diff --git a/.gitlab/ci/docs.gitlab-ci.yml b/.gitlab/ci/docs.gitlab-ci.yml
index c78f243ff62..c7b9c56c1a5 100644
--- a/.gitlab/ci/docs.gitlab-ci.yml
+++ b/.gitlab/ci/docs.gitlab-ci.yml
@@ -39,6 +39,41 @@ review-docs-cleanup:
   script:
     - ./scripts/trigger-build.rb docs cleanup
 
+.review-docs-hugo:
+  extends:
+    - .default-retry
+    - .docs:rules:review-docs
+  image: ${GITLAB_DEPENDENCY_PROXY_ADDRESS}ruby:${RUBY_VERSION}-alpine
+  stage: review
+  needs: []
+  variables:
+    GIT_DEPTH: 1
+    # By default, deploy the Review App using the `main` branch of the `gitlab-org/technical-writing-group/gitlab-docs-hugo` project
+    DOCS_BRANCH: main
+  environment:
+    name: review-docs/mr-${CI_MERGE_REQUEST_IID}-hugo
+    auto_stop_in: 2 weeks
+    url: https://new.docs.gitlab.com/upstream-review-mr-${DOCS_GITLAB_REPO_SUFFIX}-${CI_MERGE_REQUEST_IID}
+    on_stop: review-docs-hugo-cleanup
+  before_script:
+    - source ./scripts/utils.sh
+    - install_gitlab_gem
+
+# Deploy documentation review app by using GitLab Docs Hugo project (gitlab-org/technical-writing-group/gitlab-docs-hugo)
+review-docs-hugo-deploy:
+  extends: .review-docs-hugo
+  script:
+    - ./scripts/trigger-build.rb docs-hugo deploy
+
+# Cleanup remote environment of gitlab-org/technical-writing-group/gitlab-docs-hugo
+review-docs-hugo-cleanup:
+  extends: .review-docs-hugo
+  environment:
+    name: review-docs/mr-${CI_MERGE_REQUEST_IID}-hugo
+    action: stop
+  script:
+    - ./scripts/trigger-build.rb docs-hugo cleanup
+
 .docs-markdown-lint-image:
   # When updating the image version here, update it in /scripts/lint-doc.sh too.
   image: ${REGISTRY_HOST}/${REGISTRY_GROUP}/gitlab-docs/lint-markdown:alpine-3.20-vale-3.7.1-markdownlint2-0.14.0-lychee-0.15.1
diff --git a/.rubocop_todo/layout/argument_alignment.yml b/.rubocop_todo/layout/argument_alignment.yml
index ff92e46df6d..e294578b4ec 100644
--- a/.rubocop_todo/layout/argument_alignment.yml
+++ b/.rubocop_todo/layout/argument_alignment.yml
@@ -2,7 +2,6 @@
 # Cop supports --autocorrect.
 Layout/ArgumentAlignment:
   Exclude:
-    - 'ee/app/services/ee/issues/clone_service.rb'
     - 'ee/app/services/ee/keys/create_service.rb'
     - 'ee/app/services/ee/projects/create_from_template_service.rb'
     - 'ee/app/services/ee/projects/gitlab_projects_import_service.rb'
diff --git a/app/assets/javascripts/custom_emoji/components/list.vue b/app/assets/javascripts/custom_emoji/components/list.vue
index a41d1bc30f3..cd8b5493ca1 100644
--- a/app/assets/javascripts/custom_emoji/components/list.vue
+++ b/app/assets/javascripts/custom_emoji/components/list.vue
@@ -45,7 +45,7 @@ export default {
       return {
         text: __('New custom emoji'),
         attributes: {
-          variant: 'info',
+          variant: 'confirm',
           to: '/new',
         },
       };
diff --git a/app/assets/javascripts/environments/components/stop_stale_environments_modal.vue b/app/assets/javascripts/environments/components/stop_stale_environments_modal.vue
index 57873b28d37..9d5680f6f95 100644
--- a/app/assets/javascripts/environments/components/stop_stale_environments_modal.vue
+++ b/app/assets/javascripts/environments/components/stop_stale_environments_modal.vue
@@ -39,7 +39,6 @@ export default {
   modalProps: {
     primary: {
       text: s__('Environments|Clean up'),
-      attributes: [{ variant: 'info' }],
     },
     cancel: {
       text: __('Cancel'),
diff --git a/app/assets/javascripts/projects/settings/repository/branch_rules/components/branch_rule.vue b/app/assets/javascripts/projects/settings/repository/branch_rules/components/branch_rule.vue
index ad77e97794c..7f94fd486e5 100644
--- a/app/assets/javascripts/projects/settings/repository/branch_rules/components/branch_rule.vue
+++ b/app/assets/javascripts/projects/settings/repository/branch_rules/components/branch_rule.vue
@@ -1,5 +1,6 @@
 <script>
 import { GlBadge, GlButton } from '@gitlab/ui';
+import glFeatureFlagsMixin from '~/vue_shared/mixins/gl_feature_flags_mixin';
 import ProtectedBadge from '~/vue_shared/components/badges/protected_badge.vue';
 import { s__, sprintf, n__ } from '~/locale';
 import { accessLevelsConfig } from '~/projects/settings/branch_rules/components/view/constants';
@@ -18,12 +19,14 @@ export default {
     matchingBranches: s__('BranchRules|%{total} matching %{subject}'),
     pushAccessLevels: s__('BranchRules|Allowed to push and merge'),
     mergeAccessLevels: s__('BranchRules|Allowed to merge'),
+    squashSetting: s__('BranchRules|Squash commits: %{setting}'),
   },
   components: {
     GlBadge,
     GlButton,
     ProtectedBadge,
   },
+  mixins: [glFeatureFlagsMixin()],
   inject: {
     branchRulesPath: {
       default: '',
@@ -94,6 +97,11 @@ export default {
         subject: n__('branch', 'branches', this.matchingBranchesCount),
       });
     },
+    squashSettingText() {
+      return sprintf(this.$options.i18n.squashSetting, {
+        setting: this.branchProtection?.squashSetting,
+      });
+    },
     mergeAccessLevels() {
       const { mergeAccessLevels } = this.branchProtection || {};
       return this.getAccessLevels(mergeAccessLevels);
@@ -131,6 +139,9 @@ export default {
       if (this.pushAccessLevels.total > 0) {
         approvalDetails.push(this.pushAccessLevelsText);
       }
+      if (this.glFeatures.branchRuleSquashSettings && this.branchProtection?.squashSetting) {
+        approvalDetails.push(this.squashSettingText);
+      }
       return approvalDetails;
     },
   },
diff --git a/app/assets/javascripts/vue_shared/components/customizable_dashboard/constants.js b/app/assets/javascripts/vue_shared/components/customizable_dashboard/constants.js
index 90bef9d4dd4..b2d4bb9a0f9 100644
--- a/app/assets/javascripts/vue_shared/components/customizable_dashboard/constants.js
+++ b/app/assets/javascripts/vue_shared/components/customizable_dashboard/constants.js
@@ -43,12 +43,6 @@ export const VISUALIZATION_TYPE_SINGLE_STAT = 'SingleStat';
 export const EVENT_LABEL_VIEWED_DASHBOARD_DESIGNER = 'user_viewed_dashboard_designer';
 export const EVENT_LABEL_EXCLUDE_ANONYMISED_USERS = 'exclude_anonymised_users';
 
-export const AI_IMPACT_DASHBOARD = 'ai_impact';
-
-// The URL name already in use is `value_streams_dashboard`,
-// the slug name for a dashboard must match the URL path that is used
-export const BUILT_IN_VALUE_STREAM_DASHBOARD = 'value_streams_dashboard';
-
 // The URL for shared analytics dashboards is based on the name of the YAML config
 // YAML configured VSD uses `/value_streams` for the custom file name
 export const CUSTOM_VALUE_STREAM_DASHBOARD = 'value_streams';
diff --git a/app/assets/javascripts/vue_shared/components/customizable_dashboard/customizable_dashboard.vue b/app/assets/javascripts/vue_shared/components/customizable_dashboard/customizable_dashboard.vue
index c97d35f69a4..76e6d895b5d 100644
--- a/app/assets/javascripts/vue_shared/components/customizable_dashboard/customizable_dashboard.vue
+++ b/app/assets/javascripts/vue_shared/components/customizable_dashboard/customizable_dashboard.vue
@@ -1,13 +1,5 @@
 <script>
-import {
-  GlButton,
-  GlFormInput,
-  GlFormGroup,
-  GlLink,
-  GlIcon,
-  GlSprintf,
-  GlExperimentBadge,
-} from '@gitlab/ui';
+import { GlButton, GlFormInput, GlFormGroup, GlIcon, GlExperimentBadge } from '@gitlab/ui';
 import { isEqual } from 'lodash';
 import { createAlert } from '~/alert';
 import { cloneWithoutReferences } from '~/lib/utils/common_utils';
@@ -17,13 +9,10 @@ import { InternalEvents } from '~/tracking';
 import UrlSync, { HISTORY_REPLACE_UPDATE_METHOD } from '~/vue_shared/components/url_sync.vue';
 import glFeatureFlagsMixin from '~/vue_shared/mixins/gl_feature_flags_mixin';
 import { confirmAction } from '~/lib/utils/confirm_via_gl_modal/confirm_via_gl_modal';
-import { helpPagePath } from '~/helpers/help_page_helper';
 import {
   EVENT_LABEL_VIEWED_DASHBOARD_DESIGNER,
   EVENT_LABEL_EXCLUDE_ANONYMISED_USERS,
   DASHBOARD_STATUS_BETA,
-  AI_IMPACT_DASHBOARD,
-  BUILT_IN_VALUE_STREAM_DASHBOARD,
   CUSTOM_VALUE_STREAM_DASHBOARD,
 } from './constants';
 import GridstackWrapper from './gridstack_wrapper.vue';
@@ -43,9 +32,7 @@ export default {
     GlButton,
     GlFormInput,
     GlIcon,
-    GlLink,
     GlFormGroup,
-    GlSprintf,
     GlExperimentBadge,
     UrlSync,
     AvailableVisualizationsDrawer,
@@ -155,12 +142,6 @@ export default {
         getDashboardConfig(this.dashboard),
       );
     },
-    isValueStreamsDashboard() {
-      return this.dashboard.slug === BUILT_IN_VALUE_STREAM_DASHBOARD;
-    },
-    isAiImpactDashboard() {
-      return this.dashboard.slug === AI_IMPACT_DASHBOARD;
-    },
   },
   watch: {
     isNewDashboard(isNew) {
@@ -344,19 +325,9 @@ export default {
       this.dashboard.panels.push(...panels);
     },
   },
-  i18n: {
-    alternativeAiImpactDescription: s__(
-      'Analytics|Visualize the relation between AI usage and SDLC trends. Learn more about %{docsLinkStart}AI Impact analytics%{docsLinkEnd} and %{subscriptionLinkStart}GitLab Duo Pro seats usage%{subscriptionLinkEnd}.',
-    ),
-  },
   HISTORY_REPLACE_UPDATE_METHOD,
   FORM_GROUP_CLASS: 'gl-w-full sm:gl-w-3/10 gl-min-w-20 gl-m-0',
   FORM_INPUT_CLASS: 'form-control gl-mr-4 gl-border-gray-200',
-  VSD_DOCUMENTATION_LINK: helpPagePath('user/analytics/value_streams_dashboard'),
-  AI_IMPACT_DOCUMENTATION_LINK: helpPagePath('user/analytics/ai_impact_analytics'),
-  DUO_PRO_SUBSCRIPTION_ADD_ON_LINK: helpPagePath('subscriptions/subscription-add-ons', {
-    anchor: 'assign-gitlab-duo-seats',
-  }),
 };
 </script>
 
@@ -382,31 +353,8 @@ export default {
           data-testid="dashboard-description"
         >
           <p class="gl-mb-0">
-            <!-- TODO: Remove this alternative description in https://gitlab.com/gitlab-org/gitlab/-/issues/465569 -->
-            <gl-sprintf
-              v-if="isAiImpactDashboard"
-              :message="$options.i18n.alternativeAiImpactDescription"
-            >
-              <template #docsLink="{ content }">
-                <gl-link :href="$options.AI_IMPACT_DOCUMENTATION_LINK">{{ content }}</gl-link>
-              </template>
-
-              <template #subscriptionLink="{ content }">
-                <gl-link :href="$options.DUO_PRO_SUBSCRIPTION_ADD_ON_LINK">{{ content }}</gl-link>
-              </template>
-            </gl-sprintf>
-            <template v-else>
-              {{ dashboardDescription }}
-              <!-- TODO: Remove this link in https://gitlab.com/gitlab-org/gitlab/-/issues/465569 -->
-              <gl-sprintf
-                v-if="isValueStreamsDashboard"
-                :message="__('%{linkStart} Learn more%{linkEnd}.')"
-              >
-                <template #link="{ content }">
-                  <gl-link :href="$options.VSD_DOCUMENTATION_LINK">{{ content }}</gl-link>
-                </template>
-              </gl-sprintf>
-            </template>
+            {{ dashboardDescription }}
+            <slot name="after-description"></slot>
           </p>
         </div>
 
diff --git a/app/assets/javascripts/work_items/components/create_work_item_modal.vue b/app/assets/javascripts/work_items/components/create_work_item_modal.vue
index d332f1e356e..1383bf70a87 100644
--- a/app/assets/javascripts/work_items/components/create_work_item_modal.vue
+++ b/app/assets/javascripts/work_items/components/create_work_item_modal.vue
@@ -11,6 +11,7 @@ import {
   sprintfWorkItem,
   I18N_WORK_ITEM_ERROR_FETCHING_TYPES,
   ROUTES,
+  RELATED_ITEM_ID_URL_QUERY_PARAM,
 } from '../constants';
 import namespaceWorkItemTypesQuery from '../graphql/namespace_work_item_types.query.graphql';
 import CreateWorkItem from './create_work_item.vue';
@@ -134,6 +135,7 @@ export default {
         fullPath: this.fullPath,
         isGroup: this.isGroup,
         workItemTypeName: this.workItemTypeName,
+        query: this.relatedItem ? `?${RELATED_ITEM_ID_URL_QUERY_PARAM}=${this.relatedItem.id}` : '',
       });
     },
     newWorkItemText() {
@@ -202,7 +204,10 @@ export default {
       event.preventDefault();
 
       if (this.useVueRouter) {
-        this.$router.push({ name: ROUTES.new });
+        this.$router.push({
+          name: ROUTES.new,
+          query: { [RELATED_ITEM_ID_URL_QUERY_PARAM]: this.relatedItem?.id },
+        });
       } else {
         visitUrl(this.newWorkItemPath);
       }
diff --git a/app/assets/javascripts/work_items/components/work_item_actions.vue b/app/assets/javascripts/work_items/components/work_item_actions.vue
index e0182c773c9..def6a7a5f9b 100644
--- a/app/assets/javascripts/work_items/components/work_item_actions.vue
+++ b/app/assets/javascripts/work_items/components/work_item_actions.vue
@@ -188,6 +188,10 @@ export default {
       required: false,
       default: false,
     },
+    isGroup: {
+      type: Boolean,
+      required: true,
+    },
   },
   data() {
     return {
@@ -551,6 +555,7 @@ export default {
       :related-item="relatedItemData"
       :work-item-type-name="workItemType.toUpperCase()"
       :show-project-selector="!isEpic"
+      :is-group="isGroup"
       hide-button
       @workItemCreated="$emit('workItemCreated')"
       @hideModal="isCreateWorkItemModalVisible = false"
diff --git a/app/assets/javascripts/work_items/components/work_item_detail.vue b/app/assets/javascripts/work_items/components/work_item_detail.vue
index 2ba539f6722..33387062895 100644
--- a/app/assets/javascripts/work_items/components/work_item_detail.vue
+++ b/app/assets/javascripts/work_items/components/work_item_detail.vue
@@ -676,6 +676,7 @@ export default {
       :is-sticky-header-showing="isStickyHeaderShowing"
       :work-item-notifications-subscribed="workItemNotificationsSubscribed"
       :work-item-author-id="workItemAuthorId"
+      :is-group="isGroupWorkItem"
       @hideStickyHeader="hideStickyHeader"
       @showStickyHeader="showStickyHeader"
       @deleteWorkItem="$emit('deleteWorkItem', { workItemType, workItemId: workItem.id })"
@@ -773,6 +774,7 @@ export default {
                 :has-children="hasChildren"
                 :work-item-author-id="workItemAuthorId"
                 :can-create-related-item="workItemLinkedItems !== undefined"
+                :is-group="isGroupWorkItem"
                 @deleteWorkItem="$emit('deleteWorkItem', { workItemType, workItemId: workItem.id })"
                 @toggleWorkItemConfidentiality="toggleConfidentiality"
                 @error="updateError = $event"
diff --git a/app/assets/javascripts/work_items/components/work_item_sticky_header.vue b/app/assets/javascripts/work_items/components/work_item_sticky_header.vue
index 3421792259e..12f619e7b86 100644
--- a/app/assets/javascripts/work_items/components/work_item_sticky_header.vue
+++ b/app/assets/javascripts/work_items/components/work_item_sticky_header.vue
@@ -71,6 +71,10 @@ export default {
       required: false,
       default: 0,
     },
+    isGroup: {
+      type: Boolean,
+      required: true,
+    },
   },
   computed: {
     canUpdate() {
@@ -175,6 +179,7 @@ export default {
             :work-item-state="workItem.state"
             :is-modal="isModal"
             :work-item-author-id="workItemAuthorId"
+            :is-group="isGroup"
             @deleteWorkItem="$emit('deleteWorkItem')"
             @toggleWorkItemConfidentiality="
               $emit('toggleWorkItemConfidentiality', !workItem.confidential)
diff --git a/app/assets/javascripts/work_items/constants.js b/app/assets/javascripts/work_items/constants.js
index a424d2847b4..be29637931c 100644
--- a/app/assets/javascripts/work_items/constants.js
+++ b/app/assets/javascripts/work_items/constants.js
@@ -344,6 +344,7 @@ export const DEFAULT_EPIC_COLORS = '#1068bf';
 
 export const MAX_FREQUENT_PROJECTS = 3;
 export const CREATE_NEW_WORK_ITEM_MODAL = 'create_new_work_item_modal';
+export const RELATED_ITEM_ID_URL_QUERY_PARAM = 'related_item_id';
 
 export const WORK_ITEM_REFERENCE_CHAR = '#';
 
diff --git a/app/assets/javascripts/work_items/graphql/work_item_related_item.query.graphql b/app/assets/javascripts/work_items/graphql/work_item_related_item.query.graphql
new file mode 100644
index 00000000000..c820a825a7d
--- /dev/null
+++ b/app/assets/javascripts/work_items/graphql/work_item_related_item.query.graphql
@@ -0,0 +1,10 @@
+query workItemRelatedItem($id: WorkItemID!) {
+  workItem(id: $id) {
+    id
+    reference
+    workItemType {
+      id
+      name
+    }
+  }
+}
diff --git a/app/assets/javascripts/work_items/pages/create_work_item.vue b/app/assets/javascripts/work_items/pages/create_work_item.vue
index 206cc819574..331e8637b3e 100644
--- a/app/assets/javascripts/work_items/pages/create_work_item.vue
+++ b/app/assets/javascripts/work_items/pages/create_work_item.vue
@@ -1,7 +1,8 @@
 <script>
-import { visitUrl } from '~/lib/utils/url_utility';
+import { visitUrl, getParameterByName, updateHistory, removeParams } from '~/lib/utils/url_utility';
 import CreateWorkItem from '../components/create_work_item.vue';
-import { ROUTES } from '../constants';
+import { ROUTES, RELATED_ITEM_ID_URL_QUERY_PARAM } from '../constants';
+import workItemRelatedItemQuery from '../graphql/work_item_related_item.query.graphql';
 
 export default {
   name: 'CreateWorkItemPage',
@@ -16,6 +17,36 @@ export default {
       default: null,
     },
   },
+  data() {
+    return {
+      relatedItem: null,
+      relatedItemId: getParameterByName(RELATED_ITEM_ID_URL_QUERY_PARAM),
+    };
+  },
+  apollo: {
+    relatedItem: {
+      query: workItemRelatedItemQuery,
+      variables() {
+        return {
+          id: this.relatedItemId,
+        };
+      },
+      skip() {
+        return !this.relatedItemId;
+      },
+      update(data) {
+        return {
+          id: this.relatedItemId,
+          reference: data.workItem.reference,
+          type: data.workItem.workItemType.name,
+        };
+      },
+      error() {
+        // if we cannot find an item with the given id, ignore it and remove it from the url.
+        updateHistory({ url: removeParams([RELATED_ITEM_ID_URL_QUERY_PARAM]), replace: true });
+      },
+    },
+  },
   methods: {
     workItemCreated(workItem) {
       if (this.$router) {
@@ -35,6 +66,7 @@ export default {
   <create-work-item
     :work-item-type-name="workItemTypeName"
     :is-group="isGroup"
+    :related-item="relatedItem"
     @workItemCreated="workItemCreated"
   />
 </template>
diff --git a/app/assets/javascripts/work_items/utils.js b/app/assets/javascripts/work_items/utils.js
index d85f76fa155..c75cbdb9541 100644
--- a/app/assets/javascripts/work_items/utils.js
+++ b/app/assets/javascripts/work_items/utils.js
@@ -161,12 +161,12 @@ export const markdownPreviewPath = ({ fullPath, iid, isGroup = false }) => {
 };
 
 // the path for creating a new work item of that type, e.g. /groups/gitlab-org/-/epics/new
-export const newWorkItemPath = ({ fullPath, isGroup = false, workItemTypeName }) => {
+export const newWorkItemPath = ({ fullPath, isGroup = false, workItemTypeName, query = '' }) => {
   const domain = gon.relative_url_root || '';
   const basePath = isGroup ? `groups/${fullPath}` : fullPath;
   const type =
     WORK_ITEMS_TYPE_MAP[workItemTypeName]?.routeParamName || WORK_ITEM_TYPE_ROUTE_WORK_ITEM;
-  return `${domain}/${basePath}/-/${type}/new`;
+  return `${domain}/${basePath}/-/${type}/new${query}`;
 };
 
 export const getDisplayReference = (workItemFullPath, workitemReference) => {
diff --git a/app/controllers/projects/settings/repository_controller.rb b/app/controllers/projects/settings/repository_controller.rb
index e6a0adbffae..ccf8c402a9a 100644
--- a/app/controllers/projects/settings/repository_controller.rb
+++ b/app/controllers/projects/settings/repository_controller.rb
@@ -9,6 +9,7 @@ module Projects
 
       before_action do
         push_frontend_feature_flag(:edit_branch_rules, @project)
+        push_frontend_feature_flag(:branch_rule_squash_settings, @project)
         push_frontend_ability(ability: :admin_project, resource: @project, user: current_user)
         push_frontend_ability(ability: :admin_protected_branch, resource: @project, user: current_user)
       end
diff --git a/app/finders/projects/ml/experiment_finder.rb b/app/finders/projects/ml/experiment_finder.rb
index 768754ae0a1..12867437e91 100644
--- a/app/finders/projects/ml/experiment_finder.rb
+++ b/app/finders/projects/ml/experiment_finder.rb
@@ -22,7 +22,6 @@ module Projects
       def relation
         @experiments = ::Ml::Experiment
             .by_project(project)
-            .exclude_experiments_for_models
             .including_project
 
         with_candidate_count
diff --git a/app/models/packages/package.rb b/app/models/packages/package.rb
index bf3585a75b0..38e536924eb 100644
--- a/app/models/packages/package.rb
+++ b/app/models/packages/package.rb
@@ -323,8 +323,6 @@ class Packages::Package < ApplicationRecord
   # This is a temp advisory lock to prevent race conditions. We will switch to use database `upsert`
   # once we have a database unique index: https://gitlab.com/gitlab-org/gitlab/-/issues/424238#note_2187274213
   def prevent_concurrent_inserts
-    return if Feature.disabled?(:use_exclusive_lease_in_mvn_find_or_create_package, project)
-
     lock_key = [self.class.table_name, project_id, name, version].join('-')
     lock_expression = "hashtext(#{connection.quote(lock_key)})"
 
diff --git a/app/models/sent_notification.rb b/app/models/sent_notification.rb
index 43db987af43..b39c6649089 100644
--- a/app/models/sent_notification.rb
+++ b/app/models/sent_notification.rb
@@ -15,8 +15,6 @@ class SentNotification < ApplicationRecord
   validates :in_reply_to_discussion_id, format: { with: /\A\h{40}\z/, allow_nil: true }
   validate :note_valid
 
-  after_save :keep_around_commit, if: :for_commit?
-
   class << self
     def reply_key
       SecureRandom.hex(16)
@@ -122,8 +120,4 @@ class SentNotification < ApplicationRecord
       )
     end
   end
-
-  def keep_around_commit
-    project.repository.keep_around(self.commit_id, source: self.class.name)
-  end
 end
diff --git a/app/models/todo.rb b/app/models/todo.rb
index 79866926ba2..47eca6686ed 100644
--- a/app/models/todo.rb
+++ b/app/models/todo.rb
@@ -107,8 +107,6 @@ class Todo < ApplicationRecord
     state :done
   end
 
-  after_save :keep_around_commit, if: :commit_id
-
   class << self
     # Returns all todos for the given group ids and their descendants.
     #
@@ -388,10 +386,6 @@ class Todo < ApplicationRecord
 
   private
 
-  def keep_around_commit
-    project.repository.keep_around(self.commit_id, source: self.class.name)
-  end
-
   def build_work_item_target_url
     ::Gitlab::UrlBuilder.build(
       target,
diff --git a/app/services/packages/maven/create_package_service.rb b/app/services/packages/maven/create_package_service.rb
index 62ae308cddc..cc6524b829d 100644
--- a/app/services/packages/maven/create_package_service.rb
+++ b/app/services/packages/maven/create_package_service.rb
@@ -18,12 +18,7 @@ module Packages
 
         ServiceResponse.success(payload: { package: package })
       rescue ActiveRecord::RecordInvalid => e
-        reason = if e.record&.errors&.of_kind?(:name, :taken) && ::Feature.enabled?(
-          :use_exclusive_lease_in_mvn_find_or_create_package, project)
-                   :name_taken
-                 else
-                   :invalid_parameter
-                 end
+        reason = e.record&.errors&.of_kind?(:name, :taken) ? :name_taken : :invalid_parameter
 
         ServiceResponse.error(message: e.message, reason: reason)
       end
diff --git a/config/feature_flags/beta/pipeline_vulnerability_code_flow.yml b/config/feature_flags/beta/pipeline_vulnerability_code_flow.yml
index 3291c3eec88..4189f4c11b4 100644
--- a/config/feature_flags/beta/pipeline_vulnerability_code_flow.yml
+++ b/config/feature_flags/beta/pipeline_vulnerability_code_flow.yml
@@ -4,6 +4,6 @@ feature_issue_url: https://gitlab.com/gitlab-org/gitlab/-/issues/458062
 introduced_by_url: https://gitlab.com/gitlab-org/gitlab/-/merge_requests/159610
 rollout_issue_url: https://gitlab.com/gitlab-org/gitlab/-/issues/483039
 milestone: '17.5'
-group: group::static analysis
+group: group::security platform management
 type: beta
 default_enabled: true
diff --git a/config/feature_flags/beta/vulnerability_code_flow.yml b/config/feature_flags/beta/vulnerability_code_flow.yml
index 84252e20aaa..86d14f482cf 100644
--- a/config/feature_flags/beta/vulnerability_code_flow.yml
+++ b/config/feature_flags/beta/vulnerability_code_flow.yml
@@ -4,6 +4,6 @@ feature_issue_url: https://gitlab.com/gitlab-org/gitlab/-/issues/458062
 introduced_by_url: https://gitlab.com/gitlab-org/gitlab/-/merge_requests/157858
 rollout_issue_url: https://gitlab.com/gitlab-org/gitlab/-/issues/465776
 milestone: '17.2'
-group: group::static analysis
+group: group::security platform management
 type: beta
 default_enabled: true
diff --git a/config/feature_flags/gitlab_com_derisk/use_exclusive_lease_in_mvn_find_or_create_package.yml b/config/feature_flags/wip/branch_rule_squash_settings.yml
similarity index 57%
rename from config/feature_flags/gitlab_com_derisk/use_exclusive_lease_in_mvn_find_or_create_package.yml
rename to config/feature_flags/wip/branch_rule_squash_settings.yml
index 48e8cedf6ba..078c749e160 100644
--- a/config/feature_flags/gitlab_com_derisk/use_exclusive_lease_in_mvn_find_or_create_package.yml
+++ b/config/feature_flags/wip/branch_rule_squash_settings.yml
@@ -1,9 +1,9 @@
 ---
-name: use_exclusive_lease_in_mvn_find_or_create_package
-feature_issue_url: https://gitlab.com/gitlab-org/gitlab/-/issues/424238
-introduced_by_url: https://gitlab.com/gitlab-org/gitlab/-/merge_requests/170916
-rollout_issue_url: https://gitlab.com/gitlab-org/gitlab/-/issues/501019
-milestone: '17.6'
-group: group::package registry
-type: gitlab_com_derisk
+name: branch_rule_squash_settings
+feature_issue_url: https://gitlab.com/gitlab-org/gitlab/-/issues/498701
+introduced_by_url: https://gitlab.com/gitlab-org/gitlab/-/merge_requests/173991
+rollout_issue_url: https://gitlab.com/gitlab-org/gitlab/-/issues/506542
+milestone: '17.7'
+group: group::source code
+type: wip
 default_enabled: false
diff --git a/db/migrate/20231031114050_add_highest_severity_and_vulnerability_count_into_sbom_occurrences.rb b/db/migrate/20231031114050_add_highest_severity_and_vulnerability_count_into_sbom_occurrences.rb
index 621db3aea56..7b33d31b642 100644
--- a/db/migrate/20231031114050_add_highest_severity_and_vulnerability_count_into_sbom_occurrences.rb
+++ b/db/migrate/20231031114050_add_highest_severity_and_vulnerability_count_into_sbom_occurrences.rb
@@ -4,9 +4,7 @@ class AddHighestSeverityAndVulnerabilityCountIntoSbomOccurrences < Gitlab::Datab
   milestone '16.7'
 
   def change
-    add_column :sbom_occurrences, :highest_severity, :smallint, null: true # rubocop:disable Migration/PreventAddingColumns -- Legacy migration
-    # rubocop:disable Migration/PreventAddingColumns -- Legacy migration
+    add_column :sbom_occurrences, :highest_severity, :smallint, null: true
     add_column :sbom_occurrences, :vulnerability_count, :integer, null: false, default: 0
-    # rubocop:enable Migration/PreventAddingColumns
   end
 end
diff --git a/db/migrate/20231221033539_create_sbom_source_packages_table.rb b/db/migrate/20231221033539_create_sbom_source_packages_table.rb
index 382fe22d60e..2528102270c 100644
--- a/db/migrate/20231221033539_create_sbom_source_packages_table.rb
+++ b/db/migrate/20231221033539_create_sbom_source_packages_table.rb
@@ -13,9 +13,7 @@ class CreateSbomSourcePackagesTable < Gitlab::Database::Migration[2.2]
   # rubocop:disable Migration/PreventIndexCreation -- Legacy migration
   def up
     with_lock_retries do
-      # rubocop:disable Migration/PreventAddingColumns -- Legacy migration
       add_column :sbom_occurrences, :source_package_id, :bigint, if_not_exists: true
-      # rubocop:enable Migration/PreventAddingColumns
     end
 
     create_table :sbom_source_packages, if_not_exists: true do |t|
diff --git a/db/migrate/20240104142200_add_index_sent_notifications_on_issue_email_participant_id.rb b/db/migrate/20240104142200_add_index_sent_notifications_on_issue_email_participant_id.rb
index f7d17a28c12..c9b75529470 100644
--- a/db/migrate/20240104142200_add_index_sent_notifications_on_issue_email_participant_id.rb
+++ b/db/migrate/20240104142200_add_index_sent_notifications_on_issue_email_participant_id.rb
@@ -7,11 +7,9 @@ class AddIndexSentNotificationsOnIssueEmailParticipantId < Gitlab::Database::Mig
 
   INDEX_NAME = 'index_sent_notifications_on_issue_email_participant_id'
 
-  # rubocop:disable Migration/PreventIndexCreation -- Legacy migration
   def up
     add_concurrent_index :sent_notifications, :issue_email_participant_id, name: INDEX_NAME
   end
-  # rubocop:enable Migration/PreventIndexCreation
 
   def down
     remove_concurrent_index_by_name :sent_notifications, INDEX_NAME
diff --git a/db/migrate/20240109145839_add_partition_id_to_pipeline_config.rb b/db/migrate/20240109145839_add_partition_id_to_pipeline_config.rb
index 943ff8d6080..e4f661a5e31 100644
--- a/db/migrate/20240109145839_add_partition_id_to_pipeline_config.rb
+++ b/db/migrate/20240109145839_add_partition_id_to_pipeline_config.rb
@@ -5,8 +5,6 @@ class AddPartitionIdToPipelineConfig < Gitlab::Database::Migration[2.2]
   enable_lock_retries!
 
   def change
-    # rubocop:disable Migration/PreventAddingColumns -- Legacy migration
     add_column(:ci_pipelines_config, :partition_id, :bigint, default: 100, null: false)
-    # rubocop:enable Migration/PreventAddingColumns
   end
 end
diff --git a/db/migrate/20240129175101_add_archived_and_traversal_ids_columns_to_sbom_occurrences.rb b/db/migrate/20240129175101_add_archived_and_traversal_ids_columns_to_sbom_occurrences.rb
index fa95155580f..4e5cc8736da 100644
--- a/db/migrate/20240129175101_add_archived_and_traversal_ids_columns_to_sbom_occurrences.rb
+++ b/db/migrate/20240129175101_add_archived_and_traversal_ids_columns_to_sbom_occurrences.rb
@@ -4,11 +4,7 @@ class AddArchivedAndTraversalIdsColumnsToSbomOccurrences < Gitlab::Database::Mig
   milestone '16.9'
 
   def change
-    # rubocop:disable Migration/PreventAddingColumns -- Legacy migration
     add_column :sbom_occurrences, :archived, :boolean, default: false, null: false
-    # rubocop:enable Migration/PreventAddingColumns
-    # rubocop:disable Migration/PreventAddingColumns -- Legacy migration
     add_column :sbom_occurrences, :traversal_ids, 'bigint[]', default: [], null: false
-    # rubocop:enable Migration/PreventAddingColumns
   end
 end
diff --git a/db/migrate/20240212170304_add_ancestors_column_to_sbom_occurrences.rb b/db/migrate/20240212170304_add_ancestors_column_to_sbom_occurrences.rb
index d5ba53f3112..459ce27da38 100644
--- a/db/migrate/20240212170304_add_ancestors_column_to_sbom_occurrences.rb
+++ b/db/migrate/20240212170304_add_ancestors_column_to_sbom_occurrences.rb
@@ -6,9 +6,7 @@ class AddAncestorsColumnToSbomOccurrences < Gitlab::Database::Migration[2.2]
   enable_lock_retries!
 
   def up
-    # rubocop:disable Migration/PreventAddingColumns -- Legacy migration
     add_column :sbom_occurrences, :ancestors, :jsonb, default: [], null: false
-    # rubocop:enable Migration/PreventAddingColumns
   end
 
   def down
diff --git a/db/migrate/20240320110318_add_file_final_path_to_packages_package_files.rb b/db/migrate/20240320110318_add_file_final_path_to_packages_package_files.rb
index 0bd245137bc..2f9c166ea25 100644
--- a/db/migrate/20240320110318_add_file_final_path_to_packages_package_files.rb
+++ b/db/migrate/20240320110318_add_file_final_path_to_packages_package_files.rb
@@ -6,9 +6,7 @@ class AddFileFinalPathToPackagesPackageFiles < Gitlab::Database::Migration[2.2]
 
   def up
     with_lock_retries do
-      # rubocop:disable Migration/PreventAddingColumns -- Legacy migration
       add_column :packages_package_files, :file_final_path, :text, if_not_exists: true
-      # rubocop:enable Migration/PreventAddingColumns
     end
 
     add_text_limit :packages_package_files, :file_final_path, 1024
diff --git a/db/migrate/20240516133122_add_partition_id_to_ci_pipeline_message.rb b/db/migrate/20240516133122_add_partition_id_to_ci_pipeline_message.rb
index 11e39dd0640..1b29d339e63 100644
--- a/db/migrate/20240516133122_add_partition_id_to_ci_pipeline_message.rb
+++ b/db/migrate/20240516133122_add_partition_id_to_ci_pipeline_message.rb
@@ -4,8 +4,6 @@ class AddPartitionIdToCiPipelineMessage < Gitlab::Database::Migration[2.2]
   milestone '17.1'
 
   def change
-    # rubocop:disable Migration/PreventAddingColumns -- Legacy migration
     add_column(:ci_pipeline_messages, :partition_id, :bigint, default: 100, null: false)
-    # rubocop:enable Migration/PreventAddingColumns
   end
 end
diff --git a/db/migrate/20240517192053_add_advanced_token_scope.rb b/db/migrate/20240517192053_add_advanced_token_scope.rb
index e6b85b9fc64..fb34cdcaea9 100644
--- a/db/migrate/20240517192053_add_advanced_token_scope.rb
+++ b/db/migrate/20240517192053_add_advanced_token_scope.rb
@@ -7,9 +7,7 @@ class AddAdvancedTokenScope < Gitlab::Database::Migration[2.2]
 
   def up
     with_lock_retries do
-      # rubocop:disable Migration/PreventAddingColumns -- Legacy migration
       add_column :personal_access_tokens, :advanced_scopes, :text, if_not_exists: true
-      # rubocop:enable Migration/PreventAddingColumns
     end
 
     add_text_limit :personal_access_tokens, :advanced_scopes, 4096
diff --git a/db/migrate/20240627121919_add_auto_canceled_by_partition_id_to_ci_pipelines.rb b/db/migrate/20240627121919_add_auto_canceled_by_partition_id_to_ci_pipelines.rb
index 035046c0d39..10e95433bb2 100644
--- a/db/migrate/20240627121919_add_auto_canceled_by_partition_id_to_ci_pipelines.rb
+++ b/db/migrate/20240627121919_add_auto_canceled_by_partition_id_to_ci_pipelines.rb
@@ -4,6 +4,8 @@ class AddAutoCanceledByPartitionIdToCiPipelines < Gitlab::Database::Migration[2.
   milestone '17.2'
 
   def change
-    add_column :ci_pipelines, :auto_canceled_by_partition_id, :bigint # rubocop:disable Migration/PreventAddingColumns -- Legacy migration
+    # rubocop:disable Migration/PreventAddingColumns -- Legacy migration
+    add_column :ci_pipelines, :auto_canceled_by_partition_id, :bigint
+    # rubocop:enable Migration/PreventAddingColumns
   end
 end
diff --git a/db/migrate/20240729130349_add_project_id_to_packages_package_files.rb b/db/migrate/20240729130349_add_project_id_to_packages_package_files.rb
index 97b5f22de22..264f28f8886 100644
--- a/db/migrate/20240729130349_add_project_id_to_packages_package_files.rb
+++ b/db/migrate/20240729130349_add_project_id_to_packages_package_files.rb
@@ -4,6 +4,6 @@ class AddProjectIdToPackagesPackageFiles < Gitlab::Database::Migration[2.2]
   milestone '17.3'
 
   def change
-    add_column :packages_package_files, :project_id, :bigint # rubocop:disable Migration/PreventAddingColumns -- Legacy migration
+    add_column :packages_package_files, :project_id, :bigint
   end
 end
diff --git a/db/migrate/20240730172815_add_project_id_to_vulnerability_occurrence_pipelines.rb b/db/migrate/20240730172815_add_project_id_to_vulnerability_occurrence_pipelines.rb
index 32cfb192daf..5b54c0fc3a2 100644
--- a/db/migrate/20240730172815_add_project_id_to_vulnerability_occurrence_pipelines.rb
+++ b/db/migrate/20240730172815_add_project_id_to_vulnerability_occurrence_pipelines.rb
@@ -4,6 +4,6 @@ class AddProjectIdToVulnerabilityOccurrencePipelines < Gitlab::Database::Migrati
   milestone '17.3'
 
   def change
-    add_column :vulnerability_occurrence_pipelines, :project_id, :bigint # rubocop:disable Migration/PreventAddingColumns -- Legacy migration
+    add_column :vulnerability_occurrence_pipelines, :project_id, :bigint
   end
 end
diff --git a/db/migrate/20240802194745_add_project_id_to_merge_request_diff_commits_b5377a7a34.rb b/db/migrate/20240802194745_add_project_id_to_merge_request_diff_commits_b5377a7a34.rb
index 8c52ceb9141..9072b546eee 100644
--- a/db/migrate/20240802194745_add_project_id_to_merge_request_diff_commits_b5377a7a34.rb
+++ b/db/migrate/20240802194745_add_project_id_to_merge_request_diff_commits_b5377a7a34.rb
@@ -4,9 +4,7 @@ class AddProjectIdToMergeRequestDiffCommitsB5377a7a34 < Gitlab::Database::Migrat
   milestone '17.3'
 
   def up
-    # rubocop:disable Migration/PreventAddingColumns -- Legacy migration
     add_column :merge_request_diff_commits_b5377a7a34, :project_id, :bigint
-    # rubocop:enable Migration/PreventAddingColumns
   end
 
   def down
diff --git a/db/migrate/20240802203135_add_project_id_to_merge_request_diff_files99208b8fac.rb b/db/migrate/20240802203135_add_project_id_to_merge_request_diff_files99208b8fac.rb
index 63067fa2835..77520c16be6 100644
--- a/db/migrate/20240802203135_add_project_id_to_merge_request_diff_files99208b8fac.rb
+++ b/db/migrate/20240802203135_add_project_id_to_merge_request_diff_files99208b8fac.rb
@@ -4,7 +4,7 @@ class AddProjectIdToMergeRequestDiffFiles99208b8fac < Gitlab::Database::Migratio
   milestone '17.3'
 
   def up
-    add_column :merge_request_diff_files_99208b8fac, :project_id, :bigint # rubocop:disable Migration/PreventAddingColumns -- Legacy migration
+    add_column :merge_request_diff_files_99208b8fac, :project_id, :bigint
   end
 
   def down
diff --git a/db/migrate/20240805080941_add_organization_id_to_personal_access_tokens.rb b/db/migrate/20240805080941_add_organization_id_to_personal_access_tokens.rb
index 495cbc2ae33..e0fe35d7ad7 100644
--- a/db/migrate/20240805080941_add_organization_id_to_personal_access_tokens.rb
+++ b/db/migrate/20240805080941_add_organization_id_to_personal_access_tokens.rb
@@ -9,9 +9,7 @@ class AddOrganizationIdToPersonalAccessTokens < Gitlab::Database::Migration[2.2]
 
   def up
     with_lock_retries do
-      # rubocop:disable Migration/PreventAddingColumns -- Legacy migration
       add_column :personal_access_tokens, :organization_id, :bigint, default: DEFAULT_ORGANIZATION_ID, null: false,
-        # rubocop:enable Migration/PreventAddingColumns
         if_not_exists: true
     end
     # rubocop:disable Migration/PreventIndexCreation -- Legacy migration
diff --git a/db/migrate/20240805081832_add_reachability_column_to_sbom_occurances_table.rb b/db/migrate/20240805081832_add_reachability_column_to_sbom_occurances_table.rb
index d0b413f5059..7648f1da32d 100644
--- a/db/migrate/20240805081832_add_reachability_column_to_sbom_occurances_table.rb
+++ b/db/migrate/20240805081832_add_reachability_column_to_sbom_occurances_table.rb
@@ -4,7 +4,7 @@ class AddReachabilityColumnToSbomOccurancesTable < Gitlab::Database::Migration[2
   milestone '17.4'
   def up
     with_lock_retries do
-      add_column :sbom_occurrences, :reachability, :smallint, default: 0 # rubocop:disable Migration/PreventAddingColumns -- Legacy migration
+      add_column :sbom_occurrences, :reachability, :smallint, default: 0 # -- Legacy migration
     end
   end
 
diff --git a/db/migrate/20240822195511_add_notification_cols_to_personal_access_tokens.rb b/db/migrate/20240822195511_add_notification_cols_to_personal_access_tokens.rb
index 0df734bcbf0..e934da182fd 100644
--- a/db/migrate/20240822195511_add_notification_cols_to_personal_access_tokens.rb
+++ b/db/migrate/20240822195511_add_notification_cols_to_personal_access_tokens.rb
@@ -4,15 +4,9 @@ class AddNotificationColsToPersonalAccessTokens < Gitlab::Database::Migration[2.
   milestone '17.4'
 
   def up
-    # rubocop:disable Migration/PreventAddingColumns -- Legacy migration
     add_column :personal_access_tokens, :seven_days_notification_sent_at, :datetime_with_timezone
-    # rubocop:enable Migration/PreventAddingColumns
-    # rubocop:disable Migration/PreventAddingColumns -- Legacy migration
     add_column :personal_access_tokens, :thirty_days_notification_sent_at, :datetime_with_timezone
-    # rubocop:enable Migration/PreventAddingColumns
-    # rubocop:disable Migration/PreventAddingColumns -- Legacy migration
     add_column :personal_access_tokens, :sixty_days_notification_sent_at, :datetime_with_timezone
-    # rubocop:enable Migration/PreventAddingColumns
   end
 
   def down
diff --git a/db/migrate/20241014081022_add_project_id_to_ci_pipeline_messages.rb b/db/migrate/20241014081022_add_project_id_to_ci_pipeline_messages.rb
index 08a283122ca..804ada9dcfb 100644
--- a/db/migrate/20241014081022_add_project_id_to_ci_pipeline_messages.rb
+++ b/db/migrate/20241014081022_add_project_id_to_ci_pipeline_messages.rb
@@ -4,6 +4,6 @@ class AddProjectIdToCiPipelineMessages < Gitlab::Database::Migration[2.2]
   milestone '17.6'
 
   def change
-    add_column(:ci_pipeline_messages, :project_id, :bigint) # rubocop:disable Migration/PreventAddingColumns -- Legacy migration
+    add_column(:ci_pipeline_messages, :project_id, :bigint)
   end
 end
diff --git a/db/migrate/20241021141853_add_auto_resolved_to_vulnerabilities.rb b/db/migrate/20241021141853_add_auto_resolved_to_vulnerabilities.rb
index e026853857d..e94c532cff6 100644
--- a/db/migrate/20241021141853_add_auto_resolved_to_vulnerabilities.rb
+++ b/db/migrate/20241021141853_add_auto_resolved_to_vulnerabilities.rb
@@ -4,8 +4,6 @@ class AddAutoResolvedToVulnerabilities < Gitlab::Database::Migration[2.2]
   milestone '17.6'
 
   def change
-    # rubocop:disable Migration/PreventAddingColumns -- Legacy migration
     add_column :vulnerabilities, :auto_resolved, :boolean, null: false, default: false, if_not_exists: true
-    # rubocop:enable Migration/PreventAddingColumns
   end
 end
diff --git a/db/post_migrate/20231114034507_add_merge_request_diffs_project_id_index_async.rb b/db/post_migrate/20231114034507_add_merge_request_diffs_project_id_index_async.rb
index 7cb1ed3e8f1..1c783b922ae 100644
--- a/db/post_migrate/20231114034507_add_merge_request_diffs_project_id_index_async.rb
+++ b/db/post_migrate/20231114034507_add_merge_request_diffs_project_id_index_async.rb
@@ -6,11 +6,9 @@ class AddMergeRequestDiffsProjectIdIndexAsync < Gitlab::Database::Migration[2.2]
 
   INDEX_NAME = 'index_merge_request_diffs_on_project_id'
 
-  # rubocop:disable Migration/PreventIndexCreation -- Legacy migration
   def up
     prepare_async_index :merge_request_diffs, :project_id, name: INDEX_NAME
   end
-  # rubocop:enable Migration/PreventIndexCreation
 
   def down
     unprepare_async_index :merge_request_diffs, :project_id, name: INDEX_NAME
diff --git a/db/post_migrate/20231121040153_add_merge_request_diffs_project_id_index.rb b/db/post_migrate/20231121040153_add_merge_request_diffs_project_id_index.rb
index 29171cc501c..5576e9d534e 100644
--- a/db/post_migrate/20231121040153_add_merge_request_diffs_project_id_index.rb
+++ b/db/post_migrate/20231121040153_add_merge_request_diffs_project_id_index.rb
@@ -6,11 +6,9 @@ class AddMergeRequestDiffsProjectIdIndex < Gitlab::Database::Migration[2.2]
 
   INDEX_NAME = 'index_merge_request_diffs_on_project_id'
 
-  # rubocop:disable Migration/PreventIndexCreation -- Legacy migration
   def up
     add_concurrent_index :merge_request_diffs, :project_id, name: INDEX_NAME
   end
-  # rubocop:enable Migration/PreventIndexCreation
 
   def down
     remove_concurrent_index_by_name :merge_request_diffs, name: INDEX_NAME
diff --git a/db/post_migrate/20231207155340_prepare_iid_namespace_unique_index_in_issues.rb b/db/post_migrate/20231207155340_prepare_iid_namespace_unique_index_in_issues.rb
index ea6149612e0..a0149a79f83 100644
--- a/db/post_migrate/20231207155340_prepare_iid_namespace_unique_index_in_issues.rb
+++ b/db/post_migrate/20231207155340_prepare_iid_namespace_unique_index_in_issues.rb
@@ -6,11 +6,9 @@ class PrepareIidNamespaceUniqueIndexInIssues < Gitlab::Database::Migration[2.2]
   milestone '16.8'
 
