Merge branch '10014-ee-spec-models-ci-build_spec-rb-ee-spec-requests-api-runner_spec-rb-and-ee-spec-services-ci-process_pipeline_service_spec-rb-are-all-failing-ce' into 'master'

Revert "Merge branch 'revert-8baf9e5f' into 'master'"

See merge request gitlab-org/gitlab-ce!25584

4 files changed, 27 insertions, 3 deletions

diff --git a/app/models/ci/group_variable.rb b/app/models/ci/group_variable.rb
index 492d1d0329e..323ff560564 100644
--- a/app/models/ci/group_variable.rb
+++ b/app/models/ci/group_variable.rb
@@ -5,6 +5,7 @@ module Ci
     extend Gitlab::Ci::Model
     include HasVariable
     include Presentable
+    include Maskable
 
     belongs_to :group, class_name: "::Group"
 
diff --git a/app/models/ci/variable.rb b/app/models/ci/variable.rb
index 524d79014f8..64836ea4fa4 100644
--- a/app/models/ci/variable.rb
+++ b/app/models/ci/variable.rb
@@ -5,6 +5,7 @@ module Ci
     extend Gitlab::Ci::Model
     include HasVariable
     include Presentable
+    include Maskable
 
     belongs_to :project
 
diff --git a/app/models/concerns/has_variable.rb b/app/models/concerns/has_variable.rb
index dfbe413a878..2ec42a1029b 100644
--- a/app/models/concerns/has_variable.rb
+++ b/app/models/concerns/has_variable.rb
@@ -21,9 +21,9 @@ module HasVariable
     def key=(new_key)
       super(new_key.to_s.strip)
     end
+  end
 
-    def to_runner_variable
-      { key: key, value: value, public: false }
-    end
+  def to_runner_variable
+    { key: key, value: value, public: false }
   end
 end
diff --git a/app/models/concerns/maskable.rb b/app/models/concerns/maskable.rb
new file mode 100644
index 00000000000..8793f0ec965
--- /dev/null
+++ b/app/models/concerns/maskable.rb
@@ -0,0 +1,22 @@
+# frozen_string_literal: true
+
+module Maskable
+  extend ActiveSupport::Concern
+
+  # * Single line
+  # * No escape characters
+  # * No variables
+  # * No spaces
+  # * Minimal length of 8 characters
+  # * Absolutely no fun is allowed
+  REGEX = /\A\w{8,}\z/
+
+  included do
+    validates :masked, inclusion: { in: [true, false] }
+    validates :value, format: { with: REGEX }, if: :masked?
+  end
+
+  def to_runner_variable
+    super.merge(masked: masked?)
+  end
+end