Merge branch '31573-cross-project-pipeline-triggering-does-not-work-in-core' into 'master'

Allow cross-project pipeline triggering with CI_JOB_TOKEN in core

See merge request gitlab-org/gitlab!17251

app/controllers/projects/pipelines_controller.rb

@@ -184,7 +184,7 @@ class Projects::PipelinesController < Projects::ApplicationController
   end
 
   def show_represent_params
-    { grouped: true }
+    { grouped: true, expanded: params[:expanded].to_a.map(&:to_i) }
   end
 
   def create_params

app/models/ci/build.rb

@@ -42,6 +42,7 @@ module Ci
 
     has_many :job_artifacts, class_name: 'Ci::JobArtifact', foreign_key: :job_id, dependent: :destroy, inverse_of: :job # rubocop:disable Cop/ActiveRecordDependent
     has_many :job_variables, class_name: 'Ci::JobVariable', foreign_key: :job_id
+    has_many :sourced_pipelines, class_name: 'Ci::Sources::Pipeline', foreign_key: :source_job_id
 
     Ci::JobArtifact.file_types.each do |key, value|
       has_one :"job_artifacts_#{key}", -> { where(file_type: value) }, class_name: 'Ci::JobArtifact', inverse_of: :job, foreign_key: :job_id

app/models/ci/pipeline.rb

@@ -52,9 +52,15 @@ module Ci
 
     has_many :auto_canceled_pipelines, class_name: 'Ci::Pipeline', foreign_key: 'auto_canceled_by_id'
     has_many :auto_canceled_jobs, class_name: 'CommitStatus', foreign_key: 'auto_canceled_by_id'
+    has_many :sourced_pipelines, class_name: 'Ci::Sources::Pipeline', foreign_key: :source_pipeline_id
 
+    has_one :source_pipeline, class_name: 'Ci::Sources::Pipeline', inverse_of: :pipeline
     has_one :chat_data, class_name: 'Ci::PipelineChatData'
 
+    has_many :triggered_pipelines, through: :sourced_pipelines, source: :pipeline
+    has_one :triggered_by_pipeline, through: :source_pipeline, source: :source_pipeline
+    has_one :source_job, through: :source_pipeline, source: :source_job
+
     accepts_nested_attributes_for :variables, reject_if: :persisted?
 
     delegate :id, to: :project, prefix: true

app/models/ci/pipeline_enums.rb

@@ -22,6 +22,7 @@ module Ci
         schedule: 4,
         api: 5,
         external: 6,
+        pipeline: 7,
         chat: 8,
         merge_request_event: 10,
         external_pull_request_event: 11

ee/app/models/ci/sources/pipeline.rb → app/models/ci/sources/pipeline.rb

@@ -10,7 +10,6 @@ module Ci
 
       belongs_to :source_project, class_name: "Project", foreign_key: :source_project_id
       belongs_to :source_job, class_name: "CommitStatus", foreign_key: :source_job_id
-      belongs_to :source_bridge, class_name: "Ci::Bridge", foreign_key: :source_job_id
       belongs_to :source_pipeline, class_name: "Ci::Pipeline", foreign_key: :source_pipeline_id
 
       validates :project, presence: true
@@ -22,3 +21,5 @@ module Ci
     end
   end
 end
+
+::Ci::Sources::Pipeline.prepend_if_ee('::EE::Ci::Sources::Pipeline')

app/models/project.rb

@@ -297,6 +297,9 @@ class Project < ApplicationRecord
 
   has_many :external_pull_requests, inverse_of: :project
 
+  has_many :sourced_pipelines, class_name: 'Ci::Sources::Pipeline', foreign_key: :source_project_id
+  has_many :source_pipelines, class_name: 'Ci::Sources::Pipeline', foreign_key: :project_id
+
   has_one :pages_metadatum, class_name: 'ProjectPagesMetadatum', inverse_of: :project
 
   accepts_nested_attributes_for :variables, allow_destroy: true

app/serializers/pipeline_details_entity.rb

@@ -10,6 +10,7 @@ class PipelineDetailsEntity < PipelineEntity
     expose :manual_actions, using: BuildActionEntity
     expose :scheduled_actions, using: BuildActionEntity
   end
-end
 
-PipelineDetailsEntity.prepend_if_ee('EE::PipelineDetailsEntity')
+  expose :triggered_by_pipeline, as: :triggered_by, with: TriggeredPipelineEntity
+  expose :triggered_pipelines, as: :triggered, using: TriggeredPipelineEntity
+end

app/serializers/pipeline_serializer.rb

@@ -54,9 +54,9 @@ class PipelineSerializer < BaseSerializer
         artifacts: {
           project: [:route, { namespace: :route }]
         }
-      }
+      },
+      { triggered_by_pipeline: [:project, :user] },
+      { triggered_pipelines: [:project, :user] }
     ]
   end
 end
-
-PipelineSerializer.prepend_if_ee('EE::PipelineSerializer')

app/services/ci/pipeline_trigger_service.rb

@@ -38,11 +38,34 @@ module Ci
     end
 
     def create_pipeline_from_job(job)
-      # overridden in EE
+      # this check is to not leak the presence of the project if user cannot read it
+      return unless can?(job.user, :read_project, project)
+
+      return error("400 Job has to be running", 400) unless job.running?
+
+      pipeline = Ci::CreatePipelineService.new(project, job.user, ref: params[:ref])
+        .execute(:pipeline, ignore_skip_ci: true) do |pipeline|
+          source = job.sourced_pipelines.build(
+            source_pipeline: job.pipeline,
+            source_project: job.project,
+            pipeline: pipeline,
+            project: project)
+
+          pipeline.source_pipeline = source
+          pipeline.variables.build(variables)
+        end
+
+      if pipeline.persisted?
+        success(pipeline: pipeline)
+      else
+        error(pipeline.errors.messages, 400)
+      end
     end
 
     def job_from_token
-      # overridden in EE
+      strong_memoize(:job) do
+        Ci::Build.find_by_token(params[:token].to_s)
+      end
     end
 
     def variables
@@ -52,5 +75,3 @@ module Ci
     end
   end
 end
-
-Ci::PipelineTriggerService.prepend_if_ee('EE::Ci::PipelineTriggerService')

changelogs/unreleased/31573-cross-project-pipeline-triggering-does-not-work-in-core.yml

