Merge branch '55966-when-ref-is-ambiguous-createpipelineservice-raises-an-error' into 'master'

Resolve "When ref is ambiguous, `CreatePipelineService` raises an error"

Closes #55966

See merge request gitlab-org/gitlab-ce!24437

4 files changed, 34 insertions, 1 deletions

diff --git a/changelogs/unreleased/55966-when-ref-is-ambiguous-createpipelineservice-raises-an-error.yml b/changelogs/unreleased/55966-when-ref-is-ambiguous-createpipelineservice-raises-an-error.yml
new file mode 100644
index 00000000000..01a162944d3
--- /dev/null
+++ b/changelogs/unreleased/55966-when-ref-is-ambiguous-createpipelineservice-raises-an-error.yml
@@ -0,0 +1,5 @@
+---
+title: Prevent checking protected_ref? for ambiguous refs.
+merge_request: 24437
+author:
+type: fixed
diff --git a/lib/gitlab/ci/pipeline/chain/build.rb b/lib/gitlab/ci/pipeline/chain/build.rb
index d33d1edfe35..41632211374 100644
--- a/lib/gitlab/ci/pipeline/chain/build.rb
+++ b/lib/gitlab/ci/pipeline/chain/build.rb
@@ -17,7 +17,6 @@ module Gitlab
               user: @command.current_user,
               pipeline_schedule: @command.schedule,
               merge_request: @command.merge_request,
-              protected: @command.protected_ref?,
               variables_attributes: Array(@command.variables_attributes)
             )
 
diff --git a/lib/gitlab/ci/pipeline/chain/populate.rb b/lib/gitlab/ci/pipeline/chain/populate.rb
index 633d3cd4f6b..0405292a25b 100644
--- a/lib/gitlab/ci/pipeline/chain/populate.rb
+++ b/lib/gitlab/ci/pipeline/chain/populate.rb
@@ -13,6 +13,10 @@ module Gitlab
             # Allocate next IID. This operation must be outside of transactions of pipeline creations.
             pipeline.ensure_project_iid!
 
+            # Protect the pipeline. This is assigned in Populate instead of
+            # Build to prevent erroring out on ambiguous refs.
+            pipeline.protected = @command.protected_ref?
+
             ##
             # Populate pipeline with block argument of CreatePipelineService#execute.
             #
diff --git a/spec/lib/gitlab/ci/pipeline/chain/populate_spec.rb b/spec/lib/gitlab/ci/pipeline/chain/populate_spec.rb
index 1b014ecfaa4..3459939267a 100644
--- a/spec/lib/gitlab/ci/pipeline/chain/populate_spec.rb
+++ b/spec/lib/gitlab/ci/pipeline/chain/populate_spec.rb
@@ -79,6 +79,31 @@ describe Gitlab::Ci::Pipeline::Chain::Populate do
     end
   end
 
+  describe 'pipeline protect' do
+    subject { step.perform! }
+
+    context 'when ref is protected' do
+      before do
+        allow(project).to receive(:protected_for?).with('master').and_return(true)
+        allow(project).to receive(:protected_for?).with('refs/heads/master').and_return(true)
+      end
+
+      it 'does not protect the pipeline' do
+        subject
+
+        expect(pipeline.protected).to eq(true)
+      end
+    end
+
+    context 'when ref is not protected' do
+      it 'does not protect the pipeline' do
+        subject
+
+        expect(pipeline.protected).to eq(false)
+      end
+    end
+  end
+
   context 'when pipeline has validation errors' do
     let(:pipeline) do
       build(:ci_pipeline, project: project, ref: nil)