From 925235378f609e22de93974126af0cfb6a8502a0 Mon Sep 17 00:00:00 2001
From: GitLab Bot <gitlab-bot@gitlab.com>
Date: Wed, 31 Jan 2024 18:10:59 +0000
Subject: [PATCH] Add latest changes from gitlab-org/gitlab@master

---
 .gitlab/ci/as-if-foss.gitlab-ci.yml           |   8 +-
 .gitlab/ci/frontend.gitlab-ci.yml             |  23 --
 .gitlab/ci/preflight.gitlab-ci.yml            |   6 -
 .gitlab/ci/qa.gitlab-ci.yml                   |   6 -
 .gitlab/ci/rails.gitlab-ci.yml                | 180 +--------
 .gitlab/ci/rules.gitlab-ci.yml                | 359 ++++++++++++------
 .gitlab/ci/static-analysis.gitlab-ci.yml      |  20 -
 .rubocop_todo/layout/argument_alignment.yml   |   7 -
 Gemfile                                       |   5 +-
 Gemfile.checksum                              |   6 +-
 Gemfile.lock                                  |  16 +-
 .../blob/components/blob_content.vue          |  35 ++
 app/assets/javascripts/editor/schema/ci.json  |  13 +
 .../notes/components/mr_discussion_filter.vue |   2 +-
 app/assets/javascripts/notes/constants.js     |   5 +
 .../javascripts/notes/stores/getters.js       |   8 +-
 .../components/blob_content_viewer.vue        |  10 +-
 .../snippets/components/snippet_blob_view.vue |   1 +
 .../components/blob_viewers/constants.js      |   1 +
 .../components/blob_viewers/simple_viewer.vue | 144 ++++++-
 .../source_viewer/components/blame_info.vue   |   2 +-
 .../source_viewer/source_viewer.vue           |   4 +-
 .../components/source_viewer/utils.js         |  12 +-
 .../stylesheets/framework/highlight.scss      |   5 +-
 app/controllers/projects/blob_controller.rb   |  21 +-
 app/controllers/projects/tree_controller.rb   |  33 +-
 app/controllers/projects_controller.rb        |   6 +-
 app/controllers/snippets_controller.rb        |  18 +-
 app/graphql/mutations/work_items/delete.rb    |  23 +-
 app/models/concerns/versioned_description.rb  |   6 +-
 app/models/issue.rb                           |   6 +-
 app/models/work_items/widgets/base.rb         |   8 -
 app/models/work_items/widgets/hierarchy.rb    |  14 -
 app/models/work_items/widgets/labels.rb       |   4 -
 app/policies/group_policy.rb                  |   1 +
 app/serializers/note_user_entity.rb           |   2 +
 app/services/issuable/destroy_service.rb      |   6 +-
 app/services/issuable_base_service.rb         |  10 +-
 app/services/work_items/update_service.rb     |   5 +
 app/views/devise/sessions/_new_base.html.haml |   2 +-
 .../devise/sessions/_new_crowd.html.haml      |   3 +-
 app/views/devise/sessions/_new_ldap.html.haml |   3 +-
 app/views/shared/_file_highlight.html.haml    |  14 +-
 app/views/snippets/index.html.haml            |  13 -
 .../development/redirect_with_ref_type.yml    |   8 -
 ...templates_opentofu_base_latest_monthly.yml |  24 ++
 ...p_ci_templates_opentofu_latest_monthly.yml |  24 ++
 ...i_templates_total_unique_counts_weekly.yml |   2 +
 ..._templates_opentofu_base_latest_weekly.yml |  24 ++
 ..._p_ci_templates_opentofu_latest_weekly.yml |  24 ++
 ...6-9-deprecate-terraform-cicd-templates.yml |  33 ++
 ...dd_is_unique_to_issuable_resource_links.rb |   9 +
 ..._id_and_link_to_issuable_resource_links.rb |  19 +
 ...aversal_ids_columns_to_sbom_occurrences.rb |  10 +
 db/schema_migrations/20240110202002           |   1 +
 db/schema_migrations/20240110204949           |   1 +
 db/schema_migrations/20240129175101           |   1 +
 db/structure.sql                              |   5 +
 doc/administration/auth/test_oidc_oauth.md    |  13 +-
 doc/api/graphql/reference/index.md            |   3 +-
 doc/ci/yaml/index.md                          |  33 +-
 doc/development/ee_features.md                |   2 +-
 doc/development/pipelines/index.md            |  47 ++-
 doc/update/deprecations.md                    |  34 ++
 doc/user/custom_roles.md                      | 168 ++++----
 doc/user/gitlab_com/index.md                  |   3 +-
 doc/user/group/index.md                       |   2 +-
 doc/user/group/manage.md                      |  43 +--
 doc/user/project/members/index.md             |   2 +-
 lib/gitlab/ci/config/entry/job.rb             |   2 +-
 .../templates/OpenTofu.latest.gitlab-ci.yml   |  30 ++
 .../OpenTofu/Base.latest.gitlab-ci.yml        | 169 +++++++++
 .../ci/templates/Terraform/Base.gitlab-ci.yml |  18 +
 .../Terraform/Base.latest.gitlab-ci.yml       |  18 +
 lib/gitlab/ci/yaml_processor/feature_flags.rb |   4 +-
 locale/gitlab.pot                             |   9 +-
 package.json                                  |   2 +-
 scripts/frontend/build_css.mjs                |  13 +
 scripts/frontend/{ => lib}/compile_css.mjs    |  88 +++--
 scripts/frontend/webpack_dev_server.js        |  11 +
 scripts/rspec_helpers.sh                      |   4 +-
 scripts/setup/generate-as-if-foss-env.rb      |  12 +-
 .../projects/blob_controller_spec.rb          |  61 +--
 .../projects/tree_controller_spec.rb          |  88 +----
 spec/controllers/projects_controller_spec.rb  |   4 +-
 spec/controllers/snippets_controller_spec.rb  |  35 +-
 spec/dot_gitlab_ci/rules_spec.rb              |  35 ++
 .../blobs/blob_line_permalink_updater_spec.rb |  48 +--
 .../schemas/entities/note_user_entity.json    |   6 +-
 .../blob/components/blob_content_spec.js      |   2 +
 .../components/design_presentation_spec.js    | 337 ++++++++--------
 .../negative_tests/identity_provider.yml      |   5 +
 .../positive_tests/identity_provider.yml      |   2 +
 .../components/mr_discussion_filter_spec.js   |   7 +-
 spec/frontend/notes/stores/getters_spec.js    |  13 +
 .../components/blob_content_viewer_spec.js    |   2 +-
 .../components/snippet_blob_view_spec.js      |   5 +
 .../__snapshots__/simple_viewer_spec.js.snap  |  80 ++--
 .../components/blob_viewers/mock_data.js      |  41 ++
 .../blob_viewers/simple_viewer_spec.js        |  97 ++++-
 .../__snapshots__/utils_spec.js.snap          |   2 +-
 .../source_viewer/source_viewer_spec.js       |   1 -
 .../Terraform/base_gitlab_ci_yaml_spec.rb     |  19 +-
 .../base_latest_gitlab_ci_yaml_spec.rb        |  19 +-
 .../terraform_gitlab_ci_yaml_spec.rb          |   8 +
 .../terraform_latest_gitlab_ci_yaml_spec.rb   |  12 +
 .../ci/yaml_processor/feature_flags_spec.rb   |  22 +-
 .../mutations/work_items/delete_spec.rb       |  35 +-
 .../setup/generate_as_if_foss_env_spec.rb     |  14 +-
 .../work_items/delete_service_spec.rb         |  24 +-
 spec/simplecov_env.rb                         |   6 +-
 ...ambiguous_ref_controller_shared_context.rb |   1 -
 .../policies/group_policy_shared_context.rb   |   1 +
 vite.config.js                                |   4 +
 114 files changed, 1863 insertions(+), 1164 deletions(-)
 delete mode 100644 app/views/snippets/index.html.haml
 delete mode 100644 config/feature_flags/development/redirect_with_ref_type.yml
 create mode 100644 config/metrics/counts_28d/20240130072055_p_ci_templates_opentofu_base_latest_monthly.yml
 create mode 100644 config/metrics/counts_28d/20240130072115_p_ci_templates_opentofu_latest_monthly.yml
 create mode 100644 config/metrics/counts_7d/20240130072053_p_ci_templates_opentofu_base_latest_weekly.yml
 create mode 100644 config/metrics/counts_7d/20240130072114_p_ci_templates_opentofu_latest_weekly.yml
 create mode 100644 data/deprecations/16-9-deprecate-terraform-cicd-templates.yml
 create mode 100644 db/migrate/20240110202002_add_is_unique_to_issuable_resource_links.rb
 create mode 100644 db/migrate/20240110204949_add_partial_unique_index_on_issue_id_and_link_to_issuable_resource_links.rb
 create mode 100644 db/migrate/20240129175101_add_archived_and_traversal_ids_columns_to_sbom_occurrences.rb
 create mode 100644 db/schema_migrations/20240110202002
 create mode 100644 db/schema_migrations/20240110204949
 create mode 100644 db/schema_migrations/20240129175101
 create mode 100644 lib/gitlab/ci/templates/OpenTofu.latest.gitlab-ci.yml
 create mode 100644 lib/gitlab/ci/templates/OpenTofu/Base.latest.gitlab-ci.yml
 create mode 100755 scripts/frontend/build_css.mjs
 rename scripts/frontend/{ => lib}/compile_css.mjs (76%)
 mode change 100755 => 100644
 create mode 100644 spec/frontend/editor/schema/ci/yaml_tests/negative_tests/identity_provider.yml
 create mode 100644 spec/frontend/editor/schema/ci/yaml_tests/positive_tests/identity_provider.yml
 create mode 100644 spec/frontend/vue_shared/components/blob_viewers/mock_data.js

diff --git a/.gitlab/ci/as-if-foss.gitlab-ci.yml b/.gitlab/ci/as-if-foss.gitlab-ci.yml
index fc8db3ba974..5bcf1ff696c 100644
--- a/.gitlab/ci/as-if-foss.gitlab-ci.yml
+++ b/.gitlab/ci/as-if-foss.gitlab-ci.yml
@@ -1,7 +1,7 @@
 .as-if-foss-variables:
   variables:
     AS_IF_FOSS_BRANCH: "as-if-foss/${CI_COMMIT_REF_NAME}"
-    FOSS_REPOSITORY: "https://dummy:${AS_IF_FOSS_TOKEN}@gitlab.com/gitlab-org/gitlab-foss.git"
+    FOSS_REPOSITORY: "https://dummy:${AS_IF_FOSS_TOKEN}@gitlab.com/${CI_PROJECT_NAMESPACE}/gitlab-foss.git"
 
 prepare-as-if-foss-branch:
   extends:
@@ -66,6 +66,10 @@ start-as-if-foss:
     RUBY_VERSION: $RUBY_VERSION
     ENABLE_RSPEC: $ENABLE_RSPEC
     ENABLE_RSPEC_FAST_SPEC_HELPER: $ENABLE_RSPEC_FAST_SPEC_HELPER
+    ENABLE_RSPEC_PRAEFECT: $ENABLE_RSPEC_PRAEFECT
+    ENABLE_RSPEC_SINGLE_DB: $ENABLE_RSPEC_SINGLE_DB
+    ENABLE_RSPEC_SINGLE_DB_CI_CONNECTION: $ENABLE_RSPEC_SINGLE_DB_CI_CONNECTION
+    ENABLE_RSPEC_SINGLE_REDIS: $ENABLE_RSPEC_SINGLE_REDIS
     ENABLE_RSPEC_UNIT: $ENABLE_RSPEC_UNIT
     ENABLE_RSPEC_INTEGRATION: $ENABLE_RSPEC_INTEGRATION
     ENABLE_RSPEC_SYSTEM: $ENABLE_RSPEC_SYSTEM
@@ -86,7 +90,7 @@ start-as-if-foss:
     ENABLE_QA_SELECTORS: $ENABLE_QA_SELECTORS
     ENABLE_STATIC_ANALYSIS: $ENABLE_STATIC_ANALYSIS
   trigger:
-    project: gitlab-org/gitlab-foss
+    project: ${CI_PROJECT_NAMESPACE}/gitlab-foss
     branch: as-if-foss/${CI_COMMIT_REF_NAME}
     strategy: depend
 
diff --git a/.gitlab/ci/frontend.gitlab-ci.yml b/.gitlab/ci/frontend.gitlab-ci.yml
index 9d78fb102f9..22a6b3d4842 100644
--- a/.gitlab/ci/frontend.gitlab-ci.yml
+++ b/.gitlab/ci/frontend.gitlab-ci.yml
@@ -226,12 +226,6 @@ graphql-schema-dump:
       - tmp/tests/graphql/gitlab_schema.graphql
       - tmp/tests/graphql/gitlab_schema.json
 
-graphql-schema-dump as-if-foss:
-  extends:
-    - graphql-schema-dump
-    - .frontend:rules:default-frontend-jobs-as-if-foss
-    - .as-if-foss
-
 .frontend-test-base:
   extends:
     - .default-retry
@@ -279,14 +273,6 @@ jest predictive:
   script:
     - if [[ -s "$RSPEC_CHANGED_FILES_PATH" ]] || [[ -s "$RSPEC_MATCHING_JS_FILES_PATH" ]]; then run_timed_command "yarn jest:ci:predictive"; fi
 
-jest as-if-foss:
-  extends:
-    - .jest-base
-    - .frontend:rules:jest:as-if-foss
-    - .as-if-foss
-  needs: ["rspec-all frontend_fixture as-if-foss"]
-  parallel: 10
-
 jest predictive as-if-foss:
   extends:
     - .jest-base
@@ -434,12 +420,3 @@ compile-storybook:
     when: always
     paths:
       - storybook/public
-
-compile-storybook as-if-foss:
-  extends:
-    - .compile-storybook-base
-    - .as-if-foss
-    - .frontend:rules:default-frontend-jobs-as-if-foss
-  needs:
-    - job: "graphql-schema-dump as-if-foss"
-    - job: "rspec-all frontend_fixture as-if-foss"
diff --git a/.gitlab/ci/preflight.gitlab-ci.yml b/.gitlab/ci/preflight.gitlab-ci.yml
index cd1a9c753cb..9213ff4ca2b 100644
--- a/.gitlab/ci/preflight.gitlab-ci.yml
+++ b/.gitlab/ci/preflight.gitlab-ci.yml
@@ -85,9 +85,3 @@ qa:selectors:
     - .qa:rules:selectors
   script:
     - bundle exec bin/qa Test::Sanity::Selectors
-
-qa:selectors-as-if-foss:
-  extends:
-    - qa:selectors
-    - .qa:rules:selectors-as-if-foss
-    - .as-if-foss
diff --git a/.gitlab/ci/qa.gitlab-ci.yml b/.gitlab/ci/qa.gitlab-ci.yml
index 391e25956eb..7d0910f7ba5 100644
--- a/.gitlab/ci/qa.gitlab-ci.yml
+++ b/.gitlab/ci/qa.gitlab-ci.yml
@@ -48,12 +48,6 @@ qa:internal:
   script:
     - bundle exec rspec -O .rspec_internal
 
-qa:internal-as-if-foss:
-  extends:
-    - qa:internal
-    - .qa:rules:internal-as-if-foss
-    - .as-if-foss
-
 cache-qa-gems:
   extends:
     - .qa-job-base
diff --git a/.gitlab/ci/rails.gitlab-ci.yml b/.gitlab/ci/rails.gitlab-ci.yml
index e46e3d5b462..09ce8f8d0f9 100644
--- a/.gitlab/ci/rails.gitlab-ci.yml
+++ b/.gitlab/ci/rails.gitlab-ci.yml
@@ -358,6 +358,26 @@ rspec:artifact-collector unit:
     - job: rspec unit clickhouse  # 1 job
       optional: true
 
+rspec:artifact-collector as-if-foss:
+  extends:
+    - .artifact-collector
+    - .as-if-foss:rules:start-as-if-foss
+  needs:
+    # We need to wait for `start-as-if-foss` because cross project needs
+    # will not wait, and it'll simply look at the latest pipeline regardless
+    # status. This means we need to wait for the whole FOSS pipeline before
+    # trying to fetch the artifacts from there, ensuring they're available.
+    - job: start-as-if-foss
+    - project: gitlab-org/gitlab-foss
+      ref: as-if-foss/${CI_COMMIT_REF_NAME}
+      job: rspec:artifact-collector unit
+    - project: gitlab-org/gitlab-foss
+      ref: as-if-foss/${CI_COMMIT_REF_NAME}
+      job: rspec:artifact-collector system
+    - project: gitlab-org/gitlab-foss
+      ref: as-if-foss/${CI_COMMIT_REF_NAME}
+      job: rspec:artifact-collector remainder
+
 rspec:artifact-collector system:
   extends:
     - .artifact-collector
@@ -380,35 +400,6 @@ rspec:artifact-collector remainder:
     - !reference ['.rails:rules:ee-and-foss-migration', rules]
     - !reference ['.rails:rules:ee-and-foss-background-migration', rules]
 
-rspec:artifact-collector as-if-foss unit:
-  extends:
-    - .artifact-collector
-    - .rails:rules:as-if-foss-unit
-  needs:
-    - rspec unit pg14-as-if-foss  # 32 jobs
-
-rspec:artifact-collector as-if-foss system:
-  extends:
-    - .artifact-collector
-    - .rails:rules:as-if-foss-system
-  needs:
-    - rspec system pg14-as-if-foss  # 32 jobs
-
-rspec:artifact-collector as-if-foss remainder:
-  extends:
-    - .artifact-collector
-  needs:
-    - job: rspec integration pg14-as-if-foss  # 16 jobs
-      optional: true
-    - job: rspec migration pg14-as-if-foss  # 15 jobs
-      optional: true
-    - job: rspec background_migration pg14-as-if-foss  # 5 jobs
-      optional: true
-  rules:
-    - !reference ['.rails:rules:as-if-foss-integration', rules]
-    - !reference ['.rails:rules:as-if-foss-migration', rules]
-    - !reference ['.rails:rules:as-if-foss-background-migration', rules]
-
 rspec:artifact-collector unit single-redis:
   extends:
     - .artifact-collector
@@ -494,11 +485,7 @@ rspec:coverage:
     - job: rspec:artifact-collector remainder single-redis
       optional: true
     # as-if-foss jobs
-    - job: rspec:artifact-collector as-if-foss unit
-      optional: true
-    - job: rspec:artifact-collector as-if-foss system
-      optional: true
-    - job: rspec:artifact-collector as-if-foss remainder
+    - job: rspec:artifact-collector as-if-foss
       optional: true
     # EE jobs
     - job: rspec:artifact-collector ee single-redis
@@ -656,131 +643,6 @@ rspec-ee:predictive:trigger:
       - artifact: "${RSPEC_PREDICTIVE_PIPELINE_TEMPLATE_YML}-ee.yml"
         job: rspec-predictive:pipeline-generate
 
-rspec migration pg14-as-if-foss:
-  extends:
-    - .rspec-base-pg14-as-if-foss
-    - .rspec-base-migration
-    - .rspec-migration-parallel
-    - .rails:rules:as-if-foss-migration
-
-rspec background_migration pg14-as-if-foss:
-  extends:
-    - .rspec-base-pg14-as-if-foss
-    - .rspec-base-migration
-    - .rspec-background-migration-parallel
-    - .rails:rules:as-if-foss-background-migration
-
-rspec migration pg14-as-if-foss single-db:
-  extends:
-    - rspec migration pg14-as-if-foss
-    - .single-db-rspec
-    - .rspec-migration-parallel
-    - .rails:rules:single-db-as-if-foss
-
-rspec background_migration pg14-as-if-foss single-db:
-  extends:
-    - rspec background_migration pg14-as-if-foss
-    - .single-db-rspec
-    - .rails:rules:single-db-as-if-foss
-
-rspec migration pg14-as-if-foss single-db-ci-connection:
-  extends:
-    - rspec migration pg14-as-if-foss
-    - .single-db-ci-connection-rspec
-    - .rspec-migration-parallel
-    - .rails:rules:single-db-ci-connection-as-if-foss
-
-rspec background_migration pg14-as-if-foss single-db-ci-connection:
-  extends:
-    - rspec background_migration pg14-as-if-foss
-    - .single-db-ci-connection-rspec
-    - .rails:rules:single-db-ci-connection-as-if-foss
-
-rspec migration pg14-as-if-foss clusterwide-db:
-  extends:
-    - rspec migration pg14-as-if-foss
-    - .clusterwide-db
-    - .rspec-migration-parallel
-    - .rails:rules:clusterwide-db
-
-rspec background_migration pg14-as-if-foss clusterwide-db:
-  extends:
-    - rspec background_migration pg14-as-if-foss
-    - .clusterwide-db
-    - .rails:rules:clusterwide-db
-
-rspec unit pg14-as-if-foss:
-  extends:
-    - .rspec-base-pg14-as-if-foss
-    - .rails:rules:as-if-foss-unit
-    - .rspec-unit-parallel
-
-rspec unit pg14-as-if-foss single-db:
-  extends:
-    - rspec unit pg14-as-if-foss
-    - .single-db-rspec
-    - .rails:rules:single-db-as-if-foss
-
-rspec unit pg14-as-if-foss single-db-ci-connection:
-  extends:
-    - rspec unit pg14-as-if-foss
-    - .single-db-ci-connection-rspec
-    - .rails:rules:single-db-ci-connection-as-if-foss
-
-rspec unit pg14-as-if-foss clusterwide-db:
-  extends:
-    - rspec unit pg14-as-if-foss
-    - .clusterwide-db
-    - .rails:rules:clusterwide-db
-
-rspec integration pg14-as-if-foss:
-  extends:
-    - .rspec-base-pg14-as-if-foss
-    - .rails:rules:as-if-foss-integration
-    - .rspec-integration-parallel
-
-rspec integration pg14-as-if-foss single-db:
-  extends:
-    - rspec integration pg14-as-if-foss
-    - .single-db-rspec
-    - .rails:rules:single-db-as-if-foss
-
-rspec integration pg14-as-if-foss single-db-ci-connection:
-  extends:
-    - rspec integration pg14-as-if-foss
-    - .single-db-ci-connection-rspec
-    - .rails:rules:single-db-ci-connection-as-if-foss
-
-rspec integration pg14-as-if-foss clusterwide-db:
-  extends:
-    - rspec integration pg14-as-if-foss
-    - .clusterwide-db
-    - .rails:rules:clusterwide-db
-
-rspec system pg14-as-if-foss:
-  extends:
-    - .rspec-base-pg14-as-if-foss
-    - .rails:rules:as-if-foss-system
-    - .rspec-system-parallel
-
-rspec system pg14-as-if-foss single-db:
-  extends:
-    - rspec system pg14-as-if-foss
-    - .single-db-rspec
-    - .rails:rules:single-db-as-if-foss
-
-rspec system pg14-as-if-foss single-db-ci-connection:
-  extends:
-    - rspec system pg14-as-if-foss
-    - .single-db-ci-connection-rspec
-    - .rails:rules:single-db-ci-connection-as-if-foss
-
-rspec system pg14-as-if-foss clusterwide-db:
-  extends:
-    - rspec system pg14-as-if-foss
-    - .clusterwide-db
-    - .rails:rules:clusterwide-db
-
 .rspec-ee-base-gitlab-duo:
   extends:
     - .rspec-ee-base-pg14
diff --git a/.gitlab/ci/rules.gitlab-ci.yml b/.gitlab/ci/rules.gitlab-ci.yml
index 65b75c3e237..0e90594881b 100644
--- a/.gitlab/ci/rules.gitlab-ci.yml
+++ b/.gitlab/ci/rules.gitlab-ci.yml
@@ -38,6 +38,9 @@
 .if-merge-request: &if-merge-request
   if: '$CI_MERGE_REQUEST_EVENT_TYPE == "merged_result" || $CI_MERGE_REQUEST_EVENT_TYPE == "detached"'
 
+.if-not-merge-request: &if-not-merge-request
+  if: '$CI_MERGE_REQUEST_EVENT_TYPE == null'
+
 # Once https://gitlab.com/gitlab-org/gitlab/-/issues/373904 is implemented, we should be able to change this back to
 # if: '($CI_MERGE_REQUEST_EVENT_TYPE == "merged_result" || $CI_MERGE_REQUEST_EVENT_TYPE == "detached") && $CI_MERGE_REQUEST_APPROVALS_COUNT > 0'
 # or any similar condition to check that the MR has *any* approval (not just required approval).
@@ -68,9 +71,6 @@
 .if-merge-request-labels-as-if-foss: &if-merge-request-labels-as-if-foss
   if: '$CI_MERGE_REQUEST_LABELS =~ /pipeline:run-as-if-foss/'
 
-.if-merge-request-labels-as-if-foss-cross-project: &if-merge-request-labels-as-if-foss-cross-project
-  if: '$CI_MERGE_REQUEST_LABELS =~ /pipeline:run-as-if-foss-cross-project/'
-
 .if-merge-request-labels-as-if-jh: &if-merge-request-labels-as-if-jh
   if: '$CI_MERGE_REQUEST_LABELS =~ /pipeline:run-as-if-jh/'
 
@@ -1352,22 +1352,6 @@
     - <<: *if-merge-request
       changes: *code-backstage-patterns
 
-.frontend:rules:jest:as-if-foss:
-  rules:
-    - !reference [".strict-ee-only-rules", rules]
-    - <<: *if-merge-request-labels-as-if-foss
-    - <<: *if-merge-request-labels-pipeline-expedite
-      when: never
-    - <<: *if-merge-request-labels-run-all-jest
-    - <<: *if-merge-request
-      changes: *frontend-dependency-patterns
-    - <<: *if-security-merge-request
-      changes: *code-backstage-patterns
-    - <<: *if-merge-request-not-approved
-      when: never
-    - <<: *if-merge-request
-      changes: *frontend-patterns-for-as-if-foss
-
 .frontend:rules:jest:predictive:as-if-foss:
   rules:
     - !reference [".strict-ee-only-rules", rules]
@@ -1384,15 +1368,6 @@
     - <<: *if-merge-request
       changes: *frontend-patterns-for-as-if-foss
 
-.frontend:rules:eslint-as-if-foss:
-  rules:
-    - !reference [".strict-ee-only-rules", rules]
-    - <<: *if-merge-request-labels-as-if-foss
-    - <<: *if-merge-request-labels-pipeline-expedite
-      when: never
-    - <<: *if-merge-request
-      changes: *frontend-patterns-for-as-if-foss
-
 .frontend:rules:coverage-frontend:
   rules:
     - <<: *if-not-ee
@@ -1504,20 +1479,6 @@
     - <<: *if-default-refs
       changes: *code-qa-patterns
 
-.qa:rules:selectors-as-if-foss:
-  rules:
-    - !reference [".strict-ee-only-rules", rules]
-    - <<: *if-merge-request
-      changes: *frontend-qa-patterns
-    - <<: *if-merge-request-labels-as-if-foss
-    - <<: *if-merge-request-labels-run-all-rspec
-
-.qa:rules:internal-as-if-foss:
-  rules:
-    - !reference [".strict-ee-only-rules", rules]
-    - <<: *if-default-refs
-      changes: *qa-patterns
-
 .qa:rules:determine-e2e-tests:
   rules:
     - <<: *if-not-ee
@@ -1950,6 +1911,7 @@
     - <<: *if-merge-request-labels-run-single-db
     - <<: *if-merge-request-labels-pipeline-expedite
       when: never
+    - if: '$ENABLE_RSPEC_SINGLE_REDIS == "true"'
     - <<: *if-merge-request
       changes: *redis-patterns
     - <<: *if-default-branch-schedule-nightly
@@ -1965,6 +1927,7 @@
     - <<: *if-merge-request-labels-run-single-db
     - <<: *if-merge-request-labels-pipeline-expedite
       when: never
+    - if: '$ENABLE_RSPEC_SINGLE_DB == "true"'
     - <<: *if-merge-request
       changes: *db-patterns
     - <<: *if-merge-request
@@ -1977,11 +1940,6 @@
       when: never
     - !reference [".rails:rules:single-db", "rules"]
 
-.rails:rules:single-db-as-if-foss:
-  rules:
-    - !reference [".strict-ee-only-rules", rules]
-    - !reference [".rails:rules:single-db", "rules"]
-
 .rails:rules:db:check-migrations-single-db:
   rules:
     - <<: *if-merge-request-labels-run-single-db
@@ -1997,6 +1955,7 @@
     - <<: *if-merge-request-labels-run-single-db
     - <<: *if-merge-request-labels-pipeline-expedite
       when: never
+    - if: '$ENABLE_RSPEC_SINGLE_DB_CI_CONNECTION == "true"'
     - <<: *if-merge-request
       changes: *db-patterns
     - <<: *if-merge-request
@@ -2009,11 +1968,6 @@
       when: never
     - !reference [".rails:rules:single-db-ci-connection", "rules"]
 
-.rails:rules:single-db-ci-connection-as-if-foss:
-  rules:
-    - !reference [".strict-ee-only-rules", rules]
-    - !reference [".rails:rules:single-db-ci-connection", "rules"]
-
 .rails:rules:db:check-migrations-single-db-ci-connection:
   rules:
     - <<: *if-merge-request-labels-run-single-db
@@ -2047,6 +2001,8 @@
 
 .rails:rules:praefect-with-db:
   rules:
+    - if: '$ENABLE_RSPEC_PRAEFECT == "true"'
+      allow_failure: true
     - if: '$CI_MERGE_REQUEST_LABELS =~ /pipeline:run-praefect-with-db/'
       allow_failure: true
 
