Add latest changes from gitlab-org/gitlab@master

2022-05-14 03:09:09 +00:00 · 2022-05-14 03:09:09 +00:00 · 805f27a327
parent 3e81e2db0b
commit 805f27a327
30 changed files with 207 additions and 15 deletions
--- a/app/controllers/projects/settings/ci_cd_controller.rb
+++ b/app/controllers/projects/settings/ci_cd_controller.rb
@ -88,7 +88,7 @@ module Projects
      def permitted_project_params
        [
          :runners_token, :builds_enabled, :build_allow_git_fetch,
-          :build_timeout_human_readable, :public_builds,
+          :build_timeout_human_readable, :public_builds, :ci_separated_caches,
          :auto_cancel_pending_pipelines, :ci_config_path, :auto_rollback_enabled,
          auto_devops_attributes: [:id, :domain, :enabled, :deploy_strategy],
          ci_cd_settings_attributes: [:default_git_depth, :forward_deployment_enabled]
--- a/app/controllers/projects_controller.rb
+++ b/app/controllers/projects_controller.rb
@ -464,6 +464,7 @@ class ProjectsController < Projects::ApplicationController
      :initialize_with_sast,
      :initialize_with_readme,
      :autoclose_referenced_issues,
+      :ci_separated_caches,
      :suggestion_commit_message,
      :packages_enabled,
      :service_desk_enabled,
--- a/app/models/ci/build.rb
+++ b/app/models/ci/build.rb
@ -909,6 +909,8 @@ module Ci
        end
      end

+      return cache unless project.ci_separated_caches
+
      type_suffix = pipeline.protected_ref? ? 'protected' : 'non_protected'
      cache.map do |entry|
        entry.merge(key: "#{entry[:key]}-#{type_suffix}")
--- a/app/models/project.rb
+++ b/app/models/project.rb
@ -473,6 +473,7 @@ class Project < ApplicationRecord
  delegate :job_token_scope_enabled, :job_token_scope_enabled=, to: :ci_cd_settings, prefix: :ci, allow_nil: true
  delegate :keep_latest_artifact, :keep_latest_artifact=, to: :ci_cd_settings, allow_nil: true
  delegate :restrict_user_defined_variables, :restrict_user_defined_variables=, to: :ci_cd_settings, allow_nil: true
+  delegate :separated_caches, :separated_caches=, to: :ci_cd_settings, prefix: :ci, allow_nil: true
  delegate :runner_token_expiration_interval, :runner_token_expiration_interval=, :runner_token_expiration_interval_human_readable, :runner_token_expiration_interval_human_readable=, to: :ci_cd_settings, allow_nil: true
  delegate :actual_limits, :actual_plan_name, :actual_plan, to: :namespace, allow_nil: true
  delegate :allow_merge_on_skipped_pipeline, :allow_merge_on_skipped_pipeline?,
--- a/app/models/project_ci_cd_setting.rb
+++ b/app/models/project_ci_cd_setting.rb
@ -18,6 +18,7 @@ class ProjectCiCdSetting < ApplicationRecord
    allow_nil: true

  default_value_for :forward_deployment_enabled, true
+  default_value_for :separated_caches, true

  chronic_duration_attr :runner_token_expiration_interval_human_readable, :runner_token_expiration_interval

--- a/app/views/projects/settings/ci_cd/_form.html.haml
+++ b/app/views/projects/settings/ci_cd/_form.html.haml
@ -1,6 +1,7 @@
 - help_link_public_pipelines = link_to sprite_icon('question-o'), help_page_path('ci/pipelines/settings', anchor: 'change-which-users-can-view-your-pipelines'), target: '_blank', rel: 'noopener noreferrer'
 - help_link_auto_canceling = link_to sprite_icon('question-o'), help_page_path('ci/pipelines/settings', anchor: 'auto-cancel-redundant-pipelines'), target: '_blank', rel: 'noopener noreferrer'
- help_link_skip_outdated =link_to sprite_icon('question-o'), help_page_path('ci/pipelines/settings', anchor: 'skip-outdated-deployment-jobs'), target: '_blank', rel: 'noopener noreferrer'
+- help_link_skip_outdated = link_to sprite_icon('question-o'), help_page_path('ci/pipelines/settings', anchor: 'skip-outdated-deployment-jobs'), target: '_blank', rel: 'noopener noreferrer'
+- help_link_separated_caches = link_to sprite_icon('question-o'), help_page_path('ci/caching/index', anchor: 'cache-key-names'), target: '_blank', rel: 'noopener noreferrer'