+---
+title: Allow cross-project pipeline triggering with CI_JOB_TOKEN in core
+merge_request: 17251
+author:
+type: added

ee/app/controllers/ee/projects/pipelines_controller.rb

@@ -41,11 +41,6 @@ module EE
           end
         end
       end
-
-      override :show_represent_params
-      def show_represent_params
-        super.merge(expanded: params[:expanded].to_a.map(&:to_i))
-      end
     end
   end
 end

ee/app/models/ee/ci/build.rb

@@ -21,10 +21,6 @@ module EE
 
         after_save :stick_build_if_status_changed
         delegate :service_specification, to: :runner_session, allow_nil: true
-
-        has_many :sourced_pipelines,
-          class_name: "::Ci::Sources::Pipeline",
-          foreign_key: :source_job_id
       end
 
       def shared_runners_minutes_limit_enabled?

ee/app/models/ee/ci/pipeline.rb

@@ -19,19 +19,13 @@ module EE
         has_many :vulnerabilities_occurrence_pipelines, class_name: 'Vulnerabilities::OccurrencePipeline'
         has_many :vulnerability_findings, source: :occurrence, through: :vulnerabilities_occurrence_pipelines, class_name: 'Vulnerabilities::Occurrence'
 
-        has_one :source_pipeline, class_name: "::Ci::Sources::Pipeline", inverse_of: :pipeline
-        has_many :sourced_pipelines, class_name: "::Ci::Sources::Pipeline", foreign_key: :source_pipeline_id
-
-        has_one :triggered_by_pipeline, through: :source_pipeline, source: :source_pipeline
-        has_one :source_job, through: :source_pipeline, source: :source_job
-        has_one :source_bridge, through: :source_pipeline, source: :source_bridge
-        has_many :triggered_pipelines, through: :sourced_pipelines, source: :pipeline
-
         has_many :auto_canceled_pipelines, class_name: 'Ci::Pipeline', foreign_key: 'auto_canceled_by_id'
         has_many :auto_canceled_jobs, class_name: 'CommitStatus', foreign_key: 'auto_canceled_by_id'
 
         has_many :downstream_bridges, class_name: '::Ci::Bridge', foreign_key: :upstream_pipeline_id
 
+        has_one :source_bridge, through: :source_pipeline, source: :source_bridge
+
         # Legacy way to fetch security reports based on job name. This has been replaced by the reports feature.
         scope :with_legacy_security_reports, -> do
           joins(:artifacts).where(ci_builds: { name: %w[sast dependency_scanning sast:container container_scanning dast] })

ee/app/models/ee/ci/pipeline_enums.rb

@@ -19,7 +19,7 @@ module EE
 
         override :sources
         def sources
-          super.merge(pipeline: 7, webide: 9)
+          super.merge(webide: 9)
         end
 
         override :config_sources

ee/app/models/ee/ci/sources/pipeline.rb

+# frozen_string_literal: true
+
+module EE
+  module Ci
+    module Sources
+      module Pipeline
+        extend ActiveSupport::Concern
+
+        prepended do
+          belongs_to :source_bridge,
+            class_name: "Ci::Bridge",
+            foreign_key: :source_job_id
+        end
+      end
+    end
+  end
+end

ee/app/models/ee/project.rb

@@ -77,10 +77,6 @@ module EE
       has_many :package_files, through: :packages, class_name: 'Packages::PackageFile'
       has_many :merge_trains, foreign_key: 'target_project_id', inverse_of: :target_project
 
-      has_many :sourced_pipelines, class_name: 'Ci::Sources::Pipeline', foreign_key: :source_project_id
-
-      has_many :source_pipelines, class_name: 'Ci::Sources::Pipeline', foreign_key: :project_id
-
       has_many :webide_pipelines, -> { webide_source }, class_name: 'Ci::Pipeline', inverse_of: :project
 
       has_many :prometheus_alerts, inverse_of: :project

ee/app/serializers/ee/pipeline_details_entity.rb

-# frozen_string_literal: true
-
-module EE
-  module PipelineDetailsEntity
-    extend ActiveSupport::Concern
-
-    prepended do
-      expose :triggered_by_pipeline, as: :triggered_by, with: TriggeredPipelineEntity
-      expose :triggered_pipelines, as: :triggered, using: TriggeredPipelineEntity
-    end
-  end
-end

ee/app/serializers/ee/pipeline_serializer.rb

-# frozen_string_literal: true
-
-module EE
-  module PipelineSerializer
-    extend ActiveSupport::Concern
-    extend ::Gitlab::Utils::Override
-
-    private
-
-    override :preloaded_relations
-    def preloaded_relations
-      super.concat([
-        { triggered_by_pipeline: [:project, :user] },
-        { triggered_pipelines: [:project, :user] }
-      ])
-    end
-  end
-end

ee/app/services/ee/ci/pipeline_trigger_service.rb

-# frozen_string_literal: true
-
-module EE
-  module Ci
-    module PipelineTriggerService
-      extend ::Gitlab::Utils::Override
-      include ::Gitlab::Utils::StrongMemoize
-
-      private
-
-      override :create_pipeline_from_job
-      def create_pipeline_from_job(job)
-        # this check is to not leak the presence of the project if user cannot read it
-        return unless can?(job.user, :read_project, project)
-
-        return error("400 Job has to be running", 400) unless job.running?
-
-        pipeline = ::Ci::CreatePipelineService.new(project, job.user, ref: params[:ref])
-          .execute(:pipeline, ignore_skip_ci: true) do |pipeline|
-            source = job.sourced_pipelines.build(
-              source_pipeline: job.pipeline,
-              source_project: job.project,
-              pipeline: pipeline,
-              project: project)
-
-            pipeline.source_pipeline = source
-            pipeline.variables.build(variables)
-          end
-
-        if pipeline.persisted?
-          success(pipeline: pipeline)
-        else
-          error(pipeline.errors.messages, 400)
-        end
-      end
-
-      override :job_from_token
-      def job_from_token
-        strong_memoize(:job) do
-          ::Ci::Build.find_by_token(params[:token].to_s)
-        end
-      end
-    end
-  end
-end

