Move assignment to protected to separate step

This moves setting the protected attribute of a pipeline to a separate
pipeline chain step in order to perform the assignment after validation.

2 files changed, 43 insertions, 11 deletions

diff --git a/spec/lib/gitlab/ci/pipeline/chain/command_spec.rb b/spec/lib/gitlab/ci/pipeline/chain/command_spec.rb
index a00d4339828..6aa802ce6fd 100644
--- a/spec/lib/gitlab/ci/pipeline/chain/command_spec.rb
+++ b/spec/lib/gitlab/ci/pipeline/chain/command_spec.rb
@@ -181,17 +181,6 @@ describe Gitlab::Ci::Pipeline::Chain::Command do
 
       it { is_expected.to eq(false) }
     end
-
-    context 'when ref is ambiguous' do
-      before do
-        project.repository.add_tag(project.creator, 'ref', 'master')
-        project.repository.add_branch(project.creator, 'ref', 'master')
-      end
-
-      it 'does not raise an error' do
-        expect { subject }.not_to raise_error
-      end
-    end
   end
 
   describe '#ambiguous_ref' do
diff --git a/spec/lib/gitlab/ci/pipeline/chain/protect_spec.rb b/spec/lib/gitlab/ci/pipeline/chain/protect_spec.rb
new file mode 100644
index 00000000000..8523ebb83fc
--- /dev/null
+++ b/spec/lib/gitlab/ci/pipeline/chain/protect_spec.rb
@@ -0,0 +1,43 @@
+# frozen_string_literal: true
+
+require 'spec_helper'
+
+describe Gitlab::Ci::Pipeline::Chain::Protect do
+  set(:project) { create(:project) }
+  set(:user) { create(:user) }
+
+  let(:pipeline) do
+    build(:ci_empty_pipeline, project: project, ref: 'master')
+  end
+
+  let(:command) do
+    Gitlab::Ci::Pipeline::Chain::Command.new(
+      project: project, current_user: user, origin_ref: 'master')
+  end
+
+  let(:step) { described_class.new(pipeline, command) }
+
+  context 'when the ref is protected' do
+    before do
+      allow(project).to receive(:protected_for?).with('master').and_return(true)
+
+      step.perform!
+    end
+
+    it 'protects the pipeline' do
+      expect(pipeline.protected).to eq(true)
+    end
+  end
+
+  context 'when the ref is not protected' do
+    before do
+      allow(project).to receive(:protected_for?).with('master').and_return(false)
+
+      step.perform!
+    end
+
+    it 'does not protect the pipeline' do
+      expect(pipeline.protected).to eq(false)
+    end
+  end
+end