spec/lib/gitlab/ci/build/policy/refs_spec.rb


1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140

require 'spec_helper'

describe Gitlab::Ci::Build::Policy::Refs do
  describe '#satisfied_by?' do
    context 'when matching ref' do
      let(:pipeline) { build_stubbed(:ci_pipeline, ref: 'master') }

      it 'is satisfied when pipeline branch matches' do
        expect(described_class.new(%w[master deploy]))
          .to be_satisfied_by(pipeline)
      end

      it 'is not satisfied when pipeline branch does not match' do
        expect(described_class.new(%w[feature fix]))
          .not_to be_satisfied_by(pipeline)
      end
    end

    context 'when matching tags' do
      context 'when pipeline runs for a tag' do
        let(:pipeline) do
          build_stubbed(:ci_pipeline, ref: 'feature', tag: true)
        end

        it 'is satisfied when tags matcher is specified' do
          expect(described_class.new(%w[master tags]))
            .to be_satisfied_by(pipeline)
        end
      end

      context 'when pipeline is not created for a tag' do
        let(:pipeline) do
          build_stubbed(:ci_pipeline, ref: 'feature', tag: false)
        end

        it 'is not satisfied when tag match is specified' do
          expect(described_class.new(%w[master tags]))
            .not_to be_satisfied_by(pipeline)
        end
      end
    end

    context 'when also matching a path' do
      let(:pipeline) do
        build_stubbed(:ci_pipeline, ref: 'master')
      end

      it 'is satisfied when provided patch matches specified one' do
        expect(described_class.new(%W[master@#{pipeline.project_full_path}]))
          .to be_satisfied_by(pipeline)
      end

      it 'is not satisfied when path differs' do
        expect(described_class.new(%w[master@some/fork/repository]))
          .not_to be_satisfied_by(pipeline)
      end
    end

    context 'when matching a source' do
      let(:pipeline) { build_stubbed(:ci_pipeline, source: :push) }

      it 'is satisfied when provided source keyword matches' do
        expect(described_class.new(%w[pushes]))
          .to be_satisfied_by(pipeline)
      end

      it 'is not satisfied when provided source keyword does not match' do
        expect(described_class.new(%w[triggers]))
          .not_to be_satisfied_by(pipeline)
      end

      context 'when source is merge_request_event' do
        let(:pipeline) { build_stubbed(:ci_pipeline, source: :merge_request_event) }

        it 'is satisfied with only: merge_request' do
          expect(described_class.new(%w[merge_requests]))
            .to be_satisfied_by(pipeline)
        end

        it 'is not satisfied with only: merge_request_event' do
          expect(described_class.new(%w[merge_request_events]))
            .not_to be_satisfied_by(pipeline)
        end
      end
    end

    context 'when matching a ref by a regular expression' do
      let(:pipeline) { build_stubbed(:ci_pipeline, ref: 'docs-something') }

      it 'is satisfied when regexp matches pipeline ref' do
        expect(described_class.new(['/docs-.*/']))
          .to be_satisfied_by(pipeline)
      end

      it 'is satisfied when case-insensitive regexp matches pipeline ref' do
        expect(described_class.new(['/DOCS-.*/i']))
          .to be_satisfied_by(pipeline)
      end

      it 'is not satisfied when regexp does not match pipeline ref' do
        expect(described_class.new(['/fix-.*/']))
          .not_to be_satisfied_by(pipeline)
      end

      context 'when unsafe regexp is used' do
        let(:subject) { described_class.new(['/^(?!master).+/']) }

        context 'when allow_unsafe_ruby_regexp is disabled' do
          before do
            stub_feature_flags(allow_unsafe_ruby_regexp: false)
          end

          it 'ignores invalid regexp' do
            expect(subject)
              .not_to be_satisfied_by(pipeline)
          end
        end

        context 'when allow_unsafe_ruby_regexp is enabled' do
          before do
            stub_feature_flags(allow_unsafe_ruby_regexp: true)
          end

          it 'is satisfied by regexp' do
            expect(subject)
              .to be_satisfied_by(pipeline)
          end
        end
      end
    end

    context 'malicious regexp' do
      let(:pipeline) { build_stubbed(:ci_pipeline, ref: malicious_text) }

      subject { described_class.new([malicious_regexp_ruby]) }

      include_examples 'malicious regexp'
    end
  end
end