Merge remote-tracking branch 'upstream/master' into 32815--Add-Custom-CI-Config-Path

* upstream/master: (123 commits)
  Backport changes to Projects::IssuesController and the search bar
  bugfix: use `require_dependency` to bring in DeclarativePolicy
  Resolve "Select branch dropdown is too close to branch name"
  Clean up issuable lists
  Defer project destroys within a namespace in Groups::DestroyService#async_execute
  Fixed new navgiation bar logo height in Safari
  Resolve "Issue dropdown persists when adding issue number to issue description"
  Move verification to block level instead of paragraph
  Revert "Merge branch 'dm-drop-default-scope-on-sortable-finders' into 'master'"
  Added code for defining SHA attributes
  Minor edits
  Job details won't scroll horizontally to show long lines
  Run mysql tests on stable preperation branches like 9-3-stable-patch-2
  Bring back branches badge to main project page
  optimize translation content based on comments
  supplement traditional chinese in taiwan translation
  Inserts exact matches of username, email and name to the top of the user search list
  Remove Namespace model default scope override and write additional test to Project search
  optimize translation content based on comments
  Limit OpenGraph image size to 64x64
  ...

1 files changed, 9 insertions, 6 deletions

diff --git a/app/policies/ci/runner_policy.rb b/app/policies/ci/runner_policy.rb
index 416d93ffe63..7dff8470e23 100644
--- a/app/policies/ci/runner_policy.rb
+++ b/app/policies/ci/runner_policy.rb
@@ -1,13 +1,16 @@
 module Ci
   class RunnerPolicy < BasePolicy
-    def rules
-      return unless @user
+    with_options scope: :subject, score: 0
+    condition(:shared) { @subject.is_shared? }
 
-      can! :assign_runner if @user.admin?
+    with_options scope: :subject, score: 0
+    condition(:locked, scope: :subject) { @subject.locked? }
 
-      return if @subject.is_shared? || @subject.locked?
+    condition(:authorized_runner) { @user.ci_authorized_runners.include?(@subject) }
 
-      can! :assign_runner if @user.ci_authorized_runners.include?(@subject)
-    end
+    rule { anonymous }.prevent_all
+    rule { admin | authorized_runner }.enable :assign_runner
+    rule { ~admin & shared }.prevent :assign_runner
+    rule { ~admin & locked }.prevent :assign_runner
   end
 end