Refactor deploy token methods on Ci::Build

app/models/ci/build.rb

@@ -605,8 +605,7 @@ module Ci
           .append(key: 'CI_REGISTRY_USER', value: CI_REGISTRY_USER)
           .append(key: 'CI_REGISTRY_PASSWORD', value: token, public: false)
           .append(key: 'CI_REPOSITORY_URL', value: repo_url, public: false)
-
-        variables.concat(deploy_token_variables) if gitlab_deploy_token
+          .concat(deploy_token_variables)
       end
     end
 
@@ -659,8 +658,10 @@ module Ci
 
     def deploy_token_variables
       Gitlab::Ci::Variables::Collection.new.tap do |variables|
+        break variables unless gitlab_deploy_token
+
         variables.append(key: 'CI_DEPLOY_USER', value: gitlab_deploy_token.name)
-        variables.append(key: 'CI_DEPLOY_PASSWORD', value: gitlab_deploy_token.token)
+        variables.append(key: 'CI_DEPLOY_PASSWORD', value: gitlab_deploy_token.token, public: false)
       end
     end
 

app/models/deploy_token.rb

@@ -18,6 +18,10 @@ class DeployToken < ActiveRecord::Base
 
   scope :active, -> { where("revoked = false AND expires_at >= NOW()") }
 
+  def self.gitlab_deploy_token
+    active.find_by(name: GITLAB_DEPLOY_TOKEN_NAME)
+  end
+
   def revoke!
     update!(revoked: true)
   end

app/models/project.rb

@@ -1880,8 +1880,7 @@ class Project < ActiveRecord::Base
   end
 
   def gitlab_deploy_token
-    @gitlab_deploy_token ||=
-      deploy_tokens.active.find_by(name: DeployToken::GITLAB_DEPLOY_TOKEN_NAME)
+    @gitlab_deploy_token ||= deploy_tokens.gitlab_deploy_token
   end
 
   private

spec/models/ci/build_spec.rb

@@ -2042,7 +2042,7 @@ describe Ci::Build do
       let(:deploy_token_variables) do
         [
           { key: 'CI_DEPLOY_USER', value: deploy_token.name, public: true },
-          { key: 'CI_DEPLOY_PASSWORD', value: deploy_token.token, public: true }
+          { key: 'CI_DEPLOY_PASSWORD', value: deploy_token.token, public: false }
         ]
       end
 

spec/models/deploy_token_spec.rb

@@ -142,4 +142,23 @@ describe DeployToken do
       end
     end
   end
+
+  describe '.gitlab_deploy_token' do
+    let(:project) { create(:project ) }
+
+    subject { project.deploy_tokens.gitlab_deploy_token }
+
+    context 'with a gitlab deploy token associated' do
+      it 'should return the gitlab deploy token' do
+        deploy_token = create(:deploy_token, :gitlab_deploy_token, projects: [project])
+        is_expected.to eq(deploy_token)
+      end
+    end
+
+    context 'with no gitlab deploy token associated' do
+      it 'should return nil' do
+        is_expected.to be_nil
+      end
+    end
+  end
 end