ctdb: Use stdio's getline() in ctdb_connection_list_read()
[samba.git] / .gitlab-ci-main.yml
index 657b28e274ff5b623ef7a35af6564c818710cc70..71b3c3f861a2beb2d09bd36f01dfc8810ddc0c77 100644 (file)
@@ -30,6 +30,11 @@ variables:
   #
   GIT_STRATEGY: fetch
   GIT_DEPTH: "3"
+  #
+  # Use GZip by default, it is fast and is good enough.  Other options include --xz
+
+  SAMBA_TESTBASE_TAR_OPTIONS: -z
+
   #
   # we run autobuild.py inside a samba CI docker image located on gitlab's registry
   # overwrite this variable if you want use your own image registry.
@@ -42,28 +47,26 @@ variables:
   # Set this to the contents of bootstrap/sha1sum.txt
   # which is generated by bootstrap/template.py --render
   #
-  SAMBA_CI_CONTAINER_TAG: b5333a93306e20ba549f5fac3c6c74e0b103c1d6
+  SAMBA_CI_CONTAINER_TAG: 9a406973474a7903fe7fd6215226660911ed73c0
   #
-  # We use the ubuntu1804 image as default as
-  # it matches what we have on sn-devel-184.
+  # We use the ubuntu2204 image as default as
+  # it matches what we have on atb-devel-224
   #
-  SAMBA_CI_CONTAINER_IMAGE: ubuntu1804
+  SAMBA_CI_CONTAINER_IMAGE: ubuntu2204
   #
   # The following images are available
   # Please see the samba-o3 sections at the end of this file!
   # We should run that for each available image
   #
-  SAMBA_CI_CONTAINER_IMAGE_ubuntu1604: ubuntu1604
-  SAMBA_CI_CONTAINER_IMAGE_ubuntu1804: ubuntu1804
   SAMBA_CI_CONTAINER_IMAGE_ubuntu2004: ubuntu2004
-  SAMBA_CI_CONTAINER_IMAGE_debian9: debian9
-  SAMBA_CI_CONTAINER_IMAGE_debian10: debian10
-  SAMBA_CI_CONTAINER_IMAGE_opensuse151: opensuse151
-  SAMBA_CI_CONTAINER_IMAGE_opensuse152: opensuse152
-  SAMBA_CI_CONTAINER_IMAGE_fedora33: fedora33
-  SAMBA_CI_CONTAINER_IMAGE_fedora34: fedora34
+  SAMBA_CI_CONTAINER_IMAGE_ubuntu2204: ubuntu2204
+  SAMBA_CI_CONTAINER_IMAGE_debian11: debian11
+  SAMBA_CI_CONTAINER_IMAGE_debian11_32bit: debian11-32bit
+  SAMBA_CI_CONTAINER_IMAGE_debian12: debian12
+  SAMBA_CI_CONTAINER_IMAGE_opensuse155: opensuse155
+  SAMBA_CI_CONTAINER_IMAGE_fedora39: fedora39
   SAMBA_CI_CONTAINER_IMAGE_centos7: centos7
-  SAMBA_CI_CONTAINER_IMAGE_centos8: centos8
+  SAMBA_CI_CONTAINER_IMAGE_centos8s: centos8s
 
 include:
   # The image creation details are specified in a separate file
@@ -83,6 +86,13 @@ include:
   interruptible: true
   timeout: 2h
 