   # TODO: Index to be created synchronously in https://gitlab.com/gitlab-org/gitlab/-/issues/435856
-  # rubocop:disable Migration/PreventIndexCreation -- Legacy migration
   def up
     prepare_async_index :issues, [:namespace_id, :iid], unique: true, name: INDEX_NAME
   end
-  # rubocop:enable Migration/PreventIndexCreation
 
   def down
     unprepare_async_index :issues, [:namespace_id, :iid], unique: true, name: INDEX_NAME
diff --git a/db/post_migrate/20231207211418_add_iid_namespace_unique_index_to_issues.rb b/db/post_migrate/20231207211418_add_iid_namespace_unique_index_to_issues.rb
index 6fb51f02d4f..4c2439f33ea 100644
--- a/db/post_migrate/20231207211418_add_iid_namespace_unique_index_to_issues.rb
+++ b/db/post_migrate/20231207211418_add_iid_namespace_unique_index_to_issues.rb
@@ -7,11 +7,9 @@ class AddIidNamespaceUniqueIndexToIssues < Gitlab::Database::Migration[2.2]
 
   milestone '16.8'
 
-  # rubocop:disable Migration/PreventIndexCreation -- Legacy migration
   def up
     add_concurrent_index :issues, [:namespace_id, :iid], name: INDEX_NAME, unique: true
   end
-  # rubocop:enable Migration/PreventIndexCreation
 
   def down
     remove_concurrent_index_by_name :issues, INDEX_NAME
diff --git a/db/post_migrate/20231215130625_schedule_index_to_events_author_group_action_target_type_created_at.rb b/db/post_migrate/20231215130625_schedule_index_to_events_author_group_action_target_type_created_at.rb
index 09864109e95..1e3658aa697 100644
--- a/db/post_migrate/20231215130625_schedule_index_to_events_author_group_action_target_type_created_at.rb
+++ b/db/post_migrate/20231215130625_schedule_index_to_events_author_group_action_target_type_created_at.rb
@@ -6,11 +6,9 @@ class ScheduleIndexToEventsAuthorGroupActionTargetTypeCreatedAt < Gitlab::Databa
   INDEX_NAME = 'index_events_author_id_group_id_action_target_type_created_at'
   COLUMNS = [:author_id, :group_id, :action, :target_type, :created_at]
 
-  # rubocop:disable Migration/PreventIndexCreation -- Legacy migration
   def up
     prepare_async_index :events, COLUMNS, name: INDEX_NAME
   end
-  # rubocop:enable Migration/PreventIndexCreation
 
   def down
     unprepare_async_index :events, COLUMNS, name: INDEX_NAME
diff --git a/db/post_migrate/20231218074237_add_index_to_ci_job_artifact_states.rb b/db/post_migrate/20231218074237_add_index_to_ci_job_artifact_states.rb
index bd0a46f14ba..7179607fda4 100644
--- a/db/post_migrate/20231218074237_add_index_to_ci_job_artifact_states.rb
+++ b/db/post_migrate/20231218074237_add_index_to_ci_job_artifact_states.rb
@@ -7,7 +7,9 @@ class AddIndexToCiJobArtifactStates < Gitlab::Database::Migration[2.2]
   TABLE_NAME = :ci_job_artifact_states
 
   def up
+    # rubocop:disable Migration/PreventIndexCreation -- Legacy migration
     add_concurrent_index(TABLE_NAME, [:job_artifact_id, :partition_id], name: INDEX_NAME)
+    # rubocop:enable Migration/PreventIndexCreation
   end
 
   def down
diff --git a/db/post_migrate/20231218074508_add_index_to_ci_build_trace_metadata.rb b/db/post_migrate/20231218074508_add_index_to_ci_build_trace_metadata.rb
index e3d32471607..574c71034fe 100644
--- a/db/post_migrate/20231218074508_add_index_to_ci_build_trace_metadata.rb
+++ b/db/post_migrate/20231218074508_add_index_to_ci_build_trace_metadata.rb
@@ -7,9 +7,7 @@ class AddIndexToCiBuildTraceMetadata < Gitlab::Database::Migration[2.2]
   TABLE_NAME = :ci_build_trace_metadata
 
   def up
-    # rubocop:disable Migration/PreventIndexCreation -- Legacy migration
     add_concurrent_index(TABLE_NAME, [:trace_artifact_id, :partition_id], name: INDEX_NAME)
-    # rubocop:enable Migration/PreventIndexCreation
   end
 
   def down
diff --git a/db/post_migrate/20240104223119_add_index_owasp_top_10_with_project_id_on_vulnerability_reads.rb b/db/post_migrate/20240104223119_add_index_owasp_top_10_with_project_id_on_vulnerability_reads.rb
index 7af57a7f400..99a2dccc8f5 100644
--- a/db/post_migrate/20240104223119_add_index_owasp_top_10_with_project_id_on_vulnerability_reads.rb
+++ b/db/post_migrate/20240104223119_add_index_owasp_top_10_with_project_id_on_vulnerability_reads.rb
@@ -8,9 +8,7 @@ class AddIndexOwaspTop10WithProjectIdOnVulnerabilityReads < Gitlab::Database::Mi
   INDEX_NAME = 'index_vuln_reads_on_project_id_owasp_top_10'
 
   def up
-    # rubocop:disable Migration/PreventIndexCreation -- Legacy migration
     add_concurrent_index :vulnerability_reads, [:project_id, :owasp_top_10], name: INDEX_NAME
-    # rubocop:enable Migration/PreventIndexCreation
   end
 
   def down
diff --git a/db/post_migrate/20240112143548_add_index_to_events_author_group_action_target_type.rb b/db/post_migrate/20240112143548_add_index_to_events_author_group_action_target_type.rb
index 36b75d0e7d8..88e5f95ef68 100644
--- a/db/post_migrate/20240112143548_add_index_to_events_author_group_action_target_type.rb
+++ b/db/post_migrate/20240112143548_add_index_to_events_author_group_action_target_type.rb
@@ -8,11 +8,9 @@ class AddIndexToEventsAuthorGroupActionTargetType < Gitlab::Database::Migration[
   INDEX_NAME = 'index_events_author_id_group_id_action_target_type_created_at'
   COLUMNS = [:author_id, :group_id, :action, :target_type, :created_at]
 
-  # rubocop:disable Migration/PreventIndexCreation -- Legacy migration
   def up
     add_concurrent_index :events, COLUMNS, name: INDEX_NAME
   end
-  # rubocop:enable Migration/PreventIndexCreation
 
   def down
     remove_concurrent_index_by_name :events, INDEX_NAME
diff --git a/db/post_migrate/20240201111294_add_index_on_issues_table_tmp_epic_id_column.rb b/db/post_migrate/20240201111294_add_index_on_issues_table_tmp_epic_id_column.rb
index 32d33fe9e81..76e8323973b 100644
--- a/db/post_migrate/20240201111294_add_index_on_issues_table_tmp_epic_id_column.rb
+++ b/db/post_migrate/20240201111294_add_index_on_issues_table_tmp_epic_id_column.rb
@@ -6,11 +6,9 @@ class AddIndexOnIssuesTableTmpEpicIdColumn < Gitlab::Database::Migration[2.2]
 
   INDEX_NAME = "tmp_index_issues_on_tmp_epic_id"
 
-  # rubocop:disable Migration/PreventIndexCreation -- Legacy migration
   def up
     add_concurrent_index :issues, :tmp_epic_id, unique: true, name: INDEX_NAME
   end
-  # rubocop:enable Migration/PreventIndexCreation
 
   def down
     remove_concurrent_index_by_name :issues, name: INDEX_NAME
diff --git a/db/post_migrate/20240213125429_schedule_index_merge_requests_on_unmerged_state_id.rb b/db/post_migrate/20240213125429_schedule_index_merge_requests_on_unmerged_state_id.rb
index bf1f60c809f..e7b1fbe68a4 100644
--- a/db/post_migrate/20240213125429_schedule_index_merge_requests_on_unmerged_state_id.rb
+++ b/db/post_migrate/20240213125429_schedule_index_merge_requests_on_unmerged_state_id.rb
@@ -6,11 +6,9 @@ class ScheduleIndexMergeRequestsOnUnmergedStateId < Gitlab::Database::Migration[
   INDEX_NAME = :idx_merge_requests_on_unmerged_state_id
   TABLE_NAME = :merge_requests
 
-  # rubocop:disable Migration/PreventIndexCreation -- Legacy migration
   def up
     prepare_async_index(TABLE_NAME, :id, name: INDEX_NAME, where: "state_id <> 3")
   end
-  # rubocop:enable Migration/PreventIndexCreation
 
   def down
     unprepare_async_index(TABLE_NAME, :id, name: INDEX_NAME)
diff --git a/db/post_migrate/20240325085542_add_index_merge_requests_on_unmerged_state_id.rb b/db/post_migrate/20240325085542_add_index_merge_requests_on_unmerged_state_id.rb
index 4af2eb942f3..800dc23e7e5 100644
--- a/db/post_migrate/20240325085542_add_index_merge_requests_on_unmerged_state_id.rb
+++ b/db/post_migrate/20240325085542_add_index_merge_requests_on_unmerged_state_id.rb
@@ -8,11 +8,9 @@ class AddIndexMergeRequestsOnUnmergedStateId < Gitlab::Database::Migration[2.2]
   INDEX_NAME = :idx_merge_requests_on_unmerged_state_id
   TABLE_NAME = :merge_requests
 
-  # rubocop:disable Migration/PreventIndexCreation -- Legacy migration
   def up
     add_concurrent_index(TABLE_NAME, :id, name: INDEX_NAME, where: "state_id <> 3")
   end
-  # rubocop:enable Migration/PreventIndexCreation
 
   def down
     remove_concurrent_index_by_name(TABLE_NAME, INDEX_NAME)
diff --git a/db/post_migrate/20240410104838_index_vulnerability_reads_on_state_report_type_severity_traversal_ids_archived.rb b/db/post_migrate/20240410104838_index_vulnerability_reads_on_state_report_type_severity_traversal_ids_archived.rb
index 599612f7201..6b750eb3fe0 100644
--- a/db/post_migrate/20240410104838_index_vulnerability_reads_on_state_report_type_severity_traversal_ids_archived.rb
+++ b/db/post_migrate/20240410104838_index_vulnerability_reads_on_state_report_type_severity_traversal_ids_archived.rb
@@ -8,9 +8,7 @@ class IndexVulnerabilityReadsOnStateReportTypeSeverityTraversalIdsArchived < Git
   COLUMNS = %i[resolved_on_default_branch state report_type severity traversal_ids vulnerability_id].freeze
 
   def up
-    # rubocop:disable Migration/PreventIndexCreation -- Legacy migration
     add_concurrent_index :vulnerability_reads, COLUMNS, name: INDEX_NAME, where: 'archived = false'
-    # rubocop:enable Migration/PreventIndexCreation
   end
 
   def down
diff --git a/db/post_migrate/20240502120047_index_vulnerability_reads_for_common_group_level_query.rb b/db/post_migrate/20240502120047_index_vulnerability_reads_for_common_group_level_query.rb
index 5f3ab47f2c2..7f1eb48e627 100644
--- a/db/post_migrate/20240502120047_index_vulnerability_reads_for_common_group_level_query.rb
+++ b/db/post_migrate/20240502120047_index_vulnerability_reads_for_common_group_level_query.rb
@@ -8,9 +8,7 @@ class IndexVulnerabilityReadsForCommonGroupLevelQuery < Gitlab::Database::Migrat
   milestone '17.0'
 
   def up
-    # rubocop:disable Migration/PreventIndexCreation -- Legacy migration
     add_concurrent_index :vulnerability_reads, COLUMNS, name: INDEX_NAME, where: 'archived = false'
-    # rubocop:enable Migration/PreventIndexCreation
   end
 
   def down
diff --git a/db/post_migrate/20240514121644_replace_issues_milestone_index.rb b/db/post_migrate/20240514121644_replace_issues_milestone_index.rb
index a1d07d06bf5..eb3d67ae8df 100644
--- a/db/post_migrate/20240514121644_replace_issues_milestone_index.rb
+++ b/db/post_migrate/20240514121644_replace_issues_milestone_index.rb
@@ -6,11 +6,9 @@ class ReplaceIssuesMilestoneIndex < Gitlab::Database::Migration[2.2]
   INDEX_NAME = 'index_issues_on_milestone_id_and_id'
 
   # TODO: Index to be created synchronously in https://gitlab.com/gitlab-org/gitlab/-/issues/461627
-  # rubocop:disable Migration/PreventIndexCreation -- Legacy migration
   def up
     prepare_async_index :issues, %i[milestone_id id], name: INDEX_NAME
   end
-  # rubocop:enable Migration/PreventIndexCreation
 
   def down
     unprepare_async_index :issues, %i[milestone_id id], name: INDEX_NAME
diff --git a/db/post_migrate/20240531140131_add_issues_milestone_and_id_index_concurrently.rb b/db/post_migrate/20240531140131_add_issues_milestone_and_id_index_concurrently.rb
index f044d91cb6b..94f234f67b9 100644
--- a/db/post_migrate/20240531140131_add_issues_milestone_and_id_index_concurrently.rb
+++ b/db/post_migrate/20240531140131_add_issues_milestone_and_id_index_concurrently.rb
@@ -7,11 +7,9 @@ class AddIssuesMilestoneAndIdIndexConcurrently < Gitlab::Database::Migration[2.2
 
   disable_ddl_transaction!
 
-  # rubocop: disable Migration/PreventIndexCreation -- Replacing an existing index
   def up
     add_concurrent_index :issues, %i[milestone_id id], name: INDEX_NAME
   end
-  # rubocop: enable Migration/PreventIndexCreation
 
   def down
     remove_concurrent_index_by_name :issues, INDEX_NAME
diff --git a/db/post_migrate/20240610125054_create_idx_vulnerability_occurences_on_prim_iden_id.rb b/db/post_migrate/20240610125054_create_idx_vulnerability_occurences_on_prim_iden_id.rb
index 26b91086a0c..e1ca68e1f40 100644
--- a/db/post_migrate/20240610125054_create_idx_vulnerability_occurences_on_prim_iden_id.rb
+++ b/db/post_migrate/20240610125054_create_idx_vulnerability_occurences_on_prim_iden_id.rb
@@ -7,14 +7,13 @@ class CreateIdxVulnerabilityOccurencesOnPrimIdenId < Gitlab::Database::Migration
   NEW_INDEX_NAME = 'index_vulnerability_occurrences_prim_iden_id_and_vuln_id'
   TABLE_NAME = :vulnerability_occurrences
 
-  # rubocop:disable Migration/PreventIndexCreation -- This index was created async previously, check https://gitlab.com/gitlab-org/gitlab/-/merge_requests/131647
+  # -- This index was created async previously, check https://gitlab.com/gitlab-org/gitlab/-/merge_requests/131647
   def up
     add_concurrent_index(
       TABLE_NAME, [:primary_identifier_id, :vulnerability_id],
       name: NEW_INDEX_NAME
     )
   end
-  # rubocop:enable Migration/PreventIndexCreation
 
   def down
     remove_concurrent_index_by_name TABLE_NAME, NEW_INDEX_NAME
diff --git a/db/post_migrate/20240703142511_add_index_owasp_top_10_for_group_level_reports.rb b/db/post_migrate/20240703142511_add_index_owasp_top_10_for_group_level_reports.rb
index 4b205d9364f..a2631fe43db 100644
--- a/db/post_migrate/20240703142511_add_index_owasp_top_10_for_group_level_reports.rb
+++ b/db/post_migrate/20240703142511_add_index_owasp_top_10_for_group_level_reports.rb
@@ -6,13 +6,12 @@ class AddIndexOwaspTop10ForGroupLevelReports < Gitlab::Database::Migration[2.2]
 
   INDEX_NAME = 'index_for_owasp_top_10_group_level_reports'
 
+  # -- Legacy migration
   def up
-    # rubocop:disable Migration/PreventIndexCreation -- Legacy migration
     add_concurrent_index :vulnerability_reads, [:owasp_top_10, :state, :report_type,
       :severity, :traversal_ids, :vulnerability_id, :resolved_on_default_branch],
       where: 'archived = false',
       name: INDEX_NAME
-    # rubocop:enable Migration/PreventIndexCreation
   end
 
   def down
diff --git a/db/post_migrate/20240719033346_tmp_index_on_vulnerability_reads.rb b/db/post_migrate/20240719033346_tmp_index_on_vulnerability_reads.rb
index ba2556dcaf8..c7117461ac5 100644
--- a/db/post_migrate/20240719033346_tmp_index_on_vulnerability_reads.rb
+++ b/db/post_migrate/20240719033346_tmp_index_on_vulnerability_reads.rb
@@ -11,10 +11,9 @@ class TmpIndexOnVulnerabilityReads < Gitlab::Database::Migration[2.2]
   INDEX_NAME = 'tmp_index_vulnerability_reads_where_state_is_detected'
   TABLE_NAME = :vulnerability_reads
 
+  # -- Legacy migration
   def up
-    # rubocop:disable Migration/PreventIndexCreation -- Legacy migration
     add_concurrent_index TABLE_NAME, :id, name: INDEX_NAME, where: "state = 1"
-    # rubocop:enable Migration/PreventIndexCreation
   end
 
   def down
diff --git a/db/post_migrate/20240729133633_prepare_index_vulnerability_finding_links_on_project_id.rb b/db/post_migrate/20240729133633_prepare_index_vulnerability_finding_links_on_project_id.rb
index 95bb399285a..145fb53ad94 100644
--- a/db/post_migrate/20240729133633_prepare_index_vulnerability_finding_links_on_project_id.rb
+++ b/db/post_migrate/20240729133633_prepare_index_vulnerability_finding_links_on_project_id.rb
@@ -6,10 +6,9 @@ class PrepareIndexVulnerabilityFindingLinksOnProjectId < Gitlab::Database::Migra
 
   INDEX_NAME = 'index_vulnerability_finding_links_on_project_id'
 
+  # -- Legacy migration
   def up
-    # rubocop:disable Migration/PreventIndexCreation -- Legacy migration
     prepare_async_index :vulnerability_finding_links, :project_id, name: INDEX_NAME
-    # rubocop:enable Migration/PreventIndexCreation
   end
 
   def down
diff --git a/db/post_migrate/20240730172816_prepare_index_vulnerability_occurrence_pipelines_on_project_id.rb b/db/post_migrate/20240730172816_prepare_index_vulnerability_occurrence_pipelines_on_project_id.rb
index c204bea5628..78294f0eb0f 100644
--- a/db/post_migrate/20240730172816_prepare_index_vulnerability_occurrence_pipelines_on_project_id.rb
+++ b/db/post_migrate/20240730172816_prepare_index_vulnerability_occurrence_pipelines_on_project_id.rb
@@ -6,10 +6,9 @@ class PrepareIndexVulnerabilityOccurrencePipelinesOnProjectId < Gitlab::Database
 
   INDEX_NAME = 'index_vulnerability_occurrence_pipelines_on_project_id'
 
+  # -- Legacy migration
   def up
-    # rubocop:disable Migration/PreventIndexCreation -- Legacy migration
     prepare_async_index :vulnerability_occurrence_pipelines, :project_id, name: INDEX_NAME
-    # rubocop:enable Migration/PreventIndexCreation
   end
 
   def down
diff --git a/db/post_migrate/20240805205657_tmp_index_for_owasp_on_vulnerability_reads.rb b/db/post_migrate/20240805205657_tmp_index_for_owasp_on_vulnerability_reads.rb
index c79e98178f8..3158fc7a8e9 100644
--- a/db/post_migrate/20240805205657_tmp_index_for_owasp_on_vulnerability_reads.rb
+++ b/db/post_migrate/20240805205657_tmp_index_for_owasp_on_vulnerability_reads.rb
@@ -8,10 +8,9 @@ class TmpIndexForOwaspOnVulnerabilityReads < Gitlab::Database::Migration[2.2]
   COLUMNS = %i[vulnerability_id].freeze
   WHERE_CLAUSE = 'owasp_top_10 IS NULL'
 
+  # -- Legacy migration
   def up
-    # rubocop:disable Migration/PreventIndexCreation -- Legacy migration
     add_concurrent_index :vulnerability_reads, COLUMNS, name: INDEX_NAME, where: WHERE_CLAUSE
-    # rubocop:enable Migration/PreventIndexCreation
   end
 
   def down
diff --git a/db/post_migrate/20240828173211_add_revised_idx_owasp_top_10_for_group_level_reports.rb b/db/post_migrate/20240828173211_add_revised_idx_owasp_top_10_for_group_level_reports.rb
index 7333acfad1f..7074e911f7b 100644
--- a/db/post_migrate/20240828173211_add_revised_idx_owasp_top_10_for_group_level_reports.rb
+++ b/db/post_migrate/20240828173211_add_revised_idx_owasp_top_10_for_group_level_reports.rb
@@ -9,13 +9,12 @@ class AddRevisedIdxOwaspTop10ForGroupLevelReports < Gitlab::Database::Migration[
 
   INDEX_NAME = 'revised_idx_for_owasp_top_10_group_level_reports'
 
+  # -- Legacy migration
   def up
-    # rubocop:disable Migration/PreventIndexCreation -- Legacy migration
     add_concurrent_index :vulnerability_reads, [:owasp_top_10, :state, :report_type, :resolved_on_default_branch,
       :severity, :traversal_ids, :vulnerability_id],
       where: 'archived = false',
       name: INDEX_NAME
-    # rubocop:enable Migration/PreventIndexCreation
   end
 
   def down
diff --git a/db/post_migrate/20240905023750_async_add_index_on_events_personal_namespace_id_2.rb b/db/post_migrate/20240905023750_async_add_index_on_events_personal_namespace_id_2.rb
index 34b55998ad6..7d1d9648d15 100644
--- a/db/post_migrate/20240905023750_async_add_index_on_events_personal_namespace_id_2.rb
+++ b/db/post_migrate/20240905023750_async_add_index_on_events_personal_namespace_id_2.rb
@@ -5,14 +5,13 @@ class AsyncAddIndexOnEventsPersonalNamespaceId2 < Gitlab::Database::Migration[2.
 
   INDEX_NAME = 'index_events_on_personal_namespace_id'
 
-  # rubocop:disable Migration/PreventIndexCreation -- https://gitlab.com/gitlab-org/gitlab/-/issues/462801#note_2081632603
+  # -- https://gitlab.com/gitlab-org/gitlab/-/issues/462801#note_2081632603
   def up
     return unless Gitlab.com_except_jh?
 
     prepare_async_index :events, :personal_namespace_id, name: INDEX_NAME,
       where: 'personal_namespace_id IS NOT NULL'
   end
-  # rubocop:enable Migration/PreventIndexCreation
 
   def down
     return unless Gitlab.com_except_jh?
diff --git a/db/post_migrate/20240909230748_add_index_on_events_personal_namespace_id_self_managed.rb b/db/post_migrate/20240909230748_add_index_on_events_personal_namespace_id_self_managed.rb
index bdb2a75f62e..a36498752de 100644
--- a/db/post_migrate/20240909230748_add_index_on_events_personal_namespace_id_self_managed.rb
+++ b/db/post_migrate/20240909230748_add_index_on_events_personal_namespace_id_self_managed.rb
@@ -7,7 +7,7 @@ class AddIndexOnEventsPersonalNamespaceIdSelfManaged < Gitlab::Database::Migrati
 
   INDEX = 'index_events_on_personal_namespace_id'
 
-  # rubocop:disable Migration/PreventIndexCreation -- https://gitlab.com/gitlab-org/gitlab/-/issues/462801#note_2081632603
+  # -- https://gitlab.com/gitlab-org/gitlab/-/issues/462801#note_2081632603
   def up
     return if Gitlab.com_except_jh?
 
@@ -16,7 +16,6 @@ class AddIndexOnEventsPersonalNamespaceIdSelfManaged < Gitlab::Database::Migrati
       where: 'personal_namespace_id IS NOT NULL',
       name: INDEX
   end
-  # rubocop:enable Migration/PreventIndexCreation
 
   def down
     return if Gitlab.com_except_jh?
diff --git a/db/post_migrate/20240912122438_prepare_index_ci_job_artifact_states_on_project_id.rb b/db/post_migrate/20240912122438_prepare_index_ci_job_artifact_states_on_project_id.rb
index b9cacd0b850..4954335338a 100644
--- a/db/post_migrate/20240912122438_prepare_index_ci_job_artifact_states_on_project_id.rb
+++ b/db/post_migrate/20240912122438_prepare_index_ci_job_artifact_states_on_project_id.rb
@@ -7,7 +7,9 @@ class PrepareIndexCiJobArtifactStatesOnProjectId < Gitlab::Database::Migration[2
   INDEX_NAME = 'index_ci_job_artifact_states_on_project_id'
 
   def up
+    # rubocop:disable Migration/PreventIndexCreation -- Legacy migration
     prepare_async_index :ci_job_artifact_states, :project_id, name: INDEX_NAME
+    # rubocop:enable Migration/PreventIndexCreation
   end
 
   def down
diff --git a/db/post_migrate/20240923114603_add_index_on_vulnerability_reads_for_filtered_removal.rb b/db/post_migrate/20240923114603_add_index_on_vulnerability_reads_for_filtered_removal.rb
index 5b0fdc4aeb1..1d3e5f10a62 100644
--- a/db/post_migrate/20240923114603_add_index_on_vulnerability_reads_for_filtered_removal.rb
+++ b/db/post_migrate/20240923114603_add_index_on_vulnerability_reads_for_filtered_removal.rb
@@ -7,10 +7,9 @@ class AddIndexOnVulnerabilityReadsForFilteredRemoval < Gitlab::Database::Migrati
 
   milestone '17.5'
 
+  # -- Legacy migration
   def up
-    # rubocop:disable Migration/PreventIndexCreation -- Legacy migration
     add_concurrent_index :vulnerability_reads, %i[project_id resolved_on_default_branch], name: INDEX_NAME
-    # rubocop:enable Migration/PreventIndexCreation
   end
 
   def down
diff --git a/db/post_migrate/20241021221146_prepare_async_index_on_issues_by_project_correct_type_where_closed.rb b/db/post_migrate/20241021221146_prepare_async_index_on_issues_by_project_correct_type_where_closed.rb
index 742bdba756f..2f08cec6b02 100644
--- a/db/post_migrate/20241021221146_prepare_async_index_on_issues_by_project_correct_type_where_closed.rb
+++ b/db/post_migrate/20241021221146_prepare_async_index_on_issues_by_project_correct_type_where_closed.rb
@@ -8,7 +8,7 @@ class PrepareAsyncIndexOnIssuesByProjectCorrectTypeWhereClosed < Gitlab::Databas
   def up
     # Temporary index to be removed with https://gitlab.com/gitlab-org/gitlab/-/issues/500165
     # TODO: Index to be created synchronously in https://gitlab.com/gitlab-org/gitlab/-/merge_requests/170005
-    prepare_async_index :issues, # rubocop:disable Migration/PreventIndexCreation -- Tmp index needed to fix work item type ids
+    prepare_async_index :issues, # -- Tmp index needed to fix work item type ids
       [:project_id, :correct_work_item_type_id, :closed_at],
       where: 'state_id = 2',
       name: INDEX_NAME
diff --git a/db/post_migrate/20241021221626_prepare_async_index_on_issues_project_health_id_desc_state_correct_type.rb b/db/post_migrate/20241021221626_prepare_async_index_on_issues_project_health_id_desc_state_correct_type.rb
index f95f4634dbc..4c20d1fe744 100644
--- a/db/post_migrate/20241021221626_prepare_async_index_on_issues_project_health_id_desc_state_correct_type.rb
+++ b/db/post_migrate/20241021221626_prepare_async_index_on_issues_project_health_id_desc_state_correct_type.rb
@@ -9,7 +9,7 @@ class PrepareAsyncIndexOnIssuesProjectHealthIdDescStateCorrectType < Gitlab::Dat
   def up
     # Temporary index to be removed with https://gitlab.com/gitlab-org/gitlab/-/issues/500165
     # TODO: Index to be created synchronously in https://gitlab.com/gitlab-org/gitlab/-/merge_requests/170005
-    prepare_async_index :issues, # rubocop:disable Migration/PreventIndexCreation -- Tmp index needed to fix work item type ids
+    prepare_async_index :issues, # -- Tmp index needed to fix work item type ids
       [:project_id, :health_status, :id, :state_id, :correct_work_item_type_id],
       order: { health_status: 'DESC NULLS LAST', id: :desc },
       name: INDEX_NAME
diff --git a/db/post_migrate/20241021221755_prepare_async_index_on_issues_project_health_id_asc_state_correct_type.rb b/db/post_migrate/20241021221755_prepare_async_index_on_issues_project_health_id_asc_state_correct_type.rb
index 5afcaa4cf6d..a32e782a7dd 100644
--- a/db/post_migrate/20241021221755_prepare_async_index_on_issues_project_health_id_asc_state_correct_type.rb
+++ b/db/post_migrate/20241021221755_prepare_async_index_on_issues_project_health_id_asc_state_correct_type.rb
@@ -9,7 +9,7 @@ class PrepareAsyncIndexOnIssuesProjectHealthIdAscStateCorrectType < Gitlab::Data
   def up
     # Temporary index to be removed with https://gitlab.com/gitlab-org/gitlab/-/issues/500165
     # TODO: Index to be created synchronously in https://gitlab.com/gitlab-org/gitlab/-/merge_requests/170005
-    prepare_async_index :issues, # rubocop:disable Migration/PreventIndexCreation -- Tmp index needed to fix work item type ids
+    prepare_async_index :issues, # -- Tmp index needed to fix work item type ids
       [:project_id, :health_status, :id, :state_id, :correct_work_item_type_id],
       order: { health_status: 'ASC NULLS LAST', id: :desc },
       name: INDEX_NAME
diff --git a/db/post_migrate/20241021221938_prepare_async_index_on_issues_correct_type_project_created_at_state.rb b/db/post_migrate/20241021221938_prepare_async_index_on_issues_correct_type_project_created_at_state.rb
index 15214d865d2..3103ceebc8d 100644
--- a/db/post_migrate/20241021221938_prepare_async_index_on_issues_correct_type_project_created_at_state.rb
+++ b/db/post_migrate/20241021221938_prepare_async_index_on_issues_correct_type_project_created_at_state.rb
@@ -9,7 +9,7 @@ class PrepareAsyncIndexOnIssuesCorrectTypeProjectCreatedAtState < Gitlab::Databa
   def up
     # Temporary index to be removed with https://gitlab.com/gitlab-org/gitlab/-/issues/500165
     # TODO: Index to be created synchronously in https://gitlab.com/gitlab-org/gitlab/-/merge_requests/170005
-    prepare_async_index :issues, # rubocop:disable Migration/PreventIndexCreation -- Tmp index needed to fix work item type ids
+    prepare_async_index :issues, # -- Tmp index needed to fix work item type ids
       [:correct_work_item_type_id, :project_id, :created_at, :state_id],
       name: INDEX_NAME
   end
diff --git a/db/post_migrate/20241105213841_create_tmp_index_on_issues_by_project_correct_type_where_closed.rb b/db/post_migrate/20241105213841_create_tmp_index_on_issues_by_project_correct_type_where_closed.rb
index dcec3980862..17a47df2d91 100644
--- a/db/post_migrate/20241105213841_create_tmp_index_on_issues_by_project_correct_type_where_closed.rb
+++ b/db/post_migrate/20241105213841_create_tmp_index_on_issues_by_project_correct_type_where_closed.rb
@@ -8,7 +8,7 @@ class CreateTmpIndexOnIssuesByProjectCorrectTypeWhereClosed < Gitlab::Database::
 
   def up
     # Temporary index to be removed with https://gitlab.com/gitlab-org/gitlab/-/issues/500165
-    add_concurrent_index :issues, # rubocop:disable Migration/PreventIndexCreation -- Tmp index needed to fix work item type ids
+    add_concurrent_index :issues, # -- Tmp index needed to fix work item type ids
       [:project_id, :correct_work_item_type_id, :closed_at],
       where: 'state_id = 2',
       name: INDEX_NAME
diff --git a/db/post_migrate/20241105215409_create_tmp_index_on_issues_project_health_id_desc_state_correct_type.rb b/db/post_migrate/20241105215409_create_tmp_index_on_issues_project_health_id_desc_state_correct_type.rb
index 630ba612526..c6e1e462b2b 100644
--- a/db/post_migrate/20241105215409_create_tmp_index_on_issues_project_health_id_desc_state_correct_type.rb
+++ b/db/post_migrate/20241105215409_create_tmp_index_on_issues_project_health_id_desc_state_correct_type.rb
@@ -8,7 +8,7 @@ class CreateTmpIndexOnIssuesProjectHealthIdDescStateCorrectType < Gitlab::Databa
 
   def up
     # Temporary index to be removed with https://gitlab.com/gitlab-org/gitlab/-/issues/500165
-    add_concurrent_index :issues, # rubocop:disable Migration/PreventIndexCreation -- Tmp index needed to fix work item type ids
+    add_concurrent_index :issues, # -- Tmp index needed to fix work item type ids
       [:project_id, :health_status, :id, :state_id, :correct_work_item_type_id],
       order: { health_status: 'DESC NULLS LAST', id: :desc },
       name: INDEX_NAME
diff --git a/db/post_migrate/20241105215907_create_tmp_index_on_issues_project_health_id_asc_state_correct_type.rb b/db/post_migrate/20241105215907_create_tmp_index_on_issues_project_health_id_asc_state_correct_type.rb
index 2628d272ef9..a4091559d2c 100644
--- a/db/post_migrate/20241105215907_create_tmp_index_on_issues_project_health_id_asc_state_correct_type.rb
+++ b/db/post_migrate/20241105215907_create_tmp_index_on_issues_project_health_id_asc_state_correct_type.rb
@@ -8,7 +8,7 @@ class CreateTmpIndexOnIssuesProjectHealthIdAscStateCorrectType < Gitlab::Databas
 
   def up
     # Temporary index to be removed with https://gitlab.com/gitlab-org/gitlab/-/issues/500165
-    add_concurrent_index :issues, # rubocop:disable Migration/PreventIndexCreation -- Tmp index needed to fix work item type ids
+    add_concurrent_index :issues, # -- Tmp index needed to fix work item type ids
       [:project_id, :health_status, :id, :state_id, :correct_work_item_type_id],
       order: { health_status: 'ASC NULLS LAST', id: :desc },
       name: INDEX_NAME
diff --git a/db/post_migrate/20241105220155_create_tmp_index_on_issues_correct_type_project_created_at_state.rb b/db/post_migrate/20241105220155_create_tmp_index_on_issues_correct_type_project_created_at_state.rb
index f345fa9ae9f..33dd9437262 100644
--- a/db/post_migrate/20241105220155_create_tmp_index_on_issues_correct_type_project_created_at_state.rb
+++ b/db/post_migrate/20241105220155_create_tmp_index_on_issues_correct_type_project_created_at_state.rb
@@ -8,7 +8,7 @@ class CreateTmpIndexOnIssuesCorrectTypeProjectCreatedAtState < Gitlab::Database:
 
   def up
     # Temporary index to be removed with https://gitlab.com/gitlab-org/gitlab/-/issues/500165
-    add_concurrent_index :issues, # rubocop:disable Migration/PreventIndexCreation -- Tmp index needed to fix work item type ids
+    add_concurrent_index :issues, # -- Tmp index needed to fix work item type ids
       [:correct_work_item_type_id, :project_id, :created_at, :state_id],
       name: INDEX_NAME
   end
diff --git a/db/post_migrate/20241106125627_update_sent_notifications_index_on_noteable.rb b/db/post_migrate/20241106125627_update_sent_notifications_index_on_noteable.rb
index 3cfb203d1f0..dc4e4232d6a 100644
--- a/db/post_migrate/20241106125627_update_sent_notifications_index_on_noteable.rb
+++ b/db/post_migrate/20241106125627_update_sent_notifications_index_on_noteable.rb
@@ -1,6 +1,6 @@
 # frozen_string_literal: true
 
-# rubocop: disable Migration/PreventIndexCreation -- update an existing index
+# -- update an existing index
 class UpdateSentNotificationsIndexOnNoteable < Gitlab::Database::Migration[2.2]
   milestone '17.6'
 
@@ -22,4 +22,3 @@ class UpdateSentNotificationsIndexOnNoteable < Gitlab::Database::Migration[2.2]
     unprepare_async_index :sent_notifications, COLUMN_NAMES, name: INDEX_NAME
   end
 end
-# rubocop: enable Migration/PreventIndexCreation
diff --git a/db/post_migrate/20241128071834_remove_push_tables_force_push_delete_branch_regex.rb b/db/post_migrate/20241128071834_remove_push_tables_force_push_delete_branch_regex.rb
new file mode 100644
index 00000000000..f01cc1153f4
--- /dev/null
+++ b/db/post_migrate/20241128071834_remove_push_tables_force_push_delete_branch_regex.rb
@@ -0,0 +1,21 @@
+# frozen_string_literal: true
+
+class RemovePushTablesForcePushDeleteBranchRegex < Gitlab::Database::Migration[2.2]
+  milestone '17.7'
+
+  disable_ddl_transaction!
+
+  def up
+    remove_column :push_rules, :force_push_regex, if_exists: true
+    remove_column :push_rules, :delete_branch_regex, if_exists: true
+  end
+
+  def down
+    add_column :push_rules, :force_push_regex, :string, if_not_exists: true
+    add_column :push_rules, :delete_branch_regex, :string, if_not_exists: true
+
+    # Re-add constraints
+    add_check_constraint(:push_rules, 'char_length(force_push_regex) <= 511', 'force_push_regex_size_constraint')
+    add_check_constraint(:push_rules, 'char_length(delete_branch_regex) <= 511', 'delete_branch_regex_size_constraint')
+  end
+end
diff --git a/db/schema_migrations/20241128071834 b/db/schema_migrations/20241128071834
new file mode 100644
index 00000000000..bbfd7841c67
--- /dev/null
+++ b/db/schema_migrations/20241128071834
@@ -0,0 +1 @@
+d601bb020ed7764440919cacaac775c1b6c492df5fc8218ff4d7a791a0128615
\ No newline at end of file
diff --git a/db/structure.sql b/db/structure.sql
index 64285298ba3..dea0a913310 100644
--- a/db/structure.sql
+++ b/db/structure.sql
@@ -18563,8 +18563,6 @@ CREATE TABLE push_event_payloads (
 
 CREATE TABLE push_rules (
     id bigint NOT NULL,
-    force_push_regex character varying,
-    delete_branch_regex character varying,
     commit_message_regex character varying,
     deny_delete_tag boolean,
     project_id bigint,
@@ -18588,9 +18586,7 @@ CREATE TABLE push_rules (
     CONSTRAINT branch_name_regex_size_constraint CHECK ((char_length((branch_name_regex)::text) <= 511)),
     CONSTRAINT commit_message_negative_regex_size_constraint CHECK ((char_length((commit_message_negative_regex)::text) <= 2047)),
     CONSTRAINT commit_message_regex_size_constraint CHECK ((char_length((commit_message_regex)::text) <= 511)),
-    CONSTRAINT delete_branch_regex_size_constraint CHECK ((char_length((delete_branch_regex)::text) <= 511)),
-    CONSTRAINT file_name_regex_size_constraint CHECK ((char_length((file_name_regex)::text) <= 511)),
-    CONSTRAINT force_push_regex_size_constraint CHECK ((char_length((force_push_regex)::text) <= 511))
+    CONSTRAINT file_name_regex_size_constraint CHECK ((char_length((file_name_regex)::text) <= 511))
 );
 
 CREATE SEQUENCE push_rules_id_seq
diff --git a/doc/api/admin/token.md b/doc/api/admin/token.md
index d8016664975..3b68f042ffd 100644
--- a/doc/api/admin/token.md
+++ b/doc/api/admin/token.md
@@ -16,6 +16,7 @@ DETAILS:
 > - [Feed tokens added](https://gitlab.com/gitlab-org/gitlab/-/merge_requests/169821) in GitLab 17.6.
 > - [OAuth application secrets added](https://gitlab.com/gitlab-org/gitlab/-/merge_requests/172985) in GitLab 17.7.
 > - [Cluster agent tokens added](https://gitlab.com/gitlab-org/gitlab/-/merge_requests/172932) in GitLab 17.7.
+> - [Runner authentication tokens added](https://gitlab.com/gitlab-org/gitlab/-/merge_requests/173987) in GitLab 17.7.
 
 FLAG:
 The availability of this feature is controlled by a feature flag.
@@ -30,7 +31,7 @@ Prerequisites:
 
 - You must be an administrator.
 
-## Get Token Information
+## Identify Token
 
 Returns information about a token.
 
