Prevent compliance pipelines from overwriting child pipelines

Prevents a compliance configuration from replacing a child pipeline
by not injecting the compliance configuration if downstream of
a bridge pipeline.

Changelog: fixed
EE: true

ee/lib/gitlab/ci/pipeline/chain/config/content/compliance.rb

@@ -11,6 +11,7 @@ module Gitlab
                 strong_memoize(:content) do
                   next unless available?
                   next unless pipeline_configuration_full_path.present?
+                  next if command.bridge
 
                   path_file, path_project = pipeline_configuration_full_path.split('@', 2)
                   YAML.dump('include' => [{ 'project' => path_project, 'file' => path_file }])

ee/spec/lib/gitlab/ci/pipeline/chain/config/content_spec.rb

@@ -57,6 +57,12 @@ RSpec.describe ::Gitlab::Ci::Pipeline::Chain::Config::Content do
           expect(pipeline.pipeline_config.content).to eq(content_result)
           expect(command.config_content).to eq(content_result)
         end
+
+        context 'when pipeline is downstream of a bridge' do
+          let(:command) { Gitlab::Ci::Pipeline::Chain::Command.new(project: project, content: content, source: source, bridge: create(:ci_bridge)) }
+
+          it_behaves_like 'does not include compliance pipeline configuration content'
+        end
       end
 
       context 'when compliance pipeline configuration is not defined' do