diff --git a/.rubocop_todo/layout/argument_alignment.yml b/.rubocop_todo/layout/argument_alignment.yml index c7e3efbf25e..911c65bb97f 100644 --- a/.rubocop_todo/layout/argument_alignment.yml +++ b/.rubocop_todo/layout/argument_alignment.yml @@ -136,6 +136,7 @@ Layout/ArgumentAlignment: - 'app/graphql/mutations/incident_management/timeline_event_tag/base.rb' - 'app/graphql/mutations/incident_management/timeline_event_tag/create.rb' - 'app/graphql/mutations/issues/base.rb' + - 'app/graphql/mutations/issues/bulk_update.rb' - 'app/graphql/mutations/issues/common_mutation_arguments.rb' - 'app/graphql/mutations/issues/create.rb' - 'app/graphql/mutations/issues/move.rb' @@ -272,6 +273,7 @@ Layout/ArgumentAlignment: - 'app/graphql/resolvers/group_labels_resolver.rb' - 'app/graphql/resolvers/group_members_resolver.rb' - 'app/graphql/resolvers/group_milestones_resolver.rb' + - 'app/graphql/resolvers/group_releases_resolver.rb' - 'app/graphql/resolvers/groups_resolver.rb' - 'app/graphql/resolvers/incident_management/timeline_events_resolver.rb' - 'app/graphql/resolvers/issues/base_parent_resolver.rb' @@ -776,7 +778,6 @@ Layout/ArgumentAlignment: - 'app/workers/stuck_export_jobs_worker.rb' - 'app/workers/x509_issuer_crl_check_worker.rb' - 'config/application.rb' - - 'config/initializers/google_api_client_patch.rb' - 'config/initializers/hashie_mash_permitted_patch.rb' - 'config/initializers/rack_timeout.rb' - 'config/initializers/rest-client-hostname_override.rb' @@ -2113,7 +2114,7 @@ Layout/ArgumentAlignment: - 'lib/gitlab/gl_repository/repo_type.rb' - 'lib/gitlab/gon_helper.rb' - 'lib/gitlab/gpg.rb' - - 'lib/gitlab/graphql/deprecation.rb' + - 'lib/gitlab/graphql/deprecations/deprecation.rb' - 'lib/gitlab/graphql/expose_permissions.rb' - 'lib/gitlab/graphql/mount_mutation.rb' - 'lib/gitlab/graphql/negatable_arguments.rb' @@ -2127,6 +2128,7 @@ Layout/ArgumentAlignment: - 'lib/gitlab/import_export/snippets_repo_saver.rb' - 'lib/gitlab/issuable/clone/copy_resource_events_service.rb' - 'lib/gitlab/legacy_github_import/importer.rb' + - 'lib/gitlab/mail_room.rb' - 'lib/gitlab/markdown_cache/redis/store.rb' - 'lib/gitlab/memory/reports_uploader.rb' - 'lib/gitlab/memory/watchdog/configurator.rb' @@ -2512,6 +2514,7 @@ Layout/ArgumentAlignment: - 'spec/helpers/avatars_helper_spec.rb' - 'spec/helpers/emoji_helper_spec.rb' - 'spec/helpers/feature_flags_helper_spec.rb' + - 'spec/helpers/ide_helper_spec.rb' - 'spec/helpers/namespaces_helper_spec.rb' - 'spec/helpers/notify_helper_spec.rb' - 'spec/helpers/page_layout_helper_spec.rb' @@ -2596,7 +2599,6 @@ Layout/ArgumentAlignment: - 'spec/lib/gitlab/background_migration/remove_occurrence_pipelines_and_duplicate_vulnerabilities_findings_spec.rb' - 'spec/lib/gitlab/background_migration/remove_self_managed_wiki_notes_spec.rb' - 'spec/lib/gitlab/background_migration/reset_too_many_tags_skipped_registry_imports_spec.rb' - - 'spec/lib/gitlab/background_migration/sanitize_confidential_todos_spec.rb' - 'spec/lib/gitlab/background_migration/set_correct_vulnerability_state_spec.rb' - 'spec/lib/gitlab/background_migration/set_legacy_open_source_license_available_for_non_public_projects_spec.rb' - 'spec/lib/gitlab/background_migration/update_delayed_project_removal_to_null_for_user_namespaces_spec.rb' @@ -2662,6 +2664,7 @@ Layout/ArgumentAlignment: - 'spec/lib/gitlab/database/rename_reserved_paths_migration/v1/rename_base_spec.rb' - 'spec/lib/gitlab/database/rename_reserved_paths_migration/v1/rename_namespaces_spec.rb' - 'spec/lib/gitlab/database/rename_reserved_paths_migration/v1/rename_projects_spec.rb' + - 