@@ -41,6 +42,7 @@ Supported tokens:
 - [Feed tokens](../../security/tokens/index.md#feed-token)
 - [OAuth application secrets](../../integration/oauth_provider.md)
 - [Cluster agent tokens](../../security/tokens/index.md#gitlab-cluster-agent-tokens)
+- [Runner authentication tokens](../../security/tokens/index.md#runner-authentication-tokens)
 
 ```plaintext
 POST /api/v4/admin/token
diff --git a/doc/ci/runners/provision_runners_google_cloud.md b/doc/ci/runners/provision_runners_google_cloud.md
index 3f12fe4c902..a1aaaac2de2 100644
--- a/doc/ci/runners/provision_runners_google_cloud.md
+++ b/doc/ci/runners/provision_runners_google_cloud.md
@@ -6,7 +6,7 @@ info: >-
   this page, see
   https://handbook.gitlab.com/handbook/product/ux/technical-writing/#assignments
 ---
-# Provisioning runners in Google Cloud
+# Provision runners in Google Cloud Compute Engine
 
 DETAILS:
 **Tier:** Free, Premium, Ultimate
@@ -15,86 +15,53 @@ DETAILS:
 > - [Introduced](https://gitlab.com/gitlab-org/gitlab/-/issues/438316) in GitLab 16.10 [with a flag](../../administration/feature_flags.md) named `google_cloud_support_feature_flag`. This feature is in [beta](../../policy/development_stages_support.md).
 > - [Enabled on GitLab.com](https://gitlab.com/gitlab-org/gitlab/-/merge_requests/150472) in GitLab 17.1. Feature flag `google_cloud_support_feature_flag` removed.
 
-## Creating a runner provisioned in Google Cloud
-
-Prerequisites:
-
-- You must have [billing enabled](https://cloud.google.com/billing/docs/how-to/verify-billing-enabled#confirm_billing_is_enabled_on_a_project)
-  for your Google Cloud project.
-- You must have a working [`gcloud` CLI tool](https://cloud.google.com/sdk/docs/install) that is authenticated with the
-  [Owner](https://cloud.google.com/iam/docs/understanding-roles#owner) IAM role on the Google Cloud project.
-- You must have the [Terraform CLI tool](https://developer.hashicorp.com/terraform/install) installed.
-
 You can create a project or group runner for GitLab.com and provision it on your Google Cloud project.
 When you create a runner, the GitLab UI provides on-screen instructions and scripts to automatically provision the runner
-in a Google Cloud project that you own.
+in your Google Cloud project.
 
-After you create a runner, it is assigned a runner authentication token that a Terraform script uses to register it.
-The runner uses the token to authenticate with GitLab when picking up jobs from the job queue.
+A runner authentication token is assigned to your runner when you create it. A [GRIT](https://gitlab.com/gitlab-org/ci-cd/runner-tools/grit) Terraform script uses this token to
+register the runner. The runner then uses the token to authenticate with GitLab when it picks up jobs
+from the job queue.
 
-After the runners are provisioned, an autoscaling fleet of runners is available to execute your CI/CD jobs
-in Google Cloud.
-A runner manager automatically creates temporary runners.
-
-### Create a group runner
+After provisioning, an autoscaling fleet of runners is ready to run CI/CD jobs in Google Cloud.
+The runner manager creates temporary runners automatically.
 
 Prerequisites:
 
-- You must have the Owner role for the group.
+- For group runners: Owner role for the group.
+- For project runners: Maintainer role for the project.
+- For your Google Cloud Platform project: [Owner](https://cloud.google.com/iam/docs/understanding-roles#owner) IAM role.
+- [Billing enabled](https://cloud.google.com/billing/docs/how-to/verify-billing-enabled#confirm_billing_is_enabled_on_a_project)
+  for your Google Cloud Platform project.
+- A working [`gcloud` CLI tool](https://cloud.google.com/sdk/docs/install) authenticated with the
+  IAM role on the Google Cloud project.
+- [Terraform v1.5 or later](https://releases.hashicorp.com/terraform/1.5.7/) and [Terraform CLI tool](https://developer.hashicorp.com/terraform/install).
+- A terminal with Bash installed.
 
-To create a group runner and provision it on Google Cloud:
+To create a group or project runner and provision it on Google Cloud:
 
 1. On the left sidebar, select **Search or go to** and find your group.
-1. Select **Build > Runners**.
-1. Select **New group runner**.
+1. Create a new runner.
+   - To create a new group runner, select **Build > Runners > New group runner**.
+   - To create a new project runner, select **Settings > CI/CD > Runners > New project runner**.
 1. In the **Tags** section, in the **Tags** field, enter the job tags to specify jobs the runner can run.
-   If there are no job tags for this runner, select **Run untagged**.
-1. Optional. In the **Runner description** field, add a runner description
-   that displays in GitLab.
-1. Optional. In the **Configuration** section, add additional configurations.
+   To use the runner for jobs without tags in addition to the tagged jobs, select **Run untagged**.
+1. Optional. In the **Configuration** section, add runner description and additional configurations.
 1. Select **Create runner**.
 1. In the **Platform** section, select **Google Cloud**.
-1. To specify the environment in Google Cloud where
-   runners execute jobs, in **Step 1: Specify environment**, complete the form.
-1. In **Step 2: Set up GitLab Runner**, select **Setup instructions**. In the dialog:
+1. In **Environment**, enter the following details of the Google Cloud environment:
 
-   - **Step 1: Configure Google Cloud project** must be executed once per Google Cloud project,
-     to ensure it meets the prerequisites for the required services, service account, and permissions.
-   - **Step 2: Install and register GitLab Runner** displays the Terraform script that uses the
-     [GitLab Runner Infrastructure Toolkit](https://gitlab.com/gitlab-org/ci-cd/runner-tools/grit/-/blob/main/docs/scenarios/google/linux/docker-autoscaler-default/index.md)
-     (GRIT) to provision the infrastructure on the Google Cloud project to execute your runner manager.
-
-After you execute the scripts, a runner manager connects with the runner authentication token. The runner manager might
-take up to one minute to show as online and start receiving jobs.
-
-### Create a project runner
-
-Prerequisites:
-
-- You must have the Maintainer role for the project.
-
-To create a project runner and provision it on Google Cloud:
-
-1. On the left sidebar, select **Search or go to** and find your project.
-1. Select **Settings > CI/CD**.
-1. Expand the **Runners** section.
-1. Select **New project runner**.
-1. In the **Tags** section, in the **Tags** field, enter the job tags to specify jobs the runner can run.
-   If there are no job tags for this runner, select **Run untagged**.
-1. Optional. In the **Runner description** field, add a description for the runner
-   that displays in GitLab.
-1. Optional. In the **Configuration** section, add additional configurations.
-1. Select **Create runner**.
-1. In the **Platform** section, select **Google Cloud**.
-1. To specify the environment in Google Cloud where
-   runners execute jobs, in **Step 1: Specify environment**, complete the form.
-1. In **Step 2: Set up GitLab Runner**, select **Setup instructions**. In the dialog:
-
-   - **Step 1: Configure Google Cloud project** must be executed once per Google Cloud project,
-     to ensure it meets the prerequisites for the required services, service account, and permissions.
-   - **Step 2: Install and register GitLab Runner** displays the Terraform script that uses the
-     [GitLab Runner Infrastructure Toolkit](https://gitlab.com/gitlab-org/ci-cd/runner-tools/grit/-/blob/main/docs/scenarios/google/linux/docker-autoscaler-default/index.md) (GRIT)
-     to provision the infrastructure on the Google Cloud project to execute your runner manager.
+   - **Google Cloud project ID**
+   - **Region**
+   - **Zone**
+   - **Machine type**
+
+1. In **Set up GitLab Runner**, select **Setup instructions**. In the dialog:
+
+   1. To enable the required services, service account, and permissions, in **Configure Google Cloud project** run the Bash script once for each Google Cloud project.
+   1. Create a `main.tf` file with the configuration from **Install and register GitLab Runner**.
+      The script uses the [GitLab Runner Infrastructure Toolkit](https://gitlab.com/gitlab-org/ci-cd/runner-tools/grit/-/blob/main/docs/scenarios/google/linux/docker-autoscaler-default/index.md)
+      (GRIT) to provision the infrastructure on the Google Cloud project to execute your runner manager.
 
 After you execute the scripts, a runner manager connects with the runner authentication token. The runner manager might
 take up to one minute to show as online and start receiving jobs.
diff --git a/doc/development/database/large_tables_limitations.md b/doc/development/database/large_tables_limitations.md
index cb2bff72251..51eb5a0eeae 100644
--- a/doc/development/database/large_tables_limitations.md
+++ b/doc/development/database/large_tables_limitations.md
@@ -29,6 +29,15 @@ Exceptions to these size limitations should only granted for the following cases
 - Modify a table to assist in partitioning or data retention efforts
 - Replace an existing index to provide better query performance
 
+### Requesting an exception
+
+To request an exception to these limitations:
+
+1. Create a new issue using the [Database Team Tasks template](https://gitlab.com/gitlab-org/database-team/team-tasks/-/issues/new)
+1. Select the `schema_change_exception` template
+1. Provide detailed justification for why your case requires an exception
+1. Wait for review and approval from the Database team before proceeding
+
 ## Alternatives to table modifications
 
 Consider these alternatives when working with large tables:
diff --git a/doc/development/documentation/help.md b/doc/development/documentation/help.md
index 13d8ced5544..1f0300220e0 100644
--- a/doc/development/documentation/help.md
+++ b/doc/development/documentation/help.md
@@ -116,7 +116,7 @@ is inside `_()` so it can be translated:
   the rest of the page layout:
 
   ```haml
-  = render Pajamas::ButtonComponent.new(variant: :default, href: help_page_path('user/group/import/index.md'), target: '_blank') do
+  = render Pajamas::ButtonComponent.new(href: help_page_path('user/group/import/index.md'), target: '_blank') do
       = _('Learn more')
   ```
 
diff --git a/doc/development/documentation/img/manual_build_docs_v14_6.png b/doc/development/documentation/img/manual_build_docs_v14_6.png
deleted file mode 100644
index 731bda3dd56..00000000000
Binary files a/doc/development/documentation/img/manual_build_docs_v14_6.png and /dev/null differ
diff --git a/doc/development/documentation/review_apps.md b/doc/development/documentation/review_apps.md
index 6695359a497..a56dcc8be1b 100644
--- a/doc/development/documentation/review_apps.md
+++ b/doc/development/documentation/review_apps.md
@@ -7,144 +7,63 @@ description: Learn how documentation review apps work.
 
 # Documentation review apps
 
-If you're a GitLab team member and your merge request contains documentation changes, you can use a review app to preview
-how they would look if they were deployed to the [GitLab Docs site](https://docs.gitlab.com).
+GitLab team members can deploy a [review app](../../ci/review_apps/index.md) for merge requests with documentation
+changes. The review app helps you preview what the changes would look like if they were deployed to either:
 
-Review apps are enabled for the following projects:
+- The [GitLab Docs site](https://docs.gitlab.com).
+- The [new GitLab Docs site](https://new.docs.gitlab.com). The site is still in development.
 
-- [GitLab](https://gitlab.com/gitlab-org/gitlab)
-- [Omnibus GitLab](https://gitlab.com/gitlab-org/omnibus-gitlab)
-- [GitLab Runner](https://gitlab.com/gitlab-org/gitlab-runner)
-- [GitLab Charts](https://gitlab.com/gitlab-org/charts/gitlab)
-- [GitLab Operator](https://gitlab.com/gitlab-org/cloud-native/gitlab-operator)
+Review apps deployments are available for these projects:
 
-Alternatively, check the [`gitlab-docs` development guide](https://gitlab.com/gitlab-org/gitlab-docs/blob/main/README.md#development-when-contributing-to-gitlab-documentation)
-or [the GDK documentation](https://gitlab.com/gitlab-org/gitlab-development-kit/blob/main/doc/howto/gitlab_docs.md)
-to render and preview the documentation locally.
+- [GitLab](https://gitlab.com/gitlab-org/gitlab) (configuration: <https://gitlab.com/gitlab-org/gitlab/-/blob/b4f30955e41aeab862c59f7102529e1a5a2659d1/.gitlab/ci/docs.gitlab-ci.yml#L1-40>)
+- [Omnibus GitLab](https://gitlab.com/gitlab-org/omnibus-gitlab) (configuration: <https://gitlab.com/gitlab-org/omnibus-gitlab/-/blob/bae935d36ea9296941c20233b637d780847c443a/gitlab-ci-config/gitlab-com.yml#L304-328>)
+- [GitLab Runner](https://gitlab.com/gitlab-org/gitlab-runner) (configuration: <https://gitlab.com/gitlab-org/gitlab-runner/-/blob/69d2416333df4712cbd95d90214b10f100183df3/.gitlab/ci/docs.gitlab-ci.yml#L64-110>)
+- [GitLab Charts](https://gitlab.com/gitlab-org/charts/gitlab) (configuration: <https://gitlab.com/gitlab-org/charts/gitlab/-/blob/8222a7c3cf28d8ad3f454784a04cad8921b6638b/.gitlab/ci/review-docs.yml#L2-49>)
+- [GitLab Operator](https://gitlab.com/gitlab-org/cloud-native/gitlab-operator) (configuration: <https://gitlab.com/gitlab-org/cloud-native/gitlab-operator/-/blob/56200465a5c8f8857f3aef2c309bdf2ca9e4b672/.gitlab-ci.yml#L210-257>)
 
-## How to trigger a review app
+## Deploy a review app and preview changes
 
-If a merge request has documentation changes, use the `review-docs-deploy` manual job
-to deploy the documentation review app for your merge request.
+Prerequisites:
 
-![Manual trigger a documentation review app](img/manual_build_docs_v14_6.png)
+- You must have the Developer role for the project. External contributors cannot run these jobs and
+should ask a GitLab team member to run the jobs for them.
 
-The `review-docs-deploy*` job triggers a cross project pipeline and builds the
-docs site with your changes. When the pipeline finishes, the review app URL
-appears in the merge request widget. Use the app to go to your changes.
+Merge requests with documentation changes have the following jobs available:
 
-The `review-docs-cleanup` job is triggered automatically on merge. This job deletes the review app.
+- `review-docs-deploy`, which uses Nanoc static-site generation using
+  [`gitlab-docs`](https://gitlab.com/gitlab-org/gitlab-docs).
+- `review-docs-hugo-deploy`: Optional. This review app is only for testing the Hugo static site generation from
+  [`gitlab-docs-hugo`](https://gitlab.com/gitlab-org/technical-writing-group/gitlab-docs-hugo),
+  which is still in development.
 
-You must have the Developer role for the project. Users without the Developer role, such
-as external contributors, cannot run the manual job. In that case, ask someone from
-the GitLab team to run the job.
+To deploy a review app and preview changes:
 
-## Technical aspects
+1. [Manually run](../../ci/jobs/job_control.md#run-a-manual-job) either (or both) of these jobs. These jobs trigger a
+   [multi project pipelines](../../ci/pipelines/downstream_pipelines.md#multi-project-pipelines), build the
+   documentation site with your changes, and deploy a site with your changes.
+1. When the pipeline finishes, select **View app** on either deployment to open a browser and review the
+   changes introduced by the merge request.
 
-If you want to know the in-depth details, here's what's really happening:
+The `review-docs-cleanup` and `review-docs-hugo-cleanup` jobs are triggered automatically on merge. These job delete
+the review app.
 
-1. You manually run the `review-docs-deploy` job in a merge request.
-1. The job downloads and runs the [`scripts/trigger-build.rb`](https://gitlab.com/gitlab-org/gitlab/-/blob/master/scripts/trigger-build.rb)
-   script with the `docs deploy` flag, which triggers the "Triggered from `gitlab-org/gitlab` 'review-docs-deploy' job"
-   pipeline trigger in the `gitlab-org/gitlab-docs` project for the `$DOCS_BRANCH` (defaults to `main`).
-1. The preview URL is shown both at the job output and in the merge request
-   widget. You also get the link to the remote pipeline.
-1. In the `gitlab-org/gitlab-docs` project, the pipeline is created and it
-   [skips most test jobs](https://gitlab.com/gitlab-org/gitlab-docs/-/blob/d41ca9323f762132780d2d072f845d28817a5383/.gitlab/ci/rules.gitlab-ci.yml#L101-103)
-   to lower the build time.
-1. After the docs site is built, the HTML files are uploaded as artifacts to
-   a GCP bucket (see [issue `gitlab-com/gl-infra/reliability#11021`](https://gitlab.com/gitlab-com/gl-infra/reliability/-/issues/11021)
-   for the implementation details).
+## How documentation review apps work
 
-The following GitLab features are used among others:
+Documentation review apps follow this process:
 
-- [Manual jobs](../../ci/jobs/job_control.md#create-a-job-that-must-be-run-manually)
-- [Multi project pipelines](../../ci/pipelines/downstream_pipelines.md#multi-project-pipelines)
-- [Review apps](../../ci/review_apps/index.md)
-- [Artifacts](../../ci/yaml/index.md#artifacts)
-- [Merge request pipelines](../../ci/pipelines/merge_request_pipelines.md)
+1. You manually run the `review-docs-deploy` or `review-docs-hugo-deploy` job in a merge request.
+1. The job downloads (if outside of `gitlab` project) and runs the
+   [`scripts/trigger-build.rb`](https://gitlab.com/gitlab-org/gitlab/-/blob/master/scripts/trigger-build.rb) script with
+   either:
 
-## How to add a new documentation review app
+   - The `docs deploy` flag, which triggers a pipeline in the `gitlab-org/gitlab-docs` project.
+   - The `docs-hugo deploy` flag, which triggers a pipeline in the `gitlab-org/technical-writing-group/gitlab-docs-hugo`
+     project.
 
-In case a documentation review app is missing from one of the documentation
-projects, you can use the following CI/CD template to add a manually triggered review app:
-
-```yaml
-# Set up documentation review apps
-# https://docs.gitlab.com/ee/development/documentation/review_apps.html
-.review-docs:
-  image: ruby:3.1-alpine
-  needs: []
-  before_script:
-    - gem install gitlab --no-doc
-    # We need to download the script rather than clone the repo since the
-    # review-docs-cleanup job will not be able to run when the branch gets
-    # deleted (when merging the MR).
-    - apk add --update openssl
-    - wget https://gitlab.com/gitlab-org/gitlab/-/raw/master/scripts/trigger-build.rb
-    - chmod 755 trigger-build.rb
-  variables:
-    GIT_STRATEGY: none
-    DOCS_REVIEW_APPS_DOMAIN: docs.gitlab-review.app
-    # By default, deploy the Review App using the `main` branch of the `gitlab-org/gitlab-docs` project
-    DOCS_BRANCH: main
-  when: manual
-  allow_failure: true
-
-# Trigger a docs build in gitlab-docs
-# Useful to preview the docs changes live
-# https://docs.gitlab.com/ee/development/documentation/index.html#previewing-the-changes-live
-review-docs-deploy:
-  extends:
-    - .review-docs
-  environment:
-    name: review-docs/mr-${CI_MERGE_REQUEST_IID}
-    # DOCS_REVIEW_APPS_DOMAIN and DOCS_GITLAB_REPO_SUFFIX are CI variables
-    # Discussion: https://gitlab.com/gitlab-org/gitlab-foss/merge_requests/14236/diffs#note_40140693
-    auto_stop_in: 2 weeks
-    url: https://${DOCS_BRANCH}-${DOCS_GITLAB_REPO_SUFFIX}-${CI_MERGE_REQUEST_IID}.${DOCS_REVIEW_APPS_DOMAIN}/${DOCS_GITLAB_REPO_SUFFIX}
-    on_stop: review-docs-cleanup
-  script:
-  - ./trigger-build.rb docs deploy
-
-# Cleanup remote environment of gitlab-docs
-review-docs-cleanup:
-  extends:
-    - .review-docs
-  environment:
-    name: review-docs/mr-${CI_MERGE_REQUEST_IID}
-    action: stop
-  script:
-  - ./trigger-build.rb docs cleanup
-```
-
-You may need to add some rules when those jobs run, it depends on the project.
-You can find the current implementations:
-
-- [GitLab](https://gitlab.com/gitlab-org/gitlab/-/blob/master/.gitlab/ci/docs.gitlab-ci.yml)
-- [Omnibus GitLab](https://gitlab.com/gitlab-org/omnibus-gitlab/-/blob/ee8699658c8a7d4c635ad503ef0b825ac592dc4b/gitlab-ci-config/gitlab-com.yml#L367-391)
-- [GitLab Runner](https://gitlab.com/gitlab-org/gitlab-runner/-/blob/main/.gitlab/ci/docs.gitlab-ci.yml)
-- [GitLab Charts](https://gitlab.com/gitlab-org/charts/gitlab/-/blob/aae7ee8d23a60d6025eec7d1a864ce244f21cd85/.gitlab-ci.yml#L629-679)
-- [GitLab Operator](https://gitlab.com/gitlab-org/cloud-native/gitlab-operator/-/blob/5fa29607cf9286b510148a8f5fef7595dca34186/.gitlab-ci.yml#L180-228)
-
-## Troubleshooting review apps
-
-### `NoSuchKey The specified key does not exist`
-
-If you see the following message in a review app, either the site is not
-yet deployed, or something went wrong with the downstream pipeline in `gitlab-docs`.
-
-```plaintext
-NoSuchKeyThe specified key does not exist.No such object: <URL>
-```
-
-In that case, you can:
-
-- Wait a few minutes and the review app should appear online.
-- Check the `review-docs-deploy` job's log and verify the URL. If the URL shown in the merge
-  request UI is different than the job log, try the one from the job log.
-- Check the status of the remote pipeline from the link in the merge request's job output.
-  If the pipeline failed or got stuck, GitLab team members can ask for help in the `#docs`
-  internal Slack channel. Contributors can ping a
-  [technical writer](https://handbook.gitlab.com/handbook/product/ux/technical-writing/#assignments-to-devops-stages-and-groups)
-  in the merge request.
+   The `DOCS_BRANCH` environment variable determines which branch of either the `gitlab-org/gitlab-docs` project or the
+   `gitlab-org/technical-writing-group/gitlab-docs-hugo` project are used. If not set, the `main` branch is used.
+1. After the documentation preview site is built:
+   - For `nanoc` builds, the HTML files are uploaded as [artifacts](../../ci/yaml/index.md#artifacts) to a GCP bucket.
+     For implementation details, see
+     [issue `gitlab-com/gl-infra/reliability#11021`](https://gitlab.com/gitlab-com/gl-infra/reliability/-/issues/11021).
+   - For `hugo` builds, a [parallel deployment](../../user/project/pages/index.md#parallel-deployments) is deployed.
diff --git a/doc/development/documentation/styleguide/availability_details.md b/doc/development/documentation/styleguide/availability_details.md
index b63ccdcbc62..d2a5017fbb8 100644
--- a/doc/development/documentation/styleguide/availability_details.md
+++ b/doc/development/documentation/styleguide/availability_details.md
@@ -74,6 +74,7 @@ For status, choose one:
 
 - `Beta`
 - `Experiment`
+- `Limited availability`
 
 Generally available features should not have a status.
 
@@ -129,7 +130,14 @@ For a feature status change from experiment to beta, use `changed`:
 
 ```markdown
 > - [Introduced](https://issue-link) as an [experiment](../../policy/development_stages_support.md) in GitLab 15.7.
-> - [Changed](https://issue-link) to beta in GitLab 16.0.
+> - [Changed](https://issue-link) from experiment to beta in GitLab 16.0.
+```
+
+For a feature status change from beta to limited availability, use `changed`:
+
+```markdown
+> - [Changed](https://issue-link) from experiment to beta in GitLab 16.0.
+> - [Changed](https://issue-link) from beta to limited availability in GitLab 16.3.
 ```
 
 For a change to generally available, use:
diff --git a/doc/development/documentation/styleguide/index.md b/doc/development/documentation/styleguide/index.md
index 00b5a3b21e9..d5210b9159d 100644
--- a/doc/development/documentation/styleguide/index.md
+++ b/doc/development/documentation/styleguide/index.md
@@ -1029,6 +1029,15 @@ To open group settings:
 1. Expand **General pipelines**.
 ```
 
