gitlab-qa 15.10.0 → 15.10.2

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 8a010f513b5a21083ffc19a88bd9c462ac94b0a79dc6854a67adb11a62b27158
-  data.tar.gz: 3e5984e97c8fd28bed2dd8438f0a3fad1d96c4549fd589ada0320379f1246986
+  metadata.gz: 84dd5f52a5315b76b1fddcf578afa77b71699744f6c9250edd82c103a74c8e66
+  data.tar.gz: a6abb8d04101eac27f5289e705d54f257ca2bad9e451b039c53e9fbc86621509
 SHA512:
-  metadata.gz: 6be0df446e12c04a6e9c8e36ada004de0fdf56efa8f1df3c7512edad1823da9dcbf31f147a5e8b8a1fd1f986d1e0332694677f4d0f55fedf632242b45293555f
-  data.tar.gz: c5330a156dcbeed4c69cc6176b5204418753fa3b6649e8ec67243440bc356cd92ed84fb6bf974730b34c27d288ee62f78b22be4ce0e28cdb1f67c7c16c02ebd2
+  metadata.gz: a78f8366d7779dc733b81cbde2a6ca07ca3241558424a8b3a3a1944909eeafcebd7c0e942a5d9aadccc461a0f8d7e6ccce6a597b36f2dab39c041d94075d7662
+  data.tar.gz: 80b60afd84ec9b1d9aeb470b89cccb97d92d2086ee2c5658446d8db166c52457ad9e438c831a1358a1bc57b8c41d8562b226af01e1a3c0db933ef7365e2e0a06

data/.gitlab-ci.yml

@@ -54,7 +54,6 @@ variables:
       changes: ["lib/**/version.rb"]
 
 test-on-omnibus-env:
-  image: ${CI_DEPENDENCY_PROXY_GROUP_IMAGE_PREFIX}/alpine:latest
   stage: .pre
   variables:
     BUILD_ENV: build.env

data/Gemfile.lock

@@ -1,7 +1,7 @@
 PATH
   remote: .
   specs:
-    gitlab-qa (15.10.0)
+    gitlab-qa (15.10.2)
       activesupport (>= 6.1, < 8)
       ffi (~> 1.17)
       gitlab (~> 4.19)
@@ -42,7 +42,7 @@ GEM
     climate_control (1.0.1)
     coderay (1.1.3)
     colored2 (3.1.2)
-    concurrent-ruby (1.3.5)
+    concurrent-ruby (1.3.8)
     connection_pool (2.5.4)
     cork (0.3.0)
       colored2 (~> 3.1)

data/docs/configuring_omnibus.md

@@ -137,9 +137,9 @@ Multiple Configurators may be specified and the order will be preserved in which
 E.g., given the arguments:
 
 ```ruby
-exe/gitlab-qa Test::Instance::Image EE --omnibus-config packages,registry
+exe/gitlab-qa Test::Instance::Image EE --omnibus-config github_oauth,registry_object_storage
 # or
-exe/gitlab-qa Test::Instance::Image EE --omnibus-config packages --omnibus-config registry
+exe/gitlab-qa Test::Instance::Image EE --omnibus-config github_oauth --omnibus-config registry_object_storage
 ```
 
 Omnibus will be configured in the order they appear.
@@ -147,11 +147,11 @@ Omnibus will be configured in the order they appear.
 ```ruby
 # /etc/gitlab/gitlab.rb
 #=> Runtime::OmnibusConfiguration::Default#configuration
-#=> Runtime::OmnibusConfiguration::Packages#configuration
-#=> Runtime::OmnibusConfiguration::Registry#configuration
+#=> Runtime::OmnibusConfiguration::GithubOauth#configuration
+#=> Runtime::OmnibusConfiguration::RegistryObjectStorage#configuration
 ```
 
-The order is also preserved for Sidecar containers.  If the `Packages` and `Registry` Configurators each prepare a sidecar container, they will be spun up in order from first to last.
+The order is also preserved for Sidecar containers.  If the `GithubOauth` and `RegistryObjectStorage` Configurators each prepare a sidecar container, they will be spun up in order from first to last.
 
