"rules" used in "include" sections of a pipeline definition may create unexpected pipelines

Summary

When controlling pipeline creation using rules inside an include section of the .gitlab-ci.yml file, pipelines may be created even though rules are not fulfilled.

In a specific case, this is leading to unnecessary/unexpected failed pipelines in a project.

Steps to reproduce

1. Create a project and use the following gitlab-ci.yml definition to include a local file:

include:
    - local: gitlab.yml
      rules:
          - if: $CI_COMMIT_BEFORE_SHA == "0000000000000000000000000000000000000000"
            when: never
          - when: always

2. Create the included gitlab.yml file with the following contents:

build:
    stage: build
    script:
        - exit 0

3. The check on a $CI_COMMIT_BEFORE_SHA value of 0000000000000000000000000000000000000000 should prevent the include from running if the commit is the first one on a new branch, refer to our documentation for more information on this variable.
4. When creating a new branch, an unexpected pipeline is created with the following error:

jobs config should contain at least one visible job

If the rules section is moved to the included file instead, for example:

build:
    stage: build
    script:
        - exit 0
    rules:
        - if: $CI_COMMIT_BEFORE_SHA == "0000000000000000000000000000000000000000"
          when: never
        - when: always

Then creating a new branch does not create a pipeline, as expected.

What is the current bug behavior?

A failing pipeline is created with the error jobs config should contain at least one visible job

What is the expected correct behavior?

No pipeline should be created.

Output of checks

This bug happens on GitLab.com

Possible fixes