Merge remote-tracking branch 'ce/8-12-stable' into 8-12-stable-ee

Signed-off-by: Rémy Coutable <remy@rymai.me>

CHANGELOG

 Please view this file on the master branch, on stable branches it's out of date.
 
-v 8.12.0 (unreleased)
+v 8.12.1 (unreleased)
+
+v 8.12.0
   - Update the rouge gem to 2.0.6, which adds highlighting support for JSX, Prometheus, and others. !6251
   - Only check :can_resolve permission if the note is resolvable
   - Bump fog-aws to v0.11.0 to support ap-south-1 region
@@ -18,6 +20,7 @@ v 8.12.0 (unreleased)
   - Fix note form hint showing slash commands supported for commits.
   - Make push events have equal vertical spacing.
   - API: Ensure invitees are not returned in Members API.
+  - Preserve applied filters on issues search.
   - Add two-factor recovery endpoint to internal API !5510
   - Pass the "Remember me" value to the U2F authentication form
   - Display stages in valid order in stages dropdown on build page
@@ -176,7 +179,6 @@ v 8.12.0 (unreleased)
   - Fix Gitlab::Popen.popen thread-safety issue
   - Add specs to removing project (Katarzyna Kobierska Ula Budziszewska)
   - Clean environment variables when running git hooks
-  - Add UX improvements for merge request version diffs
   - Fix Import/Export issues importing protected branches and some specific models
   - Fix non-master branch readme display in tree view
   - Add UX improvements for merge request version diffs

app/assets/javascripts/issuable.js.es6

@@ -15,25 +15,32 @@
       return Issuable.labelRow = _.template('<% _.each(labels, function(label){ %> <span class="label-row btn-group" role="group" aria-label="<%- label.title %>" style="color: <%- label.text_color %>;"> <a href="#" class="btn btn-transparent has-tooltip" style="background-color: <%- label.color %>;" title="<%- label.description %>" data-container="body"> <%- label.title %> </a> <button type="button" class="btn btn-transparent label-remove js-label-filter-remove" style="background-color: <%- label.color %>;" data-label="<%- label.title %>"> <i class="fa fa-times"></i> </button> </span> <% }); %>');
     },
     initSearch: function() {
-      this.timer = null;
-      return $('#issuable_search').off('keyup').on('keyup', function() {
-        clearTimeout(this.timer);
-        return this.timer = setTimeout(function() {
-          var $form, $input, $search;
-          $search = $('#issuable_search');
-          $form = $('.js-filter-form');
-          $input = $("input[name='" + ($search.attr('name')) + "']", $form);
-          if ($input.length === 0) {
-            $form.append("<input type='hidden' name='" + ($search.attr('name')) + "' value='" + (_.escape($search.val())) + "'/>");
-          } else {
-            $input.val($search.val());
-          }
-          if ($search.val() !== '') {
-            return Issuable.filterResults($form);
-          }
-        }, 500);
+      // `immediate` param set to false debounces on the `trailing` edge, lets user finish typing
+      const debouncedExecSearch = _.debounce(Issuable.executeSearch, 500, false);
+
+      $('#issuable_search').off('keyup').on('keyup', debouncedExecSearch);
+
+      // ensures existing filters are preserved when manually submitted
+      $('#issue_search_form').on('submit', (e) => {
+        e.preventDefault();
+        debouncedExecSearch(e);
       });
     },
+    executeSearch: function(e) {
+      const $search = $('#issuable_search');
+      const $searchName = $search.attr('name');
+      const $searchValue = $search.val();
+      const $filtersForm = $('.js-filter-form');
+      const $input = $(`input[name='${$searchName}']`, $filtersForm);
+
+      if (!$input.length) {
+        $filtersForm.append(`<input type='hidden' name='${$searchName}' value='${_.escape($searchValue)}'/>`);
+      } else {
+        $input.val($searchValue);
+      }
+
+      Issuable.filterResults($filtersForm);
+    },
     initLabelFilterRemove: function() {
       return $(document).off('click', '.js-label-filter-remove').on('click', '.js-label-filter-remove', function(e) {
         var $button;

app/controllers/concerns/issuable_collections.rb

@@ -13,18 +13,10 @@ module IssuableCollections
     issues_finder.execute
   end
 
-  def all_issues_collection
-    IssuesFinder.new(current_user, filter_params_all).execute
-  end
-
   def merge_requests_collection
     merge_requests_finder.execute
   end
 
