1 files changed, 40 insertions, 1 deletions
diff --git a/app/models/ci/bridge.rb b/app/models/ci/bridge.rb
index cf6401dc1da..8db80cd05dc 100644
--- a/app/models/ci/bridge.rb
+++ b/app/models/ci/bridge.rb
@@ -16,6 +16,8 @@ module Ci
       pipeline_variables: false
     }.freeze
 
+    self.allow_legacy_sti_class = true
+
     belongs_to :project
     belongs_to :trigger_request
 
@@ -168,6 +170,18 @@ module Ci
     end
     # rubocop: enable CodeReuse/ServiceClass
 
+    def job_artifacts
+      Ci::JobArtifact.none
+    end
+
+    def artifacts_expire_at; end
+
+    def runner; end
+
+    def tag_list
+      ActsAsTaggableOn::TagList.new
+    end
+
     def artifacts?
       false
     end
@@ -220,8 +234,19 @@ module Ci
 
     def variables
       strong_memoize(:variables) do
+        bridge_variables =
+          if ::Feature.disabled?(:exclude_protected_variables_from_multi_project_pipeline_triggers, project) ||
+              (expose_protected_project_variables? && expose_protected_group_variables?)
+            scoped_variables
+          else
+            unprotected_scoped_variables(
+              expose_project_variables: expose_protected_project_variables?,
+              expose_group_variables: expose_protected_group_variables?
+            )
+          end
+
         Gitlab::Ci::Variables::Collection.new
-         .concat(scoped_variables)
+         .concat(bridge_variables)
          .concat(pipeline.persisted_variables)
       end
     end
@@ -260,6 +285,20 @@ module Ci
 
     private
 
+    def expose_protected_group_variables?
+      return true if downstream_project.nil?
+      return true if project.group.present? && project.group == downstream_project.group
+
+      false
+    end
+
+    def expose_protected_project_variables?
+      return true if downstream_project.nil?
+      return true if project.id == downstream_project.id
+
+      false
+    end
+
     def cross_project_params
       {
         project: downstream_project,