+  # Otherwise we run twice, once on push and once on MR
+  # https://forum.gitlab.com/t/new-rules-syntax-and-detached-pipelines/37292
+  rules:
+    - if: $CI_MERGE_REQUEST_ID
+      when: never
+    - when: on_success
+
   variables:
     AUTOBUILD_JOB_NAME: $CI_JOB_NAME
   stage: build
@@ -90,6 +100,16 @@ include:
     key: ccache.${CI_JOB_NAME}.${SAMBA_CI_JOB_IMAGE}.${SAMBA_CI_FLAVOR}
     paths:
       - ccache
+
+  # This is overridden in many cases, but ensures none of the other
+  # main jobs start until and unless this build finishes.  However
+  # this also ensures we do not download artifacts from any build
+  # unless we specifically depend on it, saving bandwidth
+
+  needs:
+    - job: samba-def-build
+      artifacts: false
+
   before_script:
     - uname -a
     - lsb_release -a
@@ -119,6 +139,8 @@ include:
     - export CXX="ccache c++"
     - ccache -z -M 500M
     - ccache -s
+      # We are already running .gitlab-ci directives from this repo, remove additional checks that break our CI
+    - git config --global --add safe.directory `pwd`
   after_script:
     - mount
     - df -h
@@ -141,7 +163,6 @@ include:
       - api_failure
       - runner_unsupported
       - stale_schedule
-      - job_execution_timeout
       - archived_failure
       - scheduler_failure
       - data_integrity_failure
@@ -149,7 +170,7 @@ include:
   script:
     # gitlab predefines CI_JOB_NAME for each job. The gitlab job usually matches the
     # autobuild name, which means we can define a default template that runs most autobuild jobs
-    - script/autobuild.py $AUTOBUILD_JOB_NAME $SAMBA_CI_AUTOBUILD_ENABLE_COVERAGE  --verbose --nocleanup --keeplogs --tail --full-testbase /tmp/samba-testbase
+    - script/autobuild.py $AUTOBUILD_JOB_NAME $SAMBA_CI_AUTOBUILD_ENABLE_COVERAGE  --verbose --nocleanup --keeplogs --tail --full-testbase /builds/samba-testbase
 
 # Ensure when adding a new job below that you also add it to
 # the dependencies for 'pages' below for the code coverage page
@@ -158,18 +179,18 @@ include:
 others:
   extends: .shared_template
   script:
-    - script/autobuild.py ldb      $SAMBA_CI_AUTOBUILD_ENABLE_COVERAGE --verbose --nocleanup --keeplogs --tail --full-testbase /tmp/samba-testbase/ldb
-    - script/autobuild.py pidl     $SAMBA_CI_AUTOBUILD_ENABLE_COVERAGE --verbose --nocleanup --keeplogs --tail --full-testbase /tmp/samba-testbase/pidl
-    - script/autobuild.py replace  $SAMBA_CI_AUTOBUILD_ENABLE_COVERAGE --verbose --nocleanup --keeplogs --tail --full-testbase /tmp/samba-testbase/replace
-    - script/autobuild.py talloc   $SAMBA_CI_AUTOBUILD_ENABLE_COVERAGE --verbose --nocleanup --keeplogs --tail --full-testbase /tmp/samba-testbase/talloc
-    - script/autobuild.py tdb      $SAMBA_CI_AUTOBUILD_ENABLE_COVERAGE --verbose --nocleanup --keeplogs --tail --full-testbase /tmp/samba-testbase/tdb
-    - script/autobuild.py tevent   $SAMBA_CI_AUTOBUILD_ENABLE_COVERAGE --verbose --nocleanup --keeplogs --tail --full-testbase /tmp/samba-testbase/tevent
-    - script/autobuild.py samba-xc $SAMBA_CI_AUTOBUILD_ENABLE_COVERAGE --verbose --nocleanup --keeplogs --tail --full-testbase /tmp/samba-testbase/samba-xc
-    - script/autobuild.py docs-xml $SAMBA_CI_AUTOBUILD_ENABLE_COVERAGE --verbose --nocleanup --keeplogs --tail --full-testbase /tmp/samba-testbase/docs-xml
+    - script/autobuild.py pidl     $SAMBA_CI_AUTOBUILD_ENABLE_COVERAGE --verbose --nocleanup --keeplogs --tail --full-testbase /builds/samba-testbase/pidl
+    - script/autobuild.py replace  $SAMBA_CI_AUTOBUILD_ENABLE_COVERAGE --verbose --nocleanup --keeplogs --tail --full-testbase /builds/samba-testbase/replace
+    - script/autobuild.py talloc   $SAMBA_CI_AUTOBUILD_ENABLE_COVERAGE --verbose --nocleanup --keeplogs --tail --full-testbase /builds/samba-testbase/talloc
+    - script/autobuild.py tdb      $SAMBA_CI_AUTOBUILD_ENABLE_COVERAGE --verbose --nocleanup --keeplogs --tail --full-testbase /builds/samba-testbase/tdb
+    - script/autobuild.py tevent   $SAMBA_CI_AUTOBUILD_ENABLE_COVERAGE --verbose --nocleanup --keeplogs --tail --full-testbase /builds/samba-testbase/tevent
+    - script/autobuild.py samba-xc $SAMBA_CI_AUTOBUILD_ENABLE_COVERAGE --verbose --nocleanup --keeplogs --tail --full-testbase /builds/samba-testbase/samba-xc
+    - script/autobuild.py docs-xml $SAMBA_CI_AUTOBUILD_ENABLE_COVERAGE --verbose --nocleanup --keeplogs --tail --full-testbase /builds/samba-testbase/docs-xml
 