 .row.gl-mt-3
  .col-lg-12
@ -24,6 +25,11 @@
            = form.gitlab_ui_checkbox_component :forward_deployment_enabled, _("Skip outdated deployment jobs"),
              help_text: (_('When a deployment job is successful, skip older deployment jobs that are still pending.') + ' ' + help_link_skip_outdated).html_safe

+        .form-group
+          = f.gitlab_ui_checkbox_component :ci_separated_caches,
+            s_("CICD|Use separate caches for protected branches"),
+            help_text: (s_('CICD|Unprotected branches will not have access to the cache from protected branches.') + ' ' + help_link_separated_caches).html_safe
+
        .form-group
          = f.label :ci_config_path, _('CI/CD configuration file'), class: 'label-bold'
          = f.text_field :ci_config_path, class: 'form-control', placeholder: '.gitlab-ci.yml'
--- a/db/migrate/20220507204024_add_separated_caches_option_to_project_ci_settings.rb
+++ b/db/migrate/20220507204024_add_separated_caches_option_to_project_ci_settings.rb
@ -0,0 +1,9 @@
+# frozen_string_literal: true
+
+class AddSeparatedCachesOptionToProjectCiSettings < Gitlab::Database::Migration[2.0]
+  enable_lock_retries!
+
+  def change
+    add_column :project_ci_cd_settings, :separated_caches, :boolean, default: true, null: false
+  end
+end
--- a/db/schema_migrations/20220507204024
+++ b/db/schema_migrations/20220507204024
@ -0,0 +1 @@
+8014dcf24ac2f1171240daa349e0552cb313b06f756b84e09a16d76a8810132a
--- a/db/structure.sql
+++ b/db/structure.sql
@ -19119,7 +19119,8 @@ CREATE TABLE project_ci_cd_settings (
    keep_latest_artifact boolean DEFAULT true NOT NULL,
    restrict_user_defined_variables boolean DEFAULT false NOT NULL,
    job_token_scope_enabled boolean DEFAULT false NOT NULL,
-    runner_token_expiration_interval integer
+    runner_token_expiration_interval integer,
+    separated_caches boolean DEFAULT true NOT NULL
 );

 CREATE SEQUENCE project_ci_cd_settings_id_seq
--- a/doc/administration/integration/terminal.md
+++ b/doc/administration/integration/terminal.md
@ -6,11 +6,15 @@ info: To determine the technical writer assigned to the Stage/Group associated w

 # Web terminals (DEPRECATED) **(FREE)**

-> [Deprecated](https://gitlab.com/groups/gitlab-org/configure/-/epics/8) in GitLab 14.5.
+> - [Deprecated](https://gitlab.com/groups/gitlab-org/configure/-/epics/8) in GitLab 14.5.
+> - [Disabled on self-managed](https://gitlab.com/gitlab-org/gitlab/-/issues/353410) in GitLab 15.0.

 WARNING:
 This feature was [deprecated](https://gitlab.com/groups/gitlab-org/configure/-/epics/8) in GitLab 14.5.

+FLAG:
+On self-managed GitLab, by default this feature is not available. To make it available, ask an administrator to [enable the feature flag](../../administration/feature_flags.md) named `certificate_based_clusters`.
+
 - Read more about the non-deprecated [Web Terminals accessible through the Web IDE](../../user/project/web_ide/index.md).
 - Read more about the non-deprecated [Web Terminals accessible from a running CI job](../../ci/interactive_web_terminal/index.md).