 ### Adding one-off configurations
 

data/docs/what_tests_can_be_run.md

@@ -636,41 +636,14 @@ $ export QA_1P_PASSWORD=1password_password
 $ export QA_1P_SECRET=1password_secret
 $ export QA_1P_GITHUB_UUID=1password_gitlab-qa-github_item_uuid
 
-$ gitlab-qa Test::Integration::OAuth CE
+$ gitlab-qa Test::Instance::Image CE --omnibus-config github_oauth
 
 # For EE
 $ export EE_LICENSE=$(cat /path/to/gitlab_license)
 
-$ gitlab-qa Test::Integration::OAuth EE
+$ gitlab-qa Test::Instance::Image EE --omnibus-config github_oauth
 ```
 
-### `Test::Integration::Packages CE|EE|<full image address>`
-
-**Note: This Scenario no longer exists.  See https://gitlab.com/gitlab-org/gitlab-qa/-/merge_requests/662**
-
-To run Packages tests, you may [configure Omnibus](configuring_omnibus.md) to use the [Packages](https://gitlab.com/gitlab-org/gitlab-qa/-/blob/master/lib/gitlab/qa/runtime/omnibus_configurations/packages.rb) configurator.
-
-Example:
-
-```shell
-$ export EE_LICENSE=$(cat /path/to/Geo.gitlab_license)
-
-$ gitlab-qa Test::Instance::Image EE --omnibus-config packages
-```
-
-This tests the GitLab Package Registry feature by setting
-`gitlab_rails['packages_enabled'] = true` in the Omnibus configuration
-before starting the GitLab container.
-
-To run tests against the GitLab container, a GitLab QA (`gitlab/gitlab-qa`)
-container is spun up and tests are run from it by running the
-`Test::Instance::All` scenario with the `--tag packages` RSpec parameter,
-which runs only the tests with `:packages` metadata.
-
-**Required environment variables:**
-
-- `EE_LICENSE`: A valid EE license.
-
 ### `Test::Integration::Praefect CE|EE|<full image address>`
 
 This tests [Praefect](https://docs.gitlab.com/ee/administration/gitaly/praefect.html),
@@ -1035,6 +1008,9 @@ This scenario will run tests from the test suite against an airgapped instance.
 The airgapped instance is set up by using `iptables` in the GitLab container to block network traffic other than testable ports, and by using runners
 in a shared internal network.
 
+After the rules are applied, the job fails if the container can connect to gitlab.com on port 443, to example.com on port 80 or 443, or to dns.google on port 53.
+The job also logs whether gitlab.com port 8080 is reachable, which the rules allow, and how many packets the `OUTPUT` policy dropped. Neither log line fails the job.
+
 Example:
 
 ```shell
@@ -1046,7 +1022,7 @@ $ gitlab-qa Test::Instance::Airgapped EE -- --tag smoke
 
 ### `Test::Instance::Image CE|EE|<full image address> --omnibus-config object_storage`
 
-This orchestrated scenario runs tests from the test suite against a GitLab instance which has object storage configured instead of using local storage. The omnibus configuration `object_storage` ([configurator](configuring_omnibus.md)), uses [Silo](https://github.com/pgsty/silo) (a MinIO fork) and `object_storage_aws` uses an AWS S3 account with credentials configured in the pipeline as CI Variables. To use Google Cloud Storage pass `--omnibus-config object_storage_gcp`. According to the storage selected it requires:
+This orchestrated scenario runs tests from the test suite against a GitLab instance which has object storage configured instead of using local storage. The omnibus configuration `object_storage` ([configurator](configuring_omnibus.md)), uses [Silo](https://github.com/pgsty/silo) (a MinIO fork) and `object_storage_aws` uses an AWS S3 account with credentials configured in the pipeline as CI Variables. To use Google Cloud Storage pass `--omnibus-config object_storage_gcs`. According to the storage selected it requires:
 