+To open settings for a top-level group:
+
+```markdown
+1. On the left sidebar, select **Search or go to** and find your group.
+   This group must be at the top level.
+1. Select **Settings > CI/CD**.
+1. Expand **General pipelines**.
+```
+
 To open either project or group settings:
 
 ```markdown
diff --git a/doc/development/geo.md b/doc/development/geo.md
index 2286ce872d2..bdfd63bd8cb 100644
--- a/doc/development/geo.md
+++ b/doc/development/geo.md
@@ -9,7 +9,7 @@ info: Any user with at least the Maintainer role can merge updates to this conte
 Geo connects GitLab instances together. One GitLab instance is
 designated as a **primary** site and can be run with multiple
 **secondary** sites. Geo orchestrates quite a few components that can be seen on
-the diagram below and are described in more detail within this document.
+the diagram below and are described in more detail in this document.
 
 ![Geo Architecture Diagram](../administration/geo/replication/img/geo_architecture_v13_8.png)
 
diff --git a/doc/user/analytics/value_streams_dashboard.md b/doc/user/analytics/value_streams_dashboard.md
index 5f4fa248324..585579902f5 100644
--- a/doc/user/analytics/value_streams_dashboard.md
+++ b/doc/user/analytics/value_streams_dashboard.md
@@ -183,7 +183,8 @@ DETAILS:
 
 To enable or disable the overview count aggregation for the Value Streams Dashboard:
 
-1. On the left sidebar, select **Search or go to** and find your top-level group.
+1. On the left sidebar, select **Search or go to** and find your group.
+   This group must be at the top level.
 1. Select **Settings > Analytics**.
 1. In **Value Streams Dashboard**, select or clear the **Enable overview background aggregation for Value Streams Dashboard** checkbox.
 
diff --git a/doc/user/enterprise_user/index.md b/doc/user/enterprise_user/index.md
index a9073bc57b4..8737b3e33dd 100644
--- a/doc/user/enterprise_user/index.md
+++ b/doc/user/enterprise_user/index.md
@@ -107,7 +107,8 @@ For more information on group-level domain verification, see [epic 5299](https:/
 
 The custom domain must match the email domain exactly. For example, if your email is `username@example.com`, verify the `example.com` domain.
 
-1. On the left sidebar, select **Search or go to** and find your top-level group.
+1. On the left sidebar, select **Search or go to** and find your group.
+   This group must be at the top level.
 1. Select **Settings > Domain Verification**.
 1. In the upper-right corner, select **Add Domain**.
 1. In **Domain**, enter the domain name.
@@ -153,7 +154,8 @@ For GitLab instances with domain verification enabled, if the domain cannot be v
 
 To view all configured domains in your group:
 
-1. On the left sidebar, select **Search or go to** and find your top-level group.
+1. On the left sidebar, select **Search or go to** and find your group.
+   This group must be at the top level.
 1. Select **Settings > Domain Verification**.
 
 You then see:
@@ -166,7 +168,8 @@ You then see:
 
 To edit or remove a domain:
 
-1. On the left sidebar, select **Search or go to** and find your top-level group.
+1. On the left sidebar, select **Search or go to** and find your group.
+   This group must be at the top level.
 1. Select **Settings > Domain Verification**.
 1. When viewing **Domain Verification**, select the project listed next to the relevant domain.
 1. Edit or remove a domain following the relevant [GitLab Pages custom domains](../project/pages/custom_domains_ssl_tls_certification/index.md) instructions.
diff --git a/doc/user/gitlab_duo_chat/index.md b/doc/user/gitlab_duo_chat/index.md
index 30b8b5c05fa..7637098a15d 100644
--- a/doc/user/gitlab_duo_chat/index.md
+++ b/doc/user/gitlab_duo_chat/index.md
@@ -193,11 +193,11 @@ After GitLab Duo Chat opens:
 1. To send your question, press **Enter** or select **Send**.
 1. Use the buttons within code blocks in the responses to interact with them.
 
-### In the editor window
+### In GitLab Duo Quick Chat in the editor view
 
-> - Introduced as [generally available](https://gitlab.com/groups/gitlab-org/editor-extensions/-/epics/80) in GitLab Duo 3.0.0.
+> - Introduced as generally available in the [GitLab Duo plugin for JetBrains 3.0.0](https://gitlab.com/groups/gitlab-org/editor-extensions/-/epics/80) and [GitLab Workflow extension for VS Code 5.14.0](https://gitlab.com/groups/gitlab-org/-/epics/15218).
 
-To open GitLab Duo Chat in the editor window, use any of these methods:
+To open GitLab Duo Chat Quick Chat in the editor window, use any of these methods:
 
 - From a keyboard shortcut, by pressing:
   - MacOS: <kbd>Option</kbd> + <kbd>c</kbd>
@@ -215,6 +215,14 @@ After Quick Chat opens:
 1. Use the buttons around code blocks in the responses to interact with them.
 1. To exit chat, either select **Escape to close**, or press **Escape** while focused on the chat.
 
+<div class="video-fallback">
+  <a href="https://youtu.be/5JbAM5g2VbQ">View how to use GitLab Duo Quick Chat</a>.
+</div>
+<figure class="video-container">
+  <iframe src="https://www.youtube.com/embed/5JbAM5g2VbQ?si=pm7bTRDCR5we_1IX" frameborder="0" allowfullscreen> </iframe>
+</figure>
+<!-- Video published on 2024-10-15 -->
+
 ## Watch a demo and get tips
 
 <div class="video-fallback">
@@ -223,6 +231,7 @@ After Quick Chat opens:
 <figure class="video-container">
   <iframe src="https://www.youtube-nocookie.com/embed/l6vsd1HMaYA?si=etXpFbj1cBvWyj3_" frameborder="0" allowfullscreen> </iframe>
 </figure>
+<!-- Video published on 2023-11-10 -->
 
 For tips and tricks about integrating GitLab Duo Chat into your AI-powered DevSecOps workflows,
 read the blog post:
diff --git a/doc/user/gitlab_duo_chat/troubleshooting.md b/doc/user/gitlab_duo_chat/troubleshooting.md
index 870a0646d38..f1aa393d47b 100644
--- a/doc/user/gitlab_duo_chat/troubleshooting.md
+++ b/doc/user/gitlab_duo_chat/troubleshooting.md
@@ -213,6 +213,14 @@ You might get an error that states
 This is a fallback error that occurs when there is a problem with GitLab Duo Chat.
 Please try a more specific request, enter `/clear` to start a new chat, or leave feedback to help us improve.
 
+## `Error G3001`
+
+You might get an error that states
+`I'm sorry, but answering this question requires a different Duo subscription. Please contact your administrator.`.
+
+This error occurs when GitLab Duo Chat is not available in your subscription.
+Try a different request and contact your administrator.
+
 ## Header mismatch issue
 
 You might get an error that states `I'm sorry, I can't generate a response. Please try again`, without a specific error code.
diff --git a/doc/user/group/import/index.md b/doc/user/group/import/index.md
index 75b87305795..11bd7e38440 100644
--- a/doc/user/group/import/index.md
+++ b/doc/user/group/import/index.md
@@ -21,10 +21,6 @@ You can migrate GitLab groups:
 - From one self-managed GitLab instance to another.
 - Between groups in the same GitLab instance.
 
-WARNING:
-Migrating GitLab.com groups and projects by using direct transfer is [unavailable](https://status.gitlab.com).
-For more information, contact [GitLab Support](https://about.gitlab.com/support/).
-
 Migration by direct transfer creates a new copy of the group. If you want to move groups instead of copying groups, you
 can [transfer groups](../manage.md#transfer-a-group) if the groups are in the same GitLab instance. Transferring groups
 instead of migrating them is a faster and more complete option.
diff --git a/doc/user/group/saml_sso/group_sync.md b/doc/user/group/saml_sso/group_sync.md
index ba4b14fa98c..cee44f5b449 100644
--- a/doc/user/group/saml_sso/group_sync.md
+++ b/doc/user/group/saml_sso/group_sync.md
@@ -220,7 +220,8 @@ To integrate Microsoft Azure AD, you:
 
 To configure for a GitLab.com group:
 
-1. On the left sidebar, select **Search or go to** and find your top-level group.
+1. On the left sidebar, select **Search or go to** and find your group.
+   This group must be at the top level.
 1. Select **Settings > SAML SSO**.
 1. Configure [SAML SSO for the group](../../../user/group/saml_sso/index.md).
 1. In the **Microsoft Azure integration** section, select the **Enable Microsoft Azure integration for this group** checkbox.
diff --git a/doc/user/group/settings/group_access_tokens.md b/doc/user/group/settings/group_access_tokens.md
index 3e673e227cb..9c6306125bb 100644
--- a/doc/user/group/settings/group_access_tokens.md
+++ b/doc/user/group/settings/group_access_tokens.md
@@ -175,7 +175,8 @@ To limit potential abuse, you can restrict users from creating tokens for a grou
 
 To restrict the creation of group access tokens:
 
-1. On the left sidebar, select **Search or go to** and find your top-level group.
+1. On the left sidebar, select **Search or go to** and find your group.
+   This group must be at the top level.
 1. Select **Settings > General**.
 1. Expand **Permissions and group features**.
 1. Under **Permissions**, clear the **Users can create project access tokens and group access tokens in this group** checkbox.
diff --git a/doc/user/project/settings/project_access_tokens.md b/doc/user/project/settings/project_access_tokens.md
index 540f10b5265..7f977a8615a 100644
--- a/doc/user/project/settings/project_access_tokens.md
+++ b/doc/user/project/settings/project_access_tokens.md
@@ -128,7 +128,8 @@ See the warning in [create a project access token](#create-a-project-access-toke
 
 To limit potential abuse, you can restrict users from creating tokens for a group hierarchy. This setting is only configurable for a top-level group and applies to every downstream project and subgroup. Any existing project access tokens remain valid until their expiration date or until manually revoked.
 
-1. On the left sidebar, select **Search or go to** and find your top-level group.
+1. On the left sidebar, select **Search or go to** and find your group.
+   This group must be at the top level.
 1. Select **Settings > General**.
 1. Expand **Permissions and group features**.
 1. In **Permissions**, clear the **Users can create project access tokens and group access tokens in this group** checkbox.
diff --git a/gems/gitlab-secret_detection/lib/gitlab/secret_detection.rb b/gems/gitlab-secret_detection/lib/gitlab/secret_detection.rb
index 62c73a35b7d..b97187b1c9f 100644
--- a/gems/gitlab-secret_detection/lib/gitlab/secret_detection.rb
+++ b/gems/gitlab-secret_detection/lib/gitlab/secret_detection.rb
@@ -4,7 +4,6 @@ require_relative 'secret_detection/status'
 require_relative 'secret_detection/finding'
 require_relative 'secret_detection/response'
 require_relative 'secret_detection/scan'
-require_relative 'secret_detection/scan_diffs'
 require_relative 'secret_detection/grpc'
 require_relative 'secret_detection/utils'
 
diff --git a/gems/gitlab-secret_detection/lib/gitlab/secret_detection/scan.rb b/gems/gitlab-secret_detection/lib/gitlab/secret_detection/scan.rb
index f360e4df473..c4a36ff37d3 100644
--- a/gems/gitlab-secret_detection/lib/gitlab/secret_detection/scan.rb
+++ b/gems/gitlab-secret_detection/lib/gitlab/secret_detection/scan.rb
@@ -20,14 +20,14 @@ module Gitlab
 
       # default time limit(in seconds) for running the scan operation per invocation
       DEFAULT_SCAN_TIMEOUT_SECS = 60
-      # default time limit(in seconds) for running the scan operation on a single blob
-      DEFAULT_BLOB_TIMEOUT_SECS = 5
+      # default time limit(in seconds) for running the scan operation on a single payload
+      DEFAULT_PAYLOAD_TIMEOUT_SECS = 5
       # file path where the secrets ruleset file is located
       RULESET_FILE_PATH = File.expand_path('../../gitleaks.toml', __dir__)
       # Max no of child processes to spawn per request
       # ref: https://gitlab.com/gitlab-org/gitlab/-/issues/430160
       MAX_PROCS_PER_REQUEST = 5
-      # Minimum cumulative size of the blobs required to spawn and
+      # Minimum cumulative size of the payloads required to spawn and
       # run the scan within a new subprocess.
       MIN_CHUNK_SIZE_PER_PROC_BYTES = 2_097_152 # 2MiB
       # Whether to run scan in subprocesses or not. Default is true.
@@ -46,25 +46,25 @@ module Gitlab
         @pattern_matcher = build_pattern_matcher(rules)
       end
 
-      # Runs Secret Detection scan on the list of given blobs. Both the total scan duration and
-      # the duration for each blob is time bound via +timeout+ and +blob_timeout+ respectively.
+      # Runs Secret Detection scan on the list of given payloads. Both the total scan duration and
+      # the duration for each payload is time bound via +timeout+ and +payload_timeout+ respectively.
       #
-      # +blobs+:: Array of blobs with each blob to have `id` and `data` properties.
+      # +payloads+:: Array of payloads with each payload to have `id`, `data`, and `offset` properties.
       # +timeout+:: No of seconds(accepts floating point for smaller time values) to limit the total scan duration
-      # +blob_timeout+:: No of seconds(accepts floating point for smaller time values) to limit
-      #                  the scan duration on each blob
+      # +payload_timeout+:: No of seconds(accepts floating point for smaller time values) to limit
+      #                  the scan duration on each payload
       # +subprocess+:: If passed true, the scan is performed within subprocess instead of main process.
-      #           To avoid over-consuming memory by running scan on multiple large blobs within a single subprocess,
-      #           it instead groups the blobs into smaller array where each array contains blobs with cumulative size of
-      #           +MIN_CHUNK_SIZE_PER_PROC_BYTES+ bytes and each group runs in a separate sub-process. Default value
-      #           is true.
+      #           To avoid over-consuming memory by running scan on multiple large payloads within a single subprocess,
+      #           it instead groups the payloads into smaller array where each array contains payloads
+      #           with cumulative size of +MIN_CHUNK_SIZE_PER_PROC_BYTES+ bytes and each group runs
+      #           in a separate sub-process. Default value is true.
       # +exclusions+:: A hash containing arrays of exclusions by their type. Types handled here are
       #                `raw_value` and `rule`.
       #
       # NOTE:
       # Running the scan in fork mode primarily focuses on reducing the memory consumption of the scan by
-      # offloading regex operations on large blobs to sub-processes. However, it does not assure the improvement
-      # in the overall latency of the scan, specifically in the case of smaller blob sizes, where the overhead of
+      # offloading regex operations on large payloads to sub-processes. However, it does not assure the improvement
+      # in the overall latency of the scan, specifically in the case of smaller payload sizes, where the overhead of
       # forking a new process adds to the overall latency of the scan instead. More reference on Subprocess-based
       # execution is found here: https://gitlab.com/gitlab-org/gitlab/-/issues/430160.
       #
@@ -76,24 +76,25 @@ module Gitlab
       # }
       #
       def secrets_scan(
-        blobs,
+        payloads,
         timeout: DEFAULT_SCAN_TIMEOUT_SECS,
-        blob_timeout: DEFAULT_BLOB_TIMEOUT_SECS,
+        payload_timeout: DEFAULT_PAYLOAD_TIMEOUT_SECS,
         subprocess: RUN_IN_SUBPROCESS,
         exclusions: {}
       )
-        return SecretDetection::Response.new(SecretDetection::Status::INPUT_ERROR) unless validate_scan_input(blobs)
+
+        return SecretDetection::Response.new(SecretDetection::Status::INPUT_ERROR) unless validate_scan_input(payloads)
 
         Timeout.timeout(timeout) do
-          matched_blobs = filter_by_keywords(blobs)
+          matched_payloads = filter_by_keywords(payloads)
 
-          next SecretDetection::Response.new(SecretDetection::Status::NOT_FOUND) if matched_blobs.empty?
+          next SecretDetection::Response.new(SecretDetection::Status::NOT_FOUND) if matched_payloads.empty?
 
           scan_result =
             if subprocess
-              run_scan_within_subprocess(matched_blobs, blob_timeout, exclusions)
+              run_scan_within_subprocess(matched_payloads, payload_timeout, exclusions)
             else
-              run_scan(matched_blobs, blob_timeout, exclusions)
+              run_scan(matched_payloads, payload_timeout, exclusions)
             end
 
           scan_status = overall_scan_status(scan_result[:secrets])
@@ -143,38 +144,34 @@ module Gitlab
 
       # creates and returns the unique set of rule matching keywords
       def create_keywords(rules)
-        secrets_keywords = []
-
-        rules.each do |rule|
-          secrets_keywords << rule["keywords"]
-        end
+        secrets_keywords = rules.map { |rule| rule["keywords"] } # rubocop: disable Rails/Pluck -- rules is an Array, not ActiveRecord relation
 
         secrets_keywords.flatten.compact.to_set
       end
 
-      # returns only those blobs that contain at least one of the keywords
+      # returns only those payloads that contain at least one of the keywords
       # from the keywords list
-      def filter_by_keywords(blobs)
-        matched_blobs = []
+      def filter_by_keywords(payloads)
+        matched_payloads = []
 
-        blobs.each do |blob|
-          matched_blobs << blob if keywords.any? { |keyword| blob.data.include?(keyword) }
+        payloads.each do |payload|
+          matched_payloads << payload if keywords.any? { |keyword| payload[:data].include?(keyword) }
         end
 
-        matched_blobs.freeze
+        matched_payloads.freeze
       end
 
-      def run_scan(blobs, blob_timeout, exclusions)
-        results = blobs.flat_map do |blob|
-          Timeout.timeout(blob_timeout) do
-            find_secrets(blob, exclusions)
+      def run_scan(payloads, payload_timeout, exclusions)
+        results = payloads.flat_map do |payload|
+          Timeout.timeout(payload_timeout) do
+            find_secrets(payload, exclusions)
           end
         rescue Timeout::Error => e
-          logger.error "Secret Detection scan timed out on the blob(id:#{blob.id}): #{e}"
+          logger.error "Secret Detection scan timed out on the payload(id:#{payload[:id]}): #{e}"
 
           # This mimics the structure returned from `find_secrets(...)`.
           {
-            secrets: [SecretDetection::Finding.new(blob.id, SecretDetection::Status::PAYLOAD_TIMEOUT)],
+            secrets: [SecretDetection::Finding.new(payload[:id], SecretDetection::Status::PAYLOAD_TIMEOUT)],
             applied_exclusions: []
           }
         end
@@ -185,27 +182,27 @@ module Gitlab
         }
       end
 
-      def run_scan_within_subprocess(blobs, blob_timeout, exclusions)
-        blob_sizes = blobs.map(&:size)
+      def run_scan_within_subprocess(payloads, payload_timeout, exclusions)
+        payload_sizes = payloads.map { |payload| payload[:data].bytesize }
+        grouped_payload_indicies = group_by_chunk_size(payload_sizes)
 
-        grouped_blob_indicies = group_by_chunk_size(blob_sizes)
-        grouped_blobs = grouped_blob_indicies.map { |idx_arr| idx_arr.map { |i| blobs[i] } }
+        grouped_payloads = grouped_payload_indicies.map { |idx_arr| idx_arr.map { |i| payloads[i] } }
 
         results = Parallel.flat_map(
-          grouped_blobs,
+          grouped_payloads,
           in_processes: MAX_PROCS_PER_REQUEST,
           isolation: true # do not reuse sub-processes
-        ) do |grouped_blob|
-          grouped_blob.map do |blob|
-            Timeout.timeout(blob_timeout) do
-              find_secrets(blob, exclusions)
+        ) do |grouped_payload|
+          grouped_payload.map do |payload|
+            Timeout.timeout(payload_timeout) do
+              find_secrets(payload, exclusions)
             end
           rescue Timeout::Error => e
-            logger.error "Secret Detection scan timed out on the blob(id:#{blob.id}): #{e}"
+            logger.error "Secret Detection scan timed out on the payload(id:#{payload[:id]}): #{e}"
 
             # This mimics the structure returned from `find_secrets(...)`.
             {
-              secrets: [SecretDetection::Finding.new(blob.id, SecretDetection::Status::PAYLOAD_TIMEOUT)],
+              secrets: [SecretDetection::Finding.new(payload[:id], SecretDetection::Status::PAYLOAD_TIMEOUT)],
               applied_exclusions: []
             }
           end
@@ -217,17 +214,17 @@ module Gitlab
         }
       end
 
-      # finds secrets in the given blob with a timeout circuit breaker
-      def find_secrets(blob, exclusions)
+      # finds secrets in the given payload with a timeout circuit breaker
+      def find_secrets(payload, exclusions)
         secrets = []
         applied_exclusions = []
+        offset = payload[:offset]
 
-        blob.data.each_line.with_index do |line, index|
+        payload[:data].each_line.with_index do |line, index|
           exclusions[:raw_value]&.each do |exclusion|
             next unless line.include?(exclusion.value)
 
             applied_exclusions << exclusion
-
             line.gsub!(exclusion.value, '') # remove excluded raw value from the line.
           end
 
@@ -237,17 +234,16 @@ module Gitlab
 
           next unless patterns.any?
 
-          line_number = index + 1
+          line_number = offset + index
 
           patterns.each do |pattern|
             type = rules[pattern]["id"]
             description = rules[pattern]["description"]
 
-            # Check if rule type is excluded and if so, skip this rule and count this as an applied exclusion
             next if applied_rule_exclusion?(type, exclusions[:rule], applied_exclusions)
 
             secrets << SecretDetection::Finding.new(
-              blob.id,
+              payload[:id],
               SecretDetection::Status::FOUND,
               line_number,
               type,
@@ -258,10 +254,10 @@ module Gitlab
 
         { secrets:, applied_exclusions: }
       rescue StandardError => e
-        logger.error "Secret Detection scan failed on the blob(id:#{blob.id}): #{e}"
+        logger.error "Secret Detection scan failed on the payload(id:#{payload[:id]}): #{e}"
 
         {
-          secrets: [SecretDetection::Finding.new(blob.id, SecretDetection::Status::SCAN_ERROR)],
+          secrets: [SecretDetection::Finding.new(payload[:id], SecretDetection::Status::SCAN_ERROR)],
           applied_exclusions: []
         }
       end
@@ -271,22 +267,22 @@ module Gitlab
         applied_exclusion && (applied_exclusions << applied_exclusion)
       end
 
-      def validate_scan_input(blobs)
-        return false if blobs.nil? || !blobs.instance_of?(Array)
+      def validate_scan_input(payloads)
+        return false if payloads.nil? || !payloads.instance_of?(Array)
 
-        blobs.all? do |blob|
-          next false unless blob.respond_to?(:id) || blob.respond_to?(:data)
+        payloads.all? do |p|
+          next false unless p.key?(:id) && p.key?(:data)
 
-          blob.data.freeze # freeze blobs to avoid additional object allocations on strings
+          p[:data].freeze
         end
       end
 
       def overall_scan_status(found_secrets)
         return SecretDetection::Status::NOT_FOUND if found_secrets.empty?
 
-        timed_out_blobs = found_secrets.count { |el| el.status == SecretDetection::Status::PAYLOAD_TIMEOUT }
+        timed_out_payloads = found_secrets.count { |el| el.status == SecretDetection::Status::PAYLOAD_TIMEOUT }
 
-        case timed_out_blobs
+        case timed_out_payloads
         when 0
           SecretDetection::Status::FOUND
         when found_secrets.length
@@ -296,15 +292,15 @@ module Gitlab
         end
       end
 
-      # This method accepts an array of blob sizes(in bytes) and groups them into an array
+      # This method accepts an array of payload sizes(in bytes) and groups them into an array
       # of arrays structure where each element is the group of indicies of the input
-      # array whose cumulative blob sizes has at least +MIN_CHUNK_SIZE_PER_PROC_BYTES+
-      def group_by_chunk_size(blob_size_arr)
+      # array whose cumulative payload sizes has at least +MIN_CHUNK_SIZE_PER_PROC_BYTES+
+      def group_by_chunk_size(payload_size_arr)
         cumulative_size = 0
         chunk_indexes = []
         chunk_idx_start = 0
 
-        blob_size_arr.each_with_index do |size, index|
+        payload_size_arr.each_with_index do |size, index|
           cumulative_size += size
           next unless cumulative_size >= MIN_CHUNK_SIZE_PER_PROC_BYTES
 
@@ -314,11 +310,11 @@ module Gitlab
           cumulative_size = 0
         end
 
-        if cumulative_size.positive? && (chunk_idx_start < blob_size_arr.length)
-          chunk_indexes << if chunk_idx_start == blob_size_arr.length - 1
+        if cumulative_size.positive? && (chunk_idx_start < payload_size_arr.length)
+          chunk_indexes << if chunk_idx_start == payload_size_arr.length - 1
                              [chunk_idx_start]
                            else
-                             (chunk_idx_start..blob_size_arr.length - 1).to_a
+                             (chunk_idx_start..payload_size_arr.length - 1).to_a
                            end
         end
 
diff --git a/gems/gitlab-secret_detection/lib/gitlab/secret_detection/scan_diffs.rb b/gems/gitlab-secret_detection/lib/gitlab/secret_detection/scan_diffs.rb
deleted file mode 100644
index 6622247c43b..00000000000
--- a/gems/gitlab-secret_detection/lib/gitlab/secret_detection/scan_diffs.rb
+++ /dev/null
@@ -1,360 +0,0 @@
-# frozen_string_literal: true
-
-require 'toml-rb'
-require 're2'
-require 'logger'
-require 'timeout'
-require 'parallel'
-
-module Gitlab
-  module SecretDetection
-    # Scan is responsible for running Secret Detection scan operation
-    class ScanDiffs
-      # RulesetParseError is thrown when the code fails to parse the
-      # ruleset file from the given path
-      RulesetParseError = Class.new(StandardError)
-
-      # RulesetCompilationError is thrown when the code fails to compile
-      # the predefined rulesets
-      RulesetCompilationError = Class.new(StandardError)
-
-      # default time limit(in seconds) for running the scan operation per invocation
-      DEFAULT_SCAN_TIMEOUT_SECS = 60
-      # default time limit(in seconds) for running the scan operation on a single diff
-      DEFAULT_PAYLOAD_TIMEOUT_SECS = 5
-      # file path where the secrets ruleset file is located
-      RULESET_FILE_PATH = File.expand_path('../../gitleaks.toml', __dir__)
-      # Max no of child processes to spawn per request
-      # ref: https://gitlab.com/gitlab-org/gitlab/-/issues/430160
-      MAX_PROCS_PER_REQUEST = 5
-      # Minimum cumulative size of the diffs required to spawn and
-      # run the scan within a new subprocess.
-      MIN_CHUNK_SIZE_PER_PROC_BYTES = 2_097_152 # 2MiB
-      # Whether to run scan in subprocesses or not. Default is true.
-      RUN_IN_SUBPROCESS = true
-
-      # Initializes the instance with logger along with following operations:
-      # 1. Parse ruleset for the given +ruleset_path+(default: +RULESET_FILE_PATH+). Raises +RulesetParseError+
-      # in case the operation fails.
-      # 2. Extract keywords from the parsed ruleset to use it for matching keywords before regex operation.
-      # 3. Build and Compile rule regex patterns obtained from the ruleset. Raises +RulesetCompilationError+
-      # in case the compilation fails.
-      def initialize(logger: Logger.new($stdout), ruleset_path: RULESET_FILE_PATH)
-        @logger = logger
-        @rules = parse_ruleset(ruleset_path)
-        @keywords = create_keywords(rules)
-        @pattern_matcher = build_pattern_matcher(rules)
-      end
-
-      # Runs Secret Detection scan on the list of given diffs. Both the total scan duration and
-      # the duration for each diff is time bound via +timeout+ and +payload_timeout+ respectively.
-      #
-      # +diffs+:: Array of diffs between diff pairs. Each diff has attributes: left_blob_id, right_blob_id,
-      #           patch, status, binary, and over_patch_bytes_limit.
-      # +timeout+:: No of seconds(accepts floating point for smaller time values) to limit the total scan duration
-      # +payload_timeout+:: No of seconds(accepts floating point for smaller time values) to limit
-      #                  the scan duration on each diff
-      # +subprocess+:: If passed true, the scan is performed within subprocess instead of main process.
-      #           To avoid over-consuming memory by running scan on multiple large diffs within a single subprocess,
-      #           it instead groups the diffs into smaller array where each array contains diffs with cumulative size of
-      #           +MIN_CHUNK_SIZE_PER_PROC_BYTES+ bytes and each group runs in a separate sub-process. Default value
-      #           is true.
-      # +exclusions+:: A hash containing arrays of exclusions by their type. Types handled here are
-      #                `raw_value` and `rule`.
-      #
-      # NOTE:
-      # Running the scan in fork mode primarily focuses on reducing the memory consumption of the scan by
-      # offloading regex operations on large diffs to sub-processes. However, it does not assure the improvement
-      # in the overall latency of the scan, specifically in the case of smaller diff sizes, where the overhead of
-      # forking a new process adds to the overall latency of the scan instead. More reference on Subprocess-based
-      # execution is found here: https://gitlab.com/gitlab-org/gitlab/-/issues/430160.
-      #
-      # Returns an instance of SecretDetection::Response by following below structure:
-      # {
-      #     status: One of the SecretDetection::Status values
-      #     results: [SecretDetection::Finding],
-      #     applied_exclusions: [Security::ProjectSecurityExclusion]
-      # }
-      #
-      def secrets_scan(
-        diffs,
-        timeout: DEFAULT_SCAN_TIMEOUT_SECS,
-        payload_timeout: DEFAULT_PAYLOAD_TIMEOUT_SECS,
-        subprocess: RUN_IN_SUBPROCESS,
-        exclusions: {}
-      )
-
-        return SecretDetection::Response.new(SecretDetection::Status::INPUT_ERROR) unless validate_scan_input(diffs)
-
-        Timeout.timeout(timeout) do
-          matched_diffs = filter_by_keywords(diffs)
-
-          next SecretDetection::Response.new(SecretDetection::Status::NOT_FOUND) if matched_diffs.empty?
-
-          scan_result =
-            if subprocess
-              run_scan_within_subprocess(matched_diffs, payload_timeout, exclusions)
-            else
-              run_scan(matched_diffs, payload_timeout, exclusions)
-            end
-
-          scan_status = overall_scan_status(scan_result[:secrets])
-
-          SecretDetection::Response.new(
-            scan_status,
-            scan_result[:secrets],
-            scan_result[:applied_exclusions]
-          )
-        end
-      rescue Timeout::Error => e
-        logger.error "Secret detection operation timed out: #{e}"
-
-        SecretDetection::Response.new(SecretDetection::Status::SCAN_TIMEOUT)
-      end
-
-      private
-
-      attr_reader :logger, :rules, :keywords, :pattern_matcher, :applied_exclusions
-
-      # parses given ruleset file and returns the parsed rules
-      def parse_ruleset(ruleset_file_path)
-        rules_data = TomlRB.load_file(ruleset_file_path)
-        rules_data['rules']
-      rescue StandardError => e
-        logger.error "Failed to parse secret detection ruleset from '#{ruleset_file_path}' path: #{e}"
-
-        raise RulesetParseError
-      end
-
-      # builds RE2::Set pattern matcher for the given rules
-      def build_pattern_matcher(rules)
-        matcher = RE2::Set.new
-
-        rules.each do |rule|
-          matcher.add(rule["regex"])
-        end
-
-        unless matcher.compile
-          logger.error "Failed to compile secret detection rulesets in RE::Set"
-
-          raise RulesetCompilationError
-        end
-
-        matcher
-      end
-
-      # creates and returns the unique set of rule matching keywords
-      def create_keywords(rules)
-        secrets_keywords = []
-
-        rules.each do |rule|
-          secrets_keywords << rule["keywords"]
-        end
-
-        secrets_keywords.flatten.compact.to_set
-      end
-
-      # returns only those diffs that contain at least one of the keywords
-      # from the keywords list
-      def filter_by_keywords(diffs)
-        matched_diffs = []
-
-        diffs.each do |diff|
-          matched_diffs << diff if keywords.any? { |keyword| diff.patch.include?(keyword) }
-        end
-
-        matched_diffs.freeze
-      end
-
-      def run_scan(diffs, payload_timeout, exclusions)
-        results = diffs.flat_map do |diff|
-          Timeout.timeout(payload_timeout) do
-            find_secrets(diff, exclusions)
-          end
-        rescue Timeout::Error => e
-          logger.error "Secret Detection scan timed out on the diff(id:#{diff.right_blob_id}): #{e}"
-
-          # This mimics the structure returned from `find_secrets(...)`.
-          {
-            secrets: [SecretDetection::Finding.new(diff.right_blob_id, SecretDetection::Status::PAYLOAD_TIMEOUT)],
-            applied_exclusions: []
-          }
-        end
-
-        {
-          secrets: results.flat_map { |result| result[:secrets] },
-          applied_exclusions: results.flat_map { |result| result[:applied_exclusions] }
-        }
-      end
-
-      def run_scan_within_subprocess(diffs, payload_timeout, exclusions)
-        diff_sizes = diffs.map { |diff| diff.patch.bytesize }
-
-        grouped_diff_indicies = group_by_chunk_size(diff_sizes)
-        grouped_diffs = grouped_diff_indicies.map { |idx_arr| idx_arr.map { |i| diffs[i] } }
-
-        results = Parallel.flat_map(
-          grouped_diffs,
-          in_processes: MAX_PROCS_PER_REQUEST,
-          isolation: true # do not reuse sub-processes
-        ) do |grouped_diff|
-          grouped_diff.map do |diff|
-            Timeout.timeout(payload_timeout) do
-              find_secrets(diff, exclusions)
-            end
-          rescue Timeout::Error => e
-            logger.error "Secret Detection scan timed out on the diff(id:#{diff.right_blob_id}): #{e}"
-
-            # This mimics the structure returned from `find_secrets(...)`.
-            {
-              secrets: [SecretDetection::Finding.new(diff.right_blob_id, SecretDetection::Status::PAYLOAD_TIMEOUT)],
-              applied_exclusions: []
-            }
-          end
-        end
-
-        {
-          secrets: results.flat_map { |result| result[:secrets] },
-          applied_exclusions: results.flat_map { |result| result[:applied_exclusions] }
-        }
-      end
-
-      # finds secrets in the given diff with a timeout circuit breaker
-      def find_secrets(diff, exclusions)
-        secrets = []
-        applied_exclusions = []
-        line_number_offset = 0
-
-        # The following section parses a single line in a diff patch.
-        #
-        # If the line starts with @@, it is the hunk header, used to calculate the line number.
-        # If the line starts with +, it is newly added in this diff, and we
-        # scan the line for newly added secrets. Also increment line number.
-        # If the line starts with -, it is removed in this diff, do not increment line number.
-        # If the line starts with \\, it is the no newline marker, do not increment line number.
-        # If the line starts with a space character, it is a context line, just increment the line number.
-        #
-        # A context line that starts with an important character would still be treated
-        # like a context line, as shown below:
-        # @@ -1,5 +1,5 @@
-        #  context line
-        # -removed line
-        # +added line
-        #  @@this context line has a @@ but starts with a space so isnt a header
-        #  +this context line has a + but starts with a space so isnt an addition
-        #  -this context line has a - but starts with a space so isnt a removal
-        diff.patch.each_line do |line|
-          exclusions[:raw_value]&.each do |exclusion|
-            next unless line.include?(exclusion.value)
-
-            applied_exclusions << exclusion
-
-            line.gsub!(exclusion.value, '') # remove excluded raw value from the line.
-          end
-
-          # Parse hunk header for start line
-          if line.start_with?("@@")
-            hunk_info = line.match(/@@ -\d+(,\d+)? \+(\d+)(,\d+)? @@/)
-            start_line = hunk_info[2].to_i
-            line_number_offset = start_line - 1
-          # Line added in this commit
-          elsif line.start_with?('+')
-            line_number_offset += 1
-            # Remove leading +
-            line_content = line[1..]
-
-            patterns = pattern_matcher.match(line_content, exception: false)
-
-            next unless patterns.any?
-
-            patterns.each do |pattern|
-              type = rules[pattern]["id"]
-              description = rules[pattern]["description"]
-
-              # Check if rule type is excluded and if so, skip this rule and count this as an applied exclusion
-              next if applied_rule_exclusion?(type, exclusions[:rule], applied_exclusions)
-
-              secrets << SecretDetection::Finding.new(
-                diff.right_blob_id,
-                SecretDetection::Status::FOUND,
-                line_number_offset,
-                type,
-                description
-              )
-            end
-          # Line not added in this commit, just increment line number
-          elsif line.start_with?(' ')
-            line_number_offset += 1
-          # Line removed in this commit or no newline marker, do not increment line number
-          elsif line.start_with?('-', '\\')
-            # No increment
-          end
-        end
-
-        { secrets:, applied_exclusions: }
-      rescue StandardError => e
-        logger.error "Secret Detection scan failed on the diff(id:#{diff.right_blob_id}): #{e}"
-
-        {
-          secrets: [SecretDetection::Finding.new(diff.right_blob_id, SecretDetection::Status::SCAN_ERROR)],
-          applied_exclusions: []
-        }
-      end
-
-      def applied_rule_exclusion?(type, rule_exclusions, applied_exclusions)
-        applied_exclusion = rule_exclusions&.find { |rule_exclusion| rule_exclusion.value == type }
-        applied_exclusion && (applied_exclusions << applied_exclusion)
-      end
-
-      def validate_scan_input(diffs)
-        return false if diffs.nil? || !diffs.instance_of?(Array)
-
-        diffs.each { |diff| diff.patch.freeze }
-      end
-
-      def overall_scan_status(found_secrets)
-        return SecretDetection::Status::NOT_FOUND if found_secrets.empty?
-
-        timed_out_diffs = found_secrets.count { |el| el.status == SecretDetection::Status::PAYLOAD_TIMEOUT }
-
-        case timed_out_diffs
-        when 0
-          SecretDetection::Status::FOUND
-        when found_secrets.length
-          SecretDetection::Status::SCAN_TIMEOUT
-        else
-          SecretDetection::Status::FOUND_WITH_ERRORS
-        end
-      end
-
-      # This method accepts an array of diff sizes(in bytes) and groups them into an array
-      # of arrays structure where each element is the group of indicies of the input
-      # array whose cumulative diff sizes has at least +MIN_CHUNK_SIZE_PER_PROC_BYTES+
-      def group_by_chunk_size(diff_size_arr)
-        cumulative_size = 0
-        chunk_indexes = []
-        chunk_idx_start = 0
-
-        diff_size_arr.each_with_index do |size, index|
-          cumulative_size += size
-          next unless cumulative_size >= MIN_CHUNK_SIZE_PER_PROC_BYTES
-
-          chunk_indexes << (chunk_idx_start..index).to_a
-
-          chunk_idx_start = index + 1
-          cumulative_size = 0
-        end
-
-        if cumulative_size.positive? && (chunk_idx_start < diff_size_arr.length)
-          chunk_indexes << if chunk_idx_start == diff_size_arr.length - 1
-                             [chunk_idx_start]
-                           else
-                             (chunk_idx_start..diff_size_arr.length - 1).to_a
-                           end
-        end
-
-        chunk_indexes
-      end
-    end
-  end
-end
diff --git a/gems/gitlab-secret_detection/spec/lib/gitlab/secret_detection/scan_diffs_spec.rb b/gems/gitlab-secret_detection/spec/lib/gitlab/secret_detection/scan_diffs_spec.rb
deleted file mode 100644
index e1e53ca0f49..00000000000
--- a/gems/gitlab-secret_detection/spec/lib/gitlab/secret_detection/scan_diffs_spec.rb
+++ /dev/null
@@ -1,544 +0,0 @@
-# frozen_string_literal: true
-
-require 'spec_helper'
-
-RSpec.describe Gitlab::SecretDetection::ScanDiffs, feature_category: :secret_detection do
-  subject(:scan) { described_class.new }
-
-  let(:diff_blob) do
-    Struct.new(:left_blob_id, :right_blob_id, :patch, :status, :binary, :over_patch_bytes_limit, keyword_init: true)
-  end
-
-  let(:exclusion) do
-    Struct.new('Exclusion', :value, :keyword_init)
-  end
-
-  let(:sha1_blank_sha) { ('0' * 40).freeze }
-  let(:sample_blob_id) { 'fe29d93da4843da433e62711ace82db601eb4f8f' }
-
-  let(:ruleset) do
-    {
-      "title" => "gitleaks config",
-      "rules" => [
-        {
-          "id" => "gitlab_personal_access_token",
-          "description" => "GitLab Personal Access Token",
-          "regex" => "\bglpat-[0-9a-zA-Z_-]{20}\b",
-          "tags" => %w[gitlab revocation_type],
-          "keywords" => ["glpat"]
-        },
-        {
-          "id" => "gitlab_pipeline_trigger_token",
-          "description" => "GitLab Pipeline Trigger Token",
-          "regex" => "\bglptt-[0-9a-zA-Z_-]{40}\b",
-          "tags" => ["gitlab"],
-          "keywords" => ["glptt"]
-        },
-        {
-          "id" => "gitlab_runner_registration_token",
-          "description" => "GitLab Runner Registration Token",
-          "regex" => "\bGR1348941[0-9a-zA-Z_-]{20}\b",
-          "tags" => ["gitlab"],
-          "keywords" => ["GR1348941"]
-        },
-        {
-          "id" => "gitlab_feed_token_v2",
-          "description" => "GitLab Feed token",
-          "regex" => "\bglft-[0-9a-zA-Z_-]{20}\b",
-          "tags" => ["gitlab"],
-          "keywords" => ["glft"]
-        }
-      ]
-    }
-  end
-
-  let(:empty_applied_exclusions) { [] }
-
-  it "does not raise an error parsing the toml file" do
-    expect { scan }.not_to raise_error
-  end
-
-  context "when it creates RE2 patterns from file data" do
-    before do
-      allow(scan).to receive(:parse_ruleset).and_return(ruleset)
-    end
-
-    it "does not raise an error when building patterns" do
-      expect { scan }.not_to raise_error
-    end
-  end
-
-  context "when matching patterns" do
-    before do
-      allow(scan).to receive(:parse_ruleset).and_return(ruleset)
-    end
-
-    context 'when the diff does not contain a secret' do
-      let(:diffs) do
-        [
-          diff_blob.new(
-            left_blob_id: sha1_blank_sha,
-            right_blob_id: sample_blob_id,
-            patch: "@@ -0,0 +1 @@\n+BASE_URL=https://foo.bar\n\\ No newline at end of file\n",
-            status: :STATUS_END_OF_PATCH,
-            binary: false,
-            over_patch_bytes_limit: false
-          )
-        ]
-      end
-
-      it "does not match" do
-        expected_response = Gitlab::SecretDetection::Response.new(
-          Gitlab::SecretDetection::Status::NOT_FOUND,
-          nil,
-          empty_applied_exclusions
-        )
-
-        expect(scan.secrets_scan(diffs)).to eq(expected_response)
-      end
-
-      it "attempts to keyword match returning no diffs for further scan" do
-        expect(scan).to receive(:filter_by_keywords)
-          .with(diffs)
-          .and_return([])
-
-        scan.secrets_scan(diffs)
-      end
-
-      it "does not attempt to regex match" do
-        expect(scan).not_to receive(:match_rules_bulk)
-
-        scan.secrets_scan(diffs)
-      end
-    end
-
-    context "when multiple diffs contains secrets" do
-      let(:diffs) do
-        [
-          diff_blob.new(
-            left_blob_id: sha1_blank_sha,
-            right_blob_id: sample_blob_id,
-            patch: "@@ -0,0 +1 @@\n+glpat-12312312312312312312\n", # gitleaks:allow
-            status: :STATUS_END_OF_PATCH,
-            binary: false,
-            over_patch_bytes_limit: false
-          ),
-          diff_blob.new(
-            left_blob_id: sha1_blank_sha,
-            right_blob_id: sample_blob_id,
-            patch: "@@ -0,0 +1,3 @@\n+\n+\n+glptt-1231231231231231231212312312312312312312\n", # gitleaks:allow
-            status: :STATUS_END_OF_PATCH,
-            binary: false,
-            over_patch_bytes_limit: false
-          ),
-          diff_blob.new(
-            left_blob_id: sha1_blank_sha,
-            right_blob_id: sample_blob_id,
-            patch: "@@ -0,0 +1 @@\n+data with no secret\n",
-            status: :STATUS_END_OF_PATCH,
-            binary: false,
-            over_patch_bytes_limit: false
-          ),
-          diff_blob.new(
-            left_blob_id: sha1_blank_sha,
-            right_blob_id: sample_blob_id,
-            patch: "@@ -0,0 +1,2 @@\n+GR134894112312312312312312312\n+glft-12312312312312312312\n", # gitleaks:allow
-            status: :STATUS_END_OF_PATCH,
-            binary: false,
-            over_patch_bytes_limit: false
-          ),
-          diff_blob.new(
-            left_blob_id: sha1_blank_sha,
-            right_blob_id: sample_blob_id,
-            patch: "@@ -0,0 +1 @@\n+data with no secret\n",
-            status: :STATUS_END_OF_PATCH,
-            binary: false,
-            over_patch_bytes_limit: false
-          ),
-          diff_blob.new(
-            left_blob_id: sha1_blank_sha,
-            right_blob_id: sample_blob_id,
-            patch: "@@ -0,0 +1 @@\n+data with no secret\n",
-            status: :STATUS_END_OF_PATCH,
-            binary: false,
-            over_patch_bytes_limit: false
-          ),
-          diff_blob.new(
-            left_blob_id: sha1_blank_sha,
-            right_blob_id: sample_blob_id,
-            patch: "@@ -0,0 +1 @@\n+glptt-1231231231231231231212312312312312312312\n", # gitleaks:allow
-            status: :STATUS_END_OF_PATCH,
-            binary: false,
-            over_patch_bytes_limit: false
-          ),
-          diff_blob.new(
-            left_blob_id: sha1_blank_sha,
-            right_blob_id: sample_blob_id,
-            patch: "@@ -0,0 +1,2 @@\n+glpat-12312312312312312312\n+GR134894112312312312312312312\n", # gitleaks:allow
-            status: :STATUS_END_OF_PATCH,
-            binary: false,
-            over_patch_bytes_limit: false
-          )
-        ]
-      end
-
-      let(:expected_response) do
-        Gitlab::SecretDetection::Response.new(
-          Gitlab::SecretDetection::Status::FOUND,
-          [
-            Gitlab::SecretDetection::Finding.new(
-              diffs[0].right_blob_id,
-              Gitlab::SecretDetection::Status::FOUND,
-              1,
-              ruleset['rules'][0]['id'],
-              ruleset['rules'][0]['description']
-            ),
-            Gitlab::SecretDetection::Finding.new(
-              diffs[1].right_blob_id,
-              Gitlab::SecretDetection::Status::FOUND,
-              3,
-              ruleset['rules'][1]['id'],
-              ruleset['rules'][1]['description']
-            ),
-            Gitlab::SecretDetection::Finding.new(
-              diffs[3].right_blob_id,
-              Gitlab::SecretDetection::Status::FOUND,
-              1,
-              ruleset['rules'][2]['id'],
-              ruleset['rules'][2]['description']
-            ),
-            Gitlab::SecretDetection::Finding.new(
-              diffs[3].right_blob_id,
-              Gitlab::SecretDetection::Status::FOUND,
-              2,
-              ruleset['rules'][3]['id'],
-              ruleset['rules'][3]['description']
-            ),
-            Gitlab::SecretDetection::Finding.new(
-              diffs[6].right_blob_id,
-              Gitlab::SecretDetection::Status::FOUND,
-              1,
-              ruleset['rules'][1]['id'],
-              ruleset['rules'][1]['description']
-            ),
-            Gitlab::SecretDetection::Finding.new(
-              diffs[7].right_blob_id,
-              Gitlab::SecretDetection::Status::FOUND,
-              1,
-              ruleset['rules'][0]['id'],
-              ruleset['rules'][0]['description']
-            ),
-            Gitlab::SecretDetection::Finding.new(
-              diffs[7].right_blob_id,
-              Gitlab::SecretDetection::Status::FOUND,
-              2,
-              ruleset['rules'][2]['id'],
-              ruleset['rules'][2]['description']
-            )
-          ],
-          empty_applied_exclusions
-        )
-      end
-
-      it "attempts to keyword match returning only filtered diffs for further scan" do
-        expected = diffs.reject { |d| d.patch.include?("data with no secret") }
-
-        expect(scan).to receive(:filter_by_keywords)
-                          .with(diffs)
-                          .and_return(expected)
-
-        scan.secrets_scan(diffs)
-      end
-
-      it "matches multiple rules when running in main process" do
-        expect(scan.secrets_scan(diffs, subprocess: false)).to eq(expected_response)
-      end
-    end
-
-    context "when configured with time out" do
-      let(:each_payload_timeout_secs) { 0.000_001 } # 1 micro-sec to intentionally timeout large diff
-
-      let(:large_data) do
-        ("\n+large data with a secret glpat-12312312312312312312" * 10_000_000).freeze # gitleaks:allow
-      end
-
-      let(:diffs) do
-        [
-          diff_blob.new(
-            left_blob_id: sha1_blank_sha,
-            right_blob_id: sample_blob_id,
-            patch: "@@ -0,0 +1,2 @@\n+GR134894112312312312312312312\n", # gitleaks:allow
-            status: :STATUS_END_OF_PATCH,
-            binary: false,
-            over_patch_bytes_limit: false
-          ),
-          diff_blob.new(
-            left_blob_id: sha1_blank_sha,
-            right_blob_id: sample_blob_id,
-            patch: "@@ -0,0 +1,2 @@\n+data with no secret\n",
-            status: :STATUS_END_OF_PATCH,
-            binary: false,
-            over_patch_bytes_limit: false
-          ),
-          diff_blob.new(
-            left_blob_id: sha1_blank_sha,
-            right_blob_id: sample_blob_id,
-            patch: "@@ -0,0 +1,10000001 @@\n#{large_data}\n",
-            status: :STATUS_END_OF_PATCH,
-            binary: false,
-            over_patch_bytes_limit: false
-          )
-        ]
-      end
-
-      let(:all_large_diffs) do
-        [
-          diff_blob.new(
-            left_blob_id: sha1_blank_sha,
-            right_blob_id: sample_blob_id,
-            patch: "@@ -0,0 +1,10000001 @@\n#{large_data}\n",
-            status: :STATUS_END_OF_PATCH,
-            binary: false,
-            over_patch_bytes_limit: false
-          ),
-          diff_blob.new(
-            left_blob_id: sha1_blank_sha,
-            right_blob_id: sample_blob_id,
-            patch: "@@ -0,0 +1,10000001 @@\n#{large_data}\n",
-            status: :STATUS_END_OF_PATCH,
-            binary: false,
-            over_patch_bytes_limit: false
-          ),
-          diff_blob.new(
-            left_blob_id: sha1_blank_sha,
-            right_blob_id: sample_blob_id,
-            patch: "@@ -0,0 +1,10000001 @@\n#{large_data}\n",
-            status: :STATUS_END_OF_PATCH,
-            binary: false,
-            over_patch_bytes_limit: false
-          )
-        ]
-      end
-
-      it "whole secret detection scan operation times out" do
-        scan_timeout_secs = 0.000_001 # 1 micro-sec to intentionally timeout large diff
-
-        expected_response = Gitlab::SecretDetection::Response.new(
-          Gitlab::SecretDetection::Status::SCAN_TIMEOUT,
-          nil,
-          empty_applied_exclusions
-        )
-
-        begin
-          response = scan.secrets_scan(diffs, timeout: scan_timeout_secs)
-
-          expect(response).to eq(expected_response)
-        rescue ArgumentError
-          # When RSpec's main process terminates and attempts to clean up child processes upon completion, it terminates
-          # subprocesses where the scans might be still ongoing. This behavior is not recognized by the
-          # upstream library (parallel), which manages all forked subprocesses it created for running scans. When the
-          # upstream library attempts to close its forked subprocesses which already terminated, it raises an
-          # 'ArgumentError' with the message 'bad signal type NilClass,' resulting in flaky failures in the test
-          # expectations.
-          #
-          # Example: https://gitlab.com/gitlab-org/gitlab/-/jobs/6935051992
-          #
-          puts "skipping the test since the subprocesses forked for SD scanning are terminated by main process"
-        end
-      end
-
-      it "one of the diffs times out while others continue to get scanned" do
