CI: "only:changes" configuration does not work properly when pipeline was not created by a push

Summary

If a .gitlab-ci.yml file contains jobs with differing use of only:changes and only:refs to determine when each are run, there are cases where some jobs will run when they should not, according to the criteria configured in their only block.

Steps to reproduce

The below CI configuration demonstrates the issue. It simulates a two-stage pipeline that is a reduced test case from where I encountered it. The build stage builds a Docker image that would subsequently get used by the test stage (it doesn't do that here since the example is simplified to a minimal test case). The build stage only needs to be run when the associated Dockerfile changes. To reduce the use of CI resources, we don't run any pipelines unless it is triggered via the Web frontend. According to the GitLab CI documentation, the below configuration should AND both of these criteria together, so the build job only runs when:

• A build has been triggered via the Web frontend, AND
• Dockerfile has changed

The test stage is somewhat simpler; we want to run it every time a pipeline is triggered via the Web frontend, so it is configured accordingly.

stages:
    - build
    - test

image: docker:stable

build:
    stage: build
    script: echo build
    only:
        changes:
            - Dockerfile
        refs:
            - web

test:
    stage: test
    script: echo test
    only:
        refs:
            - web

Example Project

https://gitlab.com/jasonroehm/only-issue

What is the current bug behavior?

When I trigger a pipeline with the Web frontend, the build stage always runs, regardless of whether Dockerfile has changed.

What is the expected correct behavior?

The build stage should only run if Dockerfile has changed, AND a pipeline is triggered via the Web frontend.

Output of checks

This bug happens on GitLab.com