From 6385b49572542066d3eb5c197ba0208bfa3158fb Mon Sep 17 00:00:00 2001
From: Kamil Trzcinski <ayufan@ayufan.eu>
Date: Fri, 14 Oct 2016 18:24:15 +0200
Subject: [PATCH 1/5] Forbid repository access when in lock

---
 app/models/ci/pipeline.rb                   | 18 ++++++++++--------
 app/models/repository.rb                    | 10 ++++++++++
 app/services/ci/process_pipeline_service.rb | 18 ++++++++++--------
 app/services/ci/register_build_service.rb   | 10 ++++++----
 4 files changed, 36 insertions(+), 20 deletions(-)

diff --git a/app/models/ci/pipeline.rb b/app/models/ci/pipeline.rb
index e75fe6c222bf..348ac5774fed 100644
--- a/app/models/ci/pipeline.rb
+++ b/app/models/ci/pipeline.rb
@@ -263,14 +263,16 @@ def process!
     end
 
     def update_status
-      with_lock do
-        case latest_builds_status
-        when 'pending' then enqueue
-        when 'running' then run
-        when 'success' then succeed
-        when 'failed' then drop
-        when 'canceled' then cancel
-        when 'skipped' then skip
+      Repository.with_forbidden_access do
+        with_lock do
+            case latest_builds_status
+            when 'pending' then enqueue
+            when 'running' then run
+            when 'success' then succeed
+            when 'failed' then drop
+            when 'canceled' then cancel
+            when 'skipped' then skip
+            end
         end
       end
     end
diff --git a/app/models/repository.rb b/app/models/repository.rb
index 72e473871fab..c4bd6d303dca 100644
--- a/app/models/repository.rb
+++ b/app/models/repository.rb
@@ -11,6 +11,14 @@ class CommitError < StandardError; end
 
   attr_accessor :path_with_namespace, :project
 
+  def self.with_forbidden_access
+    @@forbidden_access ||= 0
+    @@forbidden_access += 1
+    yield
+  rescue
+    @@forbidden_access -= 1
+  end
+
   def initialize(path_with_namespace, project)
     @path_with_namespace = path_with_namespace
     @project = project
@@ -19,6 +27,8 @@ def initialize(path_with_namespace, project)
   def raw_repository
     return nil unless path_with_namespace
 
+    raise 'Repository access is forbidden' if @@forbidden_access
+
     @raw_repository ||= Gitlab::Git::Repository.new(path_to_repo)
   end
 
diff --git a/app/services/ci/process_pipeline_service.rb b/app/services/ci/process_pipeline_service.rb
index d3dd30b2588f..69c2c53a4bc3 100644
--- a/app/services/ci/process_pipeline_service.rb
+++ b/app/services/ci/process_pipeline_service.rb
@@ -10,16 +10,18 @@ def execute(pipeline)
         create_builds!
       end
 
-      @pipeline.with_lock do
-        new_builds =
-          stage_indexes_of_created_builds.map do |index|
-            process_stage(index)
-          end
+      Repository.with_forbidden_access do
+        @pipeline.with_lock do
+          new_builds =
+            stage_indexes_of_created_builds.map do |index|
+              process_stage(index)
+            end
 
-        @pipeline.update_status
+          @pipeline.update_status
 
-        # Return a flag if a when builds got enqueued
-        new_builds.flatten.any?
+          # Return a flag if a when builds got enqueued
+          new_builds.flatten.any?
+        end
       end
     end
 
diff --git a/app/services/ci/register_build_service.rb b/app/services/ci/register_build_service.rb
index 6973191b2030..5ec9c3951915 100644
--- a/app/services/ci/register_build_service.rb
+++ b/app/services/ci/register_build_service.rb
@@ -29,10 +29,12 @@ def execute(current_runner)
       if build
         # In case when 2 runners try to assign the same build, second runner will be declined
         # with StateMachines::InvalidTransition in run! method.
-        build.with_lock do
-          build.runner_id = current_runner.id
-          build.save!
-          build.run!
+        Repository.with_forbidden_access do
+          build.with_lock do
+            build.runner_id = current_runner.id
+            build.save!
+            build.run!
+          end
         end
       end
 