-        expected_response = Gitlab::SecretDetection::Response.new(
-          Gitlab::SecretDetection::Status::FOUND_WITH_ERRORS,
-          [
-            Gitlab::SecretDetection::Finding.new(
-              diffs[0].right_blob_id,
-              Gitlab::SecretDetection::Status::FOUND,
-              1,
-              ruleset['rules'][2]['id'],
-              ruleset['rules'][2]['description']
-            ),
-            Gitlab::SecretDetection::Finding.new(
-              diffs[2].right_blob_id,
-              Gitlab::SecretDetection::Status::PAYLOAD_TIMEOUT
-            )
-          ],
-          empty_applied_exclusions
-        )
-
-        expect(scan.secrets_scan(diffs, payload_timeout: each_payload_timeout_secs)).to eq(expected_response)
-      end
-
-      it "all the diffs time out" do
-        # scan status changes to SCAN_TIMEOUT when *all* the diffs time out
-        expected_scan_status = Gitlab::SecretDetection::Status::SCAN_TIMEOUT
-
-        expected_response = Gitlab::SecretDetection::Response.new(
-          expected_scan_status,
-          [
-            Gitlab::SecretDetection::Finding.new(
-              all_large_diffs[0].right_blob_id,
-              Gitlab::SecretDetection::Status::PAYLOAD_TIMEOUT
-            ),
-            Gitlab::SecretDetection::Finding.new(
-              all_large_diffs[1].right_blob_id,
-              Gitlab::SecretDetection::Status::PAYLOAD_TIMEOUT
-            ),
-            Gitlab::SecretDetection::Finding.new(
-              all_large_diffs[2].right_blob_id,
-              Gitlab::SecretDetection::Status::PAYLOAD_TIMEOUT
-            )
-          ],
-          empty_applied_exclusions
-        )
-
-        expect(scan.secrets_scan(all_large_diffs, payload_timeout: each_payload_timeout_secs)).to eq(expected_response)
-      end
-    end
-
-    context 'when using exclusions' do
-      let(:diffs) do
-        [
-          diff_blob.new(
-            left_blob_id: sha1_blank_sha,
-            right_blob_id: sample_blob_id,
-            patch: "@@ -0,0 +1 @@\n+data with no secret\n",
-            status: :STATUS_END_OF_PATCH,
-            binary: false,
-            over_patch_bytes_limit: false
-          ),
-          diff_blob.new(
-            left_blob_id: sha1_blank_sha,
-            right_blob_id: sample_blob_id,
-            patch: "@@ -0,0 +1 @@\n+GR134894145645645645645645645\n", # gitleaks:allow
-            status: :STATUS_END_OF_PATCH,
-            binary: false,
-            over_patch_bytes_limit: false
-          ),
-          diff_blob.new(
-            left_blob_id: sha1_blank_sha,
-            right_blob_id: sample_blob_id,
-            patch: "@@ -0,0 +1 @@\n+GR134894145645645645645645789\n", # gitleaks:allow
-            status: :STATUS_END_OF_PATCH,
-            binary: false,
-            over_patch_bytes_limit: false
-          ),
-          diff_blob.new(
-            left_blob_id: sha1_blank_sha,
-            right_blob_id: sample_blob_id,
-            patch: "@@ -0,0 +1 @@\n+GR134894112312312312312312312\n", # gitleaks:allow
-            status: :STATUS_END_OF_PATCH,
-            binary: false,
-            over_patch_bytes_limit: false
-          ),
-          diff_blob.new(
-            left_blob_id: sha1_blank_sha,
-            right_blob_id: sample_blob_id,
-            patch: "@@ -0,0 +1 @@\n+glpat-12312312312312312312\n", # gitleaks:allow
-            status: :STATUS_END_OF_PATCH,
-            binary: false,
-            over_patch_bytes_limit: false
-          ),
-          diff_blob.new(
-            left_blob_id: sha1_blank_sha,
-            right_blob_id: sample_blob_id,
-            patch: "@@ -0,0 +1,3 @@\n+test data" \
-                   "\n+glptt-1231231231231231231212312312312312312312\n+line contd", # gitleaks:allow
-            status: :STATUS_END_OF_PATCH,
-            binary: false,
-            over_patch_bytes_limit: false
-          )
-        ]
-      end
-
-      context "when excluding secrets based on raw values" do
-        let(:exclusions) do
-          {
-            raw_value: [
-              exclusion.new(value: 'GR134894112312312312312312312'), # gitleaks:allow
-              exclusion.new(value: 'glpat-12312312312312312312') # gitleaks:allow
-            ]
-          }
-        end
-
-        let(:valid_lines) do
-          [
-            diffs[1].patch,
-            diffs[2].patch,
-            *diffs[5].patch.lines
-          ]
-        end
-
-        it "excludes values from being detected" do
-          expected_scan_status = Gitlab::SecretDetection::Status::FOUND
-
-          expected_response = Gitlab::SecretDetection::Response.new(
-            expected_scan_status,
-            [
-              Gitlab::SecretDetection::Finding.new(
-                diffs[1].right_blob_id,
-                expected_scan_status,
-                1,
-                ruleset['rules'][2]['id'],
-                ruleset['rules'][2]['description']
-              ),
-              Gitlab::SecretDetection::Finding.new(
-                diffs[2].right_blob_id,
-                expected_scan_status,
-                1,
-                ruleset['rules'][2]['id'],
-                ruleset['rules'][2]['description']
-              ),
-              Gitlab::SecretDetection::Finding.new(
-                diffs[5].right_blob_id,
-                expected_scan_status,
-                2,
-                ruleset['rules'][1]['id'],
-                ruleset['rules'][1]['description']
-              )
-            ],
-            exclusions[:raw_value]
-          )
-
-          expect(scan.secrets_scan(diffs, exclusions:)).to eq(expected_response)
-        end
-      end
-
-      context "when excluding secrets based on rules from default ruleset" do
-        let(:exclusions) do
-          {
-            rule: [
-              exclusion.new(value: "gitlab_runner_registration_token"),
-              exclusion.new(value: "gitlab_personal_access_token")
-            ]
-          }
-        end
-
-        it 'filters out secrets matching excluded rules from detected findings' do
-          expected_scan_status = Gitlab::SecretDetection::Status::FOUND
-
-          expected_response = Gitlab::SecretDetection::Response.new(
-            expected_scan_status,
-            [
-              Gitlab::SecretDetection::Finding.new(
-                diffs[5].right_blob_id,
-                expected_scan_status,
-                2,
-                ruleset['rules'][1]['id'],
-                ruleset['rules'][1]['description']
-              )
-            ],
-            [
-              exclusion.new(value: "gitlab_runner_registration_token"),
-              exclusion.new(value: "gitlab_runner_registration_token"),
-              exclusion.new(value: "gitlab_runner_registration_token"),
-              exclusion.new(value: "gitlab_personal_access_token")
-            ]
-          )
-
-          expect(scan.secrets_scan(diffs, exclusions:)).to eq(expected_response)
-        end
-      end
-    end
-  end
-end
diff --git a/gems/gitlab-secret_detection/spec/lib/gitlab/secret_detection/scan_spec.rb b/gems/gitlab-secret_detection/spec/lib/gitlab/secret_detection/scan_spec.rb
index d42c193cfc9..ca5527cb8ec 100644
--- a/gems/gitlab-secret_detection/spec/lib/gitlab/secret_detection/scan_spec.rb
+++ b/gems/gitlab-secret_detection/spec/lib/gitlab/secret_detection/scan_spec.rb
@@ -5,8 +5,8 @@ require 'spec_helper'
 RSpec.describe Gitlab::SecretDetection::Scan, feature_category: :secret_detection do
   subject(:scan) { described_class.new }
 
-  def new_blob(id:, data:)
-    Struct.new(:id, :data).new(id, data)
+  def new_payload(id:, data:, offset:)
+    { id:, data:, offset: }
   end
 
   let(:exclusion) do
@@ -70,10 +70,10 @@ RSpec.describe Gitlab::SecretDetection::Scan, feature_category: :secret_detectio
       allow(scan).to receive(:parse_ruleset).and_return(ruleset)
     end
 
-    context 'when the blob does not contain a secret' do
-      let(:blobs) do
+    context 'when the payload does not contain a secret' do
+      let(:payloads) do
         [
-          new_blob(id: 1234, data: "no secrets")
+          new_payload(id: 1234, data: "no secrets", offset: 1)
         ]
       end
 
@@ -84,37 +84,37 @@ RSpec.describe Gitlab::SecretDetection::Scan, feature_category: :secret_detectio
           empty_applied_exclusions
         )
 
-        expect(scan.secrets_scan(blobs)).to eq(expected_response)
+        expect(scan.secrets_scan(payloads)).to eq(expected_response)
       end
 
-      it "attempts to keyword match returning no blobs for further scan" do
+      it "attempts to keyword match returning no payloads for further scan" do
         expect(scan).to receive(:filter_by_keywords)
-          .with(blobs)
+          .with(payloads)
           .and_return([])
 
-        scan.secrets_scan(blobs)
+        scan.secrets_scan(payloads)
       end
 
       it "does not attempt to regex match" do
         expect(scan).not_to receive(:match_rules_bulk)
 
-        scan.secrets_scan(blobs)
+        scan.secrets_scan(payloads)
       end
     end
 
-    context "when multiple blobs contains secrets" do
-      let(:blobs) do
+    context "when multiple payloads contains secrets" do
+      let(:payloads) do
         [
-          new_blob(id: 111, data: "glpat-12312312312312312312"), # gitleaks:allow
-          new_blob(id: 222, data: "\n\nglptt-1231231231231231231212312312312312312312"), # gitleaks:allow
-          new_blob(id: 333, data: "data with no secret"),
-          new_blob(id: 444,
-            data: "GR134894112312312312312312312\nglft-12312312312312312312"), # gitleaks:allow
-          new_blob(id: 555, data: "data with no secret"),
-          new_blob(id: 666, data: "data with no secret"),
-          new_blob(id: 777, data: "\nglptt-1231231231231231231212312312312312312312"), # gitleaks:allow
-          new_blob(id: 888,
-            data: "glpat-12312312312312312312;GR134894112312312312312312312") # gitleaks:allow
+          new_payload(id: 111, data: "glpat-12312312312312312312", offset: 1), # gitleaks:allow
+          new_payload(id: 222, data: "\n\nglptt-1231231231231231231212312312312312312312", offset: 1), # gitleaks:allow
+          new_payload(id: 333, data: "data with no secret", offset: 1),
+          new_payload(id: 444,
+            data: "GR134894112312312312312312312\nglft-12312312312312312312", offset: 1), # gitleaks:allow
+          new_payload(id: 555, data: "data with no secret", offset: 1),
+          new_payload(id: 666, data: "data with no secret", offset: 1),
+          new_payload(id: 777, data: "\nglptt-1231231231231231231212312312312312312312", offset: 1), # gitleaks:allow
+          new_payload(id: 888,
+            data: "glpat-12312312312312312312;GR134894112312312312312312312", offset: 1) # gitleaks:allow
         ]
       end
 
@@ -123,49 +123,49 @@ RSpec.describe Gitlab::SecretDetection::Scan, feature_category: :secret_detectio
           Gitlab::SecretDetection::Status::FOUND,
           [
             Gitlab::SecretDetection::Finding.new(
-              blobs[0].id,
+              payloads[0][:id],
               Gitlab::SecretDetection::Status::FOUND,
               1,
               ruleset['rules'][0]['id'],
               ruleset['rules'][0]['description']
             ),
             Gitlab::SecretDetection::Finding.new(
-              blobs[1].id,
+              payloads[1][:id],
               Gitlab::SecretDetection::Status::FOUND,
               3,
               ruleset['rules'][1]['id'],
               ruleset['rules'][1]['description']
             ),
             Gitlab::SecretDetection::Finding.new(
-              blobs[3].id,
+              payloads[3][:id],
               Gitlab::SecretDetection::Status::FOUND,
               1,
               ruleset['rules'][2]['id'],
               ruleset['rules'][2]['description']
             ),
             Gitlab::SecretDetection::Finding.new(
-              blobs[3].id,
+              payloads[3][:id],
               Gitlab::SecretDetection::Status::FOUND,
               2,
               ruleset['rules'][3]['id'],
               ruleset['rules'][3]['description']
             ),
             Gitlab::SecretDetection::Finding.new(
-              blobs[6].id,
+              payloads[6][:id],
               Gitlab::SecretDetection::Status::FOUND,
               2,
               ruleset['rules'][1]['id'],
               ruleset['rules'][1]['description']
             ),
             Gitlab::SecretDetection::Finding.new(
-              blobs[7].id,
+              payloads[7][:id],
               Gitlab::SecretDetection::Status::FOUND,
               1,
               ruleset['rules'][0]['id'],
               ruleset['rules'][0]['description']
             ),
             Gitlab::SecretDetection::Finding.new(
-              blobs[7].id,
+              payloads[7][:id],
               Gitlab::SecretDetection::Status::FOUND,
               1,
               ruleset['rules'][2]['id'],
@@ -176,18 +176,18 @@ RSpec.describe Gitlab::SecretDetection::Scan, feature_category: :secret_detectio
         )
       end
 
-      it "attempts to keyword match returning only filtered blobs for further scan" do
-        expected = blobs.filter { |b| b.data != "data with no secret" }
+      it "attempts to keyword match returning only filtered payloads for further scan" do
+        expected = payloads.filter { |b| b[:data] != "data with no secret" }
 
         expect(scan).to receive(:filter_by_keywords)
-                          .with(blobs)
+                          .with(payloads)
                           .and_return(expected)
 
-        scan.secrets_scan(blobs)
+        scan.secrets_scan(payloads)
       end
 
       it "matches multiple rules when running in main process" do
-        expect(scan.secrets_scan(blobs, subprocess: false)).to eq(expected_response)
+        expect(scan.secrets_scan(payloads, subprocess: false)).to eq(expected_response)
       end
 
       context "in subprocess" do
@@ -195,27 +195,38 @@ RSpec.describe Gitlab::SecretDetection::Scan, feature_category: :secret_detectio
           10_000
         end
 
-        let(:large_blobs) do
+        let(:large_payloads) do
           dummy_data = "\nrandom data" * dummy_lines
           [
-            new_blob(id: 111, data: "glpat-12312312312312312312#{dummy_data}"), # gitleaks:allow
-            new_blob(id: 222, data: "\n\nglptt-1231231231231231231212312312312312312312#{dummy_data}"), # gitleaks:allow
-            new_blob(id: 333, data: "data with no secret#{dummy_data}"),
-            new_blob(id: 444,
-              data: "GR134894112312312312312312312\nglft-12312312312312312312#{dummy_data}"), # gitleaks:allow
-            new_blob(id: 555, data: "data with no secret#{dummy_data}"),
-            new_blob(id: 666, data: "data with no secret#{dummy_data}"),
-            new_blob(id: 777, data: "#{dummy_data}\nglptt-1231231231231231231212312312312312312312") # gitleaks:allow
+            new_payload(id: 111, data: "glpat-12312312312312312312#{dummy_data}", offset: 1), # gitleaks:allow
+            new_payload(
+              id: 222,
+              data: "\n\nglptt-1231231231231231231212312312312312312312#{dummy_data}", # gitleaks:allow
+              offset: 1
+            ),
+            new_payload(id: 333, data: "data with no secret#{dummy_data}", offset: 1),
+            new_payload(
+              id: 444,
+              data: "GR134894112312312312312312312\nglft-12312312312312312312#{dummy_data}", # gitleaks:allow
+              offset: 1
+            ),
+            new_payload(id: 555, data: "data with no secret#{dummy_data}", offset: 1),
+            new_payload(id: 666, data: "data with no secret#{dummy_data}", offset: 1),
+            new_payload(
+              id: 777,
+              data: "#{dummy_data}\nglptt-1231231231231231231212312312312312312312", # gitleaks:allow
+              offset: 1
+            )
           ]
         end
 
         it "matches multiple rules" do
-          expect(scan.secrets_scan(blobs, subprocess: true)).to eq(expected_response)
+          expect(scan.secrets_scan(payloads, subprocess: true)).to eq(expected_response)
         end
 
         it "allocates less memory than when running in main process" do
-          forked_stats = Benchmark::Malloc.new.run { scan.secrets_scan(large_blobs, subprocess: true) }
-          non_forked_stats = Benchmark::Malloc.new.run { scan.secrets_scan(large_blobs, subprocess: false) }
+          forked_stats = Benchmark::Malloc.new.run { scan.secrets_scan(large_payloads, subprocess: true) }
+          non_forked_stats = Benchmark::Malloc.new.run { scan.secrets_scan(large_payloads, subprocess: false) }
 
           max_processes = Gitlab::SecretDetection::Scan::MAX_PROCS_PER_REQUEST
 
@@ -231,30 +242,30 @@ RSpec.describe Gitlab::SecretDetection::Scan, feature_category: :secret_detectio
     end
 
     context "when configured with time out" do
-      let(:each_blob_timeout_secs) { 0.000_001 } # 1 micro-sec to intentionally timeout large blob
+      let(:each_payload_timeout_secs) { 0.000_001 } # 1 micro-sec to intentionally timeout large payload
 
       let(:large_data) do
         ("large data with a secret glpat-12312312312312312312\n" * 10_000_000).freeze # gitleaks:allow
       end
 
-      let(:blobs) do
+      let(:payloads) do
         [
-          new_blob(id: 111, data: "GR134894112312312312312312312"), # gitleaks:allow
-          new_blob(id: 333, data: "data with no secret"),
-          new_blob(id: 333, data: large_data)
+          new_payload(id: 111, data: "GR134894112312312312312312312", offset: 1), # gitleaks:allow
+          new_payload(id: 333, data: "data with no secret", offset: 1),
+          new_payload(id: 333, data: large_data, offset: 1)
         ]
       end
 
-      let(:all_large_blobs) do
+      let(:all_large_payloads) do
         [
-          new_blob(id: 111, data: large_data),
-          new_blob(id: 222, data: large_data),
-          new_blob(id: 333, data: large_data)
+          new_payload(id: 111, data: large_data, offset: 1),
+          new_payload(id: 222, data: large_data, offset: 1),
+          new_payload(id: 333, data: large_data, offset: 1)
         ]
       end
 
       it "whole secret detection scan operation times out" do
-        scan_timeout_secs = 0.000_001 # 1 micro-sec to intentionally timeout large blob
+        scan_timeout_secs = 0.000_001 # 1 micro-sec to intentionally timeout large payload
 
         expected_response = Gitlab::SecretDetection::Response.new(
           Gitlab::SecretDetection::Status::SCAN_TIMEOUT,
@@ -263,7 +274,7 @@ RSpec.describe Gitlab::SecretDetection::Scan, feature_category: :secret_detectio
         )
 
         begin
-          response = scan.secrets_scan(blobs, timeout: scan_timeout_secs)
+          response = scan.secrets_scan(payloads, timeout: scan_timeout_secs)
           expect(response).to eq(expected_response)
         rescue ArgumentError
           # When RSpec's main process terminates and attempts to clean up child processes upon completion, it terminates
@@ -279,65 +290,68 @@ RSpec.describe Gitlab::SecretDetection::Scan, feature_category: :secret_detectio
         end
       end
 
-      it "one of the blobs times out while others continue to get scanned" do
+      it "one of the payloads times out while others continue to get scanned" do
         expected_response = Gitlab::SecretDetection::Response.new(
           Gitlab::SecretDetection::Status::FOUND_WITH_ERRORS,
           [
             Gitlab::SecretDetection::Finding.new(
-              blobs[0].id,
+              payloads[0][:id],
               Gitlab::SecretDetection::Status::FOUND,
               1,
               ruleset['rules'][2]['id'],
               ruleset['rules'][2]['description']
             ),
             Gitlab::SecretDetection::Finding.new(
-              blobs[2].id,
+              payloads[2][:id],
               Gitlab::SecretDetection::Status::PAYLOAD_TIMEOUT
             )
           ],
           empty_applied_exclusions
         )
 
-        expect(scan.secrets_scan(blobs, blob_timeout: each_blob_timeout_secs)).to eq(expected_response)
+        expect(scan.secrets_scan(payloads, payload_timeout: each_payload_timeout_secs)).to eq(expected_response)
       end
 
-      it "all the blobs time out" do
-        # scan status changes to SCAN_TIMEOUT when *all* the blobs time out
+      it "all the payloads time out" do
+        # scan status changes to SCAN_TIMEOUT when *all* the payloads time out
         expected_scan_status = Gitlab::SecretDetection::Status::SCAN_TIMEOUT
 
         expected_response = Gitlab::SecretDetection::Response.new(
           expected_scan_status,
           [
             Gitlab::SecretDetection::Finding.new(
-              all_large_blobs[0].id,
+              all_large_payloads[0][:id],
               Gitlab::SecretDetection::Status::PAYLOAD_TIMEOUT
             ),
             Gitlab::SecretDetection::Finding.new(
-              all_large_blobs[1].id,
+              all_large_payloads[1][:id],
               Gitlab::SecretDetection::Status::PAYLOAD_TIMEOUT
             ),
             Gitlab::SecretDetection::Finding.new(
-              all_large_blobs[2].id,
+              all_large_payloads[2][:id],
               Gitlab::SecretDetection::Status::PAYLOAD_TIMEOUT
             )
           ],
           empty_applied_exclusions
         )
 
-        expect(scan.secrets_scan(all_large_blobs, blob_timeout: each_blob_timeout_secs)).to eq(expected_response)
+        expect(scan.secrets_scan(all_large_payloads,
+          payload_timeout: each_payload_timeout_secs)).to eq(expected_response)
       end
     end
 
     context "when using exclusions" do
-      let(:blobs) do
+      let(:payloads) do
         [
-          new_blob(id: 111, data: "data with no secret"),
-          new_blob(id: 222, data: "GR134894145645645645645645645"), # gitleaks:allow
-          new_blob(id: 333, data: "GR134894145645645645645645789"), # gitleaks:allow
-          new_blob(id: 444, data: "GR134894112312312312312312312"), # gitleaks:allow
-          new_blob(id: 555, data: "glpat-12312312312312312312"), # gitleaks:allow,
-          new_blob(
-            id: 666, data: "test data\nglptt-1231231231231231231212312312312312312312\nline contd" # gitleaks:allow
+          new_payload(id: 111, data: "data with no secret", offset: 1),
+          new_payload(id: 222, data: "GR134894145645645645645645645", offset: 1), # gitleaks:allow
+          new_payload(id: 333, data: "GR134894145645645645645645789", offset: 1), # gitleaks:allow
+          new_payload(id: 444, data: "GR134894112312312312312312312", offset: 1), # gitleaks:allow
+          new_payload(id: 555, data: "glpat-12312312312312312312", offset: 1), # gitleaks:allow,
+          new_payload(
+            id: 666,
+            data: "test data\nglptt-1231231231231231231212312312312312312312\nline contd", # gitleaks:allow
+            offset: 1
           )
         ]
       end
@@ -354,9 +368,9 @@ RSpec.describe Gitlab::SecretDetection::Scan, feature_category: :secret_detectio
 
         let(:valid_lines) do
           [
-            blobs[1].data,
-            blobs[2].data,
-            *blobs[5].data.lines
+            payloads[1].data,
+            payloads[2].data,
+            *payloads[5].data.lines
           ]
         end
 
@@ -367,21 +381,21 @@ RSpec.describe Gitlab::SecretDetection::Scan, feature_category: :secret_detectio
             expected_scan_status,
             [
               Gitlab::SecretDetection::Finding.new(
-                blobs[1].id,
+                payloads[1][:id],
                 expected_scan_status,
                 1,
                 ruleset['rules'][2]['id'],
                 ruleset['rules'][2]['description']
               ),
               Gitlab::SecretDetection::Finding.new(
-                blobs[2].id,
+                payloads[2][:id],
                 expected_scan_status,
                 1,
                 ruleset['rules'][2]['id'],
                 ruleset['rules'][2]['description']
               ),
               Gitlab::SecretDetection::Finding.new(
-                blobs[5].id,
+                payloads[5][:id],
                 expected_scan_status,
                 2,
                 ruleset['rules'][1]['id'],
@@ -391,7 +405,7 @@ RSpec.describe Gitlab::SecretDetection::Scan, feature_category: :secret_detectio
             exclusions[:raw_value]
           )
 
-          expect(scan.secrets_scan(blobs, exclusions:)).to eq(expected_response)
+          expect(scan.secrets_scan(payloads, exclusions:)).to eq(expected_response)
         end
       end
 
@@ -412,7 +426,7 @@ RSpec.describe Gitlab::SecretDetection::Scan, feature_category: :secret_detectio
             expected_scan_status,
             [
               Gitlab::SecretDetection::Finding.new(
-                blobs[5].id,
+                payloads[5][:id],
                 expected_scan_status,
                 2,
                 ruleset['rules'][1]['id'],
@@ -427,7 +441,7 @@ RSpec.describe Gitlab::SecretDetection::Scan, feature_category: :secret_detectio
             ]
           )
 
-          expect(scan.secrets_scan(blobs, exclusions:)).to eq(expected_response)
+          expect(scan.secrets_scan(payloads, exclusions:)).to eq(expected_response)
         end
       end
     end
diff --git a/lib/authn/agnostic_token_identifier.rb b/lib/authn/agnostic_token_identifier.rb
index 148d974693c..ccb20da2e81 100644
--- a/lib/authn/agnostic_token_identifier.rb
+++ b/lib/authn/agnostic_token_identifier.rb
@@ -9,7 +9,8 @@ module Authn
       ::Authn::Tokens::FeedToken,
       ::Authn::Tokens::PersonalAccessToken,
       ::Authn::Tokens::OauthApplicationSecret,
-      ::Authn::Tokens::ClusterAgentToken
+      ::Authn::Tokens::ClusterAgentToken,
+      ::Authn::Tokens::RunnerAuthenticationToken
     ].freeze
 
     def self.token_for(plaintext, source)
diff --git a/lib/authn/tokens/runner_authentication_token.rb b/lib/authn/tokens/runner_authentication_token.rb
new file mode 100644
index 00000000000..d0422de2308
--- /dev/null
+++ b/lib/authn/tokens/runner_authentication_token.rb
@@ -0,0 +1,28 @@
+# frozen_string_literal:true
+
+module Authn
+  module Tokens
+    class RunnerAuthenticationToken
+      def self.prefix?(plaintext)
+        plaintext.start_with?(Ci::Runner::CREATED_RUNNER_TOKEN_PREFIX)
+      end
+
+      attr_reader :revocable, :source
+
+      def initialize(plaintext, source)
+        @revocable = ::Ci::Runner.find_by_token(plaintext)
+        @source = source
+      end
+
+      def present_with
+        ::API::Entities::Ci::Runner
+      end
+
+      def revoke!(_current_user)
+        raise ::Authn::AgnosticTokenIdentifier::NotFoundError, 'Not Found' if revocable.blank?
+
+        raise ::Authn::AgnosticTokenIdentifier::UnsupportedTokenError, 'Unsupported token type'
+      end
+    end
+  end
+end
diff --git a/lib/gitlab/auth/identity.rb b/lib/gitlab/auth/identity.rb
index 06768df717d..104f8119b13 100644
--- a/lib/gitlab/auth/identity.rb
+++ b/lib/gitlab/auth/identity.rb
@@ -10,6 +10,7 @@ module Gitlab
     class Identity
       COMPOSITE_IDENTITY_USERS_KEY = 'composite_identities'
       COMPOSITE_IDENTITY_KEY_FORMAT = 'user:%s:composite_identity'
+      COMPOSITE_IDENTITY_SIDEKIQ_ARG = 'sqci' # Sidekiq Composite Identity
 
       IdentityError = Class.new(StandardError)
       IdentityLinkMismatchError = Class.new(IdentityError)
@@ -24,6 +25,25 @@ module Gitlab
         end
       end
 
+      def self.sidekiq_restore!(job)
+        ids = Array(job[COMPOSITE_IDENTITY_SIDEKIQ_ARG])
+
+        return if ids.empty?
+        raise IdentityError, 'unexpected number of identities in Sidekiq job' unless ids.size == 2
+
+        ::Gitlab::Auth::Identity
+          .new(::User.find(ids.first))
+          .link!(::User.find(ids.second))
+      end
+
+      def self.currently_linked
+        user = ::Gitlab::SafeRequestStore
+          .store[COMPOSITE_IDENTITY_USERS_KEY]
+          .to_a.first
+
+        yield new(user) if user.present?
+      end
+
       def self.fabricate(user)
         new(user) if user.is_a?(::User)
       end
@@ -36,11 +56,25 @@ module Gitlab
       end
 
       def composite?
-        return false unless Feature.enabled?(:composite_identity, @user)
+        return false unless composite_identity_enabled?
 
         @user.has_composite_identity?
       end
 
+      def sidekiq_link!(job)
+        job[COMPOSITE_IDENTITY_SIDEKIQ_ARG] = [primary_user_id, scoped_user_id]
+      end
+
+      def link!(scope_user)
+        return self unless composite_identity_enabled?
+        return self unless scope_user
+
+        validate_link!(scope_user)
+        store_identity_link!(scope_user)
+
+        self
+      end
+
       def linked?
         @request_store.exist?(store_key)
       end
@@ -57,27 +91,26 @@ module Gitlab
         end
       end
 
-      def link!(scope_user)
-        return unless scope_user
-
-        validate_link!(scope_user)
-        store_identity_link!(scope_user)
-
-        self
+      def primary_user
+        @user
       end
 
       private
 
+      def composite_identity_enabled?
+        Feature.enabled?(:composite_identity, @user)
+      end
+
       def scoped_user_id
         scoped_user.id
       end
 
-      def scoped_user_present?
-        @request_store.exist?(store_key)
+      def primary_user_id
+        @user.id
       end
 
       def validate_link!(scope_user)
-        return unless scoped_user_present? && saved_scoped_user_different_from_new_scope_user?(scope_user)
+        return unless linked? && saved_scoped_user_different_from_new_scope_user?(scope_user)
 
         raise IdentityLinkMismatchError, 'identity link change detected'
       end
diff --git a/lib/gitlab/sidekiq_middleware.rb b/lib/gitlab/sidekiq_middleware.rb
index 9848bb647c2..cebc25d684b 100644
--- a/lib/gitlab/sidekiq_middleware.rb
+++ b/lib/gitlab/sidekiq_middleware.rb
@@ -49,6 +49,7 @@ module Gitlab
         chain.add ::Gitlab::Database::LoadBalancing::SidekiqServerMiddleware
         chain.add ::Gitlab::SidekiqMiddleware::ResourceUsageLimit::Server
         chain.add ::Gitlab::SidekiqMiddleware::SkipJobs if skip_jobs
+        chain.add ::Gitlab::SidekiqMiddleware::Identity::Restore
       end
     end
 
@@ -72,6 +73,7 @@ module Gitlab
         # Size limiter should be placed at the bottom, but before the metrics middleware
         chain.add ::Gitlab::SidekiqMiddleware::SizeLimiter::Client
         chain.add ::Gitlab::SidekiqMiddleware::ClientMetrics
+        chain.add ::Gitlab::SidekiqMiddleware::Identity::Passthrough
       end
     end
   end
diff --git a/lib/gitlab/sidekiq_middleware/identity/passthrough.rb b/lib/gitlab/sidekiq_middleware/identity/passthrough.rb
new file mode 100644
index 00000000000..df3b2eeafda
--- /dev/null
+++ b/lib/gitlab/sidekiq_middleware/identity/passthrough.rb
@@ -0,0 +1,19 @@
+# frozen_string_literal: true
+
+module Gitlab
+  module SidekiqMiddleware
+    module Identity
+      class Passthrough
+        include Sidekiq::ClientMiddleware
+
+        def call(_worker_class, job, _queue, _redis_pool)
+          ::Gitlab::Auth::Identity.currently_linked do |identity|
+            identity.sidekiq_link!(job) if identity.composite?
+          end
+
+          yield
+        end
+      end
+    end
+  end
+end
diff --git a/lib/gitlab/sidekiq_middleware/identity/restore.rb b/lib/gitlab/sidekiq_middleware/identity/restore.rb
new file mode 100644
index 00000000000..88d9c404a65
--- /dev/null
+++ b/lib/gitlab/sidekiq_middleware/identity/restore.rb
@@ -0,0 +1,17 @@
+# frozen_string_literal: true
+
+module Gitlab
+  module SidekiqMiddleware
+    module Identity
+      class Restore
+        include Sidekiq::ServerMiddleware
+
+        def call(_worker, job, _queue)
+          ::Gitlab::Auth::Identity.sidekiq_restore!(job)
+
+          yield
+        end
+      end
+    end
+  end
+end
diff --git a/lib/tasks/gitlab/keep_around.rake b/lib/tasks/gitlab/keep_around.rake
index 419203f7588..05dcc878241 100644
--- a/lib/tasks/gitlab/keep_around.rake
+++ b/lib/tasks/gitlab/keep_around.rake
@@ -27,8 +27,6 @@ namespace :gitlab do
         add_merge_request_shas(project, csv)
         add_merge_request_diff_shas(project, csv)
         add_note_shas(project, csv)
-        add_sent_notification_shas(project, csv)
-        add_todo_shas(project, csv)
 
         logger.info "Keep-around orphan report complete"
       end
@@ -81,19 +79,6 @@ namespace :gitlab do
       end
     end
 
-    def add_sent_notification_shas(_project, _csv)
-      logger.warn "Sent notifications will not be included."
-    end
-
-    def add_todo_shas(project, csv)
-      logger.info "Checking todo shas..."
-      Todo.where(project: project).each_batch(of: 1000) do |b|
-        b.where.not(commit_id: nil).select(:commit_id).each do |todo|
-          add_match(csv, todo.commit_id)
-        end
-      end
-    end
-
     def add_match(csv, sha)
       return if !sha.present? || Gitlab::Git.blank_ref?(sha)
 
diff --git a/locale/gitlab.pot b/locale/gitlab.pot
index 5448786db88..7b46ee6a215 100644
--- a/locale/gitlab.pot
+++ b/locale/gitlab.pot
@@ -6548,6 +6548,9 @@ msgstr ""
 msgid "Analytics|Invalid visualization configuration"
 msgstr ""
 
+msgid "Analytics|Learn more about %{docsLinkStart}AI Impact analytics%{docsLinkEnd} and %{subscriptionLinkStart}GitLab Duo Pro seats usage%{subscriptionLinkEnd}."
+msgstr ""
+
 msgid "Analytics|Line chart"
 msgstr ""
 
@@ -6653,9 +6656,6 @@ msgstr ""
 msgid "Analytics|Visualization was saved successfully"
 msgstr ""
 
-msgid "Analytics|Visualize the relation between AI usage and SDLC trends. Learn more about %{docsLinkStart}AI Impact analytics%{docsLinkEnd} and %{subscriptionLinkStart}GitLab Duo Pro seats usage%{subscriptionLinkEnd}."
-msgstr ""
-
 msgid "Analytics|Would you like to replace your existing selection with a new visualization generated through GitLab Duo?"
 msgstr ""
 
@@ -9831,6 +9831,9 @@ msgstr ""
 msgid "BranchRules|Something went wrong while updating branch rule."
 msgstr ""
 
+msgid "BranchRules|Squash commits: %{setting}"
+msgstr ""
+
 msgid "BranchRules|Status check created"
 msgstr ""
 
@@ -27607,6 +27610,9 @@ msgstr ""
 msgid "I'm sorry, I couldn't respond in time. Please try again."
 msgstr ""
 
+msgid "I'm sorry, but answering this question requires a different Duo subscription. Please contact your administrator."
+msgstr ""
+
 msgid "I'm sorry, you don't have the GitLab Duo subscription required to use Duo Chat. Please contact your administrator."
 msgstr ""
 
diff --git a/package.json b/package.json
index c0e2643266d..0017bf8ca03 100644
--- a/package.json
+++ b/package.json
@@ -75,7 +75,7 @@
     "@gitlab/fonts": "^1.3.0",
     "@gitlab/query-language-rust": "0.1.2",
     "@gitlab/svgs": "3.121.0",
-    "@gitlab/ui": "103.7.1",
+    "@gitlab/ui": "104.0.0",
     "@gitlab/vue-router-vue3": "npm:vue-router@4.1.6",
     "@gitlab/vuex-vue3": "npm:vuex@4.0.0",
     "@gitlab/web-ide": "^0.0.1-dev-20241112063543",
diff --git a/rubocop/cop/migration/prevent_adding_columns.rb b/rubocop/cop/migration/prevent_adding_columns.rb
index b99ee21db14..004e356c6e1 100644
--- a/rubocop/cop/migration/prevent_adding_columns.rb
+++ b/rubocop/cop/migration/prevent_adding_columns.rb
@@ -10,7 +10,7 @@ module RuboCop
         include MigrationHelpers
 
         MSG = <<~MSG
-          `%s` is a large table with several columns, adding more should be avoided unless absolutely necessary.
+          `%s` is over the limit authorized, adding more should be avoided unless absolutely necessary.
           Consider storing the column in a different table or creating a new one.
           The list of large tables is defined in rubocop/rubocop-migrations.yml.
           See https://docs.gitlab.com/ee/development/database/large_tables_limitations.html
@@ -52,11 +52,11 @@ module RuboCop
           return false unless valid_table_node?(table_name)
 
           table_value = table_name.value
-          wide_or_large_table?(table_value)
+          wide_or_over_limit_table?(table_value)
         end
 
-        def wide_or_large_table?(table_value)
-          WIDE_TABLES.include?(table_value) || large_tables.include?(table_value)
+        def wide_or_over_limit_table?(table_value)
+          WIDE_TABLES.include?(table_value) || over_limit_tables.include?(table_value)
         end
 
         def valid_table_node?(table_name)
diff --git a/rubocop/migration_helpers.rb b/rubocop/migration_helpers.rb
index 4344ed91c82..eb4d5491ff6 100644
--- a/rubocop/migration_helpers.rb
+++ b/rubocop/migration_helpers.rb
@@ -28,6 +28,10 @@ module RuboCop
       @high_traffic_tables ||= rubocop_migrations_config.dig('Migration/UpdateLargeTable', 'HighTrafficTables')
     end
 
+    def over_limit_tables
+      @over_limit_table ||= rubocop_migrations_config.dig('Migration/UpdateLargeTable', 'OverLimitTables')
+    end
+
     def large_tables
       @large_tables ||= rubocop_migrations_config.dig('Migration/UpdateLargeTable', 'LargeTables')
     end
diff --git a/rubocop/rubocop-migrations.yml b/rubocop/rubocop-migrations.yml
index 112a01892c3..67e205e02f5 100644
--- a/rubocop/rubocop-migrations.yml
+++ b/rubocop/rubocop-migrations.yml
@@ -1,55 +1,66 @@
 # Make sure to update the docs if this file moves. Docs URL: https://docs.gitlab.com/ee/development/migration_style_guide.html#when-to-use-the-helper-method
 Migration/UpdateLargeTable:
   Enabled: true
-  LargeTables: # all tables classified as large, or over_limit
-    - :approval_merge_request_rules_users
-    - :audit_events
-    - :ci_build_needs
-    - :ci_build_report_results
-    - :ci_build_trace_metadata
-    - :ci_builds
+  OverLimitTables:
     - :ci_builds_metadata
-    - :ci_job_artifacts
-    - :ci_job_variables
-    - :ci_pipeline_messages
-    - :ci_pipeline_variables
+    - :ci_builds_metadata_102
+    - :ci_builds_metadata_101
+    - :ci_builds
     - :ci_pipelines
-    - :ci_pipelines_config
+    - :ci_builds_102
+    - :ci_builds_101
+    - :taggings
+    - :ci_job_artifacts
+    - :ci_build_needs
     - :ci_stages
+    - :ci_pipeline_variables
+    - :ci_build_tags_100
+    - :ci_job_artifacts_102
+    - :ci_build_names_102
+    - :ci_pipeline_variables_102
+    - :ci_build_tags_102
+    - :ci_build_tags_101
+    - :ci_build_report_results
+    - :ci_job_variables
+    - :ci_stages_102
     - :deployments
     - :description_versions
     - :events
     - :issues
     - :merge_request_diff_commits
-    - :merge_request_diff_commits_b5377a7a34
+    - :merge_request_diff_commits_b5377a7a34_1000000001
+    - :merge_request_diff_commits_b5377a7a34_800000001
     - :merge_request_diff_files
-    - :merge_request_diff_files_99208b8fac
+    - :merge_request_diff_files_99208b8fac_1000000001
     - :merge_request_diffs
     - :merge_request_metrics
     - :merge_requests
     - :note_diff_files
     - :notes
     - :oauth_access_tokens
-    - :packages_package_files
-    - :personal_access_tokens
     - :project_authorizations
-    - :projects
     - :push_event_payloads
     - :resource_label_events
-    - :sbom_occurrences
     - :security_findings
-    - :security_scans
     - :sent_notifications
     - :system_note_metadata
-    - :taggings
     - :todos
-    - :vulnerabilities
     - :vulnerability_finding_links
-    - :vulnerability_occurrence_pipelines
     - :vulnerability_occurrences
     - :vulnerability_reads
     - :web_hook_logs
-  HighTrafficTables: &high_traffic_tables # size in GB (>= 10 GB on GitLab.com as of 06/2022) and/or number of records
+  LargeTables:
+    - :ci_job_artifact_states
+    - :ci_pipeline_messages
+    - :approval_merge_request_rules_users
+    - :audit_events
+    - :packages_package_files
+    - :personal_access_tokens
+    - :projects
+    - :sbom_occurrences
+    - :security_scans
+    - :vulnerabilities
+  HighTrafficTables:
     - :alert_management_alerts
     - :approvals
     - :approval_merge_request_rules_users
diff --git a/scripts/trigger-build.rb b/scripts/trigger-build.rb
index e37109630c1..c8553a8271c 100755
--- a/scripts/trigger-build.rb
+++ b/scripts/trigger-build.rb
@@ -29,7 +29,7 @@ module Trigger
   class Base
     # Can be overridden
     STABLE_BRANCH_REGEX = /^[\d-]+-stable(-ee|-jh)?$/
-    def self.access_token
+    def access_token
       ENV['PROJECT_TOKEN_FOR_CI_SCRIPTS_API_USAGE']
     end
 
@@ -71,7 +71,7 @@ module Trigger
     def com_gitlab_client
       @com_gitlab_client ||= Gitlab.client(
         endpoint: endpoint,
-        private_token: self.class.access_token
+        private_token: access_token
       )
     end
 
@@ -246,8 +246,7 @@ module Trigger
   # - https://gitlab.com/gitlab-org/omnibus-gitlab/-/blob/b44483f05c5e22628ba3b49ec4c7f8761c688af0/gitlab-ci-config/gitlab-com.yml#L199-224
   # - https://gitlab.com/gitlab-org/omnibus-gitlab/-/blob/b44483f05c5e22628ba3b49ec4c7f8761c688af0/gitlab-ci-config/gitlab-com.yml#L356-380
   class Docs < Base
-    def self.access_token
-      # Default to "DOCS_PROJECT_API_TOKEN" at https://gitlab.com/gitlab-org/gitlab-docs/-/settings/access_tokens
+    def access_token
       ENV['DOCS_PROJECT_API_TOKEN'] || super
     end
 
@@ -345,6 +344,36 @@ module Trigger
     end
   end
 
+  class DocsHugo < Docs
+    def access_token
+      ENV['DOCS_HUGO_PROJECT_API_TOKEN'] || super
+    end
+
+    private
+
+    def downstream_environment
+      "upstream-review/mr-${CI_MERGE_REQUEST_IID}"
+    end
+
+    def review_slug
+      identifier = ENV['CI_MERGE_REQUEST_IID'] || ENV['CI_COMMIT_REF_SLUG']
+
+      "#{project_slug}-#{identifier}"
+    end
+
+    def downstream_project_path
+      ENV.fetch('DOCS_PROJECT_PATH', 'gitlab-org/technical-writing-group/gitlab-docs-hugo')
+    end
+
+    def trigger_token
+      ENV['DOCS_HUGO_TRIGGER_TOKEN']
+    end
+
+    def app_url
+      "https://new.docs.gitlab.com/upstream-review-mr-#{review_slug}/"
+    end
+  end
+
   class DatabaseTesting < Base
     IDENTIFIABLE_NOTE_TAG = 'gitlab-org/database-team/gitlab-com-database-testing:identifiable-note'
 
@@ -471,8 +500,8 @@ if $PROGRAM_NAME == __FILE__
   case ARGV[0]
   when 'gitlab-com-database-testing'
     Trigger::DatabaseTesting.new.invoke!
-  when 'docs'
-    docs_trigger = Trigger::Docs.new
+  when 'docs-hugo', 'docs'
+    docs_trigger = (ARGV[0] == 'docs-hugo' ? Trigger::DocsHugo : Trigger::Docs).new
 
     case ARGV[1]
     when 'deploy'
@@ -485,7 +514,9 @@ if $PROGRAM_NAME == __FILE__
     end
   else
     puts "Please provide a valid option:
-    omnibus - Triggers a pipeline that builds the omnibus-gitlab package
+    docs - Triggers a pipline that builds a documentation review app by using the gitlab-docs project
+    docs-hugo - Triggers a pipline that builds a documentation review app by using the gitlab-docs-hugo project
+    omnibus - Triggers a pipelines that builds the omnibus-gitlab package
     gitlab-com-database-testing - Triggers a pipeline that tests database changes on GitLab.com data"
   end
 end
diff --git a/spec/finders/projects/ml/experiment_finder_spec.rb b/spec/finders/projects/ml/experiment_finder_spec.rb
index 548ab0232ef..0c36296f4e2 100644
--- a/spec/finders/projects/ml/experiment_finder_spec.rb
+++ b/spec/finders/projects/ml/experiment_finder_spec.rb
@@ -11,8 +11,9 @@ RSpec.describe Projects::Ml::ExperimentFinder, feature_category: :mlops do
   end
 
   let_it_be(:model_experiment) { create(:ml_models, project: project) }
+  let_it_be(:experiment4) { model_experiment.default_experiment }
   let_it_be(:other_experiment) { create(:ml_experiments) }
-  let_it_be(:project_experiments) { [experiment1, experiment2, experiment3] }
+  let_it_be(:project_experiments) { [experiment1, experiment2, experiment3, experiment4] }
 
   let(:params) { {} }
 
@@ -20,7 +21,7 @@ RSpec.describe Projects::Ml::ExperimentFinder, feature_category: :mlops do
 
   describe 'default params' do
     it 'returns models for project ordered by id, descending' do
-      is_expected.to eq([experiment3, experiment2, experiment1])
+      is_expected.to eq([experiment4, experiment3, experiment2, experiment1])
     end
 
     it 'including the latest version and project', :aggregate_failures do
@@ -56,17 +57,20 @@ RSpec.describe Projects::Ml::ExperimentFinder, feature_category: :mlops do
     using RSpec::Parameterized::TableSyntax
 
     where(:test_case, :order_by, :direction, :expected_order) do
-      'default params'     | nil       | nil    | [2, 1, 0]
-      'ascending order'    | 'id'      | 'ASC'  | [0, 1, 2]
-      'by column'          | 'name'    | 'ASC'  | [0, 2, 1]
-      'invalid sort'       | nil       | 'UP'   | [2, 1, 0]
-      'invalid order by'   | 'INVALID' | nil    | [2, 1, 0]
-      'order by updated_at' | 'updated_at' | nil | [1, 0, 2]
+      'default params'      | nil          | nil    | [3, 2, 1, 0]
+      'ascending order'     | 'id'         | 'ASC'  | [0, 1, 2, 3]
+      'descending order'    | 'id'         | 'DSC'  | [3, 2, 1, 0]
+      'invalid sort'        | nil          | 'UP'   | [3, 2, 1, 0]
+      'invalid order by'    | 'INVALID'    | nil    | [3, 2, 1, 0]
+      'order by updated_at' | 'updated_at' | nil    | [3, 1, 0, 2]
     end
     with_them do
       let(:params) { { order_by: order_by, sort: direction } }
 
-      it { is_expected.to eq(project_experiments.values_at(*expected_order)) }
+      it 'sort correctly' do
+        actual_order = project_experiments.values_at(*expected_order)
+        expect(experiments).to eq(actual_order)
+      end
     end
   end
 end
diff --git a/spec/frontend/custom_emoji/components/__snapshots__/list_spec.js.snap b/spec/frontend/custom_emoji/components/__snapshots__/list_spec.js.snap
index b241890ddff..798a7eed5e2 100644
--- a/spec/frontend/custom_emoji/components/__snapshots__/list_spec.js.snap
+++ b/spec/frontend/custom_emoji/components/__snapshots__/list_spec.js.snap
@@ -15,7 +15,7 @@ exports[`Custom emoji settings list component renders table of custom emoji 1`]
           data-testid="actions-tabs-start"
         >
           <a
-            class="btn btn-info btn-md gl-button"
+            class="btn btn-confirm btn-md gl-button"
             data-testid="action-primary"
             href="/new"
             to="/new"
@@ -32,7 +32,7 @@ exports[`Custom emoji settings list component renders table of custom emoji 1`]
           data-testid="actions-tabs-end"
         >
           <a
-            class="btn btn-info btn-md gl-button"
+            class="btn btn-confirm btn-md gl-button"
             data-testid="action-primary"
             href="/new"
             to="/new"
diff --git a/spec/frontend/projects/settings/repository/branch_rules/components/branch_rule_spec.js b/spec/frontend/projects/settings/repository/branch_rules/components/branch_rule_spec.js
index 150366600ad..7be313208a7 100644
--- a/spec/frontend/projects/settings/repository/branch_rules/components/branch_rule_spec.js
+++ b/spec/frontend/projects/settings/repository/branch_rules/components/branch_rule_spec.js
@@ -10,9 +10,12 @@ import {
 describe('Branch rule', () => {
   let wrapper;
 
-  const createComponent = (props = {}) => {
+  const createComponent = (props = {}, features = { branchRuleSquashSettings: false }) => {
     wrapper = shallowMountExtended(BranchRule, {
-      provide: branchRuleProvideMock,
+      provide: {
+        ...branchRuleProvideMock,
+        glFeatures: features,
+      },
       stubs: {
         ProtectedBadge,
       },
@@ -74,4 +77,16 @@ describe('Branch rule', () => {
       `${branchRuleProvideMock.branchRulesPath}?branch=${encodedBranchName}`,
     );
   });
+
+  describe('squash settings', () => {
+    it('renders squash settings when branchRuleSquashSettings is true', () => {
+      const branchRuleProps = {
+        ...branchRulePropsMock,
+        branchProtection: { squashSetting: 'Mock setting' },
+      };
+
+      createComponent(branchRuleProps, { branchRuleSquashSettings: true });
+      expect(findProtectionDetailsListItems().at(0).text()).toBe('Squash commits: Mock setting');
+    });
+  });
 });
diff --git a/spec/frontend/vue_shared/components/customizable_dashboard/customizable_dashboard_spec.js b/spec/frontend/vue_shared/components/customizable_dashboard/customizable_dashboard_spec.js
index 584beb10027..8581ba39e3b 100644
--- a/spec/frontend/vue_shared/components/customizable_dashboard/customizable_dashboard_spec.js
+++ b/spec/frontend/vue_shared/components/customizable_dashboard/customizable_dashboard_spec.js
@@ -23,6 +23,7 @@ import {
 } from '~/vue_shared/components/customizable_dashboard/constants';
 import { confirmAction } from '~/lib/utils/confirm_via_gl_modal/confirm_via_gl_modal';
 import { stubComponent } from 'helpers/stub_component';
+import { trimText } from 'helpers/text_helper';
 import {
   dashboard,
   builtinDashboard,
@@ -61,16 +62,13 @@ describe('CustomizableDashboard', () => {
   };
 
   const panelSlotSpy = jest.fn();
-  const scopedSlots = {
+  const defaultSlots = {
     panel: panelSlotSpy,
   };
 
   const createWrapper = (
     props = {},
-    loadedDashboard = dashboard,
-    provide = {},
-    routeParams = {},
-    // eslint-disable-next-line max-params
+    { loadedDashboard = dashboard, provide = {}, routeParams = {}, scopedSlots = {} } = {},
   ) => {
     const loadDashboard = { ...loadedDashboard };
 
@@ -104,7 +102,10 @@ describe('CustomizableDashboard', () => {
           params: routeParams,
         },
       },
-      scopedSlots,
+      scopedSlots: {
+        ...defaultSlots,
+        ...scopedSlots,
+      },
       provide: {
         dashboardEmptyStateIllustrationPath: TEST_EMPTY_DASHBOARD_SVG_PATH,
         ...provide,
@@ -183,7 +184,7 @@ describe('CustomizableDashboard', () => {
 
   describe('default behaviour', () => {
     beforeEach(() => {
-      createWrapper({}, dashboard);
+      createWrapper();
     });
 
     it('shows the gridstack wrapper', () => {
@@ -236,7 +237,7 @@ describe('CustomizableDashboard', () => {
 
   describe('when a dashboard has no description', () => {
     beforeEach(() => {
-      createWrapper({}, { ...dashboard, description: undefined });
+      createWrapper({}, { loadedDashboard: { ...dashboard, description: undefined } });
     });
 
     it('does not show the dashboard description', () => {
@@ -244,50 +245,28 @@ describe('CustomizableDashboard', () => {
     });
   });
 
-  describe('when the slug is "value_stream_dashboard"', () => {
+  describe('when a dashboard has an after-description slot', () => {
     beforeEach(() => {
-      createWrapper({}, { ...builtinDashboard, slug: 'value_streams_dashboard' });
-    });
-
-    it('shows a "Learn more" link to the VSD user docs', () => {
-      const link = findDashboardDescription().findComponent(GlLink);
-
-      expect(link.text()).toBe('Learn more');
-      expect(link.attributes('href')).toBe('/help/user/analytics/value_streams_dashboard');
-    });
-  });
-
-  describe('when the slug is "ai_impact"', () => {
-    beforeEach(() => {
-      createWrapper({}, { ...builtinDashboard, slug: 'ai_impact' });
-    });
-
-    it('shows an alternative dashboard description', () => {
-      expect(findDashboardDescription().text()).toBe(
-        'Visualize the relation between AI usage and SDLC trends. Learn more about AI Impact analytics and GitLab Duo Pro seats usage.',
+      createWrapper(
+        {},
+        {
+          scopedSlots: {
+            'after-description': `<p>After description</p>`,
+          },
+        },
       );
     });
 
-    it('shows a link to the docs page', () => {
-      const link = findDashboardDescription().findAllComponents(GlLink).at(0);
-
-      expect(link.text()).toBe('AI Impact analytics');
-      expect(link.attributes('href')).toBe('/help/user/analytics/ai_impact_analytics');
-    });
-
-    it('shows a link to the Duo Pro subscription add-ons page', () => {
-      const link = findDashboardDescription().findAllComponents(GlLink).at(1);
-
-      expect(link.text()).toBe('GitLab Duo Pro seats usage');
-      expect(link.attributes('href')).toBe(
-        '/help/subscriptions/subscription-add-ons#assign-gitlab-duo-seats',
+    it('does render after-description slot after the description', () => {
+      expect(trimText(findDashboardDescription().text())).toEqual(
+        'This is a dashboard After description',
       );
     });
   });
 
   describe('when a dashboard is custom', () => {
     beforeEach(() => {
-      createWrapper({}, dashboard);
+      createWrapper();
     });
 
     it('shows the "edit" button', () => {
@@ -297,7 +276,7 @@ describe('CustomizableDashboard', () => {
 
   describe('when a dashboard is built-in', () => {
     beforeEach(() => {
-      createWrapper({}, builtinDashboard);
+      createWrapper({}, { loadedDashboard: builtinDashboard });
     });
 
     it('does not show the "edit" button', () => {
@@ -309,20 +288,20 @@ describe('CustomizableDashboard', () => {
     const customVsd = { ...dashboard, slug: CUSTOM_VALUE_STREAM_DASHBOARD };
 
     it('does not show the "edit" button when `enable_vsd_visual_editor` is disabled', () => {
-      createWrapper({}, customVsd);
+      createWrapper({}, { loadedDashboard: customVsd });
