ci: refresh with latest lcitool manifest

This refresh switches the CI for contributors to be triggered by merge requests. Pushing to a branch in a fork will no longer run CI pipelines, in order to avoid consuming CI minutes. To regain the original behaviour contributors can opt-in to a pipeline on push git push <remote> -o ci.variable=RUN_PIPELINE=1 This variable can also be set globally on the repository, though this is not recommended. Upstream repo pushes to branches will run CI. The use of containers has changed in this update, with only the upstream repo creating containers, in order to avoid consuming contributors' limited storage quotas. A fork with existing container images may delete them. Containers will be rebuilt upstream when pushing commits with CI changes to the default branch. Any other scenario with CI changes will simply install build pre-requisite packages in a throaway environment, using the ci/buildenv/ scripts. These scripts may also be used on a contributor's local machines. With pipelines triggered by merge requests, it is also now possible to workaround the inability of contributors to run pipelines if they have run out of CI quota. A project member can trigger a pipeline from the merge request, which will run in context of upstream, however, note this should only be done after reviewing the code for any malicious CI changes. Signed-off-by: Daniel P. Berrangé <berrange@redhat.com>
2025-01-18 06:03:43 +03:00 · 2022-09-30 04:50:04 -04:00 · 2022-09-30 04:50:04 -04:00 · 1e99e5e4f4
commit 1e99e5e4f4
parent 17a6ed6907
30 changed files with 1362 additions and 337 deletions
--- a/.gitlab-ci.yml
+++ b/.gitlab-ci.yml
@ -13,10 +13,8 @@ stages:
  export PKG_CONFIG_PATH="$LIBDIR/pkgconfig"

 .native_build_job:
-  extends: .gitlab_native_build_job
-  before_script:
-    - *script_variables
  script:
+    - *script_variables
    - meson build
    - ninja -C build dist;
    - if test -x /usr/bin/rpmbuild && test "$RPM" != "skip";
@ -24,11 +22,19 @@ stages:
        rpmbuild --nodeps -ta build/meson-dist/virt-viewer-*.tar.xz;
      fi

+.native_build_job_prebuilt_env:
+  extends:
+    - .native_build_job
+    - .gitlab_native_build_job_prebuilt_env
+
+.native_build_job_local_env:
+  extends:
+    - .native_build_job
+    - .gitlab_native_build_job_local_env
+
 .native_git_build_job:
-  extends: .gitlab_native_build_job
-  before_script:
-    - *script_variables
  script:
+    - *script_variables
    - pushd "$PWD"
    - mkdir -p "$SCRATCH_DIR"
    - cd "$SCRATCH_DIR"
@ -53,29 +59,60 @@ stages:
        rpmbuild --nodeps -ta build/meson-dist/virt-viewer-*.tar.xz;
      fi

+.native_git_build_job_prebuilt_env:
+  extends:
+    - .native_git_build_job
+    - .gitlab_native_build_job_prebuilt_env
+
+.native_git_build_job_local_env:
+  extends:
+    - .native_git_build_job
+    - .gitlab_native_build_job_local_env
+
 .cross_build_job:
-  extends: .gitlab_cross_build_job
  image: $CI_REGISTRY_IMAGE/ci-$NAME:latest
  cache:
    paths:
      - ccache/
    key: "$CI_JOB_NAME"
-  before_script:
-    - *script_variables
  script:
+    - *script_variables
    - meson build $MESON_OPTS
    - $NINJA -C build

+.cross_build_job_prebuilt_env:
+  extends:
+    - .cross_build_job
+    - .gitlab_cross_build_job_prebuilt_env
+
+.cross_build_job_local_env:
+  extends:
+    - .cross_build_job
+    - .gitlab_cross_build_job_local_env
+
 include: '/ci/gitlab.yml'

