Implement support for CI variables of type file

Add env_var and file as supported types for CI variables. Variables of
type file expose to users existing gitlab-runner behaviour - save
variable value into a temp file and set the path to this file in an ENV
var named after the variable key.

Resolves https://gitlab.com/gitlab-org/gitlab-ce/issues/46806.

14 files changed, 82 insertions, 18 deletions

diff --git a/spec/controllers/projects/pipeline_schedules_controller_spec.rb b/spec/controllers/projects/pipeline_schedules_controller_spec.rb
index eb8983a7633..850ef9c92fb 100644
--- a/spec/controllers/projects/pipeline_schedules_controller_spec.rb
+++ b/spec/controllers/projects/pipeline_schedules_controller_spec.rb
@@ -91,7 +91,7 @@ describe Projects::PipelineSchedulesController do
       context 'when variables_attributes has one variable' do
         let(:schedule) do
           basic_param.merge({
-            variables_attributes: [{ key: 'AAA', secret_value: 'AAA123' }]
+            variables_attributes: [{ key: 'AAA', secret_value: 'AAA123', variable_type: 'file' }]
           })
         end
 
@@ -105,6 +105,7 @@ describe Projects::PipelineSchedulesController do
           Ci::PipelineScheduleVariable.last.tap do |v|
             expect(v.key).to eq("AAA")
             expect(v.value).to eq("AAA123")
+            expect(v.variable_type).to eq("file")
           end
         end
       end
diff --git a/spec/factories/ci/pipeline_schedule_variables.rb b/spec/factories/ci/pipeline_schedule_variables.rb
index 8d29118e310..c85b97fbfc7 100644
--- a/spec/factories/ci/pipeline_schedule_variables.rb
+++ b/spec/factories/ci/pipeline_schedule_variables.rb
@@ -2,6 +2,7 @@ FactoryBot.define do
   factory :ci_pipeline_schedule_variable, class: Ci::PipelineScheduleVariable do
     sequence(:key) { |n| "VARIABLE_#{n}" }
     value 'VARIABLE_VALUE'
+    variable_type 'env_var'
 
     pipeline_schedule factory: :ci_pipeline_schedule
   end
diff --git a/spec/fixtures/api/schemas/pipeline_schedule.json b/spec/fixtures/api/schemas/pipeline_schedule.json
index c76c6945117..690c4a7d4e8 100644
--- a/spec/fixtures/api/schemas/pipeline_schedule.json
+++ b/spec/fixtures/api/schemas/pipeline_schedule.json
@@ -33,7 +33,7 @@
       "additionalProperties": false
     },
     "variables": {
-      "type": ["array", "null"],
+      "type": "array",
       "items": { "$ref": "pipeline_schedule_variable.json" }
     }
   },
diff --git a/spec/fixtures/api/schemas/pipeline_schedule_variable.json b/spec/fixtures/api/schemas/pipeline_schedule_variable.json
index f7ccb2d44a0..022d36cb88c 100644
--- a/spec/fixtures/api/schemas/pipeline_schedule_variable.json
+++ b/spec/fixtures/api/schemas/pipeline_schedule_variable.json
@@ -1,8 +1,14 @@
 {
-  "type": ["object", "null"],
+  "type": "object",
+  "required": [
+    "key",
+    "value",
+    "variable_type"
+  ],
   "properties": {
     "key": { "type": "string" },
-    "value": { "type": "string" }
+    "value": { "type": "string" },
+    "variable_type": { "type": "string" }
   },
   "additionalProperties": false
 }
diff --git a/spec/models/ci/group_variable_spec.rb b/spec/models/ci/group_variable_spec.rb
index b3999765e5f..406a69f3bbc 100644
--- a/spec/models/ci/group_variable_spec.rb
+++ b/spec/models/ci/group_variable_spec.rb
@@ -5,7 +5,8 @@ require 'spec_helper'
 describe Ci::GroupVariable do
   subject { build(:ci_group_variable) }
 
-  it { is_expected.to include_module(HasVariable) }
+  it_behaves_like "CI variable"
+
   it { is_expected.to include_module(Presentable) }
   it { is_expected.to include_module(Maskable) }
   it { is_expected.to validate_uniqueness_of(:key).scoped_to(:group_id).with_message(/\(\w+\) has already been taken/) }
diff --git a/spec/models/ci/pipeline_schedule_variable_spec.rb b/spec/models/ci/pipeline_schedule_variable_spec.rb
index 3c9379ecb0d..c96a24d5042 100644
--- a/spec/models/ci/pipeline_schedule_variable_spec.rb
+++ b/spec/models/ci/pipeline_schedule_variable_spec.rb
@@ -5,5 +5,5 @@ require 'spec_helper'
 describe Ci::PipelineScheduleVariable do
   subject { build(:ci_pipeline_schedule_variable) }
 