 | Scenario              | Variable            | Description                          |
 |-----------------------|---------------------|--------------------------------------|
@@ -1054,7 +1030,7 @@ This orchestrated scenario runs tests from the test suite against a GitLab insta
 | AWS S3 Object Storage | AWS_S3_KEY_ID       | AWS credentials                      |
 | AWS S3 Object Storage | AWS_S3_ACCESS_KEY   | AWS credentials                      |
 | AWS S3 Object Storage | AWS_S3_BUCKET_NAME  | Name of the bucket set in AWS        |
-| GCP Object Storage    | GCS_BUCKET_NAME     | Name of the bucket set in AWS        |
+| GCP Object Storage    | GCS_BUCKET_NAME     | Name of the bucket set in GCP        |
 | GCP Object Storage    | GOOGLE_JSON_KEY     | JSON key credential                  |
 | GCP Object Storage    | GOOGLE_CLIENT_EMAIL | Email address of the service account |
 | GCP Object Storage    | GOOGLE_PROJECT      | GCP project name                     |

data/lib/gitlab/qa/scenario/test/instance/airgapped.rb

@@ -39,6 +39,7 @@ module Gitlab
                 rspec_args << "--" unless rspec_args.include?('--')
                 rspec_args << "--tag ~orchestrated"
                 gitlab.instance do
+                  report_gitlab_port_8080(gitlab)
                   Component::Specs.perform do |specs|
                     specs.suite = 'Test::Instance::Airgapped'
                     specs.release = gitlab.release
@@ -46,14 +47,42 @@ module Gitlab
                     specs.runner_network = gitlab.runner_network
                     specs.args = [gitlab.address, *rspec_args]
                   end
+                ensure
+                  report_dropped_packets(gitlab)
                 end
               end
             end
 
             private
 
+            def report_dropped_packets(gitlab)
+              chain = gitlab.docker.exec(gitlab.name, 'iptables -nvxL OUTPUT')
+              Runtime::Logger.info("Airgapped packets dropped by the OUTPUT policy: #{chain[/policy DROP \d+ packets, \d+ bytes/]}")
+            rescue Support::ShellCommand::StatusError => e
+              Runtime::Logger.warn("Unable to read the airgapped OUTPUT chain counters: #{e.message}")
+            end
+
+            def report_gitlab_port_8080(gitlab)
+              address = Resolv.getaddress('gitlab.com')
+              state = gitlab.docker.exec(gitlab.name, "ncat -zv -w 10 #{address} 8080 > /dev/null 2>&1 && echo open || echo closed")
+              if state.include?('open')
+                Runtime::Logger.warn("Airgapped finding: gitlab.com port 8080 is reachable")
+              else
+                Runtime::Logger.info("Airgapped gitlab.com port 8080 is not reachable")
+              end
+            rescue Resolv::ResolvError, Support::ShellCommand::StatusError => e
+              Runtime::Logger.warn("Unable to probe gitlab.com port 8080: #{e.message}")
+            end
+
+            def unreachable_check(ip, port)
+              reachable = "echo 'Airgapped network faulty. #{ip} port #{port} is reachable.'; exit 1;"
+              "if ncat -zv -w 10 #{ip} #{port}; then #{reachable} else echo 'Airgapped connectivity #{ip} port #{port} check passed.'; fi;"
+            end
+
             def airgap_gitlab_commands
               gitlab_ip = Resolv.getaddress('gitlab.com')
+              outside_ip = Resolv.getaddress('example.com')
+              resolver_ip = Resolv.getaddress('dns.google')
               gitlab_registry_ip = Resolv.getaddress(QA::Release::COM_REGISTRY)
               dev_gitlab_registry_ip = Resolv.getaddress(QA::Release::DEV_REGISTRY.split(':')[0])
               praefect_ip = config.praefect_ip
@@ -62,6 +91,7 @@ module Gitlab
                 # Ping and wget check
                 apt-get update && apt-get install -y iptables ncat
                 if ncat -zv -w 10 #{gitlab_ip} 80; then echo 'Airgapped connectivity check passed.'; else echo 'Airgapped connectivity check failed - should be able to access gitlab_ip'; exit 1; fi;
+                if ncat -zv -w 10 #{outside_ip} 443; then echo 'Airgapped connectivity outside_ip check passed.'; else echo 'Airgapped connectivity check failed - should be able to access outside_ip'; exit 1; fi;
 