-codestyle:
+.codestyle_job:
  stage: sanity_checks
-  image: $CI_REGISTRY_IMAGE/ci-centos-stream-8:latest
+  script:
+    - *script_variables
+    - meson build || (cat build/meson-logs/meson-log.txt && exit 1)
+    - meson test -C build --suite syntax-check --no-rebuild || (cat build/meson-logs/testlog.txt && exit 1)
+
+codestyle_prebuilt_env:
+  extends:
+    - .codestyle_job
+    - .gitlab_native_build_job_prebuilt_env
  needs:
    - job: x86_64-centos-stream-8-container
      optional: true
-  before_script:
-    - *script_variables
-  script:
-    - meson build || (cat build/meson-logs/meson-log.txt && exit 1)
-    - meson test -C build --suite syntax-check --no-rebuild || (cat build/meson-logs/testlog.txt && exit 1)
+  variables:
+    NAME: centos-stream-8
+
+codestyle_local_env:
+  extends:
+    - .codestyle_job
+    - .gitlab_native_build_job_local_env
+  variables:
+    IMAGE: quay.io/centos/centos:stream8
+    NAME: centos-stream-8
--- a/ci/buildenv/centos-stream-8.sh
+++ b/ci/buildenv/centos-stream-8.sh
@ -0,0 +1,110 @@
+# THIS FILE WAS AUTO-GENERATED
+#
+#  $ lcitool manifest ci/manifest.yml
+#
+# https://gitlab.com/libvirt/libvirt-ci
+
+function install_buildenv() {
+    dnf distro-sync -y
+    dnf install 'dnf-command(config-manager)' -y
+    dnf config-manager --set-enabled -y powertools
+    dnf install -y centos-release-advanced-virtualization
+    dnf install -y epel-release
+    dnf install -y epel-next-release
+    dnf install -y \
+        audit-libs-devel \
+        augeas \
+        bash-completion \
+        ca-certificates \
+        ccache \
+        clang \
+        cpp \
+        cyrus-sasl-devel \
+        device-mapper-devel \
+        diffutils \
+        dwarves \
+        ebtables \
+        firewalld-filesystem \
+        fuse-devel \
+        gcc \
+        gdk-pixbuf2-devel \
+        gettext \
+        git \
+        glib2-devel \
+        glibc-devel \
+        glibc-langpack-en \
+        glusterfs-api-devel \
+        gnutls-devel \
+        gobject-introspection-devel \
+        grep \
+        gtk-doc \
+        gtk3-devel \
+        icoutils \
+        iproute \
+        iproute-tc \
+        iptables \
+        iscsi-initiator-utils \
+        kmod \
+        libacl-devel \
+        libattr-devel \
+        libblkid-devel \
+        libcap-ng-devel \
+        libcurl-devel \
+        libgcrypt-devel \
+        libiscsi-devel \
+        libnl3-devel \
+        libpcap-devel \
+        libpciaccess-devel \
+        librbd-devel \
+        libselinux-devel \
+        libssh-devel \
+        libssh2-devel \
+        libtirpc-devel \
+        libtool \
+        libwsman-devel \
+        libxml2 \
+        libxml2-devel \
+        libxslt \
+        lvm2 \
+        make \
+        meson \
+        netcf-devel \
+        nfs-utils \
+        ninja-build \
+        numactl-devel \
+        numad \
+        parted-devel \
+        perl \
+        pkgconfig \
+        polkit \
+        pulseaudio-libs-devel \
+        python3 \
+        python3-docutils \
+        python3-flake8 \
+        qemu-img \
+        readline-devel \
+        rpcgen \
+        rpm-build \
+        sanlock-devel \
+        scrub \
+        sed \
+        spice-gtk3-devel \
+        systemd-devel \
+        systemd-rpm-macros \
+        systemtap-sdt-devel \
+        vala \
+        vte291-devel \
+        wireshark-devel \
+        yajl-devel
+    rpm -qa | sort > /packages.txt
+    mkdir -p /usr/libexec/ccache-wrappers
+    ln -s /usr/bin/ccache /usr/libexec/ccache-wrappers/cc
+    ln -s /usr/bin/ccache /usr/libexec/ccache-wrappers/clang
+    ln -s /usr/bin/ccache /usr/libexec/ccache-wrappers/gcc
+}
+
+export CCACHE_WRAPPERSDIR="/usr/libexec/ccache-wrappers"
+export LANG="en_US.UTF-8"
+export MAKE="/usr/bin/make"
+export NINJA="/usr/bin/ninja"
+export PYTHON="/usr/bin/python3"
--- a/ci/buildenv/debian-10.sh
+++ b/ci/buildenv/debian-10.sh
@ -0,0 +1,51 @@
+# THIS FILE WAS AUTO-GENERATED
+#
+#  $ lcitool manifest ci/manifest.yml
+#
+# https://gitlab.com/libvirt/libvirt-ci
+
+function install_buildenv() {
+    export DEBIAN_FRONTEND=noninteractive
+    apt-get update
+    apt-get dist-upgrade -y
+    apt-get install --no-install-recommends -y \
+            bash-completion \
+            ca-certificates \
+            ccache \
+            gcc \
+            gettext \
+            git \
+            icoutils \
+            libglib2.0-dev \
+            libgovirt-dev \
+            libgtk-3-dev \
+            libgtk-vnc-2.0-dev \
+            librest-dev \
+            libspice-client-gtk-3.0-dev \
+            libtool \
+            libtool-bin \
+            libvirt-dev \
+            libvirt-glib-1.0-dev \
+            libvte-2.91-dev \
+            libxml2-dev \
+            libxml2-utils \
+            locales \
+            make \
+            ninja-build \
+            pkgconf \
+            python3-pip \
+            python3-setuptools \
+            python3-wheel
+    sed -Ei 's,^# (en_US\.UTF-8 .*)$,\1,' /etc/locale.gen
+    dpkg-reconfigure locales
+    dpkg-query --showformat '${Package}_${Version}_${Architecture}\n' --show > /packages.txt
+    mkdir -p /usr/libexec/ccache-wrappers
+    ln -s /usr/bin/ccache /usr/libexec/ccache-wrappers/cc
+    ln -s /usr/bin/ccache /usr/libexec/ccache-wrappers/gcc
+    /usr/bin/pip3 install meson==0.56.0
+}
+
+export CCACHE_WRAPPERSDIR="/usr/libexec/ccache-wrappers"
+export LANG="en_US.UTF-8"
+export MAKE="/usr/bin/make"
+export NINJA="/usr/bin/ninja"
--- a/ci/buildenv/debian-sid.sh
+++ b/ci/buildenv/debian-sid.sh
@ -0,0 +1,48 @@
+# THIS FILE WAS AUTO-GENERATED
+#
+#  $ lcitool manifest ci/manifest.yml
+#
+# https://gitlab.com/libvirt/libvirt-ci
+
+function install_buildenv() {
+    export DEBIAN_FRONTEND=noninteractive
+    apt-get update
+    apt-get dist-upgrade -y
+    apt-get install --no-install-recommends -y \
+            bash-completion \
+            ca-certificates \
+            ccache \
+            gcc \
+            gettext \
+            git \
+            icoutils \
+            libglib2.0-dev \
+            libgovirt-dev \
+            libgtk-3-dev \
+            libgtk-vnc-2.0-dev \
+            librest-dev \
+            libspice-client-gtk-3.0-dev \
+            libtool \
+            libtool-bin \
+            libvirt-dev \
+            libvirt-glib-1.0-dev \
+            libvte-2.91-dev \
+            libxml2-dev \
+            libxml2-utils \
+            locales \
+            make \
+            meson \
+            ninja-build \
+            pkgconf
+    sed -Ei 's,^# (en_US\.UTF-8 .*)$,\1,' /etc/locale.gen
+    dpkg-reconfigure locales
+    dpkg-query --showformat '${Package}_${Version}_${Architecture}\n' --show > /packages.txt
+    mkdir -p /usr/libexec/ccache-wrappers
+    ln -s /usr/bin/ccache /usr/libexec/ccache-wrappers/cc
+    ln -s /usr/bin/ccache /usr/libexec/ccache-wrappers/gcc
+}
+
+export CCACHE_WRAPPERSDIR="/usr/libexec/ccache-wrappers"
+export LANG="en_US.UTF-8"
+export MAKE="/usr/bin/make"
+export NINJA="/usr/bin/ninja"
--- a/ci/buildenv/fedora-35.sh
+++ b/ci/buildenv/fedora-35.sh
@ -0,0 +1,45 @@
+# THIS FILE WAS AUTO-GENERATED
+#
+#  $ lcitool manifest ci/manifest.yml
+#
+# https://gitlab.com/libvirt/libvirt-ci
+
+function install_buildenv() {
+    dnf update -y
+    dnf install -y \
+        bash-completion \
+        ca-certificates \
+        ccache \
+        cppi \
+        gcc \
+        gettext \
+        git \
+        glib2-devel \
+        glibc-langpack-en \
+        gtk-vnc2-devel \
+        gtk3-devel \
+        icoutils \
+        libgovirt-devel \
+        libtool \
+        libvirt-devel \
+        libvirt-gobject-devel \
+        libxml2 \
+        libxml2-devel \
+        make \
+        meson \
+        ninja-build \
+        pkgconfig \
+        rest-devel \
+        rpm-build \
+        spice-gtk3-devel \
+        vte291-devel
+    rpm -qa | sort > /packages.txt
+    mkdir -p /usr/libexec/ccache-wrappers
+    ln -s /usr/bin/ccache /usr/libexec/ccache-wrappers/cc
+    ln -s /usr/bin/ccache /usr/libexec/ccache-wrappers/gcc
+}
+
+export CCACHE_WRAPPERSDIR="/usr/libexec/ccache-wrappers"
+export LANG="en_US.UTF-8"
+export MAKE="/usr/bin/make"
+export NINJA="/usr/bin/ninja"
--- a/ci/buildenv/fedora-36.sh
+++ b/ci/buildenv/fedora-36.sh
@ -0,0 +1,45 @@
+# THIS FILE WAS AUTO-GENERATED
+#
+#  $ lcitool manifest ci/manifest.yml
+#
+# https://gitlab.com/libvirt/libvirt-ci
+
+function install_buildenv() {
+    dnf update -y
+    dnf install -y \
+        bash-completion \
+        ca-certificates \
+        ccache \
+        cppi \
+        gcc \
+        gettext \
+        git \
+        glib2-devel \
+        glibc-langpack-en \
+        gtk-vnc2-devel \
+        gtk3-devel \
+        icoutils \
+        libgovirt-devel \
+        libtool \
+        libvirt-devel \
+        libvirt-gobject-devel \
+        libxml2 \
+        libxml2-devel \
+        make \
+        meson \
+        ninja-build \
+        pkgconfig \
+        rest-devel \
+        rpm-build \
+        spice-gtk3-devel \
+        vte291-devel
+    rpm -qa | sort > /packages.txt
+    mkdir -p /usr/libexec/ccache-wrappers
+    ln -s /usr/bin/ccache /usr/libexec/ccache-wrappers/cc
+    ln -s /usr/bin/ccache /usr/libexec/ccache-wrappers/gcc
+}
+
+export CCACHE_WRAPPERSDIR="/usr/libexec/ccache-wrappers"
+export LANG="en_US.UTF-8"
+export MAKE="/usr/bin/make"
+export NINJA="/usr/bin/ninja"
--- a/ci/buildenv/fedora-rawhide-cross-mingw32.sh
+++ b/ci/buildenv/fedora-rawhide-cross-mingw32.sh
@ -0,0 +1,50 @@
+# THIS FILE WAS AUTO-GENERATED
+#
+#  $ lcitool manifest ci/manifest.yml
+#
+# https://gitlab.com/libvirt/libvirt-ci
+
+function install_buildenv() {
+    dnf update -y --nogpgcheck fedora-gpg-keys
+    dnf distro-sync -y
+    dnf install -y \
+        bash-completion \
+        ca-certificates \
+        ccache \
+        cppi \
+        git \
+        glibc-langpack-en \
+        gtk-vnc2-devel \
+        icoutils \
+        libtool \
+        libxml2 \
