
-    project.commit(head_commit_sha)
+    project.commit_by(oid: head_commit_sha)
   end
 
   def commit_shas

app/models/user.rb

@@ -738,7 +738,7 @@ class User < ActiveRecord::Base
 
   def ldap_user?
     if identities.loaded?
-      identities.find { |identity| identity.provider.start_with?('ldap') && !identity.extern_uid.nil? }
+      identities.find { |identity| Gitlab::OAuth::Provider.ldap_provider?(identity.provider) && !identity.extern_uid.nil? }
     else
       identities.exists?(["provider LIKE ? AND extern_uid IS NOT NULL", "ldap%"])
     end

app/models/user_synced_attributes_metadata.rb

@@ -6,11 +6,11 @@ class UserSyncedAttributesMetadata < ActiveRecord::Base
   SYNCABLE_ATTRIBUTES = %i[name email location].freeze
 
   def read_only?(attribute)
-    Gitlab.config.omniauth.sync_profile_from_provider && synced?(attribute)
+    sync_profile_from_provider? && synced?(attribute)
   end
 
   def read_only_attributes
-    return [] unless Gitlab.config.omniauth.sync_profile_from_provider
+    return [] unless sync_profile_from_provider?
 
     SYNCABLE_ATTRIBUTES.select { |key| synced?(key) }
   end
@@ -22,4 +22,10 @@ class UserSyncedAttributesMetadata < ActiveRecord::Base
   def set_attribute_synced(attribute, value)
     write_attribute("#{attribute}_synced", value)
   end
+
+  private
+
+  def sync_profile_from_provider?
+    Gitlab::OAuth::Provider.sync_profile_from_provider?(provider)
+  end
 end

app/serializers/issuable_entity.rb

@@ -3,14 +3,6 @@ class IssuableEntity < Grape::Entity
 
   expose :id
   expose :iid
-  expose :author_id
   expose :description
-  expose :lock_version
-  expose :milestone_id
   expose :title
-  expose :updated_by_id
-  expose :created_at
-  expose :updated_at
-  expose :milestone, using: API::Entities::Milestone
-  expose :labels, using: LabelEntity
 end

app/serializers/issuable_sidebar_entity.rb

 class IssuableSidebarEntity < Grape::Entity
+  include TimeTrackableEntity
   include RequestAwareEntity
 
   expose :participants, using: ::API::Entities::UserBasic do |issuable|
@@ -8,9 +9,4 @@ class IssuableSidebarEntity < Grape::Entity
   expose :subscribed do |issuable|
     issuable.subscribed?(request.current_user, issuable.project)
   end
-
-  expose :time_estimate
-  expose :total_time_spent
-  expose :human_time_estimate
-  expose :human_total_time_spent
 end

app/serializers/issue_entity.rb

@@ -2,7 +2,15 @@ class IssueEntity < IssuableEntity
   include TimeTrackableEntity
 
   expose :state
+  expose :milestone_id
+  expose :updated_by_id
+  expose :created_at
+  expose :updated_at
   expose :deleted_at
+  expose :milestone, using: API::Entities::Milestone
+  expose :labels, using: LabelEntity
+  expose :lock_version
+  expose :author_id
   expose :confidential
   expose :discussion_locked
   expose :assignees, using: API::Entities::UserBasic

app/serializers/merge_request_serializer.rb

 class MergeRequestSerializer < BaseSerializer
   # This overrided method takes care of which entity should be used
-  # to serialize the `merge_request` based on `basic` key in `opts` param.
+  # to serialize the `merge_request` based on `serializer` key in `opts` param.
   # Hence, `entity` doesn't need to be declared on the class scope.
   def represent(merge_request, opts = {})
     entity =
       case opts[:serializer]
       when 'basic', 'sidebar'
         MergeRequestBasicEntity
-      else
-        MergeRequestEntity
+      when 'widget'
+        MergeRequestWidgetEntity
       end
 
     super(merge_request, opts, entity)

app/serializers/merge_request_entity.rb → app/serializers/merge_request_widget_entity.rb

-class MergeRequestEntity < IssuableEntity
-  include TimeTrackableEntity
-
+class MergeRequestWidgetEntity < IssuableEntity
   expose :state
-  expose :deleted_at
   expose :in_progress_merge_commit_sha
   expose :merge_commit_sha
   expose :merge_error

app/views/projects/merge_requests/show.html.haml

@@ -20,7 +20,7 @@
     -# haml-lint:disable InlineJavaScript
     :javascript
       window.gl = window.gl || {};
-      window.gl.mrWidgetData = #{serialize_issuable(@merge_request)}
+      window.gl.mrWidgetData = #{serialize_issuable(@merge_request, serializer: 'widget')}
 
     #js-vue-mr-widget.mr-widget
 

changelogs/unreleased/dm-ldap-email-readonly.yml

+---
+title: Make sure user email is read only when synced with LDAP
+merge_request: 15915
+author:
+type: fixed

changelogs/unreleased/osw-isolate-mr-widget-exposed-attributes.yml

+---
+title: Stop sending milestone and labels data over the wire for MR widget requests
+merge_request:
+author:
+type: performance

changelogs/unreleased/zj-memoization-mr-commits.yml

+---
+title: Cache commits for MergeRequest diffs
+merge_request:
+author:
+type: performance

config/gitlab.yml.example

@@ -383,6 +383,7 @@ production: &base
     # Sync user's profile from the specified Omniauth providers every time the user logs in (default: empty).
     # Define the allowed providers using an array, e.g. ["cas3", "saml", "twitter"],
     # or as true/false to allow all providers or none.
+    # When authenticating using LDAP, the user's email is always synced.
     # sync_profile_from_provider: []
 
     # Select which info to sync from the providers above. (default: email).

doc/administration/reply_by_email.md

@@ -89,9 +89,11 @@ email address in order to sign up.
 
