Enable/disable Auto DevOps at Group level

- Includes instance methods on Group model to detect when a group has
AutoDevOps explicitly/implicitly enabled/disabled.
- Includes migration to add a new column to namespaces table
- Add UI necessary modifications
- Add service and controller to update auto devops
related instances
- Updates project and groups auto devops badges

Closes https://gitlab.com/gitlab-org/gitlab-ce/issues/52447

9 files changed, 111 insertions, 8 deletions

diff --git a/app/controllers/groups/settings/ci_cd_controller.rb b/app/controllers/groups/settings/ci_cd_controller.rb
index f476f428fdb..f378f7ac79a 100644
--- a/app/controllers/groups/settings/ci_cd_controller.rb
+++ b/app/controllers/groups/settings/ci_cd_controller.rb
@@ -17,6 +17,16 @@ module Groups
         redirect_to group_settings_ci_cd_path
       end
 
+      def update_auto_devops
+        if auto_devops_service.execute
+          flash[:notice] = s_('GroupSettings|Auto DevOps pipeline was updated for the group')
+        else
+          flash[:alert] = s_("GroupSettings|There was a problem updating Auto DevOps pipeline: %{error_messages}." % { error_messages: group.errors.full_messages })
+        end
+
+        redirect_to group_settings_ci_cd_path
+      end
+
       private
 
       def define_ci_variables
@@ -29,6 +39,14 @@ module Groups
       def authorize_admin_group!
         return render_404 unless can?(current_user, :admin_group, group)
       end
+
+      def auto_devops_params
+        params.require(:group).permit(:auto_devops_enabled)
+      end
+
+      def auto_devops_service
+        Groups::AutoDevopsService.new(group, current_user, auto_devops_params)
+      end
     end
   end
 end
diff --git a/app/helpers/auto_devops_helper.rb b/app/helpers/auto_devops_helper.rb
index 67e7e475920..0f0d5350df6 100644
--- a/app/helpers/auto_devops_helper.rb
+++ b/app/helpers/auto_devops_helper.rb
@@ -9,4 +9,17 @@ module AutoDevopsHelper
       !project.repository.gitlab_ci_yml &&
       !project.ci_service
   end
+
+  def badge_for_auto_devops_scope(auto_devops_receiver)
+    return unless auto_devops_receiver.auto_devops_enabled?
+
+    case auto_devops_receiver.first_auto_devops_config[:scope]
+    when :project
+      nil
+    when :group
+      s_('CICD|group enabled')
+    when :instance
+      s_('CICD|instance enabled')
+    end
+  end
 end
diff --git a/app/models/namespace.rb b/app/models/namespace.rb
index a5c479bdc0c..dea34e812ca 100644
--- a/app/models/namespace.rb
+++ b/app/models/namespace.rb
@@ -11,6 +11,7 @@ class Namespace < ApplicationRecord
   include IgnorableColumn
   include FeatureGate
   include FromUnion
+  include Gitlab::Utils::StrongMemoize
 
   ignore_column :deleted_at
 
@@ -267,6 +268,22 @@ class Namespace < ApplicationRecord
     owner.refresh_authorized_projects
   end
 
+  def auto_devops_enabled?
+    first_auto_devops_config[:status]
+  end
+
+  def first_auto_devops_config
+    return { scope: :group, status: auto_devops_enabled } unless auto_devops_enabled.nil?
+
+    strong_memoize(:first_auto_devops_config) do
+      if has_parent?
+        parent.first_auto_devops_config
+      else
+        { scope: :instance, status: Gitlab::CurrentSettings.auto_devops_enabled? }
+      end
+    end
+  end
+
   private
 
   def path_or_parent_changed?
diff --git a/app/models/project.rb b/app/models/project.rb
index 4cc13f372c1..aba63032cdf 100644
--- a/app/models/project.rb
+++ b/app/models/project.rb
@@ -631,12 +631,21 @@ class Project < ActiveRecord::Base
   end
 
   def has_auto_devops_implicitly_enabled?
-    auto_devops&.enabled.nil? &&
-      (Gitlab::CurrentSettings.auto_devops_enabled? || Feature.enabled?(:force_autodevops_on_by_default, self))
+    auto_devops_config = first_auto_devops_config
+
+    auto_devops_config[:scope] != :project && auto_devops_config[:status]
   end
 
   def has_auto_devops_implicitly_disabled?
-    auto_devops&.enabled.nil? && !(Gitlab::CurrentSettings.auto_devops_enabled? || Feature.enabled?(:force_autodevops_on_by_default, self))
+    auto_devops_config = first_auto_devops_config
+
+    auto_devops_config[:scope] != :project && !auto_devops_config[:status]
+  end
+
+  def first_auto_devops_config
+    return namespace.first_auto_devops_config if auto_devops&.enabled.nil?
+
+    { scope: :project, status: auto_devops&.enabled || Feature.enabled?(:force_autodevops_on_by_default, self) }
   end
 