+        make \
+        meson \
+        ninja-build \
+        rpm-build
+    dnf install -y \
+        mingw32-gcc \
+        mingw32-gettext \
+        mingw32-glib2 \
+        mingw32-gstreamer1-plugins-bad-free \
+        mingw32-gstreamer1-plugins-good \
+        mingw32-gtk3 \
+        mingw32-libgovirt \
+        mingw32-libvirt \
+        mingw32-libxml2 \
+        mingw32-pkg-config \
+        mingw32-rest \
+        mingw32-spice-gtk3
+    rpm -qa | sort > /packages.txt
+    mkdir -p /usr/libexec/ccache-wrappers
+    ln -s /usr/bin/ccache /usr/libexec/ccache-wrappers/i686-w64-mingw32-cc
+    ln -s /usr/bin/ccache /usr/libexec/ccache-wrappers/i686-w64-mingw32-gcc
+}
+
+export CCACHE_WRAPPERSDIR="/usr/libexec/ccache-wrappers"
+export LANG="en_US.UTF-8"
+export MAKE="/usr/bin/make"
+export NINJA="/usr/bin/ninja"
+
+export ABI="i686-w64-mingw32"
+export MESON_OPTS="--cross-file=/usr/share/mingw/toolchain-mingw32.meson"
--- a/ci/buildenv/fedora-rawhide-cross-mingw64.sh
+++ b/ci/buildenv/fedora-rawhide-cross-mingw64.sh
@ -0,0 +1,50 @@
+# THIS FILE WAS AUTO-GENERATED
+#
+#  $ lcitool manifest ci/manifest.yml
+#
+# https://gitlab.com/libvirt/libvirt-ci
+
+function install_buildenv() {
+    dnf update -y --nogpgcheck fedora-gpg-keys
+    dnf distro-sync -y
+    dnf install -y \
+        bash-completion \
+        ca-certificates \
+        ccache \
+        cppi \
+        git \
+        glibc-langpack-en \
+        gtk-vnc2-devel \
+        icoutils \
+        libtool \
+        libxml2 \
+        make \
+        meson \
+        ninja-build \
+        rpm-build
+    dnf install -y \
+        mingw64-gcc \
+        mingw64-gettext \
+        mingw64-glib2 \
+        mingw64-gstreamer1-plugins-bad-free \
+        mingw64-gstreamer1-plugins-good \
+        mingw64-gtk3 \
+        mingw64-libgovirt \
+        mingw64-libvirt \
+        mingw64-libxml2 \
+        mingw64-pkg-config \
+        mingw64-rest \
+        mingw64-spice-gtk3
+    rpm -qa | sort > /packages.txt
+    mkdir -p /usr/libexec/ccache-wrappers
+    ln -s /usr/bin/ccache /usr/libexec/ccache-wrappers/x86_64-w64-mingw32-cc
+    ln -s /usr/bin/ccache /usr/libexec/ccache-wrappers/x86_64-w64-mingw32-gcc
+}
+
+export CCACHE_WRAPPERSDIR="/usr/libexec/ccache-wrappers"
+export LANG="en_US.UTF-8"
+export MAKE="/usr/bin/make"
+export NINJA="/usr/bin/ninja"
+
+export ABI="x86_64-w64-mingw32"
+export MESON_OPTS="--cross-file=/usr/share/mingw/toolchain-mingw64.meson"
--- a/ci/buildenv/fedora-rawhide.sh
+++ b/ci/buildenv/fedora-rawhide.sh
@ -0,0 +1,46 @@
+# THIS FILE WAS AUTO-GENERATED
+#
+#  $ lcitool manifest ci/manifest.yml
+#
+# https://gitlab.com/libvirt/libvirt-ci
+
+function install_buildenv() {
+    dnf update -y --nogpgcheck fedora-gpg-keys
+    dnf distro-sync -y
+    dnf install -y \
+        bash-completion \
+        ca-certificates \
+        ccache \
+        cppi \
+        gcc \
+        gettext \
+        git \
+        glib2-devel \
+        glibc-langpack-en \
+        gtk-vnc2-devel \
+        gtk3-devel \
+        icoutils \
+        libgovirt-devel \
+        libtool \
+        libvirt-devel \
+        libvirt-gobject-devel \
+        libxml2 \
+        libxml2-devel \
+        make \
+        meson \
+        ninja-build \
+        pkgconfig \
+        rest-devel \
+        rpm-build \
+        spice-gtk3-devel \
+        vte291-devel
+    rpm -qa | sort > /packages.txt
+    mkdir -p /usr/libexec/ccache-wrappers
+    ln -s /usr/bin/ccache /usr/libexec/ccache-wrappers/cc
+    ln -s /usr/bin/ccache /usr/libexec/ccache-wrappers/gcc
+}
+
+export CCACHE_WRAPPERSDIR="/usr/libexec/ccache-wrappers"
+export LANG="en_US.UTF-8"
+export MAKE="/usr/bin/make"
+export NINJA="/usr/bin/ninja"
--- a/ci/buildenv/opensuse-leap-153.sh
+++ b/ci/buildenv/opensuse-leap-153.sh
@ -0,0 +1,48 @@
+# THIS FILE WAS AUTO-GENERATED
+#
+#  $ lcitool manifest ci/manifest.yml
+#
+# https://gitlab.com/libvirt/libvirt-ci
+
+function install_buildenv() {
+    zypper update -y
+    zypper install -y \
+           bash-completion \
+           ca-certificates \
+           ccache \
+           cppi \
+           gcc \
+           gettext-runtime \
+           git \
+           glib2-devel \
+           glibc-locale \
+           gtk-vnc-devel \
+           gtk3-devel \
+           icoutils \
+           libgovirt-devel \
+           librest-devel \
+           libtool \
+           libvirt-devel \
+           libvirt-glib-devel \
+           libxml2 \
+           libxml2-devel \
+           make \
+           ninja \
+           pkgconfig \
+           python3-pip \
+           python3-setuptools \
+           python3-wheel \
+           rpm-build \
+           spice-gtk-devel \
+           vte-devel
+    rpm -qa | sort > /packages.txt
+    mkdir -p /usr/libexec/ccache-wrappers
+    ln -s /usr/bin/ccache /usr/libexec/ccache-wrappers/cc
+    ln -s /usr/bin/ccache /usr/libexec/ccache-wrappers/gcc
+    /usr/bin/pip3 install meson==0.56.0
+}
+
+export CCACHE_WRAPPERSDIR="/usr/libexec/ccache-wrappers"
+export LANG="en_US.UTF-8"
+export MAKE="/usr/bin/make"
+export NINJA="/usr/bin/ninja"
--- a/ci/buildenv/opensuse-tumbleweed.sh
+++ b/ci/buildenv/opensuse-tumbleweed.sh
@ -0,0 +1,45 @@
+# THIS FILE WAS AUTO-GENERATED
+#
+#  $ lcitool manifest ci/manifest.yml
+#
+# https://gitlab.com/libvirt/libvirt-ci
+
+function install_buildenv() {
+    zypper dist-upgrade -y
+    zypper install -y \
+           bash-completion \
+           ca-certificates \
+           ccache \
+           cppi \
+           gcc \
+           gettext-runtime \
+           git \
+           glib2-devel \
+           glibc-locale \
+           gtk-vnc-devel \
+           gtk3-devel \
+           icoutils \
+           libgovirt-devel \
+           librest-devel \
+           libtool \
+           libvirt-devel \
+           libvirt-glib-devel \
+           libxml2 \
+           libxml2-devel \
+           make \
+           meson \
+           ninja \
+           pkgconfig \
+           rpm-build \
+           spice-gtk-devel \
+           vte-devel
+    rpm -qa | sort > /packages.txt
+    mkdir -p /usr/libexec/ccache-wrappers
+    ln -s /usr/bin/ccache /usr/libexec/ccache-wrappers/cc
+    ln -s /usr/bin/ccache /usr/libexec/ccache-wrappers/gcc
+}
+
+export CCACHE_WRAPPERSDIR="/usr/libexec/ccache-wrappers"
+export LANG="en_US.UTF-8"
+export MAKE="/usr/bin/make"
+export NINJA="/usr/bin/ninja"
--- a/ci/buildenv/ubuntu-2004.sh
+++ b/ci/buildenv/ubuntu-2004.sh
@ -0,0 +1,50 @@
+# THIS FILE WAS AUTO-GENERATED
+#
+#  $ lcitool manifest ci/manifest.yml
+#
+# https://gitlab.com/libvirt/libvirt-ci
+
+function install_buildenv() {
+    export DEBIAN_FRONTEND=noninteractive
+    apt-get update
+    apt-get dist-upgrade -y
+    apt-get install --no-install-recommends -y \
+            bash-completion \
+            ca-certificates \
+            ccache \
+            gcc \
+            gettext \
+            git \
+            icoutils \
+            libglib2.0-dev \
+            libgtk-3-dev \
+            libgtk-vnc-2.0-dev \
+            librest-dev \
+            libspice-client-gtk-3.0-dev \
+            libtool \
+            libtool-bin \
+            libvirt-dev \
+            libvirt-glib-1.0-dev \
+            libvte-2.91-dev \
+            libxml2-dev \
+            libxml2-utils \
+            locales \
+            make \
+            ninja-build \
+            pkgconf \
+            python3-pip \
+            python3-setuptools \
+            python3-wheel
+    sed -Ei 's,^# (en_US\.UTF-8 .*)$,\1,' /etc/locale.gen
+    dpkg-reconfigure locales
+    dpkg-query --showformat '${Package}_${Version}_${Architecture}\n' --show > /packages.txt
+    mkdir -p /usr/libexec/ccache-wrappers
+    ln -s /usr/bin/ccache /usr/libexec/ccache-wrappers/cc
+    ln -s /usr/bin/ccache /usr/libexec/ccache-wrappers/gcc
+    /usr/bin/pip3 install meson==0.56.0
+}
+
+export CCACHE_WRAPPERSDIR="/usr/libexec/ccache-wrappers"
+export LANG="en_US.UTF-8"
+export MAKE="/usr/bin/make"
+export NINJA="/usr/bin/ninja"
--- a/ci/buildenv/ubuntu-2204.sh
+++ b/ci/buildenv/ubuntu-2204.sh
@ -0,0 +1,47 @@
+# THIS FILE WAS AUTO-GENERATED
+#
+#  $ lcitool manifest ci/manifest.yml
+#
+# https://gitlab.com/libvirt/libvirt-ci
+
+function install_buildenv() {
+    export DEBIAN_FRONTEND=noninteractive
+    apt-get update
+    apt-get dist-upgrade -y
+    apt-get install --no-install-recommends -y \
+            bash-completion \
+            ca-certificates \
+            ccache \
+            gcc \
+            gettext \
+            git \
+            icoutils \
+            libglib2.0-dev \
+            libgtk-3-dev \
+            libgtk-vnc-2.0-dev \
+            librest-dev \
+            libspice-client-gtk-3.0-dev \
+            libtool \
+            libtool-bin \
+            libvirt-dev \
+            libvirt-glib-1.0-dev \
+            libvte-2.91-dev \
+            libxml2-dev \
+            libxml2-utils \
+            locales \
+            make \
+            meson \
+            ninja-build \
+            pkgconf
+    sed -Ei 's,^# (en_US\.UTF-8 .*)$,\1,' /etc/locale.gen
+    dpkg-reconfigure locales
+    dpkg-query --showformat '${Package}_${Version}_${Architecture}\n' --show > /packages.txt
+    mkdir -p /usr/libexec/ccache-wrappers
+    ln -s /usr/bin/ccache /usr/libexec/ccache-wrappers/cc
+    ln -s /usr/bin/ccache /usr/libexec/ccache-wrappers/gcc
+}
+
+export CCACHE_WRAPPERSDIR="/usr/libexec/ccache-wrappers"
+export LANG="en_US.UTF-8"
+export MAKE="/usr/bin/make"
+export NINJA="/usr/bin/ninja"
--- a/ci/containers/centos-stream-8.Dockerfile
+++ b/ci/containers/centos-stream-8.Dockerfile
@ -91,6 +91,7 @@ RUN dnf distro-sync -y && \
        sed \
        spice-gtk3-devel \
        systemd-devel \
+        systemd-rpm-macros \
        systemtap-sdt-devel \
        vala \
        vte291-devel \
@ -104,8 +105,8 @@ RUN dnf distro-sync -y && \
    ln -s /usr/bin/ccache /usr/libexec/ccache-wrappers/clang && \
    ln -s /usr/bin/ccache /usr/libexec/ccache-wrappers/gcc

