Merge remote-tracking branch 'upstream/master' into qa-add-more-key-tests

* upstream/master: (166 commits)
  Flowdock uses Gitaly, not Grit
  Removes 'no job log' from trace action
  Fix missing namespace for some internal users
  Dedupe yarn dependencies
  Downgrade MySQL CI service from 8.0 to 5.7
  Atomic internal ids for all models
  Add documentation on how to configure Redis Sentinel by persistent class
  Update CHANGELOG.md for 10.7.0
  Update index.md
  Resolve "Text from the diff is showing within a table header inside the discussion after the discussion is resolved"
  Don't include lfs_file_locks data in export bundle
  Documentation: Frontend Building Checklist
  Fix a documentation typo for GitLab pages
  Refactored activity calendar
  Add an API endpoint to download git repository snapshots
  Fix issues without links when added from boards new issue  modal
  Respect visibility options and description when importing project from template
  Resolve "Improve tooltips of collapsed sidebars"
  Update Container Scanning documentation
  Fix typo in vue.md
  ...

13 files changed, 243 insertions, 9 deletions

diff --git a/qa/qa.rb b/qa/qa.rb
index 48dfc93dd62..40e12c8b336 100644
--- a/qa/qa.rb
+++ b/qa/qa.rb
@@ -37,6 +37,7 @@ module QA
       autoload :Project, 'qa/factory/resource/project'
       autoload :MergeRequest, 'qa/factory/resource/merge_request'
       autoload :DeployKey, 'qa/factory/resource/deploy_key'
+      autoload :Branch, 'qa/factory/resource/branch'
       autoload :SecretVariable, 'qa/factory/resource/secret_variable'
       autoload :Runner, 'qa/factory/resource/runner'
       autoload :PersonalAccessToken, 'qa/factory/resource/personal_access_token'
@@ -138,6 +139,7 @@ module QA
         autoload :Repository, 'qa/page/project/settings/repository'
         autoload :CICD, 'qa/page/project/settings/ci_cd'
         autoload :DeployKeys, 'qa/page/project/settings/deploy_keys'
+        autoload :ProtectedBranches, 'qa/page/project/settings/protected_branches'
         autoload :SecretVariables, 'qa/page/project/settings/secret_variables'
         autoload :Runners, 'qa/page/project/settings/runners'
         autoload :MergeRequest, 'qa/page/project/settings/merge_request'
diff --git a/qa/qa/factory/base.rb b/qa/qa/factory/base.rb
index afaa96b4541..7a532ce534b 100644
--- a/qa/qa/factory/base.rb
+++ b/qa/qa/factory/base.rb
@@ -22,7 +22,7 @@ module QA
 
           factory.fabricate!(*args)
 
-          return Factory::Product.populate!(factory)
+          break Factory::Product.populate!(factory)
         end
       end
 
diff --git a/qa/qa/factory/resource/branch.rb b/qa/qa/factory/resource/branch.rb
new file mode 100644
index 00000000000..d0ef142e90d
--- /dev/null
+++ b/qa/qa/factory/resource/branch.rb
@@ -0,0 +1,73 @@
+module QA
+  module Factory
+    module Resource
+      class Branch < Factory::Base
+        attr_accessor :project, :branch_name, :allow_to_push, :protected
+
+        dependency Factory::Resource::Project, as: :project do |project|
+          project.name = 'protected-branch-project'
+        end
+
+        product :name do
+          Page::Project::Settings::Repository.act do
+            expand_protected_branches(&:last_branch_name)
+          end
+        end
+
+        product :push_allowance do
+          Page::Project::Settings::Repository.act do
+            expand_protected_branches(&:last_push_allowance)
+          end
+        end
+
+        def initialize
+          @branch_name = 'test/branch'
+          @allow_to_push = true
+          @protected = false
+        end
+
+        def fabricate!
+          project.visit!
+
+          Factory::Repository::Push.fabricate! do |resource|
+            resource.project = project
+            resource.file_name = 'kick-off.txt'
+            resource.commit_message = 'First commit'
+          end
+
+          branch = Factory::Repository::Push.fabricate! do |resource|
+            resource.project = project
+            resource.file_name = 'README.md'
+            resource.commit_message = 'Add readme'
+            resource.branch_name = "master:#{@branch_name}"
+          end
+
+          Page::Project::Show.act { wait_for_push }
+
+          # The upcoming process will make it access the Protected Branches page,
+          # select the already created branch and protect it according
+          # to `allow_to_push` variable.
+          return branch unless @protected
+
+          Page::Menu::Side.act do
+            click_repository_settings
+          end
+
+          Page::Project::Settings::Repository.perform do |setting|
+            setting.expand_protected_branches do |page|
+              page.select_branch(branch_name)
+
+              if allow_to_push
+                page.allow_devs_and_masters_to_push
+              else
+                page.allow_no_one_to_push
+              end
+
+              page.protect_branch
+            end
+          end
+        end
+      end
+    end
+  end
+end
diff --git a/qa/qa/git/repository.rb b/qa/qa/git/repository.rb
index 4ffe25304a1..7aef0fd4c7a 100644
--- a/qa/qa/git/repository.rb
+++ b/qa/qa/git/repository.rb
@@ -1,11 +1,14 @@
 require 'cgi'
 require 'uri'
+require 'open3'
 
