Add releases API

This commit introduces Releases API under /api/v4/projects/:id/releases

* We are introducing release policies at project level.
* We are deprecating releases changes from tags, both api and web
interface.
* Tags::CreateService no longer create a release

This feature is controlled by :releases_page feature flag

5 files changed, 137 insertions, 12 deletions

diff --git a/lib/api/api.rb b/lib/api/api.rb
index f1448da7403..19da0b2c434 100644
--- a/lib/api/api.rb
+++ b/lib/api/api.rb
@@ -139,6 +139,7 @@ module API
     mount ::API::ProjectTemplates
     mount ::API::ProtectedBranches
     mount ::API::ProtectedTags
+    mount ::API::Releases
     mount ::API::Repositories
     mount ::API::Runner
     mount ::API::Runners
diff --git a/lib/api/entities.rb b/lib/api/entities.rb
index 22403664c21..7116ab2882b 100644
--- a/lib/api/entities.rb
+++ b/lib/api/entities.rb
@@ -1087,11 +1087,20 @@ module API
       expose :password_authentication_enabled_for_web, as: :signin_enabled
     end
 
-    class Release < Grape::Entity
+    # deprecated old Release representation
+    class TagRelease < Grape::Entity
       expose :tag, as: :tag_name
       expose :description
     end
 
+    class Release < TagRelease
+      expose :name
+      expose :description_html
+      expose :created_at
+      expose :author, using: Entities::UserBasic, if: -> (release, _) { release.author.present? }
+      expose :commit, using: Entities::Commit
+    end
+
     class Tag < Grape::Entity
       expose :name, :message, :target
 
@@ -1100,7 +1109,7 @@ module API
       end
 
       # rubocop: disable CodeReuse/ActiveRecord
-      expose :release, using: Entities::Release do |repo_tag, options|
+      expose :release, using: Entities::TagRelease do |repo_tag, options|
         options[:project].releases.find_by(tag: repo_tag.name)
       end
       # rubocop: enable CodeReuse/ActiveRecord
diff --git a/lib/api/helpers.rb b/lib/api/helpers.rb
index c3eca713712..742d3760533 100644
--- a/lib/api/helpers.rb
+++ b/lib/api/helpers.rb
@@ -255,6 +255,18 @@ module API
       authorize! :update_build, user_project
     end
 
+    def authorize_create_release!
+      authorize! :create_release, user_project
+    end
+
+    def authorize_read_release!
+      authorize! :read_release, user_project
+    end
+
+    def authorize_update_release!
+      authorize! :update_release, user_project
+    end
+
     def require_gitlab_workhorse!
       unless env['HTTP_GITLAB_WORKHORSE'].present?
         forbidden!('Request should be executed via GitLab Workhorse')
diff --git a/lib/api/releases.rb b/lib/api/releases.rb
new file mode 100644
index 00000000000..c5c2e3d9594
--- /dev/null
+++ b/lib/api/releases.rb
@@ -0,0 +1,90 @@
+# frozen_string_literal: true
+
+module API
+  class Releases < Grape::API
+    include PaginationParams
+
+    RELEASE_ENDPOINT_REQUIREMETS = API::NAMESPACE_OR_PROJECT_REQUIREMENTS.merge(tag_name: API::NO_SLASH_URL_PART_REGEX)
+
+    before { error!('404 Not Found', 404) unless Feature.enabled?(:releases_page, user_project) }
+    before { authorize_read_release! }
+
+    params do
+      requires :id, type: String, desc: 'The ID of a project'
+    end
+    resource :projects, requirements: API::NAMESPACE_OR_PROJECT_REQUIREMENTS do
+      desc 'Get a project releases' do
+        detail 'This feature was introduced in GitLab 11.7.'
+        success Entities::Release
+      end
+      params do
+        use :pagination
+      end
+      get ':id/releases' do
+        releases = ::Kaminari.paginate_array(::ReleasesFinder.new(user_project, current_user).execute)
+
+        present paginate(releases), with: Entities::Release
+      end
+
+      desc 'Get a single project release' do
+        detail 'This feature was introduced in GitLab 11.7.'
+        success Entities::Release
+      end
+      params do
+        requires :tag_name, type: String, desc: 'The name of the tag'
+      end
+      get ':id/releases/:tag_name', requirements: RELEASE_ENDPOINT_REQUIREMETS do
+        release = user_project.releases.find_by_tag(params[:tag_name])
+        not_found!('Release') unless release
+
+        present release, with: Entities::Release
+      end
+
+      desc 'Create a new release' do
+        detail 'This feature was introduced in GitLab 11.7.'
+        success Entities::Release
+      end
+      params do
+        requires :name,                type: String, desc: 'The name of the release'
+        requires :tag_name,            type: String, desc: 'The name of the tag'
+        requires :description,         type: String, desc: 'The release notes'
+        optional :ref,                 type: String, desc: 'The commit sha or branch name'
+      end
+      post ':id/releases' do
+        authorize_create_release!
+
+        result = ::CreateReleaseService.new(user_project, current_user)
+          .execute(params[:tag_name], params[:description], params[:name], params[:ref])
+
+        if result[:status] == :success
+          present result[:release], with: Entities::Release
+        else
+          render_api_error!(result[:message], 400)
+        end
+      end
+
+      desc 'Update a release' do
+        detail 'This feature was introduced in GitLab 11.7.'
+        success Entities::Release
+      end
+      params do
+        requires :tag_name,    type: String, desc: 'The name of the tag'
+        requires :name,        type: String, desc: 'The name of the release'
+        requires :description, type: String, desc: 'Release notes with markdown support'
+      end
+      put ':id/releases/:tag_name', requirements: RELEASE_ENDPOINT_REQUIREMETS do
+        authorize_update_release!
+
+        attributes = declared(params)
+        tag = attributes.delete(:tag_name)
+        result = UpdateReleaseService.new(user_project, current_user, tag, attributes).execute
+
+        if result[:status] == :success
+          present result[:release], with: Entities::Release
+        else
+          render_api_error!(result[:message], result[:http_status])
+        end
+      end
+    end
+  end
+end
diff --git a/lib/api/tags.rb b/lib/api/tags.rb
index b18eec7d796..50ad184ba99 100644
--- a/lib/api/tags.rb
+++ b/lib/api/tags.rb
@@ -42,21 +42,28 @@ module API
       end
 
