Pass correct tag target to post-receive hook when creating tag via UI

We need to handle annotated tags that are created via GitLab UI.
Annotated tags have their own SHA. We have to pass this SHA to
post-receive hook to mirror what happens when someone creates
an annotated tag in their local repository and pushes it via
command line.
In order to obtain tag SHA we first have to create it. This is
a bit confusing because we create the tag before executing
pre-hooks, but there is no way to create a tag outside the
repository. If pre-hooks fail we have to clean up after ourselves.

app/models/repository.rb

@@ -176,11 +176,18 @@ class Repository
 
     options = { message: message, tagger: user_to_committer(user) } if message
 
-    GitHooksService.new.execute(user, path_to_repo, oldrev, target, ref) do
+    rugged.tags.create(tag_name, target, options)
-      rugged.tags.create(tag_name, target, options)
+    tag = find_tag(tag_name)
+
+    GitHooksService.new.execute(user, path_to_repo, oldrev, tag.target, ref) do
+      # we already created a tag, because we need tag SHA to pass correct
+      # values to hooks
     end
 
-    find_tag(tag_name)
+    tag
+  rescue GitHooksService::PreReceiveError
+    rugged.tags.delete(tag_name)
+    raise
   end
 
   def rm_branch(user, branch_name)

changelogs/unreleased/pass-correct-tag-target-to-post-receive.yml

@@ -0,0 +1,4 @@
+---
+title: Pass correct tag target to post-receive hook when creating tag via UI
+merge_request: 7556
+author:

spec/models/repository_spec.rb

@@ -1354,6 +1354,28 @@ describe Repository, models: true do
         repository.add_tag(user, '8.5', 'master', 'foo')
       end
 
+      it 'does not create a tag when a pre-hook fails' do
+        allow_any_instance_of(Gitlab::Git::Hook).to receive(:trigger).and_return([false, ''])
+
+        expect do
+          repository.add_tag(user, '8.5', 'master', 'foo')
+        end.to raise_error(GitHooksService::PreReceiveError)
+
+        repository.expire_tags_cache
+        expect(repository.find_tag('8.5')).to be_nil
+      end
+
+      it 'passes tag SHA to hooks' do
+        spy = GitHooksService.new
+        allow(GitHooksService).to receive(:new).and_return(spy)
+        allow(spy).to receive(:execute).and_call_original
+
+        tag = repository.add_tag(user, '8.5', 'master', 'foo')
+
+        expect(spy).to have_received(:execute).
+          with(anything, anything, anything, tag.target, anything)
+      end
+
       it 'returns a Gitlab::Git::Tag object' do
         tag = repository.add_tag(user, '8.5', 'master', 'foo')