-- 
GitLab


From d6a87e24a5170dffe224d2938709ebadd1875bcc Mon Sep 17 00:00:00 2001
From: Kamil Trzcinski <ayufan@ayufan.eu>
Date: Wed, 19 Oct 2016 11:12:41 +0200
Subject: [PATCH 2/5] Fix implementation of Repository.with_forbidden_access

---
 app/models/repository.rb | 10 +++++-----
 1 file changed, 5 insertions(+), 5 deletions(-)

diff --git a/app/models/repository.rb b/app/models/repository.rb
index c4bd6d303dca..f9ba28c1d4dd 100644
--- a/app/models/repository.rb
+++ b/app/models/repository.rb
@@ -12,11 +12,11 @@ class CommitError < StandardError; end
   attr_accessor :path_with_namespace, :project
 
   def self.with_forbidden_access
-    @@forbidden_access ||= 0
-    @@forbidden_access += 1
+    Thread.current[:repository_forbidden_access] ||= 0
+    Thread.current[:repository_forbidden_access] += 1
     yield
-  rescue
-    @@forbidden_access -= 1
+  ensure
+    Thread.current[:repository_forbidden_access] -= 1
   end
 
   def initialize(path_with_namespace, project)
@@ -27,7 +27,7 @@ def initialize(path_with_namespace, project)
   def raw_repository
     return nil unless path_with_namespace
 
-    raise 'Repository access is forbidden' if @@forbidden_access
+    raise 'Repository access is forbidden' if Thread.current[:repository_forbidden_access].to_i > 0
 
     @raw_repository ||= Gitlab::Git::Repository.new(path_to_repo)
   end
-- 
GitLab


From c5f5e25af2230a20a19b7024e868ece7bb5e5105 Mon Sep 17 00:00:00 2001
From: Kamil Trzcinski <ayufan@ayufan.eu>
Date: Wed, 19 Oct 2016 11:13:10 +0200
Subject: [PATCH 3/5] Create keep_around_commits after creating object, because
 object doesn't change afterwards

---
 app/models/ci/pipeline.rb       | 2 +-
 app/models/deployment.rb        | 2 +-
 app/models/note.rb              | 2 +-
 app/models/sent_notification.rb | 2 +-
 app/models/todo.rb              | 2 +-
 5 files changed, 5 insertions(+), 5 deletions(-)

diff --git a/app/models/ci/pipeline.rb b/app/models/ci/pipeline.rb
index 348ac5774fed..89a0c46b4e7d 100644
--- a/app/models/ci/pipeline.rb
+++ b/app/models/ci/pipeline.rb
@@ -19,7 +19,7 @@ class Pipeline < ActiveRecord::Base
     validates_presence_of :status, unless: :importing?
     validate :valid_commit_sha, unless: :importing?
 
-    after_save :keep_around_commits, unless: :importing?
+    after_create :keep_around_commits, unless: :importing?
 
     delegate :stages, to: :statuses
 
diff --git a/app/models/deployment.rb b/app/models/deployment.rb
index 3d9902d496e8..f0577724d6c5 100644
--- a/app/models/deployment.rb
+++ b/app/models/deployment.rb
@@ -11,7 +11,7 @@ class Deployment < ActiveRecord::Base
 
   delegate :name, to: :environment, prefix: true
 
-  after_save :create_ref
+  after_create :create_ref
 
   def commit
     project.commit(sha)
diff --git a/app/models/note.rb b/app/models/note.rb
index 2d644b03e4db..a25e3d270bf5 100644
--- a/app/models/note.rb
+++ b/app/models/note.rb
@@ -79,7 +79,7 @@ class Note < ActiveRecord::Base
   after_initialize :ensure_discussion_id
   before_validation :nullify_blank_type, :nullify_blank_line_code
   before_validation :set_discussion_id
-  after_save :keep_around_commit
+  after_create :keep_around_commit
 
   class << self
     def model_name
diff --git a/app/models/sent_notification.rb b/app/models/sent_notification.rb
index f4bcb49b34d5..f28de9067eb0 100644
--- a/app/models/sent_notification.rb
+++ b/app/models/sent_notification.rb
@@ -11,7 +11,7 @@ class SentNotification < ActiveRecord::Base
   validates :commit_id, presence: true, if: :for_commit?
   validate :note_valid
 