       expect(findEditButton().exists()).toBe(false);
     });
 
     it('shows the "edit" button when `enable_vsd_visual_editor` is enabled', () => {
       const provide = { glFeatures: { enableVsdVisualEditor: true } };
-      createWrapper({}, customVsd, provide);
+      createWrapper({}, { loadedDashboard: customVsd, provide });
       expect(findEditButton().exists()).toBe(true);
     });
   });
 
   describe('when a dashboard is in beta', () => {
     beforeEach(() => {
-      createWrapper({}, betaDashboard);
+      createWrapper({}, { loadedDashboard: betaDashboard });
     });
 
     it('renders the `Beta` badge', () => {
@@ -332,7 +311,7 @@ describe('CustomizableDashboard', () => {
 
   describe('when mounted with the $route.editing param', () => {
     beforeEach(() => {
-      createWrapper({}, dashboard, {}, { editing: true });
+      createWrapper({}, { routeParams: { editing: true } });
     });
 
     it('render the visualization drawer in edit mode', () => {
@@ -348,7 +327,7 @@ describe('CustomizableDashboard', () => {
       beforeUnloadEvent = new Event('beforeunload');
       windowDialogSpy = jest.spyOn(beforeUnloadEvent, 'returnValue', 'set');
 
-      createWrapper({}, dashboard);
+      createWrapper();
 
       await waitForPromises();
 
@@ -719,7 +698,7 @@ describe('CustomizableDashboard', () => {
         {
           isNewDashboard: true,
         },
-        newDashboard,
+        { loadedDashboard: newDashboard },
       );
     });
 
@@ -931,7 +910,7 @@ describe('CustomizableDashboard', () => {
 
   describe('when saving while editing and the editor is enabled', () => {
     beforeEach(() => {
-      createWrapper({ isSaving: true }, dashboard);
+      createWrapper({ isSaving: true });
 
       findEditButton().vm.$emit('click');
     });
@@ -951,7 +930,7 @@ describe('CustomizableDashboard', () => {
     `(
       'when editing="$editing" and changesSaved="$changesSaved" the new editing state is "$newState',
       async ({ editing, changesSaved, newState }) => {
-        createWrapper({ changesSaved, isNewDashboard: editing }, dashboard);
+        createWrapper({ changesSaved, isNewDashboard: editing });
 
         await nextTick();
 
@@ -967,7 +946,7 @@ describe('CustomizableDashboard', () => {
     };
 
     beforeEach(() => {
-      createWrapper({}, dashboardWithoutPanels);
+      createWrapper({}, { loadedDashboard: dashboardWithoutPanels });
 
       return findEditButton().vm.$emit('click');
     });
@@ -1005,7 +984,7 @@ describe('CustomizableDashboard', () => {
       'when isSaving=$isSaving and changesMade=$changesMade',
       ({ isSaving, changesMade, expected }) => {
         beforeEach(async () => {
-          createWrapper({ isSaving }, dashboard);
+          createWrapper({ isSaving });
 
           await findEditButton().vm.$emit('click');
 
diff --git a/spec/frontend/work_items/components/create_work_item_modal_spec.js b/spec/frontend/work_items/components/create_work_item_modal_spec.js
index 7553711e7da..33265c8a855 100644
--- a/spec/frontend/work_items/components/create_work_item_modal_spec.js
+++ b/spec/frontend/work_items/components/create_work_item_modal_spec.js
@@ -59,6 +59,7 @@ describe('CreateWorkItemModal', () => {
     hideButton = false,
     workItemTypeName = 'EPIC',
     namespaceWorkItemTypesQueryHandler = workItemTypesQueryHandler,
+    relatedItem = null,
   } = {}) => {
     apolloProvider = createMockApollo([
       [namespaceWorkItemTypesQuery, namespaceWorkItemTypesQueryHandler],
@@ -69,6 +70,7 @@ describe('CreateWorkItemModal', () => {
         workItemTypeName,
         asDropdownItem,
         hideButton,
+        relatedItem,
       },
       apolloProvider,
       provide: {
@@ -211,4 +213,20 @@ describe('CreateWorkItemModal', () => {
 
     expect(setNewWorkItemCache).toHaveBeenCalled();
   });
+
+  describe('when there is a related item', () => {
+    beforeEach(async () => {
+      createComponent({
+        relatedItem: { id: 'gid://gitlab/WorkItem/843', type: 'Epic', reference: 'flightjs#53' },
+      });
+      await waitForPromises();
+      await nextTick();
+    });
+
+    it('appends the related item id to the full page button href', () => {
+      expect(findOpenInFullPageButton().attributes('href')).toBe(
+        '/full-path/-/epics/new?related_item_id=gid://gitlab/WorkItem/843',
+      );
+    });
+  });
 });
diff --git a/spec/frontend/work_items/components/work_item_actions_spec.js b/spec/frontend/work_items/components/work_item_actions_spec.js
index 44f72cdcec0..1f76ff63233 100644
--- a/spec/frontend/work_items/components/work_item_actions_spec.js
+++ b/spec/frontend/work_items/components/work_item_actions_spec.js
@@ -141,6 +141,7 @@ describe('WorkItemActions component', () => {
         fullPath: 'gitlab-org/gitlab-test',
         workItemId: 'gid://gitlab/WorkItem/1',
         workItemIid: '1',
+        isGroup: false,
         canUpdate,
         canDelete,
         isConfidential,
diff --git a/spec/frontend/work_items/components/work_item_sticky_header_spec.js b/spec/frontend/work_items/components/work_item_sticky_header_spec.js
index 19af66ac1f7..778de9cfade 100644
--- a/spec/frontend/work_items/components/work_item_sticky_header_spec.js
+++ b/spec/frontend/work_items/components/work_item_sticky_header_spec.js
@@ -33,6 +33,7 @@ describe('WorkItemStickyHeader', () => {
         isModal: false,
         currentUserTodos: [],
         workItemState: STATE_OPEN,
+        isGroup: false,
       },
       provide: {
         glFeatures: {
diff --git a/spec/frontend/work_items/pages/create_work_item_spec.js b/spec/frontend/work_items/pages/create_work_item_spec.js
index cceffb71ddd..70cee312abb 100644
--- a/spec/frontend/work_items/pages/create_work_item_spec.js
+++ b/spec/frontend/work_items/pages/create_work_item_spec.js
@@ -1,18 +1,49 @@
+import Vue from 'vue';
+import VueApollo from 'vue-apollo';
 import { shallowMount } from '@vue/test-utils';
 import CreateWorkItemPage from '~/work_items/pages/create_work_item.vue';
 import CreateWorkItem from '~/work_items/components/create_work_item.vue';
-import { visitUrl } from '~/lib/utils/url_utility';
+import workItemRelatedItemQuery from '~/work_items/graphql/work_item_related_item.query.graphql';
+import { visitUrl, updateHistory, removeParams } from '~/lib/utils/url_utility';
+import waitForPromises from 'helpers/wait_for_promises';
+import createMockApollo from 'helpers/mock_apollo_helper';
+import setWindowLocation from 'helpers/set_window_location_helper';
 
-jest.mock('~/lib/utils/url_utility');
+Vue.use(VueApollo);
+
+jest.mock('~/lib/utils/url_utility', () => ({
+  getParameterByName: jest.requireActual('~/lib/utils/url_utility').getParameterByName,
+  joinPaths: jest.requireActual('~/lib/utils/url_utility').joinPaths,
+  setUrlFragment: jest.requireActual('~/lib/utils/url_utility').setUrlFragment,
+  visitUrl: jest.fn(),
+  updateHistory: jest.fn(),
+  removeParams: jest.fn(),
+}));
+
+const mockRelatedItem = {
+  data: {
+    workItem: {
+      id: 'gid://gitlab/WorkItem/234',
+      reference: 'gitlab#100',
+      workItemType: {
+        id: 'gid://gitlab/WorkitemType/1',
+        name: 'Epic',
+      },
+    },
+  },
+};
 
 describe('Create work item page component', () => {
   let wrapper;
 
+  const relatedItemQueryHandler = jest.fn().mockResolvedValue(mockRelatedItem);
+
   const createComponent = ($router = undefined, isGroup = true) => {
     wrapper = shallowMount(CreateWorkItemPage, {
       propsData: {
         workItemTypeName: 'issue',
       },
+      apolloProvider: createMockApollo([[workItemRelatedItemQuery, relatedItemQueryHandler]]),
       mocks: {
         $router,
       },
@@ -53,4 +84,41 @@ describe('Create work item page component', () => {
 
     expect(pushMock).toHaveBeenCalledWith({ name: 'workItem', params: { iid: '1234' } });
   });
+
+  describe('when the related_item_id url query param is present', () => {
+    describe('when successful', () => {
+      beforeEach(async () => {
+        setWindowLocation('?related_item_id=gid://gitlab/WorkItem/234');
+        createComponent();
+        await waitForPromises();
+      });
+
+      it('queries for the releated item', () => {
+        expect(relatedItemQueryHandler).toHaveBeenCalledWith({ id: 'gid://gitlab/WorkItem/234' });
+      });
+
+      it('passes the relatedItem to the CreateWorkItem component', () => {
+        const { id, reference, workItemType } = mockRelatedItem.data.workItem;
+        expect(findCreateWorkItem().props('relatedItem')).toEqual({
+          id,
+          reference,
+          type: workItemType.name,
+        });
+      });
+    });
+
+    describe('when unsuccessful', () => {
+      beforeEach(async () => {
+        setWindowLocation('?related_item_id=gid://gitlab/WorkItem/234');
+        relatedItemQueryHandler.mockRejectedValue('not found');
+        createComponent();
+        await waitForPromises();
+      });
+
+      it('removes the related_item_id parameter if there is a problem fetching the extra details', () => {
+        expect(removeParams).toHaveBeenCalledWith(['related_item_id']);
+        expect(updateHistory).toHaveBeenCalled();
+      });
+    });
+  });
 });
diff --git a/spec/frontend/work_items/utils_spec.js b/spec/frontend/work_items/utils_spec.js
index 076d0982a86..24306c33e56 100644
--- a/spec/frontend/work_items/utils_spec.js
+++ b/spec/frontend/work_items/utils_spec.js
@@ -147,6 +147,12 @@ describe('newWorkItemPath', () => {
       }),
     ).toBe('/foobar/groups/group/-/epics/new');
   });
+
+  it('appends a query string to the path', () => {
+    expect(newWorkItemPath({ fullPath: 'project', query: '?foo=bar' })).toBe(
+      '/foobar/project/-/work_items/new?foo=bar',
+    );
+  });
 });
 
 describe('getWorkItemIcon', () => {
diff --git a/spec/lib/authn/agnostic_token_identifier_spec.rb b/spec/lib/authn/agnostic_token_identifier_spec.rb
index 424cc75729d..89b0d80ce7a 100644
--- a/spec/lib/authn/agnostic_token_identifier_spec.rb
+++ b/spec/lib/authn/agnostic_token_identifier_spec.rb
@@ -11,6 +11,7 @@ RSpec.describe Authn::AgnosticTokenIdentifier, feature_category: :system_access
   let_it_be(:personal_access_token) { create(:personal_access_token, user: user).token }
   let_it_be(:oauth_application_secret) { create(:oauth_application).plaintext_secret }
   let_it_be(:cluster_agent_token) { create(:cluster_agent_token, token_encrypted: nil).token }
+  let_it_be(:runner_authentication_token) { create(:ci_runner, registration_type: :authenticated_user).token }
 
   subject(:token) { described_class.token_for(plaintext, :group_token_revocation_service) }
 
@@ -21,6 +22,7 @@ RSpec.describe Authn::AgnosticTokenIdentifier, feature_category: :system_access
       ref(:deploy_token) | ::Authn::Tokens::DeployToken
       ref(:oauth_application_secret) | ::Authn::Tokens::OauthApplicationSecret
       ref(:cluster_agent_token) | ::Authn::Tokens::ClusterAgentToken
+      ref(:runner_authentication_token) | ::Authn::Tokens::RunnerAuthenticationToken
       'unsupported' | NilClass
     end
 
diff --git a/spec/lib/authn/tokens/runner_authentication_token_spec.rb b/spec/lib/authn/tokens/runner_authentication_token_spec.rb
new file mode 100644
index 00000000000..23055467613
--- /dev/null
+++ b/spec/lib/authn/tokens/runner_authentication_token_spec.rb
@@ -0,0 +1,28 @@
+# frozen_string_literal: true
+
+require 'spec_helper'
+
+RSpec.describe Authn::Tokens::RunnerAuthenticationToken, feature_category: :system_access do
+  let_it_be(:user) { create(:user) }
+
+  let(:runner) { create(:ci_runner, registration_type: :authenticated_user) }
+
+  subject(:token) { described_class.new(plaintext, :api_admin_token) }
+
+  context 'with valid runner authentication token' do
+    let(:plaintext) { runner.token }
+    let(:valid_revocable) { runner }
+
+    it_behaves_like 'finding the valid revocable'
+
+    describe '#revoke!' do
+      it 'does not support revocation yet' do
+        expect do
+          token.revoke!(user)
+        end.to raise_error(::Authn::AgnosticTokenIdentifier::UnsupportedTokenError, 'Unsupported token type')
+      end
+    end
+  end
+
+  it_behaves_like 'token handling with unsupported token type'
+end
diff --git a/spec/lib/gitlab/auth/identity_spec.rb b/spec/lib/gitlab/auth/identity_spec.rb
index cabe0807251..ad11f802a51 100644
--- a/spec/lib/gitlab/auth/identity_spec.rb
+++ b/spec/lib/gitlab/auth/identity_spec.rb
@@ -3,17 +3,18 @@
 require 'spec_helper'
 
 RSpec.describe Gitlab::Auth::Identity, :request_store, feature_category: :system_access do
+  let_it_be(:primary_user) { create(:user) }
+  let_it_be(:scoped_user) { create(:user) }
+
   describe '.link_from_oauth_token' do
-    let_it_be(:actor_user) { create(:user) }
-    let_it_be(:delegating_user) { create(:user) }
-    let_it_be(:token_scopes) { [:api, :"user:#{delegating_user.id}"] }
-    let_it_be(:oauth_access_token) { create(:oauth_access_token, user: actor_user, scopes: token_scopes) }
+    let_it_be(:token_scopes) { [:api, :"user:#{scoped_user.id}"] }
+    let_it_be(:oauth_access_token) { create(:oauth_access_token, user: primary_user, scopes: token_scopes) }
 
     subject(:identity) { described_class.link_from_oauth_token(oauth_access_token) }
 
     context 'when composite identity is required for the actor' do
       before do
-        allow(actor_user).to receive(:has_composite_identity?).and_return(true)
+        allow(primary_user).to receive(:has_composite_identity?).and_return(true)
       end
 
       it 'returns an identity' do
@@ -21,11 +22,11 @@ RSpec.describe Gitlab::Auth::Identity, :request_store, feature_category: :system
         expect(identity).to be_linked
         expect(identity).to be_valid
 
-        expect(identity.scoped_user).to eq(delegating_user)
+        expect(identity.scoped_user).to eq(scoped_user)
       end
 
       context 'when oauth token does not have required scopes' do
-        let(:oauth_access_token) { create(:oauth_access_token, user: actor_user, scopes: [:api]) }
+        let(:oauth_access_token) { create(:oauth_access_token, user: primary_user, scopes: [:api]) }
 
         it 'fabricates a composite identity which is not valid' do
           expect(identity).to be_composite
@@ -37,7 +38,9 @@ RSpec.describe Gitlab::Auth::Identity, :request_store, feature_category: :system
       context 'when an identity link was already done for a different composite user' do
         let_it_be(:different_user) { create(:user) }
         let_it_be(:new_token_scopes) { [:api, :"user:#{different_user.id}"] }
-        let_it_be(:new_oauth_access_token) { create(:oauth_access_token, user: actor_user, scopes: new_token_scopes) }
+        let_it_be(:new_oauth_access_token) do
+          create(:oauth_access_token, user: primary_user, scopes: new_token_scopes)
+        end
 
         it 'raises an error' do
           expect(identity).to be_valid
@@ -49,7 +52,7 @@ RSpec.describe Gitlab::Auth::Identity, :request_store, feature_category: :system
 
       context 'when actor user does not have composite identity enforced' do
         before do
-          allow(actor_user).to receive(:has_composite_identity?).and_return(false)
+          allow(primary_user).to receive(:has_composite_identity?).and_return(false)
         end
 
         context 'when token has composite user scope' do
@@ -61,7 +64,9 @@ RSpec.describe Gitlab::Auth::Identity, :request_store, feature_category: :system
 
         context 'when token does not have composite user scope' do
           let_it_be(:token_scopes) { [:api] }
-          let_it_be(:oauth_access_token) { create(:oauth_access_token, user: actor_user, scopes: token_scopes) }
+          let_it_be(:oauth_access_token) do
+            create(:oauth_access_token, user: primary_user, scopes: token_scopes)
+          end
 
           it 'returns an identity' do
             expect(identity).not_to be_composite
@@ -80,9 +85,7 @@ RSpec.describe Gitlab::Auth::Identity, :request_store, feature_category: :system
   end
 
   describe '.fabricate' do
-    let_it_be(:user) { create(:user) }
-
-    subject(:identity) { described_class.fabricate(user) }
+    subject(:identity) { described_class.fabricate(primary_user) }
 
     it 'returns a valid identity without a scoped user' do
       expect(identity).to be_valid
@@ -91,4 +94,44 @@ RSpec.describe Gitlab::Auth::Identity, :request_store, feature_category: :system
         .to raise_error(::Gitlab::Auth::Identity::MissingCompositeIdentityError)
     end
   end
+
+  describe '.sidekiq_restore!' do
+    context 'when job has primary and scoped identity stored' do
+      let(:job) { { 'jid' => 123, 'sqci' => [primary_user.id, scoped_user.id] } }
+
+      it 'finds and links primary user with scoped user' do
+        identity = described_class.sidekiq_restore!(job)
+
+        expect(identity).to be_linked
+        expect(identity.primary_user).to eq(primary_user)
+        expect(identity.scoped_user).to eq(scoped_user)
+      end
+    end
+
+    context 'when linked identity in job is an unexpected value' do
+      let(:job) { { 'jid' => 123, 'sqci' => [primary_user.id] } }
+
+      it 'finds and links primary user with scoped user' do
+        expect { described_class.sidekiq_restore!(job) }
+          .to raise_error(described_class::IdentityError)
+      end
+    end
+  end
+
+  describe '#sidekiq_link!' do
+    let(:job) { { 'jid' => 123 } }
+
+    subject(:identity) { described_class.new(primary_user) }
+
+    before do
+      identity.link!(scoped_user)
+    end
+
+    it 'sets a job attribute' do
+      described_class.new(primary_user).sidekiq_link!(job)
+
+      expect(job[described_class::COMPOSITE_IDENTITY_SIDEKIQ_ARG])
+        .to eq([primary_user.id, scoped_user.id])
+    end
+  end
 end
diff --git a/spec/lib/gitlab/background_migration/backfill_archived_and_traversal_ids_to_vulnerability_reads_spec.rb b/spec/lib/gitlab/background_migration/backfill_archived_and_traversal_ids_to_vulnerability_reads_spec.rb
index 5cf450cbf75..83747731d33 100644
--- a/spec/lib/gitlab/background_migration/backfill_archived_and_traversal_ids_to_vulnerability_reads_spec.rb
+++ b/spec/lib/gitlab/background_migration/backfill_archived_and_traversal_ids_to_vulnerability_reads_spec.rb
@@ -15,6 +15,7 @@ RSpec.describe Gitlab::BackgroundMigration::BackfillArchivedAndTraversalIdsToVul
   let(:vulnerability_findings) { table(:vulnerability_occurrences) }
   let(:vulnerabilities) { table(:vulnerabilities) }
   let(:vulnerability_reads) { table(:vulnerability_reads) }
+  let(:organizations) { table(:organizations) }
   let(:projects) { table(:projects) }
   let(:users) { table(:users) }
   let(:namespaces) { table(:namespaces) }
@@ -36,8 +37,11 @@ RSpec.describe Gitlab::BackgroundMigration::BackfillArchivedAndTraversalIdsToVul
     }
   end
 
+  let!(:organization) { organizations.create!(name: 'organization', path: 'organization') }
+
   let!(:group_namespace) do
     namespaces.create!(
+      organization_id: organization.id,
       name: 'gitlab-org',
       path: 'gitlab-org',
       type: 'Group'
@@ -46,6 +50,7 @@ RSpec.describe Gitlab::BackgroundMigration::BackfillArchivedAndTraversalIdsToVul
 
   let!(:other_group_namespace) do
     namespaces.create!(
+      organization_id: organization.id,
       name: 'gitlab-com',
       path: 'gitlab-com',
       type: 'Group'
@@ -127,12 +132,14 @@ RSpec.describe Gitlab::BackgroundMigration::BackfillArchivedAndTraversalIdsToVul
 
   def create_project(name, group)
     project_namespace = namespaces.create!(
+      organization_id: group.organization_id,
       name: name,
       path: name,
       type: 'Project'
     )
 
     projects.create!(
+      organization_id: group.organization_id,
       namespace_id: group.id,
       project_namespace_id: project_namespace.id,
       name: name,
diff --git a/spec/lib/gitlab/background_migration/backfill_catalog_resource_version_sem_ver_spec.rb b/spec/lib/gitlab/background_migration/backfill_catalog_resource_version_sem_ver_spec.rb
index 63d8d707ea4..5dfad2f8ff2 100644
--- a/spec/lib/gitlab/background_migration/backfill_catalog_resource_version_sem_ver_spec.rb
+++ b/spec/lib/gitlab/background_migration/backfill_catalog_resource_version_sem_ver_spec.rb
@@ -3,8 +3,16 @@
 require 'spec_helper'
 
 RSpec.describe Gitlab::BackgroundMigration::BackfillCatalogResourceVersionSemVer, feature_category: :pipeline_composition do
-  let(:namespace) { table(:namespaces).create!(name: 'name', path: 'path') }
-  let(:project) { table(:projects).create!(namespace_id: namespace.id, project_namespace_id: namespace.id) }
+  let(:organization) { table(:organizations).create!(name: 'organization', path: 'organization') }
+  let(:namespace) { table(:namespaces).create!(name: 'name', path: 'path', organization_id: organization.id) }
+  let(:project) do
+    table(:projects).create!(
+      namespace_id: namespace.id,
+      project_namespace_id: namespace.id,
+      organization_id: organization.id
+    )
+  end
+
   let(:resource) { table(:catalog_resources).create!(project_id: project.id) }
 
   let(:releases_table) { table(:releases) }
diff --git a/spec/lib/gitlab/background_migration/backfill_catalog_resource_versions_released_at_spec.rb b/spec/lib/gitlab/background_migration/backfill_catalog_resource_versions_released_at_spec.rb
index f4ab3203cd7..b8f2dd7bcf7 100644
--- a/spec/lib/gitlab/background_migration/backfill_catalog_resource_versions_released_at_spec.rb
+++ b/spec/lib/gitlab/background_migration/backfill_catalog_resource_versions_released_at_spec.rb
@@ -4,8 +4,16 @@ require 'spec_helper'
 
 RSpec.describe Gitlab::BackgroundMigration::BackfillCatalogResourceVersionsReleasedAt,
   feature_category: :pipeline_composition do
-  let(:namespace) { table(:namespaces).create!(name: 'name', path: 'path') }
-  let(:project) { table(:projects).create!(namespace_id: namespace.id, project_namespace_id: namespace.id) }
+  let(:organization) { table(:organizations).create!(name: 'organization', path: 'organization') }
+  let(:namespace) { table(:namespaces).create!(name: 'name', path: 'path', organization_id: organization.id) }
+  let(:project) do
+    table(:projects).create!(
+      namespace_id: namespace.id,
+      project_namespace_id: namespace.id,
+      organization_id: organization.id
+    )
+  end
+
   let(:resource) { table(:catalog_resources).create!(project_id: project.id) }
 
   let(:releases_table) { table(:releases) }
diff --git a/spec/lib/gitlab/background_migration/backfill_deploy_tokens_sharding_key_spec.rb b/spec/lib/gitlab/background_migration/backfill_deploy_tokens_sharding_key_spec.rb
index 997a1611747..2d216c8fd15 100644
--- a/spec/lib/gitlab/background_migration/backfill_deploy_tokens_sharding_key_spec.rb
+++ b/spec/lib/gitlab/background_migration/backfill_deploy_tokens_sharding_key_spec.rb
@@ -3,17 +3,19 @@
 require 'spec_helper'
 
 RSpec.describe Gitlab::BackgroundMigration::BackfillDeployTokensShardingKey, feature_category: :continuous_delivery do
-  let!(:group1) { table(:namespaces).create!(name: 'group1', path: 'group1') }
-  let!(:group2) { table(:namespaces).create!(name: 'group2', path: 'group2') }
+  let!(:organization) { table(:organizations).create!(name: 'organization', path: 'organization') }
+
+  let!(:group1) { table(:namespaces).create!(name: 'group1', path: 'group1', organization_id: organization.id) }
+  let!(:group2) { table(:namespaces).create!(name: 'group2', path: 'group2', organization_id: organization.id) }
 
   let!(:project1) do
     table(:projects).create!(name: 'project1', path: 'project1', namespace_id: group1.id,
-      project_namespace_id: group1.id)
+      project_namespace_id: group1.id, organization_id: organization.id)
   end
 
   let!(:project2) do
     table(:projects).create!(name: 'project2', path: 'project2', namespace_id: group2.id,
-      project_namespace_id: group2.id)
+      project_namespace_id: group2.id, organization_id: organization.id)
   end
 
   let!(:deploy_token1) do
diff --git a/spec/lib/gitlab/background_migration/backfill_design_management_repositories_spec.rb b/spec/lib/gitlab/background_migration/backfill_design_management_repositories_spec.rb
index 381b765c876..b82e0485707 100644
--- a/spec/lib/gitlab/background_migration/backfill_design_management_repositories_spec.rb
+++ b/spec/lib/gitlab/background_migration/backfill_design_management_repositories_spec.rb
@@ -7,10 +7,13 @@ RSpec.describe(
   schema: 20230721095222,
   feature_category: :geo_replication
 ) do
+  let!(:organizations) { table(:organizations) }
   let!(:namespaces) { table(:namespaces) }
   let!(:projects) { table(:projects) }
   let!(:design_management_repositories) { table(:design_management_repositories) }
 
+  let(:organization) { organizations.create!(name: 'organization', path: 'organization') }
+
   subject(:migration) do
     described_class.new(
       start_id: projects.minimum(:id),
@@ -50,6 +53,7 @@ RSpec.describe(
 
     def create_namespace(name)
       namespaces.create!(
+        organization_id: organization.id,
         name: name,
         path: name,
         type: 'Project'
@@ -58,6 +62,7 @@ RSpec.describe(
 
     def create_project(namespace, name)
       projects.create!(
+        organization_id: namespace.organization_id,
         namespace_id: namespace.id,
         project_namespace_id: namespace.id,
         name: name,
diff --git a/spec/lib/gitlab/background_migration/backfill_events_sharding_key_spec.rb b/spec/lib/gitlab/background_migration/backfill_events_sharding_key_spec.rb
index 0b615f34383..09ff7dc38a5 100644
--- a/spec/lib/gitlab/background_migration/backfill_events_sharding_key_spec.rb
+++ b/spec/lib/gitlab/background_migration/backfill_events_sharding_key_spec.rb
@@ -6,8 +6,16 @@ RSpec.describe Gitlab::BackgroundMigration::BackfillEventsShardingKey, :migratio
   let(:connection) { ApplicationRecord.connection }
 
   describe '#perform' do
-    let!(:namespace) { table(:namespaces).create!(name: 'name', path: 'path') }
-    let!(:project) { table(:projects).create!(namespace_id: namespace.id, project_namespace_id: namespace.id) }
+    let!(:organization) { table(:organizations).create!(name: 'organization', path: 'organization') }
+    let!(:namespace) { table(:namespaces).create!(name: 'name', path: 'path', organization_id: organization.id) }
+    let!(:project) do
+      table(:projects).create!(
+        namespace_id: namespace.id,
+        project_namespace_id: namespace.id,
+        organization_id: organization.id
+      )
+    end
+
     let!(:user) { table(:users).create!(username: 'john_doe', email: 'johndoe@gitlab.com', projects_limit: 1) }
     let!(:note) { table(:notes).create!(noteable_type: 'Issue', project_id: project.id) }
     let!(:mr) do
diff --git a/spec/lib/gitlab/background_migration/backfill_finding_id_in_vulnerabilities_spec.rb b/spec/lib/gitlab/background_migration/backfill_finding_id_in_vulnerabilities_spec.rb
index 7281ce1f9e7..3c7292ace0f 100644
--- a/spec/lib/gitlab/background_migration/backfill_finding_id_in_vulnerabilities_spec.rb
+++ b/spec/lib/gitlab/background_migration/backfill_finding_id_in_vulnerabilities_spec.rb
@@ -9,6 +9,7 @@ RSpec.describe Gitlab::BackgroundMigration::BackfillFindingIdInVulnerabilities,
     skip_if_multiple_databases_are_setup(:sec)
   end
 
+  let(:organizations) { table(:organizations) }
   let(:namespaces) { table(:namespaces) }
   let(:projects) { table(:projects) }
   let(:users) { table(:users) }
@@ -17,11 +18,18 @@ RSpec.describe Gitlab::BackgroundMigration::BackfillFindingIdInVulnerabilities,
   let(:vulnerability_scanners) { table(:vulnerability_scanners) }
   let(:vulnerability_findings) { table(:vulnerability_occurrences) }
   let(:vulnerabilities) { table(:vulnerabilities) }
+
   let!(:user) { create_user(email: "test1@example.com", username: "test1") }
-  let!(:namespace) { namespaces.create!(name: "test-1", path: "test-1", owner_id: user.id) }
+  let!(:organization) { organizations.create!(name: 'organization', path: 'organization') }
+  let!(:namespace) do
+    namespaces.create!(name: "test-1", path: "test-1", owner_id: user.id, organization_id: organization.id)
+  end
+
   let!(:project) do
     projects.create!(
-      id: 9999, namespace_id: namespace.id,
+      id: 9999,
+      organization_id: organization.id,
+      namespace_id: namespace.id,
       project_namespace_id: namespace.id,
       creator_id: user.id
     )
diff --git a/spec/lib/gitlab/background_migration/backfill_has_issues_for_external_issue_links_spec.rb b/spec/lib/gitlab/background_migration/backfill_has_issues_for_external_issue_links_spec.rb
index 196fd63756c..68a072b115a 100644
--- a/spec/lib/gitlab/background_migration/backfill_has_issues_for_external_issue_links_spec.rb
+++ b/spec/lib/gitlab/background_migration/backfill_has_issues_for_external_issue_links_spec.rb
@@ -13,11 +13,18 @@ RSpec.describe Gitlab::BackgroundMigration::BackfillHasIssuesForExternalIssueLin
   let(:users) { table(:users) }
   let(:user) { create_user(email: "test1@example.com", username: "test1") }
 
+  let(:organizations) { table(:organizations) }
+  let(:organization) { organizations.create!(name: 'organization', path: 'organization') }
+
   let(:namespaces) { table(:namespaces) }
-  let(:namespace) { namespaces.create!(name: 'test-1', path: 'test-1', owner_id: user.id) }
+  let(:namespace) do
+    namespaces.create!(name: 'test-1', path: 'test-1', owner_id: user.id, organization_id: organization.id)
+  end
 
   let(:projects) { table(:projects) }
-  let(:project) { projects.create!(namespace_id: namespace.id, project_namespace_id: namespace.id) }
+  let(:project) do
+    projects.create!(namespace_id: namespace.id, project_namespace_id: namespace.id, organization_id: organization.id)
+  end
 
   let(:members) { table(:members) }
   let!(:membership) do
diff --git a/spec/lib/gitlab/background_migration/backfill_has_remediations_of_vulnerability_reads_spec.rb b/spec/lib/gitlab/background_migration/backfill_has_remediations_of_vulnerability_reads_spec.rb
index 23b1f438745..b49327b9030 100644
--- a/spec/lib/gitlab/background_migration/backfill_has_remediations_of_vulnerability_reads_spec.rb
+++ b/spec/lib/gitlab/background_migration/backfill_has_remediations_of_vulnerability_reads_spec.rb
@@ -11,6 +11,7 @@ RSpec.describe Gitlab::BackgroundMigration::BackfillHasRemediationsOfVulnerabili
     skip_if_multiple_databases_are_setup(:sec)
   end
 
+  let(:organizations) { table(:organizations) }
   let(:namespaces) { table(:namespaces) }
   let(:projects) { table(:projects) }
   let(:users) { table(:users) }
@@ -18,8 +19,12 @@ RSpec.describe Gitlab::BackgroundMigration::BackfillHasRemediationsOfVulnerabili
   let(:vulnerabilities) { table(:vulnerabilities) }
   let(:vulnerability_reads) { table(:vulnerability_reads) }
 
-  let(:namespace) { namespaces.create!(name: 'user', path: 'user') }
-  let(:project) { projects.create!(namespace_id: namespace.id, project_namespace_id: namespace.id) }
+  let(:organization) { organizations.create!(name: 'organization', path: 'organization') }
+  let(:namespace) { namespaces.create!(name: 'user', path: 'user', organization_id: organization.id) }
+  let(:project) do
+    projects.create!(namespace_id: namespace.id, project_namespace_id: namespace.id, organization_id: organization.id)
+  end
+
   let(:user) { users.create!(username: 'john_doe', email: 'johndoe@gitlab.com', projects_limit: 10) }
   let(:scanner) { scanners.create!(project_id: project.id, external_id: 'external_id', name: 'Test Scanner') }
 
diff --git a/spec/lib/gitlab/background_migration/backfill_identifier_names_of_vulnerability_reads_spec.rb b/spec/lib/gitlab/background_migration/backfill_identifier_names_of_vulnerability_reads_spec.rb
index 76e2c85699e..5e999b39542 100644
--- a/spec/lib/gitlab/background_migration/backfill_identifier_names_of_vulnerability_reads_spec.rb
+++ b/spec/lib/gitlab/background_migration/backfill_identifier_names_of_vulnerability_reads_spec.rb
@@ -12,8 +12,6 @@ RSpec.describe Gitlab::BackgroundMigration::BackfillIdentifierNamesOfVulnerabili
     skip_if_multiple_databases_are_setup(:sec)
   end
 
-  let(:namespaces) { table(:namespaces) }
-  let(:projects) { table(:projects) }
   let(:users) { table(:users) }
   let(:scanners) { table(:vulnerability_scanners) }
   let(:vulnerabilities) { table(:vulnerabilities) }
@@ -22,8 +20,16 @@ RSpec.describe Gitlab::BackgroundMigration::BackfillIdentifierNamesOfVulnerabili
   let(:vulnerability_occurrence_identifiers) { table(:vulnerability_occurrence_identifiers) }
   let(:vulnerability_identifiers) { table(:vulnerability_identifiers) }
 
-  let(:namespace) { namespaces.create!(name: 'user', path: 'user') }
-  let(:project) { projects.create!(namespace_id: namespace.id, project_namespace_id: namespace.id) }
+  let(:organization) { table(:organizations).create!(name: 'organization', path: 'organization') }
+  let(:namespace) { table(:namespaces).create!(name: 'user', path: 'user', organization_id: organization.id) }
+  let(:project) do
+    table(:projects).create!(
+      namespace_id: namespace.id,
+      project_namespace_id: namespace.id,
+      organization_id: organization.id
+    )
+  end
+
   let(:user) { users.create!(username: 'john_doe', email: 'johndoe@gitlab.com', projects_limit: 10) }
   let(:scanner) { scanners.create!(project_id: project.id, external_id: 'external_id', name: 'Test Scanner') }
 
diff --git a/spec/lib/gitlab/background_migration/backfill_issue_search_data_namespace_id_spec.rb b/spec/lib/gitlab/background_migration/backfill_issue_search_data_namespace_id_spec.rb
index ea5c7086ac2..11bfb4601ee 100644
--- a/spec/lib/gitlab/background_migration/backfill_issue_search_data_namespace_id_spec.rb
+++ b/spec/lib/gitlab/background_migration/backfill_issue_search_data_namespace_id_spec.rb
@@ -4,24 +4,63 @@ require 'spec_helper'
 
 RSpec.describe Gitlab::BackgroundMigration::BackfillIssueSearchDataNamespaceId,
   schema: 20240105144908, feature_category: :team_planning do
+  let(:organizations) { table(:organizations) }
   let(:namespaces) { table(:namespaces) }
   let(:projects) { table(:projects) }
   let(:issues) { table(:issues) }
   let(:issue_search_data) { table(:issue_search_data) }
   let(:issue_type) { table(:work_item_types).find_by!(namespace_id: nil, base_type: 0) }
 
-  let(:namespace_1) { namespaces.create!(name: 'namespace1', type: 'Group', path: 'namespace1') }
-  let(:namespace_2) { namespaces.create!(name: 'namespace2', type: 'Group', path: 'namespace2') }
+  let(:organization) { organizations.create!(name: 'organization', path: 'organization') }
 
-  let(:proj_ns_1) { namespaces.create!(name: 'pn1', path: 'pn1', type: 'Project', parent_id: namespace_1.id) }
-  let(:proj_ns_2) { namespaces.create!(name: 'pn2', path: 'pn2', type: 'Project', parent_id: namespace_2.id) }
+  let(:namespace_1) do
+    namespaces
+      .create!(name: 'namespace1', type: 'Group', path: 'namespace1', organization_id: organization.id)
+  end
+
+  let(:namespace_2) do
+    namespaces
+      .create!(name: 'namespace2', type: 'Group', path: 'namespace2', organization_id: organization.id)
+  end
+
+  let(:proj_ns_1) do
+    namespaces.create!(
+      name: 'pn1',
+      path: 'pn1',
+      type: 'Project',
+      parent_id: namespace_1.id,
+      organization_id: organization.id
+    )
+  end
+
+  let(:proj_ns_2) do
+    namespaces.create!(
+      name: 'pn2',
+      path: 'pn2',
+      type: 'Project',
+      parent_id: namespace_2.id,
+      organization_id: organization.id
+    )
+  end
 
   let(:proj_1) do
-    projects.create!(name: 'proj1', path: 'proj1', namespace_id: namespace_1.id, project_namespace_id: proj_ns_1.id)
+    projects.create!(
+      name: 'proj1',
+      path: 'proj1',
+      namespace_id: namespace_1.id,
+      project_namespace_id: proj_ns_1.id,
+      organization_id: organization.id
+    )
   end
 
   let(:proj_2) do
-    projects.create!(name: 'proj2', path: 'proj2', namespace_id: namespace_2.id, project_namespace_id: proj_ns_2.id)
+    projects.create!(
+      name: 'proj2',
+      path: 'proj2',
+      namespace_id: namespace_2.id,
+      project_namespace_id: proj_ns_2.id,
+      organization_id: organization.id
+    )
   end
 
   let(:proj_1_issue_1) do
diff --git a/spec/lib/gitlab/background_migration/backfill_issues_correct_work_item_type_id_spec.rb b/spec/lib/gitlab/background_migration/backfill_issues_correct_work_item_type_id_spec.rb
index fc9e300350e..215c44382c7 100644
--- a/spec/lib/gitlab/background_migration/backfill_issues_correct_work_item_type_id_spec.rb
+++ b/spec/lib/gitlab/background_migration/backfill_issues_correct_work_item_type_id_spec.rb
@@ -9,9 +9,17 @@ RSpec.describe Gitlab::BackgroundMigration::BackfillIssuesCorrectWorkItemTypeId,
   let(:sub_batch_size) { 2 }
   let(:pause_ms) { 0 }
 
+  let(:organization) { table(:organizations).create!(name: 'organization', path: 'organization') }
+  let(:namespace) { table(:namespaces).create!(name: 'namespace', path: 'namespace', organization_id: organization.id) }
+  let(:project) do
+    table(:projects).create!(
+      namespace_id: namespace.id,
+      project_namespace_id: namespace.id,
+      organization_id: organization.id
+    )
+  end
+
   let(:issue_type_enum) { { issue: 0, incident: 1, test_case: 2, requirement: 3, task: 4 } }
-  let(:namespace) { table(:namespaces).create!(name: 'namespace', path: 'namespace') }
-  let(:project) { table(:projects).create!(namespace_id: namespace.id, project_namespace_id: namespace.id) }
   let(:issues_table) { table(:issues) }
   let(:issue_type) { table(:work_item_types).find_by!(base_type: issue_type_enum[:issue]) }
   let(:task_type) { table(:work_item_types).find_by!(base_type: issue_type_enum[:task]) }
diff --git a/spec/lib/gitlab/background_migration/backfill_merge_request_diffs_project_id_spec.rb b/spec/lib/gitlab/background_migration/backfill_merge_request_diffs_project_id_spec.rb
index 8679a8fab8a..7d821049217 100644
--- a/spec/lib/gitlab/background_migration/backfill_merge_request_diffs_project_id_spec.rb
+++ b/spec/lib/gitlab/background_migration/backfill_merge_request_diffs_project_id_spec.rb
@@ -5,11 +5,13 @@ require 'spec_helper'
 RSpec.describe Gitlab::BackgroundMigration::BackfillMergeRequestDiffsProjectId,
   feature_category: :code_review_workflow,
   schema: 20231114034017 do # schema before we introduced the invalid not-null constraint
+  let!(:organization) { table(:organizations).create!(name: 'my organization', path: 'my-orgainzation') }
   let!(:tags_without_project_id) do
     13.times do
-      namespace = table(:namespaces).create!(name: 'my namespace', path: 'my-namespace')
+      namespace = table(:namespaces).create!(name: 'my namespace', path: 'my-namespace',
+        organization_id: organization.id)
       project = table(:projects).create!(name: 'my project', path: 'my-project', namespace_id: namespace.id,
-        project_namespace_id: namespace.id)
+        project_namespace_id: namespace.id, organization_id: organization.id)
       merge_request = table(:merge_requests).create!(target_project_id: project.id, target_branch: 'main',
         source_branch: 'not-main')
       table(:merge_request_diffs).create!(merge_request_id: merge_request.id, project_id: nil)
diff --git a/spec/lib/gitlab/background_migration/backfill_missing_ci_cd_settings_spec.rb b/spec/lib/gitlab/background_migration/backfill_missing_ci_cd_settings_spec.rb
index 8c4f0a895a4..83081722e95 100644
--- a/spec/lib/gitlab/background_migration/backfill_missing_ci_cd_settings_spec.rb
+++ b/spec/lib/gitlab/background_migration/backfill_missing_ci_cd_settings_spec.rb
@@ -3,16 +3,33 @@
 require 'spec_helper'
 
 RSpec.describe Gitlab::BackgroundMigration::BackfillMissingCiCdSettings, schema: 20230721095222, feature_category: :source_code_management do
+  let(:organizations_table) { table(:organizations) }
   let(:projects_table) { table(:projects) }
   let(:namespaces_table) { table(:namespaces) }
   let(:ci_cd_settings_table) { table(:project_ci_cd_settings) }
 
-  let(:namespace_1) { namespaces_table.create!(name: 'namespace', path: 'namespace-path-1') }
+  let(:organization) { organizations_table.create!(name: 'organization', path: 'organization') }
+
+  let(:namespace_1) do
+    namespaces_table.create!(name: 'namespace', path: 'namespace-path-1', organization_id: organization.id)
+  end
+
+  let(:project_namespace_2) do
+    namespaces_table.create!(name: 'np', path: 'np-path-2', type: 'Project', organization_id: organization.id)
+  end
+
+  let(:project_namespace_3) do
+    namespaces_table.create!(name: 'np', path: 'np-path-3', type: 'Project', organization_id: organization.id)
+  end
+
+  let(:project_namespace_4) do
+    namespaces_table.create!(name: 'np', path: 'np-path-4', type: 'Project', organization_id: organization.id)
+  end
+
+  let(:project_namespace_5) do
+    namespaces_table.create!(name: 'np', path: 'np-path-5', type: 'Project', organization_id: organization.id)
+  end
 
-  let(:project_namespace_2) { namespaces_table.create!(name: 'namespace', path: 'namespace-path-2', type: 'Project') }
-  let(:project_namespace_3) { namespaces_table.create!(name: 'namespace', path: 'namespace-path-3', type: 'Project') }
-  let(:project_namespace_4) { namespaces_table.create!(name: 'namespace', path: 'namespace-path-4', type: 'Project') }
-  let(:project_namespace_5) { namespaces_table.create!(name: 'namespace', path: 'namespace-path-4', type: 'Project') }
   let!(:project_1) do
     projects_table
     .create!(
diff --git a/spec/lib/gitlab/background_migration/backfill_namespace_id_of_vulnerability_reads_spec.rb b/spec/lib/gitlab/background_migration/backfill_namespace_id_of_vulnerability_reads_spec.rb
index 64f68cd5465..01a75eb6591 100644
--- a/spec/lib/gitlab/background_migration/backfill_namespace_id_of_vulnerability_reads_spec.rb
+++ b/spec/lib/gitlab/background_migration/backfill_namespace_id_of_vulnerability_reads_spec.rb
@@ -10,6 +10,7 @@ RSpec.describe Gitlab::BackgroundMigration::BackfillNamespaceIdOfVulnerabilityRe
     skip_if_multiple_databases_are_setup(:sec)
   end
 
+  let(:organizations) { table(:organizations) }
   let(:namespaces) { table(:namespaces) }
   let(:projects) { table(:projects) }
   let(:users) { table(:users) }
@@ -17,8 +18,12 @@ RSpec.describe Gitlab::BackgroundMigration::BackfillNamespaceIdOfVulnerabilityRe
   let(:vulnerabilities) { table(:vulnerabilities) }
   let(:vulnerability_reads) { table(:vulnerability_reads) }
 
-  let(:namespace) { namespaces.create!(name: 'user', path: 'user') }
-  let(:project) { projects.create!(namespace_id: namespace.id, project_namespace_id: namespace.id) }
+  let(:organization) { organizations.create!(name: 'organization', path: 'organization') }
+  let(:namespace) { namespaces.create!(name: 'user', path: 'user', organization_id: organization.id) }
+  let(:project) do
+    projects.create!(namespace_id: namespace.id, project_namespace_id: namespace.id, organization_id: organization.id)
+  end
+
   let(:user) { users.create!(username: 'john_doe', email: 'johndoe@gitlab.com', projects_limit: 10) }
   let(:scanner) { scanners.create!(project_id: project.id, external_id: 'external_id', name: 'Test Scanner') }
   let(:vulnerability) do
diff --git a/spec/lib/gitlab/background_migration/backfill_nuget_normalized_version_spec.rb b/spec/lib/gitlab/background_migration/backfill_nuget_normalized_version_spec.rb
index 3f1764ac4f3..6f83255953f 100644
--- a/spec/lib/gitlab/background_migration/backfill_nuget_normalized_version_spec.rb
+++ b/spec/lib/gitlab/background_migration/backfill_nuget_normalized_version_spec.rb
@@ -36,10 +36,14 @@ RSpec.describe Gitlab::BackgroundMigration::BackfillNugetNormalizedVersion, sche
   let(:migration) { described_class.new(**migration_attrs) }
   let(:packages) { table(:packages_packages) }
 
-  let(:namespace) { table(:namespaces).create!(name: 'project', path: 'project', type: 'Project') }
+  let(:organization) { table(:organizations).create!(name: 'organization', path: 'organization') }
+  let(:namespace) do
+    table(:namespaces).create!(name: 'project', path: 'project', type: 'Project', organization_id: organization.id)
+  end
+
   let(:project) do
     table(:projects).create!(name: 'project', path: 'project', project_namespace_id: namespace.id,
-      namespace_id: namespace.id)
+      namespace_id: namespace.id, organization_id: organization.id)
   end
 
   let(:package_ids) { [] }
diff --git a/spec/lib/gitlab/background_migration/backfill_packages_dependencies_project_id_spec.rb b/spec/lib/gitlab/background_migration/backfill_packages_dependencies_project_id_spec.rb
index 9f7f8214573..9c51f2de409 100644
--- a/spec/lib/gitlab/background_migration/backfill_packages_dependencies_project_id_spec.rb
+++ b/spec/lib/gitlab/background_migration/backfill_packages_dependencies_project_id_spec.rb
@@ -3,18 +3,24 @@
 require 'spec_helper'
 
 RSpec.describe Gitlab::BackgroundMigration::BackfillPackagesDependenciesProjectId, feature_category: :package_registry do
-  let!(:namespace_1) { table(:namespaces).create!(name: 'group-1', path: 'group-1', type: 'Group') }
+  let!(:organization) { table(:organizations).create!(name: 'organization', path: 'organization') }
 
-  let!(:namespace_2) { table(:namespaces).create!(name: 'group-2', path: 'group-2', type: 'Group') }
+  let!(:namespace_1) do
+    table(:namespaces).create!(name: 'group-1', path: 'group-1', type: 'Group', organization_id: organization.id)
+  end
+
+  let!(:namespace_2) do
+    table(:namespaces).create!(name: 'group-2', path: 'group-2', type: 'Group', organization_id: organization.id)
+  end
 
   let!(:project_1) do
     table(:projects).create!(name: 'project 1', path: 'project-1', project_namespace_id: namespace_1.id,
-      namespace_id: namespace_1.id)
+      namespace_id: namespace_1.id, organization_id: organization.id)
   end
 
   let!(:project_2) do
     table(:projects).create!(name: 'project 2', path: 'project-2', project_namespace_id: namespace_2.id,
-      namespace_id: namespace_2.id)
+      namespace_id: namespace_2.id, organization_id: organization.id)
   end
 
   let!(:package_1) do
diff --git a/spec/lib/gitlab/background_migration/backfill_packages_tags_project_id_spec.rb b/spec/lib/gitlab/background_migration/backfill_packages_tags_project_id_spec.rb
index 423d9fe76ac..4a4aa147dbf 100644
--- a/spec/lib/gitlab/background_migration/backfill_packages_tags_project_id_spec.rb
+++ b/spec/lib/gitlab/background_migration/backfill_packages_tags_project_id_spec.rb
@@ -5,11 +5,13 @@ require 'spec_helper'
 RSpec.describe Gitlab::BackgroundMigration::BackfillPackagesTagsProjectId,
   feature_category: :package_registry,
   schema: 20231030051837 do # schema before we introduced the invalid not-null constraint
+  let!(:organization) { table(:organizations).create!(name: 'my organization', path: 'my-orgainzation') }
   let!(:tags_without_project_id) do
     (0...13).map do |i|
-      namespace = table(:namespaces).create!(name: 'my namespace', path: 'my-namespace')
-      project = table(:projects).create!(name: 'my project', path: 'my-project', namespace_id: namespace.id,
-        project_namespace_id: namespace.id)
+      namespace = table(:namespaces).create!(name: 'my namespace', path: 'my namespace',
+        organization_id: organization.id)
+      project = table(:projects).create!(name: 'my project', path: 'my project', namespace_id: namespace.id,
+        project_namespace_id: namespace.id, organization_id: organization.id)
       package = table(:packages_packages).create!(project_id: project.id, created_at: Time.current,
         updated_at: Time.current, name: "Package #{i}", package_type: 1, status: 1)
       table(:packages_tags).create!(package_id: package.id, name: "Tag #{i}", created_at: Time.current,
diff --git a/spec/lib/gitlab/background_migration/backfill_project_feature_package_registry_access_level_spec.rb b/spec/lib/gitlab/background_migration/backfill_project_feature_package_registry_access_level_spec.rb
index 47ff2883fb2..11098010ba3 100644
--- a/spec/lib/gitlab/background_migration/backfill_project_feature_package_registry_access_level_spec.rb
+++ b/spec/lib/gitlab/background_migration/backfill_project_feature_package_registry_access_level_spec.rb
@@ -4,29 +4,43 @@ require 'spec_helper'
 
 RSpec.describe Gitlab::BackgroundMigration::BackfillProjectFeaturePackageRegistryAccessLevel do
   let(:non_null_project_features) { { pages_access_level: 20 } }
+  let(:organizations) { table(:organizations) }
   let(:namespaces) { table(:namespaces) }
   let(:projects) { table(:projects) }
   let(:project_features) { table(:project_features) }
 
-  let(:namespace1) { namespaces.create!(name: 'namespace 1', path: 'namespace1') }
-  let(:namespace2) { namespaces.create!(name: 'namespace 2', path: 'namespace2') }
-  let(:namespace3) { namespaces.create!(name: 'namespace 3', path: 'namespace3') }
-  let(:namespace4) { namespaces.create!(name: 'namespace 4', path: 'namespace4') }
-  let(:namespace5) { namespaces.create!(name: 'namespace 5', path: 'namespace5') }
-  let(:namespace6) { namespaces.create!(name: 'namespace 6', path: 'namespace6') }
+  let(:organization) { organizations.create!(name: 'organization', path: 'organization') }
+
+  let(:namespace1) { namespaces.create!(name: 'namespace 1', path: 'namespace1', organization_id: organization.id) }
+  let(:namespace2) { namespaces.create!(name: 'namespace 2', path: 'namespace2', organization_id: organization.id) }
+  let(:namespace3) { namespaces.create!(name: 'namespace 3', path: 'namespace3', organization_id: organization.id) }
+  let(:namespace4) { namespaces.create!(name: 'namespace 4', path: 'namespace4', organization_id: organization.id) }
+  let(:namespace5) { namespaces.create!(name: 'namespace 5', path: 'namespace5', organization_id: organization.id) }
+  let(:namespace6) { namespaces.create!(name: 'namespace 6', path: 'namespace6', organization_id: organization.id) }
 
   let(:project1) do
-    projects.create!(namespace_id: namespace1.id, project_namespace_id: namespace1.id, packages_enabled: false)
+    projects.create!(
+      namespace_id: namespace1.id,
+      project_namespace_id: namespace1.id,
+      organization_id: organization.id,
+      packages_enabled: false
+    )
   end
 
   let(:project2) do
-    projects.create!(namespace_id: namespace2.id, project_namespace_id: namespace2.id, packages_enabled: nil)
+    projects.create!(
+      namespace_id: namespace2.id,
+      project_namespace_id: namespace2.id,
+      organization_id: organization.id,
+      packages_enabled: nil
+    )
   end
 
   let(:project3) do
     projects.create!(
       namespace_id: namespace3.id,
       project_namespace_id: namespace3.id,
+      organization_id: organization.id,
       packages_enabled: true,
       visibility_level: Gitlab::VisibilityLevel::PRIVATE
     )
@@ -36,6 +50,7 @@ RSpec.describe Gitlab::BackgroundMigration::BackfillProjectFeaturePackageRegistr
     projects.create!(
       namespace_id: namespace4.id,
       project_namespace_id: namespace4.id,
+      organization_id: organization.id,
       packages_enabled: true, visibility_level: Gitlab::VisibilityLevel::INTERNAL)
   end
 
@@ -43,13 +58,19 @@ RSpec.describe Gitlab::BackgroundMigration::BackfillProjectFeaturePackageRegistr
     projects.create!(
       namespace_id: namespace5.id,
       project_namespace_id: namespace5.id,
+      organization_id: organization.id,
       packages_enabled: true,
       visibility_level: Gitlab::VisibilityLevel::PUBLIC
     )
   end
 
   let(:project6) do
-    projects.create!(namespace_id: namespace6.id, project_namespace_id: namespace6.id, packages_enabled: false)
+    projects.create!(
+      namespace_id: namespace6.id,
+      project_namespace_id: namespace6.id,
+      organization_id: organization.id,
+      packages_enabled: false
+    )
   end
 
   let!(:project_feature1) do
diff --git a/spec/lib/gitlab/background_migration/backfill_project_id_to_dependency_list_exports_spec.rb b/spec/lib/gitlab/background_migration/backfill_project_id_to_dependency_list_exports_spec.rb
index 89634066573..d3eac3b5b40 100644
--- a/spec/lib/gitlab/background_migration/backfill_project_id_to_dependency_list_exports_spec.rb
+++ b/spec/lib/gitlab/background_migration/backfill_project_id_to_dependency_list_exports_spec.rb
@@ -5,6 +5,7 @@ require 'spec_helper'
 RSpec.describe Gitlab::BackgroundMigration::BackfillProjectIdToDependencyListExports, feature_category: :dependency_management do
   let(:dependency_list_exports) { table(:dependency_list_exports) }
   let(:pipelines) { partitioned_table(:p_ci_pipelines, database: :ci) }
+  let(:organizations) { table(:organizations) }
   let(:projects) { table(:projects) }
   let(:namespaces) { table(:namespaces) }
 
@@ -72,11 +73,19 @@ RSpec.describe Gitlab::BackgroundMigration::BackfillProjectIdToDependencyListExp
   end
 
   def create_ci_pipeline(name)
-    namespace = namespaces.create!(name: "group-#{name}", path: "group-#{name}")
-    project_namespace = namespaces.create!(name: "project-#{name}", path: "project-#{name}")
+    organization = organizations.create!(name: "organization-#{name}", path: "organization-#{name}")