                 echo "Checking regular connectivity..." \
                   && wget --retry-connrefused --waitretry=1 --read-timeout=15 --timeout=10 -t 2 http://registry.gitlab.com > /dev/null 2>&1 \
@@ -92,9 +122,10 @@ module Gitlab
                 if ncat -zv -w 10 127.0.0.1 80; then echo 'Airgapped connectivity port 80 check passed.'; else echo 'Airgapped connectivity port 80 check failed.'; exit 1 ; fi;
                 if ncat -zv -w 10 #{gitlab_registry_ip} 80; then echo 'Airgapped connectivity port gitlab_registry_ip check passed.'; else echo 'Airgapped connectivity port 80 check failed.'; exit 1; fi;
 
-                echo "Checking airgapped connectivity..." \
-                  && wget --retry-connrefused --waitretry=1 --read-timeout=15 --timeout=10 -t 2 http://registry.gitlab.com > /dev/null 2>&1 \
-                  && (echo "Airgapped network faulty. Connectivity wget check failed." && exit 1) || (echo "Airgapped network confirmed. Connectivity wget check passed." && exit 0)
+                #{unreachable_check(gitlab_ip, 443)}
+                #{unreachable_check(outside_ip, 80)}
+                #{unreachable_check(outside_ip, 443)}
+                #{unreachable_check(resolver_ip, 53)}
               AIRGAP_AND_VERIFY_COMMAND
             end
 

data/lib/gitlab/qa/version.rb

@@ -2,6 +2,6 @@
 
 module Gitlab
   module QA
-    VERSION = '15.10.0'
+    VERSION = '15.10.2'
   end
 end

data/support/setup/gitlab_duo_setup.rb

@@ -83,20 +83,13 @@ class GitlabDuoSetup
       ENV.fetch(key, default) == 'true'
     end
 
-    def find_add_on_purchase(add_on:)
-      GitlabSubscriptions::AddOnPurchase.find_by(add_on: add_on)
-    end
-
+    # AddOnPurchase#add_on is no longer an ActiveRecord association, so query through the model's scopes
     def duo_pro_add_on
-      return nil unless GitlabSubscriptions::AddOn.respond_to?(:code_suggestions)
-
-      find_add_on_purchase(add_on: GitlabSubscriptions::AddOn.code_suggestions.last)
+      GitlabSubscriptions::AddOnPurchase.for_gitlab_duo_pro.last
     end
 
     def duo_enterprise_add_on
-      return nil unless GitlabSubscriptions::AddOn.respond_to?(:duo_enterprise)
-
-      find_add_on_purchase(add_on: GitlabSubscriptions::AddOn.duo_enterprise.last)
+      GitlabSubscriptions::AddOnPurchase.for_duo_enterprise.last
     end
 
     def admin

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: gitlab-qa
 version: !ruby/object:Gem::Version
-  version: 15.10.0
+  version: 15.10.2
 platform: ruby
 authors:
 - GitLab Quality
 autorequire:
 bindir: exe
 cert_chain: []
-date: 2026-10-16 00:00:00.000000000 Z
+date: 2026-11-05 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: climate_control