Add the rest of specs

lib/gitlab/ci/stage/seed.rb

@@ -29,14 +29,10 @@ module Gitlab
                              ref: pipeline.ref,
                              tag: pipeline.tag,
                              trigger_request: trigger,
-                             protected: protected?)
+                             protected: protected_ref?)
           end
         end
-        def protected?
-          @protected ||= project.protected_for?(pipeline.ref)
-        end
-
         def create!
           pipeline.stages.create!(stage).tap do |stage|
             builds_attributes = builds.map do |attributes|
@@ -48,6 +44,12 @@ module Gitlab
             end
           end
         end
+
+        private
+
+        def protected_ref?
+          @protected_ref ||= project.protected_for?(pipeline.ref)
+        end
       end
     end
   end

spec/factories/ci/builds.rb

@@ -226,5 +226,13 @@ FactoryGirl.define do
       status 'created'
       self.when 'manual'
     end
+
+    trait(:protected) do
+      protected true
+    end
+
+    trait(:unprotected) do
+      protected false
+    end
   end
 end

spec/lib/gitlab/ci/stage/seed_spec.rb

@@ -26,6 +26,17 @@ describe Gitlab::Ci::Stage::Seed do
       expect(subject.builds).to all(include(project: pipeline.project))
       expect(subject.builds)
         .to all(include(trigger_request: pipeline.trigger_requests.first))
+      expect(subject.builds).to all(include(protected: true))
+    end
+
+    context 'when a ref is unprotected' do
+      before do
+        allow_any_instance_of(Project).to receive(:protected_for?).and_return(false)
+      end
+
+      it 'returns unprotected builds' do
+        expect(subject.builds).to all(include(protected: false))
+      end
     end
   end

spec/models/ci/build_spec.rb

@@ -43,6 +43,16 @@ describe Ci::Build do
     it { is_expected.not_to include(manual_but_created) }
   end
+  describe '.protected_' do
+    let!(:protected_job) { create(:ci_build, :protected) }
+    let!(:unprotected_job) { create(:ci_build, :unprotected) }
+
+    subject { described_class.protected_ }
+
+    it { is_expected.to include(protected_job) }
+    it { is_expected.not_to include(unprotected_job) }
+  end
+
   describe '#actionize' do
     context 'when build is a created' do
       before do

spec/services/ci/register_job_service_spec.rb

@@ -215,6 +215,44 @@ module Ci
         end
       end
+      context 'when a runner is unprotected' do
+        context 'when a job is protected' do
+          let!(:pending_build) { create(:ci_build, :protected, pipeline: pipeline) }
+
+          it 'picks the protected job' do
+            expect(execute(specific_runner)).to eq(pending_build)
+          end
+        end
+
+        context 'when a job is unprotected' do
+          let!(:pending_build) { create(:ci_build, :unprotected, pipeline: pipeline) }
+
+          it 'picks the unprotected job' do
+            expect(execute(specific_runner)).to eq(pending_build)
+          end
+        end
+      end
+
+      context 'when a runner is protected' do
+        let!(:specific_runner) { create(:ci_runner, :protected, :specific) }
+
+        context 'when a job is protected' do
+          let!(:pending_build) { create(:ci_build, :protected, pipeline: pipeline) }
+
+          it 'picks the protected job' do
+            expect(execute(specific_runner)).to eq(pending_build)
+          end
+        end
+
+        context 'when a job is unprotected' do
+          let!(:unprotected_job) { create(:ci_build, :unprotected, pipeline: pipeline) }
+
+          it 'does not pick the unprotected job' do
+            expect(execute(specific_runner)).to be_nil
+          end
+        end
+      end
+
       def execute(runner)
         described_class.new(runner).execute.build
       end