Backend implementation for protected variables

app/models/ci/build.rb

@@ -186,6 +186,7 @@ module Ci
       variables += yaml_variables
       variables += user_variables
       variables += project.secret_variables
+      variables += project.protected_variables if ProtectedBranch.protected?(project, ref)
       variables += trigger_request.user_variables if trigger_request
       variables
     end

app/models/project.rb

@@ -1257,9 +1257,15 @@ class Project < ActiveRecord::Base
   end
 
   def secret_variables
-    variables.map do |variable|
-      { key: variable.key, value: variable.value, public: false }
+    filtered_variables = variables.to_a.reject(&:protected?)
+
+    build_variables(filtered_variables)
   end
+
+  def protected_variables
+    filtered_variables = variables.to_a.select(&:protected?)
+
+    build_variables(filtered_variables)
   end
 
   def deployment_variables
@@ -1412,4 +1418,10 @@ class Project < ActiveRecord::Base
 
     raise ex
   end
+
+  def build_variables(filtered_variables)
+    filtered_variables.map do |variable|
+      { key: variable.key, value: variable.value, public: false }
+    end
+  end
 end

db/migrate/20170524161101_add_protected_to_ci_variables.rb

@@ -0,0 +1,15 @@
+class AddProtectedToCiVariables < ActiveRecord::Migration
+  include Gitlab::Database::MigrationHelpers
+
+  DOWNTIME = false
+
+  disable_ddl_transaction!
+
+  def up
+    add_column_with_default(:ci_variables, :protected, :boolean, default: false)
+  end
+
+  def down
+    remove_column(:ci_variables, :protected)
+  end
+end

db/schema.rb

@@ -11,7 +11,7 @@
 #
 # It's strongly recommended that you check this file into your version control system.
 
-ActiveRecord::Schema.define(version: 20170521184006) do
+ActiveRecord::Schema.define(version: 20170524161101) do
 
   # These are extensions that must be enabled in order to support this database
   enable_extension "plpgsql"
@@ -355,6 +355,7 @@ ActiveRecord::Schema.define(version: 20170521184006) do
     t.string "encrypted_value_salt"
     t.string "encrypted_value_iv"
     t.integer "project_id", null: false
+    t.boolean "protected", default: false
   end
 
   add_index "ci_variables", ["project_id"], name: "index_ci_variables_on_project_id", using: :btree