 If you also host a public-facing GitLab instance at `hooli.com` and set your
 incoming email domain to `hooli.com`, an attacker could abuse the "Create new
-issue by email" feature by using a project's unique address as the email when
-signing up for Slack, which would send a confirmation email, which would create
-a new issue on the project owned by the attacker, allowing them to click the
+issue by email" or
+"[Create new merge request by email](../user/project/merge_requests/index.md#create-new-merge-requests-by-email)"
+features by using a project's unique address as the email when signing up for
+Slack, which would send a confirmation email, which would create a new issue or
+merge request on the project owned by the attacker, allowing them to click the
 confirmation link and validate their account on your company's private Slack
 instance.
 

doc/development/README.md

@@ -80,10 +80,9 @@ comments: false
 
 ## Documentation guides
 
-- [Documentation styleguide](doc_styleguide.md): Use this styleguide if you are
-  contributing to the documentation.
 - [Writing documentation](writing_documentation.md)
-  - [Distinction between general documentation and technical articles](writing_documentation.md#distinction-between-general-documentation-and-technical-articles)
+- [Documentation styleguide](doc_styleguide.md)
+- [Markdown](../user/markdown.md)
 
 ## Internationalization (i18n) guides
 

doc/integration/omniauth.md

@@ -230,6 +230,8 @@ In order to enable/disable an OmniAuth provider, go to Admin Area -> Settings ->
 
 You can enable profile syncing from selected OmniAuth providers and for all or for specific user information.
 