--- a/doc/ci/caching/index.md
+++ b/doc/ci/caching/index.md
@ -30,7 +30,7 @@ can't link to files outside it.
 - Subsequent pipelines can use the cache.
 - Subsequent jobs in the same pipeline can use the cache, if the dependencies are identical.
 - Different projects cannot share the cache.
- Protected and non-protected branches do not share the cache.
+- By default, protected and non-protected branches [do not share the cache](#cache-key-names). However, you can [change this behavior](#use-the-same-cache-for-all-branches).

 ### Artifacts

@ -460,6 +460,24 @@ and `feature`, then the following table represents the resulting cache keys:
 | `main`      | `main-protected` |
 | `feature`   | `feature-non_protected` |

+##### Use the same cache for all branches
+
+> [Introduced](https://gitlab.com/gitlab-org/gitlab/-/issues/361643) in GitLab 15.0.
+
+If you do not want to use [cache key names](#cache-key-names),
+you can have all branches (protected and unprotected) use the same cache.
+
+The cache separation with [cache key names](#cache-key-names) is a security feature
+and should only be disabled in an environment where all users with Developer role are highly trusted.
+
+To use the same cache for all branches:
+
+1. On the top bar, select **Menu > Projects** and find your project.
+1. On the left sidebar, select **Settings > CI/CD**.
+1. Expand **General pipelines**.
+1. Clear the **Use separate caches for protected branches** checkbox.
+1. Select **Save changes**.
+
 ### How archiving and extracting works

 This example shows two jobs in two consecutive stages:
--- a/doc/ci/pipelines/merge_trains.md
+++ b/doc/ci/pipelines/merge_trains.md
@ -24,7 +24,7 @@ requests, each waiting to be merged into the target branch.

 Many merge requests can be added to the train. Each merge request runs its own merged results pipeline,
 which includes the changes from all of the other merge requests in *front* of it on the train.
-All the pipelines run in parallel, to save time.
+All the pipelines run in parallel, to save time. The author of the internal merged result commit is always the user that initiated the merge.

 If the pipeline for a merge request fails, the breaking changes are not merged, and the target
 branch is unaffected. The merge request is removed from the train, and all pipelines behind it restart.
--- a/doc/ci/pipelines/merged_results_pipelines.md
+++ b/doc/ci/pipelines/merged_results_pipelines.md
@ -12,7 +12,8 @@ A *merged results pipeline* is a type of [merge request pipeline](merge_request_

 GitLab creates an internal commit with the merged results, so the pipeline can run
 against it. This commit does not exist in either branch,
-but you can view it in the pipeline details.
+but you can view it in the pipeline details. The author of the internal commit is
+always the user that created the merge request.

 The pipeline runs against the target branch as it exists at the moment you run the pipeline.
 Over time, while you're working in the source branch, the target branch might change.
--- a/doc/ci/yaml/index.md
+++ b/doc/ci/yaml/index.md
@ -16,7 +16,7 @@ This document lists the configuration options for your GitLab `.gitlab-ci.yml` f
 When you are editing your `.gitlab-ci.yml` file, you can validate it with the
 [CI Lint](../lint.md) tool.

-If you are editing this page, make sure you follow the [CI/CD YAML reference style guide](../../development/cicd/cicd_reference_documentation_guide.md).
+If you are editing content on this page, follow the [instructions for documenting keywords](../../development/cicd/cicd_reference_documentation_guide.md).

 ## Keywords

--- a/doc/development/cicd/cicd_reference_documentation_guide.md
+++ b/doc/development/cicd/cicd_reference_documentation_guide.md
@ -4,7 +4,7 @@ group: Pipeline Authoring
 info: To determine the technical writer assigned to the Stage/Group associated with this page, see https://about.gitlab.com/handbook/engineering/ux/technical-writing/#assignments
 ---

-# CI/CD YAML reference style guide **(FREE)**
+# Documenting the `.gitlab-ci.yml` keywords **(FREE)**

 The [CI/CD YAML reference](../../ci/yaml/index.md) uses a standard style to make it easier to use and update.

--- a/doc/topics/autodevops/requirements.md
+++ b/doc/topics/autodevops/requirements.md
@ -69,7 +69,7 @@ as other environment [variables](../../ci/variables/index.md#cicd-variable-prece

 If you don't specify the base domain in your projects and groups, Auto DevOps uses the instance-wide **Auto DevOps domain**.