+ENV CCACHE_WRAPPERSDIR "/usr/libexec/ccache-wrappers"
 ENV LANG "en_US.UTF-8"
 ENV MAKE "/usr/bin/make"
 ENV NINJA "/usr/bin/ninja"
 ENV PYTHON "/usr/bin/python3"
-ENV CCACHE_WRAPPERSDIR "/usr/libexec/ccache-wrappers"
--- a/ci/containers/debian-10.Dockerfile
+++ b/ci/containers/debian-10.Dockerfile
@ -49,7 +49,7 @@ RUN export DEBIAN_FRONTEND=noninteractive && \

 RUN /usr/bin/pip3 install meson==0.56.0

+ENV CCACHE_WRAPPERSDIR "/usr/libexec/ccache-wrappers"
 ENV LANG "en_US.UTF-8"
 ENV MAKE "/usr/bin/make"
 ENV NINJA "/usr/bin/ninja"
-ENV CCACHE_WRAPPERSDIR "/usr/libexec/ccache-wrappers"
--- a/ci/containers/debian-sid.Dockerfile
+++ b/ci/containers/debian-sid.Dockerfile
@ -45,7 +45,7 @@ RUN export DEBIAN_FRONTEND=noninteractive && \
    ln -s /usr/bin/ccache /usr/libexec/ccache-wrappers/cc && \
    ln -s /usr/bin/ccache /usr/libexec/ccache-wrappers/gcc

+ENV CCACHE_WRAPPERSDIR "/usr/libexec/ccache-wrappers"
 ENV LANG "en_US.UTF-8"
 ENV MAKE "/usr/bin/make"
 ENV NINJA "/usr/bin/ninja"
-ENV CCACHE_WRAPPERSDIR "/usr/libexec/ccache-wrappers"
--- a/ci/containers/fedora-35.Dockerfile
+++ b/ci/containers/fedora-35.Dockerfile
@ -51,7 +51,7 @@ exec "$@"' > /usr/bin/nosync && \
    ln -s /usr/bin/ccache /usr/libexec/ccache-wrappers/cc && \
    ln -s /usr/bin/ccache /usr/libexec/ccache-wrappers/gcc

+ENV CCACHE_WRAPPERSDIR "/usr/libexec/ccache-wrappers"
 ENV LANG "en_US.UTF-8"
 ENV MAKE "/usr/bin/make"
 ENV NINJA "/usr/bin/ninja"
-ENV CCACHE_WRAPPERSDIR "/usr/libexec/ccache-wrappers"
--- a/ci/containers/fedora-36.Dockerfile
+++ b/ci/containers/fedora-36.Dockerfile
@ -51,7 +51,7 @@ exec "$@"' > /usr/bin/nosync && \
    ln -s /usr/bin/ccache /usr/libexec/ccache-wrappers/cc && \
    ln -s /usr/bin/ccache /usr/libexec/ccache-wrappers/gcc

+ENV CCACHE_WRAPPERSDIR "/usr/libexec/ccache-wrappers"
 ENV LANG "en_US.UTF-8"
 ENV MAKE "/usr/bin/make"
 ENV NINJA "/usr/bin/ninja"
-ENV CCACHE_WRAPPERSDIR "/usr/libexec/ccache-wrappers"
--- a/ci/containers/fedora-rawhide-cross-mingw32.Dockerfile
+++ b/ci/containers/fedora-rawhide-cross-mingw32.Dockerfile
@ -36,10 +36,10 @@ exec "$@"' > /usr/bin/nosync && \
    nosync dnf autoremove -y && \
    nosync dnf clean all -y

+ENV CCACHE_WRAPPERSDIR "/usr/libexec/ccache-wrappers"
 ENV LANG "en_US.UTF-8"
 ENV MAKE "/usr/bin/make"
 ENV NINJA "/usr/bin/ninja"
-ENV CCACHE_WRAPPERSDIR "/usr/libexec/ccache-wrappers"

 RUN nosync dnf install -y \
               mingw32-gcc \
--- a/ci/containers/fedora-rawhide-cross-mingw64.Dockerfile
+++ b/ci/containers/fedora-rawhide-cross-mingw64.Dockerfile
@ -36,10 +36,10 @@ exec "$@"' > /usr/bin/nosync && \
    nosync dnf autoremove -y && \
    nosync dnf clean all -y

+ENV CCACHE_WRAPPERSDIR "/usr/libexec/ccache-wrappers"
 ENV LANG "en_US.UTF-8"
 ENV MAKE "/usr/bin/make"
 ENV NINJA "/usr/bin/ninja"
-ENV CCACHE_WRAPPERSDIR "/usr/libexec/ccache-wrappers"

 RUN nosync dnf install -y \
               mingw64-gcc \
--- a/ci/containers/fedora-rawhide.Dockerfile
+++ b/ci/containers/fedora-rawhide.Dockerfile
@ -52,7 +52,7 @@ exec "$@"' > /usr/bin/nosync && \
    ln -s /usr/bin/ccache /usr/libexec/ccache-wrappers/cc && \
    ln -s /usr/bin/ccache /usr/libexec/ccache-wrappers/gcc

