From 2a207bc0b2d0209bd0644ee2f61b77885490549e Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Nicki=20K=C5=99=C3=AD=C5=BEek?= <nicki@isc.org>
Date: Tue, 25 Feb 2025 17:48:05 +0100
Subject: [PATCH] Replace deprecated only/except with rules in .gitlab-ci.yml

The keyword rules allows more flexible and complex conditions when
deciding whether to create the job and also makes it possible run tweak
variables or job properties depending on arbitraty rules. Since it's
not possible to combine only/except and rules together, replace all
uses of only/except to avoid any potential future issues.

(cherry picked from commit 29fd7564083731373bd132ec65ffc0a9072f8efc)
---
 .gitlab-ci.yml | 53 +++++++++++++++++---------------------------------
 1 file changed, 18 insertions(+), 35 deletions(-)

diff --git a/.gitlab-ci.yml b/.gitlab-ci.yml
index 421c9d3941..cc044f9e47 100644
--- a/.gitlab-ci.yml
+++ b/.gitlab-ci.yml
@@ -221,31 +221,18 @@ stages:
 ### Job Templates
 
 .api-pipelines-schedules-tags-triggers-web-triggering-rules: &api_pipelines_schedules_tags_triggers_web_triggering_rules
-  only:
-    - api
-    - pipelines
-    - schedules
-    - tags
-    - triggers
-    - web
+  rules:
+    - if: '$CI_PIPELINE_SOURCE =~ /^(api|pipeline|schedule|trigger|web)$/'
+    - if: '$CI_COMMIT_TAG != null'
 
 .api-pipelines-schedules-triggers-web-triggering-rules: &api_pipelines_schedules_triggers_web_triggering_rules
-  only:
-    - api
-    - pipelines
-    - schedules
-    - triggers
-    - web
+  rules:
+    - if: '$CI_PIPELINE_SOURCE =~ /^(api|pipeline|schedule|trigger|web)$/'
 
 .default-triggering-rules: &default_triggering_rules
-  only:
-    - api
-    - merge_requests
-    - pipelines
-    - schedules
-    - tags
-    - triggers
-    - web
+  rules:
+    - if: '$CI_PIPELINE_SOURCE =~ /^(api|merge_request_event|pipeline|schedule|trigger|web)$/'
+    - if: '$CI_COMMIT_TAG != null'
 
 .precheck: &precheck_job
   <<: *default_triggering_rules
@@ -647,9 +634,8 @@ danger:
   script:
     - pip install git+https://gitlab.isc.org/isc-projects/hazard.git
     - hazard
-  only:
-    refs:
-      - merge_requests
+  rules:
+    - if: '$CI_PIPELINE_SOURCE == "merge_request_event"'
 
 checkbashisms:
   <<: *precheck_job
@@ -1442,8 +1428,8 @@ release:
       artifacts: true
     - job: docs:pdf
       artifacts: true
-  only:
-    - tags
+  rules:
+    - if: '$CI_COMMIT_TAG != null'
   artifacts:
     paths:
       - "*-release"
@@ -1486,8 +1472,8 @@ sign:
   needs:
     - job: release
       artifacts: true
-  only:
-    - tags
+  rules:
+    - if: '$CI_COMMIT_TAG != null'
   when: manual
   allow_failure: false
 
@@ -1539,10 +1525,8 @@ coverity:
       - cov-int.tar.gz
     expire_in: "1 week"
     when: on_failure
-  only:
-    variables:
-      - $COVERITY_SCAN_PROJECT_NAME
-      - $COVERITY_SCAN_TOKEN
+  rules:
+    - if: '$COVERITY_SCAN_PROJECT_NAME != null && $COVERITY_SCAN_TOKEN != null'
 
 # Respdiff tests
 
@@ -1717,9 +1701,8 @@ pairwise:
       - pairwise-model.txt
       - pairwise-output.*.txt
     when: on_failure
-  only:
-    variables:
-      - $PAIRWISE_TESTING
+  rules:
+    - if: '$PAIRWISE_TESTING != null'
 
 .post_merge_template: &post_merge
   <<: *base_image