'spec/lib/gitlab/database/tables_locker_spec.rb' - 'spec/lib/gitlab/database/tables_truncate_spec.rb' - 'spec/lib/gitlab/dependency_linker/parser/gemfile_spec.rb' - 'spec/lib/gitlab/diff/file_collection/compare_spec.rb' @@ -2750,6 +2753,10 @@ Layout/ArgumentAlignment: - 'spec/lib/gitlab/template/finders/global_template_finder_spec.rb' - 'spec/lib/gitlab/tracking/destinations/snowplow_spec.rb' - 'spec/lib/gitlab/usage/metrics/aggregates/sources/postgres_hll_spec.rb' + - 'spec/lib/gitlab/usage/metrics/instrumentations/count_ci_internal_pipelines_metric_spec.rb' + - 'spec/lib/gitlab/usage/metrics/instrumentations/count_issues_created_manually_from_alerts_metric_spec.rb' + - 'spec/lib/gitlab/usage/metrics/instrumentations/incoming_email_encrypted_secrets_enabled_metric_spec.rb' + - 'spec/lib/gitlab/usage/metrics/instrumentations/service_desk_email_encrypted_secrets_enabled_metric_spec.rb' - 'spec/lib/gitlab/usage/metrics/query_spec.rb' - 'spec/lib/gitlab/usage_data_queries_spec.rb' - 'spec/lib/gitlab/usage_data_spec.rb' @@ -2971,7 +2978,6 @@ Layout/ArgumentAlignment: - 'spec/requests/api/graphql/project/project_members_spec.rb' - 'spec/requests/api/graphql/project/project_pipeline_statistics_spec.rb' - 'spec/requests/api/graphql/project/project_statistics_spec.rb' - - 'spec/requests/api/graphql/project/releases_spec.rb' - 'spec/requests/api/graphql/project/terraform/states_spec.rb' - 'spec/requests/api/graphql/tasks/task_completion_status_spec.rb' - 'spec/requests/api/graphql/user_query_spec.rb' @@ -3194,6 +3200,7 @@ Layout/ArgumentAlignment: - 'spec/support/shared_contexts/merge_request_create_shared_context.rb' - 'spec/support/shared_contexts/merge_request_edit_shared_context.rb' - 'spec/support/shared_contexts/merge_requests_allowing_collaboration_shared_context.rb' + - 'spec/support/shared_contexts/requests/api/graphql/releases_and_group_releases_shared_context.rb' - 'spec/support/shared_contexts/services/projects/container_repository/delete_tags_service_shared_context.rb' - 'spec/support/shared_examples/controllers/snippets_sort_order_shared_examples.rb' - 'spec/support/shared_examples/controllers/wiki_actions_shared_examples.rb' @@ -3239,7 +3246,6 @@ Layout/ArgumentAlignment: - 'spec/tasks/cache/clear/redis_spec.rb' - 'spec/tasks/gitlab/cleanup_rake_spec.rb' - 'spec/tasks/gitlab/db/decomposition/rollback/bump_ci_sequences_rake_spec.rb' - - 'spec/tasks/gitlab/db/lock_writes_rake_spec.rb' - 'spec/tasks/gitlab/db/truncate_legacy_tables_rake_spec.rb' - 'spec/tasks/gitlab/sidekiq_rake_spec.rb' - 'spec/tooling/danger/sidekiq_queues_spec.rb' diff --git a/.rubocop_todo/layout/hash_alignment.yml b/.rubocop_todo/layout/hash_alignment.yml index e5796607dfd..a2480469b9f 100644 --- a/.rubocop_todo/layout/hash_alignment.yml +++ b/.rubocop_todo/layout/hash_alignment.yml @@ -10,3 +10,5 @@ Layout/HashAlignment: - 'spec/helpers/projects/ml/experiments_helper_spec.rb' - 'spec/lib/gitlab/metrics/requests_rack_middleware_spec.rb' - 'spec/requests/projects/merge_requests/creations_spec.rb' + - 'spec/support/redis/redis_new_instance_shared_examples.rb' + - 'spec/support/redis/redis_shared_examples.rb' diff --git a/doc/development/documentation/restful_api_styleguide.md b/doc/development/documentation/restful_api_styleguide.md index dce4577deaa..a92d58ead96 100644 --- a/doc/development/documentation/restful_api_styleguide.md +++ b/doc/development/documentation/restful_api_styleguide.md @@ -9,7 +9,8 @@ description: 'Writing styles, markup, formatting, and other standards for the Gi REST API resources