-  after_save :keep_around_commit
+  after_create :keep_around_commit
 
   class << self
     def reply_key
diff --git a/app/models/todo.rb b/app/models/todo.rb
index 6ae9956ade5f..9f2559a02b22 100644
--- a/app/models/todo.rb
+++ b/app/models/todo.rb
@@ -41,7 +41,7 @@ class Todo < ActiveRecord::Base
     state :done
   end
 
-  after_save :keep_around_commit
+  after_create :keep_around_commit
 
   class << self
     def sort(method)
-- 
GitLab


From ee890c26552fbeabbd9ffeb55a4bc6e8b007f7bf Mon Sep 17 00:00:00 2001
From: Kamil Trzcinski <ayufan@ayufan.eu>
Date: Wed, 19 Oct 2016 11:46:06 +0200
Subject: [PATCH 4/5] Fix after code review

---
 app/models/ci/pipeline.rb | 16 ++++++++--------
 app/models/repository.rb  |  7 ++++++-
 2 files changed, 14 insertions(+), 9 deletions(-)

diff --git a/app/models/ci/pipeline.rb b/app/models/ci/pipeline.rb
index 89a0c46b4e7d..c0b92cf356a3 100644
--- a/app/models/ci/pipeline.rb
+++ b/app/models/ci/pipeline.rb
@@ -265,14 +265,14 @@ def process!
     def update_status
       Repository.with_forbidden_access do
         with_lock do
-            case latest_builds_status
-            when 'pending' then enqueue
-            when 'running' then run
-            when 'success' then succeed
-            when 'failed' then drop
-            when 'canceled' then cancel
-            when 'skipped' then skip
-            end
+          case latest_builds_status
+          when 'pending' then enqueue
+          when 'running' then run
+          when 'success' then succeed
+          when 'failed' then drop
+          when 'canceled' then cancel
+          when 'skipped' then skip
+          end
         end
       end
     end
diff --git a/app/models/repository.rb b/app/models/repository.rb
index f9ba28c1d4dd..b6cd925e8789 100644
--- a/app/models/repository.rb
+++ b/app/models/repository.rb
@@ -2,6 +2,7 @@
 
 class Repository
   class CommitError < StandardError; end
+  class AccessForbiddenError < StandardError; end
 
   # Files to use as a project avatar in case no avatar was uploaded via the web
   # UI.
@@ -19,6 +20,10 @@ def self.with_forbidden_access
     Thread.current[:repository_forbidden_access] -= 1
   end
 
+  def self.is_access_forbidden?
+    Thread.current[:repository_forbidden_access].to_i > 0
+  end
+
   def initialize(path_with_namespace, project)
     @path_with_namespace = path_with_namespace
     @project = project
@@ -27,7 +32,7 @@ def initialize(path_with_namespace, project)
   def raw_repository
     return nil unless path_with_namespace
 
-    raise 'Repository access is forbidden' if Thread.current[:repository_forbidden_access].to_i > 0
+    raise AccessForbiddenError.new('Repository access is forbidden') if Repository.is_access_forbidden?
 
     @raw_repository ||= Gitlab::Git::Repository.new(path_to_repo)
   end
-- 
GitLab


From af7860521f7d776e879f2cc0925937b3c7681805 Mon Sep 17 00:00:00 2001
From: Kamil Trzcinski <ayufan@ayufan.eu>
Date: Wed, 19 Oct 2016 13:51:35 +0200
Subject: [PATCH 5/5] Fix all specs