@@ -2264,64 +2220,6 @@
       when: manual
       allow_failure: true
 
-.rails:rules:as-if-foss-migration:
-  rules:
-    - !reference [".strict-ee-only-rules", rules]
-    - <<: *if-merge-request-labels-pipeline-expedite
-      when: never
-    - <<: *if-merge-request-labels-run-all-rspec
-    - <<: *if-merge-request
-      changes: *core-backend-patterns
-    # When DB schema changes, many migrations spec may be affected. However, the test mapping from Crystalball does not map db change to a specific migration spec well.
-    # See https://gitlab.com/gitlab-org/gitlab/-/merge_requests/68840.
-    - <<: *if-merge-request-labels-as-if-foss
-      changes: *db-patterns
-    - <<: *if-automated-merge-request
-      changes: *db-patterns
-    - <<: *if-security-merge-request
-      changes: *db-patterns
-    - <<: *if-merge-request-not-approved
-      when: never
-
-.rails:rules:as-if-foss-background-migration:
-  rules:
-    - !reference [".rails:rules:as-if-foss-migration", rules]
-    - <<: *if-merge-request-labels-as-if-foss
-      changes: *backend-patterns
-
-.rails:rules:as-if-foss-unit:
-  rules:
-    - !reference [".strict-ee-only-rules", rules]
-    - <<: *if-fork-merge-request
-      when: never
-    - <<: *if-merge-request-labels-pipeline-expedite
-      when: never
-    - !reference [".rails:rules:ee-and-foss-default-rules", rules]
-    - <<: *if-merge-request-labels-as-if-foss
-      changes: *backend-patterns
-
-.rails:rules:as-if-foss-integration:
-  rules:
-    - !reference [".strict-ee-only-rules", rules]
-    - <<: *if-fork-merge-request
-      when: never
-    - <<: *if-merge-request-labels-pipeline-expedite
-      when: never
-    - !reference [".rails:rules:ee-and-foss-default-rules", rules]
-    - <<: *if-merge-request-labels-as-if-foss
-      changes: *backend-patterns
-
-.rails:rules:as-if-foss-system:
-  rules:
-    - !reference [".strict-ee-only-rules", rules]
-    - <<: *if-fork-merge-request
-      when: never
-    - <<: *if-merge-request-labels-pipeline-expedite
-      when: never
-    - !reference [".rails:rules:system-default-rules", rules]
-    - <<: *if-merge-request-labels-as-if-foss
-      changes: *code-backstage-patterns
-
 .rails:rules:ee-and-foss-db-library-code:
   rules:
     - <<: *if-merge-request-labels-pipeline-expedite
@@ -2520,18 +2418,6 @@
     - <<: *if-default-refs
       changes: *code-backstage-qa-patterns
 
-.static-analysis:rules:static-analysis-as-if-foss:
-  rules:
-    - !reference [".strict-ee-only-rules", rules]
-    - <<: *if-merge-request-labels-as-if-foss
-      changes: *code-backstage-qa-patterns
-    - <<: *if-security-merge-request
-      changes: *code-backstage-qa-patterns
-    - <<: *if-merge-request
-      changes: [".gitlab/ci/static-analysis.gitlab-ci.yml"]
-    - <<: *if-merge-request
-      changes: *static-analysis-patterns
-
 .static-analysis:rules:trigger-depsaster:
   rules:
     - if: "$ENABLE_DEPSASTER != 'true'"
@@ -3018,28 +2904,249 @@
 ####################
 # as-if-foss rules #
 ####################
+
+# This is a very big rules set because it's the union of all as-if-foss jobs.
+# We want to start this for any FOSS jobs we want to run. For example:
+# (This is not an exhaustive list and can be outdated!)
+# .build-images:rules:build-qa-image-merge-requests
+# .build-images:rules:build-assets-image
+# .frontend:rules:compile-production-assets
+# .frontend:rules:default-frontend-jobs-as-if-foss
+# .rails:rules:single-db
+# .rails:rules:single-db-ci-connection
+# .rails:rules:single-redis
+# .rails:rules:ee-and-foss-default-rules
+# .rails:rules:system-default-rules
 .as-if-foss:rules:start-as-if-foss:
   rules:
     - if: '$AS_IF_FOSS_TOKEN == null'
       when: never
+    - <<: *if-not-merge-request  # This is only designed to run in a merge request
+      when: never
     - !reference [".strict-ee-only-rules", rules]
-    - <<: *if-merge-request-labels-as-if-foss-cross-project
+    - <<: *if-merge-request-labels-as-if-foss
+    - <<: *if-merge-request-labels-run-all-rspec
+    - <<: *if-merge-request-labels-run-all-jest
+    - <<: *if-merge-request-labels-run-clusterwide-db
+    - <<: *if-merge-request-labels-run-single-db
+    - <<: *if-merge-request-labels-run-review-app
+    - <<: *if-merge-request-labels-run-all-e2e
+    - <<: *if-merge-request-labels-pipeline-expedite
+      when: never
+    - <<: *if-merge-request-not-approved
+      when: never
+    - <<: *if-merge-request-labels-frontend-and-feature-flag
+    - <<: *if-merge-request
+      changes: *code-backstage-qa-patterns
+    - <<: *if-merge-request
+      changes: *nodejs-patterns
+    - <<: *if-merge-request
+      changes: *static-analysis-patterns
+    - <<: *if-merge-request
+      changes: *db-patterns
+    - <<: *if-merge-request
+      changes: *workhorse-patterns
+    - <<: *if-merge-request
+      changes: *decomposed-db-models-patterns
+    - <<: *if-merge-request
+      changes: *redis-patterns
+    - <<: *if-merge-request
+      changes: *feature-flag-development-config-patterns
+    - <<: *if-merge-request-targeting-stable-branch
+      changes: *setup-test-env-patterns
+    - <<: *if-automated-merge-request
+      changes: *db-patterns
+    - <<: *if-automated-merge-request
+      changes: *backend-patterns
+    - <<: *if-automated-merge-request
+      changes: *code-backstage-patterns
+    - <<: *if-security-merge-request
+      changes: *backend-patterns
+    - <<: *if-security-merge-request
+      changes: *code-backstage-qa-patterns
+    - <<: *if-security-merge-request
+      changes: *db-patterns
+    - <<: *if-dot-com-gitlab-org-and-security-merge-request-manual-ff-package-and-e2e
+      changes: *feature-flag-development-config-patterns
 
 .as-if-foss:rules:start-as-if-foss:allow-failure:manual:
   rules:
     - if: '$AS_IF_FOSS_TOKEN == null'
       when: never
+    - <<: *if-not-merge-request
+      when: never
     - !reference [".strict-ee-only-rules", rules]
-    - <<: *if-merge-request-labels-as-if-foss-cross-project
-      when: manual
+    # Copy everything from .as-if-foss:rules:start-as-if-foss
+    # and add `allow_failure: true` and `when: manual` to all
+    - <<: *if-merge-request-labels-as-if-foss
       allow_failure: true
+      when: manual
+    - <<: *if-merge-request-labels-run-all-rspec
+      allow_failure: true
+      when: manual
+    - <<: *if-merge-request-labels-run-all-jest
+      allow_failure: true
+      when: manual
+    - <<: *if-merge-request-labels-run-clusterwide-db
+      allow_failure: true
+      when: manual
+    - <<: *if-merge-request-labels-run-single-db
+      allow_failure: true
+      when: manual
+    - <<: *if-merge-request-labels-run-review-app
+      allow_failure: true
+      when: manual
+    - <<: *if-merge-request-labels-run-all-e2e
+      allow_failure: true
+      when: manual
+    - <<: *if-merge-request-labels-pipeline-expedite
+      when: never
+    - <<: *if-merge-request-not-approved
+      when: never
+    - <<: *if-merge-request-labels-frontend-and-feature-flag
+      allow_failure: true
+      when: manual
+    - <<: *if-merge-request
+      changes: *code-backstage-qa-patterns
+      allow_failure: true
+      when: manual
+    - <<: *if-merge-request
+      changes: *nodejs-patterns
+      allow_failure: true
+      when: manual
+    - <<: *if-merge-request
+      changes: *static-analysis-patterns
+      allow_failure: true
+      when: manual
+    - <<: *if-merge-request
+      changes: *db-patterns
+      allow_failure: true
+      when: manual
+    - <<: *if-merge-request
+      changes: *workhorse-patterns
+      allow_failure: true
+      when: manual
+    - <<: *if-merge-request
+      changes: *decomposed-db-models-patterns
+      allow_failure: true
+      when: manual
+    - <<: *if-merge-request
+      changes: *redis-patterns
+      allow_failure: true
+      when: manual
+    - <<: *if-merge-request
+      changes: *feature-flag-development-config-patterns
+      allow_failure: true
+      when: manual
+    - <<: *if-merge-request-targeting-stable-branch
+      changes: *setup-test-env-patterns
+      allow_failure: true
+      when: manual
+    - <<: *if-automated-merge-request
+      changes: *db-patterns
+      allow_failure: true
+      when: manual
+    - <<: *if-automated-merge-request
+      changes: *backend-patterns
+      allow_failure: true
+      when: manual
+    - <<: *if-automated-merge-request
+      changes: *code-backstage-patterns
+      allow_failure: true
+      when: manual
+    - <<: *if-security-merge-request
+      changes: *backend-patterns
+      allow_failure: true
+      when: manual
+    - <<: *if-security-merge-request
+      changes: *code-backstage-qa-patterns
+      allow_failure: true
+      when: manual
+    - <<: *if-security-merge-request
+      changes: *db-patterns
+      allow_failure: true
+      when: manual
+    - <<: *if-dot-com-gitlab-org-and-security-merge-request-manual-ff-package-and-e2e
+      changes: *feature-flag-development-config-patterns
+      allow_failure: true
+      when: manual
 
 .as-if-foss:rules:start-as-if-foss:allow-failure:
   rules:
     - if: '$AS_IF_FOSS_TOKEN == null'
       when: never
+    - <<: *if-not-merge-request
+      when: never
     - !reference [".strict-ee-only-rules", rules]
-    - <<: *if-merge-request-labels-as-if-foss-cross-project
+    # Copy everything from .as-if-foss:rules:start-as-if-foss
+    # and add `allow_failure: true` to all
+    - <<: *if-merge-request-labels-as-if-foss
+      allow_failure: true
+    - <<: *if-merge-request-labels-run-all-rspec
+      allow_failure: true
+    - <<: *if-merge-request-labels-run-all-jest
+      allow_failure: true
+    - <<: *if-merge-request-labels-run-clusterwide-db
+      allow_failure: true
+    - <<: *if-merge-request-labels-run-single-db
+      allow_failure: true
+    - <<: *if-merge-request-labels-run-review-app
+      allow_failure: true
+    - <<: *if-merge-request-labels-run-all-e2e
+      allow_failure: true
+    - <<: *if-merge-request-labels-pipeline-expedite
+      when: never
+    - <<: *if-merge-request-not-approved
+      when: never
+    - <<: *if-merge-request-labels-frontend-and-feature-flag
+      allow_failure: true
+    - <<: *if-merge-request
+      changes: *code-backstage-qa-patterns
+      allow_failure: true
+    - <<: *if-merge-request
+      changes: *nodejs-patterns
+      allow_failure: true
+    - <<: *if-merge-request
+      changes: *static-analysis-patterns
+      allow_failure: true
+    - <<: *if-merge-request
+      changes: *db-patterns
+      allow_failure: true
+    - <<: *if-merge-request
+      changes: *workhorse-patterns
+      allow_failure: true
+    - <<: *if-merge-request
+      changes: *decomposed-db-models-patterns
+      allow_failure: true
+    - <<: *if-merge-request
+      changes: *redis-patterns
+      allow_failure: true
+    - <<: *if-merge-request
+      changes: *feature-flag-development-config-patterns
+      allow_failure: true
+    - <<: *if-merge-request-targeting-stable-branch
+      changes: *setup-test-env-patterns
+      allow_failure: true
+    - <<: *if-automated-merge-request
+      changes: *db-patterns
+      allow_failure: true
+    - <<: *if-automated-merge-request
+      changes: *backend-patterns
+      allow_failure: true
+    - <<: *if-automated-merge-request
+      changes: *code-backstage-patterns
+      allow_failure: true
+    - <<: *if-security-merge-request
+      changes: *backend-patterns
+      allow_failure: true
+    - <<: *if-security-merge-request
+      changes: *code-backstage-qa-patterns
+      allow_failure: true
+    - <<: *if-security-merge-request
+      changes: *db-patterns
+      allow_failure: true
+    - <<: *if-dot-com-gitlab-org-and-security-merge-request-manual-ff-package-and-e2e
+      changes: *feature-flag-development-config-patterns
       allow_failure: true
 
 ##################
diff --git a/.gitlab/ci/static-analysis.gitlab-ci.yml b/.gitlab/ci/static-analysis.gitlab-ci.yml
index 997dfde4271..cce0beaa5cd 100644
--- a/.gitlab/ci/static-analysis.gitlab-ci.yml
+++ b/.gitlab/ci/static-analysis.gitlab-ci.yml
@@ -34,12 +34,6 @@ static-analysis:
     - yarn_install_script
     - fail_on_warnings scripts/static-analysis
 
-static-analysis as-if-foss:
-  extends:
-    - static-analysis
-    - .static-analysis:rules:static-analysis-as-if-foss
-    - .as-if-foss
-
 static-verification-with-database:
   extends:
     - .static-analysis-base
@@ -69,13 +63,6 @@ generate-apollo-graphql-schema:
     paths:
       - "${GRAPHQL_SCHEMA_APOLLO_FILE}"
 
-generate-apollo-graphql-schema as-if-foss:
-  extends:
-    - generate-apollo-graphql-schema
-    - .frontend:rules:eslint-as-if-foss
-    - .as-if-foss
-  needs: ['graphql-schema-dump as-if-foss']
-
 eslint:
   extends:
     - .static-analysis-base
@@ -88,13 +75,6 @@ eslint:
     - yarn_install_script
     - run_timed_command "yarn run lint:eslint:all"
 
-eslint as-if-foss:
-  extends:
-    - eslint
-    - .frontend:rules:eslint-as-if-foss
-    - .as-if-foss
-  needs: ['generate-apollo-graphql-schema as-if-foss']
-
 haml-lint:
   extends:
     - .static-analysis-base
diff --git a/.rubocop_todo/layout/argument_alignment.yml b/.rubocop_todo/layout/argument_alignment.yml
index 25e222a65dc..a60b91c69d5 100644
--- a/.rubocop_todo/layout/argument_alignment.yml
+++ b/.rubocop_todo/layout/argument_alignment.yml
@@ -819,10 +819,6 @@ Layout/ArgumentAlignment:
     - 'ee/db/geo/migrate/20180405074130_add_partial_index_project_repository_verification.rb'
     - 'ee/db/geo/post_migrate/20210217020154_add_unique_index_on_container_repository_registry.rb'
     - 'ee/db/geo/post_migrate/20210217020156_add_unique_index_on_terraform_state_version_registry.rb'
-    - 'ee/lib/audit/compliance_framework_changes_auditor.rb'
-    - 'ee/lib/audit/external_status_check_changes_auditor.rb'
-    - 'ee/lib/audit/group_changes_auditor.rb'
-    - 'ee/lib/audit/project_changes_auditor.rb'
     - 'ee/lib/ee/gitlab/background_migration/backfill_epic_cache_counts.rb'
     - 'ee/lib/ee/gitlab/background_migration/backfill_project_statistics_container_repository_size.rb'
     - 'ee/lib/ee/gitlab/background_migration/backfill_project_statistics_storage_size_without_uploads_size.rb'
@@ -855,9 +851,6 @@ Layout/ArgumentAlignment:
     - 'ee/spec/lib/api/entities/protected_environments/approval_rule_for_summary_spec.rb'
     - 'ee/spec/lib/api/entities/protected_environments/approval_rule_spec.rb'
     - 'ee/spec/lib/api/entities/protected_environments/deploy_access_level_spec.rb'
-    - 'ee/spec/lib/audit/external_status_check_changes_auditor_spec.rb'
-    - 'ee/spec/lib/audit/group_merge_request_approval_setting_changes_auditor_spec.rb'
-    - 'ee/spec/lib/audit/protected_branches_changes_auditor_spec.rb'
     - 'ee/spec/lib/ee/api/entities/analytics/code_review/merge_request_spec.rb'
     - 'ee/spec/lib/ee/api/entities/geo_node_status_spec.rb'
     - 'ee/spec/lib/ee/gitlab/analytics/cycle_analytics/aggregated/base_query_builder_spec.rb'
diff --git a/Gemfile b/Gemfile
index d4d74a2c81a..84aee6fb99f 100644
--- a/Gemfile
+++ b/Gemfile
@@ -198,6 +198,7 @@ gem 'google-apis-androidpublisher_v3', '~> 0.34.0' # rubocop:todo Gemfile/Missin
 
 gem 'googleauth', '~> 1.8.1', feature_category: :shared
 gem 'google-cloud-artifact_registry-v1', '~> 0.11.0', feature_category: :shared
+gem 'google-cloud-compute-v1', '~> 2.6.0', feature_category: :shared
 
 # Seed data
 gem 'seed-fu', '~> 2.3.7' # rubocop:todo Gemfile/MissingFeatureCategory
@@ -276,7 +277,7 @@ gem 're2', '2.7.0' # rubocop:todo Gemfile/MissingFeatureCategory
 
 # Misc
 
-gem 'semver_dialects', '~> 1.6', feature_category: :static_application_security_testing
+gem 'semver_dialects', '~> 1.6.1', feature_category: :static_application_security_testing
 gem 'version_sorter', '~> 2.3' # rubocop:todo Gemfile/MissingFeatureCategory
 gem 'csv_builder', path: 'gems/csv_builder' # rubocop:todo Gemfile/MissingFeatureCategory
 
@@ -556,7 +557,7 @@ gem 'ssh_data', '~> 1.3' # rubocop:todo Gemfile/MissingFeatureCategory
 gem 'spamcheck', '~> 1.3.0' # rubocop:todo Gemfile/MissingFeatureCategory
 
 # Gitaly GRPC protocol definitions
-gem 'gitaly', '~> 16.8', feature_category: :gitaly
+gem 'gitaly', '~> 16.9.0-rc2', feature_category: :gitaly
 
 # KAS GRPC protocol definitions
 gem 'kas-grpc', '~> 0.3.0', feature_category: :deployment_management
diff --git a/Gemfile.checksum b/Gemfile.checksum
index e38a2d1647b..6c0a4d1bab8 100644
--- a/Gemfile.checksum
+++ b/Gemfile.checksum
@@ -207,7 +207,7 @@
 {"name":"gettext","version":"3.4.9","platform":"ruby","checksum":"292864fe6a15c224cee4125a4a72fab426fdbb280e4cff3cfe44935f549b009a"},
 {"name":"gettext_i18n_rails","version":"1.11.0","platform":"ruby","checksum":"e19c7e4a256c500f7f38396dca44a282b9838ae278f57c362993a54964b22bbe"},
 {"name":"git","version":"1.18.0","platform":"ruby","checksum":"c9b80462e4565cd3d7a9ba8440c41d2c52244b17b0dad0bfddb46de70630c465"},
-{"name":"gitaly","version":"16.9.0.pre.rc1","platform":"ruby","checksum":"10b6afe853d00a74198434fcbd9dd803e6ad6e0a9dc1b2aded1955bcbeb85eb5"},
+{"name":"gitaly","version":"16.9.0.pre.rc2","platform":"ruby","checksum":"6b2066f8df33ddeef9daeb02f0d749d64c6f2e970c8ba3fa14daf520799c9e32"},
 {"name":"gitlab","version":"4.19.0","platform":"ruby","checksum":"3f645e3e195dbc24f0834fbf83e8ccfb2056d8e9712b01a640aad418a6949679"},
 {"name":"gitlab-chronic","version":"0.10.5","platform":"ruby","checksum":"f80f18dc699b708870a80685243331290bc10cfeedb6b99c92219722f729c875"},
 {"name":"gitlab-dangerfiles","version":"4.6.0","platform":"ruby","checksum":"441b37b17d1dad36268517490a30aaf57e43dffb2e9ebc1da38d3bc9fa20741e"},
@@ -246,6 +246,8 @@
 {"name":"google-apis-sqladmin_v1beta4","version":"0.41.0","platform":"ruby","checksum":"551553b6481879f1cd39fb83cc2a2c2ea9334afc4bf261b96900dd559f96749d"},
 {"name":"google-apis-storage_v1","version":"0.29.0","platform":"ruby","checksum":"9dab410ab4671ed8ebf736d7eb4f4641fa072ad32a23d34c252c10d71f1683cc"},
 {"name":"google-cloud-artifact_registry-v1","version":"0.11.0","platform":"ruby","checksum":"ba80d2dce9767e663931ded7929b7f8bf5983a6e2ea68078e27e7ca9a940783e"},
+{"name":"google-cloud-common","version":"1.1.0","platform":"ruby","checksum":"738db08fd144b4fe37b4578ffd63308b64a86fd59f6979d240048f917a6fb5fb"},
+{"name":"google-cloud-compute-v1","version":"2.6.0","platform":"ruby","checksum":"b96059b33ffc2f25644d20161a0c1aa1331197073c2e44786b18f8b670f1141e"},
 {"name":"google-cloud-core","version":"1.6.0","platform":"ruby","checksum":"ea1744cd5a3085d3072de3fab9106afc769cd198609ebb5c6eeb5f13da46b72a"},
 {"name":"google-cloud-env","version":"1.6.0","platform":"ruby","checksum":"6179acb946975892c7908748df5722a4ebadfc8cf5bb7b0d8d933ca67183fa15"},
 {"name":"google-cloud-errors","version":"1.3.0","platform":"ruby","checksum":"450b681e24c089a20721a01acc4408bb4a7b0df28c175aaab488da917480d64b"},
@@ -591,7 +593,7 @@
 {"name":"sd_notify","version":"0.1.1","platform":"ruby","checksum":"cbc7ac6caa7cedd26b30a72b5eeb6f36050dc0752df263452ea24fb5a4ad3131"},
 {"name":"seed-fu","version":"2.3.7","platform":"ruby","checksum":"f19673443e9af799b730e3d4eca6a89b39e5a36825015dffd00d02ea3365cf74"},
 {"name":"selenium-webdriver","version":"4.17.0","platform":"ruby","checksum":"d876814216cf4d731e0fad07060e184cefc120c9e0de2a8e0bbca4b96d1c743c"},
-{"name":"semver_dialects","version":"1.6.0","platform":"ruby","checksum":"0d2af91eac2262c5365a182bd516bf1e2a94ba0954c64d58d85570e8166c0641"},
+{"name":"semver_dialects","version":"1.6.1","platform":"ruby","checksum":"6e5f592d8958480ea9dab80cbbbef0eea1032d373968a15b07786eae3f5e558e"},
 {"name":"sentry-rails","version":"5.10.0","platform":"ruby","checksum":"99aa2fac136c26942eb1897c65de65dac88ad43ac5eb183ff20711287a137ebd"},
 {"name":"sentry-raven","version":"3.1.2","platform":"ruby","checksum":"103d3b122958810d34898ce2e705bcf549ddb9d855a70ce9a3970ee2484f364a"},
 {"name":"sentry-ruby","version":"5.10.0","platform":"ruby","checksum":"115c24c0aee1309210f3a2988fb118e2bec1f11609feeda90e694388b1183619"},
diff --git a/Gemfile.lock b/Gemfile.lock
index 63bef853606..e16c2e3bcc8 100644
--- a/Gemfile.lock
+++ b/Gemfile.lock
@@ -676,7 +676,7 @@ GEM
     git (1.18.0)
       addressable (~> 2.8)
       rchardet (~> 1.8)
-    gitaly (16.9.0.pre.rc1)
+    gitaly (16.9.0.pre.rc2)
       grpc (~> 1.0)
     gitlab (4.19.0)
       httparty (~> 0.20)
@@ -792,6 +792,13 @@ GEM
       google-cloud-errors (~> 1.0)
       google-cloud-location (>= 0.4, < 2.a)
       grpc-google-iam-v1 (~> 1.1)
+    google-cloud-common (1.1.0)
+      google-protobuf (~> 3.14)
+      googleapis-common-protos-types (~> 1.2)
+    google-cloud-compute-v1 (2.6.0)
+      gapic-common (>= 0.20.0, < 2.a)
+      google-cloud-common (~> 1.0)
+      google-cloud-errors (~> 1.0)
     google-cloud-core (1.6.0)
       google-cloud-env (~> 1.0)
       google-cloud-errors (~> 1.0)
@@ -1543,7 +1550,7 @@ GEM
       rexml (~> 3.2, >= 3.2.5)
       rubyzip (>= 1.2.2, < 3.0)
       websocket (~> 1.0)
-    semver_dialects (1.6.0)
+    semver_dialects (1.6.1)
       deb_version (~> 1.0.1)
       pastel (~> 0.8.0)
       thor (~> 1.3)
@@ -1897,7 +1904,7 @@ DEPENDENCIES
   fuubar (~> 2.2.0)
   gettext (~> 3.3)
   gettext_i18n_rails (~> 1.11.0)
-  gitaly (~> 16.8)
+  gitaly (~> 16.9.0.pre.rc2)
   gitlab-backup-cli!
   gitlab-chronic (~> 0.10.5)
   gitlab-dangerfiles (~> 4.6.0)
@@ -1936,6 +1943,7 @@ DEPENDENCIES
   google-apis-sqladmin_v1beta4 (~> 0.41.0)
   google-apis-storage_v1 (~> 0.29)
   google-cloud-artifact_registry-v1 (~> 0.11.0)
+  google-cloud-compute-v1 (~> 2.6.0)
   google-cloud-storage (~> 1.45.0)
   google-protobuf (~> 3.25, >= 3.25.1)
   googleauth (~> 1.8.1)
@@ -2087,7 +2095,7 @@ DEPENDENCIES
   sd_notify (~> 0.1.0)
   seed-fu (~> 2.3.7)
   selenium-webdriver (~> 4.17)
-  semver_dialects (~> 1.6)
+  semver_dialects (~> 1.6.1)
   sentry-rails (~> 5.10.0)
   sentry-raven (~> 3.1)
   sentry-ruby (~> 5.10.0)
diff --git a/app/assets/javascripts/blob/components/blob_content.vue b/app/assets/javascripts/blob/components/blob_content.vue
index 5592a75a4d2..d757ff4a706 100644
--- a/app/assets/javascripts/blob/components/blob_content.vue
+++ b/app/assets/javascripts/blob/components/blob_content.vue
@@ -21,11 +21,26 @@ export default {
       required: false,
       default: () => ({}),
     },
+    projectPath: {
+      type: String,
+      required: false,
+      default: '',
+    },
+    currentRef: {
+      type: String,
+      required: false,
+      default: '',
+    },
     content: {
       type: String,
       default: '',
       required: false,
     },
+    showBlame: {
+      type: Boolean,
+      required: false,
+      default: false,
+    },
     isRawContent: {
       type: Boolean,
       default: false,
@@ -45,6 +60,11 @@ export default {
       type: Object,
       required: true,
     },
+    isBlameLinkHidden: {
+      type: Boolean,
+      required: false,
+      default: false,
+    },
     hideLineNumbers: {
       type: Boolean,
       required: false,
@@ -66,6 +86,14 @@ export default {
     viewerError() {
       return this.activeViewer.renderError;
     },
+    lineNumbers() {
+      // rawTextBlob is used for source code files and content for snippets
+      return (
+        (this?.blob?.rawTextBlob?.split('\n')?.length || 1) - 1 ||
+        this?.content?.split('\n')?.length ||
+        0
+      );
+    },
     isContentLoaded() {
       return this.activeViewer.type === RICH_BLOB_VIEWER
         ? !this.loading && this.richContentLoaded
@@ -93,10 +121,17 @@ export default {
         v-else
         ref="contentViewer"
         :content="content"
+        :current-ref="currentRef"
+        :project-path="projectPath"
+        :blob-path="blob.path || ''"
         :rich-viewer="richViewer"
         :is-raw-content="isRawContent"
+        :show-blame="showBlame"
         :file-name="blob.name"
+        :blame-path="blob.blamePath"
         :type="activeViewer.fileType"
+        :line-numbers="lineNumbers"
+        :is-blame-link-hidden="isBlameLinkHidden"
         :hide-line-numbers="hideLineNumbers"
         data-testid="blob-viewer-file-content"
         @richContentLoaded="richContentLoaded = true"
diff --git a/app/assets/javascripts/editor/schema/ci.json b/app/assets/javascripts/editor/schema/ci.json
index 1da224c2174..a2a02d2fc90 100644
--- a/app/assets/javascripts/editor/schema/ci.json
+++ b/app/assets/javascripts/editor/schema/ci.json
@@ -61,6 +61,9 @@
         "id_tokens": {
           "$ref": "#/definitions/id_tokens"
         },
+        "identity_provider": {
+          "$ref": "#/definitions/identity_provider"
+        },
         "retry": {
           "$ref": "#/definitions/retry"
         },
@@ -703,6 +706,13 @@
         }
       }
     },
+    "identity_provider": {
+      "type": "string",
+      "markdownDescription": "Sets an identity provider (experimental), allowing automatic authentication with the external provider. [Learn More](https://docs.gitlab.com/ee/ci/yaml/#identity_provider).",
+      "enum": [
+        "google_cloud"
+      ]
+    },
     "secrets": {
       "type": "object",
       "markdownDescription": "Defines secrets to be injected as environment variables. [Learn More](https://docs.gitlab.com/ee/ci/yaml/#secrets).",
@@ -1632,6 +1642,9 @@
         "id_tokens": {
           "$ref": "#/definitions/id_tokens"
         },
+        "identity_provider": {
+          "$ref": "#/definitions/identity_provider"
+        },
         "secrets": {
           "$ref": "#/definitions/secrets"
         },
diff --git a/app/assets/javascripts/notes/components/mr_discussion_filter.vue b/app/assets/javascripts/notes/components/mr_discussion_filter.vue
index c2ac95ca56e..4d78a888be7 100644
--- a/app/assets/javascripts/notes/components/mr_discussion_filter.vue
+++ b/app/assets/javascripts/notes/components/mr_discussion_filter.vue
@@ -85,7 +85,7 @@ export default {
     />
     <local-storage-sync
       :value="mergeRequestFilters"
-      storage-key="mr_activity_filters"
+      storage-key="mr_activity_filters_2"
       @input="localSyncFilters"
     />
     <gl-button-group>
diff --git a/app/assets/javascripts/notes/constants.js b/app/assets/javascripts/notes/constants.js
index 999ef8ff905..464c1cd181e 100644
--- a/app/assets/javascripts/notes/constants.js
+++ b/app/assets/javascripts/notes/constants.js
@@ -76,6 +76,11 @@ export const MR_FILTER_OPTIONS = [
       s__('IssuableEvents|unassigned'),
     ],
   },
+  {
+    text: __('Bot comments'),
+    value: 'bot_comments',
+    bot: true,
+  },
   {
     text: __('Comments'),
     value: 'comments',
diff --git a/app/assets/javascripts/notes/stores/getters.js b/app/assets/javascripts/notes/stores/getters.js
index 62d991c2d9e..56bbb44df53 100644
--- a/app/assets/javascripts/notes/stores/getters.js
+++ b/app/assets/javascripts/notes/stores/getters.js
@@ -33,13 +33,15 @@ const hideActivity = (filters, discussion) => {
       // the first in a discussion or a single note
       // If the filter option filters based on icon check against the first notes system note icon
       f.systemNoteIcons?.includes(firstNote.system_note_icon_name) ||
-      // If the filter option filters based on note type user the first notes type
-      f.noteType?.includes(firstNote.type) ||
+      // If the filter option filters based on note type use the first notes type
+      (f.noteType?.includes(firstNote.type) && !firstNote.author.bot) ||
       // If the filter option filters based on the note text then check if it is sytem
       // and filter based on the text of the system note
       (firstNote.system && f.noteText?.some((t) => firstNote.note.includes(t))) ||
       // For individual notes we filter if the discussion is a single note and is not a sytem
-      (f.individualNote === discussion.individual_note && !firstNote.system)
+      (f.individualNote === discussion.individual_note && !firstNote.system) ||
+      // For bot comments we filter on the authors `bot` boolean attribute
+      (f.bot && firstNote.author.bot)
     ) {
       return true;
     }
diff --git a/app/assets/javascripts/repository/components/blob_content_viewer.vue b/app/assets/javascripts/repository/components/blob_content_viewer.vue
index 8033b5f1225..24de4661466 100644
--- a/app/assets/javascripts/repository/components/blob_content_viewer.vue
+++ b/app/assets/javascripts/repository/components/blob_content_viewer.vue
@@ -195,10 +195,6 @@ export default {
     isUsingLfs() {
       return this.blobInfo.storedExternally && this.blobInfo.externalStorage === LFS_STORAGE;
     },
-    isBlameEnabled() {
-      // Blame information within the blob viewer is not yet supported in our fallback (HAML) viewers
-      return !this.useFallback;
-    },
   },
   watch: {
     // Watch the URL 'plain' query value to know if the viewer needs changing.
@@ -318,7 +314,7 @@ export default {
         :show-path="false"
         :override-copy="true"
         :show-fork-suggestion="showForkSuggestion"
-        :show-blame-toggle="isBlameEnabled"
+        :show-blame-toggle="true"
         :project-path="projectPath"
         :project-id="projectId"
         @viewer-changed="handleViewerChanged"
@@ -359,8 +355,10 @@ export default {
         :content="legacySimpleViewer"
         :is-raw-content="true"
         :active-viewer="viewer"
-        :hide-line-numbers="true"
+        :show-blame="showBlame"
+        :current-ref="currentRef"
         :loading="isLoadingLegacyViewer"
+        :project-path="projectPath"
         :data-loading="isRenderingLegacyTextViewer"
       />
       <component
diff --git a/app/assets/javascripts/snippets/components/snippet_blob_view.vue b/app/assets/javascripts/snippets/components/snippet_blob_view.vue
index 360ffdd34e0..c4924088c6e 100644
--- a/app/assets/javascripts/snippets/components/snippet_blob_view.vue
+++ b/app/assets/javascripts/snippets/components/snippet_blob_view.vue
@@ -100,6 +100,7 @@ export default {
       @viewer-changed="switchViewer"
     />
     <blob-content
+      is-blame-link-hidden
       :loading="isContentLoading"
       :content="blobContent"
       :active-viewer="viewer"
diff --git a/app/assets/javascripts/vue_shared/components/blob_viewers/constants.js b/app/assets/javascripts/vue_shared/components/blob_viewers/constants.js
index 957e642fcb8..02b40605afe 100644
--- a/app/assets/javascripts/vue_shared/components/blob_viewers/constants.js
+++ b/app/assets/javascripts/vue_shared/components/blob_viewers/constants.js
@@ -3,3 +3,4 @@ export const MARKUP_FILE_TYPE = 'markup';
 export const MARKUP_CONTENT_SELECTOR = '.js-markup-content';
 export const ELEMENTS_PER_CHUNK = 20;
 export const CONTENT_LOADED_EVENT = 'richContentLoaded';
+export const MAX_BLAME_LINES = 100;
diff --git a/app/assets/javascripts/vue_shared/components/blob_viewers/simple_viewer.vue b/app/assets/javascripts/vue_shared/components/blob_viewers/simple_viewer.vue
index c7a76af7f74..2bb678b35b4 100644
--- a/app/assets/javascripts/vue_shared/components/blob_viewers/simple_viewer.vue
+++ b/app/assets/javascripts/vue_shared/components/blob_viewers/simple_viewer.vue
@@ -1,27 +1,95 @@
 <script>
-import { GlIcon } from '@gitlab/ui';
 import SafeHtml from '~/vue_shared/directives/safe_html';
-import { HIGHLIGHT_CLASS_NAME } from './constants';
+import Blame from '../source_viewer/components/blame_info.vue';
+import { calculateBlameOffset, shouldRender, toggleBlameClasses } from '../source_viewer/utils';
+import blameDataQuery from '../source_viewer/queries/blame_data.query.graphql';
 import ViewerMixin from './mixins';
+import { HIGHLIGHT_CLASS_NAME, MAX_BLAME_LINES } from './constants';
 
