Fix when include has rules with invalid rule

lib/gitlab/ci/config/external/rules.rb

@@ -5,7 +5,13 @@ module Gitlab
     class Config
       module External
         class Rules
+          ALLOWED_KEYS = Entry::Include::Rules::Rule::ALLOWED_KEYS
+
+          InvalidIncludeRulesError = Class.new(Mapper::Error)
+
           def initialize(rule_hashes)
+            validate(rule_hashes)
+
             @rule_list = Build::Rules::Rule.fabricate_list(rule_hashes)
           end
 
@@ -19,6 +25,16 @@ module Gitlab
             @rule_list.find { |rule| rule.matches?(nil, context) }
           end
 
+          def validate(rule_hashes)
+            return unless rule_hashes.is_a?(Array)
+
+            rule_hashes.each do |rule_hash|
+              next if (rule_hash.keys - ALLOWED_KEYS).empty?
+
+              raise InvalidIncludeRulesError, "invalid include rule: #{rule_hash}"
+            end
+          end
+
           Result = Struct.new(:result) do
             def pass?
               !!result

spec/lib/gitlab/ci/config/external/processor_spec.rb

@@ -402,5 +402,17 @@ RSpec.describe Gitlab::Ci::Config::External::Processor do
         expect(output.keys).to match_array([:image, :my_build, :my_test])
       end
     end
+
+    context 'when rules defined' do
+      context 'when a rule is invalid' do
+        let(:values) do
+          { include: [{ local: 'builds.yml', rules: [{ exists: ['$MY_VAR'] }] }] }
+        end
+
+        it 'raises IncludeError' do
+          expect { subject }.to raise_error(described_class::IncludeError, /invalid include rule/)
+        end
+      end
+    end
   end
 end

spec/lib/gitlab/ci/config/external/rules_spec.rb

@@ -16,7 +16,7 @@ RSpec.describe Gitlab::Ci::Config::External::Rules do
       it { is_expected.to eq(true) }
     end
 
-    context 'when there is a rule' do
+    context 'when there is a rule with if' do
       let(:rule_hashes) { [{ if: '$MY_VAR == "hello"' }] }
 
       context 'when the rule matches' do
@@ -31,5 +31,23 @@ RSpec.describe Gitlab::Ci::Config::External::Rules do
         it { is_expected.to eq(false) }
       end
     end
+
+    context 'when there is a rule with if and when' do
+      let(:rule_hashes) { [{ if: '$MY_VAR == "hello"', when: 'on_success' }] }
+
+      it 'raises an error' do
+        expect { result }.to raise_error(described_class::InvalidIncludeRulesError,
+                                         'invalid include rule: {:if=>"$MY_VAR == \"hello\"", :when=>"on_success"}')
+      end
+    end
+
+    context 'when there is a rule with exists' do
+      let(:rule_hashes) { [{ exists: ['$MY_VAR'] }] }
+
+      it 'raises an error' do
+        expect { result }.to raise_error(described_class::InvalidIncludeRulesError,
+                                         'invalid include rule: {:exists=>["$MY_VAR"]}')
+      end
+    end
   end
 end