Perform merge without required jobs started (External job and detached pipeline)

Summary

Since GitLab CE 11.10, external jobs are no longer attached to merge_requests pipeline (with the detached badge). If the external job succeeds, the manual jobs defined as mandatory (only: merge_requests, allow_failure: false) are no longer required to perform a merge.

Steps to reproduce

1. Add .gitlab-ci.yml file (after create PRIVATE_TOKEN variable) :

stages:
  - test

.sonarqube:
  stage: test
  when: manual
  only:
    refs:
      - merge_requests
  script:
    # Create an external job
    - 'curl --request POST --header "PRIVATE-TOKEN: $PRIVATE_TOKEN" "${CI_API_V4_URL}/projects/${CI_PROJECT_ID}/statuses/${CI_COMMIT_SHA}?state=${COMMIT_STATE}&ref=${CI_COMMIT_REF_NAME}&name=sonarqube&description=${COMMIT_STATE}"'

sonarqube:failure:
  extends: .sonarqube
  variables:
    COMMIT_STATE: failed

sonarqube:success:
  extends: .sonarqube
  variables:
    COMMIT_STATE: success

################################################################################
# TEST
.compose:
  stage: test
  when: manual
  allow_failure: false
  only:
    refs:
      - merge_requests

Install:
  extends: .compose
  script:
    - echo "Install tests"

Update:
  extends: .compose
  script:
    - echo "Update tests"

2. Create au MR with change

3. The merge request is stuck waiting for manual action
   

4. Perform the manual job "sonarqube:success", who change commit status using the API
   

5. (bug ??) This action create two pipelines
   
   EDIT : See #14064 (comment 211187822)

6. (BUG) Now, you can merge MR even though the tasks Install and Update have not been started.
   
   EDIT : similar to #34378 (closed)

Example Project

• https://gitlab.com/baltazardoung/ci-external-from-detached/blob/master/.gitlab-ci.yml
• baltazardoung/ci-external-from-detached!1

What is the expected correct behavior?

In ours previous version of GitLab CE (11.9.4), the external job are attached to merge_requests pipeline and all mandatory manual jobs were required before merging.