---
 features/steps/shared/builds.rb                      |  2 ++
 spec/features/commits_spec.rb                        |  4 ++++
 .../merge_requests/merge_when_build_succeeds_spec.rb |  5 ++++-
 spec/features/projects/badges/coverage_spec.rb       |  4 ++++
 spec/features/projects/builds_spec.rb                |  1 +
 spec/features/projects/pipelines_spec.rb             |  1 +
 spec/lib/gitlab/badge/build/status_spec.rb           |  4 ++++
 spec/lib/gitlab/badge/coverage/report_spec.rb        |  4 ++++
 spec/mailers/emails/builds_spec.rb                   |  4 ++++
 spec/models/build_spec.rb                            |  4 ++++
 spec/models/ci/pipeline_spec.rb                      |  8 ++++++++
 spec/models/project_services/hipchat_service_spec.rb |  2 ++
 spec/requests/api/builds_spec.rb                     |  4 ++++
 spec/requests/api/commit_statuses_spec.rb            |  4 ++++
 spec/requests/api/pipelines_spec.rb                  |  4 ++++
 spec/requests/api/triggers_spec.rb                   |  4 ++++
 spec/requests/ci/api/builds_spec.rb                  |  4 ++++
 spec/requests/ci/api/triggers_spec.rb                |  4 ++++
 spec/services/ci/create_pipeline_service_spec.rb     |  1 +
 .../ci/create_trigger_request_service_spec.rb        |  1 +
 spec/services/ci/image_for_build_service_spec.rb     |  4 ++++
 spec/services/ci/process_pipeline_service_spec.rb    |  1 +
 spec/services/ci/register_build_service_spec.rb      |  1 +
 spec/services/create_deployment_service_spec.rb      |  4 ++++
 .../merge_when_build_succeeds_service_spec.rb        |  6 ++++--
 spec/support/stub_gitlab_calls.rb                    | 12 ++++++++++++
 spec/views/projects/builds/show.html.haml_spec.rb    |  2 ++
 spec/workers/build_email_worker_spec.rb              |  1 +
 spec/workers/post_receive_spec.rb                    |  1 +
 spec/workers/stuck_ci_builds_worker_spec.rb          |  4 ++++
 30 files changed, 102 insertions(+), 3 deletions(-)

diff --git a/features/steps/shared/builds.rb b/features/steps/shared/builds.rb
index 70e6d4836b24..13bf18a8b01f 100644
--- a/features/steps/shared/builds.rb
+++ b/features/steps/shared/builds.rb
@@ -15,10 +15,12 @@ module SharedBuilds
   end
 
   step 'recent build is successful' do
+    allow(PipelineHooksWorker).to receive(:perform_async).and_return(true)
     @build.success
   end
 
   step 'recent build failed' do
+    allow(PipelineHooksWorker).to receive(:perform_async).and_return(true)
     @build.drop
   end
 
diff --git a/spec/features/commits_spec.rb b/spec/features/commits_spec.rb
index 5910803df51f..4ee62aa7703c 100644
--- a/spec/features/commits_spec.rb
+++ b/spec/features/commits_spec.rb
@@ -42,6 +42,10 @@
       let!(:build) { FactoryGirl.create :ci_build, pipeline: pipeline }
       let(:artifacts_file) { fixture_file_upload(Rails.root + 'spec/fixtures/banana_sample.gif', 'image/gif') }
 
+      before do
+        stub_ci_pipeline_hooks
+      end
+
       context 'when logged as developer' do
         before do
           project.team << [@user, :developer]
diff --git a/spec/features/merge_requests/merge_when_build_succeeds_spec.rb b/spec/features/merge_requests/merge_when_build_succeeds_spec.rb
index bc2b0ff3e2c8..0a18bb04a4e6 100644
--- a/spec/features/merge_requests/merge_when_build_succeeds_spec.rb
+++ b/spec/features/merge_requests/merge_when_build_succeeds_spec.rb
@@ -84,7 +84,10 @@
     end
 
     context 'when build succeeds' do
-      background { build.success }
+      background do
+        stub_repository_forbidden_access
+        build.success
+      end
 
       it 'merges merge request' do
         visit_merge_request(merge_request) # refresh the page
diff --git a/spec/features/projects/badges/coverage_spec.rb b/spec/features/projects/badges/coverage_spec.rb
index 01a95bf49acb..c9e73d9359db 100644
--- a/spec/features/projects/badges/coverage_spec.rb
+++ b/spec/features/projects/badges/coverage_spec.rb
@@ -4,6 +4,10 @@
   given!(:user) { create(:user) }
   given!(:project) { create(:project, :private) }
 
