Add spec. Fix runner setting page. It worked.

app/controllers/projects/runners_controller.rb

@@ -59,6 +59,8 @@ def set_runner
   end
 
   def runner_params
-    params.require(:runner).permit(Ci::Runner::FORM_EDITABLE)
+    params.require(:runner).permit(Ci::Runner::FORM_EDITABLE).tap do |params|
+      params['access_level'] = params['access_level']&.to_i
+    end
   end
 end

app/views/projects/runners/_form.html.haml

@@ -10,7 +10,7 @@
     = label :protected, "Protected", class: 'control-label'
     .col-sm-10
       .checkbox
-        = f.check_box :access_level, 1, 0
+        = f.check_box :access_level, {}, Ci::Runner.access_levels['protected_'], Ci::Runner.access_levels['unprotected']
         %span.light This runner will only run on pipelines trigged on protected branches
   .form-group
     = label :run_untagged, 'Run untagged jobs', class: 'control-label'

db/migrate/20170816133938_add_access_level_to_ci_runners.rb

@@ -6,8 +6,8 @@ class AddAccessLevelToCiRunners < ActiveRecord::Migration
   disable_ddl_transaction!
 
   def up
-    # Ci::Runner.unprotected: 0
-    add_column_with_default(:ci_runners, :access_level, :integer, default: 0)
+    add_column_with_default(:ci_runners, :access_level, :integer,
+                            default: Ci::Runner.access_levels['unprotected'])
   end
 
   def down

lib/gitlab/ci/stage/seed.rb

@@ -28,7 +28,7 @@ def builds
             attributes.merge(project: project,
                              ref: pipeline.ref,
                              tag: pipeline.tag,
-                             trigger_request: trigger
+                             trigger_request: trigger,
                              protected: protected?)
           end
         end

spec/factories/ci/runners.rb

@@ -21,5 +21,13 @@
     trait :inactive do
       active false
     end
+
+    trait :protected do
+      access_level Ci::Runner.access_levels['protected_']
+    end
+
+    trait :unprotected do
+      access_level Ci::Runner.access_levels['unprotected']
+    end
   end
 end

spec/models/ci/runner_spec.rb

@@ -456,4 +456,28 @@ def expect_value_in_queues
       expect(described_class.search(runner.description.upcase)).to eq([runner])
     end
   end
+
+  describe '.access_level' do
+    context 'when access_level of a runner is protected' do
+      before do
+        create(:ci_runner, :protected)
+      end
+
+      it 'a protected runner exists' do
+        expect(Ci::Runner.count).to eq(1)
+        expect(Ci::Runner.last.protected_?).to eq(true)
+      end
+    end
+
+    context 'when access_level of a runner is unprotected' do
+      before do
+        create(:ci_runner, :unprotected)
+      end
+
+      it 'an unprotected runner exists' do
+        expect(Ci::Runner.count).to eq(1)
+        expect(Ci::Runner.last.unprotected?).to eq(true)
+      end
+    end
+  end
 end