are documented in Markdown under [`/doc/api`](https://gitlab.com/gitlab-org/gitlab/-/tree/master/doc/api). Each -resource has its own Markdown file, which is linked from `api_resources.md`. +resource has its own Markdown file, which is linked from +[`api_resources.md`](https://gitlab.com/gitlab-org/gitlab/-/blob/master/doc/api/api_resources.md). When modifying the Markdown, also update the corresponding [OpenAPI definition](https://gitlab.com/gitlab-org/gitlab/-/tree/master/doc/api/openapi) @@ -35,6 +36,8 @@ In the Markdown doc for a resource (AKA endpoint): Put the badge in the **Attribute** column, like the `**()**` code in the following template. +After a new API documentation page is added, [add an entry in the global navigation](site_architecture/global_nav.md#add-a-navigation-entry). [Example](https://gitlab.com/gitlab-org/gitlab-docs/-/merge_requests/3497). + ## API topic template Use the following template to help you get started. Be sure to list any @@ -66,7 +69,7 @@ Supported attributes: | `attribute` | datatype | No | Detailed description. | | `attribute` | datatype | No | Detailed description. | -If successful, returns [``](../../api/rest/index.md#status-codes) and the following +If successful, returns [``](rest/index.md#status-codes) and the following response attributes: | Attribute | Type | Description | diff --git a/doc/operations/feature_flags.md b/doc/operations/feature_flags.md index 1aaf572439d..68fc0fb9499 100644 --- a/doc/operations/feature_flags.md +++ b/doc/operations/feature_flags.md @@ -75,7 +75,7 @@ You can apply a feature flag strategy across multiple environments, without defi the strategy multiple times. GitLab feature flags use [Unleash](https://docs.getunleash.io/) as the feature flag -engine. In Unleash, there are [strategies](https://docs.getunleash.io/user_guide/activation_strategy) +engine. In Unleash, there are [strategies](https://docs.getunleash.io/reference/activation-strategies) for granular feature flag controls. GitLab feature flags can have multiple strategies, and the supported strategies are: @@ -90,7 +90,7 @@ and selecting **Edit** (**{pencil}**). ### All users -Enables the feature for all users. It uses the Standard (`default`) Unleash activation [strategy](https://docs.getunleash.io/user_guide/activation_strategy#standard). +Enables the feature for all users. It uses the Standard (`default`) Unleash activation [strategy](https://docs.getunleash.io/reference/activation-strategies#standard). ### Percent Rollout @@ -98,7 +98,7 @@ Enables the feature for all users. It uses the Standard (`default`) Unleash acti Enables the feature for a percentage of page views, with configurable consistency of behavior. This consistency is also known as stickiness. It uses the -Gradual Rollout (`flexibleRollout`) Unleash activation [strategy](https://docs.getunleash.io/user_guide/activation_strategy#gradual-rollout). +Gradual Rollout (`flexibleRollout`) Unleash activation [strategy](https://docs.getunleash.io/reference/activation-strategies#gradual-rollout). You can configure the consistency to be based on: @@ -126,7 +126,7 @@ Selecting **Random** provides inconsistent application behavior for individual u ### Percent of Users Enables the feature for a percentage of authenticated users. It uses the Unleash activation strategy -[`gradualRolloutUserId`](https://docs.getunleash.io/user_guide/activation_strategy#gradual-rollout). +[`gradualRolloutUserId`](https://docs.getunleash.io/reference/activation-strategies#gradual-rollout). For example, set a value of 15% to enable the