Extend can_pick?

app/models/ci/runner.rb

@@ -111,6 +111,8 @@ module Ci
     end
 
     def can_pick?(build)
+      return false if self.protected_? && !build.protected?
+
       assignable_for?(build.project) && accepting_tags?(build)
     end
 

spec/models/ci/runner_spec.rb

@@ -95,6 +95,8 @@ describe Ci::Runner do
     let(:build) { create(:ci_build, pipeline: pipeline) }
     let(:runner) { create(:ci_runner) }
 
+    subject { runner.can_pick?(build) }
+
     before do
       build.project.runners << runner
     end
@@ -222,6 +224,28 @@ describe Ci::Runner do
         end
       end
     end
+
+    context 'when runner is protected' do
+      before do
+        runner.protected_!
+      end
+
+      context 'when build is protected' do
+        before do
+          build.protected = true
+        end
+
+        it { is_expected.to be_truthy }
+      end
+
+      context 'when build is unprotected' do
+        before do
+          build.protected = false
+        end
+
+        it { is_expected.to be_falsey }
+      end
+    end
   end
 
   describe '#status' do