+When authenticating using LDAP, the user's email is always synced.
+
  ```ruby
    gitlab_rails['sync_profile_from_provider'] = ['twitter', 'google_oauth2']
    gitlab_rails['sync_profile_attributes'] = ['name', 'email', 'location']
@@ -240,5 +242,5 @@ You can enable profile syncing from selected OmniAuth providers and for all or f
  ```yaml
    omniauth:
      sync_profile_from_provider: ['twitter', 'google_oauth2']
-     sync_profile_claims_from_provider: ['email', 'location']
+     sync_profile_attributes: ['email', 'location']
  ```

doc/topics/autodevops/index.md

@@ -19,6 +19,7 @@ project in an easy and automatic way:
 1. [Auto Build](#auto-build)
 1. [Auto Test](#auto-test)
 1. [Auto Code Quality](#auto-code-quality)
+1. [Auto SAST (Static Application Security Testing)](#auto-sast)
 1. [Auto Review Apps](#auto-review-apps)
 1. [Auto Deploy](#auto-deploy)
 1. [Auto Monitoring](#auto-monitoring)
@@ -147,6 +148,10 @@ has a `.gitlab-ci.yml` or not:
   do that in a branch to test Auto DevOps before committing to `master`.
 
 NOTE: **Note:**
+Starting with GitLab 10.3, when enabling Auto DevOps, a pipeline is
+automatically run on the default branch.
+
+NOTE: **Note:**
 If you are a GitLab Administrator, you can enable Auto DevOps instance wide
 in **Admin Area > Settings > Continuous Integration and Deployment**. Doing that,
 all the projects that haven't explicitly set an option will have Auto DevOps
@@ -198,6 +203,18 @@ out. In GitLab Enterprise Edition Starter, differences between the source and
 target branches are
 [shown in the merge request widget](https://docs.gitlab.com/ee/user/project/merge_requests/code_quality_diff.html).
 
+### Auto SAST
+
+> Introduced in [GitLab Enterprise Edition Ultimate][ee] 10.3.
+
+Static Application Security Testing (SAST) uses the
+[gl-sast Docker image](https://gitlab.com/gitlab-org/gl-sast) to run static
+analysis on the current code and checks for potential security issues. Once the
+report is created, it's uploaded as an artifact which you can later download and
+check out.
+
+Any security warnings are also [shown in the merge request widget](https://docs.gitlab.com/ee/user/project/merge_requests/sast.html).
+
 ### Auto Review Apps
 
 NOTE: **Note:**
@@ -536,3 +553,4 @@ curl --data "value=true" --header "PRIVATE-TOKEN: personal_access_token" https:/
 [postgresql]: https://www.postgresql.org/
 [Auto DevOps template]: https://gitlab.com/gitlab-org/gitlab-ci-yml/blob/master/Auto-DevOps.gitlab-ci.yml
 [GitLab Omnibus Helm Chart]: ../../install/kubernetes/gitlab_omnibus.md
+[ee]: https://about.gitlab.com/gitlab-ee/

doc/user/discussions/index.md

@@ -32,6 +32,43 @@ hide discussions that are no longer relevant.
 Comments and discussions can be resolved by anyone with at least Developer
 access to the project or the author of the merge request.
 
+### Commit discussions in the context of a merge request
+
+> [Introduced][ce-31847] in GitLab 10.3.
+
+For reviewers with commit-based workflow, it may be useful to add discussions to
+specific commit diffs in the context of a merge request. These discussions will
+persist through a commit ID change when:
+
+- force-pushing after a rebase
+- amending a commit
+
+To create a commit diff discussion:
+
+1. Navigate to the merge request **Commits** tab. A list of commits that
+   constitute the merge request will be shown.
+
+    ![Merge request commits tab](img/merge_request_commits_tab.png)
+
+1. Navigate to a specific commit, click on the **Changes** tab (where you
+   will only be presented diffs from the selected commit), and leave a comment.
+
+    ![Commit diff discussion in merge request context](img/commit_comment_mr_context.png)
+
+1. Any discussions created this way will be shown in the merge request's
+   **Discussions** tab and are resolvable.
+
+    ![Merge request Discussions tab](img/commit_comment_mr_discussions_tab.png)
+
+Discussions created this way will only appear in the original merge request
+and not when navigating to that commit under your project's
+**Repository > Commits** page.
+
+TIP: **Tip:**
+When a link of a commit reference is found in a discussion inside a merge
+request, it will be automatically converted to a link in the context of the
+current merge request.
+
 ### Jumping between unresolved discussions
 
 When a merge request has a large number of comments it can be difficult to track
@@ -133,6 +170,15 @@ From now on, any discussions on a diff will be resolved by default if a push
 makes that diff section outdated. Discussions on lines that don't change and
 top-level resolvable discussions are not automatically resolved.
 
+## Commit discussions
+
+You can add comments and discussion threads to a particular commit under your
+project's **Repository > Commits**.
+
+CAUTION: **Attention:**
+Discussions created this way will be lost if the commit ID changes after a
+force push.
+
 ## Threaded discussions
 
 > [Introduced][ce-7527] in GitLab 9.1.
@@ -229,6 +275,7 @@ edit existing comments. Non-team members are restricted from adding or editing c
 [ce-14053]: https://gitlab.com/gitlab-org/gitlab-ce/merge_requests/14053
 [ce-14061]: https://gitlab.com/gitlab-org/gitlab-ce/merge_requests/14061
 [ce-14531]: https://gitlab.com/gitlab-org/gitlab-ce/merge_requests/14531
+[ce-31847]: https://gitlab.com/gitlab-org/gitlab-ce/merge_requests/31847
 [resolve-discussion-button]: img/resolve_discussion_button.png
 [resolve-comment-button]: img/resolve_comment_button.png
 [discussion-view]: img/discussion_view.png

doc/user/group/index.md

@@ -197,11 +197,11 @@ username, you can create a new group and transfer projects to it.
 Changing a group's path can have unintended side effects.
 
 * Existing web URLs for the group and anything under it (i.e. projects) will
-redirect to the new URLs
-* Existing Git remote URLs for projects under the group will no longer work, but
-Git responses will show an error with the new remote URL
-* The original namespace can be claimed again by any group or user, which will
-destroy web redirects and Git remote warnings
+redirect to the new URLs.
+* Existing Git remote URLs for projects under the group will redirect to the new remote URL, and they
+will show a warning with the new remote URL.
+* The redirect to the new URL is permanent, that implies the original namespace 
+can't be claimed again by any group or user.
 * If you are vacating the path so it can be claimed by another group or user,