+ENV CCACHE_WRAPPERSDIR "/usr/libexec/ccache-wrappers"
 ENV LANG "en_US.UTF-8"
 ENV MAKE "/usr/bin/make"
 ENV NINJA "/usr/bin/ninja"
-ENV CCACHE_WRAPPERSDIR "/usr/libexec/ccache-wrappers"
--- a/ci/containers/opensuse-leap-153.Dockerfile
+++ b/ci/containers/opensuse-leap-153.Dockerfile
@ -44,7 +44,7 @@ RUN zypper update -y && \

 RUN /usr/bin/pip3 install meson==0.56.0

+ENV CCACHE_WRAPPERSDIR "/usr/libexec/ccache-wrappers"
 ENV LANG "en_US.UTF-8"
 ENV MAKE "/usr/bin/make"
 ENV NINJA "/usr/bin/ninja"
-ENV CCACHE_WRAPPERSDIR "/usr/libexec/ccache-wrappers"
--- a/ci/containers/opensuse-tumbleweed.Dockerfile
+++ b/ci/containers/opensuse-tumbleweed.Dockerfile
@ -40,7 +40,7 @@ RUN zypper dist-upgrade -y && \
    ln -s /usr/bin/ccache /usr/libexec/ccache-wrappers/cc && \
    ln -s /usr/bin/ccache /usr/libexec/ccache-wrappers/gcc

+ENV CCACHE_WRAPPERSDIR "/usr/libexec/ccache-wrappers"
 ENV LANG "en_US.UTF-8"
 ENV MAKE "/usr/bin/make"
 ENV NINJA "/usr/bin/ninja"
-ENV CCACHE_WRAPPERSDIR "/usr/libexec/ccache-wrappers"
--- a/ci/containers/ubuntu-2004.Dockerfile
+++ b/ci/containers/ubuntu-2004.Dockerfile
@ -48,7 +48,7 @@ RUN export DEBIAN_FRONTEND=noninteractive && \

 RUN /usr/bin/pip3 install meson==0.56.0

+ENV CCACHE_WRAPPERSDIR "/usr/libexec/ccache-wrappers"
 ENV LANG "en_US.UTF-8"
 ENV MAKE "/usr/bin/make"
 ENV NINJA "/usr/bin/ninja"
-ENV CCACHE_WRAPPERSDIR "/usr/libexec/ccache-wrappers"
--- a/ci/containers/ubuntu-2204.Dockerfile
+++ b/ci/containers/ubuntu-2204.Dockerfile
@ -44,7 +44,7 @@ RUN export DEBIAN_FRONTEND=noninteractive && \
    ln -s /usr/bin/ccache /usr/libexec/ccache-wrappers/cc && \
    ln -s /usr/bin/ccache /usr/libexec/ccache-wrappers/gcc

+ENV CCACHE_WRAPPERSDIR "/usr/libexec/ccache-wrappers"
 ENV LANG "en_US.UTF-8"
 ENV MAKE "/usr/bin/make"
 ENV NINJA "/usr/bin/ninja"
-ENV CCACHE_WRAPPERSDIR "/usr/libexec/ccache-wrappers"
--- a/ci/gitlab.yml
+++ b/ci/gitlab.yml
@ -8,24 +8,72 @@
 # Variables that can be set to control the behaviour of
 # pipelines that are run
 #
-#  - RUN_ALL_CONTAINERS - build all containers
-#    even if they don't have any changes detected
+#  - RUN_PIPELINE - force creation of a CI pipeline when
+#    pushing to a branch in a forked repository. Official
+#    CI pipelines are triggered when merge requests are
+#    created/updated. Setting this variable to a non-empty
+#    value allows CI testing prior to opening a merge request.
+#
+#  - RUN_CONTAINER_BUILDS - CI pipelines in upstream only
+#    publish containers if CI file changes are detected.
+#    Setting this variable to a non-empty value will force
+#    re-publishing, even when no file changes are detected.
+#    Typically to use from a scheduled job once a month.
+#
+#  - RUN_UPSTREAM_NAMESPACE - the upstream namespace is
+#    configured to default to 'virt-viewer'. When testing
+#    changes to CI it might be useful to use a different
+#    upstream. Setting this variable will override the
+#    namespace considered to be upstream.
 #
 # These can be set as git push options
 #
-#  $ git push -o ci.variable=RUN_ALL_CONTAINERS=1
+#  $ git push -o ci.variable=RUN_PIPELINE=1
 #
 # Aliases can be set for common usage
 #
-#  $ git config --local alias.push-all-ctr "push -o ci.variable=RUN_ALL_CONTAINERS=1"
+#  $ git config --local alias.push-ci "push -o ci.variable=RUN_PIPELINE=1"
 #
 # Allowing the less verbose invocation
 #
-#  $ git push-all-ctr
+#  $ git push-ci
 #
 # Pipeline variables can also be set in the repository
 # pipeline config globally, or set against scheduled pipelines

+
+variables:
+  RUN_UPSTREAM_NAMESPACE: virt-viewer
+
+
+workflow:
+  rules:
+    # upstream+forks: Avoid duplicate pipelines on pushes, if a MR is open
+    - if: '$CI_PIPELINE_SOURCE == "push" && $CI_OPEN_MERGE_REQUESTS'
+      when: never
+
+    # upstream+forks: Avoid pipelines on tag pushes
+    - if: '$CI_PIPELINE_SOURCE == "push" && $CI_COMMIT_TAG'
+      when: never
+
+    # upstream+forks: Allow pipelines in scenarios we've figured out job rules
+    - if: '$CI_PIPELINE_SOURCE =~ /^(push|merge_request_event|api|web|schedule)$/'
+      when: always
+
+    # upstream+forks: Avoid all other pipelines
+    - when: never
+
+
+debug:
+  image: docker.io/library/alpine:3
+  stage: sanity_checks
+  needs: []
+  script:
+    - printenv | sort
+  rules:
+    - if: '$RUN_DEBUG'
+      when: always
+
 include:
  - local: '/ci/gitlab/container-templates.yml'
  - local: '/ci/gitlab/build-templates.yml'
--- a/ci/gitlab/build-templates.yml
+++ b/ci/gitlab/build-templates.yml
@ -5,25 +5,225 @@
 # https://gitlab.com/libvirt/libvirt-ci


-.gitlab_native_build_job:
-  image: $CI_REGISTRY_IMAGE/ci-$NAME:latest
+#
+# We use pre-built containers for any pipelines that are:
+#
+#  - Validating code committed on default upstream branch
+#  - Validating patches targetting default upstream branch
+#    which do not have CI changes
+#
+# We use a local build env for any pipelines that are:
+#
+#  - Validating code committed to a non-default upstream branch
+#  - Validating patches targetting a non-default upstream branch
+#  - Validating patches targetting default upstream branch which
+#    include CI changes
+#  - Validating code committed to a fork branch
+#
+# Note: the rules across the prebuilt_env and local_env templates
+# should be logical inverses, such that jobs are mutually exclusive
+#
+.gitlab_native_build_job_prebuilt_env:
+  image: $CI_REGISTRY/$RUN_UPSTREAM_NAMESPACE/virt-viewer/ci-$NAME:latest
  stage: builds
+  before_script:
+    - cat /packages.txt
  rules:
-    - if: '$CI_PIPELINE_SOURCE == "merge_request_event"'
-      when: never
-    - if: '$JOB_OPTIONAL'
+    # upstream: pushes to the default branch
+    - if: '$CI_PROJECT_NAMESPACE == $RUN_UPSTREAM_NAMESPACE && $CI_PIPELINE_SOURCE == "push" && $CI_COMMIT_BRANCH == $CI_DEFAULT_BRANCH && $JOB_OPTIONAL'
      when: manual
      allow_failure: true
-    - when: on_success
+    - if: '$CI_PROJECT_NAMESPACE == $RUN_UPSTREAM_NAMESPACE && $CI_PIPELINE_SOURCE == "push" && $CI_COMMIT_BRANCH == $CI_DEFAULT_BRANCH'
+      when: on_success