+  before do
+    stub_ci_pipeline_hooks
+  end
+
   context 'when user has access to view badge' do
     background do
       project.team << [user, :developer]
diff --git a/spec/features/projects/builds_spec.rb b/spec/features/projects/builds_spec.rb
index d1685f95503c..596ef3852a34 100644
--- a/spec/features/projects/builds_spec.rb
+++ b/spec/features/projects/builds_spec.rb
@@ -5,6 +5,7 @@
   let(:artifacts_file) { fixture_file_upload(Rails.root + 'spec/fixtures/banana_sample.gif', 'image/gif') }
 
   before do
+    stub_ci_pipeline_hooks
     login_as(:user)
     @commit = FactoryGirl.create :ci_pipeline
     @build = FactoryGirl.create :ci_build, :trace, pipeline: @commit
diff --git a/spec/features/projects/pipelines_spec.rb b/spec/features/projects/pipelines_spec.rb
index db56a50e0584..6c0bfb87950a 100644
--- a/spec/features/projects/pipelines_spec.rb
+++ b/spec/features/projects/pipelines_spec.rb
@@ -9,6 +9,7 @@
   before do
     login_as(user)
     project.team << [user, :developer]
+    stub_ci_pipeline_hooks
   end
 
   describe 'GET /:project/pipelines' do
diff --git a/spec/lib/gitlab/badge/build/status_spec.rb b/spec/lib/gitlab/badge/build/status_spec.rb
index 38eebb2a1769..d2294fb0632d 100644
--- a/spec/lib/gitlab/badge/build/status_spec.rb
+++ b/spec/lib/gitlab/badge/build/status_spec.rb
@@ -6,6 +6,10 @@
   let(:branch) { 'master' }
   let(:badge) { described_class.new(project, branch) }
 
+  before do
+    stub_ci_pipeline_hooks
+  end
+
   describe '#entity' do
     it 'always says build' do
       expect(badge.entity).to eq 'build'
diff --git a/spec/lib/gitlab/badge/coverage/report_spec.rb b/spec/lib/gitlab/badge/coverage/report_spec.rb
index 1547bd3228c0..52bf0b1c02ff 100644
--- a/spec/lib/gitlab/badge/coverage/report_spec.rb
+++ b/spec/lib/gitlab/badge/coverage/report_spec.rb
@@ -8,6 +8,10 @@
     described_class.new(project, 'master', job_name)
   end
 
+  before do
+    stub_ci_pipeline_hooks
+  end
+
   describe '#entity' do
     it 'describes a coverage' do
       expect(badge.entity).to eq 'coverage'
diff --git a/spec/mailers/emails/builds_spec.rb b/spec/mailers/emails/builds_spec.rb
index 0df89938e971..27bafc055089 100644
--- a/spec/mailers/emails/builds_spec.rb
+++ b/spec/mailers/emails/builds_spec.rb
@@ -7,6 +7,10 @@
 
   include_context 'gitlab email notification'
 
+  before do
+    stub_ci_pipeline_hooks
+  end
+
   describe 'build notification email' do
     let(:build) { create(:ci_build) }
     let(:project) { build.project }
diff --git a/spec/models/build_spec.rb b/spec/models/build_spec.rb
index ae185de9ca37..138cd7c5aa46 100644
--- a/spec/models/build_spec.rb
+++ b/spec/models/build_spec.rb
@@ -16,6 +16,10 @@
 
   it { is_expected.to respond_to :trace_html }
 
+  before do
+    stub_ci_pipeline_hooks
+  end
+
   describe '#first_pending' do
     let!(:first) { create(:ci_build, pipeline: pipeline, status: 'pending', created_at: Date.yesterday) }
     let!(:second) { create(:ci_build, pipeline: pipeline, status: 'pending') }
diff --git a/spec/models/ci/pipeline_spec.rb b/spec/models/ci/pipeline_spec.rb
index 43397c5ae39a..1364db42d9fc 100644
--- a/spec/models/ci/pipeline_spec.rb
+++ b/spec/models/ci/pipeline_spec.rb
@@ -20,6 +20,10 @@
 
   it { is_expected.to delegate_method(:stages).to(:statuses) }
 
+  before do
+    stub_ci_pipeline_hooks
+  end
+
   describe '#valid_commit_sha' do
     context 'commit.sha can not start with 00000000' do
       before do
@@ -425,6 +429,10 @@ def create_build(name, queued_at = current, started_from = 0)
 
