Send token in header to external validation service

Pass value from EXTERNAL_VALIDATION_SERVICE_TOKEN in `X-Gitlab-Token`
if present.

lib/gitlab/ci/pipeline/chain/validate/external.rb

@@ -69,8 +69,12 @@ module Gitlab
             end
 
             def validate_service_request
+              headers = {}
+              headers['X-Gitlab-Token'] = validation_service_token if validation_service_token
+
               Gitlab::HTTP.post(
                 validation_service_url, timeout: validation_service_timeout,
+                headers: headers,
                 body: validation_service_payload.to_json
               )
             end
@@ -86,6 +90,10 @@ module Gitlab
               ENV['EXTERNAL_VALIDATION_SERVICE_URL']
             end
 
+            def validation_service_token
+              ENV['EXTERNAL_VALIDATION_SERVICE_TOKEN']
+            end
+
             def validation_service_payload
               {
                 project: {

spec/lib/gitlab/ci/pipeline/chain/validate/external_spec.rb

@@ -63,6 +63,7 @@ RSpec.describe Gitlab::Ci::Pipeline::Chain::Validate::External do
       expect(::Gitlab::HTTP).to receive(:post) do |_url, params|
         expect(params[:body]).to match_schema('/external_validation')
         expect(params[:timeout]).to eq(described_class::DEFAULT_VALIDATION_REQUEST_TIMEOUT)
+        expect(params[:headers]).to eq({})
       end
 
       perform!
@@ -119,6 +120,20 @@ RSpec.describe Gitlab::Ci::Pipeline::Chain::Validate::External do
       end
     end
 
+    context 'when EXTERNAL_VALIDATION_SERVICE_TOKEN is set' do
+      before do
+        stub_env('EXTERNAL_VALIDATION_SERVICE_TOKEN', '123')
+      end
+
+      it 'passes token in X-Gitlab-Token header' do
+        expect(::Gitlab::HTTP).to receive(:post) do |_url, params|
+          expect(params[:headers]).to eq({ 'X-Gitlab-Token' => '123' })
+        end
+
+        perform!
+      end
+    end
+
     context 'when validation returns 200 OK' do
       before do
         stub_request(:post, validation_service_url).to_return(status: 200, body: "{}")