-
-.gitlab_cross_build_job:
-  image: $CI_REGISTRY_IMAGE/ci-$NAME-cross-$CROSS:latest
-  stage: builds
-  rules:
-    - if: '$CI_PIPELINE_SOURCE == "merge_request_event"'
-      when: never
-    - if: '$JOB_OPTIONAL'
+    # upstream: other web/api/scheduled pipelines targetting the default branch
+    - if: '$CI_PROJECT_NAMESPACE == $RUN_UPSTREAM_NAMESPACE && $CI_PIPELINE_SOURCE =~ /(web|api|schedule)/ && $CI_COMMIT_REF_NAME == $CI_DEFAULT_BRANCH && $JOB_OPTIONAL'
      when: manual
      allow_failure: true
-    - when: on_success
+    - if: '$CI_PROJECT_NAMESPACE == $RUN_UPSTREAM_NAMESPACE && $CI_PIPELINE_SOURCE =~ /(web|api|schedule)/ && $CI_COMMIT_REF_NAME == $CI_DEFAULT_BRANCH'
+      when: on_success
+
+    # upstream+forks: merge requests targetting the default branch, without CI changes
+    - if: '$CI_PIPELINE_SOURCE == "merge_request_event" && $CI_MERGE_REQUEST_TARGET_BRANCH_NAME == $CI_DEFAULT_BRANCH'
+      changes:
+        - ci/gitlab/container-templates.yml
+        - ci/containers/$NAME.Dockerfile
+      when: never
+    - if: '$CI_PIPELINE_SOURCE == "merge_request_event" && $CI_MERGE_REQUEST_TARGET_BRANCH_NAME == $CI_DEFAULT_BRANCH && $JOB_OPTIONAL'
+      when: manual
+      allow_failure: true
+    - if: '$CI_PIPELINE_SOURCE == "merge_request_event" && $CI_MERGE_REQUEST_TARGET_BRANCH_NAME == $CI_DEFAULT_BRANCH'
+      when: on_success
+
+    # upstream+forks: that's all folks
+    - when: never
+
+.gitlab_native_build_job_local_env:
+  image: $IMAGE
+  stage: builds
+  before_script:
+    - source ci/buildenv/$NAME.sh
+    - install_buildenv
+    - cat /packages.txt
+  rules:
+    # upstream: pushes to a non-default branch
+    - if: '$CI_PROJECT_NAMESPACE == $RUN_UPSTREAM_NAMESPACE && $CI_PIPELINE_SOURCE == "push" && $CI_COMMIT_BRANCH != $CI_DEFAULT_BRANCH && $JOB_OPTIONAL'
+      when: manual
+      allow_failure: true
+    - if: '$CI_PROJECT_NAMESPACE == $RUN_UPSTREAM_NAMESPACE && $CI_PIPELINE_SOURCE == "push" && $CI_COMMIT_BRANCH != $CI_DEFAULT_BRANCH'
+      when: on_success
+
+    - if: '$CI_PROJECT_NAMESPACE != $RUN_UPSTREAM_NAMESPACE && $CI_PIPELINE_SOURCE == "push" && $RUN_PIPELINE && $JOB_OPTIONAL'
+      when: manual
+      allow_failure: true
+    - if: '$CI_PROJECT_NAMESPACE != $RUN_UPSTREAM_NAMESPACE && $CI_PIPELINE_SOURCE == "push" && $RUN_PIPELINE'
+      when: on_success
+
+    # upstream: other web/api/scheduled pipelines targetting non-default branches
+    - if: '$CI_PROJECT_NAMESPACE == $RUN_UPSTREAM_NAMESPACE && $CI_PIPELINE_SOURCE =~ /(web|api|schedule)/ && $CI_COMMIT_REF_NAME != $CI_DEFAULT_BRANCH && $JOB_OPTIONAL'
+      when: manual
+      allow_failure: true
+    - if: '$CI_PROJECT_NAMESPACE == $RUN_UPSTREAM_NAMESPACE && $CI_PIPELINE_SOURCE =~ /(web|api|schedule)/ && $CI_COMMIT_REF_NAME != $CI_DEFAULT_BRANCH'
+      when: on_success
+
+    # forks: other web/api/scheduled pipelines
+    - if: '$CI_PROJECT_NAMESPACE != $RUN_UPSTREAM_NAMESPACE && $CI_PIPELINE_SOURCE =~ /(web|api|schedule)/ && $JOB_OPTIONAL'
+      when: manual
+      allow_failure: true
+    - if: '$CI_PROJECT_NAMESPACE != $RUN_UPSTREAM_NAMESPACE && $CI_PIPELINE_SOURCE =~ /(web|api|schedule)/'
+      when: on_success
+
+    # upstream+forks: merge requests targetting the default branch, with CI changes
+    - if: '$CI_PIPELINE_SOURCE == "merge_request_event" && $CI_MERGE_REQUEST_TARGET_BRANCH_NAME == $CI_DEFAULT_BRANCH && $JOB_OPTIONAL'
+      changes:
+        - ci/gitlab/container-templates.yml
+        - ci/containers/$NAME.Dockerfile
+      when: manual
+      allow_failure: true
+    - if: '$CI_PIPELINE_SOURCE == "merge_request_event" && $CI_MERGE_REQUEST_TARGET_BRANCH_NAME == $CI_DEFAULT_BRANCH'
+      changes:
+        - ci/gitlab/container-templates.yml
+        - ci/containers/$NAME.Dockerfile
+      when: on_success
+
+    # upstream+forks: merge requests targetting non-default branches
+    - if: '$CI_PIPELINE_SOURCE == "merge_request_event" && $CI_MERGE_REQUEST_TARGET_BRANCH_NAME != $CI_DEFAULT_BRANCH && $JOB_OPTIONAL'
+      when: manual
+      allow_failure: true
+    - if: '$CI_PIPELINE_SOURCE == "merge_request_event" && $CI_MERGE_REQUEST_TARGET_BRANCH_NAME != $CI_DEFAULT_BRANCH'
+      when: on_success
+
+    # upstream+forks: that's all folks
+    - when: never
+
+
+#
+# We use pre-built containers for any pipelines that are:
+#
+#  - Validating code committed on default upstream branch
+#  - Validating patches targetting default upstream branch
+#    which do not have CI changes
+#
+# We use a local build env for any pipelines that are:
+#
+#  - Validating code committed to a non-default upstream branch
+#  - Validating patches targetting a non-default upstream branch
+#  - Validating patches targetting default upstream branch which
+#    include CI changes
+#  - Validating code committed to a fork branch
+#
+# Note: the rules across the prebuilt_env and local_env templates
+# should be logical inverses, such that jobs are mutually exclusive
+#
+.gitlab_cross_build_job_prebuilt_env:
+  image: $CI_REGISTRY/$RUN_UPSTREAM_NAMESPACE/virt-viewer/ci-$NAME-cross-$CROSS:latest
+  stage: builds
+  before_script:
+    - cat /packages.txt
+  rules:
+    # upstream: pushes to the default branch
+    - if: '$CI_PROJECT_NAMESPACE == $RUN_UPSTREAM_NAMESPACE && $CI_PIPELINE_SOURCE == "push" && $CI_COMMIT_BRANCH == $CI_DEFAULT_BRANCH && $JOB_OPTIONAL'
+      when: manual
+      allow_failure: true
+    - if: '$CI_PROJECT_NAMESPACE == $RUN_UPSTREAM_NAMESPACE && $CI_PIPELINE_SOURCE == "push" && $CI_COMMIT_BRANCH == $CI_DEFAULT_BRANCH'
+      when: on_success
+
+    # upstream: other web/api/scheduled pipelines targetting the default branch
+    - if: '$CI_PROJECT_NAMESPACE == $RUN_UPSTREAM_NAMESPACE && $CI_PIPELINE_SOURCE =~ /(web|api|schedule)/ && $CI_COMMIT_REF_NAME == $CI_DEFAULT_BRANCH && $JOB_OPTIONAL'
+      when: manual
+      allow_failure: true
+    - if: '$CI_PROJECT_NAMESPACE == $RUN_UPSTREAM_NAMESPACE && $CI_PIPELINE_SOURCE =~ /(web|api|schedule)/ && $CI_COMMIT_REF_NAME == $CI_DEFAULT_BRANCH'
+      when: on_success
+
+    # upstream+forks: merge requests targetting the default branch, without CI changes
+    - if: '$CI_PIPELINE_SOURCE == "merge_request_event" && $CI_MERGE_REQUEST_TARGET_BRANCH_NAME == $CI_DEFAULT_BRANCH'
+      changes:
+        - ci/gitlab/container-templates.yml
+        - ci/containers/$NAME.Dockerfile
+      when: never
+    - if: '$CI_PIPELINE_SOURCE == "merge_request_event" && $CI_MERGE_REQUEST_TARGET_BRANCH_NAME == $CI_DEFAULT_BRANCH && $JOB_OPTIONAL'
+      when: manual
+      allow_failure: true
+    - if: '$CI_PIPELINE_SOURCE == "merge_request_event" && $CI_MERGE_REQUEST_TARGET_BRANCH_NAME == $CI_DEFAULT_BRANCH'
+      when: on_success
+
+    # upstream+forks: that's all folks
+    - when: never
+
+.gitlab_cross_build_job_local_env:
+  image: $IMAGE
+  stage: builds
+  before_script:
+    - source ci/buildenv/$NAME.sh
+    - install_buildenv
+    - cat /packages.txt
+  rules:
+    # upstream: pushes to a non-default branch
+    - if: '$CI_PROJECT_NAMESPACE == $RUN_UPSTREAM_NAMESPACE && $CI_PIPELINE_SOURCE == "push" && $CI_COMMIT_BRANCH != $CI_DEFAULT_BRANCH && $JOB_OPTIONAL'
+      when: manual
+      allow_failure: true
+    - if: '$CI_PROJECT_NAMESPACE == $RUN_UPSTREAM_NAMESPACE && $CI_PIPELINE_SOURCE == "push" && $CI_COMMIT_BRANCH != $CI_DEFAULT_BRANCH'
+      when: on_success
+
+    - if: '$CI_PROJECT_NAMESPACE != $RUN_UPSTREAM_NAMESPACE && $CI_PIPELINE_SOURCE == "push" && $RUN_PIPELINE && $JOB_OPTIONAL'
+      when: manual
+      allow_failure: true
+    - if: '$CI_PROJECT_NAMESPACE != $RUN_UPSTREAM_NAMESPACE && $CI_PIPELINE_SOURCE == "push" && $RUN_PIPELINE'
+      when: on_success
+
+    # upstream: other web/api/scheduled pipelines targetting non-default branches
+    - if: '$CI_PROJECT_NAMESPACE == $RUN_UPSTREAM_NAMESPACE && $CI_PIPELINE_SOURCE =~ /(web|api|schedule)/ && $CI_COMMIT_REF_NAME != $CI_DEFAULT_BRANCH && $JOB_OPTIONAL'
+      when: manual
+      allow_failure: true
+    - if: '$CI_PROJECT_NAMESPACE == $RUN_UPSTREAM_NAMESPACE && $CI_PIPELINE_SOURCE =~ /(web|api|schedule)/ && $CI_COMMIT_REF_NAME != $CI_DEFAULT_BRANCH'
+      when: on_success
+
+    # forks: other web/api/scheduled pipelines
+    - if: '$CI_PROJECT_NAMESPACE != $RUN_UPSTREAM_NAMESPACE && $CI_PIPELINE_SOURCE =~ /(web|api|schedule)/ && $JOB_OPTIONAL'
+      when: manual
+      allow_failure: true
+    - if: '$CI_PROJECT_NAMESPACE != $RUN_UPSTREAM_NAMESPACE && $CI_PIPELINE_SOURCE =~ /(web|api|schedule)/'
+      when: on_success
+
+    # upstream+forks: merge requests targetting the default branch, with CI changes
+    - if: '$CI_PIPELINE_SOURCE == "merge_request_event" && $CI_MERGE_REQUEST_TARGET_BRANCH_NAME == $CI_DEFAULT_BRANCH && $JOB_OPTIONAL'
+      changes:
+        - ci/gitlab/container-templates.yml
+        - ci/containers/$NAME.Dockerfile
+      when: manual
+      allow_failure: true
+    - if: '$CI_PIPELINE_SOURCE == "merge_request_event" && $CI_MERGE_REQUEST_TARGET_BRANCH_NAME == $CI_DEFAULT_BRANCH'
+      changes:
+        - ci/gitlab/container-templates.yml
+        - ci/containers/$NAME.Dockerfile
+      when: on_success
+
+    # upstream+forks: merge requests targetting non-default branches
+    - if: '$CI_PIPELINE_SOURCE == "merge_request_event" && $CI_MERGE_REQUEST_TARGET_BRANCH_NAME != $CI_DEFAULT_BRANCH && $JOB_OPTIONAL'
+      when: manual
+      allow_failure: true
+    - if: '$CI_PIPELINE_SOURCE == "merge_request_event" && $CI_MERGE_REQUEST_TARGET_BRANCH_NAME != $CI_DEFAULT_BRANCH'
+      when: on_success
+
+    # upstream+forks: that's all folks
+    - when: never
--- a/ci/gitlab/builds.yml
+++ b/ci/gitlab/builds.yml
@ -7,8 +7,8 @@