 export default {
   name: 'SimpleViewer',
   components: {
-    GlIcon,
+    Blame,
   },
   directives: {
     SafeHtml,
   },
   mixins: [ViewerMixin],
   inject: ['blobHash'],
+  props: {
+    blobPath: {
+      type: String,
+      required: true,
+    },
+    showBlame: {
+      type: Boolean,
+      required: false,
+      default: false,
+    },
+    isBlameLinkHidden: {
+      type: Boolean,
+      required: false,
+      default: false,
+    },
+    projectPath: {
+      type: String,
+      required: false,
+      default: '',
+    },
+    lineNumbers: {
+      type: Number,
+      required: true,
+    },
+    currentRef: {
+      type: String,
+      required: false,
+      default: '',
+    },
+    blamePath: {
+      type: String,
+      required: false,
+      default: '',
+    },
+  },
   data() {
     return {
       highlightedLine: null,
+      blameData: [],
+      fromLine: 1,
+      toLine: MAX_BLAME_LINES,
     };
   },
   computed: {
-    lineNumbers() {
-      return this.content.split('\n').length;
+    showBlameLink() {
+      return !this.isBlameLinkHidden && !this.showBlame;
+    },
+    blameInfoForRange() {
+      return this.blameData.reduce((result, blame, index) => {
+        if (shouldRender(this.blameData, index)) {
+          result.push({
+            ...blame,
+            blameOffset: calculateBlameOffset(blame.lineno, index),
+          });
+        }
+
+        return result;
+      }, []);
+    },
+  },
+  watch: {
+    showBlame: {
+      handler(isVisible) {
+        toggleBlameClasses(this.blameData, isVisible);
+        this.requestBlameInfo(this.fromLine, this.toLine);
+      },
+      immediate: true,
+    },
+    blameData: {
+      handler(blameData) {
+        if (!this.showBlame) return;
+        toggleBlameClasses(blameData, true);
+      },
+      immediate: true,
     },
   },
   mounted() {
@@ -29,6 +97,7 @@ export default {
     if (hash) {
       this.scrollToLine(hash, true);
     }
+    this.toLine = this.lineNumbers <= MAX_BLAME_LINES ? this.lineNumbers : MAX_BLAME_LINES;
   },
   methods: {
     scrollToLine(hash, scroll = false) {
@@ -46,31 +115,68 @@ export default {
         }
       }
     },
+    async requestBlameInfo(fromLine, toLine) {
+      if (!this.showBlame) return;
+
+      const { data } = await this.$apollo.query({
+        query: blameDataQuery,
+        variables: {
+          ref: this.currentRef,
+          fullPath: this.projectPath,
+          filePath: this.blobPath,
+          fromLine,
+          toLine,
+        },
+      });
+
+      const blob = data?.project?.repository?.blobs?.nodes[0];
+      const blameGroups = blob?.blame?.groups;
+      const isDuplicate = this.blameData.includes(blameGroups[0]);
+      if (blameGroups && !isDuplicate) this.blameData.push(...blameGroups);
+      if (this.toLine < this.lineNumbers) {
+        this.fromLine += MAX_BLAME_LINES;
+        this.toLine += MAX_BLAME_LINES;
+        this.requestBlameInfo(this.fromLine, this.toLine);
+      }
+    },
   },
   userColorScheme: window.gon.user_color_scheme,
 };
 </script>
 <template>
   <div>
-    <div class="file-content code js-syntax-highlight" :class="$options.userColorScheme">
-      <div v-if="!hideLineNumbers" class="line-numbers gl-pt-0!">
-        <a
+    <div
+      class="file-content code js-syntax-highlight gl-overflow-hidden gl-display-flex"
+      :class="$options.userColorScheme"
+    >
+      <blame v-if="showBlame && blameInfoForRange.length" :blame-info="blameInfoForRange" />
+      <div class="line-numbers gl-px-0!">
+        <div
           v-for="line in lineNumbers"
-          :id="`L${line}`"
           :key="line"
-          class="diff-line-num js-line-number"
-          :href="`#LC${line}`"
-          :data-line-number="line"
-          @click="scrollToLine(`#LC${line}`)"
+          class="gl-display-flex diff-line-num line-links"
         >
-          <gl-icon :size="12" name="link" />
-          {{ line }}
-        </a>
+          <a
+            v-if="showBlameLink"
+            class="gl-user-select-none gl-shadow-none! file-line-blame gl-mx-n2"
+            :href="`${blamePath}#L${line}`"
+          ></a>
+          <a
+            :id="`L${line}`"
+            :key="line"
+            class="gl-user-select-none gl-shadow-none! file-line-num gl-flex-grow-1"
+            :href="`#LC${line}`"
+            :data-line-number="line"
+            @click="scrollToLine(`#LC${line}`)"
+          >
+            {{ line }}
+          </a>
+        </div>
       </div>
-      <div class="blob-content">
+      <div class="blob-content gl-display-flex gl-flex-direction-column gl-w-full">
         <pre
-          class="code highlight gl-p-0! gl-display-flex"
-        ><code v-safe-html="content" :data-blob-hash="blobHash"></code></pre>
+          class="code highlight gl-p-0!"
+        ><code v-safe-html="content" :data-blob-hash="blobHash" ></code></pre>
       </div>
     </div>
   </div>
diff --git a/app/assets/javascripts/vue_shared/components/source_viewer/components/blame_info.vue b/app/assets/javascripts/vue_shared/components/source_viewer/components/blame_info.vue
index 3205ec2b73b..d7eb529202b 100644
--- a/app/assets/javascripts/vue_shared/components/source_viewer/components/blame_info.vue
+++ b/app/assets/javascripts/vue_shared/components/source_viewer/components/blame_info.vue
@@ -21,7 +21,7 @@ export default {
 };
 </script>
 <template>
-  <div class="blame gl-bg-gray-10">
+  <div class="blame gl-bg-gray-10 gl-border-r">
     <div class="blame-commit gl-border-none!">
       <commit-info
         v-for="(blame, index) in blameInfo"
diff --git a/app/assets/javascripts/vue_shared/components/source_viewer/source_viewer.vue b/app/assets/javascripts/vue_shared/components/source_viewer/source_viewer.vue
index 1dd001bd4f5..d6e5d3c425d 100644
--- a/app/assets/javascripts/vue_shared/components/source_viewer/source_viewer.vue
+++ b/app/assets/javascripts/vue_shared/components/source_viewer/source_viewer.vue
@@ -72,8 +72,8 @@ export default {
   },
   watch: {
     showBlame: {
-      handler(shouldShow) {
-        toggleBlameClasses(this.blameData, shouldShow);
+      handler(isVisible) {
+        toggleBlameClasses(this.blameData, isVisible);
         this.requestBlameInfo(this.renderedChunks[0]);
       },
       immediate: true,
diff --git a/app/assets/javascripts/vue_shared/components/source_viewer/utils.js b/app/assets/javascripts/vue_shared/components/source_viewer/utils.js
index 596829b51a4..0d5330ded52 100644
--- a/app/assets/javascripts/vue_shared/components/source_viewer/utils.js
+++ b/app/assets/javascripts/vue_shared/components/source_viewer/utils.js
@@ -1,4 +1,5 @@
-const BLAME_INFO_CLASSLIST = ['gl-border-t', 'gl-border-gray-500', 'gl-pt-3!'];
+const BLAME_INFO_CLASSLIST = ['gl-border-t', 'gl-border-gray-500'];
+const PADDING_TOP_SMALL = 'gl-pt-3!';
 const PADDING_BOTTOM_LARGE = 'gl-pb-6!';
 const PADDING_BOTTOM_SMALL = 'gl-pb-3!';
 const VIEWER_SELECTOR = '.file-holder .blob-viewer';
@@ -36,8 +37,13 @@ export const toggleBlameClasses = (blameData, isVisible) => {
     const lineNumberSpanEl = findLineNumberElement(lineno + span - 1)?.parentElement;
     const lineContentSpanEl = findLineContentElement(lineno + span - 1);
 
-    lineNumberEl?.classList[method](...BLAME_INFO_CLASSLIST);
-    lineContentEl?.classList[method](...BLAME_INFO_CLASSLIST);
+    lineNumberEl?.classList[method](PADDING_TOP_SMALL);
+    lineContentEl?.classList[method](PADDING_TOP_SMALL);
+
+    if (lineno !== 1) {
+      lineNumberEl?.classList[method](...BLAME_INFO_CLASSLIST);
+      lineContentEl?.classList[method](...BLAME_INFO_CLASSLIST);
+    }
 
     if (span === 1) {
       lineNumberSpanEl?.classList[method](PADDING_BOTTOM_LARGE);
diff --git a/app/assets/stylesheets/framework/highlight.scss b/app/assets/stylesheets/framework/highlight.scss
index c15819e5b62..aacc6667f17 100644
--- a/app/assets/stylesheets/framework/highlight.scss
+++ b/app/assets/stylesheets/framework/highlight.scss
@@ -6,7 +6,7 @@
   table-layout: fixed;
 
   pre {
-    padding: 10px 0;
+    line-height: 0;
     border: 0;
     border-radius: 0 0 $border-radius-default;
     font-family: $monospace-font;
@@ -41,7 +41,8 @@
   }
 
   .line-numbers {
-    padding: 10px;
+    padding: 0 10px;
+    line-height: 19px;
     text-align: right;
     float: left;
     border-bottom-left-radius: $border-radius-default;
diff --git a/app/controllers/projects/blob_controller.rb b/app/controllers/projects/blob_controller.rb
index b0eabe92f39..1983036bb5f 100644
--- a/app/controllers/projects/blob_controller.rb
+++ b/app/controllers/projects/blob_controller.rb
@@ -39,11 +39,7 @@ class Projects::BlobController < Projects::ApplicationController
   before_action :validate_diff_params, only: :diff
   before_action :set_last_commit_sha, only: [:edit, :update]
 
-  track_event :create, :update,
-    name: 'g_edit_by_sfe',
-    action: 'perform_sfe_action',
-    label: 'usage_activity_by_stage_monthly.create.action_monthly_active_users_sfe_edit',
-    destinations: [:redis_hll, :snowplow]
+  track_internal_event :create, :update, name: 'g_edit_by_sfe'
 
   feature_category :source_code_management
   urgency :low, [:create, :show, :edit, :update, :diff]
@@ -162,9 +158,8 @@ class Projects::BlobController < Projects::ApplicationController
   end
 
   def check_for_ambiguous_ref
-    return if Feature.enabled?(:redirect_with_ref_type, @project)
-
     @ref_type = ref_type
+    return if Feature.enabled?(:ambiguous_ref_modal, @project)
 
     if @ref_type == ExtractsRef::RefExtractor::BRANCH_REF_TYPE && ambiguous_ref?(@project, @ref)
       branch = @project.repository.find_branch(@ref)
@@ -173,17 +168,7 @@ class Projects::BlobController < Projects::ApplicationController
   end
 
   def commit
-    if Feature.enabled?(:redirect_with_ref_type, @project)
-      response = ::ExtractsRef::RequestedRef.new(@repository, ref_type: ref_type, ref: @ref).find
-      @commit = response[:commit]
-      @ref_type = response[:ref_type]
-
-      if response[:ambiguous]
-        return redirect_to(project_blob_path(@project, File.join(@ref_type ? @ref : @commit.id, @path), ref_type: @ref_type))
-      end
-    else
-      @commit ||= @repository.commit(@ref)
-    end
+    @commit ||= @repository.commit(@ref)
 
     return render_404 unless @commit
   end
diff --git a/app/controllers/projects/tree_controller.rb b/app/controllers/projects/tree_controller.rb
index 9b9dbc507e1..17f72168a70 100644
--- a/app/controllers/projects/tree_controller.rb
+++ b/app/controllers/projects/tree_controller.rb
@@ -13,7 +13,6 @@ class Projects::TreeController < Projects::ApplicationController
   before_action :require_non_empty_project, except: [:new, :create]
   before_action :assign_ref_vars
   before_action :set_is_ambiguous_ref, only: [:show]
-  before_action :find_requested_ref, only: [:show]
   before_action :assign_dir_vars, only: [:create_dir]
   before_action :authorize_read_code!
   before_action :authorize_edit_tree!, only: [:create_dir]
@@ -30,14 +29,13 @@ class Projects::TreeController < Projects::ApplicationController
   def show
     return render_404 unless @commit
 
-    unless Feature.enabled?(:redirect_with_ref_type, @project)
-      @ref_type = ref_type
-      if @ref_type == BRANCH_REF_TYPE && ambiguous_ref?(@project, @ref)
-        branch = @project.repository.find_branch(@ref)
-        if branch
-          redirect_to project_tree_path(@project, branch.target)
-          return
-        end
+    @ref_type = ref_type
+    if !Feature.enabled?(:ambiguous_ref_modal,
+      @project) && (@ref_type == BRANCH_REF_TYPE && ambiguous_ref?(@project, @ref))
+      branch = @project.repository.find_branch(@ref)
+      if branch
+        redirect_to project_tree_path(@project, branch.target)
+        return
       end
     end
 
@@ -63,23 +61,6 @@ class Projects::TreeController < Projects::ApplicationController
 
   private
 
-  def find_requested_ref
-    return unless Feature.enabled?(:redirect_with_ref_type, @project)
-
-    @ref_type = ref_type
-    if @ref_type.present?
-      @tree = @repo.tree(@ref, @path, ref_type: @ref_type)
-    else
-      response = ExtractsPath::RequestedRef.new(@repository, ref_type: nil, ref: @ref).find
-      @ref_type = response[:ref_type]
-      @commit = response[:commit]
-
-      if response[:ambiguous]
-        redirect_to(project_tree_path(@project, File.join(@ref_type ? @ref : @commit.id, @path), ref_type: @ref_type))
-      end
-    end
-  end
-
   def redirect_renamed_default_branch?
     action_name == 'show'
   end
diff --git a/app/controllers/projects_controller.rb b/app/controllers/projects_controller.rb
index 679be9323d4..77e0715dbef 100644
--- a/app/controllers/projects_controller.rb
+++ b/app/controllers/projects_controller.rb
@@ -183,9 +183,9 @@ class ProjectsController < Projects::ApplicationController
       flash.now[:alert] = _("Project '%{project_name}' queued for deletion.") % { project_name: @project.name }
     end
 
-    if Feature.enabled?(:redirect_with_ref_type, @project)
-      @ref_type = 'heads'
-    elsif ambiguous_ref?(@project, @ref)
+    @ref_type = 'heads'
+
+    if !Feature.enabled?(:ambiguous_ref_modal, @project) && ambiguous_ref?(@project, @ref)
       branch = @project.repository.find_branch(@ref)
 
       # The files view would render a ref other than the default branch
diff --git a/app/controllers/snippets_controller.rb b/app/controllers/snippets_controller.rb
index 3f20e1c0e86..ab959ab24b3 100644
--- a/app/controllers/snippets_controller.rb
+++ b/app/controllers/snippets_controller.rb
@@ -17,23 +17,7 @@ class SnippetsController < Snippets::ApplicationController
   layout :determine_layout
 
   def index
-    if params[:username].present?
-      @user = UserFinder.new(params[:username]).find_by_username!
-
-      @snippets = SnippetsFinder.new(current_user, author: @user, scope: params[:scope], sort: sort_param)
-        .execute
-        .page(params[:page])
-        .inc_author
-        .inc_statistics
-
-      return if redirect_out_of_range(@snippets)
-
-      @noteable_meta_data = noteable_meta_data(@snippets, 'Snippet')
-
-      render 'index'
-    else
-      redirect_to(current_user ? dashboard_snippets_path : explore_snippets_path)
-    end
+    redirect_to(current_user ? dashboard_snippets_path : explore_snippets_path)
   end
 
   def new
diff --git a/app/graphql/mutations/work_items/delete.rb b/app/graphql/mutations/work_items/delete.rb
index bce59448412..168e53a216c 100644
--- a/app/graphql/mutations/work_items/delete.rb
+++ b/app/graphql/mutations/work_items/delete.rb
@@ -14,20 +14,31 @@ module Mutations
 
       field :project, Types::ProjectType,
             null: true,
-            description: 'Project the deleted work item belonged to.'
+            description: 'Project the deleted work item belonged to.',
+            deprecated: {
+              reason: 'Use `namespace`',
+              milestone: '16.9'
+            }
+
+      field :namespace, Types::NamespaceType,
+            null: true,
+            description: 'Namespace the deleted work item belonged to.'
 
       def resolve(id:)
         work_item = authorized_find!(id: id)
 
         result = ::WorkItems::DeleteService.new(
-          container: work_item.project,
+          container: work_item.resource_parent,
           current_user: current_user
         ).execute(work_item)
 
-        {
-          project: result.success? ? work_item.project : nil,
-          errors: result.errors
-        }
+        response = { errors: result.errors }
+
+        if result.success?
+          response.merge(project: work_item.project, namespace: work_item.namespace)
+        else
+          response
+        end
       end
     end
   end
diff --git a/app/models/concerns/versioned_description.rb b/app/models/concerns/versioned_description.rb
index dd602efea1c..dff7983477a 100644
--- a/app/models/concerns/versioned_description.rb
+++ b/app/models/concerns/versioned_description.rb
@@ -8,7 +8,7 @@ module VersionedDescription
 
     has_many :description_versions
 
-    after_update :save_description_version
+    after_update :save_description_version, unless: :skip_description_version?
   end
 
   private
@@ -27,4 +27,8 @@ module VersionedDescription
 
     self.saved_description_version = description_versions.create!(description: description)
   end
+
+  def skip_description_version?
+    false
+  end
 end
diff --git a/app/models/issue.rb b/app/models/issue.rb
index 831e618c5f1..14f010180d9 100644
--- a/app/models/issue.rb
+++ b/app/models/issue.rb
@@ -232,7 +232,7 @@ class Issue < ApplicationRecord
 
   before_validation :ensure_namespace_id, :ensure_work_item_type
 
-  after_save :ensure_metrics!, unless: :importing?
+  after_save :ensure_metrics!, unless: :skip_metrics?
   after_commit :expire_etag_cache, unless: :importing?
   after_create_commit :record_create_action, unless: :importing?
 
@@ -741,6 +741,10 @@ class Issue < ApplicationRecord
     "#{work_item_type_with_default.name.underscore} #{to_reference(from)}"
   end
 
+  def skip_metrics?
+    importing?
+  end
+
   private
 
   def project_level_readable_by?(user)
diff --git a/app/models/work_items/widgets/base.rb b/app/models/work_items/widgets/base.rb
index a3051f17158..c4e87decdbf 100644
--- a/app/models/work_items/widgets/base.rb
+++ b/app/models/work_items/widgets/base.rb
@@ -15,18 +15,10 @@ module WorkItems
         []
       end
 
-      def self.sync_params
-        []
-      end
-
       def self.process_quick_action_param(param_name, value)
         { param_name => value }
       end
 
-      def self.process_sync_params(params)
-        params
-      end
-
       def self.callback_class
         WorkItems::Callbacks.const_get(name.demodulize, false)
       rescue NameError
diff --git a/app/models/work_items/widgets/hierarchy.rb b/app/models/work_items/widgets/hierarchy.rb
index 0bfffdc0fe5..f184ceefef9 100644
--- a/app/models/work_items/widgets/hierarchy.rb
+++ b/app/models/work_items/widgets/hierarchy.rb
@@ -23,10 +23,6 @@ module WorkItems
         [:set_parent, :add_child, :remove_parent]
       end
 
-      def self.sync_params
-        [:parent]
-      end
-
       def self.process_quick_action_param(param_name, value)
         return super unless param_name.in?(quick_action_params) && value.present?
 