-  def all_merge_requests_collection
-    MergeRequestsFinder.new(current_user, filter_params_all).execute
-  end
-
   def issues_finder
     @issues_finder ||= issuable_finder_for(IssuesFinder)
   end
@@ -62,10 +54,6 @@ module IssuableCollections
     @filter_params
   end
 
-  def filter_params_all
-    @filter_params_all ||= filter_params.merge(state: 'all', sort: nil)
-  end
-
   def set_default_scope
     params[:scope] = 'all' if params[:scope].blank?
   end

app/controllers/concerns/issues_action.rb

@@ -10,8 +10,6 @@ module IssuesAction
               .preload(:author, :project)
               .page(params[:page])
 
-    @all_issues = all_issues_collection.non_archived
-
     respond_to do |format|
       format.html
       format.atom { render layout: false }

app/controllers/concerns/merge_requests_action.rb

@@ -9,7 +9,5 @@ module MergeRequestsAction
                       .non_archived
                       .preload(:author, :target_project)
                       .page(params[:page])
-
-    @all_merge_requests = all_merge_requests_collection.non_archived
   end
 end

app/controllers/projects/issues_controller.rb

@@ -28,8 +28,6 @@ class Projects::IssuesController < Projects::ApplicationController
 
     @labels = @project.labels.where(title: params[:label_name])
 
-    @all_issues = all_issues_collection
-
     respond_to do |format|
       format.html
       format.atom { render layout: false }

app/controllers/projects/merge_requests_controller.rb

@@ -38,8 +38,6 @@ class Projects::MergeRequestsController < Projects::ApplicationController
 
     @labels = @project.labels.where(title: params[:label_name])
 
-    @all_merge_requests = all_merge_requests_collection
-
     respond_to do |format|
       format.html
       format.json do

app/helpers/application_helper.rb

@@ -283,14 +283,23 @@ module ApplicationHelper
     end
   end
 
-  def state_filters_text_for(state, records)
+  def state_filters_text_for(entity, project)
     titles = {
       opened: "Open"
     }
 
-    state_title = titles[state] || state.to_s.humanize
-    count       = records.public_send(state).size
-    html        = content_tag :span, state_title
+    entity_title = titles[entity] || entity.to_s.humanize
+
+    count =
+      if project.nil?
+        nil
+      elsif current_controller?(:issues)
+        project.issues.visible_to_user(current_user).send(entity).count
+      elsif current_controller?(:merge_requests)
+        project.merge_requests.send(entity).count
+      end
+
+    html = content_tag :span, entity_title
 
     if count.present?
       html += " "

app/models/merge_request_diff.rb

@@ -30,6 +30,10 @@ class MergeRequestDiff < ActiveRecord::Base
     select(column_names - ['st_diffs'])
   end
 
+  def st_commits
+    super || []
+  end
+
   # Collect information about commits and diff from repository
   # and save it to the database as serialized data
   def save_git_content
@@ -83,7 +87,7 @@ class MergeRequestDiff < ActiveRecord::Base
   end
 
   def commits
-    @commits ||= load_commits(st_commits || [])
+    @commits ||= load_commits(st_commits)
   end
 
   def reload_commits

app/views/discussions/_jump_to_next.html.haml

-- diff_notes_disabled = (@merge_request_diff.latest? && !!@start_sha) if @merge_request_diff
 - discussion = local_assigns.fetch(:discussion, nil)
 - if current_user
   %jump-to-discussion{ "inline-template" => true, ":discussion-id" => "'#{discussion.try(:id)}'" }
@@ -6,6 +5,5 @@
       %button.btn.btn-default.discussion-next-btn.has-tooltip{ "@click" => "jumpToNextUnresolvedDiscussion",
         title: "Jump to next unresolved discussion",
         "aria-label" => "Jump to next unresolved discussion",
-        data: { container: "body" },
-        disabled: diff_notes_disabled }
+        data: { container: "body" }}
         = custom_icon("next_discussion")