-  it { is_expected.to include_module(HasVariable) }
+  it_behaves_like "CI variable"
 end
diff --git a/spec/models/ci/pipeline_variable_spec.rb b/spec/models/ci/pipeline_variable_spec.rb
index 2ecb688299a..e8c7ce088e2 100644
--- a/spec/models/ci/pipeline_variable_spec.rb
+++ b/spec/models/ci/pipeline_variable_spec.rb
@@ -5,7 +5,8 @@ require 'spec_helper'
 describe Ci::PipelineVariable do
   subject { build(:ci_pipeline_variable) }
 
-  it { is_expected.to include_module(HasVariable) }
+  it_behaves_like "CI variable"
+
   it { is_expected.to validate_uniqueness_of(:key).scoped_to(:pipeline_id) }
 
   describe '#hook_attrs' do
diff --git a/spec/models/ci/variable_spec.rb b/spec/models/ci/variable_spec.rb
index d2df6b3344e..a231c7eaed8 100644
--- a/spec/models/ci/variable_spec.rb
+++ b/spec/models/ci/variable_spec.rb
@@ -5,8 +5,9 @@ require 'spec_helper'
 describe Ci::Variable do
   subject { build(:ci_variable) }
 
+  it_behaves_like "CI variable"
+
   describe 'validations' do
-    it { is_expected.to include_module(HasVariable) }
     it { is_expected.to include_module(Presentable) }
     it { is_expected.to include_module(Maskable) }
     it { is_expected.to validate_uniqueness_of(:key).scoped_to(:project_id, :environment_scope).with_message(/\(\w+\) has already been taken/) }
diff --git a/spec/requests/api/group_variables_spec.rb b/spec/requests/api/group_variables_spec.rb
index 66b9aae4b58..d50bae3dc47 100644
--- a/spec/requests/api/group_variables_spec.rb
+++ b/spec/requests/api/group_variables_spec.rb
@@ -51,6 +51,7 @@ describe API::GroupVariables do
         expect(response).to have_gitlab_http_status(200)
         expect(json_response['value']).to eq(variable.value)
         expect(json_response['protected']).to eq(variable.protected?)
+        expect(json_response['variable_type']).to eq(variable.variable_type)
       end
 
       it 'responds with 404 Not Found if requesting non-existing variable' do
@@ -94,17 +95,19 @@ describe API::GroupVariables do
         expect(json_response['key']).to eq('TEST_VARIABLE_2')
         expect(json_response['value']).to eq('PROTECTED_VALUE_2')
         expect(json_response['protected']).to be_truthy
+        expect(json_response['variable_type']).to eq('env_var')
       end
 
       it 'creates variable with optional attributes' do
         expect do
-          post api("/groups/#{group.id}/variables", user), params: { key: 'TEST_VARIABLE_2', value: 'VALUE_2' }
+          post api("/groups/#{group.id}/variables", user), params: { variable_type: 'file', key: 'TEST_VARIABLE_2', value: 'VALUE_2' }
         end.to change {group.variables.count}.by(1)
 
         expect(response).to have_gitlab_http_status(201)
         expect(json_response['key']).to eq('TEST_VARIABLE_2')
         expect(json_response['value']).to eq('VALUE_2')
         expect(json_response['protected']).to be_falsey
+        expect(json_response['variable_type']).to eq('file')
       end
 
       it 'does not allow to duplicate variable key' do
@@ -145,7 +148,7 @@ describe API::GroupVariables do
         initial_variable = group.variables.reload.first
         value_before = initial_variable.value
 
