2 files changed, 14 insertions, 4 deletions
diff --git a/lib/gitlab/ci/config/entry/include/rules.rb b/lib/gitlab/ci/config/entry/include/rules.rb
index 8eaf9e35aaf..71418e6752d 100644
--- a/lib/gitlab/ci/config/entry/include/rules.rb
+++ b/lib/gitlab/ci/config/entry/include/rules.rb
@@ -5,6 +5,12 @@ module Gitlab
     class Config
       module Entry
         class Include
+          ##
+          # Include rules are validated separately from all other entries. This
+          # is because included files are expanded before `@root.compose!` runs
+          # in Ci::Config. As such, this class is directly instantiated and
+          # composed in lib/gitlab/ci/config/external/rules.rb.
+          #
           class Rules < ::Gitlab::Config::Entry::ComposableArray
             include ::Gitlab::Config::Entry::Validatable
 
@@ -13,8 +19,9 @@ module Gitlab
               validates :config, type: Array
             end
 
+            # Remove this method when FF `ci_refactor_external_rules` is removed
             def value
-              @config
+              Feature.enabled?(:ci_refactor_external_rules) ? super : @config
             end
 
             def composable_class
diff --git a/lib/gitlab/ci/config/entry/include/rules/rule.rb b/lib/gitlab/ci/config/entry/include/rules/rule.rb
index 9cdbd8cd037..1a68e95913c 100644
--- a/lib/gitlab/ci/config/entry/include/rules/rule.rb
+++ b/lib/gitlab/ci/config/entry/include/rules/rule.rb
@@ -14,9 +14,6 @@ module Gitlab
 
             attributes :if, :exists, :when
 
-            # Include rules are validated before Entry validations. This is because
-            # the include files are expanded before `compose!` runs in Ci::Config.
-            # The actual validation logic is in lib/gitlab/ci/config/external/rules.rb.
             validations do
               validates :config, presence: true
               validates :config, type: { with: Hash }
@@ -24,8 +21,14 @@ module Gitlab
 
               with_options allow_nil: true do
                 validates :if, expression: true
+                validates :exists, array_of_strings_or_string: true, allow_blank: true
+                validates :when, allowed_values: { in: ALLOWED_WHEN }
               end
             end
+
+            def value
+              Feature.enabled?(:ci_refactor_external_rules) ? config.compact : super
+            end
           end
         end
       end