Reintroduce Command#protected_ref?

8 files changed, 36 insertions, 10 deletions

diff --git a/lib/gitlab/ci/pipeline/chain/build.rb b/lib/gitlab/ci/pipeline/chain/build.rb
index 41632211374..d33d1edfe35 100644
--- a/lib/gitlab/ci/pipeline/chain/build.rb
+++ b/lib/gitlab/ci/pipeline/chain/build.rb
@@ -17,6 +17,7 @@ module Gitlab
               user: @command.current_user,
               pipeline_schedule: @command.schedule,
               merge_request: @command.merge_request,
+              protected: @command.protected_ref?,
               variables_attributes: Array(@command.variables_attributes)
             )
 
diff --git a/lib/gitlab/ci/pipeline/chain/command.rb b/lib/gitlab/ci/pipeline/chain/command.rb
index ee5022e47c4..316c283d90b 100644
--- a/lib/gitlab/ci/pipeline/chain/command.rb
+++ b/lib/gitlab/ci/pipeline/chain/command.rb
@@ -51,6 +51,12 @@ module Gitlab
           def before_sha
             self[:before_sha] || checkout_sha || Gitlab::Git::BLANK_SHA
           end
+
+          def protected_ref?
+            strong_memoize(:protected_ref) do
+              project.protected_for?(origin_ref)
+            end
+          end
         end
       end
     end
diff --git a/lib/gitlab/ci/pipeline/chain/populate.rb b/lib/gitlab/ci/pipeline/chain/populate.rb
index 45b4393ecf3..633d3cd4f6b 100644
--- a/lib/gitlab/ci/pipeline/chain/populate.rb
+++ b/lib/gitlab/ci/pipeline/chain/populate.rb
@@ -19,11 +19,6 @@ module Gitlab
             @command.seeds_block&.call(pipeline)
 
             ##
-            # Populate pipeline protected status
-            #
-            pipeline.protected = @command.project.protected_for?(@command.origin_ref)
-
-            ##
             # Populate pipeline with all stages, and stages with builds.
             #
             pipeline.stage_seeds.each do |stage|
diff --git a/lib/gitlab/ci/pipeline/chain/validate/abilities.rb b/lib/gitlab/ci/pipeline/chain/validate/abilities.rb
index e4979102fd9..ebd7e6e8289 100644
--- a/lib/gitlab/ci/pipeline/chain/validate/abilities.rb
+++ b/lib/gitlab/ci/pipeline/chain/validate/abilities.rb
@@ -31,7 +31,7 @@ module Gitlab
               if current_user
                 allowed_to_create?
               else # legacy triggers don't have a corresponding user
-                !@command.project.protected_for?(@command.origin_ref)
+                !@command.protected_ref?
               end
             end
 
diff --git a/lib/gitlab/git.rb b/lib/gitlab/git.rb
index c4aac228b2f..2d950bb151c 100644
--- a/lib/gitlab/git.rb
+++ b/lib/gitlab/git.rb
@@ -54,11 +54,11 @@ module Gitlab
       end
 
       def tag_ref?(ref)
-        ref.start_with?(TAG_REF_PREFIX)
+        ref =~ %r{#{TAG_REF_PREFIX}\w+}
       end
 
       def branch_ref?(ref)
-        ref.start_with?(BRANCH_REF_PREFIX)
+        ref =~ %r{#{BRANCH_REF_PREFIX}\w+}
       end
 
       def blank_ref?(ref)
diff --git a/spec/lib/gitlab/ci/pipeline/chain/command_spec.rb b/spec/lib/gitlab/ci/pipeline/chain/command_spec.rb
index 14b4fbd1f5a..75a177d2d1f 100644
--- a/spec/lib/gitlab/ci/pipeline/chain/command_spec.rb
+++ b/spec/lib/gitlab/ci/pipeline/chain/command_spec.rb
@@ -160,4 +160,26 @@ describe Gitlab::Ci::Pipeline::Chain::Command do
       end
     end
   end
+
+  describe '#protected_ref?' do
+    let(:command) { described_class.new(project: project, origin_ref: 'my-branch') }
+
+    subject { command.protected_ref? }
+
+    context 'when a ref is protected' do
+      before do
+        expect_any_instance_of(Project).to receive(:protected_for?).with('my-branch').and_return(true)
+      end
+
+      it { is_expected.to eq(true) }
+    end
+
+    context 'when a ref is unprotected' do
+      before do
+        expect_any_instance_of(Project).to receive(:protected_for?).with('my-branch').and_return(false)
+      end
+
+      it { is_expected.to eq(false) }
+    end
+  end
 end
diff --git a/spec/lib/gitlab/ci/pipeline/seed/build_spec.rb b/spec/lib/gitlab/ci/pipeline/seed/build_spec.rb
index fffa727c2ed..2cf812b26dc 100644
--- a/spec/lib/gitlab/ci/pipeline/seed/build_spec.rb
+++ b/spec/lib/gitlab/ci/pipeline/seed/build_spec.rb
@@ -1,7 +1,8 @@
 require 'spec_helper'
 
 describe Gitlab::Ci::Pipeline::Seed::Build do
-  let(:pipeline) { create(:ci_empty_pipeline) }
+  let(:project) { create(:project, :repository) }
+  let(:pipeline) { create(:ci_empty_pipeline, project: project) }
 
   let(:attributes) do
     { name: 'rspec',
diff --git a/spec/lib/gitlab/ci/pipeline/seed/stage_spec.rb b/spec/lib/gitlab/ci/pipeline/seed/stage_spec.rb
index 05ce3412fd8..82f741845db 100644
--- a/spec/lib/gitlab/ci/pipeline/seed/stage_spec.rb
+++ b/spec/lib/gitlab/ci/pipeline/seed/stage_spec.rb
@@ -1,7 +1,8 @@
 require 'spec_helper'
 
 describe Gitlab::Ci::Pipeline::Seed::Stage do
-  let(:pipeline) { create(:ci_empty_pipeline) }
+  let(:project) { create(:project, :repository) }
+  let(:pipeline) { create(:ci_empty_pipeline, project: project) }
 
   let(:attributes) do
     { name: 'test',