 you may need to rename the group name as well since both names and paths must be
 unique

doc/user/profile/index.md

@@ -21,11 +21,10 @@ Alternatively, you can follow [this detailed procedure from the GitLab Team Hand
 Changing your username can have unintended side effects.
 
 * Existing web URLs for the user and anything under it (i.e. projects) will
-redirect to the new URLs
-* Existing Git remote URLs for projects under the user will no longer work, but
-Git responses will show an error with the new remote URL
-* The original namespace can be claimed again by any group or user, which will
-destroy any web redirects and Git remote warnings
+redirect to the new URLs.
+* Existing Git remote URLs for projects under the user will redirect to the new remote URL. Git responses
+will show a warning with the new remote URL.
+* The redirect to the new URL is permanent, that implies the original namespace can't be claimed again by any group or user.
 
 > It is currently not possible to rename a namespace if it contains a
 project with container registry tags, because the project cannot be moved.

doc/user/project/merge_requests/index.md

@@ -27,7 +27,7 @@ With GitLab merge requests, you can:
 - [Resolve merge conflicts from the UI](#resolve-conflicts)
 - Enable [fast-forward merge requests](#fast-forward-merge-requests)
 - Enable [semi-linear history merge requests](#semi-linear-history-merge-requests) as another security layer to guarantee the pipeline is passing in the target branch
-- [Create new merge requests by email](#create_by_email)
+- [Create new merge requests by email](#create-new-merge-requests-by-email)
 
 With **[GitLab Enterprise Edition][ee]**, you can also:
 
@@ -139,7 +139,12 @@ address. The address can be obtained on the merge requests page by clicking on
 a **Email a new merge request to this project** button.  The subject will be
 used as the source branch name for the new merge request and the target branch
 will be the default branch for the project. The message body (if not empty)
-will be used as the merge request description.
+will be used as the merge request description. You need
+["Reply by email"](../../../administration/reply_by_email.md) enabled to use
+this feature. If it's not enabled to your instance, you may ask your GitLab
+administrator to do so.
+
+![Create new merge requests by email](img/create_from_email.png)
 
 ## Revert changes
 

doc/user/project/settings/index.md

@@ -50,3 +50,9 @@ Here you can run housekeeping, archive, rename, transfer, or remove a project.
 It's possible to mark a project as archived via the Project Settings. An archived project will be hidden by default in the project listings.
 
 An archived project can be fully restored and will therefore retain it's repository and all associated resources whilst in an archived state.
+
+#### Renaming a project
+
+>**Note:** Only Project Owners and Admin users have the permission to rename a project
+
+It's possible to rename a project from "Rename repository" or "Transfer project" sections. When doing so, you will need to update your local repositories to point to the new location, otherwise Git operations will be rejected.

lib/gitlab/conflict/file_collection.rb

@@ -19,6 +19,8 @@ module Gitlab
           commit_message: commit_message || default_commit_message
         }
         resolver.resolve_conflicts(user, files, args)
+      ensure
+        @merge_request.clear_memoized_shas
       end
 
       def files

lib/gitlab/ldap/user.rb

@@ -36,10 +36,6 @@ module Gitlab
         ldap_config.block_auto_created_users
       end
 
-      def sync_profile_from_provider?
-        true
-      end
-
       def allowed?
         Gitlab::LDAP::Access.allowed?(gl_user)
       end

lib/gitlab/metrics/method_call.rb

+# rubocop:disable Style/ClassVars
+
 module Gitlab
   module Metrics
     # Class for tracking timing information about method calls
     class MethodCall
+      @@measurement_enabled_cache = Concurrent::AtomicBoolean.new(false)
+      @@measurement_enabled_cache_expires_at = Concurrent::AtomicFixnum.new(Time.now.to_i)
       MUTEX = Mutex.new
       BASE_LABELS = { module: nil, method: nil }.freeze
       attr_reader :real_time, :cpu_time, :call_count, :labels
@@ -18,6 +22,10 @@ module Gitlab
         end
       end
 
+      def self.measurement_enabled_cache_expires_at
+        @@measurement_enabled_cache_expires_at
+      end
+
       # name - The full name of the method (including namespace) such as
       #        `User#sign_in`.
       #
@@ -72,7 +80,14 @@ module Gitlab
       end
 
       def call_measurement_enabled?
-        Feature.get(:prometheus_metrics_method_instrumentation).enabled?
+        expires_at = @@measurement_enabled_cache_expires_at.value
+        if expires_at < Time.now.to_i
+          if @@measurement_enabled_cache_expires_at.compare_and_set(expires_at, 1.minute.from_now.to_i)
+            @@measurement_enabled_cache.value = Feature.get(:prometheus_metrics_method_instrumentation).enabled?
+          end
+        end
+
+        @@measurement_enabled_cache.value
       end
     end
   end

lib/gitlab/o_auth/provider.rb

@@ -19,6 +19,18 @@ module Gitlab
         name.to_s.start_with?('ldap')
       end
 
+      def self.sync_profile_from_provider?(provider)
+        return true if ldap_provider?(provider)
+
+        providers = Gitlab.config.omniauth.sync_profile_from_provider
+
+        if providers.is_a?(Array)
+          providers.include?(provider)
+        else
+          providers
+        end
+      end
+
       def self.config_for(name)
         name = name.to_s
         if ldap_provider?(name)

lib/gitlab/o_auth/user.rb

@@ -12,7 +12,7 @@ module Gitlab
 
       def initialize(auth_hash)
         self.auth_hash = auth_hash
-        update_profile if sync_profile_from_provider?
+        update_profile
         add_or_update_user_identities
       end
 
@@ -195,29 +195,31 @@ module Gitlab
       end
 
       def sync_profile_from_provider?
-        providers = Gitlab.config.omniauth.sync_profile_from_provider
-
-        if providers.is_a?(Array)
-          providers.include?(auth_hash.provider)
-        else
-          providers
-        end
+        Gitlab::OAuth::Provider.sync_profile_from_provider?(auth_hash.provider)
       end
 
       def update_profile
-        user_synced_attributes_metadata = gl_user.user_synced_attributes_metadata || gl_user.build_user_synced_attributes_metadata
+        return unless sync_profile_from_provider? || creating_linked_ldap_user?
