Merge branch 'no-security-scan-for-docs-branches' into 'master'

No security scan for docs branches

See merge request gitlab-org/gitlab-ce!30137

6 files changed, 61 insertions, 55 deletions

diff --git a/.gitlab/ci/docs.gitlab-ci.yml b/.gitlab/ci/docs.gitlab-ci.yml
index 4747e51f776..d7f8d70699b 100644
--- a/.gitlab/ci/docs.gitlab-ci.yml
+++ b/.gitlab/ci/docs.gitlab-ci.yml
@@ -12,7 +12,9 @@
 # Trigger a manual docs build in gitlab-docs only on non docs-only branches.
 # Useful to preview the docs changes live.
 review-docs-deploy-manual:
-  <<: *review-docs
+  extends:
+    - .review-docs
+    - .no-docs-and-no-qa
   stage: build
   script:
     - gem install gitlab --no-document
@@ -21,9 +23,6 @@ review-docs-deploy-manual:
   only:
     - branches@gitlab-org/gitlab-ce
     - branches@gitlab-org/gitlab-ee
-  except:
-    - /(^docs[\/-].*|.*-docs$)/
-    - /(^qa[\/-].*|.*-qa$)/
 
 # Always trigger a docs build in gitlab-docs only on docs-only branches.
 # Useful to preview the docs changes live.
diff --git a/.gitlab/ci/frontend.gitlab-ci.yml b/.gitlab/ci/frontend.gitlab-ci.yml
index cd6953a6ac2..8314c067d7a 100644
--- a/.gitlab/ci/frontend.gitlab-ci.yml
+++ b/.gitlab/ci/frontend.gitlab-ci.yml
@@ -70,9 +70,10 @@ gitlab:assets:compile pull-cache:
   cache:
     policy: pull
   except:
-    - master@gitlab-org/gitlab-ce
-    - master@gitlab-org/gitlab-ee
-    - /(^docs[\/-].*|.*-docs$)/
+    refs:
+      - master@gitlab-org/gitlab-ce
+      - master@gitlab-org/gitlab-ee
+      - /(^docs[\/-].*|.*-docs$)/
 
 .compile-assets-metadata:
   extends: .dedicated-runner
@@ -107,9 +108,10 @@ compile-assets pull-cache:
   cache:
     policy: pull
   except:
-    - master@gitlab-org/gitlab-ce
-    - master@gitlab-org/gitlab-ee
-    - /(^docs[\/-].*|.*-docs$)/
+    refs:
+      - master@gitlab-org/gitlab-ce
+      - master@gitlab-org/gitlab-ee
+      - /(^docs[\/-].*|.*-docs$)/
 
 gitlab:ui:visual:
   extends: .dedicated-runner
diff --git a/.gitlab/ci/global.gitlab-ci.yml b/.gitlab/ci/global.gitlab-ci.yml
index eb50f08c1a7..4da7f404767 100644
--- a/.gitlab/ci/global.gitlab-ci.yml
+++ b/.gitlab/ci/global.gitlab-ci.yml
@@ -30,7 +30,14 @@
 
 .no-docs:
   except:
-    - /(^docs[\/-].*|.*-docs$)/
+    refs:
+      - /(^docs[\/-].*|.*-docs$)/
+
+.no-docs-and-no-qa:
+  except:
+    refs:
+      - /(^docs[\/-].*|.*-docs$)/
+      - /(^qa[\/-].*|.*-qa$)/
 
 .dedicated-no-docs-pull-cache-job:
   extends:
@@ -38,10 +45,9 @@
     - .no-docs
 
 .dedicated-no-docs-and-no-qa-pull-cache-job:
-  extends: .dedicated-pull-cache-job
-  except:
-    - /(^docs[\/-].*|.*-docs$)/
-    - /(^qa[\/-].*|.*-qa$)/
+  extends:
+    - .dedicated-pull-cache-job
+    - .no-docs-and-no-qa
 
 # Jobs that do not need a DB
 .dedicated-no-docs-no-db-pull-cache-job:
diff --git a/.gitlab/ci/rails.gitlab-ci.yml b/.gitlab/ci/rails.gitlab-ci.yml
index 9dcc9479cca..009c18310e4 100644
--- a/.gitlab/ci/rails.gitlab-ci.yml
+++ b/.gitlab/ci/rails.gitlab-ci.yml
@@ -20,8 +20,9 @@
     - master@gitlab/gitlab-ee
 
 .gitlab-setup: &gitlab-setup
-  extends: .dedicated-no-docs-and-no-qa-pull-cache-job
-  <<: *use-pg
+  extends:
+    - .dedicated-no-docs-and-no-qa-pull-cache-job
+    - .use-pg
   variables:
     SETUP_DB: "false"
   script:
@@ -43,7 +44,9 @@
     - bundle exec rake $CI_JOB_NAME
 
 .rspec-metadata: &rspec-metadata
-  extends: .dedicated-pull-cache-job
+  extends:
+    - .dedicated-pull-cache-job
+    - .no-docs-and-no-qa
   stage: test
   script:
     - JOB_NAME=( $CI_JOB_NAME )
@@ -76,9 +79,6 @@
       - tmp/capybara/
     reports:
       junit: junit_rspec.xml
-  except:
-    - /(^docs[\/-].*|.*-docs$)/
-    - /(^qa[\/-].*|.*-qa$)/
 