@@ -36,16 +32,6 @@ module WorkItems
           { children: value }
         end
       end
-
-      def self.process_sync_params(params)
-        parent_param = params.fetch(:parent, nil)
-
-        if parent_param&.work_item
-          { parent: parent_param.work_item }
-        else
-          {}
-        end
-      end
     end
   end
 end
diff --git a/app/models/work_items/widgets/labels.rb b/app/models/work_items/widgets/labels.rb
index 0b5a231deff..e8b36156fec 100644
--- a/app/models/work_items/widgets/labels.rb
+++ b/app/models/work_items/widgets/labels.rb
@@ -13,10 +13,6 @@ module WorkItems
       def self.quick_action_params
         [:add_label_ids, :remove_label_ids, :label_ids]
       end
-
-      def self.sync_params
-        [:label_ids]
-      end
     end
   end
 end
diff --git a/app/policies/group_policy.rb b/app/policies/group_policy.rb
index cef97a42f11..9edc3246949 100644
--- a/app/policies/group_policy.rb
+++ b/app/policies/group_policy.rb
@@ -232,6 +232,7 @@ class GroupPolicy < Namespaces::GroupProjectNamespaceSharedPolicy
     enable :read_group_runners
     enable :register_group_runners
     enable :create_runner
+    enable :destroy_issue
 
     enable :set_note_created_at
     enable :set_emails_disabled
diff --git a/app/serializers/note_user_entity.rb b/app/serializers/note_user_entity.rb
index c3f14fb0f9e..f89203d4cf8 100644
--- a/app/serializers/note_user_entity.rb
+++ b/app/serializers/note_user_entity.rb
@@ -2,6 +2,8 @@
 
 class NoteUserEntity < UserEntity
   unexpose :web_url
+
+  expose :bot?, as: :bot
 end
 
 NoteUserEntity.prepend_mod_with('NoteUserEntity')
diff --git a/app/services/issuable/destroy_service.rb b/app/services/issuable/destroy_service.rb
index 47770d101f9..d1daef85cff 100644
--- a/app/services/issuable/destroy_service.rb
+++ b/app/services/issuable/destroy_service.rb
@@ -24,7 +24,11 @@ module Issuable
     end
 
     def group_for(issuable)
-      issuable.resource_parent.group
+      if issuable.project.present?
+        issuable.project.group
+      else
+        issuable.namespace
+      end
     end
 
     def delete_associated_records(issuable)
diff --git a/app/services/issuable_base_service.rb b/app/services/issuable_base_service.rb
index 27c52fc7303..0706e921a9d 100644
--- a/app/services/issuable_base_service.rb
+++ b/app/services/issuable_base_service.rb
@@ -324,9 +324,7 @@ class IssuableBaseService < ::BaseContainerService
     if issuable.changed? || params.present? || widget_params.present? || @callbacks.present?
       issuable.assign_attributes(allowed_update_params(params))
 
-      if issuable.description_changed?
-        issuable.assign_attributes(last_edited_at: Time.current, last_edited_by: current_user)
-      end
+      assign_last_edited(issuable)
 
       before_update(issuable)
 
@@ -513,6 +511,12 @@ class IssuableBaseService < ::BaseContainerService
     end
   end
 
+  def assign_last_edited(issuable)
+    return unless issuable.description_changed?
+
+    issuable.assign_attributes(last_edited_at: Time.current, last_edited_by: current_user)
+  end
+
   # Arrays of ids are used, but we should really use sets of ids, so
   # let's have an helper to properly check if some ids are changing
   def ids_changing?(old_array, new_array)
diff --git a/app/services/work_items/update_service.rb b/app/services/work_items/update_service.rb
index 27b318d280f..99c6f406d13 100644
--- a/app/services/work_items/update_service.rb
+++ b/app/services/work_items/update_service.rb
@@ -6,6 +6,7 @@ module WorkItems
     include WidgetableService
 
     def initialize(container:, current_user: nil, params: {}, perform_spam_check: false, widget_params: {})
+      @extra_params = params.delete(:extra_params) || {}
       params[:widget_params] = true if widget_params.present?
 
       super(container: container, current_user: current_user, params: params, perform_spam_check: perform_spam_check)
@@ -27,6 +28,8 @@ module WorkItems
 
     private
 
+    attr_reader :extra_params
+
     override :handle_quick_actions
     def handle_quick_actions(work_item)
       # Do not handle quick actions unless the work item is the default Issue.
@@ -79,3 +82,5 @@ module WorkItems
     end
   end
 end
+
+WorkItems::UpdateService.prepend_mod
diff --git a/app/views/devise/sessions/_new_base.html.haml b/app/views/devise/sessions/_new_base.html.haml
index d9b7c986a9f..b9658839341 100644
--- a/app/views/devise/sessions/_new_base.html.haml
+++ b/app/views/devise/sessions/_new_base.html.haml
@@ -18,7 +18,7 @@
       = recaptcha_tags nonce: content_security_policy_nonce
 
   - if remember_me_enabled?
-    .form-group
+    .gl-mb-3
       = f.gitlab_ui_checkbox_component :remember_me, _('Remember me'), checkbox_options: { autocomplete: 'off' }
 
   = render Pajamas::ButtonComponent.new(type: :submit, variant: :confirm, block: true, button_options: { class: 'js-sign-in-button', data: { testid: 'sign-in-button' } }) do
diff --git a/app/views/devise/sessions/_new_crowd.html.haml b/app/views/devise/sessions/_new_crowd.html.haml
index 4b1441662ab..98489d87966 100644
--- a/app/views/devise/sessions/_new_crowd.html.haml
+++ b/app/views/devise/sessions/_new_crowd.html.haml
@@ -10,7 +10,8 @@
     %input.form-control.gl-form-input.js-password{ data: { id: 'crowd_password', name: 'password' } }
 
   - if render_remember_me
-    = f.gitlab_ui_checkbox_component :remember_me, _('Remember me'), checkbox_options: { name: :remember_me, autocomplete: 'off' }
+    .gl-mb-3
+      = f.gitlab_ui_checkbox_component :remember_me, _('Remember me'), checkbox_options: { name: :remember_me, autocomplete: 'off' }
 
   = render Pajamas::ButtonComponent.new(type: :submit, variant: :confirm, block: true) do
     = submit_message
diff --git a/app/views/devise/sessions/_new_ldap.html.haml b/app/views/devise/sessions/_new_ldap.html.haml
index db7b7a4f729..0e5f1ab8936 100644
--- a/app/views/devise/sessions/_new_ldap.html.haml
+++ b/app/views/devise/sessions/_new_ldap.html.haml
@@ -12,7 +12,8 @@
     %input.form-control.gl-form-input.js-password{ data: { id: "#{provider}_password", name: 'password', testid: 'password-field' } }
 
   - if render_remember_me
-    = f.gitlab_ui_checkbox_component :remember_me, _('Remember me'), checkbox_options: { name: :remember_me, autocomplete: 'off' }
+    .gl-mb-3
+      = f.gitlab_ui_checkbox_component :remember_me, _('Remember me'), checkbox_options: { name: :remember_me, autocomplete: 'off' }
 
   = render Pajamas::ButtonComponent.new(type: :submit, variant: :confirm, block: true, button_options: { data: { testid: 'sign-in-button' } }) do
     = submit_message
diff --git a/app/views/shared/_file_highlight.html.haml b/app/views/shared/_file_highlight.html.haml
index 3b53a4b4e89..a789592e792 100644
--- a/app/views/shared/_file_highlight.html.haml
+++ b/app/views/shared/_file_highlight.html.haml
@@ -2,21 +2,11 @@
 
 - offset = defined?(first_line_number) ? first_line_number : 1
 - highlight = defined?(highlight_line) && highlight_line ? highlight_line - offset : nil
-- line_class = "js-line-links"
-- blame_path = project_blame_path(@project, tree_join(@ref, blob.path))
 
 - highlighted_blob = blob.present.highlight
 
 #blob-content.file-content.code.js-syntax-highlight
-  .line-numbers{ class: "gl-px-0!", data: { blame_path: blame_path } }
-    - if blob.data.present?
-      - highlighted_blob.lines.count.times do |index|
-        - i = index + offset
-
-        %a.file-line-num.diff-line-num{ class: line_class, href: "#L#{i}", id: "L#{i}", 'data-line-number' => i }
-          = i
-
   .blob-content{ data: { blob_id: blob.id, path: blob.path, highlight_line: highlight } }
-    %pre.code.highlight
-      %code
+    %pre{ class: "code highlight gl-border-none!" }
+      %code.gl-border-none
         = highlighted_blob
diff --git a/app/views/snippets/index.html.haml b/app/views/snippets/index.html.haml
deleted file mode 100644
index f5fe75bed5a..00000000000
--- a/app/views/snippets/index.html.haml
+++ /dev/null
@@ -1,13 +0,0 @@
-- page_title _("By %{user_name}") % { user_name: @user.name }, _("Snippets")
-
-%ol.breadcrumb
-  %li.breadcrumb-item
-    = link_to snippets_path do
-      = _("Snippets")
-  %li.breadcrumb-item
-    = @user.name
-  .float-right.d-none.d-sm-block
-    = link_to user_path(@user) do
-      = _("%{user_name} profile page") % { user_name: @user.name }
-
-= render 'shared/snippets/list'
diff --git a/config/feature_flags/development/redirect_with_ref_type.yml b/config/feature_flags/development/redirect_with_ref_type.yml
deleted file mode 100644
index 74a4d31eb2f..00000000000
--- a/config/feature_flags/development/redirect_with_ref_type.yml
+++ /dev/null
@@ -1,8 +0,0 @@
----
-name: redirect_with_ref_type
-introduced_by_url: https://gitlab.com/gitlab-org/gitlab/-/merge_requests/122237
-rollout_issue_url:
-milestone: '16.2'
-type: development
-group: group::source code
-default_enabled: false
diff --git a/config/metrics/counts_28d/20240130072055_p_ci_templates_opentofu_base_latest_monthly.yml b/config/metrics/counts_28d/20240130072055_p_ci_templates_opentofu_base_latest_monthly.yml
new file mode 100644
index 00000000000..fcd10e5b006
--- /dev/null
+++ b/config/metrics/counts_28d/20240130072055_p_ci_templates_opentofu_base_latest_monthly.yml
@@ -0,0 +1,24 @@
+---
+key_path: redis_hll_counters.ci_templates.p_ci_templates_opentofu_base_latest_monthly
+description: Count of pipelines that include the OpenTofu job template from GitLab
+product_section: ops
+product_stage: deploy
+product_group: environment
+value_type: number
+status: active
+milestone: "16.9"
+introduced_by_url: https://gitlab.com/gitlab-org/gitlab/-/merge_requests/142547
+time_frame: 28d
+data_source: redis_hll
+data_category: optional
+instrumentation_class: RedisHLLMetric
+distribution:
+- ce
+- ee
+tier:
+- free
+- premium
+- ultimate
+options:
+  events:
+    - p_ci_templates_opentofu_base_latest
diff --git a/config/metrics/counts_28d/20240130072115_p_ci_templates_opentofu_latest_monthly.yml b/config/metrics/counts_28d/20240130072115_p_ci_templates_opentofu_latest_monthly.yml
new file mode 100644
index 00000000000..d2be2d5cf9c
--- /dev/null
+++ b/config/metrics/counts_28d/20240130072115_p_ci_templates_opentofu_latest_monthly.yml
@@ -0,0 +1,24 @@
+---
+key_path: redis_hll_counters.ci_templates.p_ci_templates_opentofu_latest_monthly
+description: Count of pipelines that include the OpenTofu pipeline template from GitLab
+product_section: ops
+product_stage: deploy
+product_group: environment
+value_type: number
+status: active
+milestone: "16.9"
+introduced_by_url: https://gitlab.com/gitlab-org/gitlab/-/merge_requests/142547
+time_frame: 28d
+data_source: redis_hll
+data_category: optional
+instrumentation_class: RedisHLLMetric
+distribution:
+- ce
+- ee
+tier:
+- free
+- premium
+- ultimate
+options:
+  events:
+    - p_ci_templates_opentofu_latest
diff --git a/config/metrics/counts_7d/20210216184557_ci_templates_total_unique_counts_weekly.yml b/config/metrics/counts_7d/20210216184557_ci_templates_total_unique_counts_weekly.yml
index 61fa197656b..291d05736cd 100755
--- a/config/metrics/counts_7d/20210216184557_ci_templates_total_unique_counts_weekly.yml
+++ b/config/metrics/counts_7d/20210216184557_ci_templates_total_unique_counts_weekly.yml
@@ -183,6 +183,8 @@ options:
   - p_ci_templates_terraform_module
   - p_ci_templates_pages_zola
   - p_ci_templates_diffblue_cover
+  - p_ci_templates_opentofu_base_latest
+  - p_ci_templates_opentofu_latest
 distribution:
 - ce
 - ee
diff --git a/config/metrics/counts_7d/20240130072053_p_ci_templates_opentofu_base_latest_weekly.yml b/config/metrics/counts_7d/20240130072053_p_ci_templates_opentofu_base_latest_weekly.yml
new file mode 100644
index 00000000000..c1669bf823b
--- /dev/null
+++ b/config/metrics/counts_7d/20240130072053_p_ci_templates_opentofu_base_latest_weekly.yml
@@ -0,0 +1,24 @@
+---
+key_path: redis_hll_counters.ci_templates.p_ci_templates_opentofu_base_latest_weekly
+description: Count of pipelines that include the OpenTofu job template from GitLab
+product_section: ops
+product_stage: deploy
+product_group: environment
+value_type: number
+status: active
+milestone: "16.9"
+introduced_by_url: https://gitlab.com/gitlab-org/gitlab/-/merge_requests/142547
+time_frame: 7d
+data_source: redis_hll
+data_category: optional
+instrumentation_class: RedisHLLMetric
+distribution:
+- ce
+- ee
+tier:
+- free
+- premium
+- ultimate
+options:
+  events:
+    - p_ci_templates_opentofu_base_latest
diff --git a/config/metrics/counts_7d/20240130072114_p_ci_templates_opentofu_latest_weekly.yml b/config/metrics/counts_7d/20240130072114_p_ci_templates_opentofu_latest_weekly.yml
new file mode 100644
index 00000000000..53b6a1ac885
--- /dev/null
+++ b/config/metrics/counts_7d/20240130072114_p_ci_templates_opentofu_latest_weekly.yml
@@ -0,0 +1,24 @@
+---
+key_path: redis_hll_counters.ci_templates.p_ci_templates_opentofu_latest_weekly
+description: Count of pipelines that include the OpenTofu pipeline template from GitLab
+product_section: ops
+product_stage: deploy
+product_group: environment
+value_type: number
+status: active
+milestone: "16.9"
+introduced_by_url: https://gitlab.com/gitlab-org/gitlab/-/merge_requests/142547
+time_frame: 7d
+data_source: redis_hll
+data_category: optional
+instrumentation_class: RedisHLLMetric
+distribution:
+- ce
+- ee
+tier:
+- free
+- premium
+- ultimate
+options:
+  events:
+    - p_ci_templates_opentofu_latest
diff --git a/data/deprecations/16-9-deprecate-terraform-cicd-templates.yml b/data/deprecations/16-9-deprecate-terraform-cicd-templates.yml
new file mode 100644
index 00000000000..ad62f309d3a
--- /dev/null
+++ b/data/deprecations/16-9-deprecate-terraform-cicd-templates.yml
@@ -0,0 +1,33 @@
+- title: "Deprecate Terraform CI/CD templates"
+  # The milestones for the deprecation announcement, and the removal.
+  removal_milestone: "17.0"
+  announcement_milestone: "16.9"
+  # Change breaking_change to false if needed.
+  breaking_change: true
+  # The stage and GitLab username of the person reporting the change,
+  # and a link to the deprecation issue
+  reporter: timofurrer
+  stage: deploy
+  issue_url: https://gitlab.com/gitlab-org/gitlab/-/issues/438010
+  body: |  # (required) Don't change this line.
+    The Terraform CI/CD templates are deprecated and will be removed in GitLab 17.0.
+    This affects the following templates:
+
+    - `Terraform.gitlab-ci.yml`
+    - `Terraform.latest.gitlab-ci.yml`
+    - `Terraform/Base.gitlab-ci.yml`
+    - `Terraform/Base.latest.gitlab-ci.yml`
+
+    In GitLab 16.9, a new job is added to the templates to inform users of the deprecation.
+
+    To continue using Terraform, clone the templates and [Terraform image](https://gitlab.com/gitlab-org/terraform-images),
+    and maintain them as needed.
+
+    As an alternative we recommend using the new OpenTofu CI/CD component on GitLab.com
+    or the new OpenTofu CI/CD template on self-managed.
+    CI/CD components are not yet available on GitLab self-managed,
+    but [Issue #415638](https://gitlab.com/gitlab-org/gitlab/-/issues/415638)
+    proposes to add this feature. If CI/CD components become available on self-managed,
+    the OpenTofu CI/CD template will be removed.
+
+    You can read more about the new OpenTofu CI/CD component [here](https://gitlab.com/components/opentofu).
diff --git a/db/migrate/20240110202002_add_is_unique_to_issuable_resource_links.rb b/db/migrate/20240110202002_add_is_unique_to_issuable_resource_links.rb
new file mode 100644
index 00000000000..f3990843e4a
--- /dev/null
+++ b/db/migrate/20240110202002_add_is_unique_to_issuable_resource_links.rb
@@ -0,0 +1,9 @@
+# frozen_string_literal: true
+
+class AddIsUniqueToIssuableResourceLinks < Gitlab::Database::Migration[2.2]
+  milestone '16.9'
+
+  def change
+    add_column :issuable_resource_links, :is_unique, :boolean, null: true
+  end
+end
diff --git a/db/migrate/20240110204949_add_partial_unique_index_on_issue_id_and_link_to_issuable_resource_links.rb b/db/migrate/20240110204949_add_partial_unique_index_on_issue_id_and_link_to_issuable_resource_links.rb
new file mode 100644
index 00000000000..a833a9ef06b
--- /dev/null
+++ b/db/migrate/20240110204949_add_partial_unique_index_on_issue_id_and_link_to_issuable_resource_links.rb
@@ -0,0 +1,19 @@
+# frozen_string_literal: true
+
+class AddPartialUniqueIndexOnIssueIdAndLinkToIssuableResourceLinks < Gitlab::Database::Migration[2.2]
+  disable_ddl_transaction!
+  milestone '16.9'
+  INDEX_NAME = 'index_unique_issuable_resource_links_on_unique_issue_link'
+
+  def up
+    add_concurrent_index :issuable_resource_links,
+      %i[issue_id link],
+      unique: true,
+      where: "is_unique",
+      name: INDEX_NAME
+  end
+
+  def down
+    remove_concurrent_index_by_name :issuable_resource_links, INDEX_NAME
+  end
+end
diff --git a/db/migrate/20240129175101_add_archived_and_traversal_ids_columns_to_sbom_occurrences.rb b/db/migrate/20240129175101_add_archived_and_traversal_ids_columns_to_sbom_occurrences.rb
new file mode 100644
index 00000000000..4e5cc8736da
--- /dev/null
+++ b/db/migrate/20240129175101_add_archived_and_traversal_ids_columns_to_sbom_occurrences.rb
@@ -0,0 +1,10 @@
+# frozen_string_literal: true
+
+class AddArchivedAndTraversalIdsColumnsToSbomOccurrences < Gitlab::Database::Migration[2.2]
+  milestone '16.9'
+
+  def change
+    add_column :sbom_occurrences, :archived, :boolean, default: false, null: false
+    add_column :sbom_occurrences, :traversal_ids, 'bigint[]', default: [], null: false
+  end
+end
diff --git a/db/schema_migrations/20240110202002 b/db/schema_migrations/20240110202002
new file mode 100644
index 00000000000..adf8f810eda
--- /dev/null
+++ b/db/schema_migrations/20240110202002
@@ -0,0 +1 @@
+b5813e6976e323ebcea5164324fb4d5eb719f826524978b3c750c575f04f0c8b
\ No newline at end of file
diff --git a/db/schema_migrations/20240110204949 b/db/schema_migrations/20240110204949
new file mode 100644
index 00000000000..ad78b3efa87
--- /dev/null
+++ b/db/schema_migrations/20240110204949
@@ -0,0 +1 @@
+dd49cc72ac235feefcebc90eecd34e4944fd74875e8beece56cfd34015034a2d
\ No newline at end of file
diff --git a/db/schema_migrations/20240129175101 b/db/schema_migrations/20240129175101
new file mode 100644
index 00000000000..cd6780a8341
--- /dev/null
+++ b/db/schema_migrations/20240129175101
@@ -0,0 +1 @@
+802d66cbde0b01cf2ce45a0c45e71b8cbb2230f19aa354122e71b44fd5ac0a16
\ No newline at end of file
diff --git a/db/structure.sql b/db/structure.sql
index 8d1e8651638..b7d6cf930a8 100644
--- a/db/structure.sql
+++ b/db/structure.sql
@@ -18367,6 +18367,7 @@ CREATE TABLE issuable_resource_links (
     link_type smallint DEFAULT 0 NOT NULL,
     created_at timestamp with time zone NOT NULL,
     updated_at timestamp with time zone NOT NULL,
+    is_unique boolean,
     CONSTRAINT check_67be6729db CHECK ((char_length(link) <= 2200)),
     CONSTRAINT check_b137147e0b CHECK ((char_length(link_text) <= 255))
 );
@@ -23601,6 +23602,8 @@ CREATE TABLE sbom_occurrences (
     highest_severity smallint,
     vulnerability_count integer DEFAULT 0 NOT NULL,
     source_package_id bigint,
+    archived boolean DEFAULT false NOT NULL,
+    traversal_ids bigint[] DEFAULT '{}'::bigint[] NOT NULL,
     CONSTRAINT check_3f2d2c7ffc CHECK ((char_length(package_manager) <= 255)),
     CONSTRAINT check_9b29021fa8 CHECK ((char_length(component_name) <= 255)),
     CONSTRAINT check_bd1367d4c1 CHECK ((char_length(input_file_path) <= 255))
@@ -35690,6 +35693,8 @@ CREATE UNIQUE INDEX index_unique_ci_runner_projects_on_runner_id_and_project_id
 
 CREATE UNIQUE INDEX index_unique_epics_on_issue_id ON epics USING btree (issue_id);
 
+CREATE UNIQUE INDEX index_unique_issuable_resource_links_on_unique_issue_link ON issuable_resource_links USING btree (issue_id, link) WHERE is_unique;
+
 CREATE UNIQUE INDEX index_unique_issue_metrics_issue_id ON issue_metrics USING btree (issue_id);
 
 CREATE UNIQUE INDEX index_unique_project_authorizations_on_unique_project_user ON project_authorizations USING btree (project_id, user_id) WHERE is_unique;
diff --git a/doc/administration/auth/test_oidc_oauth.md b/doc/administration/auth/test_oidc_oauth.md
index e2fbf234037..39dfecc5c86 100644
--- a/doc/administration/auth/test_oidc_oauth.md
+++ b/doc/administration/auth/test_oidc_oauth.md
@@ -18,18 +18,19 @@ To test OIDC/OAuth in GitLab, you must:
 
 ## Prerequisites
 
-Before you can test OIDC/OAuth on GitLab, you'll need the following:
+Before you can test OIDC/OAuth on GitLab, you must:
 
-- Publicly accessible GitLab instance
-- A client application that you want to use to test OIDC/OAuth
-- A user account on the GitLab instance that you can use to log in and test OIDC/OAuth
+- Have a publicly accessible GitLab self-managed instance.
+- Be an administrator for that instance.
+- Have a client application that you want to use to test OIDC/OAuth.
 
 ## Enable OIDC/OAuth in GitLab
 
 First, you must create OIDC/OAuth application on your GitLab instance. To do this:
 
-1. Sign in to GitLab as an administrator.
-1. Select **Profile > Preferences > Applications**.
+1. On the left sidebar, at the bottom, select **Admin Area**.
+1. Select **Applications**.
+1. Select **Add new application**.
 1. Fill in the details for your client application, including the name, redirect URI, and allowed scopes.
 1. Make sure the `openid` scope is enabled.
 1. Select **Save application** to create the new OAuth application.
diff --git a/doc/api/graphql/reference/index.md b/doc/api/graphql/reference/index.md
index 00e4213f4a9..af136cad7b3 100644
--- a/doc/api/graphql/reference/index.md
+++ b/doc/api/graphql/reference/index.md
@@ -8645,7 +8645,8 @@ Input type: `WorkItemDeleteInput`
 | ---- | ---- | ----------- |
 | <a id="mutationworkitemdeleteclientmutationid"></a>`clientMutationId` | [`String`](#string) | A unique identifier for the client performing the mutation. |
 | <a id="mutationworkitemdeleteerrors"></a>`errors` | [`[String!]!`](#string) | Errors encountered during execution of the mutation. |
-| <a id="mutationworkitemdeleteproject"></a>`project` | [`Project`](#project) | Project the deleted work item belonged to. |
+| <a id="mutationworkitemdeletenamespace"></a>`namespace` | [`Namespace`](#namespace) | Namespace the deleted work item belonged to. |
+| <a id="mutationworkitemdeleteproject"></a>`project` **{warning-solid}** | [`Project`](#project) | **Deprecated:** Use `namespace`. Deprecated in 16.9. |
 
 ### `Mutation.workItemExport`
 
diff --git a/doc/ci/yaml/index.md b/doc/ci/yaml/index.md
index 3c271e78513..09cdbfe506d 100644
--- a/doc/ci/yaml/index.md
+++ b/doc/ci/yaml/index.md
@@ -1,7 +1,10 @@
 ---
 stage: Verify
 group: Pipeline Authoring
-info: To determine the technical writer assigned to the Stage/Group associated with this page, see https://handbook.gitlab.com/handbook/product/ux/technical-writing/#assignments
+info: >-
+  To determine the technical writer assigned to the Stage/Group associated with
+  this page, see
+  https://handbook.gitlab.com/handbook/product/ux/technical-writing/#assignments
 ---
 
 # CI/CD YAML syntax reference
@@ -59,6 +62,7 @@ A GitLab CI/CD pipeline configuration includes:
   | [`dependencies`](#dependencies)             | Restrict which artifacts are passed to a specific job by providing a list of jobs to fetch artifacts from. |
   | [`environment`](#environment)               | Name of an environment to which the job deploys. |
   | [`extends`](#extends)                       | Configuration entries that this job inherits from. |
+  | [`identity_provider`](#identity_provider)   | Authenticate with third party services. |
   | [`image`](#image)                           | Use Docker images. |
   | [`inherit`](#inherit)                       | Select which global defaults all jobs inherit. |
   | [`interruptible`](#interruptible)           | Defines if a job can be canceled when made redundant by a newer run. |
@@ -2437,6 +2441,33 @@ job1:
 
 - [GitLab Runner configuration](https://docs.gitlab.com/runner/configuration/advanced-configuration.html#the-runners-section)
 
+### `identity_provider` **(EXPERIMENT)**
+
+> [Introduced](https://gitlab.com/gitlab-org/gitlab/-/merge_requests/142054) in GitLab 16.9. This feature is an [Experiment](../../policy/experiment-beta-support.md).
+
+FLAG:
+On GitLab.com, this feature is not available.
+The feature is not ready for production use.
+
+Use `identity_provider` to authenticate with third party services.
+
+**Keyword type**: Job keyword. You can use it only as part of a job or in the [`default:` section](#default).
+
+**Possible inputs**: A provider identifier. Supported providers: `google_cloud` (Google Cloud). The Google Cloud
+
+**Example of `identity_provider`**:
+
+```yaml
+job_with_identity_provider:
+  identity_provider: google_cloud
+  script:
+    - gcloud compute instances list
+```
+
+**Related topics**:
+
+- [Workload Identity Federation](https://cloud.google.com/iam/docs/workload-identity-federation).
+
 ### `id_tokens`
 
 > - [Introduced](https://gitlab.com/gitlab-org/gitlab/-/issues/356986) in GitLab 15.7.
diff --git a/doc/development/ee_features.md b/doc/development/ee_features.md
index 3cdf8e49c94..37505c1e254 100644
--- a/doc/development/ee_features.md
+++ b/doc/development/ee_features.md
@@ -296,7 +296,7 @@ FOSS context as well.
 
 To run pipelines in both contexts, add the `~"pipeline:run-as-if-foss"` label to the merge request.
 
-See the [As-if-FOSS jobs](pipelines/index.md#as-if-foss-jobs) pipelines documentation for more information.
+See the [As-if-FOSS jobs and cross project downstream pipeline](pipelines/index.md#as-if-foss-jobs-and-cross-project-downstream-pipeline) pipelines documentation for more information.
 
 ## Separation of EE code in the backend
 
diff --git a/doc/development/pipelines/index.md b/doc/development/pipelines/index.md
index eea4fc01985..cb3d177cd6e 100644
--- a/doc/development/pipelines/index.md
+++ b/doc/development/pipelines/index.md
@@ -286,36 +286,47 @@ If you want to force a Review App to be deployed regardless of your changes, you
 
 Consult the [Review Apps](../testing_guide/review_apps.md) dedicated page for more information.
 
-### As-if-FOSS jobs
+### As-if-FOSS jobs and cross project downstream pipeline
 
-The `* as-if-foss` jobs run the GitLab test suite "as if FOSS", meaning as if the jobs would run in the context
-of `gitlab-org/gitlab-foss`. These jobs are only created in the following cases:
+To ensure the relevant changes are working properly in the FOSS project,
+under some conditions we also run:
+
+- `* as-if-foss` jobs in the same pipeline
+- Cross project downstream FOSS pipeline
+
+The `* as-if-foss` jobs run the GitLab test suite "as if FOSS", meaning as if
+the jobs would run in the context of `gitlab-org/gitlab-foss`. On the other
+hand, cross project downstream FOSS pipeline actually runs inside the FOSS
+project, which should be even closer to an actual FOSS environment.
+
+We run them in the following cases:
 
 - when the `pipeline:run-as-if-foss` label is set on the merge request
 - when the merge request is created in the `gitlab-org/security/gitlab` project
-- when any CI configuration file is changed (for example, `.gitlab-ci.yml` or `.gitlab/ci/**/*`)
+- when CI configuration file is changed (for example, `.gitlab-ci.yml` or `.gitlab/ci/**/*`)
 
-The `* as-if-foss` jobs are run in addition to the regular EE-context jobs. They have the `FOSS_ONLY='1'` variable
-set and get the `ee/` folder removed before the tests start running.
+The `* as-if-foss` jobs are run in addition to the regular EE-context jobs.
+They have the `FOSS_ONLY='1'` variable set and get the `ee/` folder removed
+before the tests start running.
 
-The intent is to ensure that a change doesn't introduce a failure after `gitlab-org/gitlab` is synced to `gitlab-org/gitlab-foss`.
+Cross project downstream FOSS pipeline simulates merging the merge request
+into the default branch in the FOSS project instead, which removes a list of
+files. The list can be found in
+[`.gitlab/ci/as-if-foss.gitlab-ci.yml`](https://gitlab.com/gitlab-org/gitlab/-/blob/215d1e27d74cbebaa787d35bf7dcabc5c34ebf86/.gitlab/ci/as-if-foss.gitlab-ci.yml#L22-30)
+and in
+[`merge-train/bin/merge-train`](https://gitlab.com/gitlab-org/merge-train/-/blob/041d942ae1b5615703b7a786982340b61620e7c5/bin/merge-train#L228-239).
 
-#### As-if-FOSS cross project downstream pipeline
+The intent is to ensure that a change doesn't introduce a failure after
+`gitlab-org/gitlab` is synced to `gitlab-org/gitlab-foss`.
 
-As an alternative to the `* as-if-foss` jobs, we can also run a cross project
-FOSS pipeline exactly in the `gitlab-org/gitlab-foss` project. We trigger it
-in the following cases:
-
-- when the `pipeline:run-as-if-foss-cross-project` label is set on the merge request
-
-This is still working-in-progress to replace the `* as-if-foss` jobs. The
-goal is to simplify pipeline rules and make it more clear about the intention.
-
-##### Tokens set in the project variables
+#### Tokens set in the project variables
 
 - `AS_IF_FOSS_TOKEN`: This is a [GitLab FOSS](https://gitlab.com/gitlab-org/gitlab-foss)
   project token with `developer` role and `write_repository` permission,
   to push generated `as-if-foss/*` branch.
+  - Note that the same name for the security project should use another token
+    from the security FOSS project, so that we never push security changes to
+    a public project.
 