+
+        metadata = gl_user.user_synced_attributes_metadata || gl_user.build_user_synced_attributes_metadata
 
+        if sync_profile_from_provider?
           UserSyncedAttributesMetadata::SYNCABLE_ATTRIBUTES.each do |key|
             if auth_hash.has_attribute?(key) && gl_user.sync_attribute?(key)
               gl_user[key] = auth_hash.public_send(key) # rubocop:disable GitlabSecurity/PublicSend
-            user_synced_attributes_metadata.set_attribute_synced(key, true)
+              metadata.set_attribute_synced(key, true)
             else
-            user_synced_attributes_metadata.set_attribute_synced(key, false)
+              metadata.set_attribute_synced(key, false)
             end
           end
 
-        user_synced_attributes_metadata.provider = auth_hash.provider
-        gl_user.user_synced_attributes_metadata = user_synced_attributes_metadata
+          metadata.provider = auth_hash.provider
+        end
+
+        if creating_linked_ldap_user? && gl_user.email == ldap_person.email.first
+          metadata.set_attribute_synced(:email, true)
+          metadata.provider = ldap_person.provider
+        end
       end
 
       def log

lib/gitlab/utils/strong_memoize.rb

@@ -11,6 +11,8 @@ module Gitlab
       #
       # We could write it like:
       #
+      #     include Gitlab::Utils::StrongMemoize
+      #
       #     def trigger_from_token
       #       strong_memoize(:trigger) do
       #         Ci::Trigger.find_by_token(params[:token].to_s)
@@ -18,14 +20,22 @@ module Gitlab
       #     end
       #
       def strong_memoize(name)
-        ivar_name = "@#{name}"
-
-        if instance_variable_defined?(ivar_name)
-          instance_variable_get(ivar_name)
+        if instance_variable_defined?(ivar(name))
+          instance_variable_get(ivar(name))
         else
-          instance_variable_set(ivar_name, yield)
+          instance_variable_set(ivar(name), yield)
         end
       end
+
+      def clear_memoization(name)
+        remove_instance_variable(ivar(name)) if instance_variable_defined?(ivar(name))
+      end
+
+      private
+
+      def ivar(name)
+        "@#{name}"
+      end
     end
   end
 end

qa/qa/page/group/show.rb

@@ -6,7 +6,13 @@ module QA
           click_link name
         end
 
+        def filter_by_name(name)
+          fill_in 'Filter by name...', with: name
+        end
+
         def has_subgroup?(name)
+          filter_by_name(name)
+
           page.has_link?(name)
         end
 

spec/controllers/projects/merge_requests_controller_spec.rb

@@ -91,11 +91,11 @@ describe Projects::MergeRequestsController do
         end
       end
 
-      context 'without basic serializer param' do
-        it 'renders the merge request in the json format' do
-          go(format: :json)
+      context 'with widget serializer param' do
+        it 'renders widget MR entity as json' do
+          go(serializer: 'widget', format: :json)
 
-          expect(response).to match_response_schema('entities/merge_request')
+          expect(response).to match_response_schema('entities/merge_request_widget')
         end
       end
     end

spec/features/help_pages_spec.rb

@@ -37,7 +37,7 @@ describe 'Help Pages' do
   context 'in a production environment with version check enabled', :js do
     before do
       allow(Rails.env).to receive(:production?) { true }
-      allow_any_instance_of(ApplicationSetting).to receive(:version_check_enabled) { true }
+      stub_application_setting(version_check_enabled: true)
       allow_any_instance_of(VersionCheck).to receive(:url) { '/version-check-url' }
 
       sign_in(create(:user))
@@ -56,9 +56,9 @@ describe 'Help Pages' do
 
   describe 'when help page is customized' do
     before do
-      allow_any_instance_of(ApplicationSetting).to receive(:help_page_hide_commercial_content?) { true }
-      allow_any_instance_of(ApplicationSetting).to receive(:help_page_text) { "My Custom Text" }
-      allow_any_instance_of(ApplicationSetting).to receive(:help_page_support_url) { "http://example.com/help" }
+      stub_application_setting(help_page_hide_commercial_content: true,
+                               help_page_text: 'My Custom Text',
+                               help_page_support_url: 'http://example.com/help')
 
       sign_in(create(:user))
       visit help_path

spec/features/merge_requests/mini_pipeline_graph_spec.rb

@@ -15,8 +15,8 @@ feature 'Mini Pipeline Graph', :js do
     visit_merge_request
   end
 
-  def visit_merge_request(format = :html)
-    visit project_merge_request_path(project, merge_request, format: format)
+  def visit_merge_request(format: :html, serializer: nil)
+    visit project_merge_request_path(project, merge_request, format: format, serializer: serializer)
   end
 
   it 'should display a mini pipeline graph' do
@@ -33,12 +33,12 @@ feature 'Mini Pipeline Graph', :js do
     end
 
     it 'avoids repeated database queries' do
-      before = ActiveRecord::QueryRecorder.new { visit_merge_request(:json) }
+      before = ActiveRecord::QueryRecorder.new { visit_merge_request(format: :json, serializer: 'widget') }
 
       create(:ci_build, pipeline: pipeline, legacy_artifacts_file: artifacts_file2)
       create(:ci_build, pipeline: pipeline, when: 'manual')
 
-      after = ActiveRecord::QueryRecorder.new { visit_merge_request(:json) }
+      after = ActiveRecord::QueryRecorder.new { visit_merge_request(format: :json, serializer: 'widget') }
 
       expect(before.count).to eq(after.count)
       expect(before.cached_count).to eq(after.cached_count)

spec/fixtures/api/schemas/entities/merge_request.json → spec/fixtures/api/schemas/entities/merge_request_widget.json

@@ -80,15 +80,15 @@
     "target_branch_tree_path": { "type": "string" },
     "source_branch_path": { "type": "string" },
     "conflict_resolution_path": { "type": ["string", "null"] },
-    "cancel_merge_when_pipeline_succeeds_path": { "type": "string" },
-    "create_issue_to_resolve_discussions_path": { "type": "string" },
-    "merge_path": { "type": "string" },
+    "cancel_merge_when_pipeline_succeeds_path": { "type": ["string", "null"] },
+    "create_issue_to_resolve_discussions_path": { "type": ["string", "null"] },
+    "merge_path": { "type": ["string", "null"] },
     "cherry_pick_in_fork_path": { "type": ["string", "null"] },
     "revert_in_fork_path": { "type": ["string", "null"] },
     "email_patches_path": { "type": "string" },
     "plain_diff_path": { "type": "string" },