 .shared_template_build_only:
   extends: .shared_template
-  timeout: 45m
+  timeout: 2h
+  needs:
   artifacts:
     expire_in: 1 week
     paths:
@@ -177,26 +198,26 @@ others:
       - "*.stderr"
       - "*.info"
       - system-info.txt
-      - samba-testbase.tar.gz
+      - samba-testbase.tar
   script:
     # gitlab predefines CI_JOB_NAME for each job. The gitlab job usually matches the
     # autobuild name, which means we can define a default template that runs most autobuild jobs
-    - script/autobuild.py $AUTOBUILD_JOB_NAME $SAMBA_CI_AUTOBUILD_ENABLE_COVERAGE  --verbose --nocleanup --keeplogs --tail --full-testbase /tmp/samba-testbase
+    - script/autobuild.py $AUTOBUILD_JOB_NAME $SAMBA_CI_AUTOBUILD_ENABLE_COVERAGE  --verbose --nocleanup --keeplogs --tail --full-testbase /builds/samba-testbase
     # On success we need to pack everything into an artifacts file
     # which needs to be in the git checkout.
     # As tar doesn't handle hardlink of read-only files,
     # we remember the acls and add write permissions
     # before creating the archive. The consumer will apply
     # the acls again.
-    - cp -a /sha1sum.txt /tmp/samba-testbase/image-sha1sum.txt
-    - cp -a /tmp/commit.txt /tmp/samba-testbase/commit.txt
-    - ln -s /tmp/samba-testbase/${AUTOBUILD_JOB_NAME}/ /tmp/samba-testbase/build_subdir_link
-    - pushd /tmp && getfacl -R samba-testbase > samba-testbase.acl.dump && popd
-    - chmod -R +w /tmp/samba-testbase
-    - mv /tmp/samba-testbase.acl.dump /tmp/samba-testbase/
-    - tar cfz samba-testbase.tar.gz /tmp/samba-testbase
-    - ls -la samba-testbase.tar.gz
-    - sha1sum samba-testbase.tar.gz
+    - cp -a /sha1sum.txt /builds/samba-testbase/image-sha1sum.txt
+    - cp -a /tmp/commit.txt /builds/samba-testbase/commit.txt
+    - ln -s /builds/samba-testbase/${AUTOBUILD_JOB_NAME}/ /builds/samba-testbase/build_subdir_link
+    - pushd /builds && getfacl -R samba-testbase > samba-testbase.acl.dump && popd
+    - chmod -R +w /builds/samba-testbase
+    - mv /builds/samba-testbase.acl.dump /builds/samba-testbase/
+    - tar $SAMBA_TESTBASE_TAR_OPTIONS -cf samba-testbase.tar /builds/samba-testbase
+    - ls -la samba-testbase.tar
+    - sha1sum samba-testbase.tar
 