       desc 'Create a new repository tag' do
+        detail 'This optional release_description parameter was deprecated in GitLab 11.7.'
         success Entities::Tag
       end
       params do
         requires :tag_name,            type: String, desc: 'The name of the tag'
         requires :ref,                 type: String, desc: 'The commit sha or branch name'
         optional :message,             type: String, desc: 'Specifying a message creates an annotated tag'
-        optional :release_description, type: String, desc: 'Specifying release notes stored in the GitLab database'
+        optional :release_description, type: String, desc: 'Specifying release notes stored in the GitLab database (deprecated in GitLab 11.7)'
       end
       post ':id/repository/tags' do
         authorize_push_project
 
         result = ::Tags::CreateService.new(user_project, current_user)
-          .execute(params[:tag_name], params[:ref], params[:message], params[:release_description])
+          .execute(params[:tag_name], params[:ref], params[:message])
 
         if result[:status] == :success
+          # Release creation with Tags API was deprecated in GitLab 11.7
+          if params[:release_description].present?
+            CreateReleaseService.new(user_project, current_user)
+              .execute(params[:tag_name], params[:release_description])
+          end
+
           present result[:tag],
                   with: Entities::Tag,
                   project: user_project
@@ -88,40 +95,46 @@ module API
       end
 
       desc 'Add a release note to a tag' do
-        success Entities::Release
+        detail 'This feature was deprecated in GitLab 11.7.'
+        success Entities::TagRelease
       end
       params do
         requires :tag_name,    type: String, desc: 'The name of the tag'
         requires :description, type: String, desc: 'Release notes with markdown support'
       end
       post ':id/repository/tags/:tag_name/release', requirements: TAG_ENDPOINT_REQUIREMENTS do
-        authorize_push_project
+        authorize_create_release!
 
         result = CreateReleaseService.new(user_project, current_user)
           .execute(params[:tag_name], params[:description])
 
         if result[:status] == :success
-          present result[:release], with: Entities::Release
+          present result[:release], with: Entities::TagRelease
         else
           render_api_error!(result[:message], result[:http_status])
         end
       end
 
       desc "Update a tag's release note" do
-        success Entities::Release
+        detail 'This feature was deprecated in GitLab 11.7.'
+        success Entities::TagRelease
       end
       params do
         requires :tag_name,    type: String, desc: 'The name of the tag'
         requires :description, type: String, desc: 'Release notes with markdown support'
       end
       put ':id/repository/tags/:tag_name/release', requirements: TAG_ENDPOINT_REQUIREMENTS do
-        authorize_push_project
+        authorize_update_release!
 
-        result = UpdateReleaseService.new(user_project, current_user)
-          .execute(params[:tag_name], params[:description])
+        result = UpdateReleaseService.new(
+          user_project,
+          current_user,
+          params[:tag_name],
+          description: params[:description]
+        ).execute
 
         if result[:status] == :success
-          present result[:release], with: Entities::Release
+          present result[:release], with: Entities::TagRelease
         else
           render_api_error!(result[:message], result[:http_status])
         end