+    namespace = namespaces.create!(name: "group-#{name}", path: "group-#{name}", organization_id: organization.id)
+
+    project_namespace = namespaces.create!(
+      name: "project-#{name}",
+      path: "project-#{name}",
+      organization_id: organization.id
+    )
+
     project = projects.create!(
       namespace_id: namespace.id,
       project_namespace_id: project_namespace.id,
+      organization_id: organization.id,
       name: "project-#{name}",
       path: "project-#{name}"
     )
diff --git a/spec/lib/gitlab/background_migration/backfill_project_id_to_security_scans_spec.rb b/spec/lib/gitlab/background_migration/backfill_project_id_to_security_scans_spec.rb
index 8e06319d360..9f03c5231ef 100644
--- a/spec/lib/gitlab/background_migration/backfill_project_id_to_security_scans_spec.rb
+++ b/spec/lib/gitlab/background_migration/backfill_project_id_to_security_scans_spec.rb
@@ -5,6 +5,7 @@ require 'spec_helper'
 RSpec.describe Gitlab::BackgroundMigration::BackfillProjectIdToSecurityScans, feature_category: :vulnerability_management do
   let(:security_scans) { table(:security_scans, database: :sec) }
   let(:ci_builds) { partitioned_table(:p_ci_builds, database: :ci) }
+  let(:organizations) { table(:organizations) }
   let(:projects) { table(:projects) }
   let(:namespaces) { table(:namespaces) }
 
@@ -80,11 +81,19 @@ RSpec.describe Gitlab::BackgroundMigration::BackfillProjectIdToSecurityScans, fe
   end
 
   def create_ci_build(name)
-    namespace = namespaces.create!(name: "group-#{name}", path: "group-#{name}")
-    project_namespace = namespaces.create!(name: "project-#{name}", path: "project-#{name}")
+    organization = organizations.create!(name: "organization-#{name}", path: "organization-#{name}")
+    namespace = namespaces.create!(name: "group-#{name}", path: "group-#{name}", organization_id: organization.id)
+
+    project_namespace = namespaces.create!(
+      name: "project-#{name}",
+      path: "project-#{name}",
+      organization_id: organization.id
+    )
+
     project = projects.create!(
       namespace_id: namespace.id,
       project_namespace_id: project_namespace.id,
+      organization_id: organization.id,
       name: "project-#{name}",
       path: "project-#{name}"
     )
diff --git a/spec/lib/gitlab/background_migration/backfill_vulnerability_reads_cluster_agent_spec.rb b/spec/lib/gitlab/background_migration/backfill_vulnerability_reads_cluster_agent_spec.rb
index 1930715fe26..375a03b5af0 100644
--- a/spec/lib/gitlab/background_migration/backfill_vulnerability_reads_cluster_agent_spec.rb
+++ b/spec/lib/gitlab/background_migration/backfill_vulnerability_reads_cluster_agent_spec.rb
@@ -23,6 +23,7 @@ RSpec.describe Gitlab::BackgroundMigration::BackfillVulnerabilityReadsClusterAge
   let(:vulnerability_reads_table) { table(:vulnerability_reads) }
   let(:vulnerability_scanners_table) { table(:vulnerability_scanners) }
   let(:vulnerabilities_table) { table(:vulnerabilities) }
+  let(:organizations_table) { table(:organizations) }
   let(:namespaces_table) { table(:namespaces) }
   let(:projects_table) { table(:projects) }
   let(:cluster_agents_table) { table(:cluster_agents) }
@@ -35,11 +36,13 @@ RSpec.describe Gitlab::BackgroundMigration::BackfillVulnerabilityReadsClusterAge
   before do
     users_table.create!(id: 1, name: 'John Doe', email: 'test@example.com', projects_limit: 5)
 
-    namespaces_table.create!(id: 1, name: 'Namespace 1', path: 'namespace-1')
-    namespaces_table.create!(id: 2, name: 'Namespace 2', path: 'namespace-2')
+    organizations_table.create!(id: 1, name: 'Organization', path: 'organization')
 
-    projects_table.create!(id: 1, namespace_id: 1, name: 'Project 1', path: 'project-1', project_namespace_id: 1)
-    projects_table.create!(id: 2, namespace_id: 2, name: 'Project 2', path: 'project-2', project_namespace_id: 2)
+    namespaces_table.create!(id: 1, name: 'Namespace 1', path: 'namespace-1', organization_id: 1)
+    namespaces_table.create!(id: 2, name: 'Namespace 2', path: 'namespace-2', organization_id: 1)
+
+    projects_table.create!(id: 1, namespace_id: 1, name: 'p1', path: 'p-1', project_namespace_id: 1, organization_id: 1)
+    projects_table.create!(id: 2, namespace_id: 2, name: 'p2', path: 'p-2', project_namespace_id: 2, organization_id: 1)
 
     cluster_agents_table.create!(id: 1, name: 'Agent 1', project_id: 1)
     cluster_agents_table.create!(id: 2, name: 'Agent 2', project_id: 2)
diff --git a/spec/lib/gitlab/background_migration/batching_strategies/loose_index_scan_batching_strategy_spec.rb b/spec/lib/gitlab/background_migration/batching_strategies/loose_index_scan_batching_strategy_spec.rb
index af3410b682c..d0976e2862b 100644
--- a/spec/lib/gitlab/background_migration/batching_strategies/loose_index_scan_batching_strategy_spec.rb
+++ b/spec/lib/gitlab/background_migration/batching_strategies/loose_index_scan_batching_strategy_spec.rb
@@ -4,24 +4,28 @@ require 'spec_helper'
 
 RSpec.describe Gitlab::BackgroundMigration::BatchingStrategies::LooseIndexScanBatchingStrategy, '#next_batch' do
   let(:batching_strategy) { described_class.new(connection: ActiveRecord::Base.connection) }
+  let(:organizations) { table(:organizations) }
   let(:namespaces) { table(:namespaces) }
   let(:projects) { table(:projects) }
   let(:issues) { table(:issues) }
   let(:issue_base_type_enum_value) { 0 }
   let(:issue_type) { table(:work_item_types).find_by!(base_type: issue_base_type_enum_value) }
 
-  let!(:namespace1) { namespaces.create!(name: 'ns1', path: 'ns1') }
-  let!(:namespace2) { namespaces.create!(name: 'ns2', path: 'ns2') }
-  let!(:namespace3) { namespaces.create!(name: 'ns3', path: 'ns3') }
-  let!(:namespace4) { namespaces.create!(name: 'ns4', path: 'ns4') }
-  let!(:namespace5) { namespaces.create!(name: 'ns5', path: 'ns5') }
-  let!(:project1) { projects.create!(name: 'p1', namespace_id: namespace1.id, project_namespace_id: namespace1.id) }
-  let!(:project2) { projects.create!(name: 'p2', namespace_id: namespace2.id, project_namespace_id: namespace2.id) }
-  let!(:project3) { projects.create!(name: 'p3', namespace_id: namespace3.id, project_namespace_id: namespace3.id) }
-  let!(:project4) { projects.create!(name: 'p4', namespace_id: namespace4.id, project_namespace_id: namespace4.id) }
-  let!(:project5) { projects.create!(name: 'p5', namespace_id: namespace5.id, project_namespace_id: namespace5.id) }
+  let!(:organization) { organizations.create!(name: 'organization', path: 'organization') }
+
+  let!(:namespace1) { namespaces.create!(name: 'ns1', path: 'ns1', organization_id: organization.id) }
+  let!(:namespace2) { namespaces.create!(name: 'ns2', path: 'ns2', organization_id: organization.id) }
+  let!(:namespace3) { namespaces.create!(name: 'ns3', path: 'ns3', organization_id: organization.id) }
+  let!(:namespace4) { namespaces.create!(name: 'ns4', path: 'ns4', organization_id: organization.id) }
+  let!(:namespace5) { namespaces.create!(name: 'ns5', path: 'ns5', organization_id: organization.id) }
 
   # rubocop:disable Layout/LineLength
+  let!(:project1) { projects.create!(name: 'p1', namespace_id: namespace1.id, project_namespace_id: namespace1.id, organization_id: organization.id) }
+  let!(:project2) { projects.create!(name: 'p2', namespace_id: namespace2.id, project_namespace_id: namespace2.id, organization_id: organization.id) }
+  let!(:project3) { projects.create!(name: 'p3', namespace_id: namespace3.id, project_namespace_id: namespace3.id, organization_id: organization.id) }
+  let!(:project4) { projects.create!(name: 'p4', namespace_id: namespace4.id, project_namespace_id: namespace4.id, organization_id: organization.id) }
+  let!(:project5) { projects.create!(name: 'p5', namespace_id: namespace5.id, project_namespace_id: namespace5.id, organization_id: organization.id) }
+
   let!(:issue1) { issues.create!(title: 'title', description: 'description', project_id: project2.id, namespace_id: project2.project_namespace_id, work_item_type_id: issue_type.id) }
   let!(:issue2) { issues.create!(title: 'title', description: 'description', project_id: project1.id, namespace_id: project1.project_namespace_id, work_item_type_id: issue_type.id) }
   let!(:issue3) { issues.create!(title: 'title', description: 'description', project_id: project2.id, namespace_id: project2.project_namespace_id, work_item_type_id: issue_type.id) }
diff --git a/spec/lib/gitlab/background_migration/create_jira_cloud_app_integration_for_jira_connect_subscription_spec.rb b/spec/lib/gitlab/background_migration/create_jira_cloud_app_integration_for_jira_connect_subscription_spec.rb
index 0dea9951d3f..11a65907e84 100644
--- a/spec/lib/gitlab/background_migration/create_jira_cloud_app_integration_for_jira_connect_subscription_spec.rb
+++ b/spec/lib/gitlab/background_migration/create_jira_cloud_app_integration_for_jira_connect_subscription_spec.rb
@@ -6,6 +6,7 @@ RSpec.describe Gitlab::BackgroundMigration::CreateJiraCloudAppIntegrationForJira
   let(:jira_connect_installation) { table(:jira_connect_installations) }
   let(:jira_connect_subscriptions) { table(:jira_connect_subscriptions) }
 
+  let(:organizations) { table(:organizations) }
   let(:projects) { table(:projects) }
   let(:namespaces) { table(:namespaces) }
   let(:integrations) { table(:integrations) }
@@ -22,8 +23,11 @@ RSpec.describe Gitlab::BackgroundMigration::CreateJiraCloudAppIntegrationForJira
     }
   end
 
+  let!(:organization) { organizations.create!(name: 'organization', path: 'organization') }
+
   let!(:group_namespace1) do
     namespaces.create!(
+      organization_id: organization.id,
       name: 'gitlab-1',
       path: 'gitlab-1',
       type: 'Group'
@@ -32,6 +36,7 @@ RSpec.describe Gitlab::BackgroundMigration::CreateJiraCloudAppIntegrationForJira
 
   let!(:group_namespace1_subgroup) do
     namespaces.create!(
+      organization_id: organization.id,
       name: 'gitlab-subgroup',
       path: 'gitlab-subgroup',
       type: 'Group',
@@ -41,6 +46,7 @@ RSpec.describe Gitlab::BackgroundMigration::CreateJiraCloudAppIntegrationForJira
 
   let!(:group_namespace2) do
     namespaces.create!(
+      organization_id: organization.id,
       name: 'gitlab-2',
       path: 'gitlab-2',
       type: 'Group'
@@ -49,6 +55,7 @@ RSpec.describe Gitlab::BackgroundMigration::CreateJiraCloudAppIntegrationForJira
 
   let!(:group_namespace3) do
     namespaces.create!(
+      organization_id: organization.id,
       name: 'gitlab-3',
       path: 'gitlab-3',
       type: 'Group'
@@ -57,6 +64,7 @@ RSpec.describe Gitlab::BackgroundMigration::CreateJiraCloudAppIntegrationForJira
 
   let!(:group_namespace4) do
     namespaces.create!(
+      organization_id: organization.id,
       name: 'gitlab-4',
       path: 'gitlab-4',
       type: 'Group'
@@ -121,12 +129,14 @@ RSpec.describe Gitlab::BackgroundMigration::CreateJiraCloudAppIntegrationForJira
 
   def create_project(name, group)
     project_namespace = namespaces.create!(
+      organization_id: organization.id,
       name: name,
       path: name,
       type: 'Project'
     )
 
     projects.create!(
+      organization_id: organization.id,
       namespace_id: group.id,
       project_namespace_id: project_namespace.id,
       name: name,
diff --git a/spec/lib/gitlab/background_migration/deduplicate_lfs_objects_projects_spec.rb b/spec/lib/gitlab/background_migration/deduplicate_lfs_objects_projects_spec.rb
index 4c60620a9af..ba31aec131c 100644
--- a/spec/lib/gitlab/background_migration/deduplicate_lfs_objects_projects_spec.rb
+++ b/spec/lib/gitlab/background_migration/deduplicate_lfs_objects_projects_spec.rb
@@ -3,19 +3,22 @@
 require 'spec_helper'
 
 RSpec.describe Gitlab::BackgroundMigration::DeduplicateLfsObjectsProjects, feature_category: :source_code_management do
-  let(:namespace_table) { table(:namespaces) }
   let(:projects_table) { table(:projects) }
   let(:lfs_objects_table) { table(:lfs_objects) }
   let(:lfs_objects_projects_table) { table(:lfs_objects_projects) }
   let(:lfs_object_size) { 20 }
 
-  let(:namespace1) { namespace_table.create!(name: 'namespace1', path: 'namespace1') }
-  let(:namespace2) { namespace_table.create!(name: 'namespace2', path: 'namespace2') }
-  let(:namespace3) { namespace_table.create!(name: 'namespace3', path: 'namespace3') }
+  let(:organization) { table(:organizations).create!(name: 'organization', path: 'organization') }
 
-  let(:project1) { projects_table.create!(namespace_id: namespace1.id, project_namespace_id: namespace1.id) }
-  let(:project2) { projects_table.create!(namespace_id: namespace2.id, project_namespace_id: namespace2.id) }
-  let(:project3) { projects_table.create!(namespace_id: namespace3.id, project_namespace_id: namespace3.id) }
+  let(:namespace1) { table(:namespaces).create!(name: 'ns1', path: 'ns1', organization_id: organization.id) }
+  let(:namespace2) { table(:namespaces).create!(name: 'ns2', path: 'ns2', organization_id: organization.id) }
+  let(:namespace3) { table(:namespaces).create!(name: 'ns3', path: 'ns3', organization_id: organization.id) }
+
+  # rubocop:disable Layout/LineLength -- easier to read in single line
+  let(:project1) { projects_table.create!(namespace_id: namespace1.id, project_namespace_id: namespace1.id, organization_id: organization.id) }
+  let(:project2) { projects_table.create!(namespace_id: namespace2.id, project_namespace_id: namespace2.id, organization_id: organization.id) }
+  let(:project3) { projects_table.create!(namespace_id: namespace3.id, project_namespace_id: namespace3.id, organization_id: organization.id) }
+  # rubocop:enable Layout/LineLength
 
   let(:lfs_object1) do
     lfs_objects_table.create!(
diff --git a/spec/lib/gitlab/background_migration/delete_duplicate_issuable_resource_links_spec.rb b/spec/lib/gitlab/background_migration/delete_duplicate_issuable_resource_links_spec.rb
index f2e6ee30f4d..d7f6fcb12ec 100644
--- a/spec/lib/gitlab/background_migration/delete_duplicate_issuable_resource_links_spec.rb
+++ b/spec/lib/gitlab/background_migration/delete_duplicate_issuable_resource_links_spec.rb
@@ -5,6 +5,7 @@
 require 'spec_helper'
 
 RSpec.describe Gitlab::BackgroundMigration::DeleteDuplicateIssuableResourceLinks, feature_category: :database do
+  let(:organizations) { table(:organizations) }
   let(:namespaces) { table(:namespaces) }
   let(:projects) { table(:projects) }
   let(:users) { table(:users) }
@@ -14,10 +15,16 @@ RSpec.describe Gitlab::BackgroundMigration::DeleteDuplicateIssuableResourceLinks
   let(:issue_type) { table(:work_item_types).find_by!(base_type: issue_base_type_enum_value) }
 
   let(:user) { create_user(email: "test1@example.com", username: "test1") }
-  let(:namespace) { namespaces.create!(name: "test-1", path: "test-1", owner_id: user.id) }
+  let(:organization) { organizations.create!(name: 'organization', path: 'organization') }
+  let(:namespace) do
+    namespaces.create!(name: "test-1", path: "test-1", owner_id: user.id, organization_id: organization.id)
+  end
+
   let!(:project) do
     projects.create!(
-      id: 9999, namespace_id: namespace.id,
+      id: 9999,
+      organization_id: organization.id,
+      namespace_id: namespace.id,
       project_namespace_id: namespace.id,
       creator_id: user.id
     )
diff --git a/spec/lib/gitlab/background_migration/delete_invalid_protected_branch_merge_access_levels_spec.rb b/spec/lib/gitlab/background_migration/delete_invalid_protected_branch_merge_access_levels_spec.rb
index 1e5b9d30436..91532d5935b 100644
--- a/spec/lib/gitlab/background_migration/delete_invalid_protected_branch_merge_access_levels_spec.rb
+++ b/spec/lib/gitlab/background_migration/delete_invalid_protected_branch_merge_access_levels_spec.rb
@@ -4,6 +4,7 @@ require 'spec_helper'
 
 RSpec.describe Gitlab::BackgroundMigration::DeleteInvalidProtectedBranchMergeAccessLevels,
   feature_category: :source_code_management do
+  let(:organizations_table) { table(:organizations) }
   let(:projects_table) { table(:projects) }
   let(:protected_branches_table) { table(:protected_branches) }
   let(:namespaces_table) { table(:namespaces) }
@@ -13,13 +14,22 @@ RSpec.describe Gitlab::BackgroundMigration::DeleteInvalidProtectedBranchMergeAcc
 
   let(:user1) { users_table.create!(name: 'user1', email: 'user1@example.com', projects_limit: 5) }
 
-  let(:project_group) { namespaces_table.create!(name: 'group-1', path: 'group-1', type: 'Group') }
-  let(:project_namespace) { namespaces_table.create!(name: 'namespace', path: 'namespace-path-2', type: 'Project') }
+  let(:organization) { organizations_table.create!(name: 'organization', path: 'organization') }
+
+  let(:project_group) do
+    namespaces_table.create!(name: 'group-1', path: 'group-1', type: 'Group', organization_id: organization.id)
+  end
+
+  let(:project_namespace) do
+    namespaces_table.create!(name: 'namespace', path: 'namespace-2', type: 'Project', organization_id: organization.id)
+  end
+
   let!(:project_1) do
     projects_table
     .create!(
       name: 'project1',
       path: 'path1',
+      organization_id: organization.id,
       namespace_id: project_group.id,
       project_namespace_id: project_namespace.id,
       visibility_level: 0
diff --git a/spec/lib/gitlab/background_migration/delete_invalid_protected_branch_push_access_levels_spec.rb b/spec/lib/gitlab/background_migration/delete_invalid_protected_branch_push_access_levels_spec.rb
index 62201831dd1..e7cffc0395f 100644
--- a/spec/lib/gitlab/background_migration/delete_invalid_protected_branch_push_access_levels_spec.rb
+++ b/spec/lib/gitlab/background_migration/delete_invalid_protected_branch_push_access_levels_spec.rb
@@ -4,6 +4,7 @@ require 'spec_helper'
 
 RSpec.describe Gitlab::BackgroundMigration::DeleteInvalidProtectedBranchPushAccessLevels,
   feature_category: :source_code_management do
+  let(:organizations_table) { table(:organizations) }
   let(:projects_table) { table(:projects) }
   let(:protected_branches_table) { table(:protected_branches) }
   let(:namespaces_table) { table(:namespaces) }
@@ -13,17 +14,26 @@ RSpec.describe Gitlab::BackgroundMigration::DeleteInvalidProtectedBranchPushAcce
 
   let(:user1) { users_table.create!(name: 'user1', email: 'user1@example.com', projects_limit: 5) }
 
-  let(:project_group) { namespaces_table.create!(name: 'group-1', path: 'group-1', type: 'Group') }
-  let(:project_namespace) { namespaces_table.create!(name: 'namespace', path: 'namespace-path-2', type: 'Project') }
+  let(:organization) { organizations_table.create!(name: 'organization', path: 'organization') }
+
+  let(:project_group) do
+    namespaces_table.create!(name: 'group-1', path: 'group-1', type: 'Group', organization_id: organization.id)
+  end
+
+  let(:project_namespace) do
+    namespaces_table.create!(name: 'namespace', path: 'namespace-2', type: 'Project', organization_id: organization.id)
+  end
+
   let!(:project_1) do
     projects_table
-    .create!(
-      name: 'project1',
-      path: 'path1',
-      namespace_id: project_group.id,
-      project_namespace_id: project_namespace.id,
-      visibility_level: 0
-    )
+      .create!(
+        name: 'project1',
+        path: 'path1',
+        organization_id: organization.id,
+        namespace_id: project_group.id,
+        project_namespace_id: project_namespace.id,
+        visibility_level: 0
+      )
   end
 
   subject(:perform_migration) do
diff --git a/spec/lib/gitlab/background_migration/delete_invalid_protected_tag_create_access_levels_spec.rb b/spec/lib/gitlab/background_migration/delete_invalid_protected_tag_create_access_levels_spec.rb
index fd6cee9e4db..0ec249a6ef6 100644
--- a/spec/lib/gitlab/background_migration/delete_invalid_protected_tag_create_access_levels_spec.rb
+++ b/spec/lib/gitlab/background_migration/delete_invalid_protected_tag_create_access_levels_spec.rb
@@ -4,6 +4,7 @@ require 'spec_helper'
 
 RSpec.describe Gitlab::BackgroundMigration::DeleteInvalidProtectedTagCreateAccessLevels,
   feature_category: :source_code_management do
+  let(:organizations_table) { table(:organizations) }
   let(:projects_table) { table(:projects) }
   let(:protected_tags_table) { table(:protected_tags) }
   let(:namespaces_table) { table(:namespaces) }
@@ -13,17 +14,26 @@ RSpec.describe Gitlab::BackgroundMigration::DeleteInvalidProtectedTagCreateAcces
 
   let(:user1) { users_table.create!(name: 'user1', email: 'user1@example.com', projects_limit: 5) }
 
-  let(:project_group) { namespaces_table.create!(name: 'group-1', path: 'group-1', type: 'Group') }
-  let(:project_namespace) { namespaces_table.create!(name: 'namespace', path: 'namespace-path-2', type: 'Project') }
+  let(:organization) { organizations_table.create!(name: 'organization', path: 'organization') }
+
+  let(:project_group) do
+    namespaces_table.create!(name: 'group-1', path: 'group-1', type: 'Group', organization_id: organization.id)
+  end
+
+  let(:project_namespace) do
+    namespaces_table.create!(name: 'namespace', path: 'namespace-2', type: 'Project', organization_id: organization.id)
+  end
+
   let!(:project_1) do
     projects_table
-    .create!(
-      name: 'project1',
-      path: 'path1',
-      namespace_id: project_group.id,
-      project_namespace_id: project_namespace.id,
-      visibility_level: 0
-    )
+      .create!(
+        name: 'project1',
+        path: 'path1',
+        organization_id: organization.id,
+        namespace_id: project_group.id,
+        project_namespace_id: project_namespace.id,
+        visibility_level: 0
+      )
   end
 
   subject(:perform_migration) do
diff --git a/spec/lib/gitlab/background_migration/delete_orphaned_deploy_tokens_spec.rb b/spec/lib/gitlab/background_migration/delete_orphaned_deploy_tokens_spec.rb
index 45d3a8d36d4..0d213a4119d 100644
--- a/spec/lib/gitlab/background_migration/delete_orphaned_deploy_tokens_spec.rb
+++ b/spec/lib/gitlab/background_migration/delete_orphaned_deploy_tokens_spec.rb
@@ -3,11 +3,12 @@
 require 'spec_helper'
 
 RSpec.describe Gitlab::BackgroundMigration::DeleteOrphanedDeployTokens, feature_category: :continuous_delivery do
-  let!(:group) { table(:namespaces).create!(name: 'group', path: 'group') }
+  let!(:organization) { table(:organizations).create!(name: 'organization', path: 'organization') }
+  let!(:group) { table(:namespaces).create!(name: 'group', path: 'group', organization_id: organization.id) }
 
   let!(:project) do
     table(:projects).create!(name: 'project', path: 'project', namespace_id: group.id,
-      project_namespace_id: group.id)
+      project_namespace_id: group.id, organization_id: organization.id)
   end
 
   let!(:valid_project_deploy_token) do
diff --git a/spec/lib/gitlab/background_migration/delete_orphaned_packages_dependencies_spec.rb b/spec/lib/gitlab/background_migration/delete_orphaned_packages_dependencies_spec.rb
index edf8a876793..d6faf414ce2 100644
--- a/spec/lib/gitlab/background_migration/delete_orphaned_packages_dependencies_spec.rb
+++ b/spec/lib/gitlab/background_migration/delete_orphaned_packages_dependencies_spec.rb
@@ -20,10 +20,14 @@ RSpec.describe Gitlab::BackgroundMigration::DeleteOrphanedPackagesDependencies,
 
   let(:packages_dependencies) { table(:packages_dependencies) }
 
-  let!(:namespace) { table(:namespaces).create!(name: 'project', path: 'project', type: 'Project') }
+  let!(:organization) { table(:organizations).create!(name: 'organization', path: 'organization') }
+  let!(:namespace) do
+    table(:namespaces).create!(name: 'project', path: 'project', type: 'Project', organization_id: organization.id)
+  end
+
   let!(:project) do
     table(:projects).create!(name: 'project', path: 'project', project_namespace_id: namespace.id,
-      namespace_id: namespace.id)
+      namespace_id: namespace.id, organization_id: organization.id)
   end
 
   let!(:package) do
diff --git a/spec/lib/gitlab/background_migration/delete_orphans_approval_merge_request_rules2_spec.rb b/spec/lib/gitlab/background_migration/delete_orphans_approval_merge_request_rules2_spec.rb
index 81dd37f0fe9..f18d043928e 100644
--- a/spec/lib/gitlab/background_migration/delete_orphans_approval_merge_request_rules2_spec.rb
+++ b/spec/lib/gitlab/background_migration/delete_orphans_approval_merge_request_rules2_spec.rb
@@ -10,23 +10,26 @@ RSpec.describe Gitlab::BackgroundMigration::DeleteOrphansApprovalMergeRequestRul
     let(:pause_ms) { 0 }
     let(:connection) { ApplicationRecord.connection }
 
+    let(:organizations) { table(:organizations) }
     let(:namespaces) { table(:namespaces) }
     let(:projects) { table(:projects) }
     let(:approval_project_rules) { table(:approval_project_rules) }
     let(:approval_merge_request_rules) { table(:approval_merge_request_rules) }
     let(:approval_merge_request_rule_sources) { table(:approval_merge_request_rule_sources) }
     let(:security_orchestration_policy_configurations) { table(:security_orchestration_policy_configurations) }
-    let(:namespace) { namespaces.create!(name: 'name', path: 'path') }
+
+    let(:organization) { organizations.create!(name: 'organization', path: 'organization') }
+    let(:namespace) { namespaces.create!(name: 'name', path: 'path', organization_id: organization.id) }
     let(:project) do
-      projects
-        .create!(name: "project", path: "project", namespace_id: namespace.id, project_namespace_id: namespace.id)
+      projects.create!(name: "project", path: "project", namespace_id: namespace.id,
+        project_namespace_id: namespace.id, organization_id: organization.id)
     end
 
-    let(:namespace_2) { namespaces.create!(name: 'name_2', path: 'path_2') }
+    let(:namespace_2) { namespaces.create!(name: 'name_2', path: 'path_2', organization_id: organization.id) }
     let(:security_project) do
       projects
         .create!(name: "security_project", path: "security_project", namespace_id: namespace_2.id,
-          project_namespace_id: namespace_2.id)
+          project_namespace_id: namespace_2.id, organization_id: organization.id)
     end
 
     let!(:security_orchestration_policy_configuration) do
diff --git a/spec/lib/gitlab/background_migration/delete_orphans_approval_project_rules2_spec.rb b/spec/lib/gitlab/background_migration/delete_orphans_approval_project_rules2_spec.rb
index c6563efe173..084250e6838 100644
--- a/spec/lib/gitlab/background_migration/delete_orphans_approval_project_rules2_spec.rb
+++ b/spec/lib/gitlab/background_migration/delete_orphans_approval_project_rules2_spec.rb
@@ -10,27 +10,34 @@ RSpec.describe Gitlab::BackgroundMigration::DeleteOrphansApprovalProjectRules2,
     let(:pause_ms) { 0 }
     let(:connection) { ApplicationRecord.connection }
 
+    let(:organizations) { table(:organizations) }
     let(:namespaces) { table(:namespaces) }
     let(:projects) { table(:projects) }
     let(:approval_project_rules) { table(:approval_project_rules) }
     let(:approval_merge_request_rules) { table(:approval_merge_request_rules) }
     let(:approval_merge_request_rule_sources) { table(:approval_merge_request_rule_sources) }
     let(:security_orchestration_policy_configurations) { table(:security_orchestration_policy_configurations) }
-    let(:namespace) { namespaces.create!(name: 'name', path: 'path') }
+    let(:organization) { organizations.create!(name: 'organizations', path: 'organizations') }
+    let(:namespace) { namespaces.create!(name: 'name', path: 'path', organization_id: organization.id) }
     let(:project) do
-      projects
-        .create!(name: "project", path: "project", namespace_id: namespace.id, project_namespace_id: namespace.id)
+      projects.create!(
+        name: "project",
+        path: "project",
+        namespace_id: namespace.id,
+        project_namespace_id: namespace.id,
+        organization_id: organization.id
+      )
     end
 
     let(:merge_request) do
       table(:merge_requests).create!(target_project_id: project.id, target_branch: 'main', source_branch: 'feature')
     end
 
-    let(:namespace_2) { namespaces.create!(name: 'name_2', path: 'path_2') }
+    let(:namespace_2) { namespaces.create!(name: 'name_2', path: 'path_2', organization_id: organization.id) }
     let(:security_project) do
       projects
         .create!(name: "security_project", path: "security_project", namespace_id: namespace_2.id,
-          project_namespace_id: namespace_2.id)
+          project_namespace_id: namespace_2.id, organization_id: organization.id)
     end
 
     let!(:security_orchestration_policy_configuration) do
diff --git a/spec/lib/gitlab/background_migration/delete_stale_packages_npm_metadata_caches_spec.rb b/spec/lib/gitlab/background_migration/delete_stale_packages_npm_metadata_caches_spec.rb
index 116c9628924..20a8e0d025c 100644
--- a/spec/lib/gitlab/background_migration/delete_stale_packages_npm_metadata_caches_spec.rb
+++ b/spec/lib/gitlab/background_migration/delete_stale_packages_npm_metadata_caches_spec.rb
@@ -3,11 +3,14 @@
 require 'spec_helper'
 
 RSpec.describe Gitlab::BackgroundMigration::DeleteStalePackagesNpmMetadataCaches, feature_category: :package_registry do
-  let!(:namespace) { table(:namespaces).create!(name: 'group', path: 'group', type: 'Group') }
+  let!(:organization) { table(:organizations).create!(name: 'organization', path: 'organization') }
+  let!(:namespace) do
+    table(:namespaces).create!(name: 'group', path: 'group', type: 'Group', organization_id: organization.id)
+  end
 
   let!(:project) do
     table(:projects).create!(name: 'project', path: 'project', project_namespace_id: namespace.id,
-      namespace_id: namespace.id)
+      namespace_id: namespace.id, organization_id: organization.id)
   end
 
   let!(:cache_1) do
diff --git a/spec/lib/gitlab/background_migration/destroy_invalid_members_spec.rb b/spec/lib/gitlab/background_migration/destroy_invalid_members_spec.rb
index 24f95ae1850..4d098bb48a6 100644
--- a/spec/lib/gitlab/background_migration/destroy_invalid_members_spec.rb
+++ b/spec/lib/gitlab/background_migration/destroy_invalid_members_spec.rb
@@ -17,6 +17,7 @@ RSpec.describe Gitlab::BackgroundMigration::DestroyInvalidMembers, :migration, s
   end
 
   let(:users_table) { table(:users) }
+  let(:organizations_table) { table(:organizations) }
   let(:namespaces_table) { table(:namespaces) }
   let(:members_table) { table(:members) }
   let(:projects_table) { table(:projects) }
@@ -30,14 +31,23 @@ RSpec.describe Gitlab::BackgroundMigration::DestroyInvalidMembers, :migration, s
   let(:user6) { users_table.create!(name: 'user6', email: 'user6@example.com', projects_limit: 5) }
   let(:user7) { users_table.create!(name: 'user7', email: 'user7@example.com', projects_limit: 5) }
   let(:user8) { users_table.create!(name: 'user8', email: 'user8@example.com', projects_limit: 5) }
-  let!(:group1) { namespaces_table.create!(name: 'marvellous group 1', path: 'group-path-1', type: 'Group') }
-  let!(:group2) { namespaces_table.create!(name: 'outstanding group 2', path: 'group-path-2', type: 'Group') }
+  let(:organization) { organizations_table.create!(name: 'organization', path: 'organization') }
+
+  let!(:group1) do
+    namespaces_table.create!(name: 'group 1', path: 'group-path-1', type: 'Group', organization_id: organization.id)
+  end
+
+  let!(:group2) do
+    namespaces_table.create!(name: 'group 2', path: 'group-path-2', type: 'Group', organization_id: organization.id)
+  end
+
   let!(:project_namespace1) do
     namespaces_table.create!(
       name: 'fabulous project',
       path: 'project-path-1',
       type: 'ProjectNamespace',
-      parent_id: group1.id
+      parent_id: group1.id,
+      organization_id: organization.id
     )
   end
 
@@ -46,7 +56,8 @@ RSpec.describe Gitlab::BackgroundMigration::DestroyInvalidMembers, :migration, s
       name: 'fabulous project',
       path: 'project-path-1',
       project_namespace_id: project_namespace1.id,
-      namespace_id: group1.id
+      namespace_id: group1.id,
+      organization_id: organization.id
     )
   end
 
@@ -55,7 +66,8 @@ RSpec.describe Gitlab::BackgroundMigration::DestroyInvalidMembers, :migration, s
       name: 'splendiferous project',
       path: 'project-path-2',
       type: 'ProjectNamespace',
-      parent_id: group1.id
+      parent_id: group1.id,
+      organization_id: organization.id
     )
   end
 
@@ -64,7 +76,8 @@ RSpec.describe Gitlab::BackgroundMigration::DestroyInvalidMembers, :migration, s
       name: 'splendiferous project',
       path: 'project-path-2',
       project_namespace_id: project_namespace2.id,
-      namespace_id: group1.id
+      namespace_id: group1.id,
+      organization_id: organization.id
     )
   end
 
diff --git a/spec/lib/gitlab/background_migration/disable_legacy_open_source_license_for_inactive_public_projects_spec.rb b/spec/lib/gitlab/background_migration/disable_legacy_open_source_license_for_inactive_public_projects_spec.rb
index 953eb09032f..3adb70a5d61 100644
--- a/spec/lib/gitlab/background_migration/disable_legacy_open_source_license_for_inactive_public_projects_spec.rb
+++ b/spec/lib/gitlab/background_migration/disable_legacy_open_source_license_for_inactive_public_projects_spec.rb
@@ -3,6 +3,7 @@
 require 'spec_helper'
 
 RSpec.describe Gitlab::BackgroundMigration::DisableLegacyOpenSourceLicenseForInactivePublicProjects, :migration do
+  let(:organizations_table) { table(:organizations) }
   let(:namespaces_table) { table(:namespaces) }
   let(:projects_table) { table(:projects) }
   let(:project_settings_table) { table(:project_settings) }
@@ -21,36 +22,38 @@ RSpec.describe Gitlab::BackgroundMigration::DisableLegacyOpenSourceLicenseForIna
 
   let(:queries) { ActiveRecord::QueryRecorder.new { perform_migration } }
 
-  let(:namespace_1) { namespaces_table.create!(name: 'namespace', path: 'namespace-path-1') }
-  let(:project_namespace_2) { namespaces_table.create!(name: 'namespace', path: 'namespace-path-2', type: 'Project') }
-  let(:project_namespace_3) { namespaces_table.create!(name: 'namespace', path: 'namespace-path-3', type: 'Project') }
-  let(:project_namespace_4) { namespaces_table.create!(name: 'namespace', path: 'namespace-path-4', type: 'Project') }
-  let(:project_namespace_5) { namespaces_table.create!(name: 'namespace', path: 'namespace-path-5', type: 'Project') }
+  let(:organization) { organizations_table.create!(name: 'organization', path: 'organization') }
+
+  let(:namespace_1) { create_namespace('namespace-1') }
+  let(:project_namespace_2) { create_namespace('namespace-2', 'Project') }
+  let(:project_namespace_3) { create_namespace('namespace-3', 'Project') }
+  let(:project_namespace_4) { create_namespace('namespace-4', 'Project') }
+  let(:project_namespace_5) { create_namespace('namespace-5', 'Project') }
 
   let(:project_1) do
     projects_table.create!(
-      name: 'proj-1', path: 'path-1', namespace_id: namespace_1.id,
+      name: 'proj-1', path: 'path-1', namespace_id: namespace_1.id, organization_id: organization.id,
       project_namespace_id: project_namespace_2.id, visibility_level: 0
     )
   end
 
   let(:project_2) do
     projects_table.create!(
-      name: 'proj-2', path: 'path-2', namespace_id: namespace_1.id,
+      name: 'proj-2', path: 'path-2', namespace_id: namespace_1.id, organization_id: organization.id,
       project_namespace_id: project_namespace_3.id, visibility_level: 10
     )
   end
 
   let(:project_3) do
     projects_table.create!(
-      name: 'proj-3', path: 'path-3', namespace_id: namespace_1.id,
+      name: 'proj-3', path: 'path-3', namespace_id: namespace_1.id, organization_id: organization.id,
       project_namespace_id: project_namespace_4.id, visibility_level: 20, last_activity_at: '2021-01-01'
     )
   end
 
   let(:project_4) do
     projects_table.create!(
-      name: 'proj-4', path: 'path-4', namespace_id: namespace_1.id,
+      name: 'proj-4', path: 'path-4', namespace_id: namespace_1.id, organization_id: organization.id,
       project_namespace_id: project_namespace_5.id, visibility_level: 20, last_activity_at: '2022-01-01'
     )
   end
@@ -75,4 +78,8 @@ RSpec.describe Gitlab::BackgroundMigration::DisableLegacyOpenSourceLicenseForIna
   def migrated_attribute(project_id)
     project_settings_table.find(project_id).legacy_open_source_license_available
   end
+
+  def create_namespace(name, type = 'User')
+    namespaces_table.create!(name: name, path: name, type: type, organization_id: organization.id)
+  end
 end
diff --git a/spec/lib/gitlab/background_migration/disable_legacy_open_source_license_for_one_member_no_repo_projects_spec.rb b/spec/lib/gitlab/background_migration/disable_legacy_open_source_license_for_one_member_no_repo_projects_spec.rb
index 0a95a9b1fb4..f85f0fd5f3c 100644
--- a/spec/lib/gitlab/background_migration/disable_legacy_open_source_license_for_one_member_no_repo_projects_spec.rb
+++ b/spec/lib/gitlab/background_migration/disable_legacy_open_source_license_for_one_member_no_repo_projects_spec.rb
@@ -5,6 +5,7 @@ require 'spec_helper'
 RSpec.describe Gitlab::BackgroundMigration::DisableLegacyOpenSourceLicenseForOneMemberNoRepoProjects,
   :migration,
   schema: 20230721095222 do
+  let(:organizations_table) { table(:organizations) }
   let(:namespaces_table) { table(:namespaces) }
   let(:projects_table) { table(:projects) }
   let(:project_settings_table) { table(:project_settings) }
@@ -12,6 +13,8 @@ RSpec.describe Gitlab::BackgroundMigration::DisableLegacyOpenSourceLicenseForOne
   let(:users_table) { table(:users) }
   let(:project_authorizations_table) { table(:project_authorizations) }
 
+  let(:organization) { organizations_table.create!(name: "organization", path: "organization") }
+
   subject(:perform_migration) do
     described_class.new(start_id: projects_table.minimum(:id),
       end_id: projects_table.maximum(:id),
@@ -41,14 +44,24 @@ RSpec.describe Gitlab::BackgroundMigration::DisableLegacyOpenSourceLicenseForOne
   end
 
   def create_legacy_license_public_project(path, repo_size: 0, members: 1)
-    namespace = namespaces_table.create!(name: "namespace-#{path}", path: "namespace-#{path}")
-    project_namespace =
-      namespaces_table.create!(name: "-project-namespace-#{path}", path: "project-namespace-#{path}", type: 'Project')
+    namespace = namespaces_table.create!(
+      organization_id: organization.id,
+      name: "namespace-#{path}",
+      path: "namespace-#{path}"
+    )
+
+    project_namespace = namespaces_table.create!(
+      organization_id: organization.id,
+      name: "-project-namespace-#{path}",
+      path: "project-namespace-#{path}",
+      type: 'Project'
+    )
+
     project = projects_table
-                .create!(
-                  name: path, path: path, namespace_id: namespace.id,
-                  project_namespace_id: project_namespace.id, visibility_level: 20
-                )
+      .create!(
+        name: path, path: path, namespace_id: namespace.id, organization_id: organization.id,
+        project_namespace_id: project_namespace.id, visibility_level: 20
+      )
 
     members.times do |member_id|
       user = users_table.create!(email: "user#{member_id}-project-#{project.id}@gitlab.com", projects_limit: 100)
diff --git a/spec/lib/gitlab/background_migration/drop_vulnerabilities_without_finding_id_spec.rb b/spec/lib/gitlab/background_migration/drop_vulnerabilities_without_finding_id_spec.rb
index 7539445bf68..4f98005783a 100644
--- a/spec/lib/gitlab/background_migration/drop_vulnerabilities_without_finding_id_spec.rb
+++ b/spec/lib/gitlab/background_migration/drop_vulnerabilities_without_finding_id_spec.rb
@@ -10,6 +10,7 @@ RSpec.describe Gitlab::BackgroundMigration::DropVulnerabilitiesWithoutFindingId,
     skip_if_multiple_databases_are_setup(:sec)
   end
 
+  let(:organizations) { table(:organizations) }
   let(:namespaces) { table(:namespaces) }
   let(:projects) { table(:projects) }
   let(:users) { table(:users) }
@@ -19,10 +20,16 @@ RSpec.describe Gitlab::BackgroundMigration::DropVulnerabilitiesWithoutFindingId,
   let(:vulnerability_findings) { table(:vulnerability_occurrences) }
   let(:vulnerabilities) { table(:vulnerabilities) }
   let!(:user) { create_user(email: "test1@example.com", username: "test1") }
-  let!(:namespace) { namespaces.create!(name: "test-1", path: "test-1", owner_id: user.id) }
+  let!(:organization) { organizations.create!(name: 'organization', path: 'organization') }
+  let!(:namespace) do
+    namespaces.create!(name: "test-1", path: "test-1", owner_id: user.id, organization_id: organization.id)
+  end
+
   let!(:project) do
     projects.create!(
-      id: 9999, namespace_id: namespace.id,
+      id: 9999,
+      organization_id: organization.id,
+      namespace_id: namespace.id,
       project_namespace_id: namespace.id,
       creator_id: user.id
     )
diff --git a/spec/lib/gitlab/background_migration/fix_synced_epic_work_item_parent_links_spec.rb b/spec/lib/gitlab/background_migration/fix_synced_epic_work_item_parent_links_spec.rb
index 86053146056..7e6c475accb 100644
--- a/spec/lib/gitlab/background_migration/fix_synced_epic_work_item_parent_links_spec.rb
+++ b/spec/lib/gitlab/background_migration/fix_synced_epic_work_item_parent_links_spec.rb
@@ -4,18 +4,25 @@ require 'spec_helper'
 
 RSpec.describe Gitlab::BackgroundMigration::FixSyncedEpicWorkItemParentLinks, feature_category: :team_planning do
   let!(:author) { table(:users).create!(username: 'tester', projects_limit: 100) }
-  let!(:namespace) { table(:namespaces).create!(name: 'my test group 1', path: 'my-test-group-1') }
+  let!(:organization) { table(:organizations).create!(name: 'organization', path: 'organization') }
+  let!(:namespace) { table(:namespaces).create!(name: 'group 1', path: 'group-1', organization_id: organization.id) }
 
-  let!(:project_namespace1) { table(:namespaces).create!(name: 'namespace 1', path: 'namespace-2') }
-  let!(:project1) do
-    table(:projects).create!(name: 'my test project 1', path: 'my-test-project-1', namespace_id: namespace.id,
-      project_namespace_id: project_namespace1.id)
+  let!(:project_namespace1) do
+    table(:namespaces).create!(name: 'namespace 1', path: 'namespace-2', organization_id: organization.id)
+  end
+
+  let!(:project1) do
+    table(:projects).create!(name: 'my test project 1', path: 'my-test-project-1', namespace_id: namespace.id,
+      project_namespace_id: project_namespace1.id, organization_id: organization.id)
+  end
+
+  let!(:project_namespace2) do
+    table(:namespaces).create!(name: 'namespace 2', path: 'namespace-2', organization_id: organization.id)
   end
 
-  let!(:project_namespace2) { table(:namespaces).create!(name: 'namespace 2', path: 'namespace-2') }
   let!(:project2) do
     table(:projects).create!(name: 'my test project 2', path: 'my-test-project-2', namespace_id: namespace.id,
-      project_namespace_id: project_namespace2.id)
+      project_namespace_id: project_namespace2.id, organization_id: organization.id)
   end
 
   let!(:epics) { table(:epics) }
diff --git a/spec/lib/gitlab/background_migration/mark_duplicate_issuable_resource_links_spec.rb b/spec/lib/gitlab/background_migration/mark_duplicate_issuable_resource_links_spec.rb
index 1874018f957..f11e1517a7f 100644
--- a/spec/lib/gitlab/background_migration/mark_duplicate_issuable_resource_links_spec.rb
+++ b/spec/lib/gitlab/background_migration/mark_duplicate_issuable_resource_links_spec.rb
@@ -5,6 +5,7 @@
 require 'spec_helper'
 
 RSpec.describe Gitlab::BackgroundMigration::MarkDuplicateIssuableResourceLinks, feature_category: :database do
+  let(:organizations) { table(:organizations) }
   let(:namespaces) { table(:namespaces) }
   let(:projects) { table(:projects) }
   let(:users) { table(:users) }
@@ -14,12 +15,18 @@ RSpec.describe Gitlab::BackgroundMigration::MarkDuplicateIssuableResourceLinks,
   let(:issue_type) { table(:work_item_types).find_by!(base_type: issue_base_type_enum_value) }
 
   let(:user) { create_user(email: "test1@example.com", username: "test1") }
-  let(:namespace) { namespaces.create!(name: "test-1", path: "test-1", owner_id: user.id) }
+  let(:organization) { organizations.create!(name: 'organization', path: 'organization') }
+  let(:namespace) do
+    namespaces.create!(name: "test-1", path: "test-1", owner_id: user.id, organization_id: organization.id)
+  end
+
   let!(:project) do
     projects.create!(
-      id: 9999, namespace_id: namespace.id,
+      id: 9999,
+      namespace_id: namespace.id,
       project_namespace_id: namespace.id,
-      creator_id: user.id
+      creator_id: user.id,
+      organization_id: organization.id
     )
   end
 
diff --git a/spec/lib/gitlab/background_migration/mark_single_issuable_resource_links_spec.rb b/spec/lib/gitlab/background_migration/mark_single_issuable_resource_links_spec.rb
index eeea185a276..e3f3391e8ae 100644
--- a/spec/lib/gitlab/background_migration/mark_single_issuable_resource_links_spec.rb
+++ b/spec/lib/gitlab/background_migration/mark_single_issuable_resource_links_spec.rb
@@ -5,6 +5,7 @@
 require 'spec_helper'
 
 RSpec.describe Gitlab::BackgroundMigration::MarkSingleIssuableResourceLinks, feature_category: :database do
+  let(:organizations) { table(:organizations) }
   let(:namespaces) { table(:namespaces) }
   let(:projects) { table(:projects) }
   let(:users) { table(:users) }
@@ -14,10 +15,17 @@ RSpec.describe Gitlab::BackgroundMigration::MarkSingleIssuableResourceLinks, fea
   let(:issue_type) { table(:work_item_types).find_by!(base_type: issue_base_type_enum_value) }
 
   let(:user) { create_user(email: "test1@example.com", username: "test1") }
-  let(:namespace) { namespaces.create!(name: "test-1", path: "test-1", owner_id: user.id) }
+  let(:organization) { organizations.create!(name: 'organization', path: 'organization') }
+
+  let(:namespace) do
+    namespaces.create!(name: "test-1", path: "test-1", owner_id: user.id, organization_id: organization.id)
+  end
+
   let!(:project) do
     projects.create!(
-      id: 9999, namespace_id: namespace.id,
+      id: 9999,
+      organization_id: organization.id,
+      namespace_id: namespace.id,
       project_namespace_id: namespace.id,
       creator_id: user.id
     )
diff --git a/spec/lib/gitlab/background_migration/migrate_links_for_vulnerability_findings_spec.rb b/spec/lib/gitlab/background_migration/migrate_links_for_vulnerability_findings_spec.rb
index ca6762993eb..e939690a927 100644
--- a/spec/lib/gitlab/background_migration/migrate_links_for_vulnerability_findings_spec.rb
+++ b/spec/lib/gitlab/background_migration/migrate_links_for_vulnerability_findings_spec.rb
@@ -15,12 +15,18 @@ RSpec.describe Gitlab::BackgroundMigration::MigrateLinksForVulnerabilityFindings
   let(:vulnerability_occurrences) { table(:vulnerability_occurrences) }
   let(:vulnerability_finding_links) { table(:vulnerability_finding_links) }
   let(:link_hash) { { url: 'http://test.com' } }
-  let(:namespace1) { table(:namespaces).create!(name: 'namespace 1', path: 'namespace1') }
-  let(:project1) { table(:projects).create!(namespace_id: namespace1.id, project_namespace_id: namespace1.id) }
+
+  let(:organization) { table(:organizations).create!(name: 'organization', path: 'organization') }
+  let(:namespace) { table(:namespaces).create!(name: 'namespace', path: 'namespace', organization_id: organization.id) }
+  let(:project) do
+    table(:projects)
+      .create!(namespace_id: namespace.id, project_namespace_id: namespace.id, organization_id: organization.id)
+  end
+
   let(:user) { table(:users).create!(email: 'test1@example.com', projects_limit: 5) }
 
-  let(:scanner1) do
-    table(:vulnerability_scanners).create!(project_id: project1.id, external_id: 'test 1', name: 'test scanner 1')
+  let(:scanner) do
+    table(:vulnerability_scanners).create!(project_id: project.id, external_id: 'test', name: 'test scanner')
   end
 
   let(:stating_id) { vulnerability_occurrences.pluck(:id).min }
@@ -42,7 +48,7 @@ RSpec.describe Gitlab::BackgroundMigration::MigrateLinksForVulnerabilityFindings
 
   context 'without the presence of links key' do
     before do
-      create_finding!(project1.id, scanner1.id, { other_keys: 'test' })
+      create_finding!(project.id, scanner.id, { other_keys: 'test' })
     end
 
     it 'does not create any link' do
@@ -54,7 +60,7 @@ RSpec.describe Gitlab::BackgroundMigration::MigrateLinksForVulnerabilityFindings
 
   context 'with links equals to an array of nil element' do
     before do
-      create_finding!(project1.id, scanner1.id, { links: [nil] })
+      create_finding!(project.id, scanner.id, { links: [nil] })
     end
 
     it 'does not create any link' do
@@ -66,7 +72,7 @@ RSpec.describe Gitlab::BackgroundMigration::MigrateLinksForVulnerabilityFindings
 
   context 'with links equals to a string' do
     before do
-      create_finding!(project1.id, scanner1.id, { links: "wrong format" })
+      create_finding!(project.id, scanner.id, { links: "wrong format" })
     end
 
     it 'does not create any link' do
@@ -78,7 +84,7 @@ RSpec.describe Gitlab::BackgroundMigration::MigrateLinksForVulnerabilityFindings
 
   context 'with some elements which do not contain the key url' do
     let!(:finding) do
-      create_finding!(project1.id, scanner1.id, { links: [link_hash, "wrong format", {}] })
+      create_finding!(project.id, scanner.id, { links: [link_hash, "wrong format", {}] })
     end
 
     it 'creates links only to valid elements' do
@@ -94,7 +100,7 @@ RSpec.describe Gitlab::BackgroundMigration::MigrateLinksForVulnerabilityFindings
 
   context 'when link name is too long' do
     let!(:finding) do
-      create_finding!(project1.id, scanner1.id, { links: [{ name: 'A' * 300, url: 'https://foo' }] })
+      create_finding!(project.id, scanner.id, { links: [{ name: 'A' * 300, url: 'https://foo' }] })
     end
 
     it 'skips creation of link and logs error' do
@@ -109,7 +115,7 @@ RSpec.describe Gitlab::BackgroundMigration::MigrateLinksForVulnerabilityFindings
 
   context 'when link url is too long' do
     let!(:finding) do
-      create_finding!(project1.id, scanner1.id, { links: [{ url: "https://f#{'o' * 2050}" }] })
+      create_finding!(project.id, scanner.id, { links: [{ url: "https://f#{'o' * 2050}" }] })
     end
 
     it 'skips creation of link and logs error' do
@@ -124,7 +130,7 @@ RSpec.describe Gitlab::BackgroundMigration::MigrateLinksForVulnerabilityFindings
 
   context 'with links equals to an array of duplicated elements' do
     let!(:finding) do
-      create_finding!(project1.id, scanner1.id, { links: [link_hash, link_hash] })
+      create_finding!(project.id, scanner.id, { links: [link_hash, link_hash] })
     end
 
     it 'creates one new link' do
@@ -139,8 +145,8 @@ RSpec.describe Gitlab::BackgroundMigration::MigrateLinksForVulnerabilityFindings
   end
 
   context 'with existing links within raw_metadata' do
-    let!(:finding1) { create_finding!(project1.id, scanner1.id, { links: [link_hash] }) }
-    let!(:finding2) { create_finding!(project1.id, scanner1.id, { links: [link_hash] }) }
+    let!(:finding1) { create_finding!(project.id, scanner.id, { links: [link_hash] }) }
+    let!(:finding2) { create_finding!(project.id, scanner.id, { links: [link_hash] }) }
 
     it 'creates new link for each finding' do
       expect(Gitlab::AppLogger).not_to receive(:error)
@@ -151,7 +157,7 @@ RSpec.describe Gitlab::BackgroundMigration::MigrateLinksForVulnerabilityFindings
 
   context 'when Gitlab::Json throws exception JSON::ParserError' do
     before do
-      create_finding!(project1.id, scanner1.id, { links: [link_hash] })
+      create_finding!(project.id, scanner.id, { links: [link_hash] })
       allow(Gitlab::Json).to receive(:parse).and_raise(JSON::ParserError)
     end
 
@@ -163,7 +169,7 @@ RSpec.describe Gitlab::BackgroundMigration::MigrateLinksForVulnerabilityFindings
   end
 
   context 'with existing link records' do
-    let!(:finding) { create_finding!(project1.id, scanner1.id, { links: [link_hash] }) }
+    let!(:finding) { create_finding!(project.id, scanner.id, { links: [link_hash] }) }
 
     before do
       vulnerability_finding_links.create!(vulnerability_occurrence_id: finding.id, url: link_hash[:url])
diff --git a/spec/lib/gitlab/background_migration/migrate_os_sbom_occurrences_to_components_without_prefix_spec.rb b/spec/lib/gitlab/background_migration/migrate_os_sbom_occurrences_to_components_without_prefix_spec.rb
index cd34f49f570..3f19cf8981f 100644
--- a/spec/lib/gitlab/background_migration/migrate_os_sbom_occurrences_to_components_without_prefix_spec.rb
+++ b/spec/lib/gitlab/background_migration/migrate_os_sbom_occurrences_to_components_without_prefix_spec.rb
@@ -10,20 +10,24 @@ RSpec.describe Gitlab::BackgroundMigration::MigrateOsSbomOccurrencesToComponents
     skip_if_multiple_databases_are_setup(:sec)
   end
 
+  let(:organizations) { table(:organizations) }
   let(:projects) { table(:projects) }
   let(:namespaces) { table(:namespaces) }
   let(:sbom_components) { table(:sbom_components) }
   let(:sbom_component_versions) { table(:sbom_component_versions) }
   let(:sbom_occurrences) { table(:sbom_occurrences) }
 
-  let(:namespace) { namespaces.create!(name: 'gitlab', path: 'gitlab') }
+  let(:organization) { organizations.create!(name: 'organization', path: 'organization') }