 .shared_template_test_only:
   extends:
@@ -204,23 +225,27 @@ others:
     - .shared_runner_test
   stage: test_only
   script:
+    # Print the Kerberos version to check we ended up with the right one
+    # in the runner. We do not have configure output to recognize it
+    # otherwise.
+    - if [ -x "$(command -v krb5-config)" ]; then krb5-config --version; fi
     # We unpack the artifacts file created by the .shared_template_build_only
     # run we depend on
-    - ls -la samba-testbase.tar.gz
-    - sha1sum samba-testbase.tar.gz
-    - tar xfz samba-testbase.tar.gz -C /
-    - diff -u /tmp/samba-testbase/image-sha1sum.txt /sha1sum.txt
-    - diff -u /tmp/samba-testbase/commit.txt /tmp/commit.txt
-    - mv /tmp/samba-testbase/samba-testbase.acl.dump /tmp/samba-testbase.acl.dump
-    - pushd /tmp && setfacl --restore=/tmp/samba-testbase.acl.dump && popd
-    - ls -la /tmp/samba-testbase/
-    - ls -la /tmp/samba-testbase/build_subdir_link
-    - ls -la /tmp/samba-testbase/build_subdir_link/
-    - if [ -n "$SAMBA_CI_AUTOBUILD_ENABLE_COVERAGE" ]; then find /tmp/samba-testbase/build_subdir_link/ -type d -printf "'%p'\n" | xargs chmod u+w; fi
-    - ls -la /tmp/samba-testbase/build_subdir_link/
+    - ls -la samba-testbase.tar
+    - sha1sum samba-testbase.tar
+    - tar $SAMBA_TESTBASE_TAR_OPTIONS -xf samba-testbase.tar -C /
+    - diff -u /builds/samba-testbase/image-sha1sum.txt /sha1sum.txt
+    - diff -u /builds/samba-testbase/commit.txt /tmp/commit.txt
+    - mv /builds/samba-testbase/samba-testbase.acl.dump /builds/samba-testbase.acl.dump
+    - pushd /builds && setfacl --restore=/builds/samba-testbase.acl.dump && popd
+    - ls -la /builds/samba-testbase/
+    - ls -la /builds/samba-testbase/build_subdir_link
+    - ls -la /builds/samba-testbase/build_subdir_link/
+    - if [ -n "$SAMBA_CI_AUTOBUILD_ENABLE_COVERAGE" ]; then find /builds/samba-testbase/build_subdir_link/ -type d -printf "'%p'\n" | xargs chmod u+w; fi
+    - ls -la /builds/samba-testbase/build_subdir_link/
     # gitlab predefines CI_JOB_NAME for each job. The gitlab job usually matches the
     # autobuild name, which means we can define a default template that runs most autobuild jobs
-    - script/autobuild.py $AUTOBUILD_JOB_NAME $SAMBA_CI_AUTOBUILD_ENABLE_COVERAGE --skip-dependencies --verbose --nocleanup --keeplogs --tail --full-testbase /tmp/samba-testbase
+    - script/autobuild.py $AUTOBUILD_JOB_NAME $SAMBA_CI_AUTOBUILD_ENABLE_COVERAGE --skip-dependencies --verbose --nocleanup --keeplogs --tail --full-testbase /builds/samba-testbase
 
 samba-def-build:
   extends: .shared_template_build_only
@@ -231,16 +256,22 @@ samba-def-build:
   needs:
     - job: samba-def-build
       artifacts: true
+    - job: samba-codecheck
 
 samba-mit-build:
   extends: .shared_template_build_only
+  variables:
+    SAMBA_CI_JOB_IMAGE: ${SAMBA_CI_CONTAINER_IMAGE_fedora39}
   stage: build_first
 
 .needs_samba-mit-build:
   extends: .shared_template_test_only
+  variables:
+    SAMBA_CI_JOB_IMAGE: ${SAMBA_CI_CONTAINER_IMAGE_fedora39}
   needs:
     - job: samba-mit-build
       artifacts: true
+    - job: samba-codecheck
 
 samba-h5l-build:
   extends: .shared_template_build_only
@@ -251,6 +282,15 @@ samba-h5l-build:
     - job: samba-h5l-build
       artifacts: true
 
+samba-without-smb1-build:
+  extends: .shared_template_build_only
+
+.needs_samba-without-smb1-build:
+  extends: .shared_template_test_only
+  needs:
+    - job: samba-without-smb1-build
+      artifacts: true
+
 samba-nt4-build:
   extends: .shared_template_build_only
 