ee/spec/controllers/projects/pipelines_controller_spec.rb

@@ -3,9 +3,9 @@
 require 'spec_helper'
 
 describe Projects::PipelinesController do
-  set(:user) { create(:user) }
-  set(:project) { create(:project, :repository) }
-  set(:pipeline) { create(:ci_pipeline, project: project, ref: 'master', sha: project.commit.id) }
+  let_it_be(:user) { create(:user) }
+  let_it_be(:project) { create(:project, :repository) }
+  let_it_be(:pipeline) { create(:ci_pipeline, project: project, ref: 'master', sha: project.commit.id) }
 
   before do
     project.add_developer(user)
@@ -13,191 +13,6 @@ describe Projects::PipelinesController do
     sign_in(user)
   end
 
-  describe 'GET show.json' do
-    set(:source_project) { create(:project) }
-    set(:target_project) { create(:project) }
-    set(:root_pipeline) { create_pipeline(project) }
-    set(:source_pipeline) { create_pipeline(source_project) }
-    set(:source_of_source_pipeline) { create_pipeline(source_project) }
-    set(:target_pipeline) { create_pipeline(target_project) }
-    set(:target_of_target_pipeline) { create_pipeline(target_project) }
-    before do
-      create_link(source_of_source_pipeline, source_pipeline)
-      create_link(source_pipeline, root_pipeline)
-      create_link(root_pipeline, target_pipeline)
-      create_link(target_pipeline, target_of_target_pipeline)
-    end
-
-    shared_examples 'not expanded' do
-      let(:expected_stages) { be_nil }
-
-      it 'does return base details' do
-        get_pipeline_json(root_pipeline)
-
-        expect(json_response['triggered_by']).to include('id' => source_pipeline.id)
-        expect(json_response['triggered']).to contain_exactly(
-          include('id' => target_pipeline.id))
-      end
-
-      it 'does not expand triggered_by pipeline' do
-        get_pipeline_json(root_pipeline)
-
-        triggered_by = json_response['triggered_by']
-        expect(triggered_by['triggered_by']).to be_nil
-        expect(triggered_by['triggered']).to be_nil
-        expect(triggered_by['details']['stages']).to expected_stages
-      end
-
-      it 'does not expand triggered pipelines' do
-        get_pipeline_json(root_pipeline)
-
-        first_triggered = json_response['triggered'].first
-        expect(first_triggered['triggered_by']).to be_nil
-        expect(first_triggered['triggered']).to be_nil
-        expect(first_triggered['details']['stages']).to expected_stages
-      end
-    end
-
-    shared_examples 'expanded' do
-      it 'does return base details' do
-        get_pipeline_json(root_pipeline)
-
-        expect(json_response['triggered_by']).to include('id' => source_pipeline.id)
-        expect(json_response['triggered']).to contain_exactly(
-          include('id' => target_pipeline.id))
-      end
-
-      it 'does expand triggered_by pipeline' do
-        get_pipeline_json(root_pipeline)
-
-        triggered_by = json_response['triggered_by']
-        expect(triggered_by['triggered_by']).to include(
-          'id' => source_of_source_pipeline.id)
-        expect(triggered_by['details']['stages']).not_to be_nil
-      end
-
-      it 'does not recursively expand triggered_by' do
-        get_pipeline_json(root_pipeline)
-
-        triggered_by = json_response['triggered_by']
-        expect(triggered_by['triggered']).to be_nil
-      end
-
-      it 'does expand triggered pipelines' do
-        get_pipeline_json(root_pipeline)
-
-        first_triggered = json_response['triggered'].first
-        expect(first_triggered['triggered']).to contain_exactly(
-          include('id' => target_of_target_pipeline.id))
-        expect(first_triggered['details']['stages']).not_to be_nil
-      end
-
-      it 'does not recursively expand triggered' do
-        get_pipeline_json(root_pipeline)
-
-        first_triggered = json_response['triggered'].first
-        expect(first_triggered['triggered_by']).to be_nil
-      end
-    end
-
-    context 'when it does have permission to read other projects' do
-      before do
-        source_project.add_developer(user)
-        target_project.add_developer(user)
-      end
-
-      context 'when not-expanding any pipelines' do
-        let(:expanded) { nil }
-
-        it_behaves_like 'not expanded'
-      end
-
-      context 'when expanding non-existing pipeline' do
-        let(:expanded) { [-1] }
-
-        it_behaves_like 'not expanded'
-      end
-
-      context 'when expanding pipeline that is not directly expandable' do
-        let(:expanded) { [source_of_source_pipeline.id, target_of_target_pipeline.id] }
-
-        it_behaves_like 'not expanded'
-      end
-
-      context 'when expanding self' do
-        let(:expanded) { [root_pipeline.id] }
-
-        context 'it does not recursively expand pipelines' do
-          it_behaves_like 'not expanded'
-        end
-      end
-
-      context 'when expanding source and target pipeline' do
-        let(:expanded) { [source_pipeline.id, target_pipeline.id] }
-
-        it_behaves_like 'expanded'
-
-        context 'when expand depth is limited to 1' do
-          before do
-            stub_const('TriggeredPipelineEntity::MAX_EXPAND_DEPTH', 1)
-          end
-
-          it_behaves_like 'not expanded' do
-            # We expect that triggered/triggered_by is not expanded,
-            # but we still return details.stages for that pipeline
-            let(:expected_stages) { be_a(Array) }
-          end
-        end
-      end
-
-      context 'when expanding all' do
-        let(:expanded) do
-          [
-            source_of_source_pipeline.id,
-            source_pipeline.id,
-            root_pipeline.id,
-            target_pipeline.id,
-            target_of_target_pipeline.id
-          ]
-        end
-
-        it_behaves_like 'expanded'
-      end
-    end
-
-    context 'when does not have permission to read other projects' do
-      let(:expanded) { [source_pipeline.id, target_pipeline.id] }
-
-      it_behaves_like 'not expanded'
-    end
-
-    def create_pipeline(project)
-      create(:ci_empty_pipeline, project: project).tap do |pipeline|
-        create(:ci_build, pipeline: pipeline, stage: 'test', name: 'rspec')
-      end
-    end
-
-    def create_link(source_pipeline, pipeline)
-      source_pipeline.sourced_pipelines.create!(
-        source_job: source_pipeline.builds.all.sample,
-        source_project: source_pipeline.project,
-        project: pipeline.project,
-        pipeline: pipeline
-      )
-    end
-
-    def get_pipeline_json(pipeline)
-      params = {
-        namespace_id: pipeline.project.namespace,
-        project_id: pipeline.project,
-        id: pipeline,
-        expanded: expanded
-      }
-
-      get :show, params: params.compact, format: :json
-    end
-  end
-
   describe 'GET security' do
     context 'with a sast artifact' do
       before do