 # Native build jobs

-x86_64-centos-stream-8:
-  extends: .native_build_job
+x86_64-centos-stream-8-prebuilt-env:
+  extends: .native_build_job_prebuilt_env
  needs:
    - job: x86_64-centos-stream-8-container
      optional: true
@ -17,9 +17,18 @@ x86_64-centos-stream-8:
    NAME: centos-stream-8
    RPM: skip

+x86_64-centos-stream-8-local-env:
+  extends: .native_build_job_local_env
+  needs: []
+  allow_failure: false
+  variables:
+    IMAGE: quay.io/centos/centos:stream8
+    NAME: centos-stream-8
+    RPM: skip

-x86_64-debian-10:
-  extends: .native_build_job
+
+x86_64-debian-10-prebuilt-env:
+  extends: .native_build_job_prebuilt_env
  needs:
    - job: x86_64-debian-10-container
      optional: true
@ -27,9 +36,17 @@ x86_64-debian-10:
  variables:
    NAME: debian-10

+x86_64-debian-10-local-env:
+  extends: .native_build_job_local_env
+  needs: []
+  allow_failure: false
+  variables:
+    IMAGE: docker.io/library/debian:10-slim
+    NAME: debian-10

-x86_64-debian-sid:
-  extends: .native_build_job
+
+x86_64-debian-sid-prebuilt-env:
+  extends: .native_build_job_prebuilt_env
  needs:
    - job: x86_64-debian-sid-container
      optional: true
@ -37,9 +54,17 @@ x86_64-debian-sid:
  variables:
    NAME: debian-sid

+x86_64-debian-sid-local-env:
+  extends: .native_build_job_local_env
+  needs: []
+  allow_failure: true
+  variables:
+    IMAGE: docker.io/library/debian:sid-slim
+    NAME: debian-sid

-x86_64-fedora-35:
-  extends: .native_build_job
+
+x86_64-fedora-35-prebuilt-env:
+  extends: .native_build_job_prebuilt_env
  needs:
    - job: x86_64-fedora-35-container
      optional: true
@ -47,9 +72,17 @@ x86_64-fedora-35:
  variables:
    NAME: fedora-35

+x86_64-fedora-35-local-env:
+  extends: .native_build_job_local_env
+  needs: []
+  allow_failure: false
+  variables:
+    IMAGE: registry.fedoraproject.org/fedora:35
+    NAME: fedora-35

-x86_64-fedora-36:
-  extends: .native_build_job
+
+x86_64-fedora-36-prebuilt-env:
+  extends: .native_build_job_prebuilt_env
  needs:
    - job: x86_64-fedora-36-container
      optional: true
@ -57,9 +90,17 @@ x86_64-fedora-36:
  variables:
    NAME: fedora-36

+x86_64-fedora-36-local-env:
+  extends: .native_build_job_local_env
+  needs: []
+  allow_failure: false
+  variables:
+    IMAGE: registry.fedoraproject.org/fedora:36
+    NAME: fedora-36

-x86_64-fedora-rawhide:
-  extends: .native_build_job
+
+x86_64-fedora-rawhide-prebuilt-env:
+  extends: .native_build_job_prebuilt_env
  needs:
    - job: x86_64-fedora-rawhide-container
      optional: true
@ -67,9 +108,17 @@ x86_64-fedora-rawhide:
  variables:
    NAME: fedora-rawhide

+x86_64-fedora-rawhide-local-env:
+  extends: .native_build_job_local_env
+  needs: []
+  allow_failure: true
+  variables:
+    IMAGE: registry.fedoraproject.org/fedora:rawhide
+    NAME: fedora-rawhide

-x86_64-opensuse-leap-153:
-  extends: .native_build_job
+
+x86_64-opensuse-leap-153-prebuilt-env:
+  extends: .native_build_job_prebuilt_env
  needs:
    - job: x86_64-opensuse-leap-153-container
      optional: true
@ -78,9 +127,18 @@ x86_64-opensuse-leap-153:
    NAME: opensuse-leap-153
    RPM: skip

