Add scope to variables to indicate environments

app/models/ee/project.rb

@@ -77,6 +77,10 @@ module EE
       end
     end
 
+    def secret_variables_for(ref)
+      super.where(scope: '*')
+    end
+
     private
 
     def licensed_feature_available?(feature)

db/migrate/20170612150426_add_scope_to_ci_variables.rb

+class AddScopeToCiVariables < ActiveRecord::Migration
+  include Gitlab::Database::MigrationHelpers
+
+  DOWNTIME = false
+
+  disable_ddl_transaction!
+
+  def up
+    add_column_with_default(:ci_variables, :scope, :string, default: '*')
+  end
+
+  def down
+    remove_column(:ci_variables, :scope)
+  end
+end

db/schema.rb

@@ -11,7 +11,7 @@
 #
 # It's strongly recommended that you check this file into your version control system.
 
-ActiveRecord::Schema.define(version: 20170603200744) do
+ActiveRecord::Schema.define(version: 20170612150426) do
 
   # These are extensions that must be enabled in order to support this database
   enable_extension "plpgsql"
@@ -440,6 +440,7 @@ ActiveRecord::Schema.define(version: 20170603200744) do
     t.string "encrypted_value_iv"
     t.integer "project_id", null: false
     t.boolean "protected", default: false, null: false
+    t.string "scope", default: "*", null: false
   end
 
   add_index "ci_variables", ["project_id"], name: "index_ci_variables_on_project_id", using: :btree