ee/spec/models/ci/build_spec.rb

@@ -15,8 +15,6 @@ describe Ci::Build do
 
   let(:job) { create(:ci_build, pipeline: pipeline) }
 
-  it { is_expected.to have_many(:sourced_pipelines) }
-
   describe '#shared_runners_minutes_limit_enabled?' do
     subject { job.shared_runners_minutes_limit_enabled? }
 

ee/spec/models/ci/pipeline_spec.rb

@@ -10,10 +10,6 @@ describe Ci::Pipeline do
     create(:ci_empty_pipeline, status: :created, project: project)
   end
 
-  it { is_expected.to have_one(:source_pipeline) }
-  it { is_expected.to have_many(:sourced_pipelines) }
-  it { is_expected.to have_one(:triggered_by_pipeline) }
-  it { is_expected.to have_many(:triggered_pipelines) }
   it { is_expected.to have_many(:downstream_bridges) }
   it { is_expected.to have_many(:job_artifacts).through(:builds) }
   it { is_expected.to have_many(:vulnerability_findings).through(:vulnerabilities_occurrence_pipelines).class_name('Vulnerabilities::Occurrence') }

ee/spec/models/ci/sources/pipeline_spec.rb

@@ -3,17 +3,5 @@
 require 'spec_helper'
 
 describe Ci::Sources::Pipeline do
-  it { is_expected.to belong_to(:project) }
-  it { is_expected.to belong_to(:pipeline) }
-
-  it { is_expected.to belong_to(:source_project) }
-  it { is_expected.to belong_to(:source_job) }
-  it { is_expected.to belong_to(:source_pipeline) }
-
-  it { is_expected.to validate_presence_of(:project) }
-  it { is_expected.to validate_presence_of(:pipeline) }
-
-  it { is_expected.to validate_presence_of(:source_project) }
-  it { is_expected.to validate_presence_of(:source_job) }
-  it { is_expected.to validate_presence_of(:source_pipeline) }
+  it { is_expected.to belong_to(:source_bridge) }
 end

ee/spec/models/project_spec.rb

@@ -29,8 +29,6 @@ describe Project do
     it { is_expected.to have_many(:reviews).inverse_of(:project) }
     it { is_expected.to have_many(:path_locks) }
     it { is_expected.to have_many(:vulnerability_feedback) }
-    it { is_expected.to have_many(:sourced_pipelines) }
-    it { is_expected.to have_many(:source_pipelines) }
     it { is_expected.to have_many(:audit_events).dependent(false) }
     it { is_expected.to have_many(:protected_environments) }
     it { is_expected.to have_many(:approvers).dependent(:destroy) }

ee/spec/serializers/pipeline_details_entity_spec.rb

-# frozen_string_literal: true
-
-require 'spec_helper'
-
-describe PipelineDetailsEntity do
-  let(:user) { create(:user) }
-  let(:request) { double('request') }
-
-  before do
-    stub_not_protect_default_branch
-
-    allow(request).to receive(:current_user).and_return(user)
-  end
-
-  let(:entity) do
-    described_class.represent(pipeline, request: request)
-  end
-
-  describe '#as_json' do
-    subject { entity.as_json }
-
-    context 'when pipeline is triggered by other pipeline' do
-      let(:pipeline) { create(:ci_empty_pipeline) }
-
-      before do
-        create(:ci_sources_pipeline, pipeline: pipeline)
-      end
-
-      it 'contains an information about depedent pipeline' do
-        expect(subject[:triggered_by]).to be_a(Hash)
-        expect(subject[:triggered_by][:path]).not_to be_nil
-        expect(subject[:triggered_by][:details]).not_to be_nil
-        expect(subject[:triggered_by][:details][:status]).not_to be_nil
-        expect(subject[:triggered_by][:project]).not_to be_nil
-      end
-    end
-
-    context 'when pipeline triggered other pipeline' do
-      let(:pipeline) { create(:ci_empty_pipeline) }
-      let(:build) { create(:ci_build, pipeline: pipeline) }
-
-      before do
-        create(:ci_sources_pipeline, source_job: build)
-        create(:ci_sources_pipeline, source_job: build)
-      end
-
-      it 'contains an information about depedent pipeline' do
-        expect(subject[:triggered]).to be_a(Array)
-        expect(subject[:triggered].length).to eq(2)
-        expect(subject[:triggered].first[:path]).not_to be_nil
-        expect(subject[:triggered].first[:details]).not_to be_nil
-        expect(subject[:triggered].first[:details][:status]).not_to be_nil
-        expect(subject[:triggered].first[:project]).not_to be_nil
-      end
-    end
-  end
-end