     "status_path": { "type": "string" },
-    "new_blob_path": { "type": "string" },
+    "new_blob_path": { "type": ["string", "null"] },
     "merge_check_path": { "type": "string" },
     "ci_environments_status_path": { "type": "string" },
     "merge_commit_message_with_description": { "type": "string" },

spec/helpers/notes_helper_spec.rb

@@ -41,6 +41,7 @@ describe NotesHelper do
 
   describe '#discussion_path' do
     let(:project) { create(:project, :repository) }
+    let(:anchor) { discussion.line_code }
 
     context 'for a merge request discusion' do
       let(:merge_request) { create(:merge_request, source_project: project, target_project: project, importing: true) }
@@ -151,6 +152,15 @@ describe NotesHelper do
           expect(helper.discussion_path(discussion)).to be_nil
         end
       end
+
+      context 'for a contextual commit discussion' do
+        let(:commit) { merge_request.commits.last }
+        let(:discussion) { create(:diff_note_on_merge_request, noteable: merge_request, project: project, commit_id: commit.id).to_discussion }
+
+        it 'returns the merge request diff discussion scoped in the commit' do
+          expect(helper.discussion_path(discussion)).to eq(diffs_project_merge_request_path(project, merge_request, commit_id: commit.id, anchor: anchor))
+        end
+      end
     end
 
     context 'for a commit discussion' do
@@ -160,7 +170,7 @@ describe NotesHelper do
         let(:discussion) { create(:diff_note_on_commit, project: project).to_discussion }
 
         it 'returns the commit path with the line code' do
-          expect(helper.discussion_path(discussion)).to eq(project_commit_path(project, commit, anchor: discussion.line_code))
+          expect(helper.discussion_path(discussion)).to eq(project_commit_path(project, commit, anchor: anchor))
         end
       end
 
@@ -168,7 +178,7 @@ describe NotesHelper do
         let(:discussion) { create(:legacy_diff_note_on_commit, project: project).to_discussion }
 
         it 'returns the commit path with the line code' do
-          expect(helper.discussion_path(discussion)).to eq(project_commit_path(project, commit, anchor: discussion.line_code))
+          expect(helper.discussion_path(discussion)).to eq(project_commit_path(project, commit, anchor: anchor))
         end
       end
 

spec/lib/gitlab/ldap/user_spec.rb

@@ -38,7 +38,6 @@ describe Gitlab::LDAP::User do
 
     it "does not mark existing ldap user as changed" do
       create(:omniauth_user, email: 'john@example.com', extern_uid: 'uid=john smith,ou=people,dc=example,dc=com', provider: 'ldapmain')
-      ldap_user.gl_user.user_synced_attributes_metadata(provider: 'ldapmain', email: true)
       expect(ldap_user.changed?).to be_falsey
     end
   end
@@ -144,11 +143,15 @@ describe Gitlab::LDAP::User do
         expect(ldap_user.gl_user.email).to eq(info[:email])
       end
 
-      it "has user_synced_attributes_metadata email set to true" do
+      it "has email set as synced" do
         expect(ldap_user.gl_user.user_synced_attributes_metadata.email_synced).to be_truthy
       end
 
-      it "has synced_attribute_provider set to ldapmain" do
+      it "has email set as read-only" do
+        expect(ldap_user.gl_user.read_only_attribute?(:email)).to be_truthy
+      end
+
+      it "has synced attributes provider set to ldapmain" do
         expect(ldap_user.gl_user.user_synced_attributes_metadata.provider).to eql 'ldapmain'
       end
     end
@@ -162,9 +165,13 @@ describe Gitlab::LDAP::User do
         expect(ldap_user.gl_user.temp_oauth_email?).to be_truthy
       end
 
-      it "has synced attribute email set to false" do
+      it "has email set as not synced" do
         expect(ldap_user.gl_user.user_synced_attributes_metadata.email_synced).to be_falsey
       end
+
+      it "does not have email set as read-only" do
+        expect(ldap_user.gl_user.read_only_attribute?(:email)).to be_falsey
+      end
     end
   end
 

spec/lib/gitlab/metrics/method_call_spec.rb

@@ -20,9 +20,39 @@ describe Gitlab::Metrics::MethodCall do
 
       context 'prometheus instrumentation is enabled' do
         before do
+          allow(Feature.get(:prometheus_metrics_method_instrumentation)).to receive(:enabled?).and_call_original
+          described_class.measurement_enabled_cache_expires_at.value = Time.now.to_i - 1
           Feature.get(:prometheus_metrics_method_instrumentation).enable
         end
 
+        around do |example|
+          Timecop.freeze do
+            example.run
+          end
+        end
+
+        it 'caches subsequent invocations of feature check' do
+          10.times do
+            method_call.measure { 'foo' }
+          end
+
+          expect(Feature.get(:prometheus_metrics_method_instrumentation)).to have_received(:enabled?).once
+        end
+
+        it 'expires feature check cache after 1 minute' do
+          method_call.measure { 'foo' }
+
+          Timecop.travel(1.minute.from_now) do
+            method_call.measure { 'foo' }
+          end
+
+          Timecop.travel(1.minute.from_now + 1.second) do
+            method_call.measure { 'foo' }
+          end
+
+          expect(Feature.get(:prometheus_metrics_method_instrumentation)).to have_received(:enabled?).twice
+        end
+
         it 'observes the performance of the supplied block' do
           expect(described_class.call_duration_histogram)
             .to receive(:observe)
@@ -34,6 +64,8 @@ describe Gitlab::Metrics::MethodCall do
 
       context 'prometheus instrumentation is disabled' do
         before do
+          described_class.measurement_enabled_cache_expires_at.value = Time.now.to_i - 1
+
           Feature.get(:prometheus_metrics_method_instrumentation).disable
         end
 

spec/lib/gitlab/o_auth/user_spec.rb

@@ -202,11 +202,13 @@ describe Gitlab::OAuth::User do
             end
 
             context "and no account for the LDAP user" do
-              it "creates a user with dual LDAP and omniauth identities" do
+              before do
                 allow(Gitlab::LDAP::Person).to receive(:find_by_uid).and_return(ldap_user)
 
                 oauth_user.save
+              end
 
+              it "creates a user with dual LDAP and omniauth identities" do
                 expect(gl_user).to be_valid
                 expect(gl_user.username).to eql uid
                 expect(gl_user.email).to eql 'johndoe@example.com'
@@ -219,6 +221,18 @@ describe Gitlab::OAuth::User do
