Add OpenSSL::OpenSSLError to HTTP_ERRORS

Some services can raise OpenSSL::X509::CertificateError due
to an invalid SSL certificates, with OpenSSL::OpenSSLError
we can handle these errors.

app/models/project_services/drone_ci_service.rb

@@ -46,7 +46,7 @@ class DroneCiService < CiService
   end
 
   def commit_status(sha, ref)
-    with_reactive_cache(sha, ref) {|cached| cached[:commit_status] }
+    with_reactive_cache(sha, ref) { |cached| cached[:commit_status] }
   end
 
   def calculate_reactive_cache(sha, ref)
@@ -68,7 +68,7 @@ class DroneCiService < CiService
       end
 
     { commit_status: status }
-  rescue Errno::ECONNREFUSED
+  rescue *Gitlab::HTTP::HTTP_ERRORS
     { commit_status: :error }
   end
 

changelogs/unreleased/64176-fix-error-handling.yml

+---
+title: Fix invalid SSL certificate errors on Drone CI service
+merge_request: 30422
+author:
+type: fixed

lib/gitlab/http.rb

@@ -10,9 +10,9 @@ module Gitlab
     RedirectionTooDeep = Class.new(StandardError)
 
     HTTP_ERRORS = [
-      SocketError, OpenSSL::SSL::SSLError, Errno::ECONNRESET,
-      Errno::ECONNREFUSED, Errno::EHOSTUNREACH, Net::OpenTimeout,
-      Net::ReadTimeout, Gitlab::HTTP::BlockedUrlError,
+      SocketError, OpenSSL::SSL::SSLError, OpenSSL::OpenSSLError,
+      Errno::ECONNRESET, Errno::ECONNREFUSED, Errno::EHOSTUNREACH,
+      Net::OpenTimeout, Net::ReadTimeout, Gitlab::HTTP::BlockedUrlError,
       Gitlab::HTTP::RedirectionTooDeep
     ].freeze
 

spec/models/project_services/drone_ci_service_spec.rb

@@ -101,6 +101,15 @@ describe DroneCiService, :use_clean_rails_memory_store_caching do
         is_expected.to eq(:error)
       end
 
+      Gitlab::HTTP::HTTP_ERRORS.each do |http_error|
+        it "sets commit status to :error with a #{http_error.name} error" do
+          WebMock.stub_request(:get, commit_status_path)
+            .to_raise(http_error)
+
+          is_expected.to eq(:error)
+        end
+      end
+
       {
         "killed"  => :canceled,
         "failure" => :failed,