 ### As-if-JH cross project downstream pipeline
 
diff --git a/doc/update/deprecations.md b/doc/update/deprecations.md
index aeb84e052d3..c7bf066c2b4 100644
--- a/doc/update/deprecations.md
+++ b/doc/update/deprecations.md
@@ -495,6 +495,40 @@ Maven versions below 3.6.3 have reached their end-of-life. Users are advised to
 
 <div class="deprecation breaking-change" data-milestone="17.0">
 
+### Deprecate Terraform CI/CD templates
+
+<div class="deprecation-notes">
+- Announced in GitLab <span class="milestone">16.9</span>
+- Removal in GitLab <span class="milestone">17.0</span> ([breaking change](https://docs.gitlab.com/ee/update/terminology.html#breaking-change))
+- To discuss this change or learn more, see the [deprecation issue](https://gitlab.com/gitlab-org/gitlab/-/issues/438010).
+</div>
+
+The Terraform CI/CD templates are deprecated and will be removed in GitLab 17.0.
+This affects the following templates:
+
+- `Terraform.gitlab-ci.yml`
+- `Terraform.latest.gitlab-ci.yml`
+- `Terraform/Base.gitlab-ci.yml`
+- `Terraform/Base.latest.gitlab-ci.yml`
+
+In GitLab 16.9, a new job is added to the templates to inform users of the deprecation.
+
+To continue using Terraform, clone the templates and [Terraform image](https://gitlab.com/gitlab-org/terraform-images),
+and maintain them as needed.
+
+As an alternative we recommend using the new OpenTofu CI/CD component on GitLab.com
+or the new OpenTofu CI/CD template on self-managed.
+CI/CD components are not yet available on GitLab self-managed,
+but [Issue #415638](https://gitlab.com/gitlab-org/gitlab/-/issues/415638)
+proposes to add this feature. If CI/CD components become available on self-managed,
+the OpenTofu CI/CD template will be removed.
+
+You can read more about the new OpenTofu CI/CD component [here](https://gitlab.com/components/opentofu).
+
+</div>
+
+<div class="deprecation breaking-change" data-milestone="17.0">
+
 ### Deprecate Windows CMD in GitLab Runner
 
 <div class="deprecation-notes">
diff --git a/doc/user/custom_roles.md b/doc/user/custom_roles.md
index d5ac9e783ed..909688630d0 100644
--- a/doc/user/custom_roles.md
+++ b/doc/user/custom_roles.md
@@ -16,33 +16,23 @@ DETAILS:
 > - Ability to create and remove a custom role with the UI [introduced](https://gitlab.com/gitlab-org/gitlab/-/issues/393235) in GitLab 16.4.
 > - Ability to use the UI to add a user to your group with a custom role, change a user's custom role, or remove a custom role from a group member [introduced](https://gitlab.com/gitlab-org/gitlab/-/issues/393239) in GitLab 16.7.
 
-Custom roles allow group Owners or instance administrators to create roles
-specific to the needs of their organization.
+Custom roles allow an organization to create user roles with the precise privileges and permissions required for that organization's needs.
 
 <i class="fa fa-youtube-play youtube" aria-hidden="true"></i>
 For a demo of the custom roles feature, see [[Demo] Ultimate Guest can view code on private repositories via custom role](https://www.youtube.com/watch?v=46cp_-Rtxps).
 
 You can discuss individual custom role and permission requests in [issue 391760](https://gitlab.com/gitlab-org/gitlab/-/issues/391760).
 
+NOTE:
+Most custom roles are considered [billable users that use a seat](#billing-and-seat-usage). When you add a user to your group with a custom role, a warning is displayed if you are about to incur additional charges for having more seats than are included in your subscription.
+
 ## Available permissions
 
 For more information on available permissions, see [custom permissions](custom_roles/abilities.md).
 
 ## Create a custom role
 
-Prerequisites:
-
-- You must be an administrator for the self-managed instance, or have the Owner
-  role in the group you are creating the custom role in.
-- The group must be in the Ultimate tier.
-- You must have:
-  - At least one private project so that you can see the effect of giving a
-    user a custom role. The project can be in the group itself
-    or one of that group's subgroups.
-  - If you are using the API to create the custom role, a [personal access token with the API scope](profile/personal_access_tokens.md#create-a-personal-access-token).
-
-You create a custom role by selecting [permissions](#available-permissions) to add
-to a base role.
+You create a custom role by adding [permissions](#available-permissions) to a base role.
 
 You can select any number of permissions. For example, you can create a custom role
 with the permission to:
@@ -55,12 +45,12 @@ with the permission to:
 
 Prerequisites:
 
-- You must have the Owner role in the group you are creating the custom role in.
+- You must have the Owner role for the group.
 
 1. On the left sidebar, select **Search or go to** and find your group.
 1. Select **Settings > Roles and Permissions**.
 1. Select **Add new role**.
-1. In **Base role to use as template**, select an existing non-custom role.
+1. In **Base role to use as template**, select an existing default role.
 1. In **Role name**, enter the custom role's title.
 1. Optional. In **Description**, enter a description for the custom role.
 1. Select the **Permissions** for the new custom role.
@@ -77,13 +67,13 @@ In **Settings > Roles and Permissions**, the list of all custom roles displays t
 
 Prerequisites:
 
-- You must be an administrator for the self-managed instance you are creating the custom role in.
+- You must be an administrator or have the Owner role for the group.
 
 1. On the left sidebar, at the bottom, select **Admin Area**.
 1. Select **Settings > Roles and Permissions**.
 1. From the top dropdown list, select the group you want to create a custom role in.
 1. Select **Add new role**.
-1. In **Base role to use as template**, select an existing non-custom role.
+1. In **Base role to use as template**, select an existing default role.
 1. In **Role name**, enter the custom role's title.
 1. Optional. In **Description**, enter a description for the custom role.
 1. Select the **Permissions** for the new custom role.
@@ -98,73 +88,64 @@ In **Settings > Roles and Permissions**, the list of all custom roles displays t
 
 To create a custom role, you can also [use the API](../api/member_roles.md#add-a-member-role-to-a-group).
 
-## Billing and seat usage
-
-When you enable a custom role for a user with the Guest role, that user has
-access to elevated permissions over the base role, and therefore:
-
-- Is considered a [billable user](../subscriptions/self_managed/index.md#billable-users) on self-managed GitLab.
-- [Uses a seat](../subscriptions/gitlab_com/index.md#how-seat-usage-is-determined) on GitLab.com.
-
-This does not apply when the user's custom role only has the `read_code` permission
-enabled. Guest users with that specific permission only are not considered billable users
-and do not use a seat.
-
-## Add a user to your group with a custom role
+## Delete the custom role
 
 Prerequisites:
 
-- You must be an administrator, or have the Owner role in the group you are creating the custom role in.
+- You must be an administrator or have the Owner role for the group.
 
-To add a user to your group with a custom role:
+You can remove a custom role from a group only if no members have that role. See [unassign a custom role from a group or project member](#unassign-a-custom-role-from-a-group-or-project-member).
 
-1. On the left sidebar, select **Search or go to** and find your group.
-1. Select **Manage > Members**.
-1. Select **Invite members**.
-1. In **Username or email address**, if the user:
-   - Has a GitLab account, enter their username.
-   - Does not have a GitLab account, enter their email address.
-1. In **Select a role**, select a static or custom role.
-1. Optional. In **Access expiration date (optional)**, enter or select a date.
-   From that date onward, the user can no longer access the group.
-1. Select **Invite**. If you invite the user by their:
-   - GitLab username, the user is added to the member list.
-   - Email address, the user receives an email invitation and is prompted to create an account.
-     If the invitation is not accepted, GitLab sends reminder emails two, five, and ten days later.
-     Unaccepted invites are automatically deleted after 90 days.
+1. On the left sidebar:
+   - For self-managed, at the bottom, select **Admin Area**.
+   - For SaaS, select **Search or go to** and find your group.
+1. Select **Settings > Roles and Permissions**.
+1. Select **Custom Roles**.
+1. In the **Actions** column, select **Delete role** (**{remove}**) and confirm.
 
-The new member with custom role and custom permissions appears on the [group's members list](group/index.md#view-group-members).
+You can also [use the API](../api/member_roles.md#remove-member-role-of-a-group) to delete a custom role. To use the API, you must know the `id` of the custom role. If you do not know this `id`, find it by making an [API request](../api/member_roles.md#list-all-member-roles-of-a-group).
 
-NOTE:
-Most custom roles are considered [billable users that use a seat](#billing-and-seat-usage). When you add a user to your group with a custom role, a warning is displayed if you are about to incur additional charges for having more seats than are included in your subscription.
+## Add a user with a custom role to your group or project
 
-### Change a member's custom role
+Prerequisites:
 
-To change a group member's custom role:
+If you are adding a user with a custom role:
 
-1. On the left sidebar, select **Search or go to** and find your group.
+- To your group, you must have the Owner role for the group.
+- To your project, you must have at least the Maintainer role for the project.
+
+To add a user with a custom role:
+
+- To a group, see [add users to a group](group/index.md#add-users-to-a-group).
+- To a project, see [add users to a project](project/members/index.md#add-users-to-a-project).
+
+If a group or project member has a custom role, the [group or project members list](group/index.md#view-group-members) displays "Custom Role" in the **Max role** column of the table.
+
+## Assign a custom role to an existing group or project member
+
+Prerequisites:
+
+If you are assigning a custom role to an existing:
+
+- Group member, you must have the Owner role for the group.
+- Project member, you must have at least the Maintainer role for the project.
+
+### Use the UI to assign a custom role
+
+1. On the left sidebar, select **Search or go to** and find your group or project.
 1. Select **Manage > Members**.
 1. Select the **Max role** dropdown list for the member you want to select a custom role for.
 1. On the **Change role** dialog, select a different custom role.
 
-### Associate a custom role with an existing group member
+### Use the API to assign a custom role
 
-You can use the API to associate a custom role with an existing group member.
-
-Prerequisites:
-
-- You must have the Owner role for the group.
-
-To associate a custom role with an existing group member, a group member with
-the Owner role:
-
-1. Invites a user as a direct member to the root group or any subgroup or project in the root
+1. Invite a user as a direct member to the root group or any subgroup or project in the root
    group's hierarchy as a Guest. At this point, this Guest user cannot see any
    code on the projects in the group or subgroup.
-1. Optional. If the Owner does not know the `id` of the Guest user receiving a custom
-   role, finds that `id` by making an [API request](../api/member_roles.md#list-all-member-roles-of-a-group).
-
-1. Associates the member with the Guest+1 role using the [Group and Project Members API endpoint](../api/members.md#edit-a-member-of-a-group-or-project)
+1. Optional. If you do not know the `id` of the Guest user receiving a custom
+   role, find that `id` by making an [API request](../api/member_roles.md#list-all-member-roles-of-a-group).
+1. Use the [Group and Project Members API endpoint](../api/members.md#edit-a-member-of-a-group-or-project) to 
+   associate the member with the Guest+1 role:
 
    ```shell
    # to update a project membership
@@ -182,27 +163,33 @@ the Owner role:
 
    Now the Guest+1 user can view code on all projects associated with this membership.
 
-## Remove a custom role
+## Unassign a custom role from a group or project member
 
 Prerequisites:
 
-- You must be an administrator, or have the Owner role in the group you are removing the custom role from.
+If you are unassigning a custom role from a:
 
-You can remove a custom role from a group only if no group members have that role.
+- Group member, you must have the Owner role for the group.
+- Project member, you must have at least the Maintainer role for the project.
 
-To do this, you can either remove the custom role from all group members with that custom role, or remove those members from the group.
+You can remove a custom role from a group or project only if no group or project members have that role. To do this, you can use one of the following methods:
 
-### Remove a custom role from a group member
+- Remove a member with a custom role from a [group](group/index.md#remove-a-member-from-the-group) or [project](project/members/index.md#remove-a-member-from-a-project).
+- [Use the UI to change the user role](#use-the-ui-to-change-user-role).
+- [Use the API to change the user role](#use-the-api-to-change-user-role).
+
+### Use the UI to change user role
 
 To remove a custom role from a group member:
 
 1. On the left sidebar, select **Search or go to** and find your group.
 1. Select **Manage > Members**.
 1. Select the **Max role** dropdown list for the member you want to remove a custom role from.
-1. On the **Change role** dialog, select a static role.
+1. On the **Change role** dialog, select a default role.
 
-You can also use the [Group and Project Members API endpoint](../api/members.md#edit-a-member-of-a-group-or-project)
-to update or remove a custom role from a group member by passing an empty `member_role_id` value:
+### Use the API to change user role
+
+You can also use the [Group and Project Members API endpoint](../api/members.md#edit-a-member-of-a-group-or-project) to update or remove a custom role from a group member by passing an empty `member_role_id` value:
 
 ```shell
 # to update a project membership
@@ -212,28 +199,17 @@ curl --request PUT --header "Content-Type: application/json" --header "Authoriza
 curl --request PUT --header "Content-Type: application/json" --header "Authorization: Bearer <your_access_token>" --data '{"member_role_id": null, "access_level": 10}' "https://gitlab.example.com/api/v4/groups/<group_id>/members/<user_id>"
 ```
 
-### Remove a group member with a custom role from the group
+## Billing and seat usage
 
-1. On the left sidebar, select **Search or go to** and find your group.
-1. Select **Manage > Members**.
-1. On the member row you want to remove, select the vertical ellipsis
-   (**{ellipsis_v}**) and select **Remove member**.
-1. In the **Remove member** confirmation dialog, do not select any checkboxes.
-1. Select **Remove member**.
+When you enable a custom role for a user with the Guest role, that user has
+access to elevated permissions over the base role, and therefore:
 
-### Delete the custom role
+- Is considered a [billable user](../subscriptions/self_managed/index.md#billable-users) on self-managed GitLab.
+- [Uses a seat](../subscriptions/gitlab_com/index.md#how-seat-usage-is-determined) on GitLab.com.
 
-After you have made sure no group members have that custom role, delete the
-custom role.
-
-1. On the left sidebar, at the bottom, select **Admin Area**.
-1. Select **Settings > Roles and Permissions**.
-1. Select **Custom Roles**.
-1. In the **Actions** column, select **Delete role** (**{remove}**) and confirm.
-
-To delete a custom role, you can also [use the API](../api/member_roles.md#remove-member-role-of-a-group).
-To use the API, you must know the `id` of the custom role. If you do not know this
-`id`, find it by making an [API request](../api/member_roles.md#list-all-member-roles-of-a-group).
+This does not apply when the user's custom role only has the `read_code` permission
+enabled. Guest users with that specific permission only are not considered billable users
+and do not use a seat.
 
 ## Known issues
 
diff --git a/doc/user/gitlab_com/index.md b/doc/user/gitlab_com/index.md
index 62567fa34a9..9093d62dbd6 100644
--- a/doc/user/gitlab_com/index.md
+++ b/doc/user/gitlab_com/index.md
@@ -363,7 +363,8 @@ after the limits change in January, 2021:
 | **GitLab Pages** TLS connections (for a given **GitLab Pages domain**)     |                               | **400** requests per **10 seconds**  |
 | **Pipeline creation** requests (for a given **project, user, and commit**) |                               | **25** requests per minute           |
 | **Alert integration endpoint** requests (for a given **project**)          |                               | **3600** requests per hour           |
-| **[Pull mirroring](../project/repository/mirror/pull.md)** intervals       | **5** minutes                 | **5** minutes |
+| **[Pull mirroring](../project/repository/mirror/pull.md)** intervals       | **5** minutes                 | **5** minutes                        |
+| **API Requests** (from a given **user**) to `/api/v4/users/:id`            |                               | **300** requests per **10 minutes**  |
 
 More details are available on the rate limits for
 [protected paths](#protected-paths-throttle) and
diff --git a/doc/user/group/index.md b/doc/user/group/index.md
index e83a1ec011f..2863928a7e5 100644
--- a/doc/user/group/index.md
+++ b/doc/user/group/index.md
@@ -306,7 +306,7 @@ Prerequisites:
    - Has a GitLab account, enter the user's username.
    - Doesn't have a GitLab account, enter the user's email address.
 
-1. Select a [role](../permissions.md).
+1. Select a [default role](../permissions.md) or [custom role](../custom_roles.md).
 1. Optional. For **Access expiration date**, enter or select a date.
    From that date onward, the user can no longer access the project.
 
diff --git a/doc/user/group/manage.md b/doc/user/group/manage.md
index 6d566eced79..95cce896d04 100644
--- a/doc/user/group/manage.md
+++ b/doc/user/group/manage.md
@@ -114,46 +114,43 @@ for the group's projects to meet your group's needs.
 > - [Generally available](https://gitlab.com/gitlab-org/gitlab/-/issues/352526) in GitLab 14.9. [Feature flag `invite_members_group_modal`](https://gitlab.com/gitlab-org/gitlab/-/issues/352526) removed.
 
 Similar to how you [share a project with a group](../project/members/share_project_with_groups.md),
-you can share a group with another group. To invite a group, you must be a member of it.
-To share a given group, for example, `Frontend` with another group, for example,
-`Engineering`:
+you can share a group with another group by invitation. To invite a group, you must be a member of the inviting group.
 
-1. Go to the `Frontend` group.
+To invite a group to your group:
+
+1. On the left sidebar, select **Search or go to** and find your group.
 1. Select **Manage > Members**.
 1. Select **Invite a group**.
-1. In the **Select a group to invite** list, select `Engineering`.
+1. In the **Select a group to invite** list, select the group you want to invite.
 1. Select a [role](../permissions.md) as maximum access level.
 1. Select **Invite**.
 
-After sharing the `Frontend` group with the `Engineering` group:
+After inviting a group to your group:
 
-- The **Groups** tab lists the `Engineering` group.
-- The **Groups** tab lists a group regardless of whether it is a public or private group.
+- The **Groups** tab lists the invited group. This list includes both public and private groups.
 - From [GitLab 16.6](https://gitlab.com/gitlab-org/gitlab/-/merge_requests/134623),
-  the invited group's name and membership source will be masked unless:
-  - the invited group is public, or
-  - the current user is a member of the invited group, or
-  - the current user is a member of the current group.
-- All direct members of the `Engineering` group have access to the `Frontend` group. The least access is granted between the access in the `Engineering` group and the access in the `Frontend` group.
-  - If `Member1` has the Maintainer role in `Engineering` and `Engineering` is added to `Frontend` with the Developer role, `Member1` has the Developer role in `Frontend`.
-  - If `Member2` has the Guest role in `Engineering` and `Engineering` is added to `Frontend` with the Developer role, `Member2` has the Guest role in `Frontend`.
-- Inherited members of the `Engineering` group do not gain access to the `Frontend` group.
-- Direct members of the `Engineering` group who have the **Group Invite** badge next to their profile on the group's usage quota page count towards the billable members of the `Frontend` group.
+  the invited group's name and membership source are masked, unless either:
+  - The invited group is public.
+  - The current user is a member of the invited group.
+  - The current user is a member of the current group.
+- All direct members of the invited group have access to the inviting group. The least access is granted between the access in the invited group and the access in the inviting group.
+  For example, if a member has the Maintainer role in the invited group, and that group is invited with the Developer role, the member has the Developer role in the inviting group.
+- Inherited members of the invited group do not gain access to the inviting group.
+- Direct members of the invited group who have the **Group Invite** badge next to their profile on the group's usage quota page count towards the billable members of the inviting group.
 
-## Remove a shared group
+## Remove an invited group
 
-To unshare a group:
+To remove an invited group:
 
 1. On the left sidebar, select **Search or go to** and find your group.
 1. Select **Manage > Members**.
 1. Select the **Groups** tab.
 1. To the right of the account you want to remove, select **Remove group** (**{remove}**).
 
-For example, if the `Engineering` group is shared with the `Frontend` group, when
-you unshare the `Engineering` group:
+For example, when you remove the invited group from your group:
 
-- All direct members of the `Engineering` group no longer have access to the `Frontend` group.
-- Members of the `Engineering` group no longer count towards the billable members of the `Frontend` group.
+- All direct members of the invited group no longer have access to the inviting group.
+- Members of the invited group no longer count towards the billable members of the inviting group.
 
 ## Transfer a group
 
diff --git a/doc/user/project/members/index.md b/doc/user/project/members/index.md
index 455d737820a..8c29d9b1116 100644
--- a/doc/user/project/members/index.md
+++ b/doc/user/project/members/index.md
@@ -75,7 +75,7 @@ To add a user to a project:
    - Has a GitLab account, enter their username.
    - Doesn't have a GitLab account, enter their email address.
 
-1. Select a [role](../../permissions.md).
+1. Select a [default role](../../permissions.md) or [custom role](../../custom_roles.md).
 1. Optional. Select an **Access expiration date**.
    From that date onward, the user can no longer access the project.
 
diff --git a/lib/gitlab/ci/config/entry/job.rb b/lib/gitlab/ci/config/entry/job.rb
index 7ea4b460640..74edf814803 100644
--- a/lib/gitlab/ci/config/entry/job.rb
+++ b/lib/gitlab/ci/config/entry/job.rb
@@ -121,7 +121,7 @@ module Gitlab
             inherit: false
 
           entry :id_tokens, ::Gitlab::Config::Entry::ComposableHash,
-            description: 'Configured JWTs for this job',
+            description: 'Configured JWTs for this job.',
             inherit: true,
             metadata: { composable_class: ::Gitlab::Ci::Config::Entry::IdToken }
 
diff --git a/lib/gitlab/ci/templates/OpenTofu.latest.gitlab-ci.yml b/lib/gitlab/ci/templates/OpenTofu.latest.gitlab-ci.yml
new file mode 100644
index 00000000000..7932b2801bb
--- /dev/null
+++ b/lib/gitlab/ci/templates/OpenTofu.latest.gitlab-ci.yml
@@ -0,0 +1,30 @@
+# This template is a port of the OpenTofu CI/CD component at
+# https://gitlab.com/components/opentofu
+# It is generated with the `make backports` command from that project.
+#
+# Please make sure to use the component when your project is hosted on GitLab.com
+# or when you are willing to mirror the component project into your self-managed
+# instance and use it from there.
+#
+# Attention: This template will be removed in favor of the OpenTofu CI/CD component as soon as components
+#            are available for self-managed instances.
+#
+# This specific template is located at:
+# https://gitlab.com/gitlab-org/gitlab/-/blob/master/lib/gitlab/ci/templates/OpenTofu.latest.gitlab-ci.yml
+
+include:
+  - template: OpenTofu/Base.latest.gitlab-ci.yml  # https://gitlab.com/gitlab-org/gitlab/blob/master/lib/gitlab/ci/templates/OpenTofu/Base.latest.gitlab-ci.yml
+
+stages: [validate, build, deploy]
+
+fmt:
+  extends: .opentofu:fmt
+
+validate:
+  extends: .opentofu:validate
+
+plan:
+  extends: .opentofu:plan
+
+apply:
+  extends: .opentofu:apply
diff --git a/lib/gitlab/ci/templates/OpenTofu/Base.latest.gitlab-ci.yml b/lib/gitlab/ci/templates/OpenTofu/Base.latest.gitlab-ci.yml
new file mode 100644
index 00000000000..5600b234b1d
--- /dev/null
+++ b/lib/gitlab/ci/templates/OpenTofu/Base.latest.gitlab-ci.yml
@@ -0,0 +1,169 @@
+# This template is a port of the OpenTofu CI/CD component at
+# https://gitlab.com/components/opentofu
+# It is generated with the `make backports` command from that project.
+#
+# Please make sure to use the component (https://gitlab.com/components/opentofu)
+# when your project is hosted on GitLab.com
+# or when you are willing to mirror the component project into your self-managed
+# instance and use it from there.
+#
+# Attention: This template will be removed in favor of the OpenTofu CI/CD component following components
+#            are available for self-managed instances.
+#
+# This specific template is located at:
+# https://gitlab.com/gitlab-org/gitlab/-/blob/master/lib/gitlab/ci/templates/OpenTofu/Base.latest.gitlab-ci.yml
+
+variables:
+  # OpenTofu CI/CD component version, see https://gitlab.com/components/opentofu/-/releases
+  VERSION: "latest"
+  # Compatible OpenTofu version, see https://gitlab.com/components/opentofu/-/releases
+  OPENTOFU_VERSION: "1.6.0"
+  # Job Image with `gitlab-tofu`
+  GITLAB_OPENTOFU_IMAGE_REGISTRY_BASE: $CI_REGISTRY/components/opentofu
+  # The relative path to the root directory of the OpenTofu project
+  TF_ROOT: ${CI_PROJECT_DIR}
+  # The name of the state file used by the GitLab Managed Terraform state backend
+  TF_STATE_NAME: default
+
+opentofu:use-component-instead-of-template:
+  stage: .pre
+  needs: []
+  allow_failure: true
+  rules:
+    - if: '$CI_SERVER_HOST == "gitlab.com"'
+  image: alpine:3.19
+  script:
+    - |
+      echo "You are using the OpenTofu CI/CD template on GitLab.com, which is not recommended."
+      echo "This template is available for self-managed users only until CI/CD components are "
+      echo "available. See https://gitlab.com/gitlab-org/gitlab/-/issues/415638"
+      echo " "
+      echo "You should use the OpenTofu CI/CD component instead."
+      echo "To include the CI/CD component with a default configuration:"
+      echo " "
+      echo "include:"
+      echo "  - component: gitlab.com/components/opentofu/full-pipeline@<VERSION>"
+      echo "    inputs:"
+      echo "      version: <VERSION>"
+      echo "      opentofu_version: 1.6.0"
+      echo ""
+      echo "stages: [validate, build, deploy, cleanup]"
+      echo " "
+      echo "You can read about more about the OpenTofu CI/CD component here:"
+      echo "https://gitlab.com/components/opentofu"
+    - 'false'
+
+'.opentofu:fmt':
+  stage: validate
+  needs: []
+  rules:
+    - if: $CI_PIPELINE_SOURCE == "merge_request_event"
+    - if: $CI_OPEN_MERGE_REQUESTS  # Don't add it to a *branch* pipeline if it's already in a merge request pipeline.
+      when: never
+    - if: $CI_COMMIT_BRANCH        # If there's no open merge request, add it to a *branch* pipeline instead.
+  #allow_failure: true
+  allow_failure: true
+  cache:
+    key: "$TF_ROOT"
+    paths:
+      - $TF_ROOT/.terraform/
+  image:
+    name: '$GITLAB_OPENTOFU_IMAGE_REGISTRY_BASE/gitlab-opentofu:$GITLAB_OPENTOFU_VERSION-opentofu$OPENTOFU_VERSION'
+  script:
+    - gitlab-tofu fmt
+
+'.opentofu:validate':
+  stage: validate
+  rules:
+    - if: $CI_PIPELINE_SOURCE == "merge_request_event"
+    - if: $CI_OPEN_MERGE_REQUESTS  # Don't add it to a *branch* pipeline if it's already in a merge request pipeline.
+      when: never
+    - if: $CI_COMMIT_BRANCH        # If there's no open merge request, add it to a *branch* pipeline instead.
+  cache:
+    key: "$TF_ROOT"
+    paths:
+      - $TF_ROOT/.terraform/
+  image:
+    name: '$GITLAB_OPENTOFU_IMAGE_REGISTRY_BASE/gitlab-opentofu:$GITLAB_OPENTOFU_VERSION-opentofu$OPENTOFU_VERSION'
+  script:
+    - gitlab-tofu validate
+
+'.opentofu:plan':
+  stage: build
+  environment:
+    name: $TF_STATE_NAME
+    action: prepare
+  resource_group: $TF_STATE_NAME
+  artifacts:
+    # Terraform's cache files can include secrets which can be accidentally exposed.
+    # Please exercise caution when utilizing secrets in your Terraform infrastructure and
+    # consider limiting access to artifacts or take other security measures to protect sensitive information.
+    #
+    # The next line, which disables public access to pipeline artifacts, is not available on GitLab.com.
+    # See: https://docs.gitlab.com/ee/ci/yaml/#artifactspublic
+    public: false
+    paths:
+      - $TF_ROOT/plan.cache
+    reports:
+      terraform: $TF_ROOT/plan.json
+  rules:
+    - if: $CI_PIPELINE_SOURCE == "merge_request_event"
+    - if: $CI_OPEN_MERGE_REQUESTS  # Don't add it to a *branch* pipeline if it's already in a merge request pipeline.
+      when: never
+    - if: $CI_COMMIT_BRANCH        # If there's no open merge request, add it to a *branch* pipeline instead.
+  cache:
+    key: "$TF_ROOT"
+    paths:
+      - $TF_ROOT/.terraform/
+  image:
+    name: '$GITLAB_OPENTOFU_IMAGE_REGISTRY_BASE/gitlab-opentofu:$GITLAB_OPENTOFU_VERSION-opentofu$OPENTOFU_VERSION'
+  script:
+    - gitlab-tofu plan
+    - gitlab-tofu plan-json
+
+'.opentofu:apply':
+  stage: deploy
+  environment:
+    name: $TF_STATE_NAME
+    action: start
+  resource_group: $TF_STATE_NAME
+  rules:
+    - if: '$CI_COMMIT_BRANCH == $CI_DEFAULT_BRANCH && "$_TF_AUTO_APPLY" == "true"'
+    - if: $CI_COMMIT_BRANCH == $CI_DEFAULT_BRANCH
+      when: manual
+  cache:
+    key: "$TF_ROOT"
+    paths:
+      - $TF_ROOT/.terraform/
+  image:
+    name: '$GITLAB_OPENTOFU_IMAGE_REGISTRY_BASE/gitlab-opentofu:$GITLAB_OPENTOFU_VERSION-opentofu$OPENTOFU_VERSION'
+  script:
+    - gitlab-tofu apply
+
+'.opentofu:destroy':
+  stage: cleanup
+  environment:
+    name: $TF_STATE_NAME
+    action: stop
+  resource_group: $TF_STATE_NAME
+  rules:
+    - if: '$CI_COMMIT_BRANCH == $CI_DEFAULT_BRANCH && "$_TF_AUTO_DESTROY" == "true"'
+    - when: manual
+  cache:
+    key: "$TF_ROOT"
+    paths:
+      - $TF_ROOT/.terraform/
+  image:
+    name: '$GITLAB_OPENTOFU_IMAGE_REGISTRY_BASE/gitlab-opentofu:$GITLAB_OPENTOFU_VERSION-opentofu$OPENTOFU_VERSION'
+  script:
+    - gitlab-tofu destroy
+
+'.opentofu:delete-state':
+  stage: cleanup
+  resource_group: $TF_STATE_NAME
+  image: curlimages/curl:latest
+  script:
+    - curl --request DELETE -u "gitlab-ci-token:$CI_JOB_TOKEN" "$CI_API_V4_URL/projects/$CI_PROJECT_ID/terraform/state/$TF_STATE_NAME"
+  rules:
+    - if: '$CI_COMMIT_BRANCH == $CI_DEFAULT_BRANCH'
+    - when: manual
diff --git a/lib/gitlab/ci/templates/Terraform/Base.gitlab-ci.yml b/lib/gitlab/ci/templates/Terraform/Base.gitlab-ci.yml
index 87d0894b67a..cb0790240cb 100644
--- a/lib/gitlab/ci/templates/Terraform/Base.gitlab-ci.yml
+++ b/lib/gitlab/ci/templates/Terraform/Base.gitlab-ci.yml
@@ -20,6 +20,24 @@ cache:
   paths:
     - ${TF_ROOT}/.terraform/
 