                   ]
                 )
               end
+
+              it "has email set as synced" do
+                expect(gl_user.user_synced_attributes_metadata.email_synced).to be_truthy
+              end
+
+              it "has email set as read-only" do
+                expect(gl_user.read_only_attribute?(:email)).to be_truthy
+              end
+
+              it "has synced attributes provider set to ldapmain" do
+                expect(gl_user.user_synced_attributes_metadata.provider).to eql 'ldapmain'
+              end
             end
 
             context "and LDAP user has an account already" do
@@ -440,11 +454,15 @@ describe Gitlab::OAuth::User do
         expect(gl_user.email).to eq(info_hash[:email])
       end
 
-      it "has external_attributes set to true" do
-        expect(gl_user.user_synced_attributes_metadata).not_to be_nil
+      it "has email set as synced" do
+        expect(gl_user.user_synced_attributes_metadata.email_synced).to be_truthy
+      end
+
+      it "has email set as read-only" do
+        expect(gl_user.read_only_attribute?(:email)).to be_truthy
       end
 
-      it "has attributes_provider set to my-provider" do
+      it "has synced attributes provider set to my-provider" do
         expect(gl_user.user_synced_attributes_metadata.provider).to eql 'my-provider'
       end
     end
@@ -458,10 +476,13 @@ describe Gitlab::OAuth::User do
         expect(gl_user.email).not_to eq(info_hash[:email])
       end
 
-      it "has user_synced_attributes_metadata set to nil" do
-        expect(gl_user.user_synced_attributes_metadata.provider).to eql 'my-provider'
+      it "has email set as not synced" do
         expect(gl_user.user_synced_attributes_metadata.email_synced).to be_falsey
       end
+
+      it "does not have email set as read-only" do
+        expect(gl_user.read_only_attribute?(:email)).to be_falsey
+      end
     end
   end
 
@@ -508,11 +529,15 @@ describe Gitlab::OAuth::User do
         expect(gl_user.email).to eq(info_hash[:email])
       end
 
-      it "has email_synced_attribute set to true" do
+      it "has email set as synced" do
         expect(gl_user.user_synced_attributes_metadata.email_synced).to be(true)
       end
 
-      it "has my-provider as attributes_provider" do
+      it "has email set as read-only" do
+        expect(gl_user.read_only_attribute?(:email)).to be_truthy
+      end
+
+      it "has synced attributes provider set to my-provider" do
         expect(gl_user.user_synced_attributes_metadata.provider).to eql 'my-provider'
       end
     end
@@ -524,7 +549,14 @@ describe Gitlab::OAuth::User do
 
       it "does not update the user email" do
         expect(gl_user.email).not_to eq(info_hash[:email])
-        expect(gl_user.user_synced_attributes_metadata.email_synced).to be(false)
+      end
+
+      it "has email set as not synced" do
+        expect(gl_user.user_synced_attributes_metadata.email_synced).to be_falsey
+      end
+
+      it "does not have email set as read-only" do
+        expect(gl_user.read_only_attribute?(:email)).to be_falsey
       end
     end
   end

spec/lib/gitlab/utils/strong_memoize_spec.rb

@@ -49,4 +49,16 @@ describe Gitlab::Utils::StrongMemoize do
       end
     end
   end
+
+  describe '#clear_memoization' do
+    let(:value) { 'mepmep' }
+
+    it 'removes the instance variable' do
+      object.method_name
+
+      object.clear_memoization(:method_name)
+
+      expect(object.instance_variable_defined?(:@method_name)).to be(false)
+    end
+  end
 end

spec/models/merge_request_spec.rb

@@ -124,6 +124,7 @@ describe MergeRequest do
     context 'when the target branch does not exist' do
       before do
         project.repository.rm_branch(subject.author, subject.target_branch)
+        subject.clear_memoized_shas
       end
 
       it 'returns nil' do
@@ -600,30 +601,30 @@ describe MergeRequest do
   end
 
   describe '#can_remove_source_branch?' do
-    let(:user) { create(:user) }
-    let(:user2) { create(:user) }
+    set(:user) { create(:user) }
+    set(:merge_request) { create(:merge_request, :simple) }
 
-    before do
-      subject.source_project.team << [user, :master]
+    subject { merge_request }
 
-      subject.source_branch = "feature"
-      subject.target_branch = "master"
-      subject.save!
+    before do
+      subject.source_project.add_master(user)
     end
 
     it "can't be removed when its a protected branch" do
       allow(ProtectedBranch).to receive(:protected?).and_return(true)
+
       expect(subject.can_remove_source_branch?(user)).to be_falsey
     end
 
     it "can't remove a root ref" do
-      subject.source_branch = "master"
-      subject.target_branch = "feature"
+      subject.update(source_branch: 'master', target_branch: 'feature')
 
       expect(subject.can_remove_source_branch?(user)).to be_falsey
     end
 
     it "is unable to remove the source branch for a project the user cannot push to" do
+      user2 = create(:user)
+
       expect(subject.can_remove_source_branch?(user2)).to be_falsey
     end
 
@@ -634,6 +635,7 @@ describe MergeRequest do
     end
 
     it "cannot be removed if the last commit is not also the head of the source branch" do
+      subject.clear_memoized_shas
       subject.source_branch = "lfs"
 
       expect(subject.can_remove_source_branch?(user)).to be_falsey
@@ -733,7 +735,7 @@ describe MergeRequest do
 
       before do
         project.repository.raw_repository.delete_branch(subject.target_branch)
-        subject.reload
+        subject.clear_memoized_shas
       end
 
       it 'does not crash' do
@@ -1404,6 +1406,16 @@ describe MergeRequest do
 
       subject.reload_diff
     end
+
+    context 'when using the after_update hook to update' do
+      context 'when the branches are updated' do
+        it 'uses the new heads to generate the diff' do
+          expect { subject.update!(source_branch: subject.target_branch, target_branch: subject.source_branch) }
+            .to change { subject.merge_request_diff.start_commit_sha }
+            .and change { subject.merge_request_diff.head_commit_sha }
+        end
+      end
+    end
   end
 
   describe '#update_diff_discussion_positions' do
@@ -1468,6 +1480,7 @@ describe MergeRequest do
     context 'when the target branch does not exist' do
       before do
         subject.project.repository.rm_branch(subject.author, subject.target_branch)
+        subject.clear_memoized_shas
