Extend can_pick?

2 files changed, 26 insertions, 0 deletions

diff --git a/app/models/ci/runner.rb b/app/models/ci/runner.rb
index 24b62555845..a3b4a1fccf3 100644
--- a/app/models/ci/runner.rb
+++ b/app/models/ci/runner.rb
@@ -111,6 +111,8 @@ module Ci
     end
 
     def can_pick?(build)
+      return false if self.protected_? && !build.protected?
+
       assignable_for?(build.project) && accepting_tags?(build)
     end
 
diff --git a/spec/models/ci/runner_spec.rb b/spec/models/ci/runner_spec.rb
index a04d4615b6b..566b9b48879 100644
--- a/spec/models/ci/runner_spec.rb
+++ b/spec/models/ci/runner_spec.rb
@@ -95,6 +95,8 @@ describe Ci::Runner do
     let(:build) { create(:ci_build, pipeline: pipeline) }
     let(:runner) { create(:ci_runner) }
 
+    subject { runner.can_pick?(build) }
+
     before do
       build.project.runners << runner
     end
@@ -222,6 +224,28 @@ describe Ci::Runner do
         end
       end
     end
+
+    context 'when runner is protected' do
+      before do
+        runner.protected_!
+      end
+
+      context 'when build is protected' do
+        before do
+          build.protected = true
+        end
+
+        it { is_expected.to be_truthy }
+      end
+
+      context 'when build is unprotected' do
+        before do
+          build.protected = false
+        end
+
+        it { is_expected.to be_falsey }
+      end
+    end
   end
 
   describe '#status' do