+'deprecated-and-will-be-removed-in-17.0':
+  stage: .pre
+  needs: []
+  allow_failure: true
+  image: alpine:3.19
+  script:
+    - |
+      echo "You are using the Terraform CI/CD template, which is deprecated and will be removed in GitLab 17.0."
+      echo "GitLab provides an alternative OpenTofu CI/CD component for GitLab.com users."
+      echo "Self-managed users should use the OpenTofu CI/CD template, which will be removed after "
+      echo "CI/CD components are available on GitLab self-managed."
+      echo "You can read about more about the OpenTofu CI/CD component here:"
+      echo "https://gitlab.com/components/opentofu"
+      echo " "
+      echo "Alternatively, you can continue building the Terraform templates and "
+      echo "accompanying image (see https://gitlab.com/gitlab-org/terraform-images) yourself and use them as before."
+    - 'false'
+
 .terraform:fmt:
   stage: validate
   script:
diff --git a/lib/gitlab/ci/templates/Terraform/Base.latest.gitlab-ci.yml b/lib/gitlab/ci/templates/Terraform/Base.latest.gitlab-ci.yml
index 0ba4f9715c5..7308e699c22 100644
--- a/lib/gitlab/ci/templates/Terraform/Base.latest.gitlab-ci.yml
+++ b/lib/gitlab/ci/templates/Terraform/Base.latest.gitlab-ci.yml
@@ -22,6 +22,24 @@ variables:
   TF_ROOT: ${CI_PROJECT_DIR}  # The relative path to the root directory of the Terraform project
   TF_STATE_NAME: default      # The name of the state file used by the GitLab Managed Terraform state backend
 
+'deprecated-and-will-be-removed-in-17.0':
+  stage: .pre
+  needs: []
+  allow_failure: true
+  image: alpine:3.19
+  script:
+    - |
+      echo "You are using the Terraform CI/CD template, which is deprecated and will be removed in GitLab 17.0."
+      echo "GitLab provides an alternative OpenTofu CI/CD component for GitLab.com users."
+      echo "Self-managed users should use the OpenTofu CI/CD template, which will be removed after "
+      echo "CI/CD components are available on GitLab self-managed."
+      echo "You can read about more about the OpenTofu CI/CD component here:"
+      echo "https://gitlab.com/components/opentofu"
+      echo " "
+      echo "Alternatively, you can continue building the Terraform templates and "
+      echo "accompanying image (see https://gitlab.com/gitlab-org/terraform-images) yourself and use them as before."
+    - 'false'
+
 .terraform:fmt:
   stage: validate
   script:
diff --git a/lib/gitlab/ci/yaml_processor/feature_flags.rb b/lib/gitlab/ci/yaml_processor/feature_flags.rb
index 50d37f6e4a0..5a2fa7c8bc4 100644
--- a/lib/gitlab/ci/yaml_processor/feature_flags.rb
+++ b/lib/gitlab/ci/yaml_processor/feature_flags.rb
@@ -27,8 +27,8 @@ module Gitlab
           end
 
           # Use this to check if a feature flag is enabled
-          def enabled?(feature_flag)
-            ::Feature.enabled?(feature_flag, current_actor)
+          def enabled?(feature_flag, type: :development)
+            ::Feature.enabled?(feature_flag, current_actor, type: type)
           end
 
           def ensure_correct_usage
diff --git a/locale/gitlab.pot b/locale/gitlab.pot
index 4b07a1aa6cf..24f1e6a6ff3 100644
--- a/locale/gitlab.pot
+++ b/locale/gitlab.pot
@@ -1318,9 +1318,6 @@ msgstr ""
 msgid "%{user_name} (%{user_username}) was removed from the following escalation policies in %{project}:"
 msgstr ""
 
-msgid "%{user_name} profile page"
-msgstr ""
-
 msgid "%{username} has asked for a GitLab account on your instance %{host}:"
 msgstr ""
 
@@ -8578,6 +8575,9 @@ msgstr ""
 msgid "Bot"
 msgstr ""
 
+msgid "Bot comments"
+msgstr ""
+
 msgid "Both SSH and HTTP(S)"
 msgstr ""
 
@@ -9346,9 +9346,6 @@ msgstr ""
 msgid "Buy more Pipeline minutes"
 msgstr ""
 
-msgid "By %{user_name}"
-msgstr ""
-
 msgid "By default, all projects and groups use the global notifications setting."
 msgstr ""
 
diff --git a/package.json b/package.json
index 3a758ebafe4..6c10c563903 100644
--- a/package.json
+++ b/package.json
@@ -10,7 +10,7 @@
     "internal:eslint": "eslint --cache --max-warnings 0 --report-unused-disable-directives --ext .js,.vue,.graphql",
     "internal:stylelint": "stylelint -q --rd '{ee/,}app/assets/stylesheets/**/*.{css,scss}'",
     "prejest": "yarn check-dependencies",
-    "build:css": "node ./scripts/frontend/compile_css.mjs",
+    "build:css": "node scripts/frontend/build_css.mjs",
     "jest": "jest --config jest.config.js",
     "jest-debug": "node --inspect-brk node_modules/.bin/jest --runInBand",
     "jest:ci": "jest --config jest.config.js --ci --coverage --testSequencer ./scripts/frontend/parallel_ci_sequencer.js",
diff --git a/scripts/frontend/build_css.mjs b/scripts/frontend/build_css.mjs
new file mode 100755
index 00000000000..bc07362c3f9
--- /dev/null
+++ b/scripts/frontend/build_css.mjs
@@ -0,0 +1,13 @@
+#!/usr/bin/env node
+
+import process from 'node:process';
+/* eslint-disable import/extensions */
+import { compileAllStyles } from './lib/compile_css.mjs';
+/* eslint-enable import/extensions */
+
+const fileWatcher = await compileAllStyles({ shouldWatch: process.argv?.includes('--watch') });
+
+process.on('SIGTERM', () => {
+  console.info('SIGTERM signal received.');
+  fileWatcher?.close();
+});
diff --git a/scripts/frontend/compile_css.mjs b/scripts/frontend/lib/compile_css.mjs
old mode 100755
new mode 100644
similarity index 76%
rename from scripts/frontend/compile_css.mjs
rename to scripts/frontend/lib/compile_css.mjs
index 433c9117f81..64d694c4371
--- a/scripts/frontend/compile_css.mjs
+++ b/scripts/frontend/lib/compile_css.mjs
@@ -1,18 +1,16 @@
-#!/usr/bin/env node
-
-import { existsSync, mkdirSync, writeFileSync } from 'node:fs';
+import { mkdir, writeFile } from 'node:fs/promises';
 import { fileURLToPath } from 'node:url';
 import path from 'node:path';
-import { argv } from 'node:process';
+import { env } from 'node:process';
 import { compile, Logger } from 'sass';
 import glob from 'glob';
 /* eslint-disable import/extensions */
-import IS_EE from '../../config/helpers/is_ee_env.js';
-import IS_JH from '../../config/helpers/is_jh_env.js';
+import IS_EE from '../../../config/helpers/is_ee_env.js';
+import IS_JH from '../../../config/helpers/is_jh_env.js';
 /* eslint-enable import/extensions */
 
 // Note, in node > 21.2 we could replace the below with import.meta.dirname
-const ROOT_PATH = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '../../');
+const ROOT_PATH = path.resolve(path.dirname(fileURLToPath(import.meta.url)), '../../../');
 const OUTPUT_PATH = path.join(ROOT_PATH, 'app/assets/builds/');
 
 const BASE_PATH = 'app/assets/stylesheets';
@@ -166,14 +164,7 @@ function resolveCompilationTargets() {
   return Object.fromEntries([...result.entries()].map((entry) => entry.reverse()));
 }
 
-function writeContentToFile(content, srcFile, outputFile) {
-  if (!existsSync(path.dirname(outputFile))) {
-    mkdirSync(path.dirname(outputFile), { recursive: true });
-  }
-  writeFileSync(outputFile, content.css);
-}
-
-async function compileAllStyles() {
+export async function compileAllStyles({ shouldWatch = false }) {
   const reverseDependencies = {};
 
   const compilationTargets = resolveCompilationTargets();
@@ -184,38 +175,81 @@ async function compileAllStyles() {
   };
 
   let fileWatcher = null;
-  if (argv?.includes('--watch')) {
+  if (shouldWatch) {
     const { watch } = await import('chokidar');
     fileWatcher = watch([]);
   }
 
-  function compileSCSSFile(source, dest) {
+  async function compileSCSSFile(source, dest) {
     console.log(`\tcompiling source ${source} to ${dest}`);
     const content = compile(source, sassCompilerOptions);
     if (fileWatcher) {
       for (const dependency of content.loadedUrls) {
         if (dependency.protocol === 'file:') {
-          reverseDependencies[dependency.pathname] ||= new Set();
-          reverseDependencies[dependency.pathname].add(source);
-          fileWatcher.add(dependency.pathname);
+          const dependencyPath = fileURLToPath(dependency);
+          reverseDependencies[dependencyPath] ||= new Set();
+          reverseDependencies[dependencyPath].add(source);
+          fileWatcher.add(dependencyPath);
         }
       }
     }
-    writeContentToFile(content, source, dest);
+    // Create target folder if it doesn't exist
+    await mkdir(path.dirname(dest), { recursive: true });
+    return writeFile(dest, content.css, 'utf-8');
   }
 
   if (fileWatcher) {
-    fileWatcher.on('change', (changedFile) => {
+    fileWatcher.on('change', async (changedFile) => {
       console.warn(`${changedFile} changed, recompiling`);
+      const recompile = [];
       for (const source of reverseDependencies[changedFile]) {
-        compileSCSSFile(source, compilationTargets[source]);
+        recompile.push(compileSCSSFile(source, compilationTargets[source]));
       }
+      await Promise.all(recompile);
     });
   }
 
-  for (const [source, dest] of Object.entries(compilationTargets)) {
-    compileSCSSFile(source, dest);
-  }
+  const initialCompile = Object.entries(compilationTargets).map(([source, dest]) =>
+    compileSCSSFile(source, dest),
+  );
+
+  await Promise.all(initialCompile);
+
+  return fileWatcher;
 }
 
-await compileAllStyles();
+function shouldUseNewPipeline() {
+  return /^(true|t|yes|y|1|on)$/i.test(`${env.USE_NEW_CSS_PIPELINE}`);
+}
+
+export function viteCSSCompilerPlugin() {
+  if (!shouldUseNewPipeline()) {
+    return null;
+  }
+  let fileWatcher = null;
+  return {
+    name: 'gitlab-css-compiler',
+    async configureServer() {
+      fileWatcher = await compileAllStyles({ shouldWatch: true });
+    },
+    buildEnd() {
+      return fileWatcher?.close();
+    },
+  };
+}
+
+export function simplePluginForNodemon({ shouldWatch = true }) {
+  if (!shouldUseNewPipeline()) {
+    return null;
+  }
+  let fileWatcher = null;
+  return {
+    async start() {
+      await fileWatcher?.close();
+      fileWatcher = await compileAllStyles({ shouldWatch });
+    },
+    stop() {
+      return fileWatcher?.close();
+    },
+  };
+}
diff --git a/scripts/frontend/webpack_dev_server.js b/scripts/frontend/webpack_dev_server.js
index ae73c14b501..296d0058b1a 100755
--- a/scripts/frontend/webpack_dev_server.js
+++ b/scripts/frontend/webpack_dev_server.js
@@ -47,6 +47,8 @@ else {
   });
 }
 
+let plugin = false;
+
 // print useful messages for nodemon events
 nodemon
   .on('start', () => {
@@ -56,11 +58,20 @@ nodemon
       console.log('The JavaScript assets are recompiled only if they change');
       console.log('If you change them often, you might want to unset DEV_SERVER_STATIC');
     }
+    /* eslint-disable import/extensions, promise/catch-or-return */
+    import('./lib/compile_css.mjs').then(({ simplePluginForNodemon }) => {
+      plugin = simplePluginForNodemon({ shouldWatch: !STATIC_MODE });
+      return plugin?.start();
+    });
+    /* eslint-enable import/extensions, promise/catch-or-return */
   })
   .on('quit', () => {
+    console.log('Shutting down CSS compilation process');
+    plugin?.stop();
     console.log('Shutting down webpack process');
     process.exit();
   })
   .on('restart', (files) => {
     console.log('Restarting webpack process due to: ', files);
+    plugin?.start();
   });
diff --git a/scripts/rspec_helpers.sh b/scripts/rspec_helpers.sh
index b0dc3bf2925..f42e7bbcfb7 100644
--- a/scripts/rspec_helpers.sh
+++ b/scripts/rspec_helpers.sh
@@ -232,7 +232,8 @@ function rspec_parallelized_job() {
   read -ra job_name <<< "${CI_JOB_NAME}"
   local test_tool="${job_name[0]}"
   local test_level="${job_name[1]}"
-  local report_name=$(echo "${CI_JOB_NAME}" | sed -E 's|[/ ]|_|g') # e.g. 'rspec unit pg13 1/24' would become 'rspec_unit_pg13_1_24'
+  # e.g. 'rspec unit pg13 1/24 278964' would become 'rspec_unit_pg13_1_24_278964'
+  local report_name=$(echo "${CI_JOB_NAME} ${CI_PROJECT_ID}" | sed -E 's|[/ ]|_|g')
   local rspec_opts="${1:-}"
   local rspec_tests_mapping_enabled="${RSPEC_TESTS_MAPPING_ENABLED:-}"
   local spec_folder_prefixes=""
@@ -311,7 +312,6 @@ function retry_failed_rspec_examples() {
 
   # Keep track of the tests that are retried, later consolidated in a single file by the `rspec:flaky-tests-report` job
   local failed_examples=$(grep " failed" ${RSPEC_LAST_RUN_RESULTS_FILE})
-  local report_name=$(echo "${CI_JOB_NAME}" | sed -E 's|[/ ]|_|g') # e.g. 'rspec unit pg13 1/24' would become 'rspec_unit_pg13_1_24'
   echoinfo "RSPEC_RETRIED_TESTS_REPORT_PATH: ${RSPEC_RETRIED_TESTS_REPORT_PATH:-}"
 
   echo "${CI_JOB_URL}" > "${RSPEC_RETRIED_TESTS_REPORT_PATH:-}"
diff --git a/scripts/setup/generate-as-if-foss-env.rb b/scripts/setup/generate-as-if-foss-env.rb
index 21f1822503c..35fc4dfe449 100755
--- a/scripts/setup/generate-as-if-foss-env.rb
+++ b/scripts/setup/generate-as-if-foss-env.rb
@@ -23,7 +23,9 @@ class GenerateAsIfFossEnv
   ]).freeze
 
   def initialize
-    @client = Gitlab.client(endpoint: ENV['CI_API_V4_URL'], private_token: '')
+    @client = Gitlab.client(
+      endpoint: ENV['CI_API_V4_URL'],
+      private_token: ENV['PROJECT_TOKEN_FOR_CI_SCRIPTS_API_USAGE'] || '')
     @rspec_jobs = Set.new
     @other_jobs = Set.new
   end
@@ -64,9 +66,13 @@ class GenerateAsIfFossEnv
   end
 
   def detect_rspec(job)
-    rspec_type = job.name[/^rspec(?:-all)? ([\w\-]+)/, 1]
+    rspec_type = job.name[%r{^rspec(?:-all)? ([\w\-]+)}, 1]
 
-    rspec_jobs << rspec_type if rspec_type
+    return unless rspec_type
+
+    rspec_kind = job.name[%r{pg\d+ ([\w\-]+)(?: \d+/\d+)?$}, 1]
+    rspec_jobs << rspec_type
+    rspec_jobs << rspec_kind if rspec_kind
   end
 
   def detect_other_jobs(job)
diff --git a/spec/controllers/projects/blob_controller_spec.rb b/spec/controllers/projects/blob_controller_spec.rb
index 7811ef3bade..0c431d217b9 100644
--- a/spec/controllers/projects/blob_controller_spec.rb
+++ b/spec/controllers/projects/blob_controller_spec.rb
@@ -14,12 +14,6 @@ RSpec.describe Projects::BlobController, feature_category: :source_code_manageme
       get(:show, params: params)
     end
 
-    let(:redirect_with_ref_type) { true }
-
-    before do
-      stub_feature_flags(redirect_with_ref_type: redirect_with_ref_type)
-    end
-
     render_views
 
     context 'with file path' do
@@ -34,40 +28,27 @@ RSpec.describe Projects::BlobController, feature_category: :source_code_manageme
         let(:path) { 'README.md' }
         let(:id) { "#{ref}/#{path}" }
 
-        context 'and the redirect_with_ref_type flag is disabled' do
-          let(:redirect_with_ref_type) { false }
+        it_behaves_like '#set_is_ambiguous_ref when ref is ambiguous'
 
-          it_behaves_like '#set_is_ambiguous_ref when ref is ambiguous'
+        context 'and explicitly requesting a branch' do
+          let(:ref_type) { 'heads' }
 
-          context 'and explicitly requesting a branch' do
-            let(:ref_type) { 'heads' }
-
-            it 'redirects to blob#show with sha for the branch' do
-              expect(response).to redirect_to(project_blob_path(project, "#{RepoHelpers.another_sample_commit.id}/#{path}"))
-            end
-          end
-
-          context 'and explicitly requesting a tag' do
-            let(:ref_type) { 'tags' }
-
-            it 'responds with success' do
-              expect(response).to be_ok
-            end
+          it 'redirects to blob#show with sha for the branch' do
+            expect(response).to redirect_to(project_blob_path(project, "#{RepoHelpers.another_sample_commit.id}/#{path}"))
           end
         end
 
-        context 'and the redirect_with_ref_type flag is enabled' do
-          let(:ref_type) { nil }
+        context 'and explicitly requesting a tag' do
+          let(:ref_type) { 'tags' }
 
-          it 'redirects to the tag' do
-            expect(response).to redirect_to(project_blob_path(project, id, ref_type: 'tags'))
+          it 'responds with success' do
+            expect(response).to be_ok
           end
         end
       end
 
       describe '#set_is_ambiguous_ref with no ambiguous ref' do
         let(:id) { 'master/invalid-path.rb' }
-        let(:redirect_with_ref_type) { false }
         let(:ambiguous_ref_modal) { true }
 
         it_behaves_like '#set_is_ambiguous_ref when ref is not ambiguous'
@@ -403,16 +384,9 @@ RSpec.describe Projects::BlobController, feature_category: :source_code_manageme
 
       subject(:request) { put :update, params: default_params }
 
-      it_behaves_like 'tracking unique hll events' do
-        let(:expected_value) { instance_of(Integer) }
-      end
-
-      it_behaves_like 'Snowplow event tracking with RedisHLL context' do
-        let(:action) { 'perform_sfe_action' }
-        let(:category) { described_class.to_s }
+      it_behaves_like 'internal event tracking' do
         let(:namespace) { project.namespace.reload }
-        let(:property) { target_event }
-        let(:label) { 'usage_activity_by_stage_monthly.create.action_monthly_active_users_sfe_edit' }
+        let(:event) { target_event }
       end
     end
   end
@@ -566,16 +540,9 @@ RSpec.describe Projects::BlobController, feature_category: :source_code_manageme
 
     subject(:request) { post :create, params: default_params }
 
-    it_behaves_like 'tracking unique hll events' do
-      let(:expected_value) { instance_of(Integer) }
-    end
-
-    it_behaves_like 'Snowplow event tracking with RedisHLL context' do
-      let(:action) { 'perform_sfe_action' }
-      let(:category) { described_class.to_s }
-      let(:namespace) { project.namespace }
-      let(:property) { target_event }
-      let(:label) { 'usage_activity_by_stage_monthly.create.action_monthly_active_users_sfe_edit' }
+    it_behaves_like 'internal event tracking' do
+      let(:namespace) { project.namespace.reload }
+      let(:event) { target_event }
     end
 
     it 'redirects to blob' do
diff --git a/spec/controllers/projects/tree_controller_spec.rb b/spec/controllers/projects/tree_controller_spec.rb
index 1244668c659..86ef379bacf 100644
--- a/spec/controllers/projects/tree_controller_spec.rb
+++ b/spec/controllers/projects/tree_controller_spec.rb
@@ -24,16 +24,12 @@ RSpec.describe Projects::TreeController, feature_category: :source_code_manageme
 
     let(:ref_type) { nil }
 
-    let(:redirect_with_ref_type) { true }
-
     # Make sure any errors accessing the tree in our views bubble up to this spec
     render_views
 
     include_context 'with ambiguous refs for controllers'
 
     describe '#set_is_ambiguous_ref before action' do
-      let(:redirect_with_ref_type) { false }
-
       before do
         request
       end
@@ -51,83 +47,25 @@ RSpec.describe Projects::TreeController, feature_category: :source_code_manageme
       end
     end
 
-    context 'when the redirect_with_ref_type flag is disabled' do
-      let(:redirect_with_ref_type) { false }
+    context 'when there is a ref and tag with the same name' do
+      let(:id) { 'ambiguous_ref' }
+      let(:params) { { namespace_id: project.namespace, project_id: project, id: id, ref_type: ref_type } }
 
-      context 'when there is a ref and tag with the same name' do
-        let(:id) { 'ambiguous_ref' }
-        let(:params) { { namespace_id: project.namespace, project_id: project, id: id, ref_type: ref_type } }
+      context 'and explicitly requesting a branch' do
+        let(:ref_type) { 'heads' }
 
-        context 'and explicitly requesting a branch' do
-          let(:ref_type) { 'heads' }
-
-          it 'redirects to blob#show with sha for the branch' do
-            request
-            expect(response).to redirect_to(project_tree_path(project, RepoHelpers.another_sample_commit.id))
-          end
-        end
-
-        context 'and explicitly requesting a tag' do
-          let(:ref_type) { 'tags' }
-
-          it 'responds with success' do
-            request
-            expect(response).to be_ok
-          end
+        it 'redirects to blob#show with sha for the branch' do
+          request
+          expect(response).to redirect_to(project_tree_path(project, RepoHelpers.another_sample_commit.id))
         end
       end
-    end
 
-    describe 'delegating to ExtractsRef::RequestedRef' do
-      context 'when there is a ref and tag with the same name' do
-        let(:id) { 'ambiguous_ref' }
-        let(:params) { { namespace_id: project.namespace, project_id: project, id: id, ref_type: ref_type } }
+      context 'and explicitly requesting a tag' do
+        let(:ref_type) { 'tags' }
 
-        let(:requested_ref_double) { ExtractsRef::RequestedRef.new(project.repository, ref_type: ref_type, ref: id) }
-
-        before do
-          allow(ExtractsRef::RequestedRef).to receive(:new).with(kind_of(Repository), ref_type: ref_type, ref: id).and_return(requested_ref_double)
-        end
-
-        context 'and not specifying a ref_type' do
-          it 'finds the tags and redirects' do
-            expect(requested_ref_double).to receive(:find).and_call_original
-            request
-            expect(subject).to redirect_to("/#{project.full_path}/-/tree/#{id}/?ref_type=tags")
-          end
-        end
-
-        context 'and explicitly requesting a branch' do
-          let(:ref_type) { 'heads' }
-
-          it 'checks for tree with ref_type' do
-            allow(project.repository).to receive(:tree).and_call_original
-            expect(project.repository).to receive(:tree).with(id, '', ref_type: 'heads').and_call_original
-            request
-          end
-
-          it 'finds the branch' do
-            expect(requested_ref_double).not_to receive(:find)
-
-            request
-            expect(response).to be_ok
-          end
-        end
-
-        context 'and explicitly requesting a tag' do
-          let(:ref_type) { 'tags' }
-
-          it 'checks for tree with ref_type' do
-            allow(project.repository).to receive(:tree).and_call_original
-            expect(project.repository).to receive(:tree).with(id, '', ref_type: 'tags').and_call_original
-            request
-          end
-
-          it 'finds the tag' do
-            expect(requested_ref_double).not_to receive(:find)
-            request
-            expect(response).to be_ok
-          end
+        it 'responds with success' do
+          request
+          expect(response).to be_ok
         end
       end
     end
diff --git a/spec/controllers/projects_controller_spec.rb b/spec/controllers/projects_controller_spec.rb
index 3ddfb5e7262..94058fbc21a 100644
--- a/spec/controllers/projects_controller_spec.rb
+++ b/spec/controllers/projects_controller_spec.rb
@@ -207,9 +207,9 @@ RSpec.describe ProjectsController, feature_category: :groups_and_projects do
           end
         end
 
-        context 'when redirect_with_ref_type is disabled' do
+        context 'when ambiguous_ref_modal is disabled' do
           before do
-            stub_feature_flags(redirect_with_ref_type: false)
+            stub_feature_flags(ambiguous_ref_modal: false)
           end
 
           context 'when there is a tag with the same name as the default branch' do
diff --git a/spec/controllers/snippets_controller_spec.rb b/spec/controllers/snippets_controller_spec.rb
index b33687df2ef..86b1771c056 100644
--- a/spec/controllers/snippets_controller_spec.rb
+++ b/spec/controllers/snippets_controller_spec.rb
@@ -8,39 +8,18 @@ RSpec.describe SnippetsController do
   let_it_be(:public_snippet) { create(:personal_snippet, :public, :repository, author: user) }
 
   describe 'GET #index' do
-    let(:base_params) { { username: user.username } }
+    it 'redirects to explore snippets page when user is not logged in' do
+      get :index
 
-    context 'when username parameter is present' do
-      it_behaves_like 'paginated collection' do
-        let(:collection) { Snippet.all }
-        let(:params) { { username: user.username } }
-      end
-
-      it 'renders snippets of a user when username is present' do
-        get :index, params: { username: user.username }
-
-        expect(response).to render_template(:index)
-      end
+      expect(response).to redirect_to(explore_snippets_path)
     end
 
-    context 'when username parameter is not present' do
-      it 'redirects to explore snippets page when user is not logged in' do
-        get :index
+    it 'redirects to snippets dashboard page when user is logged in' do
+      sign_in(user)
 
-        expect(response).to redirect_to(explore_snippets_path)
-      end
+      get :index
 
