Require pipeline if "Pipeline must succeed" is setrequire-pipeline-when-enabling-only-allow-merge-if-pipeline-succeeds

When a user sets only_allow_merge_if_pipeline_succeeds, also named
as "Pipeline must succeed" project setting, we require the pipeline
to be present.

This solves race condition issues especially with external CI
providers when a build is triggered externally but no pipelines are
created in GitLab yet.

Document that a head pipeline is expected when using "Pipeline
must succeed" setting. Also explain limitations with the use of
only/except where there may not be any jobs created and the merge
request will not be allowed to be merged.

4 files changed, 24 insertions, 2 deletions

diff --git a/app/models/merge_request.rb b/app/models/merge_request.rb
index df2dc9c49eb..c9079b9897a 100644
--- a/app/models/merge_request.rb
+++ b/app/models/merge_request.rb
@@ -1030,7 +1030,7 @@ class MergeRequest < ApplicationRecord
 
   def mergeable_ci_state?
     return true unless project.only_allow_merge_if_pipeline_succeeds?
-    return true unless head_pipeline
+    return false unless head_pipeline
 
     actual_head_pipeline&.success? || actual_head_pipeline&.skipped?
   end
diff --git a/changelogs/unreleased/require-pipeline-when-enabling-only-allow-merge-if-pipeline-succeeds.yml b/changelogs/unreleased/require-pipeline-when-enabling-only-allow-merge-if-pipeline-succeeds.yml
new file mode 100644
index 00000000000..c105287532b
--- /dev/null
+++ b/changelogs/unreleased/require-pipeline-when-enabling-only-allow-merge-if-pipeline-succeeds.yml
@@ -0,0 +1,5 @@
+---
+title: Enforce presence of pipeline when "Pipeline must succeed" project setting is enabled
+merge_request: 29926
+author:
+type: fixed
diff --git a/doc/user/project/merge_requests/merge_when_pipeline_succeeds.md b/doc/user/project/merge_requests/merge_when_pipeline_succeeds.md
index c93c7a5fe08..0dd60d84c42 100644
--- a/doc/user/project/merge_requests/merge_when_pipeline_succeeds.md
+++ b/doc/user/project/merge_requests/merge_when_pipeline_succeeds.md
@@ -42,6 +42,8 @@ Navigate to your project's settings page and expand the **Merge requests** secti
 In the **Merge checks** subsection, select the **Pipelines must succeed** check
 box and hit **Save** for the changes to take effect.
 
+NOTE: **Note:** This setting also prevents merge requests from being merged if there is no pipeline.
+
 ![Pipelines must succeed settings](img/merge_when_pipeline_succeeds_only_if_succeeds_settings.png)
 
 From now on, every time the pipeline fails you will not be able to merge the
@@ -49,6 +51,21 @@ merge request from the UI, until you make all relevant jobs pass.
 
 ![Only allow merge if pipeline succeeds message](img/merge_when_pipeline_succeeds_only_if_succeeds_msg.png)
 
+### Limitations
+
+When this setting is enabled, a merge request is prevented from being merged if there is no pipeline. This may conflict with some use cases where [`only/except`](../../../ci/yaml/README.md#onlyexcept-advanced) rules are used and they don't generate any pipelines.
+
+Users that expect to be able to merge a merge request in this scenario should ensure that [there is always a pipeline](https://gitlab.com/gitlab-org/gitlab-ce/issues/54226) and that it's succesful.
+
+For example, to that on merge requests there is always a passing job even though `only/except` rules may not generate any other jobs:
+
+```yaml
+enable_merge:
+  only: merge_requests
+  script:
+    - echo true
+```
+
 <!-- ## Troubleshooting
 
 Include any troubleshooting steps that you can foresee. If you know beforehand what issues
diff --git a/spec/models/merge_request_spec.rb b/spec/models/merge_request_spec.rb
index fc28c216b21..a2547755510 100644
--- a/spec/models/merge_request_spec.rb
+++ b/spec/models/merge_request_spec.rb
@@ -2124,7 +2124,7 @@ describe MergeRequest do
           allow(subject).to receive(:head_pipeline) { nil }
         end
 
-        it { expect(subject.mergeable_ci_state?).to be_truthy }
+        it { expect(subject.mergeable_ci_state?).to be_falsey }
       end
     end