catching and cleanly reporting SSL errors in Ci::Config::External::Processor

changelogs/unreleased/ci-lint-ssl-error.yml

+---
+title: Catch and report OpenSSL exceptions while fetching external configuration files
+  in CI::Config
+merge_request: 26750
+author: Drew Cimino
+type: fixed

lib/gitlab/ci/config/external/processor.rb

@@ -11,7 +11,8 @@ module Gitlab
             @values = values
             @external_files = External::Mapper.new(values, project: project, sha: sha, user: user, expandset: expandset).process
             @content = {}
-          rescue External::Mapper::Error => e
+          rescue External::Mapper::Error,
+                 OpenSSL::SSL::SSLError => e
             raise IncludeError, e.message
           end
 

spec/lib/gitlab/ci/config/external/processor_spec.rb

@@ -270,5 +270,27 @@ describe Gitlab::Ci::Config::External::Processor do
         end
       end
     end
+
+    context 'when config includes an external configuration file via SSL web request' do
+      before do
+        stub_request(:get, 'https://sha256.badssl.com/fake.yml').to_return(body: 'image: ruby:2.6', status: 200)
+        stub_request(:get, 'https://self-signed.badssl.com/fake.yml')
+          .to_raise(OpenSSL::SSL::SSLError.new('SSL_connect returned=1 errno=0 state=error: certificate verify failed (self signed certificate)'))
+      end
+
+      context 'with an acceptable certificate' do
+        let(:values) { { include: 'https://sha256.badssl.com/fake.yml' } }
+
+        it { is_expected.to include(image: 'ruby:2.6') }
+      end
+
+      context 'with a self-signed certificate' do
+        let(:values) { { include: 'https://self-signed.badssl.com/fake.yml' } }
+
+        it 'returns a reportable configuration error' do
+          expect { subject }.to raise_error(described_class::IncludeError, /certificate verify failed/)
+        end
+      end
+    end
   end
 end