 .rspec-metadata-pg: &rspec-metadata-pg
   <<: *rspec-metadata
@@ -122,8 +122,10 @@
     - setup-test-env
 
 setup-test-env:
-  extends: .dedicated-runner-default-cache
-  <<: *use-pg
+  extends:
+    - .dedicated-runner-default-cache
+    - .no-docs
+    - .use-pg
   stage: prepare
   script:
     - bundle exec ruby -Ispec -e 'require "spec_helper" ; TestEnv.init'
@@ -134,8 +136,6 @@ setup-test-env:
       - tmp/tests
       - config/secrets.yml
       - vendor/gitaly-ruby
-  except:
-    - /(^docs[\/-].*|.*-docs$)/
 
 rspec unit pg:
   <<: *rspec-metadata-pg
@@ -200,11 +200,12 @@ static-analysis:
 downtime_check:
   <<: *rake-exec
   except:
-    - master
-    - tags
-    - /^[\d-]+-stable(-ee)?$/
-    - /(^docs[\/-].*|.*-docs$)/
-    - /(^qa[\/-].*|.*-qa$)/
+    refs:
+      - master
+      - tags
+      - /^[\d-]+-stable(-ee)?$/
+      - /(^docs[\/-].*|.*-docs$)/
+      - /(^qa[\/-].*|.*-qa$)/
   dependencies:
     - setup-test-env
 
@@ -212,12 +213,13 @@ ee_compat_check:
   <<: *rake-exec
   dependencies: []
   except:
-    - master
-    - tags
-    - /[\d-]+-stable(-ee)?/
-    - /^security-/
-    - branches@gitlab-org/gitlab-ee
-    - branches@gitlab/gitlab-ee
+    refs:
+      - master
+      - tags
+      - /[\d-]+-stable(-ee)?/
+      - /^security-/
+      - branches@gitlab-org/gitlab-ee
+      - branches@gitlab/gitlab-ee
   retry: 0
   artifacts:
     name: "${CI_JOB_NAME}_${CI_COMIT_REF_NAME}_${CI_COMMIT_SHA}"
@@ -261,7 +263,9 @@ gitlab:setup-pg:
 coverage:
   # Don't include dedicated-no-docs-no-db-pull-cache-job here since we need to
   # download artifacts from all the rspec jobs instead of from setup-test-env only
-  extends: .dedicated-runner-default-cache
+  extends:
+    - .dedicated-runner-default-cache
+    - .no-docs-and-no-qa
   cache:
     policy: pull
   variables:
@@ -276,6 +280,3 @@ coverage:
     paths:
       - coverage/index.html
       - coverage/assets/
-  except:
-    - /(^docs[\/-].*|.*-docs$)/
-    - /(^qa[\/-].*|.*-qa$)/
diff --git a/.gitlab/ci/setup.gitlab-ci.yml b/.gitlab/ci/setup.gitlab-ci.yml
index debc90a1cb0..c1fc3a893ca 100644
--- a/.gitlab/ci/setup.gitlab-ci.yml
+++ b/.gitlab/ci/setup.gitlab-ci.yml
@@ -15,7 +15,9 @@ cache gems:
     - setup-test-env
 
 gitlab_git_test:
-  extends: .dedicated-runner
+  extends:
+    - .dedicated-runner
+    - .no-docs-and-no-qa
   variables:
     SETUP_DB: "false"
   before_script: []
@@ -23,12 +25,11 @@ gitlab_git_test:
   cache: {}
   script:
     - spec/support/prepare-gitlab-git-test-for-commit --check-for-changes
-  except:
-    - /(^docs[\/-].*|.*-docs$)/
-    - /(^qa[\/-].*|.*-qa$)/
 
 no_ee_check:
-  extends: .dedicated-runner
+  extends:
+    - .dedicated-runner
+    - .no-docs-and-no-qa
   variables:
     SETUP_DB: "false"
   before_script: []
@@ -38,6 +39,3 @@ no_ee_check:
     - scripts/no-ee-check
   only:
     - /.+/@gitlab-org/gitlab-ce
-  except:
-    - /(^docs[\/-].*|.*-docs$)/
-    - /(^qa[\/-].*|.*-qa$)/
diff --git a/.gitlab/ci/test-metadata.gitlab-ci.yml b/.gitlab/ci/test-metadata.gitlab-ci.yml
index c51f825f831..2454ea85652 100644
--- a/.gitlab/ci/test-metadata.gitlab-ci.yml
+++ b/.gitlab/ci/test-metadata.gitlab-ci.yml
@@ -12,7 +12,9 @@
       - rspec_profiling/
 
 retrieve-tests-metadata:
-  <<: *tests-metadata-state
+  extends:
+    - .tests-metadata-state
+    - .no-docs-and-no-qa
   stage: prepare
   cache:
     key: tests_metadata
@@ -25,9 +27,6 @@ retrieve-tests-metadata:
     - mkdir -p rspec_profiling/
     - wget -O $FLAKY_RSPEC_SUITE_REPORT_PATH http://${TESTS_METADATA_S3_BUCKET}.s3.amazonaws.com/$FLAKY_RSPEC_SUITE_REPORT_PATH || rm $FLAKY_RSPEC_SUITE_REPORT_PATH
     - '[[ -f $FLAKY_RSPEC_SUITE_REPORT_PATH ]] || echo "{}" > ${FLAKY_RSPEC_SUITE_REPORT_PATH}'
-  except:
-    - /(^docs[\/-].*|.*-docs$)/
-    - /(^qa[\/-].*|.*-qa$)/
 
 update-tests-metadata:
   <<: *tests-metadata-state
@@ -69,9 +68,10 @@ flaky-examples-check:
   only:
     - branches
   except:
-    - master
-    - /(^docs[\/-].*|.*-docs$)/
-    - /(^qa[\/-].*|.*-qa$)/
+    refs:
+      - master
+      - /(^docs[\/-].*|.*-docs$)/
+      - /(^qa[\/-].*|.*-qa$)/
   artifacts:
     expire_in: 30d
     paths: