7 files changed, 444 insertions, 72 deletions

diff --git a/spec/models/ci/bridge_spec.rb b/spec/models/ci/bridge_spec.rb
index 5ee560c4925..6409ea9fc3d 100644
--- a/spec/models/ci/bridge_spec.rb
+++ b/spec/models/ci/bridge_spec.rb
@@ -31,7 +31,37 @@ RSpec.describe Ci::Bridge do
   end
 
   describe '#retryable?' do
+    let(:bridge) { create(:ci_bridge, :success) }
+
+    it 'returns true' do
+      expect(bridge.retryable?).to eq(true)
+    end
+
+    context 'without ci_recreate_downstream_pipeline ff' do
+      before do
+        stub_feature_flags(ci_recreate_downstream_pipeline: false)
+      end
+
+      it 'returns false' do
+        expect(bridge.retryable?).to eq(false)
+      end
+    end
+  end
+
+  context 'when there is a pipeline loop detected' do
+    let(:bridge) { create(:ci_bridge, :failed, failure_reason: :pipeline_loop_detected) }
+
+    it 'returns false' do
+      expect(bridge.failure_reason).to eq('pipeline_loop_detected')
+      expect(bridge.retryable?).to eq(false)
+    end
+  end
+
+  context 'when the pipeline depth has reached the max descendents' do
+    let(:bridge) { create(:ci_bridge, :failed, failure_reason: :reached_max_descendant_pipelines_depth) }
+
     it 'returns false' do
+      expect(bridge.failure_reason).to eq('reached_max_descendant_pipelines_depth')
       expect(bridge.retryable?).to eq(false)
     end
   end
diff --git a/spec/models/ci/build_spec.rb b/spec/models/ci/build_spec.rb
index 12e65974270..dcf6915a01e 100644
--- a/spec/models/ci/build_spec.rb
+++ b/spec/models/ci/build_spec.rb
@@ -743,7 +743,7 @@ RSpec.describe Ci::Build do
       it { is_expected.to be_falsey }
     end
 
-    context 'when there are runners' do
+    context 'when there is a runner' do
       let(:runner) { create(:ci_runner, :project, projects: [build.project]) }
 
       before do
@@ -752,19 +752,28 @@ RSpec.describe Ci::Build do
 
       it { is_expected.to be_truthy }
 
-      it 'that is inactive' do
-        runner.update!(active: false)
-        is_expected.to be_falsey
+      context 'that is inactive' do
+        before do
+          runner.update!(active: false)
+        end
+
+        it { is_expected.to be_falsey }
       end
 
-      it 'that is not online' do
-        runner.update!(contacted_at: nil)
-        is_expected.to be_falsey
+      context 'that is not online' do
+        before do
+          runner.update!(contacted_at: nil)
+        end
+
+        it { is_expected.to be_falsey }
       end
 
-      it 'that cannot handle build' do
-        expect_any_instance_of(Ci::Runner).to receive(:matches_build?).with(build).and_return(false)
-        is_expected.to be_falsey
+      context 'that cannot handle build' do
+        before do
+          expect_any_instance_of(Gitlab::Ci::Matching::RunnerMatcher).to receive(:matches?).with(build.build_matcher).and_return(false)
+        end
+
+        it { is_expected.to be_falsey }
       end
     end
 
@@ -1069,6 +1078,32 @@ RSpec.describe Ci::Build do
             is_expected.to all(a_hash_including(key: a_string_matching(/-non_protected$/)))
           end
         end
+
+        context 'when separated caches are disabled' do
+          before do
+            allow_any_instance_of(Project).to receive(:ci_separated_caches).and_return(false)
+          end
+
+          context 'running on protected ref' do
+            before do
+              allow(build.pipeline).to receive(:protected_ref?).and_return(true)
+            end
+
+            it 'is expected to have no type suffix' do
+              is_expected.to match([a_hash_including(key: 'key-1'), a_hash_including(key: 'key2-1')])
+            end
+          end
+
+          context 'running on not protected ref' do
+            before do
+              allow(build.pipeline).to receive(:protected_ref?).and_return(false)
+            end
+
+            it 'is expected to have no type suffix' do
+              is_expected.to match([a_hash_including(key: 'key-1'), a_hash_including(key: 'key2-1')])
+            end
+          end
+        end
       end
 
       context 'when project has jobs_cache_index' do
@@ -1123,36 +1158,6 @@ RSpec.describe Ci::Build do
     end
   end
 
-  describe '#coverage_regex' do
-    subject { build.coverage_regex }
-
-    context 'when project has build_coverage_regex set' do
-      let(:project_regex) { '\(\d+\.\d+\) covered' }
-
-      before do
-        project.update_column(:build_coverage_regex, project_regex)
-      end
-
-      context 'and coverage_regex attribute is not set' do
-        it { is_expected.to eq(project_regex) }
-      end
-
-      context 'but coverage_regex attribute is also set' do
-        let(:build_regex) { 'Code coverage: \d+\.\d+' }
-
-        before do
-          build.coverage_regex = build_regex
-        end
-
-        it { is_expected.to eq(build_regex) }
-      end
-    end
-
-    context 'when neither project nor build has coverage regex set' do
-      it { is_expected.to be_nil }
-    end
-  end
-
   describe '#update_coverage' do
     context "regarding coverage_regex's value," do
       before do
@@ -1476,6 +1481,44 @@ RSpec.describe Ci::Build do
         expect(deployment).to be_canceled
       end
     end
+
+    # Mimic playing a manual job that needs another job.
+    # `needs + when:manual` scenario, see: https://gitlab.com/gitlab-org/gitlab/-/issues/347502
+    context 'when transits from skipped to created to running' do
+      before do
+        build.skip!
+      end
+
+      context 'during skipped to created' do
+        let(:event) { :process! }
+
+        it 'transitions to created' do
+          subject
+
+          expect(deployment).to be_created
+        end
+      end
+
+      context 'during created to running' do
+        let(:event) { :run! }
+
+        before do
+          build.process!
+          build.enqueue!
+        end
+
+        it 'transitions to running and calls webhook' do
+          freeze_time do
+            expect(Deployments::HooksWorker)
+            .to receive(:perform_async).with(deployment_id: deployment.id, status_changed_at: Time.current)
+
+            subject
+          end
+
+          expect(deployment).to be_running
+        end
+      end
+    end
   end
 
   describe '#on_stop' do
@@ -3755,6 +3798,7 @@ RSpec.describe Ci::Build do
 
     context 'for pipeline ref existence' do
       it 'ensures pipeline ref creation' do
+        expect(job.pipeline).to receive(:ensure_persistent_ref).once.and_call_original
         expect(job.pipeline.persistent_ref).to receive(:create).once
 
         run_job_without_exception
diff --git a/spec/models/ci/job_artifact_spec.rb b/spec/models/ci/job_artifact_spec.rb
index 24c318d0218..24265242172 100644
--- a/spec/models/ci/job_artifact_spec.rb
+++ b/spec/models/ci/job_artifact_spec.rb
@@ -206,8 +206,8 @@ RSpec.describe Ci::JobArtifact do
     end
   end
 
-  describe '#archived_trace_exists?' do
-    subject { artifact.archived_trace_exists? }
+  describe '#stored?' do
+    subject { artifact.stored? }
 
     context 'when the file exists' do
       it { is_expected.to be_truthy }
@@ -270,15 +270,6 @@ RSpec.describe Ci::JobArtifact do
     end
   end
 
-  describe '.order_expired_desc' do
-    let_it_be(:first_artifact) { create(:ci_job_artifact, expire_at: 2.days.ago) }
-    let_it_be(:second_artifact) { create(:ci_job_artifact, expire_at: 1.day.ago) }
-
-    it 'returns ordered artifacts' do
-      expect(described_class.order_expired_desc).to eq([second_artifact, first_artifact])
-    end
-  end
-
   describe '.order_expired_asc' do
     let_it_be(:first_artifact) { create(:ci_job_artifact, expire_at: 2.days.ago) }
     let_it_be(:second_artifact) { create(:ci_job_artifact, expire_at: 1.day.ago) }
diff --git a/spec/models/ci/pipeline_spec.rb b/spec/models/ci/pipeline_spec.rb
index 45b51d5bf44..8dc041814fa 100644
--- a/spec/models/ci/pipeline_spec.rb
+++ b/spec/models/ci/pipeline_spec.rb
@@ -11,7 +11,7 @@ RSpec.describe Ci::Pipeline, :mailer, factory_default: :keep do
   let_it_be(:namespace) { create_default(:namespace).freeze }
   let_it_be(:project) { create_default(:project, :repository).freeze }
 
-  it 'paginates 15 pipeleines per page' do
+  it 'paginates 15 pipelines per page' do
     expect(described_class.default_per_page).to eq(15)
   end
 
@@ -552,7 +552,7 @@ RSpec.describe Ci::Pipeline, :mailer, factory_default: :keep do
       it { is_expected.to be_truthy }
     end
 
-    context 'when both sha and source_sha do not matche' do
+    context 'when both sha and source_sha do not match' do
       let(:pipeline) { build(:ci_pipeline, sha: 'test', source_sha: 'test') }
 
       it { is_expected.to be_falsy }
@@ -1423,7 +1423,7 @@ RSpec.describe Ci::Pipeline, :mailer, factory_default: :keep do
     let(:build_b) { create_build('build2', queued_at: 0) }
     let(:build_c) { create_build('build3', queued_at: 0) }
 
-    %w[succeed! drop! cancel! skip!].each do |action|
+    %w[succeed! drop! cancel! skip! block! delay!].each do |action|
       context "when the pipeline recieved #{action} event" do
         it 'deletes a persistent ref' do
           expect(pipeline.persistent_ref).to receive(:delete).once
@@ -1534,6 +1534,21 @@ RSpec.describe Ci::Pipeline, :mailer, factory_default: :keep do
           expect(pipeline.started_at).to be_nil
         end
       end
+
+      context 'from success' do
+        let(:started_at) { 2.days.ago }
+        let(:from_status) { :success }
+
+        before do
+          pipeline.update!(started_at: started_at)
+        end
+
+        it 'does not update on transitioning to running' do
+          pipeline.run
+
+          expect(pipeline.started_at).to eq started_at
+        end
+      end
     end
 
     describe '#finished_at' do
@@ -1813,6 +1828,32 @@ RSpec.describe Ci::Pipeline, :mailer, factory_default: :keep do
     end
   end
 
+  describe '#ensure_persistent_ref' do
+    subject { pipeline.ensure_persistent_ref }
+
+    let(:pipeline) { create(:ci_pipeline, project: project) }
+
+    context 'when the persistent ref does not exist' do
+      it 'creates a ref' do
+        expect(pipeline.persistent_ref).to receive(:create).once
+
+        subject
+      end
+    end
+
+    context 'when the persistent ref exists' do
+      before do
+        pipeline.persistent_ref.create # rubocop:disable Rails/SaveBang
+      end
+
+      it 'does not create a ref' do
+        expect(pipeline.persistent_ref).not_to receive(:create)
+
+        subject
+      end
+    end
+  end
+
   describe '#branch?' do
     subject { pipeline.branch? }
 
@@ -3428,6 +3469,46 @@ RSpec.describe Ci::Pipeline, :mailer, factory_default: :keep do
     end
   end
 
+  describe '#upstream_root' do
+    subject { pipeline.upstream_root }
+
+    let_it_be(:pipeline) { create(:ci_pipeline) }
+
+    context 'when pipeline is child of child pipeline' do
+      let!(:root_ancestor) { create(:ci_pipeline) }
+      let!(:parent_pipeline) { create(:ci_pipeline, child_of: root_ancestor) }
+      let!(:pipeline) { create(:ci_pipeline, child_of: parent_pipeline) }
+
+      it 'returns the root ancestor' do
+        expect(subject).to eq(root_ancestor)
+      end
+    end
+
+    context 'when pipeline is root ancestor' do
+      let!(:child_pipeline) { create(:ci_pipeline, child_of: pipeline) }
+
+      it 'returns itself' do
+        expect(subject).to eq(pipeline)
+      end
+    end
+
+    context 'when pipeline is standalone' do
+      it 'returns itself' do
+        expect(subject).to eq(pipeline)
+      end
+    end
+
+    context 'when pipeline is multi-project downstream pipeline' do
+      let!(:upstream_pipeline) do
+        create(:ci_pipeline, project: create(:project), upstream_of: pipeline)
+      end
+
+      it 'returns the upstream pipeline' do
+        expect(subject).to eq(upstream_pipeline)
+      end
+    end
+  end
+
   describe '#stuck?' do
     let(:pipeline) { create(:ci_empty_pipeline, :created) }
 
diff --git a/spec/models/ci/processable_spec.rb b/spec/models/ci/processable_spec.rb
index 71fef3c1b5b..cdd96d45561 100644
--- a/spec/models/ci/processable_spec.rb
+++ b/spec/models/ci/processable_spec.rb
@@ -14,6 +14,223 @@ RSpec.describe Ci::Processable do
     it { is_expected.to delegate_method(:legacy_detached_merge_request_pipeline?).to(:pipeline) }
   end
 
+  describe '#clone' do
+    let(:user) { create(:user) }
+
+    let(:new_processable) do
+      new_proc = processable.clone(current_user: user)
+      new_proc.save!
+
+      new_proc
+    end
+
+    let_it_be(:stage) { create(:ci_stage_entity, project: project, pipeline: pipeline, name: 'test') }
+
+    shared_context 'processable bridge' do
+      let_it_be(:downstream_project) { create(:project, :repository) }
+
+      let_it_be_with_refind(:processable) do
+        create(
+          :ci_bridge, :success, pipeline: pipeline, downstream: downstream_project,
+          description: 'a trigger job', stage_id: stage.id
+        )
+      end
+
+      let(:clone_accessors) { ::Ci::Bridge.clone_accessors }
+      let(:reject_accessors) { [] }
+      let(:ignore_accessors) { [] }
+    end
+
+    shared_context 'processable build' do
+      let_it_be(:another_pipeline) { create(:ci_empty_pipeline, project: project) }
+
+      let_it_be_with_refind(:processable) do
+        create(:ci_build, :failed, :picked, :expired, :erased, :queued, :coverage, :tags,
+              :allowed_to_fail, :on_tag, :triggered, :teardown_environment, :resource_group,
+              description: 'my-job', stage: 'test', stage_id: stage.id,
+              pipeline: pipeline, auto_canceled_by: another_pipeline,
+              scheduled_at: 10.seconds.since)
+      end
+
+      let_it_be(:internal_job_variable) { create(:ci_job_variable, job: processable) }
+
+      let(:clone_accessors) { ::Ci::Build.clone_accessors.without(::Ci::Build.extra_accessors) }
+
+      let(:reject_accessors) do
+        %i[id status user token token_encrypted coverage trace runner
+           artifacts_expire_at
+           created_at updated_at started_at finished_at queued_at erased_by
+           erased_at auto_canceled_by job_artifacts job_artifacts_archive
+           job_artifacts_metadata job_artifacts_trace job_artifacts_junit
+           job_artifacts_sast job_artifacts_secret_detection job_artifacts_dependency_scanning
+           job_artifacts_container_scanning job_artifacts_cluster_image_scanning job_artifacts_dast
+           job_artifacts_license_scanning
+           job_artifacts_performance job_artifacts_browser_performance job_artifacts_load_performance
+           job_artifacts_lsif job_artifacts_terraform job_artifacts_cluster_applications
+           job_artifacts_codequality job_artifacts_metrics scheduled_at
+           job_variables waiting_for_resource_at job_artifacts_metrics_referee
+           job_artifacts_network_referee job_artifacts_dotenv
+           job_artifacts_cobertura needs job_artifacts_accessibility
+           job_artifacts_requirements job_artifacts_coverage_fuzzing
+           job_artifacts_api_fuzzing terraform_state_versions].freeze
+      end
+
+      let(:ignore_accessors) do
+        %i[type namespace lock_version target_url base_tags trace_sections
+           commit_id deployment erased_by_id project_id
+           runner_id tag_taggings taggings tags trigger_request_id
+           user_id auto_canceled_by_id retried failure_reason
+           sourced_pipelines artifacts_file_store artifacts_metadata_store
+           metadata runner_session trace_chunks upstream_pipeline_id
+           artifacts_file artifacts_metadata artifacts_size commands
+           resource resource_group_id processed security_scans author
+           pipeline_id report_results pending_state pages_deployments
+           queuing_entry runtime_metadata trace_metadata
+           dast_site_profile dast_scanner_profile].freeze
+      end
+
+      before_all do
+        # Create artifacts to check that the associations are rejected when cloning
+        Ci::JobArtifact::TYPE_AND_FORMAT_PAIRS.each do |file_type, file_format|
+          create(:ci_job_artifact, file_format,
+                file_type: file_type, job: processable, expire_at: processable.artifacts_expire_at)
+        end
+
+        create(:ci_job_variable, :dotenv_source, job: processable)
+        create(:terraform_state_version, build: processable)
+      end
+
+      before do
+        processable.update!(retried: false, status: :success)
+      end
+    end
+
+    shared_examples_for 'clones the processable' do
+      before_all do
+        processable.update!(stage: 'test', stage_id: stage.id)
+
+        create(:ci_build_need, build: processable)
+      end
+
+      describe 'clone accessors' do
+        let(:forbidden_associations) do
+          Ci::Build.reflect_on_all_associations.each_with_object(Set.new) do |assoc, memo|
+            memo << assoc.name unless assoc.macro == :belongs_to
+          end
+        end
+
+        it 'clones the processable attributes', :aggregate_failures do
+          clone_accessors.each do |attribute|
+            expect(attribute).not_to be_in(forbidden_associations), "association #{attribute} must be `belongs_to`"
+            expect(processable.send(attribute)).not_to be_nil, "old processable attribute #{attribute} should not be nil"
+            expect(new_processable.send(attribute)).not_to be_nil, "new processable attribute #{attribute} should not be nil"
+            expect(new_processable.send(attribute)).to eq(processable.send(attribute)), "new processable attribute #{attribute} should match old processable"
+          end
+        end
+
+        it 'clones only the needs attributes' do
+          expect(new_processable.needs.size).to be(1)
+          expect(processable.needs.exists?).to be_truthy
+
+          expect(new_processable.needs_attributes).to match(processable.needs_attributes)
+          expect(new_processable.needs).not_to match(processable.needs)
+        end
+
+        context 'when the processable has protected: nil' do
+          before do
+            processable.update_attribute(:protected, nil)
+          end
+
+          it 'clones the protected job attribute' do
+            expect(new_processable.protected).to be_nil
+            expect(new_processable.protected).to eq processable.protected
+          end
+        end
+      end
+
+      describe 'reject accessors' do
+        it 'does not clone rejected attributes' do
+          reject_accessors.each do |attribute|
+            expect(new_processable.send(attribute)).not_to eq(processable.send(attribute)), "processable attribute #{attribute} should not have been cloned"
+          end
+        end
+      end
+
+      it 'creates a new processable that represents the old processable' do
+        expect(new_processable.name).to eq processable.name
+      end
+    end
+
+    context 'when the processable to be cloned is a bridge' do
+      include_context 'processable bridge'
+
+      it_behaves_like 'clones the processable'
+    end
+
+    context 'when the processable to be cloned is a build' do
+      include_context 'processable build'
+
+      it_behaves_like 'clones the processable'
+
+      it 'has the correct number of known attributes', :aggregate_failures do
+        processed_accessors = clone_accessors + reject_accessors
+        known_accessors = processed_accessors + ignore_accessors
+
+        current_accessors =
+          Ci::Build.attribute_names.map(&:to_sym) +
+          Ci::Build.attribute_aliases.keys.map(&:to_sym) +
+          Ci::Build.reflect_on_all_associations.map(&:name) +
+          [:tag_list, :needs_attributes, :job_variables_attributes] -
+          # ToDo: Move EE accessors to ee/
+          ::Ci::Build.extra_accessors -
+          [:dast_site_profiles_build, :dast_scanner_profiles_build]
+
+        current_accessors.uniq!
+
+        expect(current_accessors).to include(*processed_accessors)
+        expect(known_accessors).to include(*current_accessors)
+      end
+
+      context 'when it has a deployment' do
+        let!(:processable) do
+          create(:ci_build, :with_deployment, :deploy_to_production,
+                  pipeline: pipeline, stage_id: stage.id, project: project)
+        end
+
+        it 'persists the expanded environment name' do
+          expect(new_processable.metadata.expanded_environment_name).to eq('production')
+        end
+      end
+
+      context 'when it has a dynamic environment' do
+        let_it_be(:other_developer) { create(:user).tap { |u| project.add_developer(u) } }
+
+        let(:environment_name) { 'review/$CI_COMMIT_REF_SLUG-$GITLAB_USER_ID' }
+
+        let!(:processable) do
+          create(:ci_build, :with_deployment, environment: environment_name,
+                options: { environment: { name: environment_name } },
+                pipeline: pipeline, stage_id: stage.id, project: project,
+                user: other_developer)
+        end
+
+        it 're-uses the previous persisted environment' do
+          expect(processable.persisted_environment.name).to eq("review/#{processable.ref}-#{other_developer.id}")
+
+          expect(new_processable.persisted_environment.name).to eq("review/#{processable.ref}-#{other_developer.id}")
+        end
+      end
+
+      context 'when the processable has job variables' do
+        it 'only clones the internal job variables' do
+          expect(new_processable.job_variables.size).to eq(1)
+          expect(new_processable.job_variables.first.key).to eq(internal_job_variable.key)
+          expect(new_processable.job_variables.first.value).to eq(internal_job_variable.value)
+        end
+      end
+    end
+  end
+
   describe '#retryable' do
     shared_examples_for 'retryable processable' do
       context 'when processable is successful' do
@@ -69,6 +286,12 @@ RSpec.describe Ci::Processable do
       end
     end
 