app/views/projects/merge_requests/show/_versions.html.haml

@@ -10,23 +10,25 @@
             - else
               version #{version_index(@merge_request_diff)}
           %span.caret
-        %ul.dropdown-menu.dropdown-menu-selectable
+        .dropdown-menu.dropdown-select.dropdown-menu-selectable
           .dropdown-title
             %span Version:
-            %button.dropdown-title-button.dropdown-menu-close
-              %i.fa.fa-times.dropdown-menu-close-icon
-          - @merge_request_diffs.each do |merge_request_diff|
-            %li
-              = link_to merge_request_version_path(@project, @merge_request, merge_request_diff), class: ('is-active' if merge_request_diff == @merge_request_diff) do
-                %strong
-                  - if merge_request_diff.latest?
-                    latest version
-                  - else
-                    version #{version_index(merge_request_diff)}
-                .monospace #{short_sha(merge_request_diff.head_commit_sha)}
-                %small
-                  #{number_with_delimiter(merge_request_diff.commits.count)} #{'commit'.pluralize(merge_request_diff.commits.count)},
-                  = time_ago_with_tooltip(merge_request_diff.created_at)
+            %button.dropdown-title-button.dropdown-menu-close{aria: {label: "Close"}}
+              = icon('times', class: 'dropdown-menu-close-icon')
+          .dropdown-content
+            %ul
+              - @merge_request_diffs.each do |merge_request_diff|
+                %li
+                  = link_to merge_request_version_path(@project, @merge_request, merge_request_diff), class: ('is-active' if merge_request_diff == @merge_request_diff) do
+                    %strong
+                      - if merge_request_diff.latest?
+                        latest version
+                      - else
+                        version #{version_index(merge_request_diff)}
+                    .monospace #{short_sha(merge_request_diff.head_commit_sha)}
+                    %small
+                      #{number_with_delimiter(merge_request_diff.commits.count)} #{'commit'.pluralize(merge_request_diff.commits.count)},
+                      = time_ago_with_tooltip(merge_request_diff.created_at)
 
       - if @merge_request_diff.base_commit_sha
         and
@@ -38,27 +40,29 @@
               - else
                 #{@merge_request.target_branch}
             %span.caret
-          %ul.dropdown-menu.dropdown-menu-selectable
+          .dropdown-menu.dropdown-select.dropdown-menu-selectable
             .dropdown-title
               %span Compared with:
-              %button.dropdown-title-button.dropdown-menu-close
-                %i.fa.fa-times.dropdown-menu-close-icon
-            - @comparable_diffs.each do |merge_request_diff|
-              %li
-                = link_to merge_request_version_path(@project, @merge_request, @merge_request_diff, merge_request_diff.head_commit_sha), class: ('is-active' if merge_request_diff == @start_version) do
-                  %strong
-                    - if merge_request_diff.latest?
-                      latest version
-                    - else
-                      version #{version_index(merge_request_diff)}
-                  .monospace #{short_sha(merge_request_diff.head_commit_sha)}
-                  %small
-                    = time_ago_with_tooltip(merge_request_diff.created_at)
-            %li
-              = link_to merge_request_version_path(@project, @merge_request, @merge_request_diff), class: ('is-active' unless @start_sha) do
-                %strong
-                  #{@merge_request.target_branch} (base)
-                .monospace #{short_sha(@merge_request_diff.base_commit_sha)}
+              %button.dropdown-title-button.dropdown-menu-close{aria: {label: "Close"}}
+                = icon('times', class: 'dropdown-menu-close-icon')
+            .dropdown-content
+              %ul
+                - @comparable_diffs.each do |merge_request_diff|
+                  %li
+                    = link_to merge_request_version_path(@project, @merge_request, @merge_request_diff, merge_request_diff.head_commit_sha), class: ('is-active' if merge_request_diff == @start_version) do
+                      %strong
+                        - if merge_request_diff.latest?
+                          latest version
+                        - else
+                          version #{version_index(merge_request_diff)}
+                      .monospace #{short_sha(merge_request_diff.head_commit_sha)}
+                      %small
+                        = time_ago_with_tooltip(merge_request_diff.created_at)
+                  %li
+                    = link_to merge_request_version_path(@project, @merge_request, @merge_request_diff), class: ('is-active' unless @start_sha) do
+                      %strong
+                        #{@merge_request.target_branch} (base)
+                      .monospace #{short_sha(@merge_request_diff.base_commit_sha)}
 
