Make sure scope has the right format

app/models/ci/variable.rb

 module Ci
   class Variable < ActiveRecord::Base
     extend Ci::Model
+    prepend EE::Ci::Variable
+
+    def self.key_uniqueness_scope
+      :project_id
+    end
 
     belongs_to :project
 
     validates :key,
       presence: true,
-      uniqueness: { scope: %i[project_id scope] },
+      uniqueness: { scope: key_uniqueness_scope },
       length: { maximum: 255 },
       format: { with: /\A[a-zA-Z0-9_]+\z/,
                 message: "can contain only letters, digits and '_'." }

app/models/ee/ci/variable.rb

+module EE
+  module Ci
+    module Variable
+      extend ActiveSupport::Concern
+
+      module VariableClassMethods
+        def key_uniqueness_scope
+          %i[project_id scope]
+        end
+      end
+
+      prepended do
+        singleton_class.prepend(VariableClassMethods)
+
+        validates(
+          :scope,
+          presence: true,
+          format: { with: ::Gitlab::Regex.variable_scope_regex,
+                    message: ::Gitlab::Regex.variable_scope_regex_message }
+        )
+      end
+    end
+  end
+end

lib/ee/gitlab/regex.rb

+module EE
+  module Gitlab
+    module Regex
+      def variable_scope_regex
+        @variable_scope_regex ||= /\A[a-zA-Z0-9_\\\/\${}. -*]+\z/.freeze
+      end
+
+      def variable_scope_regex_message
+        "can contain only letters, digits, '-', '_', '/', '$', '{', '}', '.', '*' and spaces"
+      end
+    end
+  end
+end

lib/gitlab/regex.rb

 module Gitlab
   module Regex
     extend self
+    extend EE::Gitlab::Regex
 
     def namespace_name_regex
       @namespace_name_regex ||= /\A[\p{Alnum}\p{Pd}_\. ]*\z/.freeze

spec/models/ci/variable_spec.rb

@@ -11,7 +11,11 @@ describe Ci::Variable, models: true do
   it { is_expected.not_to allow_value('foo bar').for(:key) }
   it { is_expected.not_to allow_value('foo/bar').for(:key) }
 
-  if described_class.column_names.include?('scope')
+  # EE
+  it { is_expected.to allow_value('review/*').for(:scope) }
+  it { is_expected.not_to allow_value('').for(:scope) }
+
+  if defined?(EE::Ci::Variable)
     it { is_expected.to validate_uniqueness_of(:key).scoped_to(:project_id, :scope) }
   else
     it { is_expected.to validate_uniqueness_of(:key).scoped_to(:project_id) }