-Auto DevOps requires a wildcard DNS record that matches the base domains. For
+Auto DevOps requires a wildcard DNS `A` record that matches the base domains. For
 a base domain of `example.com`, you'd need a DNS entry like:

 ```plaintext
--- a/doc/user/clusters/cost_management.md
+++ b/doc/user/clusters/cost_management.md
@ -8,10 +8,14 @@ info: To determine the technical writer assigned to the Stage/Group associated w

 > - [Introduced](https://gitlab.com/gitlab-org/gitlab/-/issues/216737) in [GitLab Ultimate](https://about.gitlab.com/pricing/) 13.5.
 > - [Deprecated](https://gitlab.com/groups/gitlab-org/configure/-/epics/8) in GitLab 14.5.
+> - [Disabled on self-managed](https://gitlab.com/gitlab-org/gitlab/-/issues/353410) in GitLab 15.0.

 WARNING:
 This feature was [deprecated](https://gitlab.com/groups/gitlab-org/configure/-/epics/8) in GitLab 14.5.

+FLAG:
+On self-managed GitLab, by default this feature is not available. To make it available, ask an administrator to [enable the feature flag](../../administration/feature_flags.md) named `certificate_based_clusters`.
+
 Cluster cost management provides insights into cluster resource usage. GitLab provides an example
 [`kubecost-cost-model`](https://gitlab.com/gitlab-examples/kubecost-cost-model/)
 project that uses the GitLab Prometheus integration and
--- a/doc/user/clusters/environments.md
+++ b/doc/user/clusters/environments.md
@ -9,10 +9,14 @@ info: To determine the technical writer assigned to the Stage/Group associated w
 > - [Introduced](https://gitlab.com/gitlab-org/gitlab/-/issues/13392) in GitLab 12.3 for group-level clusters.
 > - [Introduced](https://gitlab.com/gitlab-org/gitlab/-/issues/14809) in GitLab 12.4 for instance-level clusters.
 > - [Deprecated](https://gitlab.com/groups/gitlab-org/configure/-/epics/8) in GitLab 14.5.
+> - [Disabled on self-managed](https://gitlab.com/gitlab-org/gitlab/-/issues/353410) in GitLab 15.0.

 WARNING:
 This feature was [deprecated](https://gitlab.com/groups/gitlab-org/configure/-/epics/8) in GitLab 14.5.

+FLAG:
+On self-managed GitLab, by default this feature is not available. To make it available, ask an administrator to [enable the feature flag](../../administration/feature_flags.md) named `certificate_based_clusters`.
+
 Cluster environments provide a consolidated view of which CI [environments](../../ci/environments/index.md) are
 deployed to the Kubernetes cluster and it:

--- a/doc/user/clusters/integrations.md
+++ b/doc/user/clusters/integrations.md
@ -6,11 +6,15 @@ info: To determine the technical writer assigned to the Stage/Group associated w

 # Cluster integrations (DEPRECATED) **(FREE)**

-> [Deprecated](https://gitlab.com/groups/gitlab-org/configure/-/epics/8) in GitLab 14.5.
+> - [Deprecated](https://gitlab.com/groups/gitlab-org/configure/-/epics/8) in GitLab 14.5.
+> - [Disabled on self-managed](https://gitlab.com/gitlab-org/gitlab/-/issues/353410) in GitLab 15.0.

 WARNING:
 This feature was [deprecated](https://gitlab.com/groups/gitlab-org/configure/-/epics/8) in GitLab 14.5.

+FLAG:
+On self-managed GitLab, by default this feature is not available. To make it available, ask an administrator to [enable the feature flag](../../administration/feature_flags.md) named `certificate_based_clusters`.
+
 GitLab provides several ways to integrate applications to your
 Kubernetes cluster.

--- a/doc/user/clusters/management_project.md
+++ b/doc/user/clusters/management_project.md
@ -8,12 +8,16 @@ info: To determine the technical writer assigned to the Stage/Group associated w

 > - [Introduced](https://gitlab.com/gitlab-org/gitlab/-/issues/32810) in GitLab 12.5.
 > - [Deprecated](https://gitlab.com/groups/gitlab-org/configure/-/epics/8) in GitLab 14.5.
+> - [Disabled on self-managed](https://gitlab.com/gitlab-org/gitlab/-/issues/353410) in GitLab 15.0.