     - unless @merge_request_diff.latest? && !@start_sha
       .comments-disabled-notif.content-block
@@ -67,4 +71,4 @@
           Comments are disabled because you're comparing two versions of this merge request.
         - else
           Comments are disabled because you're viewing an old version of this merge request.
-        = link_to 'Show latest version', merge_request_version_path(@project, @merge_request, @merge_request_diff), class: 'btn btn-sm'
+        = link_to 'Show latest version', diffs_namespace_project_merge_request_path(@project.namespace, @project, @merge_request), class: 'btn btn-sm'

app/views/shared/issuable/_nav.html.haml

 %ul.nav-links.issues-state-filters
   - if defined?(type) && type == :merge_requests
     - page_context_word = 'merge requests'
-    - records = @all_merge_requests
   - else
     - page_context_word = 'issues'
-    - records = @all_issues
   %li{class: ("active" if params[:state] == 'opened')}
     = link_to page_filter_path(state: 'opened', label: true), title: "Filter by #{page_context_word} that are currently opened." do
-      #{state_filters_text_for(:opened, records)}
+      #{state_filters_text_for(:opened, @project)}
 
   - if defined?(type) && type == :merge_requests
     %li{class: ("active" if params[:state] == 'merged')}
       = link_to page_filter_path(state: 'merged', label: true), title: 'Filter by merge requests that are currently merged.' do
-        #{state_filters_text_for(:merged, records)}
+        #{state_filters_text_for(:merged, @project)}
 
     %li{class: ("active" if params[:state] == 'closed')}
       = link_to page_filter_path(state: 'closed', label: true), title: 'Filter by merge requests that are currently closed and unmerged.' do
-        #{state_filters_text_for(:closed, records)}
+        #{state_filters_text_for(:closed, @project)}
   - else
     %li{class: ("active" if params[:state] == 'closed')}
       = link_to page_filter_path(state: 'closed', label: true), title: 'Filter by issues that are currently closed.' do
-        #{state_filters_text_for(:closed, records)}
+        #{state_filters_text_for(:closed, @project)}
 
   %li{class: ("active" if params[:state] == 'all')}
     = link_to page_filter_path(state: 'all', label: true), title: "Show all #{page_context_word}." do
-      #{state_filters_text_for(:all, records)}
+      #{state_filters_text_for(:all, @project)}

db/schema.rb

@@ -11,7 +11,7 @@
 #
 # It's strongly recommended that you check this file into your version control system.
 
-ActiveRecord::Schema.define(version: 20160915081353) do
+ActiveRecord::Schema.define(version: 20160915042921) do
 
   # These are extensions that must be enabled in order to support this database
   enable_extension "plpgsql"
@@ -185,9 +185,9 @@ ActiveRecord::Schema.define(version: 20160915081353) do
     t.text     "commands"
     t.integer  "job_id"
     t.string   "name"
-    t.boolean  "deploy",              default: false
+    t.boolean  "deploy",                        default: false
     t.text     "options"
-    t.boolean  "allow_failure",       default: false, null: false
+    t.boolean  "allow_failure",                 default: false, null: false
     t.string   "stage"
     t.integer  "trigger_request_id"
     t.integer  "stage_idx"
@@ -501,11 +501,11 @@ ActiveRecord::Schema.define(version: 20160915081353) do
 
   create_table "issue_metrics", force: :cascade do |t|
     t.integer  "issue_id",                           null: false
+    t.datetime "first_mentioned_in_commit_at"
     t.datetime "first_associated_with_milestone_at"
     t.datetime "first_added_to_board_at"
     t.datetime "created_at",                         null: false
     t.datetime "updated_at",                         null: false
-    t.datetime "first_mentioned_in_commit_at"
   end
 
   add_index "issue_metrics", ["issue_id"], name: "index_issue_metrics", using: :btree
@@ -680,6 +680,7 @@ ActiveRecord::Schema.define(version: 20160915081353) do
     t.datetime "updated_at",                      null: false
   end
 