+
+  let(:namespace) { namespaces.create!(name: 'gitlab', path: 'gitlab', organization_id: organization.id) }
   let(:project_namespace) do
-    namespaces.create!(name: 'project-1', path: 'project', type: 'Project', parent_id: namespace.id)
+    namespaces.create!(name: 'project-1', path: 'project', type: 'Project',
+      parent_id: namespace.id, organization_id: organization.id)
   end
 
   let(:project) do
     projects.create!(name: 'project-1', path: 'project-1', project_namespace_id: project_namespace.id,
-      namespace_id: namespace.id)
+      namespace_id: namespace.id, organization_id: organization.id)
   end
 
   def create_sbom_occurrence(src_component, src_component_version)
diff --git a/spec/lib/gitlab/background_migration/nullify_organization_id_for_snippets_spec.rb b/spec/lib/gitlab/background_migration/nullify_organization_id_for_snippets_spec.rb
index 8eebb45ad0b..d95b415d14e 100644
--- a/spec/lib/gitlab/background_migration/nullify_organization_id_for_snippets_spec.rb
+++ b/spec/lib/gitlab/background_migration/nullify_organization_id_for_snippets_spec.rb
@@ -3,11 +3,16 @@
 require 'spec_helper'
 
 RSpec.describe Gitlab::BackgroundMigration::NullifyOrganizationIdForSnippets, feature_category: :source_code_management do
+  let(:organizations) { table(:organizations) }
   let(:snippets) { table(:snippets) }
   let(:projects) { table(:projects) }
   let(:namespaces) { table(:namespaces) }
-  let(:namespace) { namespaces.create!(name: 'foo', path: 'foo') }
-  let!(:project) { projects.create!(namespace_id: namespace.id, project_namespace_id: namespace.id) }
+
+  let(:organization) { organizations.create!(name: 'organization', path: 'organization') }
+  let(:namespace) { namespaces.create!(name: 'foo', path: 'foo', organization_id: organization.id) }
+  let!(:project) do
+    projects.create!(namespace_id: namespace.id, project_namespace_id: namespace.id, organization_id: organization.id)
+  end
 
   let!(:personal_snippet) do
     snippets.create!(
diff --git a/spec/lib/gitlab/background_migration/populate_operation_visibility_permissions_from_operations_spec.rb b/spec/lib/gitlab/background_migration/populate_operation_visibility_permissions_from_operations_spec.rb
index 1ebdca136a3..027d77c1daf 100644
--- a/spec/lib/gitlab/background_migration/populate_operation_visibility_permissions_from_operations_spec.rb
+++ b/spec/lib/gitlab/background_migration/populate_operation_visibility_permissions_from_operations_spec.rb
@@ -3,15 +3,18 @@
 require 'spec_helper'
 
 RSpec.describe Gitlab::BackgroundMigration::PopulateOperationVisibilityPermissionsFromOperations do
+  let(:organizations) { table(:organizations) }
   let(:namespaces) { table(:namespaces) }
   let(:project_features) { table(:project_features) }
   let(:projects) { table(:projects) }
 
-  let(:namespace) { namespaces.create!(name: 'user', path: 'user') }
+  let(:organization) { organizations.create!(name: 'organization', path: 'organization') }
 
-  let(:proj_namespace1) { namespaces.create!(name: 'proj1', path: 'proj1', type: 'Project', parent_id: namespace.id) }
-  let(:proj_namespace2) { namespaces.create!(name: 'proj2', path: 'proj2', type: 'Project', parent_id: namespace.id) }
-  let(:proj_namespace3) { namespaces.create!(name: 'proj3', path: 'proj3', type: 'Project', parent_id: namespace.id) }
+  let(:namespace) { namespaces.create!(name: 'user', path: 'user', organization_id: organization.id) }
+
+  let(:proj_namespace1) { create_project_namespace('proj1') }
+  let(:proj_namespace2) { create_project_namespace('proj2') }
+  let(:proj_namespace3) { create_project_namespace('proj3') }
 
   let(:project1) { create_project('test1', proj_namespace1) }
   let(:project2) { create_project('test2', proj_namespace2) }
@@ -61,12 +64,23 @@ RSpec.describe Gitlab::BackgroundMigration::PopulateOperationVisibilityPermissio
     expect(record.environments_access_level).to eq(record.operations_access_level)
   end
 
+  def create_project_namespace(name)
+    namespaces.create!(
+      name: name,
+      path: name,
+      type: 'Project',
+      parent_id: namespace.id,
+      organization_id: organization.id
+    )
+  end
+
   def create_project(proj_name, proj_namespace)
     projects.create!(
       namespace_id: namespace.id,
       project_namespace_id: proj_namespace.id,
       name: proj_name,
-      path: proj_name
+      path: proj_name,
+      organization_id: organization.id
     )
   end
 
diff --git a/spec/lib/gitlab/background_migration/populate_vulnerability_dismissal_fields_spec.rb b/spec/lib/gitlab/background_migration/populate_vulnerability_dismissal_fields_spec.rb
index 00a9aaa4b6b..302bec09bce 100644
--- a/spec/lib/gitlab/background_migration/populate_vulnerability_dismissal_fields_spec.rb
+++ b/spec/lib/gitlab/background_migration/populate_vulnerability_dismissal_fields_spec.rb
@@ -11,6 +11,7 @@ RSpec.describe Gitlab::BackgroundMigration::PopulateVulnerabilityDismissalFields
   end
 
   let(:users) { table(:users) }
+  let(:organizations) { table(:organizations) }
   let(:namespaces) { table(:namespaces) }
   let(:projects) { table(:projects) }
   let(:vulnerabilities) { table(:vulnerabilities) }
@@ -20,8 +21,17 @@ RSpec.describe Gitlab::BackgroundMigration::PopulateVulnerabilityDismissalFields
   let(:feedback) { table(:vulnerability_feedback) }
 
   let(:user) { users.create!(name: 'test', email: 'test@example.com', projects_limit: 5) }
-  let(:namespace) { namespaces.create!(name: 'gitlab', path: 'gitlab-org') }
-  let(:project) { projects.create!(namespace_id: namespace.id, name: 'foo', project_namespace_id: namespace.id) }
+  let(:organization) { organizations.create!(name: 'organization', path: 'organization') }
+  let(:namespace) { namespaces.create!(name: 'gitlab', path: 'gitlab-org', organization_id: organization.id) }
+  let(:project) do
+    projects.create!(
+      namespace_id: namespace.id,
+      name: 'foo',
+      project_namespace_id: namespace.id,
+      organization_id: organization.id
+    )
+  end
+
   let(:vulnerability_1) do
     vulnerabilities.create!(title: 'title', state: 2, severity: 0,
       confidence: 5, report_type: 2, project_id: project.id, author_id: user.id
diff --git a/spec/lib/gitlab/background_migration/project_bot_user_details_bot_namespace_migration_spec.rb b/spec/lib/gitlab/background_migration/project_bot_user_details_bot_namespace_migration_spec.rb
index 6455e9f75d0..1e43566c31e 100644
--- a/spec/lib/gitlab/background_migration/project_bot_user_details_bot_namespace_migration_spec.rb
+++ b/spec/lib/gitlab/background_migration/project_bot_user_details_bot_namespace_migration_spec.rb
@@ -7,16 +7,23 @@ RSpec.describe Gitlab::BackgroundMigration::ProjectBotUserDetailsBotNamespaceMig
   let(:users) { table(:users) }
   let(:user_details) { table(:user_details) }
   let(:members) { table(:members) }
+  let(:organizations) { table(:organizations) }
   let(:projects) { table(:projects) }
   let(:namespaces) { table(:namespaces) }
 
-  let(:group) { namespaces.create!(name: 'group', path: 'group', type: 'Group') }
-  let(:subgroup) { namespaces.create!(name: 'subgroup', path: 'subgroup', type: 'Group') }
-  let(:group2) { namespaces.create!(name: 'group2', path: 'group2', type: 'Group') }
+  let(:organization) { organizations.create!(name: 'organization', path: 'organization') }
+
+  let(:group) { namespaces.create!(name: 'group', path: 'group', type: 'Group', organization_id: organization.id) }
+  let(:subgroup) { namespaces.create!(name: 'subgroup', path: 'sub', type: 'Group', organization_id: organization.id) }
+  let(:group2) { namespaces.create!(name: 'group2', path: 'group2', type: 'Group', organization_id: organization.id) }
+
+  let(:project_namespace) do
+    namespaces.create!(name: 'proj1', path: 'proj1', type: 'Project', organization_id: organization.id)
+  end
 
-  let(:project_namespace) { namespaces.create!(name: 'proj1', path: 'proj1', type: 'Project') }
   let(:project) do
     projects.create!(
+      organization_id: organization.id,
       namespace_id: group.id,
       project_namespace_id: project_namespace.id,
       name: 'proj1',
diff --git a/spec/lib/gitlab/background_migration/recalculate_dora_deployment_frequency_score_spec.rb b/spec/lib/gitlab/background_migration/recalculate_dora_deployment_frequency_score_spec.rb
index e87df4737dc..3c28d0258f6 100644
--- a/spec/lib/gitlab/background_migration/recalculate_dora_deployment_frequency_score_spec.rb
+++ b/spec/lib/gitlab/background_migration/recalculate_dora_deployment_frequency_score_spec.rb
@@ -6,13 +6,20 @@ RSpec.describe Gitlab::BackgroundMigration::RecalculateDoraDeploymentFrequencySc
   describe '#perform', :freeze_time do
     let(:environments) { table(:environments) }
     let(:namespaces) { table(:namespaces) }
+    let(:organizations) { table(:organizations) }
     let(:projects) { table(:projects) }
     let(:performance_scores) { table(:dora_performance_scores) }
     let(:daily_metrics) { table(:dora_daily_metrics) }
 
-    let!(:namespace) { namespaces.create!(name: 'gitlab', path: 'gitlab-org') }
+    let!(:organization) { organizations.create!(name: 'organization', path: 'organization') }
+    let!(:namespace) { namespaces.create!(name: 'gitlab', path: 'gitlab-org', organization_id: organization.id) }
     let!(:project) do
-      projects.create!(namespace_id: namespace.id, name: 'foo', project_namespace_id: namespace.id)
+      projects.create!(
+        namespace_id: namespace.id,
+        name: 'foo',
+        project_namespace_id: namespace.id,
+        organization_id: organization.id
+      )
     end
 
     let!(:production) { environments.create!(project_id: project.id, tier: 0, name: 'prod', slug: 'prod') }
diff --git a/spec/lib/gitlab/background_migration/recover_deleted_ml_model_version_packages_spec.rb b/spec/lib/gitlab/background_migration/recover_deleted_ml_model_version_packages_spec.rb
index 8d6e2d8877b..be34eae87f2 100644
--- a/spec/lib/gitlab/background_migration/recover_deleted_ml_model_version_packages_spec.rb
+++ b/spec/lib/gitlab/background_migration/recover_deleted_ml_model_version_packages_spec.rb
@@ -4,14 +4,18 @@ require 'spec_helper'
 
 RSpec.describe Gitlab::BackgroundMigration::RecoverDeletedMlModelVersionPackages, feature_category: :mlops do
   let(:ml_model_package_type) { 14 }
+  let(:organizations_table) { table(:organizations) }
   let(:namespaces_table) { table(:namespaces) }
   let(:projects_table) { table(:projects) }
   let(:packages_table) { table(:packages_packages) }
   let(:ml_models_table) { table(:ml_models) }
   let(:ml_model_versions_table) { table(:ml_model_versions) }
 
-  let(:namespace) { namespaces_table.create!(name: 'namespace', path: 'namespace-path-1') }
-  let(:project_namespace) { namespaces_table.create!(name: 'namespace', path: 'namespace-path-2', type: 'Project') }
+  let(:organization) { organizations_table.create!(name: 'organization', path: 'organization') }
+  let(:namespace) { namespaces_table.create!(name: 'namespace', path: 'namespace-1', organization_id: organization.id) }
+  let(:project_namespace) do
+    namespaces_table.create!(name: 'namespace', path: 'namespace-2', type: 'Project', organization_id: organization.id)
+  end
 
   let!(:project) do
     projects_table
@@ -20,6 +24,7 @@ RSpec.describe Gitlab::BackgroundMigration::RecoverDeletedMlModelVersionPackages
         path: 'path1',
         namespace_id: namespace.id,
         project_namespace_id: project_namespace.id,
+        organization_id: organization.id,
         visibility_level: 0
       )
   end
diff --git a/spec/lib/gitlab/background_migration/resolve_vulnerabilities_for_removed_analyzers_spec.rb b/spec/lib/gitlab/background_migration/resolve_vulnerabilities_for_removed_analyzers_spec.rb
index 56ebbbaa48e..8ec58e159f1 100644
--- a/spec/lib/gitlab/background_migration/resolve_vulnerabilities_for_removed_analyzers_spec.rb
+++ b/spec/lib/gitlab/background_migration/resolve_vulnerabilities_for_removed_analyzers_spec.rb
@@ -23,8 +23,13 @@ RSpec.describe Gitlab::BackgroundMigration::ResolveVulnerabilitiesForRemovedAnal
   let(:vulnerability_statistics) { table(:vulnerability_statistics) }
   let(:notes) { table(:notes) }
   let(:system_note_metadata) { table(:system_note_metadata) }
-  let(:namespace) { namespaces.create!(name: 'user', path: 'user') }
-  let(:project) { projects.create!(namespace_id: namespace.id, project_namespace_id: namespace.id) }
+
+  let(:organization) { table(:organizations).create!(name: 'organization', path: 'organization') }
+  let(:namespace) { namespaces.create!(name: 'user', path: 'user', organization_id: organization.id) }
+  let(:project) do
+    projects.create!(namespace_id: namespace.id, project_namespace_id: namespace.id, organization_id: organization.id)
+  end
+
   let(:vulnerability_resolved_by_user) { Users::Internal.security_bot }
   let(:vulnerability_created_by_user) do
     table(:users).create!(username: 'john_doe', email: 'johndoe@gitlab.com', projects_limit: 10)
@@ -287,8 +292,13 @@ RSpec.describe Gitlab::BackgroundMigration::ResolveVulnerabilitiesForRemovedAnal
             control = ActiveRecord::QueryRecorder.new { perform_migration }
 
             removed_scanners.map do |external_id|
-              new_namespace = namespaces.create!(name: 'user', path: 'user')
-              new_project = projects.create!(namespace_id: new_namespace.id, project_namespace_id: new_namespace.id)
+              new_namespace = namespaces.create!(name: 'user', path: 'user', organization_id: organization.id)
+
+              new_project = projects.create!(
+                namespace_id: new_namespace.id,
+                project_namespace_id: new_namespace.id,
+                organization_id: organization.id
+              )
               create_vulnerability(project_id: new_project.id, external_id: external_id)
             end
 
diff --git a/spec/lib/gitlab/background_migration/resync_has_vulnerabilities_spec.rb b/spec/lib/gitlab/background_migration/resync_has_vulnerabilities_spec.rb
index 6fdb6207f1c..ad8c6ee0797 100644
--- a/spec/lib/gitlab/background_migration/resync_has_vulnerabilities_spec.rb
+++ b/spec/lib/gitlab/background_migration/resync_has_vulnerabilities_spec.rb
@@ -9,6 +9,7 @@ RSpec.describe Gitlab::BackgroundMigration::ResyncHasVulnerabilities, feature_ca
   let(:identifiers) { table(:vulnerability_identifiers) }
   let(:scanners) { table(:vulnerability_scanners) }
   let!(:user) { table(:users).create!(email: 'author@example.com', username: 'author', projects_limit: 10) }
+  let(:organizations) { table(:organizations) }
   let(:namespaces) { table(:namespaces) }
   let(:projects) { table(:projects) }
 
@@ -73,13 +74,15 @@ RSpec.describe Gitlab::BackgroundMigration::ResyncHasVulnerabilities, feature_ca
     actually_has_vulnerabilities:,
     present_on_default_branch: true
   )
-    group_namespace = namespaces.create!(name: name, path: name)
-    project_namespace = namespaces.create!(name: name, path: name)
+    organization = organizations.create!(name: "#{name}-organization", path: "#{name}-organization")
+    group_namespace = namespaces.create!(name: name, path: name, organization_id: organization.id)
+    project_namespace = namespaces.create!(name: name, path: name, organization_id: organization.id)
     project = projects.create!(
       name: name,
       path: name,
       namespace_id: group_namespace.id,
-      project_namespace_id: project_namespace.id
+      project_namespace_id: project_namespace.id,
+      organization_id: organization.id
     )
     create_vulnerability(project, present_on_default_branch) if actually_has_vulnerabilities
     project_settings.create!(project_id: project.id, has_vulnerabilities: has_vulnerabilities_setting)
diff --git a/spec/lib/gitlab/background_migration/set_correct_vulnerability_state_spec.rb b/spec/lib/gitlab/background_migration/set_correct_vulnerability_state_spec.rb
index 81ea6a6abe3..02aa00e930d 100644
--- a/spec/lib/gitlab/background_migration/set_correct_vulnerability_state_spec.rb
+++ b/spec/lib/gitlab/background_migration/set_correct_vulnerability_state_spec.rb
@@ -12,14 +12,17 @@ RSpec.describe Gitlab::BackgroundMigration::SetCorrectVulnerabilityState,
     skip_if_multiple_databases_are_setup(:sec)
   end
 
-  let(:namespace) { table(:namespaces).create!(name: 'user', path: 'user') }
+  let(:organization) { table(:organizations).create!(name: 'organization', path: 'organization') }
+  let(:namespace) { table(:namespaces).create!(name: 'user', path: 'user', organization_id: organization.id) }
   let(:users) { table(:users) }
   let(:user) { create_user! }
   let(:project) do
     table(:projects).create!(
       namespace_id: namespace.id,
       project_namespace_id: namespace.id,
-      packages_enabled: false)
+      organization_id: organization.id,
+      packages_enabled: false
+    )
   end
 
   let(:identifiers) { table(:vulnerability_identifiers) }
diff --git a/spec/lib/gitlab/background_migration/set_legacy_open_source_license_available_for_non_public_projects_spec.rb b/spec/lib/gitlab/background_migration/set_legacy_open_source_license_available_for_non_public_projects_spec.rb
index 708845120b1..f4ed4c5802f 100644
--- a/spec/lib/gitlab/background_migration/set_legacy_open_source_license_available_for_non_public_projects_spec.rb
+++ b/spec/lib/gitlab/background_migration/set_legacy_open_source_license_available_for_non_public_projects_spec.rb
@@ -5,6 +5,7 @@ require 'spec_helper'
 RSpec.describe Gitlab::BackgroundMigration::SetLegacyOpenSourceLicenseAvailableForNonPublicProjects,
   :migration,
   schema: 20230721095222 do
+  let(:organizations_table) { table(:organizations) }
   let(:namespaces_table) { table(:namespaces) }
   let(:projects_table) { table(:projects) }
   let(:project_settings_table) { table(:project_settings) }
@@ -36,15 +37,30 @@ RSpec.describe Gitlab::BackgroundMigration::SetLegacyOpenSourceLicenseAvailableF
   end
 
   def create_legacy_license_project(path, visibility_level:)
-    namespace = namespaces_table.create!(name: "namespace-#{path}", path: "namespace-#{path}")
-    project_namespace = namespaces_table.create!(name: "project-namespace-#{path}", path: path, type: 'Project')
+    organization = organizations_table.create!(name: "organization-#{path}", path: "organization-#{path}")
+
+    namespace = namespaces_table.create!(
+      name: "namespace-#{path}",
+      path: "namespace-#{path}",
+      organization_id: organization.id
+    )
+
+    project_namespace = namespaces_table.create!(
+      name: "project-namespace-#{path}",
+      path: path,
+      type: 'Project',
+      organization_id: organization.id
+    )
+
     project = projects_table.create!(
+      organization_id: organization.id,
       name: path,
       path: path,
       namespace_id: namespace.id,
       project_namespace_id: project_namespace.id,
       visibility_level: visibility_level
     )
+
     project_settings_table.create!(project_id: project.id, legacy_open_source_license_available: true)
 
     project
diff --git a/spec/lib/gitlab/background_migration/update_owasp_top10_default_of_vulnerability_reads_spec.rb b/spec/lib/gitlab/background_migration/update_owasp_top10_default_of_vulnerability_reads_spec.rb
index 03f6d2b2102..76ebfa70f9b 100644
--- a/spec/lib/gitlab/background_migration/update_owasp_top10_default_of_vulnerability_reads_spec.rb
+++ b/spec/lib/gitlab/background_migration/update_owasp_top10_default_of_vulnerability_reads_spec.rb
@@ -12,6 +12,7 @@ RSpec.describe Gitlab::BackgroundMigration::UpdateOwaspTop10DefaultOfVulnerabili
     skip_if_multiple_databases_are_setup(:sec)
   end
 
+  let(:organizations) { table(:organizations) }
   let(:namespaces) { table(:namespaces) }
   let(:projects) { table(:projects) }
   let(:users) { table(:users) }
@@ -21,8 +22,12 @@ RSpec.describe Gitlab::BackgroundMigration::UpdateOwaspTop10DefaultOfVulnerabili
   let(:vulnerability_findings) { table(:vulnerability_occurrences) }
   let(:vulnerability_identifiers) { table(:vulnerability_identifiers) }
 
-  let(:namespace) { namespaces.create!(name: 'user', path: 'user') }
-  let(:project) { projects.create!(namespace_id: namespace.id, project_namespace_id: namespace.id) }
+  let(:organization) { organizations.create!(name: 'organization', path: 'organization') }
+  let(:namespace) { namespaces.create!(name: 'user', path: 'user', organization_id: organization.id) }
+  let(:project) do
+    projects.create!(namespace_id: namespace.id, project_namespace_id: namespace.id, organization_id: organization.id)
+  end
+
   let(:user) { users.create!(username: 'john_doe', email: 'johndoe@gitlab.com', projects_limit: 10) }
   let(:scanner) { scanners.create!(project_id: project.id, external_id: 'external_id', name: 'Test Scanner') }
 
diff --git a/spec/lib/gitlab/background_migration/update_sbom_occurrences_component_name_based_on_pep503_spec.rb b/spec/lib/gitlab/background_migration/update_sbom_occurrences_component_name_based_on_pep503_spec.rb
index 9a16e86a2ec..03cb8a9c1c1 100644
--- a/spec/lib/gitlab/background_migration/update_sbom_occurrences_component_name_based_on_pep503_spec.rb
+++ b/spec/lib/gitlab/background_migration/update_sbom_occurrences_component_name_based_on_pep503_spec.rb
@@ -12,10 +12,14 @@ RSpec.describe Gitlab::BackgroundMigration::UpdateSbomOccurrencesComponentNameBa
 
   let(:occurrences) { table(:sbom_occurrences) }
   let(:components) { table(:sbom_components) }
+  let(:organizations) { table(:organizations) }
   let(:projects) { table(:projects) }
   let(:namespaces) { table(:namespaces) }
-  let(:namespace) { namespaces.create!(name: 'name', path: 'path') }
-  let(:project) { projects.create!(namespace_id: namespace.id, project_namespace_id: namespace.id) }
+  let(:organization) { organizations.create!(name: 'organization', path: 'organization') }
+  let(:namespace) { namespaces.create!(name: 'name', path: 'path', organization_id: organization.id) }
+  let(:project) do
+    projects.create!(namespace_id: namespace.id, project_namespace_id: namespace.id, organization_id: organization.id)
+  end
 
   describe '#perform' do
     subject(:perform_migration) do
diff --git a/spec/lib/gitlab/database/migration_helpers_spec.rb b/spec/lib/gitlab/database/migration_helpers_spec.rb
index 6a3aaaef5be..24896462072 100644
--- a/spec/lib/gitlab/database/migration_helpers_spec.rb
+++ b/spec/lib/gitlab/database/migration_helpers_spec.rb
@@ -2818,14 +2818,35 @@ RSpec.describe Gitlab::Database::MigrationHelpers, feature_category: :database d
       end
     end
 
-    let(:namespaces)     { table(:namespaces) }
-    let(:projects)       { table(:projects) }
-    let(:issues)         { table(:issues) }
+    let_it_be(:organizations)  { table(:organizations) }
+    let_it_be(:namespaces)     { table(:namespaces) }
+    let_it_be(:projects)       { table(:projects) }
+    let_it_be(:issues)         { table(:issues) }
+
+    let_it_be(:organization) { organizations.create!(name: 'organization', path: 'organization') }
 
     def setup
-      namespace = namespaces.create!(name: 'foo', path: 'foo', type: Namespaces::UserNamespace.sti_name)
-      project_namespace = namespaces.create!(name: 'project-foo', path: 'project-foo', type: 'Project', parent_id: namespace.id, visibility_level: 20)
-      projects.create!(namespace_id: namespace.id, project_namespace_id: project_namespace.id)
+      namespace = namespaces.create!(
+        name: 'foo',
+        path: 'foo',
+        type: Namespaces::UserNamespace.sti_name,
+        organization_id: organization.id
+      )
+
+      project_namespace = namespaces.create!(
+        name: 'project-foo',
+        path: 'project-foo',
+        type: 'Project',
+        organization_id: organization.id,
+        parent_id: namespace.id,
+        visibility_level: 20
+      )
+
+      projects.create!(
+        namespace_id: namespace.id,
+        project_namespace_id: project_namespace.id,
+        organization_id: organization.id
+      )
     end
 
     it 'generates iids properly for models created after the migration' do
diff --git a/spec/lib/gitlab/database/schema_cache_with_renamed_table_spec.rb b/spec/lib/gitlab/database/schema_cache_with_renamed_table_spec.rb
index d9e6d1220ba..94d0f4caff5 100644
--- a/spec/lib/gitlab/database/schema_cache_with_renamed_table_spec.rb
+++ b/spec/lib/gitlab/database/schema_cache_with_renamed_table_spec.rb
@@ -67,9 +67,15 @@ RSpec.describe Gitlab::Database::SchemaCacheWithRenamedTable do
     end
 
     describe 'when the table behind a model is actually a view' do
+      let(:organization) { create(:organization) }
       let(:group) { create(:group) }
       let(:attrs) do
-        attributes_for(:project, namespace_id: group.id, project_namespace_id: group.id).except(:creator, :organization)
+        attributes_for(
+          :project,
+          namespace_id: group.id,
+          project_namespace_id: group.id,
+          organization_id: organization.id
+        ).except(:creator)
       end
 
       let(:record) { old_model.create!(attrs) }
diff --git a/spec/lib/gitlab/sidekiq_middleware/identity/passthrough_spec.rb b/spec/lib/gitlab/sidekiq_middleware/identity/passthrough_spec.rb
new file mode 100644
index 00000000000..e7b6edac4d8
--- /dev/null
+++ b/spec/lib/gitlab/sidekiq_middleware/identity/passthrough_spec.rb
@@ -0,0 +1,51 @@
+# frozen_string_literal: true
+
+require 'spec_helper'
+
+RSpec.describe Gitlab::SidekiqMiddleware::Identity::Passthrough, :request_store, feature_category: :system_access do
+  let_it_be(:primary_user) { create(:user) }
+  let_it_be(:scoped_user) { create(:user) }
+
+  let(:worker) { Class.new }
+  let(:job) { { 'jid' => 123 } }
+  let(:queue) { 'test_queue' }
+
+  subject(:middleware) { described_class.new }
+
+  describe '#call' do
+    context 'when composite identity is linked' do
+      before do
+        ::Gitlab::Auth::Identity.new(primary_user).link!(scoped_user)
+      end
+
+      context 'when user has a composite identity' do
+        before do
+          allow(primary_user).to receive(:has_composite_identity?).and_return(true)
+        end
+
+        it 'adds composite identity to job payload' do
+          expect { |b| middleware.call(worker, job, queue, nil, &b) }.to yield_control
+
+          expect(::Gitlab::Auth::Identity::COMPOSITE_IDENTITY_SIDEKIQ_ARG).to eq 'sqci'
+          expect(job['sqci']).to eq([primary_user.id, scoped_user.id])
+        end
+      end
+
+      context 'when user does not have composite identity' do
+        it 'does not modify job payload' do
+          expect { |b| middleware.call(worker, job, queue, nil, &b) }.to yield_control
+
+          expect(job[::Gitlab::Auth::Identity::COMPOSITE_IDENTITY_SIDEKIQ_ARG]).to be_nil
+        end
+      end
+    end
+
+    context 'when composite identity has not been linked' do
+      it 'does not modify job payload' do
+        expect { |b| middleware.call(worker, job, queue, nil, &b) }.to yield_control
+
+        expect(job[::Gitlab::Auth::Identity::COMPOSITE_IDENTITY_SIDEKIQ_ARG]).to be_nil
+      end
+    end
+  end
+end
diff --git a/spec/lib/gitlab/sidekiq_middleware/identity/restore_spec.rb b/spec/lib/gitlab/sidekiq_middleware/identity/restore_spec.rb
new file mode 100644
index 00000000000..0c5dfd3eba3
--- /dev/null
+++ b/spec/lib/gitlab/sidekiq_middleware/identity/restore_spec.rb
@@ -0,0 +1,76 @@
+# frozen_string_literal: true
+
+require 'spec_helper'
+
+RSpec.describe Gitlab::SidekiqMiddleware::Identity::Restore, :request_store, feature_category: :system_access do
+  let_it_be(:primary_user) { create(:user, username: 'gitlab-duo') }
+  let_it_be(:scoped_user) { create(:user) }
+
+  let(:job) { { 'jid' => 123 } }
+  let(:queue) { 'test_queue' }
+  let(:worker) do
+    Class.new do
+      include ::Sidekiq::Worker
+
+      def perform(user_id)
+        ::Gitlab::Auth::Identity.new(::User.find(user_id)).tap do |identity|
+          raise ArgumentError unless identity.linked?
+        end
+      end
+    end
+  end
+
+  subject(:middleware) { described_class.new }
+
+  before do
+    stub_const('TestIdentityWorker', worker)
+  end
+
+  describe '#call' do
+    context 'when composite identity has been linked' do
+      let(:job) { { 'jid' => 123, 'sqci' => [primary_user.id, scoped_user.id] } }
+
+      it 'yields control' do
+        expect { |b| middleware.call(worker.new, job, queue, &b) }.to yield_control
+      end
+
+      it 'restores composite identity' do
+        middleware.call(worker.new, job, queue) do
+          identity = ::Gitlab::Auth::Identity.new(primary_user)
+
+          expect(identity).to be_linked
+          expect(identity).to be_valid
+          expect(identity.scoped_user).to eq(scoped_user)
+        end
+      end
+    end
+
+    context 'when composite identity has not been linked' do
+      it 'restores composite identity' do
+        middleware.call(worker.new, job, queue) do
+          expect(::Gitlab::Auth::Identity.new(primary_user)).not_to be_linked
+        end
+      end
+    end
+  end
+
+  describe 'composite identity restoration end-to-end' do
+    before do
+      allow_any_instance_of(::User).to receive(:has_composite_identity?) do |user| # rubocop:disable RSpec/AnyInstanceOf -- works more reliably
+        user.username == 'gitlab-duo'
+      end
+
+      ::Gitlab::Auth::Identity.new(primary_user).link!(scoped_user)
+    end
+
+    it 'restores identity' do
+      assertion = -> do
+        Sidekiq::Testing.inline! do
+          TestIdentityWorker.perform_async(primary_user.id)
+        end
+      end
+
+      expect { assertion.call }.not_to raise_error
+    end
+  end
+end
diff --git a/spec/models/ability_spec.rb b/spec/models/ability_spec.rb
index 35732df0420..30445ac0add 100644
--- a/spec/models/ability_spec.rb
+++ b/spec/models/ability_spec.rb
@@ -480,6 +480,7 @@ RSpec.describe Ability, feature_category: :system_access do
     let_it_be(:group) { create(:group, :private) }
     let_it_be(:user) { create(:user) }
     let_it_be(:delegated_user) { create(:user) }
+
     let(:request_store_key) { format(::Gitlab::Auth::Identity::COMPOSITE_IDENTITY_KEY_FORMAT, user.id) }
 
     subject { described_class.allowed?(user, :read_group, group) }
diff --git a/spec/models/packages/package_spec.rb b/spec/models/packages/package_spec.rb
index f9f9b07a4ed..aebdb9df434 100644
--- a/spec/models/packages/package_spec.rb
+++ b/spec/models/packages/package_spec.rb
@@ -356,18 +356,6 @@ RSpec.describe Packages::Package, type: :model, feature_category: :package_regis
 
         subject
       end
-
-      context 'when the use_exclusive_lease_in_mvn_find_or_create_package FF is disabled' do
-        before do
-          stub_feature_flags(use_exclusive_lease_in_mvn_find_or_create_package: false)
-        end
-
-        it 'does not execute advisory lock' do
-          expect(maven_package.connection).not_to receive(:execute)
-
-          subject
-        end
-      end
     end
 
     Packages::Package.package_types.keys.without('conan').each do |pt|
diff --git a/spec/requests/api/admin/token_spec.rb b/spec/requests/api/admin/token_spec.rb
index 60b6dda764a..1c9415489ef 100644
--- a/spec/requests/api/admin/token_spec.rb
+++ b/spec/requests/api/admin/token_spec.rb
@@ -12,6 +12,7 @@ RSpec.describe API::Admin::Token, :aggregate_failures, feature_category: :system
   let_it_be(:deploy_token) { create(:deploy_token) }
   let_it_be(:oauth_application) { create(:oauth_application) }
   let_it_be(:cluster_agent_token) { create(:cluster_agent_token, token_encrypted: nil) }
+  let_it_be(:runner_authentication_token) { create(:ci_runner, registration_type: :authenticated_user) }
 
   let(:plaintext) { nil }
   let(:params) { { token: plaintext } }
@@ -27,7 +28,8 @@ RSpec.describe API::Admin::Token, :aggregate_failures, feature_category: :system
             [ref(:deploy_token), lazy { deploy_token.token }],
             [ref(:user), lazy { user.feed_token }],
             [ref(:oauth_application), lazy { oauth_application.plaintext_secret }],
-            [ref(:cluster_agent_token), lazy { cluster_agent_token.token }]
+            [ref(:cluster_agent_token), lazy { cluster_agent_token.token }],
+            [ref(:runner_authentication_token), lazy { runner_authentication_token.token }]
           ]
         end
 
diff --git a/spec/requests/api/merge_requests_spec.rb b/spec/requests/api/merge_requests_spec.rb
index 3366fdf713d..9c257158460 100644
--- a/spec/requests/api/merge_requests_spec.rb
+++ b/spec/requests/api/merge_requests_spec.rb
@@ -2660,6 +2660,77 @@ RSpec.describe API::MergeRequests, :aggregate_failures, feature_category: :sourc
         end
       end
     end
+
+    context 'when user is using a composite identity', :request_store, :sidekiq_inline do
+      let(:user) { create(:user, username: 'gitlab-duo') }
+
+      before do
+        allow_any_instance_of(::User).to receive(:has_composite_identity?) do |user|
+          user.username == 'gitlab-duo'
+        end
+      end
+
+      let(:params) do
+        {
+          title: 'Test merge request',
+          source_branch: 'markdown',
+          target_branch: 'master',
+          author_id: user.id
+        }
+      end
+
+      context 'when composite identity is missing' do
+        it 'responds with 403 forbidden http status' do
+          post api("/projects/#{project.id}/merge_requests", user), params: params
+
+          expect(response).to have_gitlab_http_status(:forbidden)
+        end
+      end
+
+      context 'when composite identity is defined' do
+        before do
+          ::Gitlab::Auth::Identity.new(user).link!(user2)
+        end
+
+        context 'when both users can create a merge request' do
+          before do
+            project.add_developer(user)
+            project.add_developer(user2)
+          end
+
+          it 'creates a merge request' do
+            post api("/projects/#{project.id}/merge_requests", user), params: params
+
+            expect(response).to have_gitlab_http_status(:created)
+          end
+
+          context 'when composite identity has not been passed to Sidekiq' do
+            before do
+              allow(::Gitlab::Auth::Identity).to receive(:sidekiq_restore!)
+            end
+
+            it 'raises an error' do
+              post api("/projects/#{project.id}/merge_requests", user), params: params
+
+              expect(response).to have_gitlab_http_status(:forbidden)
+            end
+          end
+        end
+
+        context 'when scoped user can not create a merge request' do
+          before do
+            project.add_developer(user)
+            project.add_reporter(user2)
+          end
+
+          it 'does not create a merge request' do
+            post api("/projects/#{project.id}/merge_requests", user), params: params
+
+            expect(response).to have_gitlab_http_status(:forbidden)
+          end
+        end
+      end
+    end
   end
 
   describe 'PUT /projects/:id/merge_requests/:merge_request_iid' do
diff --git a/spec/rubocop/cop/migration/prevent_adding_columns_spec.rb b/spec/rubocop/cop/migration/prevent_adding_columns_spec.rb
index 6b2ca190188..b2f019c30f0 100644
--- a/spec/rubocop/cop/migration/prevent_adding_columns_spec.rb
+++ b/spec/rubocop/cop/migration/prevent_adding_columns_spec.rb
@@ -21,7 +21,7 @@ RSpec.describe RuboCop::Cop::Migration::PreventAddingColumns, feature_category:
 
     context 'with wide tables' do
       it 'registers an offense when adding a column to a wide table' do
-        offense = '`projects` is a large table with several columns, [...]'
+        offense = '`projects` is over the limit authorized, [...]'
 
         expect_offense(<<~RUBY)
           def up
@@ -32,7 +32,7 @@ RSpec.describe RuboCop::Cop::Migration::PreventAddingColumns, feature_category:
       end
 
       it 'registers an offense when adding a column with default to a wide table' do
-        offense = '`users` is a large table with several columns, [...]'
+        offense = '`users` is over the limit authorized, [...]'
 
         expect_offense(<<~RUBY)
           def up
@@ -43,7 +43,7 @@ RSpec.describe RuboCop::Cop::Migration::PreventAddingColumns, feature_category:
       end
 
       it 'registers an offense when adding a reference' do
-        offense = '`ci_builds` is a large table with several columns, [...]'
+        offense = '`ci_builds` is over the limit authorized, [...]'
 
         expect_offense(<<~RUBY)
           def up
@@ -54,7 +54,7 @@ RSpec.describe RuboCop::Cop::Migration::PreventAddingColumns, feature_category:
       end
 
       it 'registers an offense when adding timestamps' do
-        offense = '`projects` is a large table with several columns, [...]'
+        offense = '`projects` is over the limit authorized, [...]'
 
         expect_offense(<<~RUBY)
           def up
@@ -83,13 +83,13 @@ RSpec.describe RuboCop::Cop::Migration::PreventAddingColumns, feature_category:
       end
     end
 
-    context 'when targeting a large table' do
-      it 'registers an offense for audit_events' do
-        offense = '`audit_events` is a large table with several columns, [...]'
+    context 'when targeting an over limit table' do
+      it 'registers an offense for issues' do
+        offense = '`issues` is over the limit authorized, [...]'
 
         expect_offense(<<~RUBY)
           def up
-            add_column(:audit_events, :another_column, :boolean, default: false)
+            add_column(:issues, :another_column, :boolean, default: false)
             ^^^^^^^^^^ #{offense}
           end
         RUBY
diff --git a/spec/rubocop/cop/migration/prevent_index_creation_spec.rb b/spec/rubocop/cop/migration/prevent_index_creation_spec.rb
index 2daab714cad..3a3409b67db 100644
--- a/spec/rubocop/cop/migration/prevent_index_creation_spec.rb
+++ b/spec/rubocop/cop/migration/prevent_index_creation_spec.rb
@@ -3,30 +3,11 @@
 require 'rubocop_spec_helper'
 require_relative '../../../../rubocop/cop/migration/prevent_index_creation'
 
-RSpec.describe RuboCop::Cop::Migration::PreventIndexCreation do
+RSpec.describe RuboCop::Cop::Migration::PreventIndexCreation, feature_category: :database do
+  include RuboCop::MigrationHelpers
+
   let(:forbidden_tables) do
-    %w[
-      ci_builds
-      namespaces
-      projects
-      users
-      merge_requests
-      merge_request_metrics
-      merge_request_diffs
-      merge_request_diff_commits
-      notes
-      web_hook_logs
-      events
-      project_statistics
-      sent_notifications
-      issues
-      issue_search_data
-      packages_packages
-      vulnerability_occurrences
-      sbom_occurrences
-      security_findings
-      deployments
-    ].freeze
+    described_class::FORBIDDEN_TABLES + large_tables
   end
 
   context 'when in migration' do
@@ -121,7 +102,7 @@ RSpec.describe RuboCop::Cop::Migration::PreventIndexCreation do
         it "registers an offense when add_concurrent_index is used", :aggregate_failures do
           expect_offense(<<~RUBY)
             INDEX_NAME = "index_name"
-            TABLE_NAME = :ci_builds
+            TABLE_NAME = :projects
             disable_ddl_transaction!
 
             def change
@@ -134,7 +115,7 @@ RSpec.describe RuboCop::Cop::Migration::PreventIndexCreation do
         it "registers an offense when prepare_async_index is used", :aggregate_failures do
           expect_offense(<<~RUBY)
             INDEX_NAME = "index_name"
-            TABLE_NAME = :ci_builds
+            TABLE_NAME = :projects
             disable_ddl_transaction!
 
             def change
diff --git a/spec/scripts/trigger-build_spec.rb b/spec/scripts/trigger-build_spec.rb
index a1bedd19ed3..6a853fed7bc 100644
--- a/spec/scripts/trigger-build_spec.rb
+++ b/spec/scripts/trigger-build_spec.rb
@@ -21,7 +21,8 @@ RSpec.describe Trigger, feature_category: :tooling do
       'GITLAB_USER_NAME' => 'gitlab_user_name',
       'GITLAB_USER_LOGIN' => 'gitlab_user_login',
       'QA_IMAGE' => 'qa_image',
-      'DOCS_PROJECT_API_TOKEN' => nil
+      'DOCS_PROJECT_API_TOKEN' => nil,
+      'DOCS_HUGO_PROJECT_API_TOKEN' => nil
     }
   end
 
@@ -569,7 +570,7 @@ RSpec.describe Trigger, feature_category: :tooling do
         end
 
         it 'returns the docs-specific access token' do
-          expect(described_class.access_token).to eq(docs_project_api_token)
+          expect(subject.access_token).to eq(docs_project_api_token)
         end
       end
 
@@ -579,7 +580,7 @@ RSpec.describe Trigger, feature_category: :tooling do
         end
 
         it 'returns the default access token' do
-          expect(described_class.access_token).to eq(Trigger::Base.access_token)
+          expect(subject.access_token).to eq(Trigger::Base.new.access_token)
         end
       end
     end
@@ -665,6 +666,223 @@ RSpec.describe Trigger, feature_category: :tooling do
     end
   end
 
+  describe Trigger::DocsHugo do
+    let(:downstream_project_path) { 'gitlab-org/technical-writing-group/gitlab-docs-hugo' }
+
+    describe '#variables' do
+      describe "BRANCH_CE" do
+        before do
+          stub_env('CI_PROJECT_PATH', 'gitlab-org/gitlab-foss')
+        end
+
+        context 'when CI_PROJECT_PATH is gitlab-org/gitlab-foss' do
+          it 'sets BRANCH_CE to CI_COMMIT_REF_NAME' do
+            expect(subject.variables['BRANCH_CE']).to eq(env['CI_COMMIT_REF_NAME'])
+          end
+        end
+      end
+
+      describe "BRANCH_EE" do
+        before do
+          stub_env('CI_PROJECT_PATH', 'gitlab-org/gitlab')
+        end
+
+        context 'when CI_PROJECT_PATH is gitlab-org/gitlab' do
+          it 'sets BRANCH_EE to CI_COMMIT_REF_NAME' do
+            expect(subject.variables['BRANCH_EE']).to eq(env['CI_COMMIT_REF_NAME'])
+          end
+        end
+      end
+
+      describe "BRANCH_RUNNER" do
+        before do
+          stub_env('CI_PROJECT_PATH', 'gitlab-org/gitlab-runner')
+        end
+
+        context 'when CI_PROJECT_PATH is gitlab-org/gitlab-runner' do
+          it 'sets BRANCH_RUNNER to CI_COMMIT_REF_NAME' do
+            expect(subject.variables['BRANCH_RUNNER']).to eq(env['CI_COMMIT_REF_NAME'])
+          end
+        end
+      end
+
+      describe "BRANCH_OMNIBUS" do
+        before do
+          stub_env('CI_PROJECT_PATH', 'gitlab-org/omnibus-gitlab')
+        end
+
+        context 'when CI_PROJECT_PATH is gitlab-org/omnibus-gitlab' do
+          it 'sets BRANCH_OMNIBUS to CI_COMMIT_REF_NAME' do
+            expect(subject.variables['BRANCH_OMNIBUS']).to eq(env['CI_COMMIT_REF_NAME'])
+          end
+        end
+      end
+
+      describe "BRANCH_CHARTS" do
+        before do
+          stub_env('CI_PROJECT_PATH', 'gitlab-org/charts/gitlab')
+        end
+
+        context 'when CI_PROJECT_PATH is gitlab-org/charts/gitlab' do
+          it 'sets BRANCH_CHARTS to CI_COMMIT_REF_NAME' do
+            expect(subject.variables['BRANCH_CHARTS']).to eq(env['CI_COMMIT_REF_NAME'])
+          end
+        end
+      end
+
+      describe "BRANCH_OPERATOR" do
+        before do
+          stub_env('CI_PROJECT_PATH', 'gitlab-org/cloud-native/gitlab-operator')
+        end
+
+        context 'when CI_PROJECT_PATH is gitlab-org/cloud-native/gitlab-operator' do
+          it 'sets BRANCH_OPERATOR to CI_COMMIT_REF_NAME' do
+            expect(subject.variables['BRANCH_OPERATOR']).to eq(env['CI_COMMIT_REF_NAME'])
+          end
+        end
+      end
+
+      describe "REVIEW_SLUG" do
+        before do
+          stub_env('CI_PROJECT_PATH', 'gitlab-org/gitlab-foss')
+        end
+
+        context 'when CI_MERGE_REQUEST_IID is set' do
+          it 'sets REVIEW_SLUG' do
+            expect(subject.variables['REVIEW_SLUG']).to eq("ce-#{env['CI_MERGE_REQUEST_IID']}")
+          end
+        end
+
+        context 'when CI_MERGE_REQUEST_IID is not set' do
+          before do
+            stub_env('CI_MERGE_REQUEST_IID', nil)
+          end
+
+          it 'sets REVIEW_SLUG' do
+            expect(subject.variables['REVIEW_SLUG']).to eq("ce-#{env['CI_COMMIT_REF_SLUG']}")
+          end
+        end
+      end
+    end
+
+    describe '.access_token' do
+      context 'when DOCS_HUGO_PROJECT_API_TOKEN is set' do
+        let(:docs_hugo_project_api_token) { 'docs_hugo_project_api_token' }
+
+        before do
+          stub_env('DOCS_HUGO_PROJECT_API_TOKEN', docs_hugo_project_api_token)
+        end
+
+        it 'returns the docs-specific access token' do
+          expect(subject.access_token).to eq(docs_hugo_project_api_token)
+        end
+      end
+
+      context 'when DOCS_HUGO_PROJECT_API_TOKEN is not set' do
+        before do
+          stub_env('DOCS_HUGO_PROJECT_API_TOKEN', nil)
+        end
+
+        it 'returns the default access token' do
+          expect(subject.access_token).to eq(Trigger::Base.new.access_token)
+        end
+      end
+    end
+
+    describe '#invoke!' do
+      let(:trigger_token) { 'docs_hugo_trigger_token' }
+      let(:ref) { 'main' }
+
+      let(:env) do
+        super().merge(
+          'CI_PROJECT_PATH' => 'gitlab-org/gitlab-foss',
+          'DOCS_HUGO_TRIGGER_TOKEN' => trigger_token
+        )
+      end
+
+      describe '#downstream_project_path' do
+        context 'when DOCS_PROJECT_PATH is set' do
+          let(:downstream_project_path) { 'docs_project_path' }
+
+          before do
+            stub_env('DOCS_PROJECT_PATH', downstream_project_path)
+          end
+
+          it 'triggers the pipeline on the correct project' do
+            expect_run_trigger_with_params
+
+            subject.invoke!
+          end
+        end
+      end
+
+      describe '#ref' do
+        context 'when DOCS_BRANCH is set' do
+          let(:ref) { 'docs_branch' }
+
+          before do
+            stub_env('DOCS_BRANCH', ref)
+          end
+
+          it 'triggers the pipeline on the correct ref' do
+            expect_run_trigger_with_params
+
+            subject.invoke!
+          end
+        end
+      end
+    end
+
+    describe '#cleanup!' do
+      let(:downstream_environment_response) { double('downstream_environment', id: 42) }
+      let(:downstream_environments_response) { [downstream_environment_response] }
+
+      before do
+        expect(com_gitlab_client).to receive(:environments)
+          .with(downstream_project_path, name: subject.__send__(:downstream_environment))
+          .and_return(downstream_environments_response)
+        expect(com_gitlab_client).to receive(:stop_environment)
+          .with(downstream_project_path, downstream_environment_response.id)
+          .and_return(downstream_environment_stopping_response)
+      end
+
+      context "when stopping the environment succeeds" do
+        let(:downstream_environment_stopping_response) { double('downstream_environment', state: 'stopped') }
+
+        it 'displays a success message' do
+          expect(subject).to receive(:puts)
+            .with("=> Downstream environment '#{subject.__send__(:downstream_environment)}' stopped.")
+
+          subject.cleanup!
+        end
+      end
+
+      context "when stopping the environment fails" do
+        let(:downstream_environment_stopping_response) { double('downstream_environment', state: 'running') }
+
+        it 'displays a failure message' do
+          expect(subject).to receive(:puts)
+            .with("=> Downstream environment '#{subject.__send__(:downstream_environment)}' failed to stop.")
+
+          subject.cleanup!
+        end
+      end
+    end
+
+    describe '#app_url' do
+      let(:review_slug) { 'ce-123' }
+
+      before do
+        allow(subject).to receive(:review_slug).and_return(review_slug)
+      end
+
+      it 'returns the correct app URL' do
+        expected_url = "https://new.docs.gitlab.com/upstream-review-mr-#{review_slug}/"
+        expect(subject.send(:app_url)).to eq(expected_url)
+      end
+    end
+  end
+
   describe Trigger::DatabaseTesting do
     describe '#variables' do
       it 'invokes the trigger with expected variables' do
diff --git a/spec/services/packages/maven/create_package_service_spec.rb b/spec/services/packages/maven/create_package_service_spec.rb
index c39b1e62a4d..a2c23fcad06 100644
--- a/spec/services/packages/maven/create_package_service_spec.rb
+++ b/spec/services/packages/maven/create_package_service_spec.rb
@@ -96,17 +96,6 @@ RSpec.describe Packages::Maven::CreatePackageService, feature_category: :package
         message: 'Validation failed: Name has already been taken' do
         it { is_expected.to have_attributes(reason: :name_taken) }
       end
-
-      context 'when use_exclusive_lease_in_mvn_find_or_create_package FF is disabled' do
-        before do
-          stub_feature_flags(use_exclusive_lease_in_mvn_find_or_create_package: false)
-        end
-
-        it_behaves_like 'returning an error service response',
-          message: 'Validation failed: Name has already been taken' do
-          it { is_expected.to have_attributes(reason: :invalid_parameter) }
-        end
-      end
     end
   end
 end
diff --git a/spec/tasks/gitlab/keep_around_rake_spec.rb b/spec/tasks/gitlab/keep_around_rake_spec.rb
index ade11e59c37..dbdfc3d4edf 100644
--- a/spec/tasks/gitlab/keep_around_rake_spec.rb
+++ b/spec/tasks/gitlab/keep_around_rake_spec.rb
@@ -182,14 +182,6 @@ RSpec.describe 'keep-around tasks', :silence_stdout, feature_category: :source_c
         keep_around_count: 3,
         orphan_count: 2
     end
-
-    context "for todo keep-arounds" do
-      let_it_be(:todo) { create(:todo, project: project, commit_id: ::TestEnv::BRANCH_SHA['master']) }
-
-      it_behaves_like 'orphans found',
-        keep_around_count: 3,
-        orphan_count: 2
-    end
   end
 end
 # rubocop:enable RSpec/AvoidTestProf
diff --git a/spec/tooling/danger/project_helper_spec.rb b/spec/tooling/danger/project_helper_spec.rb
index 7aea33f3879..76a01970859 100644
--- a/spec/tooling/danger/project_helper_spec.rb
+++ b/spec/tooling/danger/project_helper_spec.rb
@@ -35,6 +35,19 @@ RSpec.describe Tooling::Danger::ProjectHelper, feature_category: :tooling do
       'doc/api/openapi/openapi.yaml'                     | [:docs, :backend]
       'doc/api/openapi/any_other_file.yaml'              | [:docs, :backend]
 
+      'config/feature_flags/flag_config.yml' | [:feature_flag]
+      'config/feature_flags/nested/flag_config.yaml' | [:feature_flag]
+      'ee/config/feature_flags/flag_config.yml' | [:feature_flag]
+      'ee/config/feature_flags/nested/flag_config.yaml' | [:feature_flag]
+      'jh/config/feature_flags/flag_config.yml' | [:feature_flag]
+      'jh/config/feature_flags/nested/flag_config.yaml' | [:feature_flag]
+      'config/feature_flags/flag_config.patch' | [:backend]
+      'config/feature_flags/nested/flag_config.patch' | [:backend]
+      'ee/config/feature_flags/flag_config.patch' | [:backend]
+      'ee/config/feature_flags/nested/flag_config.patch' | [:backend]
+      'jh/config/feature_flags/flag_config.patch' | [:backend]
+      'jh/config/feature_flags/nested/flag_config.patch' | [:backend]
+
       'usage_data.rb'   | [:database, :backend, :analytics_instrumentation]
       'doc/foo.md'      | [:docs]
       'CONTRIBUTING.md' | [:docs]
diff --git a/tooling/danger/project_helper.rb b/tooling/danger/project_helper.rb
index 95e2b2dd38e..846b76c8b01 100644
--- a/tooling/danger/project_helper.rb
+++ b/tooling/danger/project_helper.rb
@@ -23,7 +23,7 @@ module Tooling
 
         [%r{usage_data\.rb}, %r{^(\+|-).*\s+(count|distinct_count|estimate_batch_distinct_count)\(.*\)(.*)$}] => [:database, :backend, :analytics_instrumentation],
 
-        %r{\A((ee|jh)/)?config/feature_flags/} => :feature_flag,
+        %r{\A((ee|jh)/)?config/feature_flags/.*(\.(yml|yaml))\z} => :feature_flag,
 
         %r{doc/api/usage_data.md} => [:analytics_instrumentation],
 
diff --git a/yarn.lock b/yarn.lock
index 7f1ddd8154d..7e8de5dc426 100644
--- a/yarn.lock
+++ b/yarn.lock
@@ -1398,6 +1398,7 @@
   integrity sha512-DoMUIN3DqjEn7wvcxBg/b7Ite5fTdF5EmuOZoBRo2j0UBGweDXmNBi+9HrTZs4cBU660dOxcf1hATFcG3npbPg==
 
 "@gitlab/noop@^1.0.0", jackspeak@^2.3.5, "jackspeak@npm:@gitlab/noop@1.0.0":
+  name jackspeak
   version "1.0.0"
   resolved "https://registry.yarnpkg.com/@gitlab/noop/-/noop-1.0.0.tgz#b1ecb8ae6b2abf9b2e28927e4fbb05b7a1b2704b"
   integrity sha512-nOltttik5o2BjBo8LnyeTFzHoLpMY/XcCVOC+lm9ZwU+ivEam8wafacMF0KTbRn1KVrIoHYdo70QnqS+vJiOVw==
@@ -1421,10 +1422,10 @@
   resolved "https://registry.yarnpkg.com/@gitlab/svgs/-/svgs-3.121.0.tgz#57cacc895929aef4320632396373797a64b230ff"
   integrity sha512-ZekVjdMZrjrNEjdrOHsJYCu7A+ea3AkuNUxWIZ3FaNgJj4Oh21RlTP7bQKnRSXVhBbV1jg1PgzQ1ANEoCW8t4g==
 
-"@gitlab/ui@103.7.1":
-  version "103.7.1"
-  resolved "https://registry.yarnpkg.com/@gitlab/ui/-/ui-103.7.1.tgz#7df2ab802aad48a946100d73d3fc9fa1733bb9bb"
-  integrity sha512-ThpGdWWLdWN0j2q3RhQ63625KbeK2BXinhk3iQyy//z08sxZJYXWwcdFF88TImPtBVV7p5e/01Mb6WhqI/H8wg==
+"@gitlab/ui@104.0.0":
+  version "104.0.0"
+  resolved "https://registry.yarnpkg.com/@gitlab/ui/-/ui-104.0.0.tgz#a4f00addd595a8248bd99cf0ceaebf1c67c54775"
+  integrity sha512-vhCZ+Hrvx/qRuVtpKB5SN4sC+FIvkzywKbxjC7rq0aQG314gmBl7W41vAPHCPO7zCPSlrNyT7zyCN1jcrQxsWA==
   dependencies:
     "@floating-ui/dom" "1.4.3"
     echarts "^5.3.2"