@@ -274,6 +314,8 @@ samba:
 
 samba-mitkrb5:
   extends: .shared_template
+  variables:
+    SAMBA_CI_JOB_IMAGE: ${SAMBA_CI_CONTAINER_IMAGE_fedora39}
 
 samba-minimal-smbd:
   extends: .shared_template
@@ -317,7 +359,8 @@ samba-libs:
 samba-fuzz:
   extends: .shared_template
   variables:
-    SAMBA_CI_JOB_IMAGE: ${SAMBA_CI_CONTAINER_IMAGE_ubuntu1604}
+    # We match what Google is running over at oss-fuzz
+    SAMBA_CI_JOB_IMAGE: ${SAMBA_CI_CONTAINER_IMAGE_ubuntu2004}
 
 ctdb:
   extends: .shared_template
@@ -342,61 +385,120 @@ samba-addc-mit-4b:
 samba-fips:
   extends: .shared_template
   variables:
-    SAMBA_CI_JOB_IMAGE: ${SAMBA_CI_CONTAINER_IMAGE_fedora34}
+    SAMBA_CI_JOB_IMAGE: ${SAMBA_CI_CONTAINER_IMAGE_fedora39}
+
+samba-codecheck:
+  extends: .shared_template
+  needs:
+  stage: build_first
 
 .private_test_only:
   extends: .private_runner_test
   stage: test_private
-  only:
-    variables:
+  rules:
+      # See above, to avoid a duplicate CI on the MR (these rules override the others)
+    - if: $CI_MERGE_REQUEST_ID
+      when: never
+
       # These jobs are only run if the gitlab repo has private runners available.
       # To enable private jobs, you must add the following var and value to
       # your gitlab repo by navigating to:
       # settings -> CI/CD -> Environment variables
-      - $SUPPORT_PRIVATE_TEST == "yes"
+    - if: $SUPPORT_PRIVATE_TEST == "yes"
+
+.needs_ext4_support:
+  # All runners provide an ext4 filesystem
+  #
+  # Note: we don't use
+  # extends: .shared_template_test_only
+  # as that somehow resets the needs section
+  # and generates problems for something
+  # like this (which is used below)
+  #
+  # .needs_samba-SOME-build-ext4:
+  #   extends:
+  #     - .needs_samba-SOME-build
+  #     - .needs_ext4_support
+  #
+  # So we only set stage again instead...
+  stage: test_only
+
+.needs_5_15_kernel:
+  # Our private runners are based on
+  # ubuntu2204 with a 5.15 kernel.
+  #
+  # And they also provide an ext4 filesystem
+  extends: .private_test_only
 
-.needs_samba-def-build-private:
+.needs_samba-def-build-ext4:
   extends:
     - .needs_samba-def-build
-    - .private_test_only
+    - .needs_ext4_support
 
-.needs_samba-mit-build-private:
+.needs_samba-mit-build-ext4:
   extends:
     - .needs_samba-mit-build
-    - .private_test_only
+    - .needs_ext4_support
 
-.needs_samba-h5l-build-private:
+.needs_samba-h5l-build-ext4:
   extends:
     - .needs_samba-h5l-build
-    - .private_test_only
+    - .needs_ext4_support
+
+.needs_samba-without-smb1-build-5_15:
+  # Currently this doesn't strictly
+  # require a kernel >= 5.15, but only
+  # ext4 support.
+  #
+  # But we want to make sure that
+  # our private runners keep working
+  # and at least do a single job.
+  #
+  # In future we'll be able to run
+  # tests with io_uring in this
+  # setup, which will requires a
+  # 5.15 kernel in order to be useful.
+  extends:
+    - .needs_samba-without-smb1-build
+    - .needs_5_15_kernel
 
-.needs_samba-nt4-build-private:
+.needs_samba-nt4-build-ext4:
   extends:
     - .needs_samba-nt4-build
-    - .private_test_only
+    - .needs_ext4_support
 
-.needs_samba-no-opath-build-private:
+.needs_samba-no-opath-build-ext4:
   extends:
     - .needs_samba-no-opath-build
-    - .private_test_only
+    - .needs_ext4_support
 
 samba-fileserver:
-  extends: .needs_samba-h5l-build-private
+  extends: .needs_samba-h5l-build-ext4
+
+samba-fileserver-without-smb1:
+  extends: .needs_samba-without-smb1-build-5_15
+
+# This is a full build without the AD DC so we test the build with MIT
+# Kerberos from the default system (Ubuntu 22.04 at this stage).
+# Runtime behaviour checked via the ktest (static ccache and keytab)
+# environment
+samba-ktest-mit:
+ extends: .shared_template
 