+  add_index "merge_request_metrics", ["first_deployed_to_production_at"], name: "index_merge_request_metrics_on_first_deployed_to_production_at", using: :btree
   add_index "merge_request_metrics", ["merge_request_id"], name: "index_merge_request_metrics", using: :btree
 
   create_table "merge_requests", force: :cascade do |t|

doc/ci/README.md

@@ -16,5 +16,7 @@
 - [Trigger builds through the API](triggers/README.md)
 - [Build artifacts](../user/project/builds/artifacts.md)
 - [User permissions](../user/permissions.md#gitlab-ci)
+- [Build permissions](../user/permissions.md#build-permissions)
 - [API](../api/ci/README.md)
 - [CI services (linked docker containers)](services/README.md)
+- [**New CI build permissions model**](../user/project/new_ci_build_permissions_model.md) Read about what changed in GitLab 8.12 and how that affects your builds. There's a new way to access your Git submodules and LFS objects in builds.

doc/ci/triggers/README.md

@@ -2,6 +2,10 @@
 
 > [Introduced][ci-229] in GitLab CE 7.14.
 
+> **Note**:
+GitLab 8.12 has a completely redesigned build permissions system.
+Read all about the [new model and its implications][../../user/project/new_ci_build_permissions_model.md#build-triggers].
+
 Triggers can be used to force a rebuild of a specific branch, tag or commit,
 with an API call.
 

doc/update/8.11-to-8.12.md

@@ -70,7 +70,7 @@ sudo -u git -H git checkout 8-12-stable-ee
 ```bash
 cd /home/git/gitlab-shell
 sudo -u git -H git fetch --all --tags
-sudo -u git -H git checkout v3.5.0
+sudo -u git -H git checkout v3.6.0
 ```
 
 ### 6. Update gitlab-workhorse

doc/user/permissions.md

@@ -141,3 +141,33 @@ instance and project. In addition, all admins can use the admin interface under
 | Add shared runners                    |                 |             |          | ✓      |
 | See events in the system              |                 |             |          | ✓      |
 | Admin interface                       |                 |             |          | ✓      |
+
+### Build permissions
+
+> Changed in GitLab 8.12.
+
+GitLab 8.12 has a completely redesigned build permissions system.
+Read all about the [new model and its implications][new-mod].
+
+This table shows granted privileges for builds triggered by specific types of
+users:
+
+| Action                                      | Guest, Reporter | Developer   | Master   | Admin  |
+|---------------------------------------------|-----------------|-------------|----------|--------|
+| Run CI build                                |                 | ✓           | ✓        | ✓      |
+| Clone source and LFS from current project   |                 | ✓           | ✓        | ✓      |
+| Clone source and LFS from public projects   |                 | ✓           | ✓        | ✓      |
+| Clone source and LFS from internal projects |                 | ✓ [^3]      | ✓ [^3]   | ✓      |
+| Clone source and LFS from private projects  |                 | ✓ [^4]      | ✓ [^4]   | ✓ [^4] |
+| Push source and LFS                         |                 |             |          |        |
+| Pull container images from current project  |                 | ✓           | ✓        | ✓      |
+| Pull container images from public projects  |                 | ✓           | ✓        | ✓      |
+| Pull container images from internal projects|                 | ✓ [^3]      | ✓ [^3]   | ✓      |
+| Pull container images from private projects |                 | ✓ [^4]      | ✓ [^4]   | ✓ [^4] |
+| Push container images to current project    |                 | ✓           | ✓        | ✓      |
+| Push container images to other projects     |                 |             |          |        |
+
+[^3]: Only if user is not external one.
+[^4]: Only if user is a member of the project.
+[ce-18994]: https://gitlab.com/gitlab-org/gitlab-ce/issues/18994
+[new-mod]: project/new_ci_build_permissions_model.md

doc/user/project/cycle_analytics.md

@@ -6,7 +6,7 @@
 This the first iteration of Cycle Analytics, you can follow the following issue
 to track the changes that are coming to this feature: [#20975][ce-20975].
 
