Change default only policychange-default-only-policy

4 files changed, 41 insertions, 4 deletions

diff --git a/lib/gitlab/ci/build/policy/projects.rb b/lib/gitlab/ci/build/policy/projects.rb
new file mode 100644
index 00000000000..21f6104172a
--- /dev/null
+++ b/lib/gitlab/ci/build/policy/projects.rb
@@ -0,0 +1,29 @@
+# frozen_string_literal: true
+
+module Gitlab
+  module Ci
+    module Build
+      module Policy
+        class Projects < Policy::Specification
+          def initialize(projects)
+            @paths = Array(projects)
+          end
+
+          def satisfied_by?(pipeline, seed = nil)
+            @paths.any? do |path|
+              matches_path?(path, pipeline)
+            end
+          end
+
+          private
+
+          def matches_path?(path, pipeline)
+            return true unless path
+
+            pipeline.project_full_path == path
+          end
+        end
+      end
+    end
+  end
+end
diff --git a/lib/gitlab/ci/build/policy/refs.rb b/lib/gitlab/ci/build/policy/refs.rb
index c3005303fd8..6a2c2a1eb02 100644
--- a/lib/gitlab/ci/build/policy/refs.rb
+++ b/lib/gitlab/ci/build/policy/refs.rb
@@ -29,6 +29,7 @@ module Gitlab
           def matches_pattern?(pattern, pipeline)
             return true if pipeline.tag? && pattern == 'tags'
             return true if pipeline.branch? && pattern == 'branches'
+            return true if pattern == 'protected_refs' && pipeline.protected_ref?
             return true if sanitized_source_name(pipeline) == pattern
             return true if sanitized_source_name(pipeline)&.pluralize == pattern
 
diff --git a/lib/gitlab/ci/config/entry/job.rb b/lib/gitlab/ci/config/entry/job.rb
index 290c9591b98..94dd9960652 100644
--- a/lib/gitlab/ci/config/entry/job.rb
+++ b/lib/gitlab/ci/config/entry/job.rb
@@ -67,7 +67,7 @@ module Gitlab
 
           entry :only, Entry::Policy,
             description: 'Refs policy this job will be executed for.',
-            default: Entry::Policy::DEFAULT_ONLY
+            default: Entry::Policy.default_only
 
           entry :except, Entry::Policy,
             description: 'Refs policy this job will be executed for.'
diff --git a/lib/gitlab/ci/config/entry/policy.rb b/lib/gitlab/ci/config/entry/policy.rb
index 7b14218d3ea..183ae4beee7 100644
--- a/lib/gitlab/ci/config/entry/policy.rb
+++ b/lib/gitlab/ci/config/entry/policy.rb
@@ -11,7 +11,13 @@ module Gitlab
           strategy :RefsPolicy, if: -> (config) { config.is_a?(Array) }
           strategy :ComplexPolicy, if: -> (config) { config.is_a?(Hash) }
 
-          DEFAULT_ONLY = { refs: %w[branches tags] }.freeze
+          def self.default_only
+            if Feature.enable(:ci_new_default_only, project)
+              { refs: %w[protected_refs tags merge_requests] }
+            else
+              { refs: %w[branches tags] }
+            end
+          end
 
           class RefsPolicy < ::Gitlab::Config::Entry::Node
             include ::Gitlab::Config::Entry::Validatable
@@ -29,8 +35,8 @@ module Gitlab
             include ::Gitlab::Config::Entry::Validatable
             include ::Gitlab::Config::Entry::Attributable
 
-            ALLOWED_KEYS = %i[refs kubernetes variables changes].freeze
-            attributes :refs, :kubernetes, :variables, :changes
+            ALLOWED_KEYS = %i[refs kubernetes variables changes projects].freeze
+            attributes :refs, :kubernetes, :variables, :changes, :projects
 
             validations do
               validates :config, presence: true
@@ -42,6 +48,7 @@ module Gitlab
                 validates :kubernetes, allowed_values: %w[active]
                 validates :variables, array_of_strings: true
                 validates :changes, array_of_strings: true
+                validates :projects, array_of_strings: true
               end
 
               def variables_expressions_syntax