Use Github repo visibility during import while respecting restricted visibility levels

changelogs/unreleased/47189-github_import_visibility.yml

+---
+title: Use Github repo visibility during import while respecting restricted visibility
+  levels
+merge_request:
+author:
+type: fixed

lib/gitlab/legacy_github_import/project_creator.rb

@@ -35,7 +35,10 @@ module Gitlab
       end
 
       def visibility_level
-        repo.private ? Gitlab::VisibilityLevel::PRIVATE : Gitlab::CurrentSettings.default_project_visibility
+        visibility_level = repo.private ? Gitlab::VisibilityLevel::PRIVATE : Gitlab::VisibilityLevel::PUBLIC
+        visibility_level = Gitlab::CurrentSettings.default_project_visibility if Gitlab::CurrentSettings.restricted_visibility_levels.include?(visibility_level)
+
+        visibility_level
       end
 
       #

spec/lib/gitlab/legacy_github_import/project_creator_spec.rb

@@ -44,16 +44,44 @@ describe Gitlab::LegacyGithubImport::ProjectCreator do
     end
 
     context 'when GitHub project is public' do
-      before do
-        allow_any_instance_of(ApplicationSetting).to receive(:default_project_visibility).and_return(Gitlab::VisibilityLevel::INTERNAL)
-      end
-
-      it 'sets project visibility to the default project visibility' do
+      it 'sets project visibility to public' do
         repo.private = false
 
         project = service.execute
 
-        expect(project.visibility_level).to eq(Gitlab::VisibilityLevel::INTERNAL)
+        expect(project.visibility_level).to eq(Gitlab::VisibilityLevel::PUBLIC)
+      end
+    end
+
+    context 'when visibility level is restricted' do
+      context 'when GitHub project is private' do
+        before do
+          stub_application_setting(restricted_visibility_levels: [Gitlab::VisibilityLevel::PRIVATE])
+          allow_any_instance_of(ApplicationSetting).to receive(:default_project_visibility).and_return(Gitlab::VisibilityLevel::INTERNAL)
+        end
+
+        it 'sets project visibility to the default project visibility' do
+          repo.private = true
+
+          project = service.execute
+
+          expect(project.visibility_level).to eq(Gitlab::VisibilityLevel::INTERNAL)
+        end
+      end
+
+      context 'when GitHub project is public' do
+        before do
+          stub_application_setting(restricted_visibility_levels: [Gitlab::VisibilityLevel::PUBLIC])
+          allow_any_instance_of(ApplicationSetting).to receive(:default_project_visibility).and_return(Gitlab::VisibilityLevel::INTERNAL)
+        end
+
+        it 'sets project visibility to the default project visibility' do
+          repo.private = false
+
+          project = service.execute
+
+          expect(project.visibility_level).to eq(Gitlab::VisibilityLevel::INTERNAL)
+        end
       end
     end