       before do
         WebMock.stub_request(:post, hook.url)
+
+        stub_repository_forbidden_access
+
+        allow(PipelineHooksWorker).to receive(:perform_async).and_call_original
       end
 
       context 'with multiple builds' do
diff --git a/spec/models/project_services/hipchat_service_spec.rb b/spec/models/project_services/hipchat_service_spec.rb
index 26dd95bdfec6..15c8ca3e5563 100644
--- a/spec/models/project_services/hipchat_service_spec.rb
+++ b/spec/models/project_services/hipchat_service_spec.rb
@@ -41,6 +41,8 @@
         token: token
       )
       WebMock.stub_request(:post, api_url)
+
+      stub_repository_forbidden_access
     end
 
     it 'tests and return errors' do
diff --git a/spec/requests/api/builds_spec.rb b/spec/requests/api/builds_spec.rb
index 95c7bbf99c93..d1a86ac5a95e 100644
--- a/spec/requests/api/builds_spec.rb
+++ b/spec/requests/api/builds_spec.rb
@@ -12,6 +12,10 @@
   let!(:pipeline) { create(:ci_empty_pipeline, project: project, sha: project.commit.id, ref: project.default_branch) }
   let!(:build) { create(:ci_build, pipeline: pipeline) }
 
+  before do
+    stub_ci_pipeline_hooks
+  end
+
   describe 'GET /projects/:id/builds ' do
     let(:query) { '' }
 
diff --git a/spec/requests/api/commit_statuses_spec.rb b/spec/requests/api/commit_statuses_spec.rb
index 7aa7e85a9e27..fe5007215a11 100644
--- a/spec/requests/api/commit_statuses_spec.rb
+++ b/spec/requests/api/commit_statuses_spec.rb
@@ -11,6 +11,10 @@
   let(:developer) { create_user(:developer) }
   let(:sha) { commit.id }
 
+  before do
+    stub_ci_pipeline_hooks
+  end
+
   describe "GET /projects/:id/repository/commits/:sha/statuses" do
     let(:get_url) { "/projects/#{project.id}/repository/commits/#{sha}/statuses" }
 
diff --git a/spec/requests/api/pipelines_spec.rb b/spec/requests/api/pipelines_spec.rb
index 7011bdc9ec00..bb62b96952f9 100644
--- a/spec/requests/api/pipelines_spec.rb
+++ b/spec/requests/api/pipelines_spec.rb
@@ -108,6 +108,10 @@
 
     let!(:build) { create(:ci_build, :running, pipeline: pipeline) }
 
+    before do
+      stub_ci_pipeline_hooks
+    end
+
     context 'authorized user' do
       it 'retries failed builds' do
         post api("/projects/#{project.id}/pipelines/#{pipeline.id}/cancel", user)
diff --git a/spec/requests/api/triggers_spec.rb b/spec/requests/api/triggers_spec.rb
index 82bba1ce8a40..a9fc8148e9b7 100644
--- a/spec/requests/api/triggers_spec.rb
+++ b/spec/requests/api/triggers_spec.rb
@@ -14,6 +14,10 @@
   let!(:trigger2) { create(:ci_trigger, project: project, token: trigger_token_2) }
   let!(:trigger_request) { create(:ci_trigger_request, trigger: trigger, created_at: '2015-01-01 12:13:14') }
 
+  before do
+    stub_ci_pipeline_hooks
+  end
+
   describe 'POST /projects/:project_id/trigger' do
     let!(:project2) { create(:empty_project) }
     let(:options) do
diff --git a/spec/requests/ci/api/builds_spec.rb b/spec/requests/ci/api/builds_spec.rb
index 7b7d62feb2c8..0344549072bd 100644
--- a/spec/requests/ci/api/builds_spec.rb
+++ b/spec/requests/ci/api/builds_spec.rb
@@ -6,6 +6,10 @@
   let(:runner) { FactoryGirl.create(:ci_runner, tag_list: ["mysql", "ruby"]) }
   let(:project) { FactoryGirl.create(:empty_project) }
 