ee/spec/services/ci/pipeline_trigger_service_spec.rb

-# frozen_string_literal: true
-
-require 'spec_helper'
-
-describe Ci::PipelineTriggerService do
-  let(:project) { create(:project, :repository) }
-
-  before do
-    stub_ci_pipeline_to_return_yaml_file
-  end
-
-  describe '#execute' do
-    let(:user) { create(:user) }
-    let!(:pipeline) { create(:ci_empty_pipeline, project: project) }
-    let(:job) { create(:ci_build, :running, pipeline: pipeline, user: user) }
-    let(:result) { described_class.new(project, user, params).execute }
-
-    before do
-      project.add_developer(user)
-    end
-
-    context 'when job user does not have a permission to read a project' do
-      let(:params) { { token: job.token, ref: 'master', variables: nil } }
-      let(:job) { create(:ci_build, pipeline: pipeline, user: create(:user)) }
-
-      it 'does nothing' do
-        expect { result }.not_to change { Ci::Pipeline.count }
-      end
-    end
-
-    context 'when job is not running' do
-      let(:params) { { token: job.token, ref: 'master', variables: nil } }
-      let(:job) { create(:ci_build, :success, pipeline: pipeline, user: user) }
-
-      it 'does nothing' do
-        expect { result }.not_to change { Ci::Pipeline.count }
-        expect(result[:message]).to eq('400 Job has to be running')
-      end
-    end
-
-    context 'when params have an existsed job token' do
-      context 'when params have an existsed ref' do
-        let(:params) { { token: job.token, ref: 'master', variables: nil } }
-
-        it 'triggers a pipeline' do
-          expect { result }.to change { Ci::Pipeline.count }.by(1)
-          expect(result[:pipeline].ref).to eq('master')
-          expect(result[:pipeline].project).to eq(project)
-          expect(result[:pipeline].user).to eq(job.user)
-          expect(result[:status]).to eq(:success)
-        end
-
-        context 'when commit message has [ci skip]' do
-          before do
-            allow_any_instance_of(Ci::Pipeline).to receive(:git_commit_message) { '[ci skip]' }
-          end
-
-          it 'ignores [ci skip] and create as general' do
-            expect { result }.to change { Ci::Pipeline.count }.by(1)
-            expect(result[:status]).to eq(:success)
-          end
-        end
-
-        context 'when params have a variable' do
-          let(:params) { { token: job.token, ref: 'master', variables: variables } }
-          let(:variables) { { 'AAA' => 'AAA123' } }
-
-          it 'has a variable' do
-            expect { result }.to change { Ci::PipelineVariable.count }.by(1)
-                             .and change { Ci::Sources::Pipeline.count }.by(1)
-            expect(result[:pipeline].variables.map { |v| { v.key => v.value } }.first).to eq(variables)
-            expect(job.sourced_pipelines.last.pipeline_id).to eq(result[:pipeline].id)
-          end
-        end
-      end
-
-      context 'when params have a non-existsed ref' do
-        let(:params) { { token: job.token, ref: 'invalid-ref', variables: nil } }
-
-        it 'does not job a pipeline' do
-          expect { result }.not_to change { Ci::Pipeline.count }
-          expect(result[:http_status]).to eq(400)
-        end
-      end
-    end
-
-    context 'when params have a non-existsed trigger token' do
-      let(:params) { { token: 'invalid-token', ref: nil, variables: nil } }
-
-      it 'does not trigger a pipeline' do
-        expect { result }.not_to change { Ci::Pipeline.count }
-        expect(result).to be_nil
-      end
-    end
-  end
-end

spec/controllers/projects/pipelines_controller_spec.rb

@@ -217,6 +217,193 @@ describe Projects::PipelinesController do
       end
     end
 