+    context 'when the processable is a bridge' do
+      subject(:processable) { create(:ci_bridge, pipeline: pipeline) }
+
+      it_behaves_like 'retryable processable'
+    end
+
     context 'when the processable is a build' do
       subject(:processable) { create(:ci_build, pipeline: pipeline) }
 
diff --git a/spec/models/ci/runner_spec.rb b/spec/models/ci/runner_spec.rb
index 05b7bc39a74..8a1dcbfbdeb 100644
--- a/spec/models/ci/runner_spec.rb
+++ b/spec/models/ci/runner_spec.rb
@@ -412,12 +412,9 @@ RSpec.describe Ci::Runner do
     context 'with shared_runner' do
       let(:runner) { create(:ci_runner, :instance) }
 
-      it 'transitions shared runner to project runner and assigns project' do
-        expect(subject).to be_truthy
-
-        expect(runner).to be_project_type
-        expect(runner.runner_projects.pluck(:project_id)).to match_array([project.id])
-        expect(runner.only_for?(project)).to be_truthy
+      it 'raises an error' do
+        expect { subject }
+          .to raise_error(ArgumentError, 'Transitioning an instance runner to a project runner is not supported')
       end
     end
 
@@ -430,6 +427,18 @@ RSpec.describe Ci::Runner do
           .to raise_error(ArgumentError, 'Transitioning a group runner to a project runner is not supported')
       end
     end
+
+    context 'with project runner' do
+      let(:other_project) { create(:project) }
+      let(:runner) { create(:ci_runner, :project, projects: [other_project]) }
+
+      it 'assigns runner to project' do
+        expect(subject).to be_truthy
+
+        expect(runner).to be_project_type
+        expect(runner.runner_projects.pluck(:project_id)).to contain_exactly(project.id, other_project.id)
+      end
+    end
   end
 
   describe '.recent' do
@@ -829,7 +838,7 @@ RSpec.describe Ci::Runner do
       context 'with legacy_mode enabled' do
         let(:legacy_mode) { '14.5' }
 
-        it { is_expected.to eq(:not_connected) }
+        it { is_expected.to eq(:stale) }
       end
 
       context 'with legacy_mode disabled' do
@@ -886,7 +895,7 @@ RSpec.describe Ci::Runner do
       context 'with legacy_mode enabled' do
         let(:legacy_mode) { '14.5' }
 
-        it { is_expected.to eq(:offline) }
+        it { is_expected.to eq(:stale) }
       end
 
       context 'with legacy_mode disabled' do
@@ -896,7 +905,7 @@ RSpec.describe Ci::Runner do
   end
 
   describe '#deprecated_rest_status' do
-    let(:runner) { build(:ci_runner, :instance, contacted_at: 1.second.ago) }
+    let(:runner) { create(:ci_runner, :instance, contacted_at: 1.second.ago) }
 
     subject { runner.deprecated_rest_status }
 
@@ -905,7 +914,7 @@ RSpec.describe Ci::Runner do
         runner.contacted_at = nil
       end
 
-      it { is_expected.to eq(:not_connected) }
+      it { is_expected.to eq(:never_contacted) }
     end
 
     context 'contacted 1s ago' do
@@ -918,10 +927,11 @@ RSpec.describe Ci::Runner do
 
     context 'contacted long time ago' do
       before do
+        runner.created_at = 1.year.ago
         runner.contacted_at = 1.year.ago
       end
 
-      it { is_expected.to eq(:offline) }
+      it { is_expected.to eq(:stale) }
     end
 
     context 'inactive' do
diff --git a/spec/models/ci/secure_file_spec.rb b/spec/models/ci/secure_file_spec.rb
index f92db3fe8db..40ddafad013 100644
--- a/spec/models/ci/secure_file_spec.rb
+++ b/spec/models/ci/secure_file_spec.rb
@@ -25,7 +25,6 @@ RSpec.describe Ci::SecureFile do
     it { is_expected.to validate_presence_of(:checksum) }
     it { is_expected.to validate_presence_of(:file_store) }
     it { is_expected.to validate_presence_of(:name) }
-    it { is_expected.to validate_presence_of(:permissions) }
     it { is_expected.to validate_presence_of(:project_id) }
     context 'unique filename' do
       let_it_be(:project1) { create(:project) }
@@ -49,12 +48,6 @@ RSpec.describe Ci::SecureFile do
     end
   end
 
-  describe '#permissions' do
-    it 'defaults to read_only file permssions' do
-      expect(subject.permissions).to eq('read_only')
-    end
-  end
-
   describe '#checksum' do
     it 'computes SHA256 checksum on the file before encrypted' do
       expect(subject.checksum).to eq(Digest::SHA256.hexdigest(sample_file))