port CommitStatus/Build

app/models/ability.rb

@@ -74,7 +74,8 @@ class Ability
       when Issue then IssuePolicy.abilities(user, subject)
       when MergeRequest then MergeRequestPolicy.abilities(user, subject)
 
-      when CommitStatus then commit_status_abilities(user, subject)
+      when Ci::Build then Ci::BuildPolicy.abilities(user, subject)
+      when CommitStatus then CommitStatus.abilities(user, subject)
       when Note then note_abilities(user, subject)
       when ProjectSnippet then project_snippet_abilities(user, subject)
       when PersonalSnippet then personal_snippet_abilities(user, subject)

app/policies/base_policy.rb

@@ -30,6 +30,10 @@ class BasePolicy
     @can.merge(BasePolicy.class_for(new_subject).abilities(@user, new_subject))
   end
 
+  def can?(rule)
+    @can.include?(rule) && !@cannot.include?(rule)
+  end
+
   def can!(*rules)
     @can.merge(rules)
   end

app/policies/ci/build_policy.rb

+module Ci
+  class BuildPolicy < CommitStatusPolicy
+    def rules
+      super
+
+      # If we can't read build we should also not have that
+      # ability when looking at this in context of commit_status
+      %w(read create update admin).each do |rule|
+        cannot! :"#{rule}_commit_status" unless can? :"#{rule}_build"
+      end
+    end
+  end
+end

app/policies/commit_status_policy.rb

+class CommitStatusPolicy < BasePolicy
+  def rules
+    delegate! @subject.project
+  end
+end