+    context 'with triggered pipelines' do
+      let_it_be(:project) { create(:project, :repository) }
+      let_it_be(:source_project) { create(:project, :repository) }
+      let_it_be(:target_project) { create(:project, :repository) }
+      let_it_be(:root_pipeline) { create_pipeline(project) }
+      let_it_be(:source_pipeline) { create_pipeline(source_project) }
+      let_it_be(:source_of_source_pipeline) { create_pipeline(source_project) }
+      let_it_be(:target_pipeline) { create_pipeline(target_project) }
+      let_it_be(:target_of_target_pipeline) { create_pipeline(target_project) }
+
+      before do
+        create_link(source_of_source_pipeline, source_pipeline)
+        create_link(source_pipeline, root_pipeline)
+        create_link(root_pipeline, target_pipeline)
+        create_link(target_pipeline, target_of_target_pipeline)
+      end
+
+      shared_examples 'not expanded' do
+        let(:expected_stages) { be_nil }
+
+        it 'does return base details' do
+          get_pipeline_json(root_pipeline)
+
+          expect(json_response['triggered_by']).to include('id' => source_pipeline.id)
+          expect(json_response['triggered']).to contain_exactly(
+            include('id' => target_pipeline.id))
+        end
+
+        it 'does not expand triggered_by pipeline' do
+          get_pipeline_json(root_pipeline)
+
+          triggered_by = json_response['triggered_by']
+          expect(triggered_by['triggered_by']).to be_nil
+          expect(triggered_by['triggered']).to be_nil
+          expect(triggered_by['details']['stages']).to expected_stages
+        end
+
+        it 'does not expand triggered pipelines' do
+          get_pipeline_json(root_pipeline)
+
+          first_triggered = json_response['triggered'].first
+          expect(first_triggered['triggered_by']).to be_nil
+          expect(first_triggered['triggered']).to be_nil
+          expect(first_triggered['details']['stages']).to expected_stages
+        end
+      end
+
+      shared_examples 'expanded' do
+        it 'does return base details' do
+          get_pipeline_json(root_pipeline)
+
+          expect(json_response['triggered_by']).to include('id' => source_pipeline.id)
+          expect(json_response['triggered']).to contain_exactly(
+            include('id' => target_pipeline.id))
+        end
+
+        it 'does expand triggered_by pipeline' do
+          get_pipeline_json(root_pipeline)
+
+          triggered_by = json_response['triggered_by']
+          expect(triggered_by['triggered_by']).to include(
+            'id' => source_of_source_pipeline.id)
+          expect(triggered_by['details']['stages']).not_to be_nil
+        end
+
+        it 'does not recursively expand triggered_by' do
+          get_pipeline_json(root_pipeline)
+
+          triggered_by = json_response['triggered_by']
+          expect(triggered_by['triggered']).to be_nil
+        end
+
+        it 'does expand triggered pipelines' do
+          get_pipeline_json(root_pipeline)
+
+          first_triggered = json_response['triggered'].first
+          expect(first_triggered['triggered']).to contain_exactly(
+            include('id' => target_of_target_pipeline.id))
+          expect(first_triggered['details']['stages']).not_to be_nil
+        end
+
+        it 'does not recursively expand triggered' do
+          get_pipeline_json(root_pipeline)
+
+          first_triggered = json_response['triggered'].first
+          expect(first_triggered['triggered_by']).to be_nil
+        end
+      end
+
+      context 'when it does have permission to read other projects' do
+        before do
+          source_project.add_developer(user)
+          target_project.add_developer(user)
+        end
+
+        context 'when not-expanding any pipelines' do
+          let(:expanded) { nil }
+
+          it_behaves_like 'not expanded'
+        end
+
+        context 'when expanding non-existing pipeline' do
+          let(:expanded) { [-1] }
+
+          it_behaves_like 'not expanded'
+        end
+
+        context 'when expanding pipeline that is not directly expandable' do
+          let(:expanded) { [source_of_source_pipeline.id, target_of_target_pipeline.id] }
+
+          it_behaves_like 'not expanded'
+        end
+
+        context 'when expanding self' do
+          let(:expanded) { [root_pipeline.id] }
+
+          context 'it does not recursively expand pipelines' do
+            it_behaves_like 'not expanded'
+          end
+        end
+
+        context 'when expanding source and target pipeline' do
+          let(:expanded) { [source_pipeline.id, target_pipeline.id] }
+
+          it_behaves_like 'expanded'
+
+          context 'when expand depth is limited to 1' do
+            before do
+              stub_const('TriggeredPipelineEntity::MAX_EXPAND_DEPTH', 1)
+            end
+
+            it_behaves_like 'not expanded' do
+              # We expect that triggered/triggered_by is not expanded,
+              # but we still return details.stages for that pipeline
+              let(:expected_stages) { be_a(Array) }
+            end
+          end
+        end
+
+        context 'when expanding all' do
+          let(:expanded) do
+            [
+              source_of_source_pipeline.id,
+              source_pipeline.id,
+              root_pipeline.id,
+              target_pipeline.id,
+              target_of_target_pipeline.id
+            ]
+          end
+
+          it_behaves_like 'expanded'
+        end
+      end
+
+      context 'when does not have permission to read other projects' do
+        let(:expanded) { [source_pipeline.id, target_pipeline.id] }
+
+        it_behaves_like 'not expanded'
+      end
+
+      def create_pipeline(project)
+        create(:ci_empty_pipeline, project: project).tap do |pipeline|
+          create(:ci_build, pipeline: pipeline, stage: 'test', name: 'rspec')
+        end
+      end
+
+      def create_link(source_pipeline, pipeline)
+        source_pipeline.sourced_pipelines.create!(
+          source_job: source_pipeline.builds.all.sample,
+          source_project: source_pipeline.project,
+          project: pipeline.project,
+          pipeline: pipeline
+        )
+      end
+
+      def get_pipeline_json(pipeline)
+        params = {
+          namespace_id: pipeline.project.namespace,
+          project_id: pipeline.project,
+          id: pipeline,
+          expanded: expanded
+        }
+
+        get :show, params: params.compact, format: :json
+      end
+    end
+
     def get_pipeline_json
       get :show, params: { namespace_id: project.namespace, project_id: project, id: pipeline }, format: :json
     end

spec/models/ci/build_spec.rb

@@ -19,17 +19,24 @@ describe Ci::Build do
   it { is_expected.to belong_to(:runner) }
   it { is_expected.to belong_to(:trigger_request) }
   it { is_expected.to belong_to(:erased_by) }
+
   it { is_expected.to have_many(:trace_sections) }
   it { is_expected.to have_many(:needs) }
+  it { is_expected.to have_many(:sourced_pipelines) }
+  it { is_expected.to have_many(:job_variables) }
+
   it { is_expected.to have_one(:deployment) }
   it { is_expected.to have_one(:runner_session) }
-  it { is_expected.to have_many(:job_variables) }
+
   it { is_expected.to validate_presence_of(:ref) }
+
   it { is_expected.to respond_to(:has_trace?) }
   it { is_expected.to respond_to(:trace) }
+
   it { is_expected.to delegate_method(:merge_request_event?).to(:pipeline) }
   it { is_expected.to delegate_method(:merge_request_ref?).to(:pipeline) }
   it { is_expected.to delegate_method(:legacy_detached_merge_request_pipeline?).to(:pipeline) }
+
   it { is_expected.to include_module(Ci::PipelineDelegator) }
 
   describe 'associations' do

spec/models/ci/pipeline_spec.rb

@@ -28,7 +28,13 @@ describe Ci::Pipeline, :mailer do
   it { is_expected.to have_many(:builds) }
   it { is_expected.to have_many(:auto_canceled_pipelines) }
   it { is_expected.to have_many(:auto_canceled_jobs) }
+  it { is_expected.to have_many(:sourced_pipelines) }
+  it { is_expected.to have_many(:triggered_pipelines) }
+
   it { is_expected.to have_one(:chat_data) }
+  it { is_expected.to have_one(:source_pipeline) }
+  it { is_expected.to have_one(:triggered_by_pipeline) }
+  it { is_expected.to have_one(:source_job) }
 
   it { is_expected.to validate_presence_of(:sha) }
   it { is_expected.to validate_presence_of(:status) }