 WARNING:
 The cluster management project was [deprecated](https://gitlab.com/groups/gitlab-org/configure/-/epics/8) in GitLab 14.5.
 To manage cluster applications, use the [GitLab agent](agent/index.md)
 with the [Cluster Management Project Template](management_project_template.md).

+FLAG:
+On self-managed GitLab, by default this feature is not available. To make it available, ask an administrator to [enable the feature flag](../../administration/feature_flags.md) named `certificate_based_clusters`.
+
 A project can be designated as the management project for a cluster.
 A management project can be used to run deployment jobs with
 Kubernetes
--- a/doc/user/project/clusters/gitlab_managed_clusters.md
+++ b/doc/user/project/clusters/gitlab_managed_clusters.md
@ -9,12 +9,16 @@ info: To determine the technical writer assigned to the Stage/Group associated w
 > - [Introduced](https://gitlab.com/gitlab-org/gitlab-foss/-/merge_requests/22011) in GitLab 11.5.
 > - Became [optional](https://gitlab.com/gitlab-org/gitlab-foss/-/merge_requests/26565) in GitLab 11.11.
 > - [Deprecated](https://gitlab.com/groups/gitlab-org/configure/-/epics/8) in GitLab 14.5.
+> - [Disabled on self-managed](https://gitlab.com/gitlab-org/gitlab/-/issues/353410) in GitLab 15.0.

 WARNING:
 This feature was [deprecated](https://gitlab.com/groups/gitlab-org/configure/-/epics/8) in GitLab 14.5.
 To connect your cluster to GitLab, use the [GitLab agent](../../../user/clusters/agent/index.md).
 To manage applications, use the [Cluster Project Management Template](../../../user/clusters/management_project_template.md).

+FLAG:
+On self-managed GitLab, by default this feature is not available. To make it available, ask an administrator to [enable the feature flag](../../../administration/feature_flags.md) named `certificate_based_clusters`.
+
 You can choose to allow GitLab to manage your cluster for you. If your cluster
 is managed by GitLab, resources for your projects are automatically created. See
 the [Access controls](cluster_access.md) section for
--- a/doc/user/project/clusters/kubernetes_pod_logs.md
+++ b/doc/user/project/clusters/kubernetes_pod_logs.md
@ -10,6 +10,7 @@ info: To determine the technical writer assigned to the Stage/Group associated w
 > - [Moved](https://gitlab.com/gitlab-org/gitlab/-/merge_requests/26383) from GitLab Ultimate to GitLab Free 12.9.
 > - [Deprecated](https://gitlab.com/groups/gitlab-org/configure/-/epics/8) in GitLab 14.5.
 > - [Moved](https://gitlab.com/gitlab-org/gitlab/-/issues/360182) behind a [feature flag](../../../administration/feature_flags.md) named `monitor_logging` in GitLab 15.0. Disabled by default.
+> - [Disabled on self-managed](https://gitlab.com/gitlab-org/gitlab/-/issues/353410) in GitLab 15.0.

 WARNING:
 This feature is in its end-of-life process.
@ -17,7 +18,7 @@ This feature was [deprecated](https://gitlab.com/groups/gitlab-org/configure/-/e
 It will be [removed completely](https://gitlab.com/gitlab-org/gitlab/-/issues/346485) in GitLab 15.2.

 FLAG:
-On self-managed GitLab, by default this feature is not available. To make it available, ask an administrator to [enable the feature flag](../../../administration/feature_flags.md) named `monitor_logging`.
+On self-managed GitLab, by default this feature is not available. To make it available, ask an administrator to [enable the feature flag](../../../administration/feature_flags.md) named `monitor_logging` and the one named `certificate_based_clusters`.
 On GitLab.com, this feature is not available.
 This feature is not recommended for production use.

--- a/doc/user/project/deploy_boards.md
+++ b/doc/user/project/deploy_boards.md
@ -16,12 +16,16 @@ type: howto, reference