feature for 15% of authenticated users. @@ -148,7 +148,7 @@ ID for the feature to be enabled. See the [Ruby example](#ruby-application-examp > - [Updated](https://gitlab.com/gitlab-org/gitlab/-/issues/34363) to be defined per environment in GitLab 12.6. Enables the feature for a list of target users. It is implemented -using the Unleash UserIDs (`userWithId`) activation [strategy](https://docs.getunleash.io/user_guide/activation_strategy#userids). +using the Unleash UserIDs (`userWithId`) activation [strategy](https://docs.getunleash.io/reference/activation-strategies#userids). Enter user IDs as a comma-separated list of values (for example, `user@example.com, user2@example.com`, or `username1,username2,username3`, and so on). @@ -163,7 +163,7 @@ target users. See the [Ruby example](#ruby-application-example) below. > [Introduced](https://gitlab.com/gitlab-org/gitlab/-/issues/35930) in GitLab 13.1. Enables the feature for lists of users created [in the feature flags UI](#create-a-user-list), or with the [feature flag user list API](../api/feature_flag_user_lists.md). -Similar to [User IDs](#user-ids), it uses the Unleash UsersIDs (`userWithId`) activation [strategy](https://docs.getunleash.io/user_guide/activation_strategy#userids). +Similar to [User IDs](#user-ids), it uses the Unleash UsersIDs (`userWithId`) activation [strategy](https://docs.getunleash.io/reference/activation-strategies#userids). It's not possible to *disable* a feature for members of a user list, but you can achieve the same effect by enabling a feature for a user list that doesn't contain the excluded users. @@ -372,7 +372,7 @@ end ### Unleash Proxy example -As of [Unleash Proxy](https://docs.getunleash.io/sdks/unleash-proxy) version +As of [Unleash Proxy](https://docs.getunleash.io/reference/unleash-proxy) version 0.2, the proxy is compatible with feature flags. To run a Docker container to connect to your project's feature flags, run the following command: @@ -389,7 +389,7 @@ docker run \ | Variable | Value | | --------------------------- | ------------------------------------------------------------------------------------------------------------------------------------ | -| `UNLEASH_PROXY_SECRETS` | Shared secret used to configure an [Unleash Proxy client](https://docs.getunleash.io/sdks/unleash-proxy#how-to-connect-to-the-proxy). | +| `UNLEASH_PROXY_SECRETS` | Shared secret used to configure an [Unleash Proxy client](https://docs.getunleash.io/reference/unleash-proxy#how-to-connect-to-the-proxy). | | `UNLEASH_URL` | Your project's API URL. For more details, read [Get access credentials](#get-access-credentials). | | `UNLEASH_INSTANCE_ID` | Your project's Instance ID. For more details, read [Get access credentials](#get-access-credentials). | | `UNLEASH_APP_NAME` | The name of the environment the application runs in. For more details, read [Get access credentials](#get-access-credentials). | diff --git a/doc/user/application_security/api_fuzzing/create_har_files.md b/doc/user/application_security/api_fuzzing/create_har_files.md index 1a6144b991c..0ad87facc50 100644 --- a/doc/user/application_security/api_fuzzing/create_har_files.md +++ b/doc/user/application_security/api_fuzzing/create_har_files.md @@ -109,7 +109,7 @@ responses in HAR format. have an account, first create an account. 1. Browse pages that call an API. Fiddler automatically captures the requests. 1. Select one or more requests, then from the context menu, select **Export > Selected Sessions**. -1. In the **Choose Format** dropdown list select **HTTP Archive v1.2**. +1. In the **Choose Format** dropdown list select **HTTPArchive v1.2**. 