spec/models/ci/sources/pipeline_spec.rb

+# frozen_string_literal: true
+
+require 'spec_helper'
+
+describe Ci::Sources::Pipeline do
+  it { is_expected.to belong_to(:project) }
+  it { is_expected.to belong_to(:pipeline) }
+
+  it { is_expected.to belong_to(:source_project) }
+  it { is_expected.to belong_to(:source_job) }
+  it { is_expected.to belong_to(:source_pipeline) }
+
+  it { is_expected.to validate_presence_of(:project) }
+  it { is_expected.to validate_presence_of(:pipeline) }
+
+  it { is_expected.to validate_presence_of(:source_project) }
+  it { is_expected.to validate_presence_of(:source_job) }
+  it { is_expected.to validate_presence_of(:source_pipeline) }
+end

spec/models/project_spec.rb

@@ -101,6 +101,8 @@ describe Project do
     it { is_expected.to have_many(:deploy_tokens).through(:project_deploy_tokens) }
     it { is_expected.to have_many(:cycle_analytics_stages) }
     it { is_expected.to have_many(:external_pull_requests) }
+    it { is_expected.to have_many(:sourced_pipelines) }
+    it { is_expected.to have_many(:source_pipelines) }
 
     it 'has an inverse relationship with merge requests' do
       expect(described_class.reflect_on_association(:merge_requests).has_inverse?).to eq(:target_project)

spec/serializers/pipeline_details_entity_spec.rb

@@ -138,5 +138,40 @@ describe PipelineDetailsEntity do
         expect(subject[:flags][:yaml_errors]).to be false
       end
     end
+
+    context 'when pipeline is triggered by other pipeline' do
+      let(:pipeline) { create(:ci_empty_pipeline) }
+
+      before do
+        create(:ci_sources_pipeline, pipeline: pipeline)
+      end
+
+      it 'contains an information about depedent pipeline' do
+        expect(subject[:triggered_by]).to be_a(Hash)
+        expect(subject[:triggered_by][:path]).not_to be_nil
+        expect(subject[:triggered_by][:details]).not_to be_nil
+        expect(subject[:triggered_by][:details][:status]).not_to be_nil
+        expect(subject[:triggered_by][:project]).not_to be_nil
+      end
+    end
+
+    context 'when pipeline triggered other pipeline' do
+      let(:pipeline) { create(:ci_empty_pipeline) }
+      let(:build) { create(:ci_build, pipeline: pipeline) }
+
+      before do
+        create(:ci_sources_pipeline, source_job: build)
+        create(:ci_sources_pipeline, source_job: build)
+      end
+
+      it 'contains an information about depedent pipeline' do
+        expect(subject[:triggered]).to be_a(Array)
+        expect(subject[:triggered].length).to eq(2)
+        expect(subject[:triggered].first[:path]).not_to be_nil
+        expect(subject[:triggered].first[:details]).not_to be_nil
+        expect(subject[:triggered].first[:details][:status]).not_to be_nil
+        expect(subject[:triggered].first[:project]).not_to be_nil
+      end
+    end
   end
 end

spec/serializers/pipeline_serializer_spec.rb

@@ -158,7 +158,7 @@ describe PipelineSerializer do
 
         it 'verifies number of queries', :request_store do
           recorded = ActiveRecord::QueryRecorder.new { subject }
-          expected_queries = Gitlab.ee? ? 38 : 31
+          expected_queries = Gitlab.ee? ? 38 : 35
 
           expect(recorded.count).to be_within(2).of(expected_queries)
           expect(recorded.cached_count).to eq(0)
@@ -179,7 +179,8 @@ describe PipelineSerializer do
           # pipeline. With the same ref this check is cached but if refs are
           # different then there is an extra query per ref
           # https://gitlab.com/gitlab-org/gitlab-foss/issues/46368
-          expected_queries = Gitlab.ee? ? 44 : 38
+          expected_queries = Gitlab.ee? ? 44 : 41
+
           expect(recorded.count).to be_within(2).of(expected_queries)
           expect(recorded.cached_count).to eq(0)
         end

spec/services/ci/pipeline_trigger_service_spec.rb

@@ -11,76 +11,158 @@ describe Ci::PipelineTriggerService do
 
   describe '#execute' do
     let(:user) { create(:user) }
-    let(:trigger) { create(:ci_trigger, project: project, owner: user) }
     let(:result) { described_class.new(project, user, params).execute }
 
     before do
       project.add_developer(user)
     end
 
-    context 'when trigger belongs to a different project' do
-      let(:params) { { token: trigger.token, ref: 'master', variables: nil } }
-      let(:trigger) { create(:ci_trigger, project: create(:project), owner: user) }
+    context 'with a trigger token' do
+      let(:trigger) { create(:ci_trigger, project: project, owner: user) }
 
-      it 'does nothing' do
-        expect { result }.not_to change { Ci::Pipeline.count }
-      end
-    end
-
-    context 'when params have an existsed trigger token' do
-      context 'when params have an existsed ref' do
+      context 'when trigger belongs to a different project' do
         let(:params) { { token: trigger.token, ref: 'master', variables: nil } }
+        let(:trigger) { create(:ci_trigger, project: create(:project), owner: user) }
 
-        it 'triggers a pipeline' do
-          expect { result }.to change { Ci::Pipeline.count }.by(1)
-          expect(result[:pipeline].ref).to eq('master')
-          expect(result[:pipeline].project).to eq(project)
-          expect(result[:pipeline].user).to eq(trigger.owner)
-          expect(result[:pipeline].trigger_requests.to_a)
-            .to eq(result[:pipeline].builds.map(&:trigger_request).uniq)
-          expect(result[:status]).to eq(:success)
+        it 'does nothing' do
+          expect { result }.not_to change { Ci::Pipeline.count }
         end
+      end
 
-        context 'when commit message has [ci skip]' do
-          before do
-            allow_any_instance_of(Ci::Pipeline).to receive(:git_commit_message) { '[ci skip]' }
-          end
+      context 'when params have an existsed trigger token' do
+        context 'when params have an existsed ref' do
+          let(:params) { { token: trigger.token, ref: 'master', variables: nil } }
 
