Use before_save :set_protected

app/models/ci/build.rb

@@ -27,7 +27,6 @@ module Ci
 
     validates :coverage, numericality: true, allow_blank: true
     validates :ref, presence: true
-    validates :protected, inclusion: { in: [true, false], unless: :importing? }, on: :create
 
     scope :unstarted, ->() { where(runner_id: nil) }
     scope :ignore_failures, ->() { where(allow_failure: false) }
@@ -47,6 +46,7 @@ module Ci
 
     before_save :update_artifacts_size, if: :artifacts_file_changed?
     before_save :ensure_token
+    before_save :set_protected
     before_destroy { unscoped_project }
 
     after_create do |build|
@@ -461,6 +461,10 @@ module Ci
                             end
     end
 
+    def set_protected
+      self.protected = pipeline.protected
+    end
+
     def erase_trace!
       trace.erase!
     end

app/models/ci/pipeline.rb

@@ -36,9 +36,9 @@ module Ci
     validates :sha, presence: { unless: :importing? }
     validates :ref, presence: { unless: :importing? }
     validates :status, presence: { unless: :importing? }
-    validates :protected, inclusion: { in: [true, false], unless: :importing? }, on: :create
     validate :valid_commit_sha, unless: :importing?
 
+    # before_save :set_protected
     after_create :keep_around_commits, unless: :importing?
 
     enum source: {
@@ -445,6 +445,10 @@ module Ci
       statuses.latest.status || 'skipped'
     end
 
+    def set_protected
+      self.protected = project.protected_for?(self.ref)
+    end
+
     def keep_around_commits
       return unless project
 

app/services/ci/create_pipeline_service.rb

@@ -12,8 +12,7 @@ module Ci
         tag: tag?,
         trigger_requests: Array(trigger_request),
         user: current_user,
-        pipeline_schedule: schedule,
-        protected: project.protected_for?(ref)
+        pipeline_schedule: schedule
       )
 
       result = validate(current_user,

lib/gitlab/ci/stage/seed.rb

@@ -28,8 +28,7 @@ module Gitlab
             attributes.merge(project: project,
                              ref: pipeline.ref,
                              tag: pipeline.tag,
-                             trigger_request: trigger,
-                             protected: protected_ref?)
+                             trigger_request: trigger)
           end
         end
 
@@ -44,12 +43,6 @@ module Gitlab
             end
           end
         end
-
-        private
-
-        def protected_ref?
-          @protected_ref ||= project.protected_for?(pipeline.ref)
-        end
       end
     end
   end

spec/services/ci/retry_build_service_spec.rb

@@ -52,6 +52,17 @@ describe Ci::RetryBuildService do
           expect(new_build.send(attribute)).to eq build.send(attribute)
         end
       end
+
+      context 'when job has nullified protected' do
+        before do
+          build.update_attribute(:protected, nil)
+        end
+
+        it "clones protected build attribute" do
+          expect(new_build.protected).not_to be_nil
+          expect(new_build.protected).to eq build.protected
+        end
+      end
     end
 
     describe 'reject acessors' do