disallow group runners to become project runners

2 files changed, 7 insertions, 0 deletions

diff --git a/lib/api/runners.rb b/lib/api/runners.rb
index 3098b296a27..b28621c357d 100644
--- a/lib/api/runners.rb
+++ b/lib/api/runners.rb
@@ -205,6 +205,7 @@ module API
       def authenticate_enable_runner!(runner)
         forbidden!("Runner is shared") if runner.is_shared?
         forbidden!("Runner is locked") if runner.locked?
+        forbidden!("Runner is a group runner") if runner.group?
         return if current_user.admin?
 
         forbidden!("No access granted") unless user_can_access_runner?(runner)
diff --git a/spec/requests/api/runners_spec.rb b/spec/requests/api/runners_spec.rb
index 427c60501e0..dd196787034 100644
--- a/spec/requests/api/runners_spec.rb
+++ b/spec/requests/api/runners_spec.rb
@@ -655,6 +655,12 @@ describe API::Runners do
         expect(response).to have_gitlab_http_status(403)
       end
 
+      it 'does not enable group runner' do
+        post api("/projects/#{project.id}/runners", user), runner_id: group_runner.id
+
+        expect(response).to have_http_status(403)
+      end
+
       context 'user is admin' do
         it 'enables any specific runner' do
           expect do