-Cycle Analytics measures the time it takes to go from an idea to production for
+Cycle Analytics measures the time it takes to go from [an idea to production] for
 each project you have. This is achieved by not only indicating the total time it
 takes to reach at that point, but the total time is broken down into the
 multiple stages an idea has to pass through to be shipped.
@@ -32,7 +32,7 @@ You can see that there are seven stages in total:
 - **Code** (IDE)
     - Median time from the first commit until the merge request is created
 - **Test** (CI)
-    - Total test time for all commits/merges
+    - Median total test time for all commits/merges
 - **Review** (Merge Request/MR)
     - Median time from merge request creation until the merge request is merged
       (closed merge requests won't be taken into account)
@@ -57,11 +57,11 @@ Below you can see in more detail what the various stages of Cycle Analytics mean
 | **Stage** | **Description** |
 | --------- | --------------- |
 | Issue     | Measures the median time between creating an issue and taking action to solve it, by either labeling it or adding it to a milestone, whatever comes first. The label will be tracked only if it already has an [Issue Board list][board] created for it. |
-| Plan      | Measures the median time between the action you took for the previous stage, and pushing the first commit to the repository. To make this change tracked, the commit needs to be pushed that contains the issue closing pattern `Closes #xxx`, where `xxx` is the number of the issue related to this commit. If the commit does not contain the issue closing pattern, it is not considered to the measure time of the stage. |
-| Code      | Measures the median time between pushing a first commit (previous stage) and creating a merge request related to that commit. The key to keep the process tracked is include the issue closing pattern to the description of the merge request. |
+| Plan      | Measures the median time between the action you took for the previous stage, and pushing the first commit to the repository. To make this change tracked, the pushed commit needs to contain the [issue closing pattern], for example `Closes #xxx`, where `xxx` is the number of the issue related to this commit. If the commit does not contain the issue closing pattern, it is not considered to the measurement time of the stage. |
+| Code      | Measures the median time between pushing a first commit (previous stage) and creating a merge request related to that commit. The key to keep the process tracked is include the [issue closing pattern] to the description of the merge request. |
 | Test      | Measures the median time to run the entire pipeline for that project. It's related to the time GitLab CI takes to run every job for the commits pushed to that merge request defined in the previous stage. It is basically the start->finish time for all pipelines. `master` is not excluded. It does not attempt to track time for any particular stages. |
 | Review    | Measures the median time taken to review the merge request, between its creation and until it's merged. |
-| Staging   | Measures the median time between merging the merge request until the very first deployment of the to production. It's tracked by the [environment] set to `production` in your GitLab CI configuration. If there isn't a `production` environment, this is not tracked. |
+| Staging   | Measures the median time between merging the merge request until the very first deployment to production. It's tracked by the [environment] set to `production` in your GitLab CI configuration. If there isn't a `production` environment, this is not tracked. |
 | Production| The sum of all time taken to run the entire process, from issue creation to deploying the code to production. |
 
 ---
@@ -101,7 +101,7 @@ Learn more about Cycle Analytics in the following resources:
 
 - [Cycle Analytics feature page](https://about.gitlab.com/solutions/cycle-analytics/)
 - [Cycle Analytics feature preview](https://about.gitlab.com/2016/09/16/feature-preview-introducing-cycle-analytics/)
-- [Cycle Analytics feature highlight](https://about.gitlab.com/2016-09-19-cycle-analytics-feature-highlight.html)
+- [Cycle Analytics feature highlight](https://about.gitlab.com/2016/09/21/cycle-analytics-feature-highlight/)
 
 
 [ce-5986]: https://gitlab.com/gitlab-org/gitlab-ce/merge_requests/5986
@@ -110,3 +110,5 @@ Learn more about Cycle Analytics in the following resources:
 [permissions]: ../permissions.md
 [environment]: ../../ci/yaml/README.md#environment
 [board]: issue_board.md#creating-a-new-list
+[idea to production]: https://about.gitlab.com/2016/08/05/continuous-integration-delivery-and-deployment-with-gitlab/#from-idea-to-production-with-gitlab
+[issue closing pattern]: issues/automatic_issue_closing.md

doc/user/project/merge_requests/versions.md

@@ -7,14 +7,18 @@ of merge request diff is created. When you visit a merge request that contains
 more than one pushes, you can select and compare the versions of those merge
 request diffs.
 
