1 files changed, 21 insertions, 10 deletions
diff --git a/app/models/integrations/apple_app_store.rb b/app/models/integrations/apple_app_store.rb
index 5e502cce927..a4036a82cec 100644
--- a/app/models/integrations/apple_app_store.rb
+++ b/app/models/integrations/apple_app_store.rb
@@ -15,23 +15,28 @@ module Integrations
       validates :app_store_key_id, presence: true, format: { with: KEY_ID_REGEX }
       validates :app_store_private_key, presence: true, certificate_key: true
       validates :app_store_private_key_file_name, presence: true
+      validates :app_store_protected_refs, inclusion: [true, false]
     end
 
     field :app_store_issuer_id,
-          section: SECTION_TYPE_CONNECTION,
-          required: true,
-          title: -> { s_('AppleAppStore|The Apple App Store Connect Issuer ID.') }
+      section: SECTION_TYPE_CONNECTION,
+      required: true,
+      title: -> { s_('AppleAppStore|The Apple App Store Connect Issuer ID.') }
 
     field :app_store_key_id,
-          section: SECTION_TYPE_CONNECTION,
-          required: true,
-          title: -> { s_('AppleAppStore|The Apple App Store Connect Key ID.') }
-
-    field :app_store_private_key_file_name,
-          section: SECTION_TYPE_CONNECTION
+      section: SECTION_TYPE_CONNECTION,
+      required: true,
+      title: -> { s_('AppleAppStore|The Apple App Store Connect Key ID.') }
 
+    field :app_store_private_key_file_name, section: SECTION_TYPE_CONNECTION
     field :app_store_private_key, api_only: true
 
+    field :app_store_protected_refs,
+      type: 'checkbox',
+      section: SECTION_TYPE_CONFIGURATION,
+      title: -> { s_('AppleAppStore|Protected branches and tags only') },
+      checkbox_label: -> { s_('AppleAppStore|Only set variables on protected branches and tags') }
+
     def title
       'Apple App Store Connect'
     end
@@ -87,8 +92,9 @@ module Integrations
       end
     end
 
-    def ci_variables
+    def ci_variables(protected_ref:)
       return [] unless activated?
+      return [] if app_store_protected_refs && !protected_ref
 
       [
         { key: 'APP_STORE_CONNECT_API_KEY_ISSUER_ID', value: app_store_issuer_id, masked: true, public: false },
@@ -100,6 +106,11 @@ module Integrations
       ]
     end
 
+    def initialize_properties
+      super
+      self.app_store_protected_refs = true if app_store_protected_refs.nil?
+    end
+
     private
 
     def client