Use update build policy instead of new play policy

app/policies/ci/build_policy.rb

 module Ci
   class BuildPolicy < CommitStatusPolicy
+    alias_method :build, :subject
+
     def rules
       super
 
@@ -9,17 +11,17 @@ module Ci
         cannot! :"#{rule}_commit_status" unless can? :"#{rule}_build"
       end
 
-      can! :play_build if can_play_action?
+      if can?(:update_build) && protected_action?
+        cannot! :update_build
+      end
     end
 
     private
 
-    alias_method :build, :subject
-
-    def can_play_action?
+    def protected_action?
       return false unless build.action?
 
-      ::Gitlab::UserAccess
+      !::Gitlab::UserAccess
         .new(user, project: build.project)
         .can_push_to_branch?(build.ref)
     end

app/policies/environment_policy.rb

@@ -12,6 +12,6 @@ class EnvironmentPolicy < BasePolicy
   private
 
   def can_play_stop_action?
-    Ability.allowed?(user, :play_build, environment.stop_action)
+    Ability.allowed?(user, :update_build, environment.stop_action)
   end
 end

app/serializers/build_action_entity.rb

@@ -19,6 +19,6 @@ class BuildActionEntity < Grape::Entity
   alias_method :build, :object
 
   def playable?
-    build.playable? && can?(request.user, :play_build, build)
+    build.playable? && can?(request.user, :update_build, build)
   end
 end

app/serializers/build_entity.rb

@@ -26,7 +26,7 @@ class BuildEntity < Grape::Entity
   alias_method :build, :object
 
   def playable?
-    build.playable? && can?(request.user, :play_build, build)
+    build.playable? && can?(request.user, :update_build, build)
   end
 
   def detailed_status

app/services/ci/play_build_service.rb

 module Ci
   class PlayBuildService < ::BaseService
     def execute(build)
-      unless can?(current_user, :play_build, build)
+      unless can?(current_user, :update_build, build)
         raise Gitlab::Access::AccessDeniedError
       end
 

app/views/projects/ci/builds/_build.html.haml

@@ -102,7 +102,7 @@
           = link_to cancel_namespace_project_build_path(job.project.namespace, job.project, job, return_to: request.original_url), method: :post, title: 'Cancel', class: 'btn btn-build' do
             = icon('remove', class: 'cred')
         - elsif allow_retry
-          - if job.playable? && !admin && can?(current_user, :play_build, job)
+          - if job.playable? && !admin && can?(current_user, :update_build, job)
             = link_to play_namespace_project_build_path(job.project.namespace, job.project, job, return_to: request.original_url), method: :post, title: 'Play', class: 'btn btn-build' do
               = custom_icon('icon_play')
           - elsif job.retryable?

lib/gitlab/ci/status/build/play.rb

@@ -14,7 +14,7 @@ module Gitlab
           end
 
           def has_action?
-            can?(user, :play_build, subject)
+            can?(user, :update_build, subject)
           end
 
           def action_icon

spec/policies/ci/build_policy_spec.rb

@@ -108,8 +108,8 @@ describe Ci::BuildPolicy, :models do
             create(:ci_build, :manual, ref: 'some-ref', pipeline: pipeline)
           end
 
-          it 'does not include ability to play build' do
-            expect(policies).not_to include :play_build
+          it 'does not include ability to update build' do
+            expect(policies).not_to include :update_build
           end
         end
 
@@ -118,8 +118,8 @@ describe Ci::BuildPolicy, :models do
             create(:ci_build, ref: 'some-ref', pipeline: pipeline)
           end
 
-          it 'does not include ability to play build' do
-            expect(policies).not_to include :play_build
+          it 'includes ability to update build' do
+            expect(policies).to include :update_build
           end
         end
       end
@@ -128,16 +128,16 @@ describe Ci::BuildPolicy, :models do
         context 'when build is a manual action' do
           let(:build) { create(:ci_build, :manual, pipeline: pipeline) }
 
-          it 'includes ability to play build' do
-            expect(policies).to include :play_build
+          it 'includes ability to update build' do
+            expect(policies).to include :update_build
           end
         end
 
         context 'when build is not a manual action' do
-          let(:build) { create(:ci_build,  pipeline: pipeline) }
+          let(:build) { create(:ci_build, pipeline: pipeline) }
 
-          it 'does not include ability to play build' do
-            expect(policies).not_to include :play_build
+          it 'includes ability to update build' do
+            expect(policies).to include :update_build
           end
         end
       end