 >   This is [fixed](https://gitlab.com/gitlab-org/gitlab/-/merge_requests/60525) in
 >   GitLab 13.12.
 > - [Deprecated](https://gitlab.com/groups/gitlab-org/configure/-/epics/8) in GitLab 14.5.
+> - [Disabled on self-managed](https://gitlab.com/gitlab-org/gitlab/-/issues/353410) in GitLab 15.0.

 WARNING:
 This feature was [deprecated](https://gitlab.com/groups/gitlab-org/configure/-/epics/8) in GitLab 14.5.
 [An epic exists](https://gitlab.com/groups/gitlab-org/-/epics/2493)
 to add this functionality to the [agent](../index.md).

+FLAG:
+On self-managed GitLab, by default this feature is not available. To make it available, ask an administrator to [enable the feature flag](../../administration/feature_flags.md) named `certificate_based_clusters`.
+
 GitLab deploy boards offer a consolidated view of the current health and
 status of each CI [environment](../../ci/environments/index.md) running on [Kubernetes](https://kubernetes.io), displaying the status
 of the pods in the deployment. Developers and other teammates can view the
--- a/lib/api/entities/project.rb
+++ b/lib/api/entities/project.rb
@ -103,6 +103,7 @@ module API
      expose :ci_default_git_depth
      expose :ci_forward_deployment_enabled
      expose :ci_job_token_scope_enabled
+      expose :ci_separated_caches
      expose :public_builds, as: :public_jobs
      expose :build_git_strategy, if: lambda { |project, options| options[:user_can_admin_project] } do |project, options|
        project.build_allow_git_fetch ? 'fetch' : 'clone'
--- a/locale/gitlab.pot
+++ b/locale/gitlab.pot
@ -6927,6 +6927,12 @@ msgstr ""
 msgid "CICD|There are several CI/CD limits in place."
 msgstr ""

+msgid "CICD|Unprotected branches will not have access to the cache from protected branches."
+msgstr ""
+
+msgid "CICD|Use separate caches for protected branches"
+msgstr ""
+
 msgid "CICD|group enabled"
 msgstr ""

--- a/qa/qa/page/project/pipeline/new.rb
+++ b/qa/qa/page/project/pipeline/new.rb
@ -16,9 +16,9 @@ module QA
            click_element(:run_pipeline_button, Page::Project::Pipeline::Show)
          end

-          def add_variable(key, value, row_index: 0)
+          def configure_variable(key: nil, value: 'foo', row_index: 0)
            within_element_by_index(:ci_variable_row_container, row_index) do
-              fill_element(:ci_variable_key_field, key)
+              fill_element(:ci_variable_key_field, key) unless key.nil?
              fill_element(:ci_variable_value_field, value)
            end
          end
--- a/qa/qa/specs/features/browser_ui/4_verify/ci_variable/custom_variable_spec.rb
+++ b/qa/qa/specs/features/browser_ui/4_verify/ci_variable/custom_variable_spec.rb
@ -0,0 +1,88 @@
+# frozen_string_literal: true
+
+module QA
+  RSpec.describe 'Verify', :runner do
+    describe 'Pipeline with customizable variable' do
+      let(:executor) { "qa-runner-#{Time.now.to_i}" }
+      let(:pipeline_job_name) { 'customizable-variable' }
+      let(:variable_custom_value) { 'Custom Foo' }
+
+      let(:project) do
+        Resource::Project.fabricate_via_api! do |project|
+          project.name = 'project-with-customizable-variable-pipeline'
+        end
+      end
+
+      let!(:runner) do
+        Resource::Runner.fabricate! do |runner|
+          runner.project = project
+          runner.name = executor
+          runner.tags = [executor]
+        end
+      end
+
+      let!(:commit) do
+        Resource::Repository::Commit.fabricate_via_api! do |commit|
+          commit.project = project
+          commit.commit_message = 'Add .gitlab-ci.yml'
+          commit.add_files(
+            [
+              {
+                file_path: '.gitlab-ci.yml',
+                content: <<~YAML
+                  variables:
+                    FOO:
+                      value: "Default Foo"