       end
 
       it 'returns nil' do

spec/serializers/merge_request_serializer_spec.rb

 require 'spec_helper'
 
 describe MergeRequestSerializer do
-  let(:user) { build_stubbed(:user) }
-  let(:merge_request) { build_stubbed(:merge_request) }
-
-  let(:serializer) do
+  let(:user) { create(:user) }
+  let(:resource) { create(:merge_request) }
+  let(:json_entity) do
     described_class.new(current_user: user)
+      .represent(resource, serializer: serializer)
+      .with_indifferent_access
   end
 
-  describe '#represent' do
-    let(:opts) { { serializer: serializer_entity } }
-    subject { serializer.represent(merge_request, serializer: serializer_entity) }
+  context 'widget merge request serialization' do
+    let(:serializer) { 'widget' }
 
-    context 'when passing basic serializer param' do
-      let(:serializer_entity) { 'basic' }
+    it 'matches issue json schema' do
+      expect(json_entity).to match_schema('entities/merge_request_widget')
+    end
+  end
 
-      it 'calls super class #represent with correct params' do
-        expect_any_instance_of(BaseSerializer).to receive(:represent)
-          .with(merge_request, opts, MergeRequestBasicEntity)
+  context 'sidebar merge request serialization' do
+    let(:serializer) { 'sidebar' }
 
-        subject
+    it 'matches basic merge request json schema' do
+      expect(json_entity).to match_schema('entities/merge_request_basic')
     end
   end
 
-    context 'when serializer param is falsy' do
-      let(:serializer_entity) { nil }
-
-      it 'calls super class #represent with correct params' do
-        expect_any_instance_of(BaseSerializer).to receive(:represent)
-          .with(merge_request, opts, MergeRequestEntity)
+  context 'basic merge request serialization' do
+    let(:serializer) { 'basic' }
 
-        subject
+    it 'matches basic merge request json schema' do
+      expect(json_entity).to match_schema('entities/merge_request_basic')
     end
   end
+
+  context 'no serializer' do
+    let(:serializer) { nil }
+
+    it 'raises an error' do
+      expect { json_entity }.to raise_error(NoMethodError)
+    end
   end
 end

spec/serializers/merge_request_entity_spec.rb → spec/serializers/merge_request_widget_entity_spec.rb

 require 'spec_helper'
 
-describe MergeRequestEntity do
+describe MergeRequestWidgetEntity do
   let(:project)  { create :project, :repository }
   let(:resource) { create(:merge_request, source_project: project, target_project: project) }
   let(:user)     { create(:user) }
@@ -35,33 +35,6 @@ describe MergeRequestEntity do
     end
   end
 
-  it 'includes issues_links' do
-    issues_links = subject[:issues_links]
-
-    expect(issues_links).to include(:closing, :mentioned_but_not_closing,
-                                    :assign_to_closing)
-  end
-
-  it 'has Issuable attributes' do
-    expect(subject).to include(:id, :iid, :author_id, :description, :lock_version, :milestone_id,
-                               :title, :updated_by_id, :created_at, :updated_at, :milestone, :labels)
-  end
-
-  it 'has time estimation attributes' do
-    expect(subject).to include(:time_estimate, :total_time_spent, :human_time_estimate, :human_total_time_spent)
-  end
-
-  it 'has important MergeRequest attributes' do
-    expect(subject).to include(:state, :deleted_at, :diff_head_sha, :merge_commit_message,
-                               :has_conflicts, :has_ci, :merge_path,
-                               :conflict_resolution_path,
-                               :cancel_merge_when_pipeline_succeeds_path,
-                               :create_issue_to_resolve_discussions_path,
-                               :source_branch_path, :target_branch_commits_path,
-                               :target_branch_tree_path, :commits_count, :merge_ongoing,
-                               :ff_only_enabled)
-  end
-
   it 'has email_patches_path' do
     expect(subject[:email_patches_path])
       .to eq("/#{resource.project.full_path}/merge_requests/#{resource.iid}.patch")
@@ -116,18 +89,6 @@ describe MergeRequestEntity do
     end
   end
 
-  it 'includes merge_event' do
-    create(:event, :merged, author: user, project: resource.project, target: resource)
-
-    expect(subject[:merge_event]).to include(:author, :updated_at)
-  end
-
-  it 'includes closed_event' do
-    create(:event, :closed, author: user, project: resource.project, target: resource)
-
-    expect(subject[:closed_event]).to include(:author, :updated_at)
-  end
-
   describe 'diverged_commits_count' do
     context 'when MR open and its diverging' do
       it 'returns diverged commits count' do

spec/services/merge_requests/merge_service_spec.rb

 require 'spec_helper'
 
 describe MergeRequests::MergeService do
-  let(:user) { create(:user) }
-  let(:user2) { create(:user) }
+  set(:user) { create(:user) }
+  set(:user2) { create(:user) }
   let(:merge_request) { create(:merge_request, :simple, author: user2, assignee: user2) }
   let(:project) { merge_request.project }
 
   before do
-    project.team << [user, :master]
-    project.team << [user2, :developer]
+    project.add_master(user)
+    project.add_developer(user2)
   end
 
   describe '#execute' do

spec/support/batch_loader.rb

+RSpec.configure do |config|
+  config.after do
+    BatchLoader::Executor.clear_current
+  end
+end

spec/support/stub_configuration.rb

@@ -7,6 +7,9 @@ module StubConfiguration
     allow_any_instance_of(ApplicationSetting).to receive_messages(to_settings(messages))
     allow(Gitlab::CurrentSettings.current_application_settings)
       .to receive_messages(to_settings(messages))
+
+    # Ensure that we don't use the Markdown cache when stubbing these values
+    allow_any_instance_of(ApplicationSetting).to receive(:cached_html_up_to_date?).and_return(false)
   end
 
   def stub_not_protect_default_branch

vendor/gitlab-ci-yml/Auto-DevOps.gitlab-ci.yml

@@ -89,7 +89,7 @@ sast:
     POSTGRES_DB: "false"
   allow_failure: true
   script:
-    - /app/bin/run .
+    - sast .
   artifacts:
     paths: [gl-sast-report.json]
 
@@ -232,6 +232,17 @@ production:
     docker run ${cc_opts} codeclimate/codeclimate:0.69.0 analyze -f json > codeclimate.json
   }
 
+  function sast() {
+    case "$CI_SERVER_VERSION" in
+      *-ee)
+        /app/bin/run "$@"
+        ;;
+      *)
+        echo "GitLab EE is required"
+        ;;
+    esac
+  }
+
   function deploy() {
     track="${1-stable}"
     name="$CI_ENVIRONMENT_SLUG"