+  before do
+    stub_ci_pipeline_hooks
+  end
+
   describe "Builds API for runners" do
     let(:pipeline) { create(:ci_pipeline_without_jobs, project: project, ref: 'master') }
 
diff --git a/spec/requests/ci/api/triggers_spec.rb b/spec/requests/ci/api/triggers_spec.rb
index 0a0f979f57d6..374313ba2be5 100644
--- a/spec/requests/ci/api/triggers_spec.rb
+++ b/spec/requests/ci/api/triggers_spec.rb
@@ -38,6 +38,10 @@
     context 'Have a commit' do
       let(:pipeline) { project.pipelines.last }
 
+      before do
+        stub_ci_pipeline_hooks
+      end
+
       it 'creates builds' do
         post ci_api("/projects/#{project.ci_id}/refs/master/trigger"), options
         expect(response).to have_http_status(201)
diff --git a/spec/services/ci/create_pipeline_service_spec.rb b/spec/services/ci/create_pipeline_service_spec.rb
index 4aadd009f3ec..59ea0517b5a1 100644
--- a/spec/services/ci/create_pipeline_service_spec.rb
+++ b/spec/services/ci/create_pipeline_service_spec.rb
@@ -6,6 +6,7 @@
 
   before do
     stub_ci_pipeline_to_return_yaml_file
+    stub_ci_pipeline_hooks
   end
 
   describe '#execute' do
diff --git a/spec/services/ci/create_trigger_request_service_spec.rb b/spec/services/ci/create_trigger_request_service_spec.rb
index d8c443d29d56..60657ee5cda2 100644
--- a/spec/services/ci/create_trigger_request_service_spec.rb
+++ b/spec/services/ci/create_trigger_request_service_spec.rb
@@ -7,6 +7,7 @@
 
   before do
     stub_ci_pipeline_to_return_yaml_file
+    stub_ci_pipeline_hooks
   end
 
   describe '#execute' do
diff --git a/spec/services/ci/image_for_build_service_spec.rb b/spec/services/ci/image_for_build_service_spec.rb
index b3e0a7b9b58b..0a50347a7c50 100644
--- a/spec/services/ci/image_for_build_service_spec.rb
+++ b/spec/services/ci/image_for_build_service_spec.rb
@@ -8,6 +8,10 @@ module Ci
     let(:pipeline) { project.ensure_pipeline('master', commit_sha) }
     let(:build) { FactoryGirl.create(:ci_build, pipeline: pipeline) }
 
+    before do
+      stub_ci_pipeline_hooks
+    end
+
     describe '#execute' do
       before { build }
 
diff --git a/spec/services/ci/process_pipeline_service_spec.rb b/spec/services/ci/process_pipeline_service_spec.rb
index ff113efd916b..b62c6a9321f0 100644
--- a/spec/services/ci/process_pipeline_service_spec.rb
+++ b/spec/services/ci/process_pipeline_service_spec.rb
@@ -7,6 +7,7 @@
 
   before do
     allow(pipeline).to receive(:ci_yaml_file).and_return(config)
+    stub_ci_pipeline_hooks
   end
 
   describe '#execute' do
diff --git a/spec/services/ci/register_build_service_spec.rb b/spec/services/ci/register_build_service_spec.rb
index 1e21a32a0629..49033e548c87 100644
--- a/spec/services/ci/register_build_service_spec.rb
+++ b/spec/services/ci/register_build_service_spec.rb
@@ -11,6 +11,7 @@ module Ci
 
     before do
       specific_runner.assign_to(project)
+      stub_ci_pipeline_hooks
     end
 
     describe '#execute' do
diff --git a/spec/services/create_deployment_service_spec.rb b/spec/services/create_deployment_service_spec.rb
index 0b84c7262c3f..794067f52203 100644
--- a/spec/services/create_deployment_service_spec.rb
+++ b/spec/services/create_deployment_service_spec.rb
@@ -6,6 +6,10 @@
 