-        put api("/groups/#{group.id}/variables/#{variable.key}", user), params: { value: 'VALUE_1_UP', protected: true }
+        put api("/groups/#{group.id}/variables/#{variable.key}", user), params: { variable_type: 'file', value: 'VALUE_1_UP', protected: true }
 
         updated_variable = group.variables.reload.first
 
@@ -153,6 +156,7 @@ describe API::GroupVariables do
         expect(value_before).to eq(variable.value)
         expect(updated_variable.value).to eq('VALUE_1_UP')
         expect(updated_variable).to be_protected
+        expect(json_response['variable_type']).to eq('file')
       end
 
       it 'responds with 404 Not Found if requesting non-existing variable' do
diff --git a/spec/requests/api/pipeline_schedules_spec.rb b/spec/requests/api/pipeline_schedules_spec.rb
index 870ef34437f..072bd02f2ac 100644
--- a/spec/requests/api/pipeline_schedules_spec.rb
+++ b/spec/requests/api/pipeline_schedules_spec.rb
@@ -91,6 +91,7 @@ describe API::PipelineSchedules do
     let(:pipeline_schedule) { create(:ci_pipeline_schedule, project: project, owner: developer) }
 
     before do
+      pipeline_schedule.variables << build(:ci_pipeline_schedule_variable)
       pipeline_schedule.pipelines << build(:ci_pipeline, project: project)
     end
 
@@ -331,13 +332,14 @@ describe API::PipelineSchedules do
         it 'creates pipeline_schedule_variable' do
           expect do
             post api("/projects/#{project.id}/pipeline_schedules/#{pipeline_schedule.id}/variables", developer),
-              params: params
+              params: params.merge(variable_type: 'file')
           end.to change { pipeline_schedule.variables.count }.by(1)
 
           expect(response).to have_gitlab_http_status(:created)
           expect(response).to match_response_schema('pipeline_schedule_variable')
           expect(json_response['key']).to eq(params[:key])
           expect(json_response['value']).to eq(params[:value])
+          expect(json_response['variable_type']).to eq('file')
         end
       end
 
@@ -389,11 +391,12 @@ describe API::PipelineSchedules do
     context 'authenticated user with valid permissions' do
       it 'updates pipeline_schedule_variable' do
         put api("/projects/#{project.id}/pipeline_schedules/#{pipeline_schedule.id}/variables/#{pipeline_schedule_variable.key}", developer),
-          params: { value: 'updated_value' }
+          params: { value: 'updated_value', variable_type: 'file' }
 
         expect(response).to have_gitlab_http_status(:ok)
         expect(response).to match_response_schema('pipeline_schedule_variable')
         expect(json_response['value']).to eq('updated_value')
+        expect(json_response['variable_type']).to eq('file')
       end
     end
 
diff --git a/spec/requests/api/pipelines_spec.rb b/spec/requests/api/pipelines_spec.rb
index 26158231444..35b3dd219f7 100644
--- a/spec/requests/api/pipelines_spec.rb
+++ b/spec/requests/api/pipelines_spec.rb
@@ -294,6 +294,7 @@ describe API::Pipelines do
 
         expect(variable.key).to eq(expected_variable['key'])
         expect(variable.value).to eq(expected_variable['value'])
+        expect(variable.variable_type).to eq(expected_variable['variable_type'])
       end
     end
 
@@ -314,7 +315,7 @@ describe API::Pipelines do
         end
 
         context 'variables given' do
-          let(:variables) { [{ 'key' => 'UPLOAD_TO_S3', 'value' => 'true' }] }
+          let(:variables) { [{ 'variable_type' => 'file', 'key' => 'UPLOAD_TO_S3', 'value' => 'true' }] }
 
           it 'creates and returns a new pipeline using the given variables' do
             expect do
@@ -330,7 +331,7 @@ describe API::Pipelines do
         end
 
         describe 'using variables conditions' do
-          let(:variables) { [{ 'key' => 'STAGING', 'value' => 'true' }] }
+          let(:variables) { [{ 'variable_type' => 'env_var', 'key' => 'STAGING', 'value' => 'true' }] }
 
           before do
             config = YAML.dump(test: { script: 'test', only: { variables: ['$STAGING'] } })
@@ -467,7 +468,7 @@ describe API::Pipelines do
           subject
 
           expect(response).to have_gitlab_http_status(200)
-          expect(json_response).to contain_exactly({ "key" => "foo", "value" => "bar" })
+          expect(json_response).to contain_exactly({ "variable_type" => "env_var", "key" => "foo", "value" => "bar" })
         end
       end
     end
@@ -488,7 +489,7 @@ describe API::Pipelines do
           subject
 
           expect(response).to have_gitlab_http_status(200)
-          expect(json_response).to contain_exactly({ "key" => "foo", "value" => "bar" })
+          expect(json_response).to contain_exactly({ "variable_type" => "env_var", "key" => "foo", "value" => "bar" })
         end
       end
 
