Add Ci::InstanceVariable schema and model

This is the first commit for defining CI variables at the instance
level.

app/models/ci/instance_variable.rb

+# frozen_string_literal: true
+
+module Ci
+  class InstanceVariable < ApplicationRecord
+    extend Gitlab::Ci::Model
+    include Ci::NewHasVariable
+    include Ci::Maskable
+
+    alias_attribute :secret_value, :value
+
+    validates :key, uniqueness: {
+      message: "(%{value}) has already been taken"
+    }
+
+    scope :unprotected, -> { where(protected: false) }
+  end
+end

changelogs/unreleased/14108-instance-level-ci-variables.yml

+---
+title: Add migrations for global CI variables
+merge_request: 30156
+author:
+type: added

db/migrate/20200422091541_create_ci_instance_variables.rb

+# frozen_string_literal: true
+
+class CreateCiInstanceVariables < ActiveRecord::Migration[6.0]
+  include Gitlab::Database::MigrationHelpers
+  DOWNTIME = false
+
+  disable_ddl_transaction!
+
+  def up
+    unless table_exists?(:ci_instance_variables)
+      create_table :ci_instance_variables do |t|
+        t.integer :variable_type, null: false, limit: 2, default: 1
+        t.boolean :masked, default: false, allow_null: false
+        t.boolean :protected, default: false, allow_null: false
+        t.text :key, null: false
+        t.text :encrypted_value
+        t.text :encrypted_value_iv
+
+        t.index [:key], name: 'index_ci_instance_variables_on_key', unique: true, using: :btree
+      end
+    end
+
+    add_text_limit(:ci_instance_variables, :key, 255)
+    add_text_limit(:ci_instance_variables, :encrypted_value, 1024)
+    add_text_limit(:ci_instance_variables, :encrypted_value_iv, 255)
+  end
+
+  def down
+    drop_table :ci_instance_variables
+  end
+end

db/structure.sql

@@ -1069,6 +1069,28 @@ CREATE SEQUENCE public.ci_group_variables_id_seq
 
 ALTER SEQUENCE public.ci_group_variables_id_seq OWNED BY public.ci_group_variables.id;
 
+CREATE TABLE public.ci_instance_variables (
+    id bigint NOT NULL,
+    variable_type smallint DEFAULT 1 NOT NULL,
+    masked boolean DEFAULT false,
+    protected boolean DEFAULT false,
+    key text NOT NULL,
+    encrypted_value text,
+    encrypted_value_iv text,
+    CONSTRAINT check_07a45a5bcb CHECK ((char_length(encrypted_value_iv) <= 255)),
+    CONSTRAINT check_5aede12208 CHECK ((char_length(key) <= 255)),
+    CONSTRAINT check_5ebd0515a0 CHECK ((char_length(encrypted_value) <= 1024))
+);
+
+CREATE SEQUENCE public.ci_instance_variables_id_seq
+    START WITH 1
+    INCREMENT BY 1
+    NO MINVALUE
+    NO MAXVALUE
+    CACHE 1;
+
+ALTER SEQUENCE public.ci_instance_variables_id_seq OWNED BY public.ci_instance_variables.id;
+
 CREATE TABLE public.ci_job_artifacts (
     id integer NOT NULL,
     project_id integer NOT NULL,
@@ -7227,6 +7249,8 @@ ALTER TABLE ONLY public.ci_daily_report_results ALTER COLUMN id SET DEFAULT next
 
 ALTER TABLE ONLY public.ci_group_variables ALTER COLUMN id SET DEFAULT nextval('public.ci_group_variables_id_seq'::regclass);
 
+ALTER TABLE ONLY public.ci_instance_variables ALTER COLUMN id SET DEFAULT nextval('public.ci_instance_variables_id_seq'::regclass);
+
 ALTER TABLE ONLY public.ci_job_artifacts ALTER COLUMN id SET DEFAULT nextval('public.ci_job_artifacts_id_seq'::regclass);
 
 ALTER TABLE ONLY public.ci_job_variables ALTER COLUMN id SET DEFAULT nextval('public.ci_job_variables_id_seq'::regclass);
@@ -7892,6 +7916,9 @@ ALTER TABLE ONLY public.ci_daily_report_results
 ALTER TABLE ONLY public.ci_group_variables
     ADD CONSTRAINT ci_group_variables_pkey PRIMARY KEY (id);
 
+ALTER TABLE ONLY public.ci_instance_variables
+    ADD CONSTRAINT ci_instance_variables_pkey PRIMARY KEY (id);
+
 ALTER TABLE ONLY public.ci_job_artifacts
     ADD CONSTRAINT ci_job_artifacts_pkey PRIMARY KEY (id);
 
@@ -9073,6 +9100,8 @@ CREATE INDEX index_ci_daily_report_results_on_last_pipeline_id ON public.ci_dail
 
 CREATE UNIQUE INDEX index_ci_group_variables_on_group_id_and_key ON public.ci_group_variables USING btree (group_id, key);
 
+CREATE UNIQUE INDEX index_ci_instance_variables_on_key ON public.ci_instance_variables USING btree (key);
+
 CREATE INDEX index_ci_job_artifacts_file_store_is_null ON public.ci_job_artifacts USING btree (id) WHERE (file_store IS NULL);
 
 CREATE INDEX index_ci_job_artifacts_on_expire_at_and_job_id ON public.ci_job_artifacts USING btree (expire_at, job_id);
@@ -13556,6 +13585,7 @@ COPY "schema_migrations" (version) FROM STDIN;
 20200420201933
 20200421092907
 20200421233150
+20200422091541
 20200422213749
 20200423075720
 20200423080334

spec/factories/ci/instance_variables.rb

+# frozen_string_literal: true
+
+FactoryBot.define do
+  factory :ci_instance_variable, class: 'Ci::InstanceVariable' do
+    sequence(:key) { |n| "VARIABLE_#{n}" }
+    value { 'VARIABLE_VALUE' }
+    masked { false }
+
+    trait(:protected) do
+      add_attribute(:protected) { true }
+    end
+  end
+end

spec/models/ci/instance_variable_spec.rb

+# frozen_string_literal: true
+
+require 'spec_helper'
+
+describe Ci::InstanceVariable do
+  subject { build(:ci_instance_variable) }
+
+  it_behaves_like "CI variable"
+
+  it { is_expected.to include_module(Ci::Maskable) }
+  it { is_expected.to validate_uniqueness_of(:key).with_message(/\(\w+\) has already been taken/) }
+
+  describe '.unprotected' do
+    subject { described_class.unprotected }
+
+    context 'when variable is protected' do
+      before do
+        create(:ci_instance_variable, :protected)
+      end
+
+      it 'returns nothing' do
+        is_expected.to be_empty
+      end
+    end
+
+    context 'when variable is not protected' do
+      let(:variable) { create(:ci_instance_variable, protected: false) }
+
+      it 'returns the variable' do
+        is_expected.to contain_exactly(variable)
+      end
+    end
+  end
+end