 module QA
   module Git
     class Repository
       include Scenario::Actable
 
+      attr_reader :push_error
+
       def self.perform(*args)
         Dir.mktmpdir do |dir|
           Dir.chdir(dir) { super }
@@ -69,7 +72,8 @@ module QA
       end
 
       def push_changes(branch = 'master')
-        `git push #{@uri.to_s} #{branch} #{suppress_output}`
+        # capture3 returns stdout, stderr and status.
+        _, @push_error, _ = Open3.capture3("git push #{@uri} #{branch} #{suppress_output}")
       end
 
       def commits
diff --git a/qa/qa/page/README.md b/qa/qa/page/README.md
index d38223f690d..2dbc59846e7 100644
--- a/qa/qa/page/README.md
+++ b/qa/qa/page/README.md
@@ -115,8 +115,8 @@ from within the `qa` directory.
 
 ## Where to ask for help?
 
-If you need more information, ask for help on `#qa` channel on Slack (GitLab
-Team only).
+If you need more information, ask for help on `#quality` channel on Slack
+(internal, GitLab Team only).
 
 If you are not a Team Member, and you still need help to contribute, please
 open an issue in GitLab QA issue tracker.
diff --git a/qa/qa/page/group/show.rb b/qa/qa/page/group/show.rb
index d215518d316..89125bd2e59 100644
--- a/qa/qa/page/group/show.rb
+++ b/qa/qa/page/group/show.rb
@@ -29,7 +29,7 @@ module QA
           filter_by_name(name)
 
           wait(reload: false) do
-            return false if page.has_content?('Sorry, no groups or projects matched your search')
+            break false if page.has_content?('Sorry, no groups or projects matched your search')
 
             page.has_link?(name)
           end
diff --git a/qa/qa/page/project/pipeline/show.rb b/qa/qa/page/project/pipeline/show.rb
index b183552d46c..ec61c47b3bb 100644
--- a/qa/qa/page/project/pipeline/show.rb
+++ b/qa/qa/page/project/pipeline/show.rb
@@ -20,14 +20,14 @@ module QA::Page
 
       def running?
         within('.ci-header-container') do
-          return page.has_content?('running')
+          page.has_content?('running')
         end
       end
 
       def has_build?(name, status: :success)
         within('.pipeline-graph') do
           within('.ci-job-component', text: name) do
-            return has_selector?(".ci-status-icon-#{status}")
+            has_selector?(".ci-status-icon-#{status}")
           end
         end
       end
diff --git a/qa/qa/page/project/settings/protected_branches.rb b/qa/qa/page/project/settings/protected_branches.rb
new file mode 100644
index 00000000000..f3563401124
--- /dev/null
+++ b/qa/qa/page/project/settings/protected_branches.rb
@@ -0,0 +1,69 @@
+module QA
+  module Page
+    module Project
+      module Settings
+        class ProtectedBranches < Page::Base
+          view 'app/views/projects/protected_branches/shared/_dropdown.html.haml' do
+            element :protected_branch_select
+            element :protected_branch_dropdown
+          end
+
+          view 'app/views/projects/protected_branches/_create_protected_branch.html.haml' do
+            element :allowed_to_push_select
+            element :allowed_to_push_dropdown
+          end
+
+          view 'app/views/projects/protected_branches/shared/_branches_list.html.haml' do
+            element :protected_branches_list
+          end
+
+          view 'app/views/projects/protected_branches/shared/_protected_branch.html.haml' do
+            element :protected_branch_name
+          end
+
+          def select_branch(branch_name)
+            click_element :protected_branch_select
+
+            within_element(:protected_branch_dropdown) do
+              click_on branch_name
+            end
+          end
+
+          def allow_no_one_to_push
+            allow_to_push('No one')
+          end
+
+          def allow_devs_and_masters_to_push
+            allow_to_push('Developers + Masters')
+          end
+
+          def protect_branch
+            click_on 'Protect'
+          end
+
+          def last_branch_name
+            within_element(:protected_branches_list) do
+              all('.qa-protected-branch-name').last
+            end
+          end
+
+          def last_push_allowance
+            within_element(:protected_branches_list) do
+              all('.qa-allowed-to-push').last
+            end
+          end
+
+          private
+
+          def allow_to_push(text)
+            click_element :allowed_to_push_select
+
+            within_element(:allowed_to_push_dropdown) do
+              click_on text
+            end
+          end
+        end
+      end
+    end
+  end
+end
diff --git a/qa/qa/page/project/settings/repository.rb b/qa/qa/page/project/settings/repository.rb
index 22362164a1a..30900e74e90 100644
--- a/qa/qa/page/project/settings/repository.rb
+++ b/qa/qa/page/project/settings/repository.rb
@@ -14,6 +14,12 @@ module QA
               DeployKeys.perform(&block)
             end
           end
+
+          def expand_protected_branches(&block)
+            expand_section('Protected Branches') do
+              ProtectedBranches.perform(&block)
+            end
+          end
         end
       end
     end
diff --git a/qa/qa/page/project/show.rb b/qa/qa/page/project/show.rb
index 261acb10a7a..5bbef040330 100644
--- a/qa/qa/page/project/show.rb
+++ b/qa/qa/page/project/show.rb
@@ -21,6 +21,11 @@ module QA
           element :new_issue_link, "link_to 'New issue', new_project_issue_path(@project)"
         end
 
