Move assignment to protected to separate step

This moves setting the protected attribute of a pipeline to a separate
pipeline chain step in order to perform the assignment after validation.

3 files changed, 19 insertions, 3 deletions

diff --git a/lib/gitlab/ci/pipeline/chain/build.rb b/lib/gitlab/ci/pipeline/chain/build.rb
index d33d1edfe35..41632211374 100644
--- a/lib/gitlab/ci/pipeline/chain/build.rb
+++ b/lib/gitlab/ci/pipeline/chain/build.rb
@@ -17,7 +17,6 @@ module Gitlab
               user: @command.current_user,
               pipeline_schedule: @command.schedule,
               merge_request: @command.merge_request,
-              protected: @command.protected_ref?,
               variables_attributes: Array(@command.variables_attributes)
             )
 
diff --git a/lib/gitlab/ci/pipeline/chain/command.rb b/lib/gitlab/ci/pipeline/chain/command.rb
index e0172e56f56..e62d547d862 100644
--- a/lib/gitlab/ci/pipeline/chain/command.rb
+++ b/lib/gitlab/ci/pipeline/chain/command.rb
@@ -53,8 +53,6 @@ module Gitlab
           end
 
           def protected_ref?
-            return if ambiguous_ref?
-
             strong_memoize(:protected_ref) do
               project.protected_for?(origin_ref)
             end
diff --git a/lib/gitlab/ci/pipeline/chain/protect.rb b/lib/gitlab/ci/pipeline/chain/protect.rb
new file mode 100644
index 00000000000..4c743d6b988
--- /dev/null
+++ b/lib/gitlab/ci/pipeline/chain/protect.rb
@@ -0,0 +1,19 @@
+# frozen_string_literal: true
+
+module Gitlab
+  module Ci
+    module Pipeline
+      module Chain
+        class Protect < Chain::Base
+          def perform!
+            @pipeline.protected = @command.protected_ref?
+          end
+
+          def break?
+            @pipeline.protected? != @command.protected_ref?
+          end
+        end
+      end
+    end
+  end
+end