-      it 'redirects to snippets dashboard page when user is logged in' do
-        sign_in(user)
-
-        get :index
-
-        expect(response).to redirect_to(dashboard_snippets_path)
-      end
-    end
-
-    it_behaves_like 'snippets sort order' do
-      let(:params) { base_params }
+      expect(response).to redirect_to(dashboard_snippets_path)
     end
   end
 
diff --git a/spec/dot_gitlab_ci/rules_spec.rb b/spec/dot_gitlab_ci/rules_spec.rb
index b22cc6ac549..af30621ac83 100644
--- a/spec/dot_gitlab_ci/rules_spec.rb
+++ b/spec/dot_gitlab_ci/rules_spec.rb
@@ -23,4 +23,39 @@ RSpec.describe '.gitlab/ci/rules.gitlab-ci.yml', feature_category: :tooling do
       end
     end
   end
+
+  describe 'start-as-if-foss' do
+    let(:base_rules) { config.dig('.as-if-foss:rules:start-as-if-foss', 'rules') }
+
+    context 'with .as-if-foss:rules:start-as-if-foss:allow-failure:manual' do
+      let(:derived_rules) { config.dig('.as-if-foss:rules:start-as-if-foss:allow-failure:manual', 'rules') }
+
+      it 'has the same rules as the base and also allow-failure and manual' do
+        base_rules.zip(derived_rules).each do |(base, derived)|
+          # !references should be the same. Stop rules should be the same.
+          if base.is_a?(Array) || base['when'] == 'never'
+            expect(base).to eq(derived)
+          else
+            expect(derived).to eq(
+              base.merge('allow_failure' => true, 'when' => 'manual'))
+          end
+        end
+      end
+    end
+
+    context 'with .as-if-foss:rules:start-as-if-foss:allow-failure' do
+      let(:derived_rules) { config.dig('.as-if-foss:rules:start-as-if-foss:allow-failure', 'rules') }
+
+      it 'has the same rules as the base and also allow-failure' do
+        base_rules.zip(derived_rules).each do |(base, derived)|
+          # !references should be the same. Stop rules should be the same.
+          if base.is_a?(Array) || base['when'] == 'never'
+            expect(base).to eq(derived)
+          else
+            expect(derived).to eq(base.merge('allow_failure' => true))
+          end
+        end
+      end
+    end
+  end
 end
diff --git a/spec/features/projects/blobs/blob_line_permalink_updater_spec.rb b/spec/features/projects/blobs/blob_line_permalink_updater_spec.rb
index 89f6e41bec0..f0058e75e52 100644
--- a/spec/features/projects/blobs/blob_line_permalink_updater_spec.rb
+++ b/spec/features/projects/blobs/blob_line_permalink_updater_spec.rb
@@ -55,50 +55,10 @@ RSpec.describe 'Blob button line permalinks (BlobLinePermalinkUpdater)', :js, fe
     end
 
     describe 'Click "Blame" button' do
-      context 'when redirect_with_ref_type is disabled' do
-        before do
-          stub_feature_flags(redirect_with_ref_type: false)
-        end
-
-        it 'works with no initial line number fragment hash' do
-          visit_blob
-
-          expect(find('.js-blob-blame-link')['href']).to eq(get_absolute_url(project_blame_path(project, tree_join('master', path))))
-        end
-
-        it 'maintains intitial fragment hash' do
-          fragment = "L3"
-
-          visit_blob(fragment)
-
-          expect(find('.js-blob-blame-link')['href']).to eq(get_absolute_url(project_blame_path(project, tree_join('master', path), anchor: fragment)))
-        end
-
-        it 'changes fragment hash if line number clicked' do
-          visit_blob
-
-          find('#L3').click
-          find("#L5").click
-
-          expect(find('.js-blob-blame-link')['href']).to eq(get_absolute_url(project_blame_path(project, tree_join('master', path), anchor: "L5")))
-        end
-
-        it 'with initial fragment hash, changes fragment hash if line number clicked' do
-          fragment = "L1"
-
-          visit_blob(fragment)
-
-          find('#L3').click
-          find("#L5").click
-
-          expect(find('.js-blob-blame-link')['href']).to eq(get_absolute_url(project_blame_path(project, tree_join('master', path), anchor: "L5")))
-        end
-      end
-
       it 'works with no initial line number fragment hash' do
         visit_blob
 
-        expect(find('.js-blob-blame-link')['href']).to eq(get_absolute_url(project_blame_path(project, tree_join('master', path), ref_type: 'heads')))
+        expect(find('.js-blob-blame-link')['href']).to eq(get_absolute_url(project_blame_path(project, tree_join('master', path))))
       end
 
       it 'maintains intitial fragment hash' do
@@ -106,7 +66,7 @@ RSpec.describe 'Blob button line permalinks (BlobLinePermalinkUpdater)', :js, fe
 
         visit_blob(fragment)
 
-        expect(find('.js-blob-blame-link')['href']).to eq(get_absolute_url(project_blame_path(project, tree_join('master', path), ref_type: 'heads', anchor: fragment)))
+        expect(find('.js-blob-blame-link')['href']).to eq(get_absolute_url(project_blame_path(project, tree_join('master', path), anchor: fragment)))
       end
 
       it 'changes fragment hash if line number clicked' do
@@ -115,7 +75,7 @@ RSpec.describe 'Blob button line permalinks (BlobLinePermalinkUpdater)', :js, fe
         find('#L3').click
         find("#L5").click
 
-        expect(find('.js-blob-blame-link')['href']).to eq(get_absolute_url(project_blame_path(project, tree_join('master', path), ref_type: 'heads', anchor: "L5")))
+        expect(find('.js-blob-blame-link')['href']).to eq(get_absolute_url(project_blame_path(project, tree_join('master', path), anchor: "L5")))
       end
 
       it 'with initial fragment hash, changes fragment hash if line number clicked' do
@@ -126,7 +86,7 @@ RSpec.describe 'Blob button line permalinks (BlobLinePermalinkUpdater)', :js, fe
         find('#L3').click
         find("#L5").click
 
-        expect(find('.js-blob-blame-link')['href']).to eq(get_absolute_url(project_blame_path(project, tree_join('master', path), ref_type: 'heads', anchor: "L5")))
+        expect(find('.js-blob-blame-link')['href']).to eq(get_absolute_url(project_blame_path(project, tree_join('master', path), anchor: "L5")))
       end
     end
   end
diff --git a/spec/fixtures/api/schemas/entities/note_user_entity.json b/spec/fixtures/api/schemas/entities/note_user_entity.json
index 16d33ada51d..af5e6fa53a9 100644
--- a/spec/fixtures/api/schemas/entities/note_user_entity.json
+++ b/spec/fixtures/api/schemas/entities/note_user_entity.json
@@ -7,7 +7,8 @@
     "avatar_url",
     "path",
     "name",
-    "username"
+    "username",
+    "bot"
   ],
   "properties": {
     "id": {
@@ -39,6 +40,9 @@
     },
     "show_status": {
       "type": "boolean"
+    },
+    "bot": {
+      "type": "boolean"
     }
   }
 }
diff --git a/spec/frontend/blob/components/blob_content_spec.js b/spec/frontend/blob/components/blob_content_spec.js
index 91af5f7bfed..dc122fc8b2f 100644
--- a/spec/frontend/blob/components/blob_content_spec.js
+++ b/spec/frontend/blob/components/blob_content_spec.js
@@ -23,6 +23,8 @@ describe('Blob Content component', () => {
     wrapper = shallowMount(BlobContent, {
       propsData: {
         loading: false,
+        projectPath: 'somePath',
+        currentRef: 'test',
         activeViewer,
         ...propsData,
       },
diff --git a/spec/frontend/design_management/components/design_presentation_spec.js b/spec/frontend/design_management/components/design_presentation_spec.js
index 96c2b4da2c6..cb9350912d9 100644
--- a/spec/frontend/design_management/components/design_presentation_spec.js
+++ b/spec/frontend/design_management/components/design_presentation_spec.js
@@ -2,52 +2,40 @@ import { shallowMount } from '@vue/test-utils';
 import { nextTick } from 'vue';
 import DesignOverlay from '~/design_management/components/design_overlay.vue';
 import DesignPresentation from '~/design_management/components/design_presentation.vue';
+import DesignImage from '~/design_management/components/image.vue';
 
-const mockOverlayData = {
-  overlayDimensions: {
-    width: 100,
-    height: 100,
-  },
-  overlayPosition: {
-    top: '0',
-    left: '0',
-  },
+const mockOverlayDimensions = {
+  width: 100,
+  height: 100,
 };
 
 describe('Design management design presentation component', () => {
   let wrapper;
 
-  function createComponent(
-    {
-      image,
-      imageName,
-      discussions = [],
-      isAnnotating = false,
-      resolvedDiscussionsExpanded = false,
-    } = {},
-    data = {},
-    stubs = {},
-  ) {
+  const findDesignImage = () => wrapper.findComponent(DesignImage);
+  const findDesignOverlay = () => wrapper.findComponent(DesignOverlay);
+  const findOverlayCommentButton = () => wrapper.find('[data-testid="design-image-button"]');
+
+  function createComponent(props = {}, initialOverlayDimensions = mockOverlayDimensions, options) {
     wrapper = shallowMount(DesignPresentation, {
       propsData: {
-        image,
-        imageName,
-        discussions,
-        isAnnotating,
-        resolvedDiscussionsExpanded,
+        image: 'test.jpg',
+        imageName: 'test',
+        resolvedDiscussionsExpanded: false,
+        discussions: [],
         isLoading: false,
+        ...props,
       },
-      stubs,
+      ...options,
     });
 
-    // setData usage is discouraged. See https://gitlab.com/groups/gitlab-org/-/epics/7330 for details
-    // eslint-disable-next-line no-restricted-syntax
-    wrapper.setData(data);
+    if (initialOverlayDimensions) {
+      findDesignImage().vm.$emit('resize', initialOverlayDimensions);
+    }
+
     wrapper.element.scrollTo = jest.fn();
   }
 
-  const findOverlayCommentButton = () => wrapper.find('[data-testid="design-image-button"]');
-
   /**
    * Spy on $refs and mock given values
    * @param {Object} viewportDimensions {width, height}
@@ -114,141 +102,131 @@ describe('Design management design presentation component', () => {
   });
 
   it('renders image and overlay when image provided', async () => {
-    createComponent(
-      {
-        image: 'test.jpg',
-        imageName: 'test',
-      },
-      mockOverlayData,
-    );
+    createComponent({
+      image: 'test.jpg',
+      imageName: 'test',
+    });
 
     await nextTick();
     expect(wrapper.element).toMatchSnapshot();
   });
 
   it('renders empty state when no image provided', async () => {
-    createComponent();
+    createComponent(
+      {
+        image: '',
+        imageName: '',
+      },
+      null,
+    );
 
     await nextTick();
     expect(wrapper.element).toMatchSnapshot();
   });
 
   it('openCommentForm event emits correct data', async () => {
-    createComponent(
-      {
-        image: 'test.jpg',
-        imageName: 'test',
-      },
-      mockOverlayData,
-    );
+    createComponent({
+      image: 'test.jpg',
+      imageName: 'test',
+    });
 
     wrapper.vm.openCommentForm({ x: 1, y: 1 });
 
     await nextTick();
     expect(wrapper.emitted('openCommentForm')).toEqual([
-      [{ ...mockOverlayData.overlayDimensions, x: 1, y: 1 }],
+      [{ ...mockOverlayDimensions, x: 1, y: 1 }],
     ]);
   });
 
   describe('currentCommentForm', () => {
     it('is null when isAnnotating is false', async () => {
-      createComponent(
-        {
-          image: 'test.jpg',
-          imageName: 'test',
-        },
-        mockOverlayData,
-      );
+      createComponent({
+        image: 'test.jpg',
+        imageName: 'test',
+      });
 
       await nextTick();
-      expect(wrapper.vm.currentCommentForm).toBeNull();
+      expect(findDesignOverlay().props('currentCommentForm')).toBeNull();
       expect(wrapper.element).toMatchSnapshot();
     });
 
     it('is null when isAnnotating is true but annotation position is falsey', async () => {
-      createComponent(
-        {
-          image: 'test.jpg',
-          imageName: 'test',
-          isAnnotating: true,
-        },
-        mockOverlayData,
-      );
+      createComponent({
+        image: 'test.jpg',
+        imageName: 'test',
+        isAnnotating: true,
+      });
 
       await nextTick();
-      expect(wrapper.vm.currentCommentForm).toBeNull();
+      expect(findDesignOverlay().props('currentCommentForm')).toBeNull();
       expect(wrapper.element).toMatchSnapshot();
     });
 
     it('is equal to current annotation position when isAnnotating is true', async () => {
-      createComponent(
-        {
-          image: 'test.jpg',
-          imageName: 'test',
-          isAnnotating: true,
-        },
-        {
-          ...mockOverlayData,
-          currentAnnotationPosition: {
-            x: 1,
-            y: 1,
-            width: 100,
-            height: 100,
-          },
-        },
-      );
+      createComponent({
+        image: 'test.jpg',
+        imageName: 'test',
+        isAnnotating: true,
+      });
 
       await nextTick();
-      expect(wrapper.vm.currentCommentForm).toEqual({
+      findDesignOverlay().vm.$emit('openCommentForm', {
+        x: 1,
+        y: 1,
+      });
+
+      await nextTick();
+      expect(findDesignOverlay().props('currentCommentForm')).toEqual({
         x: 1,
         y: 1,
         width: 100,
         height: 100,
       });
+
       expect(wrapper.element).toMatchSnapshot();
     });
   });
 
   describe('setOverlayPosition', () => {
     beforeEach(() => {
-      createComponent(
-        {
-          image: 'test.jpg',
-          imageName: 'test',
-        },
-        mockOverlayData,
-      );
-    });
-
-    it('sets overlay position correctly when overlay is smaller than viewport', () => {
-      jest.spyOn(wrapper.vm.$refs.presentationViewport, 'offsetWidth', 'get').mockReturnValue(200);
-      jest.spyOn(wrapper.vm.$refs.presentationViewport, 'offsetHeight', 'get').mockReturnValue(200);
-
-      wrapper.vm.setOverlayPosition();
-      expect(wrapper.vm.overlayPosition).toEqual({
-        left: `calc(50% - ${mockOverlayData.overlayDimensions.width / 2}px)`,
-        top: `calc(50% - ${mockOverlayData.overlayDimensions.height / 2}px)`,
+      createComponent({
+        image: 'test.jpg',
+        imageName: 'test',
       });
     });
 
-    it('sets overlay position correctly when overlay width is larger than viewports', () => {
+    it('sets overlay position correctly when overlay is smaller than viewport', async () => {
+      jest.spyOn(wrapper.vm.$refs.presentationViewport, 'offsetWidth', 'get').mockReturnValue(200);
+      jest.spyOn(wrapper.vm.$refs.presentationViewport, 'offsetHeight', 'get').mockReturnValue(200);
+      wrapper.vm.setOverlayPosition();
+
+      await nextTick();
+      expect(findDesignOverlay().props('position')).toEqual({
+        left: `calc(50% - ${mockOverlayDimensions.width / 2}px)`,
+        top: `calc(50% - ${mockOverlayDimensions.height / 2}px)`,
+      });
+    });
+
+    it('sets overlay position correctly when overlay width is larger than viewports', async () => {
       jest.spyOn(wrapper.vm.$refs.presentationViewport, 'offsetWidth', 'get').mockReturnValue(50);
       jest.spyOn(wrapper.vm.$refs.presentationViewport, 'offsetHeight', 'get').mockReturnValue(200);
-
       wrapper.vm.setOverlayPosition();
-      expect(wrapper.vm.overlayPosition).toEqual({
-        left: '0',
-        top: `calc(50% - ${mockOverlayData.overlayDimensions.height / 2}px)`,
+
+      await nextTick();
+      expect(findDesignOverlay().props('position')).toEqual({
+        left: `0`,
+        top: `calc(50% - ${mockOverlayDimensions.height / 2}px)`,
       });
     });
 
-    it('sets overlay position correctly when overlay height is larger than viewports', () => {
+    it('sets overlay position correctly when overlay height is larger than viewports', async () => {
       jest.spyOn(wrapper.vm.$refs.presentationViewport, 'offsetWidth', 'get').mockReturnValue(200);
       jest.spyOn(wrapper.vm.$refs.presentationViewport, 'offsetHeight', 'get').mockReturnValue(50);
-
       wrapper.vm.setOverlayPosition();
-      expect(wrapper.vm.overlayPosition).toEqual({
-        left: `calc(50% - ${mockOverlayData.overlayDimensions.width / 2}px)`,
+
+      await nextTick();
+      expect(findDesignOverlay().props('position')).toEqual({
+        left: `calc(50% - ${mockOverlayDimensions.width / 2}px)`,
         top: '0',
       });
     });
@@ -256,13 +234,10 @@ describe('Design management design presentation component', () => {
 
   describe('getViewportCenter', () => {
     beforeEach(() => {
-      createComponent(
-        {
-          image: 'test.jpg',
-          imageName: 'test',
-        },
-        mockOverlayData,
-      );
+      createComponent({
+        image: 'test.jpg',
+        imageName: 'test',
+      });
     });
 
     it('calculate center correctly with no scroll', () => {
@@ -313,22 +288,21 @@ describe('Design management design presentation component', () => {
 
   describe('scaleZoomFocalPoint', () => {
     it('scales focal point correctly when zooming in', () => {
-      createComponent(
-        {
-          image: 'test.jpg',
-          imageName: 'test',
-        },
-        {
-          ...mockOverlayData,
-          zoomFocalPoint: {
-            x: 5,
-            y: 5,
-            width: 50,
-            height: 50,
-          },
-        },
-      );
+      createComponent({
+        image: 'test.jpg',
+        imageName: 'test',
+      });
 
+      // setData usage is discouraged. See https://gitlab.com/groups/gitlab-org/-/epics/7330 for details
+      // eslint-disable-next-line no-restricted-syntax
+      wrapper.setData({
+        zoomFocalPoint: {
+          x: 5,
+          y: 5,
+          width: 50,
+          height: 50,
+        },
+      });
       wrapper.vm.scaleZoomFocalPoint();
       expect(wrapper.vm.zoomFocalPoint).toEqual({
         x: 10,
@@ -339,22 +313,21 @@ describe('Design management design presentation component', () => {
     });
 
     it('scales focal point correctly when zooming out', () => {
-      createComponent(
-        {
-          image: 'test.jpg',
-          imageName: 'test',
-        },
-        {
-          ...mockOverlayData,
-          zoomFocalPoint: {
-            x: 10,
-            y: 10,
-            width: 200,
-            height: 200,
-          },
-        },
-      );
+      createComponent({
+        image: 'test.jpg',
+        imageName: 'test',
+      });
 
+      // setData usage is discouraged. See https://gitlab.com/groups/gitlab-org/-/epics/7330 for details
+      // eslint-disable-next-line no-restricted-syntax
+      wrapper.setData({
+        zoomFocalPoint: {
+          x: 10,
+          y: 10,
+          width: 200,
+          height: 200,
+        },
+      });
       wrapper.vm.scaleZoomFocalPoint();
       expect(wrapper.vm.zoomFocalPoint).toEqual({
         x: 5,
@@ -367,13 +340,10 @@ describe('Design management design presentation component', () => {
 
   describe('onImageResize', () => {
     beforeEach(async () => {
-      createComponent(
-        {
-          image: 'test.jpg',
-          imageName: 'test',
-        },
-        mockOverlayData,
-      );
+      createComponent({
+        image: 'test.jpg',
+        imageName: 'test',
+      });
 
       jest.spyOn(wrapper.vm, 'shiftZoomFocalPoint');
       jest.spyOn(wrapper.vm, 'scaleZoomFocalPoint');
@@ -402,7 +372,13 @@ describe('Design management design presentation component', () => {
       ${'height overflows'}           | ${100} | ${101}
       ${'width and height overflows'} | ${200} | ${200}
     `('sets lastDragPosition when design $scenario', ({ width, height }) => {
-      createComponent();
+      createComponent(
+        {
+          image: '',
+          imageName: '',
+        },
+        null,
+      );
       mockRefDimensions(
         wrapper.vm.$refs.presentationViewport,
         { width: 100, height: 100 },
@@ -410,7 +386,7 @@ describe('Design management design presentation component', () => {
       );
 
       const newLastDragPosition = { x: 2, y: 2 };
-      wrapper.vm.onPresentationMousedown({
+      wrapper.trigger('mousedown', {
         clientX: newLastDragPosition.x,
         clientY: newLastDragPosition.y,
       });
@@ -421,7 +397,18 @@ describe('Design management design presentation component', () => {
     it('does not set lastDragPosition if design does not overflow', () => {
       const lastDragPosition = { x: 1, y: 1 };
 
-      createComponent({}, { lastDragPosition });
+      createComponent(
+        {
+          image: '',
+          imageName: '',
+        },
+        null,
+      );
+
+      // setData usage is discouraged. See https://gitlab.com/groups/gitlab-org/-/epics/7330 for details
+      // eslint-disable-next-line no-restricted-syntax
+      wrapper.setData({ lastDragPosition });
+
       mockRefDimensions(
         wrapper.vm.$refs.presentationViewport,
         { width: 100, height: 100 },
@@ -440,16 +427,21 @@ describe('Design management design presentation component', () => {
       coordinates               | overlayDimensions                | position
       ${{ x: 100, y: 100 }}     | ${{ width: 50, height: 50 }}     | ${{ x: 100, y: 100, width: 50, height: 50 }}
       ${{ x: 100.2, y: 100.5 }} | ${{ width: 50.6, height: 50.0 }} | ${{ x: 100, y: 101, width: 51, height: 50 }}
-    `('returns correct annotation position', ({ coordinates, overlayDimensions, position }) => {
-      createComponent(undefined, {
-        overlayDimensions: {
-          width: overlayDimensions.width,
-          height: overlayDimensions.height,
-        },
-      });
+    `(
+      'returns correct annotation position',
+      async ({ coordinates, overlayDimensions, position }) => {
+        createComponent(
+          {
+            image: 'test.jpg',
+            imageName: 'test',
+          },
+          overlayDimensions,
+        );
 
-      expect(wrapper.vm.getAnnotationPositon(coordinates)).toStrictEqual(position);
-    });
+        await nextTick();
+        expect(wrapper.vm.getAnnotationPositon(coordinates)).toStrictEqual(position);
+      },
+    );
   });
 
   describe('when design is overflowing', () => {
@@ -459,9 +451,9 @@ describe('Design management design presentation component', () => {
           image: 'test.jpg',
           imageName: 'test',
         },
-        mockOverlayData,
+        mockOverlayDimensions,
         {
-          'design-overlay': DesignOverlay,
+          stubs: { DesignOverlay },
         },
       );
 
@@ -534,19 +526,14 @@ describe('Design management design presentation component', () => {
   describe('when user is not logged in', () => {
     beforeEach(() => {
       window.gon = { current_user_id: null };
-      createComponent(
-        {
-          image: 'test.jpg',
-          imageName: 'test',
-        },
-        mockOverlayData,
-      );
+      createComponent({
+        image: 'test.jpg',
+        imageName: 'test',
+      });
     });
 
     it('disables commenting from design overlay', () => {
-      expect(wrapper.findComponent(DesignOverlay).props()).toMatchObject({
-        disableCommenting: true,
-      });
+      expect(findDesignOverlay().props('disableCommenting')).toEqual(true);
     });
   });
 });
diff --git a/spec/frontend/editor/schema/ci/yaml_tests/negative_tests/identity_provider.yml b/spec/frontend/editor/schema/ci/yaml_tests/negative_tests/identity_provider.yml
new file mode 100644
index 00000000000..76836cc1cea
--- /dev/null
+++ b/spec/frontend/editor/schema/ci/yaml_tests/negative_tests/identity_provider.yml
@@ -0,0 +1,5 @@
+id_token_with_missing_identity_provider_value:
+  identity_provider: ""
+
+id_token_with_unknown_identity_provider_value:
+  identity_provider: unknown
diff --git a/spec/frontend/editor/schema/ci/yaml_tests/positive_tests/identity_provider.yml b/spec/frontend/editor/schema/ci/yaml_tests/positive_tests/identity_provider.yml
new file mode 100644
index 00000000000..6a54422bc31
--- /dev/null
+++ b/spec/frontend/editor/schema/ci/yaml_tests/positive_tests/identity_provider.yml
@@ -0,0 +1,2 @@
+valid_identity_provider:
+  identity_provider: google_cloud
diff --git a/spec/frontend/notes/components/mr_discussion_filter_spec.js b/spec/frontend/notes/components/mr_discussion_filter_spec.js
index 05576d2ccc6..73fd6da811d 100644
--- a/spec/frontend/notes/components/mr_discussion_filter_spec.js
+++ b/spec/frontend/notes/components/mr_discussion_filter_spec.js
@@ -57,7 +57,7 @@ describe('Merge request discussion filter component', () => {
 
   describe('local sync sort filters', () => {
     it('calls setDiscussionSortDirection when mounted', () => {
-      localStorage.setItem('mr_activity_filters', '["comments"]');
+      localStorage.setItem('mr_activity_filters_2', '["comments"]');
 
       createComponent();
 
@@ -82,6 +82,7 @@ describe('Merge request discussion filter component', () => {
 
     expect(updateMergeRequestFilters).toHaveBeenCalledWith(expect.anything(), [
       'assignees_reviewers',
+      'bot_comments',
       'comments',
       'commit_branches',
       'edits',
@@ -126,12 +127,12 @@ describe('Merge request discussion filter component', () => {
 
     await nextTick();
 
-    expect(wrapper.findAll('[aria-selected="true"]')).toHaveLength(9);
+    expect(wrapper.findAll('[aria-selected="true"]')).toHaveLength(10);
 
     wrapper.find('[data-testid="listbox-select-all-button"]').vm.$emit('click');
 
     await nextTick();
 
-    expect(wrapper.findAll('[aria-selected="true"]')).toHaveLength(10);
+    expect(wrapper.findAll('[aria-selected="true"]')).toHaveLength(11);
   });
 });
diff --git a/spec/frontend/notes/stores/getters_spec.js b/spec/frontend/notes/stores/getters_spec.js
index 1514602d424..8eebfeff553 100644
--- a/spec/frontend/notes/stores/getters_spec.js
+++ b/spec/frontend/notes/stores/getters_spec.js
@@ -87,6 +87,19 @@ describe('Getters Notes Store', () => {
 
     const getDiscussions = () => getters.discussions(state, {}, { batchComments });
 
+    describe('merge request filters', () => {
+      it('returns only bot comments', () => {
+        const discussion = JSON.parse(JSON.stringify(discussionMock));
+        discussion.notes[0].author.bot = true;
+
+        state.noteableData = { targetType: 'merge_request' };
+        state.discussions = [discussion];
+        state.mergeRequestFilters = ['bot_comments'];
+
+        expect(getDiscussions()).toContain(discussion);
+      });
+    });
+
     describe('without batchComments module', () => {
       it('should return all discussions in the store', () => {
         expect(getDiscussions()).toEqual([individualNote]);
diff --git a/spec/frontend/repository/components/blob_content_viewer_spec.js b/spec/frontend/repository/components/blob_content_viewer_spec.js
index 31337364dca..b528726542b 100644
--- a/spec/frontend/repository/components/blob_content_viewer_spec.js
+++ b/spec/frontend/repository/components/blob_content_viewer_spec.js
@@ -266,7 +266,7 @@ describe('Blob content viewer component', () => {
 
         expect(mockAxios.history.get).toHaveLength(1);
         expect(mockAxios.history.get[0].url).toBe(legacyViewerUrl);
-        expect(findBlobHeader().props('showBlameToggle')).toEqual(false);
+        expect(findBlobHeader().props('showBlameToggle')).toEqual(true);
       });
 
       it('loads a legacy viewer when a viewer component is not available', async () => {
diff --git a/spec/frontend/snippets/components/snippet_blob_view_spec.js b/spec/frontend/snippets/components/snippet_blob_view_spec.js
index 05ff64c2296..d43a61cd730 100644
--- a/spec/frontend/snippets/components/snippet_blob_view_spec.js
+++ b/spec/frontend/snippets/components/snippet_blob_view_spec.js
@@ -107,6 +107,11 @@ describe('Blob Embeddable', () => {
       expect(findBlobContent().exists()).toBe(true);
     });
 