+        view 'app/views/shared/_ref_switcher.html.haml' do
+          element :branches_select
+          element :branches_dropdown
+        end
+
         def choose_repository_clone_http
           choose_repository_clone('HTTP', 'http')
         end
@@ -40,6 +45,18 @@ module QA
           find('.qa-project-name').text
         end
 
+        def switch_to_branch(branch_name)
+          find_element(:branches_select).click
+
+          within_element(:branches_dropdown) do
+            click_on branch_name
+          end
+        end
+
+        def last_commit_content
+          find_element(:commit_content).text
+        end
+
         def new_merge_request
           wait(reload: true) do
             has_css?(element_selector_css(:create_merge_request))
diff --git a/qa/qa/scenario/template.rb b/qa/qa/scenario/template.rb
index 341998af160..d21a9d52997 100644
--- a/qa/qa/scenario/template.rb
+++ b/qa/qa/scenario/template.rb
@@ -4,7 +4,7 @@ module QA
       def self.perform(*args)
         new.tap do |scenario|
           yield scenario if block_given?
-          return scenario.perform(*args)
+          break scenario.perform(*args)
         end
       end
 
diff --git a/qa/qa/scenario/test/sanity/selectors.rb b/qa/qa/scenario/test/sanity/selectors.rb
index c87eb5f3dfb..cff320cb751 100644
--- a/qa/qa/scenario/test/sanity/selectors.rb
+++ b/qa/qa/scenario/test/sanity/selectors.rb
@@ -31,7 +31,7 @@ module QA
                 current changes in this merge request.
 
                 For more help see documentation in `qa/page/README.md` file or
-                ask for help on #qa channel on Slack (GitLab Team only).
+                ask for help on #quality channel on Slack (GitLab Team only).
 
                 If you are not a Team Member, and you still need help to
                 contribute, please open an issue in GitLab QA issue tracker.
diff --git a/qa/qa/specs/features/repository/protected_branches_spec.rb b/qa/qa/specs/features/repository/protected_branches_spec.rb
new file mode 100644
index 00000000000..88fa4994e32
--- /dev/null
+++ b/qa/qa/specs/features/repository/protected_branches_spec.rb
@@ -0,0 +1,63 @@
+module QA
+  feature 'branch protection support', :core do
+    given(:branch_name) { 'protected-branch' }
+    given(:commit_message) { 'Protected push commit message' }
+    given(:project) do
+      Factory::Resource::Project.fabricate! do |resource|
+        resource.name = 'protected-branch-project'
+      end
+    end
+    given(:location) do
+      Page::Project::Show.act do
+        choose_repository_clone_http
+        repository_location
+      end
+    end
+
+    before do
+      Runtime::Browser.visit(:gitlab, Page::Main::Login)
+      Page::Main::Login.act { sign_in_using_credentials }
+    end
+
+    scenario 'user is able to protect a branch' do
+      protected_branch = Factory::Resource::Branch.fabricate! do |resource|
+        resource.branch_name = branch_name
+        resource.project = project
+        resource.allow_to_push = true
+        resource.protected = true
+      end
+
+      expect(protected_branch.name).to have_content(branch_name)
+      expect(protected_branch.push_allowance).to have_content('Developers + Masters')
+    end
+
+    scenario 'users without authorization cannot push to protected branch' do
+      Factory::Resource::Branch.fabricate! do |resource|
+        resource.branch_name = branch_name
+        resource.project = project
+        resource.allow_to_push = false
+        resource.protected = true
+      end
+
+      project.visit!
+
+      Git::Repository.perform do |repository|
+        repository.location = location
+        repository.use_default_credentials
+
+        repository.act do
+          clone
+          configure_identity('GitLab QA', 'root@gitlab.com')
+          checkout('protected-branch')
+          commit_file('README.md', 'readme content', 'Add a readme')
+          push_changes('protected-branch')
+        end
+
+        expect(repository.push_error)
+          .to match(/remote\: GitLab\: You are not allowed to push code to protected branches on this project/)
+        expect(repository.push_error)
+          .to match(/\[remote rejected\] #{branch_name} -> #{branch_name} \(pre-receive hook declined\)/)
+      end
+    end
+  end
+end