-          it 'ignores [ci skip] and create as general' do
+          it 'triggers a pipeline' do
             expect { result }.to change { Ci::Pipeline.count }.by(1)
+            expect(result[:pipeline].ref).to eq('master')
+            expect(result[:pipeline].project).to eq(project)
+            expect(result[:pipeline].user).to eq(trigger.owner)
+            expect(result[:pipeline].trigger_requests.to_a)
+              .to eq(result[:pipeline].builds.map(&:trigger_request).uniq)
             expect(result[:status]).to eq(:success)
           end
+
+          context 'when commit message has [ci skip]' do
+            before do
+              allow_any_instance_of(Ci::Pipeline).to receive(:git_commit_message) { '[ci skip]' }
+            end
+
+            it 'ignores [ci skip] and create as general' do
+              expect { result }.to change { Ci::Pipeline.count }.by(1)
+              expect(result[:status]).to eq(:success)
+            end
+          end
+
+          context 'when params have a variable' do
+            let(:params) { { token: trigger.token, ref: 'master', variables: variables } }
+            let(:variables) { { 'AAA' => 'AAA123' } }
+
+            it 'has a variable' do
+              expect { result }.to change { Ci::PipelineVariable.count }.by(1)
+                               .and change { Ci::TriggerRequest.count }.by(1)
+              expect(result[:pipeline].variables.map { |v| { v.key => v.value } }.first).to eq(variables)
+              expect(result[:pipeline].trigger_requests.last.variables).to be_nil
+            end
+          end
         end
 
-        context 'when params have a variable' do
-          let(:params) { { token: trigger.token, ref: 'master', variables: variables } }
-          let(:variables) { { 'AAA' => 'AAA123' } }
+        context 'when params have a non-existsed ref' do
+          let(:params) { { token: trigger.token, ref: 'invalid-ref', variables: nil } }
 
-          it 'has a variable' do
-            expect { result }.to change { Ci::PipelineVariable.count }.by(1)
-                             .and change { Ci::TriggerRequest.count }.by(1)
-            expect(result[:pipeline].variables.map { |v| { v.key => v.value } }.first).to eq(variables)
-            expect(result[:pipeline].trigger_requests.last.variables).to be_nil
+          it 'does not trigger a pipeline' do
+            expect { result }.not_to change { Ci::Pipeline.count }
+            expect(result[:http_status]).to eq(400)
           end
         end
       end
 
-      context 'when params have a non-existsed ref' do
-        let(:params) { { token: trigger.token, ref: 'invalid-ref', variables: nil } }
+      context 'when params have a non-existsed trigger token' do
+        let(:params) { { token: 'invalid-token', ref: nil, variables: nil } }
 
         it 'does not trigger a pipeline' do
           expect { result }.not_to change { Ci::Pipeline.count }
-          expect(result[:http_status]).to eq(400)
+          expect(result).to be_nil
         end
       end
     end
 
-    context 'when params have a non-existsed trigger token' do
-      let(:params) { { token: 'invalid-token', ref: nil, variables: nil } }
+    context 'with a pipeline job token' do
+      let!(:pipeline) { create(:ci_empty_pipeline, project: project) }
+      let(:job) { create(:ci_build, :running, pipeline: pipeline, user: user) }
+
+      context 'when job user does not have a permission to read a project' do
+        let(:params) { { token: job.token, ref: 'master', variables: nil } }
+        let(:job) { create(:ci_build, pipeline: pipeline, user: create(:user)) }
+
+        it 'does nothing' do
+          expect { result }.not_to change { Ci::Pipeline.count }
+        end
+      end
+
+      context 'when job is not running' do
+        let(:params) { { token: job.token, ref: 'master', variables: nil } }
+        let(:job) { create(:ci_build, :success, pipeline: pipeline, user: user) }
+
+        it 'does nothing' do
+          expect { result }.not_to change { Ci::Pipeline.count }
+          expect(result[:message]).to eq('400 Job has to be running')
+        end
+      end
 
-      it 'does not trigger a pipeline' do
-        expect { result }.not_to change { Ci::Pipeline.count }
-        expect(result).to be_nil
+      context 'when params have an existsed job token' do
+        context 'when params have an existsed ref' do
+          let(:params) { { token: job.token, ref: 'master', variables: nil } }
+
+          it 'triggers a pipeline' do
+            expect { result }.to change { Ci::Pipeline.count }.by(1)
+            expect(result[:pipeline].ref).to eq('master')
+            expect(result[:pipeline].project).to eq(project)
+            expect(result[:pipeline].user).to eq(job.user)
+            expect(result[:status]).to eq(:success)
+          end
+
+          context 'when commit message has [ci skip]' do
+            before do
+              allow_any_instance_of(Ci::Pipeline).to receive(:git_commit_message) { '[ci skip]' }
+            end
+
+            it 'ignores [ci skip] and create as general' do
+              expect { result }.to change { Ci::Pipeline.count }.by(1)
+              expect(result[:status]).to eq(:success)
+            end
+          end
+
+          context 'when params have a variable' do
+            let(:params) { { token: job.token, ref: 'master', variables: variables } }
+            let(:variables) { { 'AAA' => 'AAA123' } }
+
+            it 'has a variable' do
+              expect { result }.to change { Ci::PipelineVariable.count }.by(1)
+                               .and change { Ci::Sources::Pipeline.count }.by(1)
+              expect(result[:pipeline].variables.map { |v| { v.key => v.value } }.first).to eq(variables)
+              expect(job.sourced_pipelines.last.pipeline_id).to eq(result[:pipeline].id)
+            end
+          end
+        end
+
+        context 'when params have a non-existsed ref' do
+          let(:params) { { token: job.token, ref: 'invalid-ref', variables: nil } }
+
+          it 'does not job a pipeline' do
+            expect { result }.not_to change { Ci::Pipeline.count }
+            expect(result[:http_status]).to eq(400)
+          end
+        end
+      end
+
+      context 'when params have a non-existsed trigger token' do
+        let(:params) { { token: 'invalid-token', ref: nil, variables: nil } }
+
+        it 'does not trigger a pipeline' do
+          expect { result }.not_to change { Ci::Pipeline.count }
+          expect(result).to be_nil
+        end
       end
     end
   end