   def daily_statistics_enabled?
diff --git a/app/services/groups/auto_devops_service.rb b/app/services/groups/auto_devops_service.rb
new file mode 100644
index 00000000000..1925e0cc0ea
--- /dev/null
+++ b/app/services/groups/auto_devops_service.rb
@@ -0,0 +1,17 @@
+# frozen_string_literal: true
+
+module Groups
+  class AutoDevopsService < Groups::BaseService
+    def execute
+      raise Gitlab::Access::AccessDeniedError unless can?(current_user, :admin_group, group)
+
+      group.update(auto_devops_enabled: auto_devops_enabled)
+    end
+
+    private
+
+    def auto_devops_enabled
+      params[:auto_devops_enabled]
+    end
+  end
+end
diff --git a/app/views/groups/settings/ci_cd/_auto_devops_form.html.haml b/app/views/groups/settings/ci_cd/_auto_devops_form.html.haml
new file mode 100644
index 00000000000..e7efc0237c8
--- /dev/null
+++ b/app/views/groups/settings/ci_cd/_auto_devops_form.html.haml
@@ -0,0 +1,15 @@
+= form_for group, url: update_auto_devops_group_settings_ci_cd_path(group), method: :patch do |f|
+  = form_errors(group)
+  %fieldset
+    .form-group
+      .card.auto-devops-card
+        .card-body
+          .form-check
+            = f.check_box :auto_devops_enabled, class: 'form-check-input', checked: group.auto_devops_enabled?
+            = f.label :auto_devops_enabled, class: 'form-check-label' do
+              %strong= s_('GroupSettings|Default to Auto DevOps pipeline for all projects within this group')
+              %span.badge.badge-info#auto-devops-badge= badge_for_auto_devops_scope(group)
+            .form-text.text-muted
+              = s_('GroupSettings|The Auto DevOps pipeline will run if no alternative CI configuration file is found.')
+              = link_to _('More information'), help_page_path('topics/autodevops/index.md'), target: '_blank'
+      = f.submit _('Save changes'), class: 'btn btn-success prepend-top-15'
diff --git a/app/views/groups/settings/ci_cd/show.html.haml b/app/views/groups/settings/ci_cd/show.html.haml
index d9332e36ef5..d0f5cd94002 100644
--- a/app/views/groups/settings/ci_cd/show.html.haml
+++ b/app/views/groups/settings/ci_cd/show.html.haml
@@ -19,3 +19,17 @@
       = _('Register and see your runners for this group.')
   .settings-content
     = render 'groups/runners/index'
+
+%section.settings#auto-devops-settings.no-animate{ class: ('expanded' if expanded) }
+  .settings-header
+    %h4
+      = _('Auto DevOps')
+    %button.btn.btn-default.js-settings-toggle{ type: "button" }
+      = expanded ? _('Collapse') : _('Expand')
+    %p
+      - auto_devops_url = help_page_path('topics/autodevops/index')
+      - auto_devops_start = '<a href="%{url}" target="_blank" rel="noopener noreferrer">'.html_safe % { url: auto_devops_url }
+      = s_('GroupSettings|Auto DevOps will automatically build, test and deploy your application based on a predefined Continuous Integration and Delivery configuration. %{auto_devops_start}Learn more about Auto DevOps%{auto_devops_end}').html_safe % { auto_devops_start: auto_devops_start, auto_devops_end: '</a>'.html_safe }
+
+  .settings-content
+    = render 'groups/settings/ci_cd/auto_devops_form', group: @group
diff --git a/app/views/projects/settings/ci_cd/_autodevops_form.html.haml b/app/views/projects/settings/ci_cd/_autodevops_form.html.haml
index 8c4d1c32ebe..fac68a36e79 100644
--- a/app/views/projects/settings/ci_cd/_autodevops_form.html.haml
+++ b/app/views/projects/settings/ci_cd/_autodevops_form.html.haml
@@ -8,15 +8,15 @@
             .card.auto-devops-card
               .card-body
                 .form-check
-                  = form.check_box :enabled, class: 'form-check-input js-toggle-extra-settings', checked: @project.auto_devops_enabled?
+                  = form.check_box :enabled, class: 'form-check-input js-toggle-extra-settings', checked: auto_devops_enabled
                   = form.label :enabled, class: 'form-check-label' do
                     %strong= s_('CICD|Default to Auto DevOps pipeline')
-                    - if @project.has_auto_devops_implicitly_enabled?
-                      %span.badge.badge-info.js-instance-default-badge= s_('CICD|instance enabled')
+                    - if auto_devops_enabled
+                      %span.badge.badge-info.js-instance-default-badge= badge_for_auto_devops_scope(@project)
                   .form-text.text-muted
                     = s_('CICD|The Auto DevOps pipeline will run if no alternative CI configuration file is found.')
                     = link_to _('More information'), help_page_path('topics/autodevops/index.md'), target: '_blank'
-              .card-footer.js-extra-settings{ class: @project.auto_devops_enabled? || 'hidden' }
+              .card-footer.js-extra-settings{ class: auto_devops_enabled || 'hidden' }
                 %p.settings-message.text-center
                   - kubernetes_cluster_link = help_page_path('user/project/clusters/index')
                   - kubernetes_cluster_start = '<a href="%{url}" target="_blank" rel="noopener noreferrer">'.html_safe % { url: kubernetes_cluster_link }
diff --git a/app/views/projects/settings/ci_cd/show.html.haml b/app/views/projects/settings/ci_cd/show.html.haml
index 6966bf96724..548b7c06867 100644
--- a/app/views/projects/settings/ci_cd/show.html.haml
+++ b/app/views/projects/settings/ci_cd/show.html.haml
@@ -26,7 +26,7 @@
       = s_('CICD|Auto DevOps will automatically build, test, and deploy your application based on a predefined Continuous Integration and Delivery configuration.')
       = link_to s_('CICD|Learn more about Auto DevOps'), help_page_path('topics/autodevops/index.md')
   .settings-content
-    = render 'autodevops_form'
+    = render 'autodevops_form', auto_devops_enabled: @project.auto_devops_enabled?
 
 = render_if_exists 'projects/settings/ci_cd/protected_environments', expanded: expanded