1. Enter a filename and select **Save**. Fiddler shows a popup message confirming the export has succeeded. diff --git a/doc/user/application_security/sast/index.md b/doc/user/application_security/sast/index.md index 025d35ed9d6..d55f9cf3382 100644 --- a/doc/user/application_security/sast/index.md +++ b/doc/user/application_security/sast/index.md @@ -144,14 +144,16 @@ the repository. For details on the Solution format, see the Microsoft reference ## False positive detection **(ULTIMATE)** -> Introduced in GitLab 14.2. +> - Introduced for Ruby in GitLab 14.2. +> - [Introduced](https://gitlab.com/gitlab-org/gitlab/-/issues/378622) for Go in GitLab 15.8. -Vulnerabilities that have been detected and are false positives are flagged as false positives in the security dashboard. +GitLab SAST can identify certain types of false positive results in the output of other tools. +These results are flagged as false positives on the [Vulnerability Report](../vulnerability_report/index.md) and the [Vulnerability Page](../vulnerabilities/index.md). False positive detection is available in a subset of the [supported languages](#supported-languages-and-frameworks) and [analyzers](analyzers.md): +- Go, in the Semgrep-based analyzer - Ruby, in the Brakeman-based analyzer -- Go ![SAST false-positives show in Vulnerability Pages](img/sast_vulnerability_page_fp_detection_v15_2.png) @@ -169,7 +171,7 @@ GitLab SAST uses an advanced vulnerability tracking algorithm to more accurately Advanced vulnerability tracking is available in a subset of the [supported languages](#supported-languages-and-frameworks) and [analyzers](analyzers.md): - C, in the Semgrep-based analyzer only -- Go, in the Gosec- and Semgrep-based analyzers +- Go, in the Semgrep-based analyzer only - Java, in the Semgrep-based analyzer only - JavaScript, in the Semgrep-based analyzer only - Python, in the Semgrep-based analyzer only diff --git a/workhorse/go.mod b/workhorse/go.mod index 923c049a293..8097d1cfeda 100644 --- a/workhorse/go.mod +++ b/workhorse/go.mod @@ -7,7 +7,7 @@ require ( github.com/BurntSushi/toml v1.2.1 github.com/FZambia/sentinel v1.1.1 github.com/alecthomas/chroma/v2 v2.4.0 - github.com/aws/aws-sdk-go v1.44.189 + github.com/aws/aws-sdk-go v1.44.194 github.com/disintegration/imaging v1.6.2 github.com/getsentry/raven-go v0.2.0 github.com/golang-jwt/jwt/v4 v4.4.3 diff --git a/workhorse/go.sum b/workhorse/go.sum index 53e65569c91..112348c4ae2 100644 --- a/workhorse/go.sum +++ b/workhorse/go.sum @@ -542,8 +542,8 @@ github.com/aws/aws-sdk-go v1.43.11/go.mod h1:y4AeaBuwd2Lk+GepC1E9v0qOiTws0MIWAX4 github.com/aws/aws-sdk-go v1.43.31/go.mod h1:y4AeaBuwd2Lk+GepC1E9v0qOiTws0MIWAX4oIKwKHZo= github.com/aws/aws-sdk-go v1.44.128/go.mod h1:y4AeaBuwd2Lk+GepC1E9v0qOiTws0MIWAX4oIKwKHZo= github.com/aws/aws-sdk-go v1.44.151/go.mod h1:aVsgQcEevwlmQ7qHE9I3h+dtQgpqhFB+i8Phjh7fkwI= -github.com/aws/aws-sdk-go v1.44.189 h1:9PBrjndH1uL5AN8818qI3duhQ4hgkMuLvqkJlg9MRyk= -github.com/aws/aws-sdk-go v1.44.189/go.mod h1:aVsgQcEevwlmQ7qHE9I3h+dtQgpqhFB+i8Phjh7fkwI= +github.com/aws/aws-sdk-go v1.44.194 h1:1ZDK+QDcc5oRbZGgRZSz561eR8XVizXCeGpoZKo33NU= +github.com/aws/aws-sdk-go v1.44.194/go.mod h1:aVsgQcEevwlmQ7qHE9I3h+dtQgpqhFB+i8Phjh7fkwI= github.com/aws/aws-sdk-go-v2 v0.18.0/go.mod h1:JWVYvqSMppoMJC0x5wdwiImzgXTI9FuZwxzkQq9wy+g= github.com/aws/aws-sdk-go-v2 v1.17.1 h1:02c72fDJr87N8RAC2s3Qu0YuvMRZKNZJ9F+lAehCazk= github.com/aws/aws-sdk-go-v2 v1.17.1/go.mod h1:JLnGeGONAyi2lWXI1p0PCIOIy333JMVK1U7Hf0aRFLw=