+                      description: "This is a description for the foo variable"
+                  #{pipeline_job_name}:
+                    tags:
+                      - #{executor}
+                    script: echo "$FOO"
+                YAML
+              }
+            ]
+          )
+        end
+      end
+
+      before do
+        Flow::Login.sign_in
+        project.visit!
+        Page::Project::Menu.perform(&:click_ci_cd_pipelines)
+        Page::Project::Pipeline::Index.perform do |index|
+          index.click_run_pipeline_button
+        end
+      end
+
+      after do
+        [runner, project].each(&:remove_via_api!)
+      end
+
+      it(
+        'manually creates a pipeline and uses the defined custom variable value',
+        testcase: 'https://gitlab.com/gitlab-org/gitlab/-/quality/test_cases/361814'
+      ) do
+        Page::Project::Pipeline::New.perform do |new|
+          new.configure_variable(value: variable_custom_value)
+          new.click_run_pipeline_button
+        end
+
+        Page::Project::Pipeline::Show.perform do |show|
+          Support::Waiter.wait_until { show.passed? }
+        end
+
+        job = Resource::Job.fabricate_via_api! do |job|
+          job.id = project.job_by_name(pipeline_job_name)[:id]
+          job.name = pipeline_job_name
+          job.project = project
+        end
+
+        job.visit!
+
+        Page::Project::Job::Show.perform do |show|
+          expect(show.output).to have_content(variable_custom_value)
+        end
+      end
+    end
+  end
+end
--- a/qa/qa/specs/features/shared_contexts/variable_inheritance_shared_context.rb
+++ b/qa/qa/specs/features/shared_contexts/variable_inheritance_shared_context.rb
@ -59,7 +59,7 @@ module QA
      Flow::Pipeline.wait_for_latest_pipeline
      Page::Project::Pipeline::Index.perform(&:click_run_pipeline_button)
      Page::Project::Pipeline::New.perform do |new|
-        new.add_variable(key, value)
+        new.configure_variable(key: key, value: value)
        new.click_run_pipeline_button
      end
    end
--- a/spec/models/ci/build_spec.rb
+++ b/spec/models/ci/build_spec.rb
@ -1078,6 +1078,32 @@ RSpec.describe Ci::Build do
            is_expected.to all(a_hash_including(key: a_string_matching(/-non_protected$/)))
          end
        end
+
+        context 'when separated caches are disabled' do
+          before do
+            allow_any_instance_of(Project).to receive(:ci_separated_caches).and_return(false)
+          end
+
+          context 'running on protected ref' do
+            before do
+              allow(build.pipeline).to receive(:protected_ref?).and_return(true)
+            end
+
+            it 'is expected to have no type suffix' do
+              is_expected.to match([a_hash_including(key: 'key-1'), a_hash_including(key: 'key2-1')])
+            end
+          end
+
+          context 'running on not protected ref' do
+            before do
+              allow(build.pipeline).to receive(:protected_ref?).and_return(false)
+            end
+
+            it 'is expected to have no type suffix' do
+              is_expected.to match([a_hash_including(key: 'key-1'), a_hash_including(key: 'key2-1')])
+            end
+          end
+        end
      end

      context 'when project has jobs_cache_index' do
--- a/spec/requests/api/project_attributes.yml
+++ b/spec/requests/api/project_attributes.yml
@ -99,6 +99,7 @@ ci_cd_settings:
    default_git_depth: ci_default_git_depth
    forward_deployment_enabled: ci_forward_deployment_enabled
    job_token_scope_enabled: ci_job_token_scope_enabled
+    separated_caches: ci_separated_caches

 build_import_state: # import_state
  unexposed_attributes:
				`@ -0,0 +1 @@`
				`8014dcf24ac2f1171240daa349e0552cb313b06f756b84e09a16d76a8810132a`