+![Merge Request Versions](img/versions.png)
+
 By default, the latest version of changes is shown. However, you
 can select an older one from version dropdown.
 
-![Merge Request Versions](img/versions.png)
+![Merge Request Versions](img/versions-dropdown.png)
 
 You can also compare the merge request version with older one to see what is
 changed since then.
 
+![Merge Request Versions](img/versions-compare.png)
+
 Please note that comments are disabled while viewing outdated merge versions
 or comparing to versions other than base.
 

lib/api/projects.rb

@@ -211,7 +211,9 @@ module API
         if namespace_id.present?
           namespace = Namespace.find_by(id: namespace_id) || Namespace.find_by_path_or_name(namespace_id)
 
-          not_found!('Target Namespace') unless namespace
+          unless namespace && can?(current_user, :create_projects, namespace)
+            not_found!('Target Namespace')
+          end
 
           attrs[:namespace] = namespace
         end

spec/features/dashboard_issues_spec.rb

@@ -21,9 +21,6 @@ describe "Dashboard Issues filtering", feature: true, js: true do
 
       click_link 'No Milestone'
 
-      page.within '.issues-state-filters' do
-        expect(page).to have_selector('.active .badge', text: '1')
-      end
       expect(page).to have_selector('.issue', count: 1)
     end
 
@@ -32,9 +29,6 @@ describe "Dashboard Issues filtering", feature: true, js: true do
 
       click_link 'Any Milestone'
 
-      page.within '.issues-state-filters' do
-        expect(page).to have_selector('.active .badge', text: '2')
-      end
       expect(page).to have_selector('.issue', count: 2)
     end
 
@@ -45,9 +39,6 @@ describe "Dashboard Issues filtering", feature: true, js: true do
         click_link milestone.title
       end
 
-      page.within '.issues-state-filters' do
-        expect(page).to have_selector('.active .badge', text: '1')
-      end
       expect(page).to have_selector('.issue', count: 1)
     end
   end

spec/features/issues/filter_issues_spec.rb

@@ -230,10 +230,6 @@ describe 'Filter issues', feature: true do
           expect(page).to have_selector('.issue', count: 2)
         end
 
-        page.within '.issues-state-filters' do
-          expect(page).to have_selector('.active .badge', text: '2')
-        end
-
         click_button 'Label'
         page.within '.labels-filter' do
           click_link 'bug'
@@ -243,10 +239,6 @@ describe 'Filter issues', feature: true do
         page.within '.issues-list' do
           expect(page).to have_selector('.issue', count: 1)
         end
-
-        page.within '.issues-state-filters' do
-          expect(page).to have_selector('.active .badge', text: '1')
-        end
       end
 
       it 'filters by text and milestone' do
@@ -256,10 +248,6 @@ describe 'Filter issues', feature: true do
           expect(page).to have_selector('.issue', count: 2)
         end
 
-        page.within '.issues-state-filters' do
-          expect(page).to have_selector('.active .badge', text: '2')
-        end
-
         click_button 'Milestone'
         page.within '.milestone-filter' do
           click_link '8'
@@ -268,10 +256,6 @@ describe 'Filter issues', feature: true do
         page.within '.issues-list' do
           expect(page).to have_selector('.issue', count: 1)
         end
-
-        page.within '.issues-state-filters' do
-          expect(page).to have_selector('.active .badge', text: '1')
-        end
       end
 
       it 'filters by text and assignee' do
@@ -281,10 +265,6 @@ describe 'Filter issues', feature: true do
           expect(page).to have_selector('.issue', count: 2)
         end
 