   let(:service) { described_class.new(project, user, params) }
 
+  before do
+    stub_ci_pipeline_hooks
+  end
+
   describe '#execute' do
     let(:params) do
       { environment: 'production',
diff --git a/spec/services/merge_requests/merge_when_build_succeeds_service_spec.rb b/spec/services/merge_requests/merge_when_build_succeeds_service_spec.rb
index b80cfd8f4501..17b1db93d049 100644
--- a/spec/services/merge_requests/merge_when_build_succeeds_service_spec.rb
+++ b/spec/services/merge_requests/merge_when_build_succeeds_service_spec.rb
@@ -141,17 +141,19 @@
         allow_any_instance_of(MergeRequest).to receive(:pipeline).and_wrap_original do
           Ci::Pipeline.find(pipeline.id)
         end
+
+        stub_ci_pipeline_hooks
       end
 
       it "doesn't merge if any of stages failed" do
-        expect(MergeWorker).not_to receive(:perform_async)
+        expect(PipelineSuccessWorker).not_to receive(:perform_async)
 
         build.success
         test.drop
       end
 
       it 'merges when all stages succeeded' do
-        expect(MergeWorker).to receive(:perform_async)
+        expect(PipelineSuccessWorker).to receive(:perform_async).and_return(true)
 
         build.success
         test.success
diff --git a/spec/support/stub_gitlab_calls.rb b/spec/support/stub_gitlab_calls.rb
index 93f96cacc001..74aa60c283b8 100644
--- a/spec/support/stub_gitlab_calls.rb
+++ b/spec/support/stub_gitlab_calls.rb
@@ -13,6 +13,18 @@ def stub_js_gitlab_calls
     allow_any_instance_of(Network).to receive(:projects) { project_hash_array }
   end
 
+  def stub_ci_pipeline_hooks
+    allow(PipelineHooksWorker).to receive(:perform_async).and_return(true)
+  end
+
+  def stub_ci_build_hooks
+    allow(BuildHooksWorker).to receive(:perform_async).and_return(true)
+  end
+
+  def stub_repository_forbidden_access
+    allow(Repository).to receive(:is_access_forbidden?).and_return(false)
+  end
+
   def stub_ci_pipeline_to_return_yaml_file
     stub_ci_pipeline_yaml_file(gitlab_ci_yaml)
   end
diff --git a/spec/views/projects/builds/show.html.haml_spec.rb b/spec/views/projects/builds/show.html.haml_spec.rb
index da43622d3f94..929d4023890f 100644
--- a/spec/views/projects/builds/show.html.haml_spec.rb
+++ b/spec/views/projects/builds/show.html.haml_spec.rb
@@ -15,6 +15,8 @@
     assign(:project, project)
 
     allow(view).to receive(:can?).and_return(true)
+
+    stub_ci_pipeline_hooks
   end
 
   context 'when build is running' do
diff --git a/spec/workers/build_email_worker_spec.rb b/spec/workers/build_email_worker_spec.rb
index 788b92c1b84e..ee27be35384f 100644
--- a/spec/workers/build_email_worker_spec.rb
+++ b/spec/workers/build_email_worker_spec.rb
@@ -10,6 +10,7 @@
   subject { BuildEmailWorker.new }
 
   before do
+    stub_ci_pipeline_hooks
     allow(build).to receive(:execute_hooks).and_return(false)
     build.success
   end
diff --git a/spec/workers/post_receive_spec.rb b/spec/workers/post_receive_spec.rb
index 984acdade360..d800248d5349 100644
--- a/spec/workers/post_receive_spec.rb
+++ b/spec/workers/post_receive_spec.rb
@@ -59,6 +59,7 @@
           end
           allow_any_instance_of(Ci::CreatePipelineService).to receive(:branch?).and_return(true)
           stub_ci_pipeline_to_return_yaml_file
+          stub_ci_pipeline_hooks
         end
 
         it { expect{ subject }.to change{ Ci::Pipeline.count }.by(2) }
diff --git a/spec/workers/stuck_ci_builds_worker_spec.rb b/spec/workers/stuck_ci_builds_worker_spec.rb
index 801fa31b45d8..930da4c220a8 100644
--- a/spec/workers/stuck_ci_builds_worker_spec.rb
+++ b/spec/workers/stuck_ci_builds_worker_spec.rb
@@ -4,6 +4,10 @@
   let!(:build) { create :ci_build }
   let(:worker) { described_class.new }
 
+  before do
+    stub_ci_pipeline_hooks
+  end
+
   subject do
     build.reload
     build.status
-- 
GitLab