+x86_64-opensuse-leap-153-local-env:
+  extends: .native_build_job_local_env
+  needs: []
+  allow_failure: false
+  variables:
+    IMAGE: registry.opensuse.org/opensuse/leap:15.3
+    NAME: opensuse-leap-153
+    RPM: skip

-x86_64-opensuse-tumbleweed:
-  extends: .native_build_job
+
+x86_64-opensuse-tumbleweed-prebuilt-env:
+  extends: .native_build_job_prebuilt_env
  needs:
    - job: x86_64-opensuse-tumbleweed-container
      optional: true
@ -89,9 +147,18 @@ x86_64-opensuse-tumbleweed:
    NAME: opensuse-tumbleweed
    RPM: skip

+x86_64-opensuse-tumbleweed-local-env:
+  extends: .native_build_job_local_env
+  needs: []
+  allow_failure: true
+  variables:
+    IMAGE: registry.opensuse.org/opensuse/tumbleweed:latest
+    NAME: opensuse-tumbleweed
+    RPM: skip

-x86_64-ubuntu-2004:
-  extends: .native_build_job
+
+x86_64-ubuntu-2004-prebuilt-env:
+  extends: .native_build_job_prebuilt_env
  needs:
    - job: x86_64-ubuntu-2004-container
      optional: true
@ -99,9 +166,17 @@ x86_64-ubuntu-2004:
  variables:
    NAME: ubuntu-2004

+x86_64-ubuntu-2004-local-env:
+  extends: .native_build_job_local_env
+  needs: []
+  allow_failure: false
+  variables:
+    IMAGE: docker.io/library/ubuntu:20.04
+    NAME: ubuntu-2004

-x86_64-ubuntu-2204:
-  extends: .native_build_job
+
+x86_64-ubuntu-2204-prebuilt-env:
+  extends: .native_build_job_prebuilt_env
  needs:
    - job: x86_64-ubuntu-2204-container
      optional: true
@ -109,12 +184,20 @@ x86_64-ubuntu-2204:
  variables:
    NAME: ubuntu-2204

+x86_64-ubuntu-2204-local-env:
+  extends: .native_build_job_local_env
+  needs: []
+  allow_failure: false
+  variables:
+    IMAGE: docker.io/library/ubuntu:22.04
+    NAME: ubuntu-2204
+


 # Cross build jobs

-mingw32-fedora-rawhide:
-  extends: .cross_build_job
+mingw32-fedora-rawhide-prebuilt-env:
+  extends: .cross_build_job_prebuilt_env
  needs:
    - job: mingw32-fedora-rawhide-container
      optional: true
@ -127,9 +210,22 @@ mingw32-fedora-rawhide:
    paths:
      - data/virt-viewer-x86*.msi

+mingw32-fedora-rawhide-local-env:
+  extends: .cross_build_job_local_env
+  needs: []
+  allow_failure: true
+  variables:
+    CROSS: mingw32
+    IMAGE: registry.fedoraproject.org/fedora:rawhide
+    NAME: fedora-rawhide
+  artifacts:
+    expire_in: 2 days
+    paths:
+      - data/virt-viewer-x86*.msi

-mingw64-fedora-rawhide:
-  extends: .cross_build_job
+
+mingw64-fedora-rawhide-prebuilt-env:
+  extends: .cross_build_job_prebuilt_env
  needs:
    - job: mingw64-fedora-rawhide-container
      optional: true
@ -141,3 +237,16 @@ mingw64-fedora-rawhide:
    expire_in: 2 days
    paths:
      - data/virt-viewer-x64*.msi
+
+mingw64-fedora-rawhide-local-env:
+  extends: .cross_build_job_local_env
+  needs: []
+  allow_failure: true
+  variables:
+    CROSS: mingw64
+    IMAGE: registry.fedoraproject.org/fedora:rawhide
+    NAME: fedora-rawhide
+  artifacts:
+    expire_in: 2 days
+    paths:
+      - data/virt-viewer-x64*.msi
--- a/ci/gitlab/container-templates.yml
+++ b/ci/gitlab/container-templates.yml
@ -5,17 +5,13 @@
 # https://gitlab.com/libvirt/libvirt-ci


-# For upstream
+# We want to publish containers with tag 'latest':
 #
-#   - Push to default branch:
-#       -> rebuild if dockerfile changed, no cache
-#   - Otherwise
-#       -> rebuild if RUN_ALL_CONTAINERS=1, no cache,
-#          to pick up new published distro packages or
-#          recover from deleted tag
+#  - In upstream, for push to default branch with CI changes.
+#  - In upstream, on request, for scheduled/manual pipelines
+#    against default branch
 #
-# For forks
-#   - Always rebuild, with cache
+# Note: never publish from merge requests since they have non-committed code
 #
 .container_job:
  image: docker:stable
@ -25,33 +21,24 @@
    - docker:dind
  before_script:
    - export TAG="$CI_REGISTRY_IMAGE/ci-$NAME:latest"
-    - export COMMON_TAG="$CI_REGISTRY/virt-viewer/virt-viewer/ci-$NAME:latest"
    - docker info
    - docker login "$CI_REGISTRY" -u "$CI_REGISTRY_USER" -p "$CI_REGISTRY_PASSWORD"
  script:
-    - if test $CI_PROJECT_NAMESPACE = "virt-viewer";
-      then
-        docker build --tag "$TAG" -f "ci/containers/$NAME.Dockerfile" ci/containers ;
-      else
-        docker pull "$TAG" || docker pull "$COMMON_TAG" || true ;
-        docker build --cache-from "$TAG" --cache-from "$COMMON_TAG" --tag "$TAG" -f "ci/containers/$NAME.Dockerfile" ci/containers ;
-      fi
+    - docker build --tag "$TAG" -f "ci/containers/$NAME.Dockerfile" ci/containers ;
    - docker push "$TAG"
  after_script:
    - docker logout
  rules:
-    - if: '$CI_PIPELINE_SOURCE == "merge_request_event"'
-      when: never
-    - if: '$CI_PROJECT_NAMESPACE == "virt-viewer" && $CI_PIPELINE_SOURCE == "push" && $CI_COMMIT_BRANCH == $CI_DEFAULT_BRANCH'
+    # upstream: publish containers if there were CI changes on the default branch
+    - if: '$CI_PROJECT_NAMESPACE == $RUN_UPSTREAM_NAMESPACE && $CI_PIPELINE_SOURCE == "push" && $CI_COMMIT_BRANCH == $CI_DEFAULT_BRANCH'
      when: on_success
      changes:
        - ci/gitlab/container-templates.yml
        - ci/containers/$NAME.Dockerfile
-    - if: '$CI_PROJECT_NAMESPACE == "virt-viewer" && $RUN_ALL_CONTAINERS == "1"'
+
+    # upstream: allow force re-publishing containers on default branch for web/api/scheduled pipelines
+    - if: '$CI_PROJECT_NAMESPACE == $RUN_UPSTREAM_NAMESPACE && $CI_PIPELINE_SOURCE =~ /(web|api|schedule)/ && $CI_COMMIT_REF_NAME == $CI_DEFAULT_BRANCH && $RUN_CONTAINER_BUILDS == "1"'
      when: on_success
-    - if: '$CI_PROJECT_NAMESPACE == "virt-viewer"'
-      when: never
-    - if: '$JOB_OPTIONAL'
-      when: manual
-      allow_failure: true
-    - when: on_success
+
+    # upstream+forks: that's all folks
+    - when: never
--- a/ci/gitlab/sanity-checks.yml
+++ b/ci/gitlab/sanity-checks.yml
@ -10,9 +10,17 @@ check-dco:
  needs: []
  image: registry.gitlab.com/libvirt/libvirt-ci/check-dco:master
  script:
-    - /check-dco virt-viewer
-  except:
-    variables:
-      - $CI_PROJECT_NAMESPACE == 'virt-viewer'
+    - /check-dco "$RUN_UPSTREAM_NAMESPACE"
+  rules:
+    # upstream+forks: Run pipelines on MR
+    - if: '$CI_PIPELINE_SOURCE =~ "merge_request_event"'
+      when: on_success
+
+    # forks: pushes to branches with pipeline requested
+    - if: '$CI_PROJECT_NAMESPACE != $RUN_UPSTREAM_NAMESPACE && $CI_PIPELINE_SOURCE == "push" && $CI_COMMIT_BRANCH && $RUN_PIPELINE'
+      when: on_success
+
+    # upstream+forks: that's all folks
+    - when: never
  variables:
    GIT_DEPTH: 1000