Ignore merge if the status of the merge request pipeline is stale

Merge request pipeline is meant for ensuring target branch's pipeline
green. We should not let maintainers merge a merge request if the head
pipeline of the merge request doesn't fulfill the criteria.

ee/app/models/ee/ci/pipeline.rb

@@ -173,6 +173,15 @@ module EE
         end
       end
 
+      ##
+      # Check if it's a merge request pipeline with the HEAD of source and target branches
+      # TODO: Make `Ci::Pipeline#latest?` compatible with merge request pipelines and remove this method.
+      def latest_merge_request_pipeline?
+        merge_request_pipeline? &&
+          source_sha == merge_request.diff_head_sha &&
+          target_sha == merge_request.target_branch_sha
+      end
+
       private
 
       def available_licensed_report_type?(file_type)

ee/app/models/ee/merge_request.rb

@@ -47,10 +47,23 @@ module EE
       super
     end
 
+    override :mergeable_ci_state?
+    def mergeable_ci_state?
+      return false unless validate_merge_request_pipelines
+
+      super
+    end
+
     def supports_weight?
       false
     end
 
+    def validate_merge_request_pipelines
+      return true unless project.merge_pipelines_enabled?
+
+      actual_head_pipeline&.latest_merge_request_pipeline?
+    end
+
     def validate_approvals_before_merge
       return true unless approvals_before_merge
       return true unless target_project

ee/changelogs/unreleased/ignore-merge-when-merge-pipelines-is-stale.yml

+---
+title: Prevent merge if the merge request pipeline is stale
+merge_request: 9643
+author:
+type: added

ee/spec/models/ci/pipeline_spec.rb

@@ -508,4 +508,36 @@ describe Ci::Pipeline do
       end
     end
   end
+
+  describe '#latest_merge_request_pipeline?' do
+    subject { pipeline.latest_merge_request_pipeline? }
+
+    let(:merge_request) { create(:merge_request, :with_merge_request_pipeline) }
+    let(:pipeline) { merge_request.all_pipelines.first }
+    let(:args) { {} }
+
+    it { is_expected.to be_truthy }
+
+    context 'when pipeline is not merge request pipeline' do
+      let(:pipeline) { build(:ci_pipeline) }
+
+      it { is_expected.to be_falsy }
+    end
+
+    context 'when source sha is outdated' do
+      before do
+        pipeline.source_sha = merge_request.diff_base_sha
+      end
+
+      it { is_expected.to be_falsy }
+    end
+
+    context 'when target sha is outdated' do
+      before do
+        pipeline.target_sha = 'old-sha'
+      end
+
+      it { is_expected.to be_falsy }
+    end
+  end
 end

ee/spec/models/merge_request_spec.rb

@@ -769,4 +769,62 @@ describe MergeRequest do
       end
     end
   end
+
+  describe '#mergeable_ci_state?' do
+    subject { merge_request.mergeable_ci_state? }
+
+    let(:project) { create(:project, :repository) }
+
+    let(:merge_request) do
+      create(:merge_request,
+        :with_merge_request_pipeline,
+        source_branch: 'feature',
+        source_project: project,
+        target_branch: 'master',
+        target_project: project)
+    end
+
+    shared_examples_for 'merge pipelines project option is disabled' do
+      before do
+        project.merge_pipelines_enabled = false
+      end
+
+      it { is_expected.to be_truthy }
+    end
+
+    before do
+      stub_licensed_features(merge_pipelines: true)
+      project.merge_pipelines_enabled = true
+      merge_request.update_head_pipeline
+    end
+
+    it { is_expected.to be_truthy }
+
+    context 'when head pipeline is a detached merge request pipeline' do
+      before do
+        merge_request.head_pipeline.update_column(:target_sha, nil)
+      end
+
+      it { is_expected.to be_falsy }
+      it_behaves_like 'merge pipelines project option is disabled'
+    end
+
+    context 'when source sha of the merge request pipeline is not HEAD' do
+      before do
+        merge_request.head_pipeline.update_column(:source_sha, 'old-commit')
+      end
+
+      it { is_expected.to be_falsy }
+      it_behaves_like 'merge pipelines project option is disabled'
+    end
+
+    context 'when target sha of the merge request pipeline is not HEAD' do
+      before do
+        merge_request.head_pipeline.update_column(:target_sha, 'old-commit')
+      end
+
+      it { is_expected.to be_falsy }
+      it_behaves_like 'merge pipelines project option is disabled'
+    end
+  end
 end