-        page.within '.issues-state-filters' do
-          expect(page).to have_selector('.active .badge', text: '2')
-        end
-
         click_button 'Assignee'
         page.within '.dropdown-menu-assignee' do
           click_link user.name
@@ -293,10 +273,6 @@ describe 'Filter issues', feature: true do
         page.within '.issues-list' do
           expect(page).to have_selector('.issue', count: 1)
         end
-
-        page.within '.issues-state-filters' do
-          expect(page).to have_selector('.active .badge', text: '1')
-        end
       end
 
       it 'filters by text and author' do
@@ -306,10 +282,6 @@ describe 'Filter issues', feature: true do
           expect(page).to have_selector('.issue', count: 2)
         end
 
-        page.within '.issues-state-filters' do
-          expect(page).to have_selector('.active .badge', text: '2')
-        end
-
         click_button 'Author'
         page.within '.dropdown-menu-author' do
           click_link user.name
@@ -318,10 +290,6 @@ describe 'Filter issues', feature: true do
         page.within '.issues-list' do
           expect(page).to have_selector('.issue', count: 1)
         end
-
-        page.within '.issues-state-filters' do
-          expect(page).to have_selector('.active .badge', text: '1')
-        end
       end
     end
   end

spec/models/merge_request_diff_spec.rb

@@ -64,5 +64,27 @@ describe MergeRequestDiff, models: true do
         end
       end
     end
+
+    describe '#commits_sha' do
+      shared_examples 'returning all commits SHA' do
+        it 'returns all commits SHA' do
+          commits_sha = subject.commits_sha
+
+          expect(commits_sha).to eq(subject.commits.map(&:sha))
+        end
+      end
+
+      context 'when commits were loaded' do
+        before do
+          subject.commits
+        end
+
+        it_behaves_like 'returning all commits SHA'
+      end
+
+      context 'when commits were not loaded' do
+        it_behaves_like 'returning all commits SHA'
+      end
+    end
   end
 end

spec/models/merge_request_spec.rb

@@ -611,7 +611,7 @@ describe MergeRequest, models: true do
 
     context 'with multiple irrelevant merge_request_diffs' do
       before do
-        subject.update(target_branch: 'markdown')
+        subject.update(target_branch: 'v1.0.0')
       end
 
       it_behaves_like 'returning pipelines with proper ordering'
@@ -638,13 +638,28 @@ describe MergeRequest, models: true do
       subject.merge_request_diffs.flat_map(&:commits).map(&:sha).uniq
     end
 
-    before do
-      subject.update(target_branch: 'markdown')
+    shared_examples 'returning all SHA' do
+      it 'returns all SHA from all merge_request_diffs' do
+        expect(subject.merge_request_diffs.size).to eq(2)
+        expect(subject.all_commits_sha).to eq(all_commits_sha)
+      end
+    end
+
+    context 'with a completely different branch' do
+      before do
+        subject.update(target_branch: 'v1.0.0')
+      end
+
+      it_behaves_like 'returning all SHA'
     end
 
-    it 'returns all SHA from all merge_request_diffs' do
-      expect(subject.merge_request_diffs.size).to eq(2)
-      expect(subject.all_commits_sha).to eq(all_commits_sha)
+    context 'with a branch having no difference' do
+      before do
+        subject.update(target_branch: 'v1.1.0')
+        subject.reload # make sure commits were not cached
+      end
+
+      it_behaves_like 'returning all SHA'
     end
   end
 

spec/requests/api/fork_spec.rb

@@ -94,7 +94,7 @@ describe API::API, api: true  do
       it 'fails if trying to fork to another user when not admin' do
         post api("/projects/fork/#{project.id}", user2), namespace: admin.namespace.id
 
-        expect(response).to have_http_status(409)
+        expect(response).to have_http_status(404)
       end
 
       it 'fails if trying to fork to non-existent namespace' do
@@ -114,7 +114,7 @@ describe API::API, api: true  do
       it 'fails to fork to not owned group' do
         post api("/projects/fork/#{project.id}", user2), namespace: group.name
 
-        expect(response).to have_http_status(409)
+        expect(response).to have_http_status(404)
       end
 
       it 'forks to not owned group when admin' do