diff --git a/spec/requests/api/variables_spec.rb b/spec/requests/api/variables_spec.rb
index 5df6baf0ddf..cc07869a744 100644
--- a/spec/requests/api/variables_spec.rb
+++ b/spec/requests/api/variables_spec.rb
@@ -43,6 +43,7 @@ describe API::Variables do
         expect(response).to have_gitlab_http_status(200)
         expect(json_response['value']).to eq(variable.value)
         expect(json_response['protected']).to eq(variable.protected?)
+        expect(json_response['variable_type']).to eq('env_var')
       end
 
       it 'responds with 404 Not Found if requesting non-existing variable' do
@@ -80,17 +81,19 @@ describe API::Variables do
         expect(json_response['key']).to eq('TEST_VARIABLE_2')
         expect(json_response['value']).to eq('PROTECTED_VALUE_2')
         expect(json_response['protected']).to be_truthy
+        expect(json_response['variable_type']).to eq('env_var')
       end
 
       it 'creates variable with optional attributes' do
         expect do
-          post api("/projects/#{project.id}/variables", user), params: { key: 'TEST_VARIABLE_2', value: 'VALUE_2' }
+          post api("/projects/#{project.id}/variables", user), params: { variable_type: 'file',  key: 'TEST_VARIABLE_2', value: 'VALUE_2' }
         end.to change {project.variables.count}.by(1)
 
         expect(response).to have_gitlab_http_status(201)
         expect(json_response['key']).to eq('TEST_VARIABLE_2')
         expect(json_response['value']).to eq('VALUE_2')
         expect(json_response['protected']).to be_falsey
+        expect(json_response['variable_type']).to eq('file')
       end
 
       it 'does not allow to duplicate variable key' do
@@ -125,7 +128,7 @@ describe API::Variables do
         initial_variable = project.variables.reload.first
         value_before = initial_variable.value
 
-        put api("/projects/#{project.id}/variables/#{variable.key}", user), params: { value: 'VALUE_1_UP', protected: true }
+        put api("/projects/#{project.id}/variables/#{variable.key}", user), params: { variable_type: 'file', value: 'VALUE_1_UP', protected: true }
 
         updated_variable = project.variables.reload.first
 
@@ -133,6 +136,7 @@ describe API::Variables do
         expect(value_before).to eq(variable.value)
         expect(updated_variable.value).to eq('VALUE_1_UP')
         expect(updated_variable).to be_protected
+        expect(updated_variable.variable_type).to eq('file')
       end
 
       it 'responds with 404 Not Found if requesting non-existing variable' do
diff --git a/spec/support/shared_examples/controllers/variables_shared_examples.rb b/spec/support/shared_examples/controllers/variables_shared_examples.rb
index b615a8f54cf..e80722857ec 100644
--- a/spec/support/shared_examples/controllers/variables_shared_examples.rb
+++ b/spec/support/shared_examples/controllers/variables_shared_examples.rb
@@ -120,4 +120,16 @@ shared_examples 'PATCH #update updates variables' do
       expect(response).to match_response_schema('variables')
     end
   end
+
+  context 'for variables of type file' do
+    let(:variables_attributes) do
+      [
+        new_variable_attributes.merge(variable_type: 'file')
+      ]
+    end
+
+    it 'creates new variable of type file' do
+      expect { subject }.to change { owner.variables.file.count }.by(1)
+    end
+  end
 end
diff --git a/spec/support/shared_examples/models/ci_variable_shared_examples.rb b/spec/support/shared_examples/models/ci_variable_shared_examples.rb
new file mode 100644
index 00000000000..f93de8b6ff1
--- /dev/null
+++ b/spec/support/shared_examples/models/ci_variable_shared_examples.rb
@@ -0,0 +1,29 @@
+# frozen_string_literal: true
+
+shared_examples_for 'CI variable' do
+  it { is_expected.to include_module(HasVariable) }
+
+  describe "variable type" do
+    it 'defines variable types' do
+      expect(described_class.variable_types).to eq({ "env_var" => 1, "file" => 2 })
+    end
+
+    it "defaults variable type to env_var" do
+      expect(subject.variable_type).to eq("env_var")
+    end
+
+    it "supports variable type file" do
+      variable = described_class.new(variable_type: :file)
+      expect(variable).to be_file
+    end
+  end
+
+  it 'strips whitespaces when assigning key' do
+    subject.key = " SECRET "
+    expect(subject.key).to eq("SECRET")
+  end
+
+  it 'can convert to runner variable' do
+    expect(subject.to_runner_variable.keys).to include(:key, :value, :public, :file)
+  end
+end