 samba-ad-dc-1:
-  extends: .needs_samba-def-build-private
+  extends: .needs_samba-def-build-ext4
 
 samba-nt4:
-  extends: .needs_samba-nt4-build-private
+  extends: .needs_samba-nt4-build-ext4
 
 samba-addc-mit-1:
-  extends: .needs_samba-mit-build-private
+  extends: .needs_samba-mit-build-ext4
 
 samba-no-opath1:
-  extends: .needs_samba-no-opath-build-private
+  extends: .needs_samba-no-opath-build-ext4
 
 samba-no-opath2:
-  extends: .needs_samba-no-opath-build-private
+  extends: .needs_samba-no-opath-build-ext4
 
 # 'pages' is a special job which can publish artifacts in `public` dir to gitlab pages
 pages:
@@ -426,6 +528,7 @@ pages:
     - samba-ad-back1
     - samba-ad-back2
     - samba-fileserver
+    - samba-fileserver-without-smb1
     - samba-ad-dc-1
     - samba-nt4
     - samba-schemaupgrade
@@ -433,7 +536,7 @@ pages:
     - samba-fips
     - samba-no-opath1
     - samba-no-opath2
-    - ubuntu1804-samba-o3
+    - ubuntu2204-samba-o3
   script:
     - ls -la *.info
     - ./configure.developer
@@ -441,7 +544,7 @@ pages:
     - ls -la *.info
     - lcov $(ls *.info | xargs -I{} echo -n "-a {} ") -o all.info
     - ls -la *.info
-    - genhtml all.info --output-directory public --prefix=$(pwd) --title "coverage report for $CI_COMMIT_REF_NAME $CI_COMMIT_SHORT_SHA"
+    - genhtml all.info --ignore-errors source --output-directory public --prefix=$(pwd) --title "coverage report for $CI_COMMIT_REF_NAME $CI_COMMIT_SHORT_SHA"
   artifacts:
     expire_in: 30 days
     paths:
@@ -454,12 +557,12 @@ pages:
 coverity:
   extends: .shared_runner_build_image
   variables:
-    SAMBA_CI_JOB_IMAGE: ${SAMBA_CI_CONTAINER_IMAGE_fedora34}
+    SAMBA_CI_JOB_IMAGE: ${SAMBA_CI_CONTAINER_IMAGE_opensuse155}
   stage: build
   script:
     - wget https://scan.coverity.com/download/linux64 --post-data "token=$COVERITY_SCAN_TOKEN&project=$COVERITY_SCAN_PROJECT_NAME" -O /tmp/coverity_tool.tgz
     - tar xf /tmp/coverity_tool.tgz
-    - ./configure.developer --with-cluster-support --with-system-mitkrb5 --with-experimental-mit-ad-dc
+    - ./configure.developer --with-cluster-support
     - cov-analysis-linux64-*/bin/cov-build --dir cov-int make -j$(nproc)
     - tar czf cov-int.tar.gz cov-int
     - curl
@@ -483,6 +586,12 @@ coverity:
     paths:
       - cov-int/*.txt
 
+debian11-samba-32bit:
+  extends: .shared_template
+  variables:
+    AUTOBUILD_JOB_NAME: samba-32bit
+    SAMBA_CI_JOB_IMAGE: ${SAMBA_CI_CONTAINER_IMAGE_debian11_32bit}
+
 #
 # We build samba-o3 on all supported distributions
 #
@@ -495,42 +604,57 @@ coverity:
 # when -O3 gets combined with --enable-coverage in the scheduled
 # builds.
 
