Move protected runner builds scoping to register job service

app/services/ci/register_job_service.rb

@@ -115,6 +115,10 @@ module Ci
         end
       end
 
+      if runner.ref_protected?
+        builds = queue.builds_for_protected_runner(builds)
+      end
+
       # pick builds that does not have other tags than runner's one
       builds = queue.builds_matching_tag_ids(builds, runner.tags.ids)
 

lib/gitlab/ci/queue/builder.rb

@@ -57,6 +57,10 @@ module Gitlab
           relation.queued_before(time)
         end
 
+        def builds_for_protected_runner(relation)
+          relation.ref_protected
+        end
+
         class BuildsTableStrategy
           attr_reader :runner, :common
 
@@ -104,13 +108,7 @@ module Gitlab
           end
 
           def new_builds
-            all_builds = ::Ci::Build.pending.unstarted
-
-            if runner.ref_protected?
-              all_builds.ref_protected
-            else
-              all_builds
-            end
+            ::Ci::Build.pending.unstarted
           end
 
           private
@@ -172,11 +170,7 @@ module Gitlab
           end
 
           def new_builds
-            if runner.ref_protected?
-              ::Ci::PendingBuild.ref_protected
-            else
-              ::Ci::PendingBuild.all
-            end
+            ::Ci::PendingBuild.all
           end
 
           private