+    it('passes `isBlameLinkHidden = true` to blob content component', () => {
+      createComponent();
+      expect(findBlobContent().props('isBlameLinkHidden')).toEqual(true);
+    });
+
     it('sets simple viewer correctly', async () => {
       createComponent();
       await waitForPromises();
diff --git a/spec/frontend/vue_shared/components/blob_viewers/__snapshots__/simple_viewer_spec.js.snap b/spec/frontend/vue_shared/components/blob_viewers/__snapshots__/simple_viewer_spec.js.snap
index 1f3f1fef365..f5133a7f02f 100644
--- a/spec/frontend/vue_shared/components/blob_viewers/__snapshots__/simple_viewer_spec.js.snap
+++ b/spec/frontend/vue_shared/components/blob_viewers/__snapshots__/simple_viewer_spec.js.snap
@@ -3,53 +3,65 @@
 exports[`Blob Simple Viewer component rendering matches the snapshot 1`] = `
 <div>
   <div
-    class="code file-content js-syntax-highlight"
+    class="code file-content gl-display-flex gl-overflow-hidden js-syntax-highlight"
   >
     <div
-      class="gl-pt-0! line-numbers"
+      class="gl-px-0! line-numbers"
     >
-      <a
-        class="diff-line-num js-line-number"
-        data-line-number="1"
-        href="#LC1"
-        id="reference-0"
+      <div
+        class="diff-line-num gl-display-flex line-links"
       >
-        <gl-icon-stub
-          name="link"
-          size="12"
+        <a
+          class="file-line-blame gl-mx-n2 gl-shadow-none! gl-user-select-none"
+          href="/blame/foo-bar#L1"
         />
-        1
-      </a>
-      <a
-        class="diff-line-num js-line-number"
-        data-line-number="2"
-        href="#LC2"
-        id="reference-1"
+        <a
+          class="file-line-num gl-flex-grow-1 gl-shadow-none! gl-user-select-none"
+          data-line-number="1"
+          href="#LC1"
+          id="reference-0"
+        >
+          1
+        </a>
+      </div>
+      <div
+        class="diff-line-num gl-display-flex line-links"
       >
-        <gl-icon-stub
-          name="link"
-          size="12"
+        <a
+          class="file-line-blame gl-mx-n2 gl-shadow-none! gl-user-select-none"
+          href="/blame/foo-bar#L2"
         />
-        2
-      </a>
-      <a
-        class="diff-line-num js-line-number"
-        data-line-number="3"
-        href="#LC3"
-        id="reference-2"
+        <a
+          class="file-line-num gl-flex-grow-1 gl-shadow-none! gl-user-select-none"
+          data-line-number="2"
+          href="#LC2"
+          id="reference-1"
+        >
+          2
+        </a>
+      </div>
+      <div
+        class="diff-line-num gl-display-flex line-links"
       >
-        <gl-icon-stub
-          name="link"
-          size="12"
+        <a
+          class="file-line-blame gl-mx-n2 gl-shadow-none! gl-user-select-none"
+          href="/blame/foo-bar#L3"
         />
-        3
-      </a>
+        <a
+          class="file-line-num gl-flex-grow-1 gl-shadow-none! gl-user-select-none"
+          data-line-number="3"
+          href="#LC3"
+          id="reference-2"
+        >
+          3
+        </a>
+      </div>
     </div>
     <div
-      class="blob-content"
+      class="blob-content gl-display-flex gl-flex-direction-column gl-w-full"
     >
       <pre
-        class="code gl-display-flex gl-p-0! highlight"
+        class="code gl-p-0! highlight"
       >
         <code
           data-blob-hash="foo-bar"
diff --git a/spec/frontend/vue_shared/components/blob_viewers/mock_data.js b/spec/frontend/vue_shared/components/blob_viewers/mock_data.js
new file mode 100644
index 00000000000..80927c30d7b
--- /dev/null
+++ b/spec/frontend/vue_shared/components/blob_viewers/mock_data.js
@@ -0,0 +1,41 @@
+export const BLAME_DATA_QUERY_RESPONSE_MOCK = {
+  data: {
+    project: {
+      id: 'gid://gitlab/Project/278964',
+      __typename: 'Project',
+      repository: {
+        __typename: 'Repository',
+        blobs: {
+          __typename: 'BlobConnection',
+          nodes: [
+            {
+              id: 'gid://gitlab/Blob/f0c77e4b621df72719ce2b500ea6228559f6bc09',
+              blame: {
+                firstLine: '1',
+                groups: [
+                  {
+                    lineno: 1,
+                    span: 3,
+                    blameOffset: '0px',
+                    commit: {
+                      id: 'gid://gitlab/CommitPresenter/13b0aca4142d1d55931577f69289a792f216f805',
+                      titleHtml: 'Upload New File',
+                      message: 'Upload New File',
+                      authoredDate: '2022-10-31T10:38:30+00:00',
+                      authorName: 'Peter',
+                      authorGravatar: 'path/to/gravatar',
+                      webPath: '/commit/1234',
+                      author: {},
+                      sha: '13b0aca4142d1d55931577f69289a792f216f805',
+                    },
+                    commitData: { projectBlameLink: 'project/blame/link' },
+                  },
+                ],
+              },
+            },
+          ],
+        },
+      },
+    },
+  },
+};
diff --git a/spec/frontend/vue_shared/components/blob_viewers/simple_viewer_spec.js b/spec/frontend/vue_shared/components/blob_viewers/simple_viewer_spec.js
index a480e0869e8..35dfc02bc78 100644
--- a/spec/frontend/vue_shared/components/blob_viewers/simple_viewer_spec.js
+++ b/spec/frontend/vue_shared/components/blob_viewers/simple_viewer_spec.js
@@ -1,15 +1,42 @@
+import Vue, { nextTick } from 'vue';
+import VueApollo from 'vue-apollo';
 import { shallowMount } from '@vue/test-utils';
-import { nextTick } from 'vue';
-import { HIGHLIGHT_CLASS_NAME } from '~/vue_shared/components/blob_viewers/constants';
+import createMockApollo from 'helpers/mock_apollo_helper';
+import {
+  HIGHLIGHT_CLASS_NAME,
+  MAX_BLAME_LINES,
+} from '~/vue_shared/components/blob_viewers/constants';
 import SimpleViewer from '~/vue_shared/components/blob_viewers/simple_viewer.vue';
+import waitForPromises from 'helpers/wait_for_promises';
+
+import blameDataQuery from '~/vue_shared/components/source_viewer/queries/blame_data.query.graphql';
+import Blame from '~/vue_shared/components/source_viewer/components/blame_info.vue';
+
+import { BLAME_DATA_QUERY_RESPONSE_MOCK } from './mock_data';
+
+Vue.use(VueApollo);
 
 describe('Blob Simple Viewer component', () => {
   let wrapper;
+  let fakeApollo;
   const contentMock = `<span id="LC1">First</span>\n<span id="LC2">Second</span>\n<span id="LC3">Third</span>`;
   const blobHash = 'foo-bar';
 
-  function createComponent(content = contentMock, isRawContent = false, glFeatures = {}) {
+  const blameDataQueryHandlerSuccess = jest.fn().mockResolvedValue(BLAME_DATA_QUERY_RESPONSE_MOCK);
+
+  function createComponent({
+    content = contentMock,
+    showBlame = false,
+    blamePath = '/blame/foo-bar',
+    isBlameLinkHidden = false,
+    isRawContent = false,
+    propsData = {},
+    glFeatures = {},
+  } = {}) {
+    fakeApollo = createMockApollo([[blameDataQuery, blameDataQueryHandlerSuccess]]);
+
     wrapper = shallowMount(SimpleViewer, {
+      apolloProvider: fakeApollo,
       provide: {
         blobHash,
         glFeatures,
@@ -19,13 +46,23 @@ describe('Blob Simple Viewer component', () => {
         type: 'text',
         fileName: 'test.js',
         isRawContent,
+        isBlameLinkHidden,
+        blamePath,
+        blobPath: 'podfile',
+        projectPath: 'test',
+        currentRef: 'test',
+        lineNumbers: 3,
+        showBlame,
+        ...propsData,
       },
     });
   }
+  const findBlameComponents = () => wrapper.findAllComponents(Blame);
+  const findBlameLinks = () => wrapper.findAll('.file-line-blame');
 
   it('does not fail if content is empty', () => {
     const spy = jest.spyOn(window.console, 'error');
-    createComponent('');
+    createComponent({ content: '' });
     expect(spy).not.toHaveBeenCalled();
   });
 
@@ -39,12 +76,62 @@ describe('Blob Simple Viewer component', () => {
     });
 
     it('renders exactly three lines', () => {
-      expect(wrapper.findAll('.js-line-number')).toHaveLength(3);
+      expect(wrapper.findAll('.file-line-num')).toHaveLength(3);
+    });
+
+    it('renders a blame link for each line with correct href attribute', () => {
+      expect(findBlameLinks()).toHaveLength(3);
+      expect(findBlameLinks().at(0).attributes('href')).toBe('/blame/foo-bar#L1');
+    });
+
+    it('does not render blame link when `isBlameLinkHidden` prop set to true', () => {
+      createComponent({ isBlameLinkHidden: true });
+      expect(findBlameLinks()).toHaveLength(0);
     });
 
     it('renders the content without transformations', () => {
       expect(wrapper.html()).toContain(contentMock);
     });
+
+    it('does not render a Blame component when `showBlame: false`', async () => {
+      await waitForPromises();
+      expect(findBlameComponents()).toHaveLength(0);
+    });
+
+    describe('Blame component', () => {
+      beforeEach(() => {
+        createComponent({ propsData: { showBlame: true } });
+      });
+      it('renders a Blame component with correct props', async () => {
+        await waitForPromises();
+        const blameInfo =
+          BLAME_DATA_QUERY_RESPONSE_MOCK.data.project.repository.blobs.nodes[0].blame.groups;
+
+        expect(findBlameComponents().at(0).exists()).toBe(true);
+        expect(findBlameComponents().at(0).props()).toMatchObject({ blameInfo });
+      });
+
+      it('calls the blame data query', async () => {
+        await waitForPromises();
+        expect(blameDataQueryHandlerSuccess).toHaveBeenCalledTimes(1);
+        expect(blameDataQueryHandlerSuccess).toHaveBeenCalledWith(
+          expect.objectContaining({
+            filePath: 'podfile',
+            fromLine: 1,
+            fullPath: 'test',
+            ref: 'test',
+            toLine: MAX_BLAME_LINES,
+          }),
+        );
+      });
+
+      it('if there is more than 100 lines it calls query as many time as needed', async () => {
+        createComponent({ propsData: { showBlame: true, lineNumbers: 201 } });
+        await waitForPromises();
+        await waitForPromises();
+        expect(blameDataQueryHandlerSuccess).toHaveBeenCalledTimes(4);
+      });
+    });
   });
 
   describe('functionality', () => {
diff --git a/spec/frontend/vue_shared/components/source_viewer/__snapshots__/utils_spec.js.snap b/spec/frontend/vue_shared/components/source_viewer/__snapshots__/utils_spec.js.snap
index e75b07dcf71..45fcd377ec3 100644
--- a/spec/frontend/vue_shared/components/source_viewer/__snapshots__/utils_spec.js.snap
+++ b/spec/frontend/vue_shared/components/source_viewer/__snapshots__/utils_spec.js.snap
@@ -25,7 +25,7 @@ exports[`SourceViewer utils toggleBlameClasses adds classes 1`] = `
   </div>
   <div>
     <div
-      class="gl-border-gray-500 gl-border-t gl-pt-3!"
+      class="gl-pt-3!"
       id="reference-3"
     >
       Content 1
diff --git a/spec/frontend/vue_shared/components/source_viewer/source_viewer_spec.js b/spec/frontend/vue_shared/components/source_viewer/source_viewer_spec.js
index 1fa15b28cf1..79025725d08 100644
--- a/spec/frontend/vue_shared/components/source_viewer/source_viewer_spec.js
+++ b/spec/frontend/vue_shared/components/source_viewer/source_viewer_spec.js
@@ -105,7 +105,6 @@ describe('Source Viewer component', () => {
         jest.spyOn(utils, 'toggleBlameClasses');
         createComponent();
         await triggerChunkAppear();
-
         expect(utils.toggleBlameClasses).toHaveBeenCalledWith(blameInfo, true);
       });
     });
diff --git a/spec/lib/gitlab/ci/templates/Terraform/base_gitlab_ci_yaml_spec.rb b/spec/lib/gitlab/ci/templates/Terraform/base_gitlab_ci_yaml_spec.rb
index 42df924f8fd..9fcae67c717 100644
--- a/spec/lib/gitlab/ci/templates/Terraform/base_gitlab_ci_yaml_spec.rb
+++ b/spec/lib/gitlab/ci/templates/Terraform/base_gitlab_ci_yaml_spec.rb
@@ -3,7 +3,18 @@
 require 'spec_helper'
 
 RSpec.describe 'Terraform/Base.gitlab-ci.yml' do
-  subject(:template) { Gitlab::Template::GitlabCiYmlTemplate.find('Terraform/Base') }
+  subject(:template) do
+    <<~YAML
+      stages: [test]
+
+      include:
+        - template: 'Terraform/Base.gitlab-ci.yml'
+
+      placeholder:
+        script:
+          - keep pipeline validator happy by having a job when stages are intentionally empty
+    YAML
+  end
 
   describe 'the created pipeline' do
     let(:default_branch) { 'master' }
@@ -15,12 +26,12 @@ RSpec.describe 'Terraform/Base.gitlab-ci.yml' do
     let(:build_names) { pipeline.builds.pluck(:name) }
 
     before do
-      stub_ci_pipeline_yaml_file(template.content)
+      stub_ci_pipeline_yaml_file(template)
       allow(project).to receive(:default_branch).and_return(default_branch)
     end
 
-    it 'does not create any jobs' do
-      expect(build_names).to be_empty
+    it 'creates deprecation warning job' do
+      expect(build_names).to include('deprecated-and-will-be-removed-in-17.0')
     end
   end
 end
diff --git a/spec/lib/gitlab/ci/templates/Terraform/base_latest_gitlab_ci_yaml_spec.rb b/spec/lib/gitlab/ci/templates/Terraform/base_latest_gitlab_ci_yaml_spec.rb
index 332708ffa13..ab4536e450e 100644
--- a/spec/lib/gitlab/ci/templates/Terraform/base_latest_gitlab_ci_yaml_spec.rb
+++ b/spec/lib/gitlab/ci/templates/Terraform/base_latest_gitlab_ci_yaml_spec.rb
@@ -3,7 +3,18 @@
 require 'spec_helper'
 
 RSpec.describe 'Terraform/Base.latest.gitlab-ci.yml' do
-  subject(:template) { Gitlab::Template::GitlabCiYmlTemplate.find('Terraform/Base.latest') }
+  subject(:template) do
+    <<~YAML
+      stages: [test]
+
+      include:
+        - template: 'Terraform/Base.latest.gitlab-ci.yml'
+
+      placeholder:
+        script:
+          - keep pipeline validator happy by having a job when stages are intentionally empty
+    YAML
+  end
 
   describe 'the created pipeline' do
     let(:default_branch) { 'master' }
@@ -15,12 +26,12 @@ RSpec.describe 'Terraform/Base.latest.gitlab-ci.yml' do
     let(:build_names) { pipeline.builds.pluck(:name) }
 
     before do
-      stub_ci_pipeline_yaml_file(template.content)
+      stub_ci_pipeline_yaml_file(template)
       allow(project).to receive(:default_branch).and_return(default_branch)
     end
 
-    it 'does not create any jobs' do
-      expect(build_names).to be_empty
+    it 'creates deprecation warning job' do
+      expect(build_names).to include('deprecated-and-will-be-removed-in-17.0')
     end
   end
 end
diff --git a/spec/lib/gitlab/ci/templates/terraform_gitlab_ci_yaml_spec.rb b/spec/lib/gitlab/ci/templates/terraform_gitlab_ci_yaml_spec.rb
index aa7d0249066..38a182bcd36 100644
--- a/spec/lib/gitlab/ci/templates/terraform_gitlab_ci_yaml_spec.rb
+++ b/spec/lib/gitlab/ci/templates/terraform_gitlab_ci_yaml_spec.rb
@@ -27,6 +27,10 @@ RSpec.describe 'Terraform.gitlab-ci.yml' do
     end
 
     context 'on master branch' do
+      it 'creates deprecation warning job' do
+        expect(build_names).to include('deprecated-and-will-be-removed-in-17.0')
+      end
+
       it 'creates init, validate,build terraform jobs as well as kics-iac-sast job', :aggregate_failures do
         expect(pipeline.errors).to be_empty
         expect(build_names).to include('kics-iac-sast', 'validate', 'build', 'deploy')
@@ -36,6 +40,10 @@ RSpec.describe 'Terraform.gitlab-ci.yml' do
     context 'outside the master branch' do
       let(:pipeline_branch) { 'patch-1' }
 
+      it 'creates deprecation warning job' do
+        expect(build_names).to include('deprecated-and-will-be-removed-in-17.0')
+      end
+
       it 'does not creates a deploy and a test job', :aggregate_failures do
         expect(pipeline.errors).to be_empty
         expect(build_names).not_to include('deploy')
diff --git a/spec/lib/gitlab/ci/templates/terraform_latest_gitlab_ci_yaml_spec.rb b/spec/lib/gitlab/ci/templates/terraform_latest_gitlab_ci_yaml_spec.rb
index a81f29d0d01..777470def83 100644
--- a/spec/lib/gitlab/ci/templates/terraform_latest_gitlab_ci_yaml_spec.rb
+++ b/spec/lib/gitlab/ci/templates/terraform_latest_gitlab_ci_yaml_spec.rb
@@ -27,6 +27,10 @@ RSpec.describe 'Terraform.latest.gitlab-ci.yml', feature_category: :continuous_i
     end
 
     context 'on master branch' do
+      it 'creates deprecation warning job' do
+        expect(build_names).to include('deprecated-and-will-be-removed-in-17.0')
+      end
+
       it 'creates init, validate and build jobs', :aggregate_failures do
         expect(pipeline.errors).to be_empty
         expect(build_names).to include('validate', 'build', 'deploy')
@@ -36,6 +40,10 @@ RSpec.describe 'Terraform.latest.gitlab-ci.yml', feature_category: :continuous_i
     context 'outside the master branch' do
       let(:pipeline_branch) { 'patch-1' }
 
+      it 'creates deprecation warning job' do
+        expect(build_names).to include('deprecated-and-will-be-removed-in-17.0')
+      end
+
       it 'does not creates a deploy and a test job', :aggregate_failures do
         expect(pipeline.errors).to be_empty
         expect(build_names).not_to include('deploy')
@@ -52,6 +60,10 @@ RSpec.describe 'Terraform.latest.gitlab-ci.yml', feature_category: :continuous_i
       let(:branch_pipeline) { branch_service.execute(:push).payload }
       let(:branch_build_names) { branch_pipeline.builds.pluck(:name) }
 
+      it 'creates deprecation warning job' do
+        expect(build_names).to include('deprecated-and-will-be-removed-in-17.0')
+      end
+
       # This is needed so that the terraform artifacts and sast_iac artifacts
       # are both available in the MR
       it 'creates a pipeline with the terraform and sast_iac jobs' do
diff --git a/spec/lib/gitlab/ci/yaml_processor/feature_flags_spec.rb b/spec/lib/gitlab/ci/yaml_processor/feature_flags_spec.rb
index 77346f328ca..72b87ec07e2 100644
--- a/spec/lib/gitlab/ci/yaml_processor/feature_flags_spec.rb
+++ b/spec/lib/gitlab/ci/yaml_processor/feature_flags_spec.rb
@@ -2,7 +2,7 @@
 
 require 'spec_helper'
 
-RSpec.describe Gitlab::Ci::YamlProcessor::FeatureFlags do
+RSpec.describe Gitlab::Ci::YamlProcessor::FeatureFlags, feature_category: :pipeline_composition do
   let(:feature_flag) { :my_feature_flag }
 
   context 'when the actor is set' do
@@ -11,12 +11,20 @@ RSpec.describe Gitlab::Ci::YamlProcessor::FeatureFlags do
 
     it 'checks the feature flag using the given actor' do
       described_class.with_actor(actor) do
-        expect(Feature).to receive(:enabled?).with(feature_flag, actor)
+        expect(Feature).to receive(:enabled?).with(feature_flag, actor, type: :development)
 
         described_class.enabled?(feature_flag)
       end
     end
 
+    it 'checks the feature flag using the given type' do
+      described_class.with_actor(actor) do
+        expect(Feature).to receive(:enabled?).with(feature_flag, actor, type: :beta)
+
+        described_class.enabled?(feature_flag, type: :beta)
+      end
+    end
+
     it 'returns the value of the block' do
       result = described_class.with_actor(actor) do
         :test
@@ -28,12 +36,12 @@ RSpec.describe Gitlab::Ci::YamlProcessor::FeatureFlags do
     it 'restores the existing actor if any' do
       described_class.with_actor(actor) do
         described_class.with_actor(another_actor) do
-          expect(Feature).to receive(:enabled?).with(feature_flag, another_actor)
+          expect(Feature).to receive(:enabled?).with(feature_flag, another_actor, type: anything)
 
           described_class.enabled?(feature_flag)
         end
 
-        expect(Feature).to receive(:enabled?).with(feature_flag, actor)
+        expect(Feature).to receive(:enabled?).with(feature_flag, actor, type: anything)
         described_class.enabled?(feature_flag)
       end
     end
@@ -59,7 +67,7 @@ RSpec.describe Gitlab::Ci::YamlProcessor::FeatureFlags do
         end
 
         it 'checks the feature flag without actor' do
-          expect(Feature).to receive(:enabled?).with(feature_flag, nil)
+          expect(Feature).to receive(:enabled?).with(feature_flag, nil, type: anything)
           expect(Gitlab::ErrorTracking)
             .to receive(:track_and_raise_for_dev_exception)
             .and_call_original
@@ -71,7 +79,7 @@ RSpec.describe Gitlab::Ci::YamlProcessor::FeatureFlags do
 
     context 'when yaml_processor_feature_flag_corectness is not used' do
       it 'checks the feature flag without actor' do
-        expect(Feature).to receive(:enabled?).with(feature_flag, nil)
+        expect(Feature).to receive(:enabled?).with(feature_flag, nil, type: anything)
         expect(Gitlab::ErrorTracking)
           .to receive(:track_exception)
 
@@ -83,7 +91,7 @@ RSpec.describe Gitlab::Ci::YamlProcessor::FeatureFlags do
   context 'when actor is explicitly nil' do
     it 'checks the feature flag without actor' do
       described_class.with_actor(nil) do
-        expect(Feature).to receive(:enabled?).with(feature_flag, nil)
+        expect(Feature).to receive(:enabled?).with(feature_flag, nil, type: anything)
 
         described_class.enabled?(feature_flag)
       end
diff --git a/spec/requests/api/graphql/mutations/work_items/delete_spec.rb b/spec/requests/api/graphql/mutations/work_items/delete_spec.rb
index e25ff5613e4..d94622c033f 100644
--- a/spec/requests/api/graphql/mutations/work_items/delete_spec.rb
+++ b/spec/requests/api/graphql/mutations/work_items/delete_spec.rb
@@ -5,7 +5,9 @@ require 'spec_helper'
 RSpec.describe 'Delete a work item', feature_category: :team_planning do
   include GraphqlHelpers
 
-  let_it_be(:project) { create(:project) }
+  let_it_be(:group) { create(:group) }
+  let_it_be(:owner) { create(:user).tap { |user| group.add_owner(user) } }
+  let_it_be(:project) { create(:project, group: group) }
   let_it_be(:developer) { create(:user).tap { |user| project.add_developer(user) } }
 
   let(:current_user) { developer }
@@ -31,5 +33,36 @@ RSpec.describe 'Delete a work item', feature_category: :team_planning do
       expect(response).to have_gitlab_http_status(:success)
       expect(mutation_response['project']).to include('id' => work_item.project.to_global_id.to_s)
     end
+
+    context 'when group owner can delete a work item even if not the author' do
+      let!(:work_item) { create(:work_item, :group_level, namespace: group) }
+
+      it 'deletes the group-level work item' do
+        expect do
+          post_graphql_mutation(mutation, current_user: owner)
+        end.to change(WorkItem, :count).by(-1)
+
+        expect(response).to have_gitlab_http_status(:success)
+        expect(mutation_response['namespace']).to include('id' => work_item.namespace.to_global_id.to_s)
+      end
+    end
+
+    context 'when an error is produced when trying to delete the work item' do
+      let(:error_response) { ServiceResponse.error(message: 'Failed to delete') }
+
+      before do
+        allow_next_instance_of(WorkItems::DeleteService) do |instance|
+          allow(instance).to receive(:execute).and_return(error_response)
+        end
+      end
+
+      it 'returns an error message' do
+        expect do
+          post_graphql_mutation(mutation, current_user: current_user)
+        end.to not_change(WorkItem, :count)
+
+        expect(mutation_response['errors']).to contain_exactly('Failed to delete')
+      end
+    end
   end
 end
diff --git a/spec/scripts/setup/generate_as_if_foss_env_spec.rb b/spec/scripts/setup/generate_as_if_foss_env_spec.rb
index e437ce24e79..2b94ce5bb0c 100644
--- a/spec/scripts/setup/generate_as_if_foss_env_spec.rb
+++ b/spec/scripts/setup/generate_as_if_foss_env_spec.rb
@@ -21,7 +21,11 @@ RSpec.describe GenerateAsIfFossEnv, feature_category: :tooling do
     let(:jobs) do
       [
         'rspec fast_spec_helper',
-        'rspec unit pg14',
+        'rspec unit pg14 praefect 1/5',
+        'rspec unit pg14 single-db 2/5',
+        'rspec unit pg14 single-db-ci-connection 3/5',
+        'rspec unit pg14 single-redis 4/5',
+        'rspec unit pg14 5/5',
         'rspec integration pg14',
         'rspec system pg14',
         'rspec migration pg14',
@@ -64,6 +68,10 @@ RSpec.describe GenerateAsIfFossEnv, feature_category: :tooling do
         ENABLE_RSPEC: 'true',
         ENABLE_RSPEC_FAST_SPEC_HELPER: 'true',
         ENABLE_RSPEC_UNIT: 'true',
+        ENABLE_RSPEC_PRAEFECT: 'true',
+        ENABLE_RSPEC_SINGLE_DB: 'true',
+        ENABLE_RSPEC_SINGLE_DB_CI_CONNECTION: 'true',
+        ENABLE_RSPEC_SINGLE_REDIS: 'true',
         ENABLE_RSPEC_INTEGRATION: 'true',
         ENABLE_RSPEC_SYSTEM: 'true',
         ENABLE_RSPEC_MIGRATION: 'true',
@@ -96,6 +104,10 @@ RSpec.describe GenerateAsIfFossEnv, feature_category: :tooling do
         ENABLE_RSPEC=true
         ENABLE_RSPEC_FAST_SPEC_HELPER=true
         ENABLE_RSPEC_UNIT=true
+        ENABLE_RSPEC_PRAEFECT=true
+        ENABLE_RSPEC_SINGLE_DB=true
+        ENABLE_RSPEC_SINGLE_DB_CI_CONNECTION=true
+        ENABLE_RSPEC_SINGLE_REDIS=true
         ENABLE_RSPEC_INTEGRATION=true
         ENABLE_RSPEC_SYSTEM=true
         ENABLE_RSPEC_MIGRATION=true
diff --git a/spec/services/work_items/delete_service_spec.rb b/spec/services/work_items/delete_service_spec.rb
index ac72815a57e..05caf5057fa 100644
--- a/spec/services/work_items/delete_service_spec.rb
+++ b/spec/services/work_items/delete_service_spec.rb
@@ -3,14 +3,15 @@
 require 'spec_helper'
 
 RSpec.describe WorkItems::DeleteService, feature_category: :team_planning do
-  let_it_be(:project) { create(:project, :repository) }
-  let_it_be(:guest) { create(:user) }
+  let_it_be(:group) { create(:group) }
+  let_it_be(:project) { create(:project, :repository, group: group) }
+  let_it_be(:guest) { create(:user).tap { |u| group.add_guest(u) } }
+  let_it_be(:owner) { create(:user).tap { |u| group.add_owner(u) } }
   let_it_be(:work_item, refind: true) { create(:work_item, project: project, author: guest) }
 
   let(:user) { guest }
 
   before_all do
-    project.add_guest(guest)
     # note necessary to test note removal as part of work item deletion
     create(:note, project: project, noteable: work_item)
   end
@@ -21,6 +22,23 @@ RSpec.describe WorkItems::DeleteService, feature_category: :team_planning do
     context 'when user can delete the work item' do
       it { is_expected.to be_success }
 
+      context 'when work item exists at the group level' do
+        let_it_be(:work_item) { create(:work_item, :group_level, namespace: group) }
+
+        context 'when the user is owner of the group' do
+          let_it_be(:work_item) { create(:work_item, :group_level, namespace: group) }
+          let(:user) { owner }
+
+          it { is_expected.to be_success }
+        end
+
+        context 'when the user is a guest of the group but author of the work item' do
+          let_it_be(:work_item) { create(:work_item, :group_level, namespace: group, author: guest) }
+
+          it { is_expected.to be_success }
+        end
+      end
+
       # currently we don't expect destroy to fail. Mocking here for coverage and keeping
       # the service's return type consistent
       context 'when there are errors preventing to delete the work item' do
diff --git a/spec/simplecov_env.rb b/spec/simplecov_env.rb
index d48acc77afb..fbf4401ac2f 100644
--- a/spec/simplecov_env.rb
+++ b/spec/simplecov_env.rb
@@ -21,9 +21,9 @@ module SimpleCovEnv
   def configure_job
     SimpleCov.configure do
       if ENV['CI_JOB_NAME']
-        job_name = Gitlab::Utils.slugify(ENV['CI_JOB_NAME'])
-        coverage_dir "coverage/#{job_name}"
-        command_name job_name
+        coverage_name = Gitlab::Utils.slugify("#{ENV['CI_JOB_NAME']}-#{ENV['CI_PROJECT_ID']}")
+        coverage_dir "coverage/#{coverage_name}"
+        command_name coverage_name
       end
 
       if ENV['CI']
diff --git a/spec/support/shared_contexts/controllers/ambiguous_ref_controller_shared_context.rb b/spec/support/shared_contexts/controllers/ambiguous_ref_controller_shared_context.rb
index 8ad7edee1a1..28598a387bd 100644
--- a/spec/support/shared_contexts/controllers/ambiguous_ref_controller_shared_context.rb
+++ b/spec/support/shared_contexts/controllers/ambiguous_ref_controller_shared_context.rb
@@ -8,7 +8,6 @@ RSpec.shared_context 'with ambiguous refs for controllers' do
     project.repository.add_tag(project.creator, 'ambiguous_ref', RepoHelpers.sample_commit.id)
     project.repository.add_branch(project.creator, 'ambiguous_ref', RepoHelpers.another_sample_commit.id)
 
-    stub_feature_flags(redirect_with_ref_type: redirect_with_ref_type)
     stub_feature_flags(ambiguous_ref_modal: ambiguous_ref_modal)
   end
 
diff --git a/spec/support/shared_contexts/policies/group_policy_shared_context.rb b/spec/support/shared_contexts/policies/group_policy_shared_context.rb
index ec0d1e1a976..094a78aa45f 100644
--- a/spec/support/shared_contexts/policies/group_policy_shared_context.rb
+++ b/spec/support/shared_contexts/policies/group_policy_shared_context.rb
@@ -77,6 +77,7 @@ RSpec.shared_context 'GroupPolicy context' do
       register_group_runners
       read_billing
       edit_billing
+      destroy_issue
       admin_member_access_request
       update_git_access_protocol
     ]
diff --git a/vite.config.js b/vite.config.js
index 007706a1955..2a395b5acb1 100644
--- a/vite.config.js
+++ b/vite.config.js
@@ -14,6 +14,9 @@ import {
   SOURCEGRAPH_PUBLIC_PATH,
   GITLAB_WEB_IDE_PUBLIC_PATH,
 } from './config/webpack.constants';
+/* eslint-disable import/extensions */
+import { viteCSSCompilerPlugin } from './scripts/frontend/lib/compile_css.mjs';
+/* eslint-enable import/extensions */
 
 let viteGDKConfig;
 try {
@@ -104,6 +107,7 @@ export default defineConfig({
     ],
   },
   plugins: [
+    viteCSSCompilerPlugin(),
     viteGDKConfig.enabled ? autoRestartPlugin : null,
     fixedRubyPlugin,
     vue({