-ubuntu1804-samba-o3:
+ubuntu2204-samba-o3:
   extends: .shared_template
   variables:
     AUTOBUILD_JOB_NAME: samba-o3
-    SAMBA_CI_JOB_IMAGE: ${SAMBA_CI_CONTAINER_IMAGE_ubuntu1804}
+    SAMBA_CI_JOB_IMAGE: ${SAMBA_CI_CONTAINER_IMAGE_ubuntu2204}
     SAMBA_CI_AUTOBUILD_ENABLE_COVERAGE: "--enable-coverage"
+  rules:
+    # See above, to avoid a duplicate CI on the MR (these rules override the others)
+    - if: $CI_MERGE_REQUEST_ID
+      when: never
+    # do not run o3 builds (which run a lot of VMs) if told not to
+    # (this uses the same variable as autobuild.py)
+    - if: $AUTOBUILD_SKIP_SAMBA_O3 == "1"
+      when: never
+    - when: on_success
 
 # All other jobs do not want code coverage.
 .samba-o3-template:
   extends: .shared_template
   variables:
     AUTOBUILD_JOB_NAME: samba-o3
-  only:
-    variables:
-      # do not run o3 for coverage since they are using different images
-      - $SAMBA_CI_AUTOBUILD_ENABLE_COVERAGE == ""
+  rules:
+    # See above, to avoid a duplicate CI on the MR (these rules override the others)
+    - if: $CI_MERGE_REQUEST_ID
+      when: never
+    # do not run o3 builds (which run a lot of VMs) if told not to
+    # (this uses the same variable as autobuild.py)
+    - if: $AUTOBUILD_SKIP_SAMBA_O3 == "1"
+      when: never
+    # do not run o3 for coverage since they are using different images
+    - if: $SAMBA_CI_AUTOBUILD_ENABLE_COVERAGE == ""
 
 ubuntu2004-samba-o3:
   extends: .samba-o3-template
   variables:
     SAMBA_CI_JOB_IMAGE: ${SAMBA_CI_CONTAINER_IMAGE_ubuntu2004}
 
-debian10-samba-o3:
+debian11-samba-o3:
   extends: .samba-o3-template
   variables:
-    SAMBA_CI_JOB_IMAGE: ${SAMBA_CI_CONTAINER_IMAGE_debian10}
+    SAMBA_CI_JOB_IMAGE: ${SAMBA_CI_CONTAINER_IMAGE_debian11}
 
-opensuse151-samba-o3:
+debian12-samba-o3:
   extends: .samba-o3-template
   variables:
-    SAMBA_CI_JOB_IMAGE: ${SAMBA_CI_CONTAINER_IMAGE_opensuse151}
+    SAMBA_CI_JOB_IMAGE: ${SAMBA_CI_CONTAINER_IMAGE_debian12}
 
-opensuse152-samba-o3:
+opensuse155-samba-o3:
   extends: .samba-o3-template
   variables:
-    SAMBA_CI_JOB_IMAGE: ${SAMBA_CI_CONTAINER_IMAGE_opensuse152}
+    SAMBA_CI_JOB_IMAGE: ${SAMBA_CI_CONTAINER_IMAGE_opensuse155}
 
 centos7-samba-o3:
   extends: .samba-o3-template
@@ -539,22 +663,17 @@ centos7-samba-o3:
     # Git on CentOS doesn't support shallow git cloning
     GIT_DEPTH: ""
     # We need a newer GnuTLS version on CentOS7
-    PKG_CONFIG_PATH: "/usr/lib64/compat-gnutls34/pkgconfig:/usr/lib64/compat-nettle32/pkgconfig"
-
-centos8-samba-o3:
-  extends: .samba-o3-template
-  variables:
-    SAMBA_CI_JOB_IMAGE: ${SAMBA_CI_CONTAINER_IMAGE_centos8}
+    PKG_CONFIG_PATH: "/usr/lib64/compat-gnutls37/pkgconfig:/usr/lib64/compat-nettle32/pkgconfig"
 
-fedora33-samba-o3:
+centos8s-samba-o3:
   extends: .samba-o3-template
   variables:
-    SAMBA_CI_JOB_IMAGE: ${SAMBA_CI_CONTAINER_IMAGE_fedora33}
+    SAMBA_CI_JOB_IMAGE: ${SAMBA_CI_CONTAINER_IMAGE_centos8s}
 
-fedora34-samba-o3:
+fedora39-samba-o3:
   extends: .samba-o3-template
   variables:
-    SAMBA_CI_JOB_IMAGE: ${SAMBA_CI_CONTAINER_IMAGE_fedora34}
+    SAMBA_CI_JOB_IMAGE: ${SAMBA_CI_CONTAINER_IMAGE_fedora39}
 
 #
 # Keep the samba-o3 sections at the end ...