CLEANUP/MINOR: ci: restrict pipelines to MRs and consolidate job rules

Add a global workflow block to restrict pipeline execution to merge
requests and manual triggers (web/API)

Author: oktalz

.gitlab-ci.yml

@@ -1,3 +1,15 @@
+# Pipelines run only for MRs and manual (web/API) runs; branch pushes create none.
+workflow:
+  rules:
+    - if: $CI_PIPELINE_SOURCE == 'merge_request_event'
+    - if: $CI_PIPELINE_SOURCE == 'api'
+    - if: $CI_PIPELINE_SOURCE == 'web'
+
+# Extend to run in every allowed pipeline; rule-less jobs drop out of MR pipelines.
+.all-pipelines:
+  rules:
+    - when: on_success
+
 stages:
   - lint
   - security

.gitlab/build.yml

@@ -1,9 +1,7 @@
 build:
   stage: build
   needs: []
-  rules:
-    - if: $CI_PIPELINE_SOURCE == 'merge_request_event'
-    - if: $CI_PIPELINE_SOURCE == 'push'
+  extends: .all-pipelines
   image:
     name: $HAPROXY_REGISTRY_GO/golang:latest-alpine
     entrypoint: [""]

.gitlab/lint.yml

@@ -1,9 +1,7 @@
 tidy:
   stage: lint
   needs: []
-  rules:
-    - if: $CI_PIPELINE_SOURCE == 'merge_request_event'
-    - if: $CI_PIPELINE_SOURCE == 'push'
+  extends: .all-pipelines
   image:
     name: $HAPROXY_REGISTRY_GO/golang:latest-alpine
     entrypoint: [""]
@@ -30,9 +28,7 @@ tidy:
 format:
   stage: lint
   needs: []
-  rules:
-    - if: $CI_PIPELINE_SOURCE == 'merge_request_event'
-    - if: $CI_PIPELINE_SOURCE == 'push'
+  extends: .all-pipelines
   image:
     name: $HAPROXY_REGISTRY_GO/golang:latest-alpine
     entrypoint: [""]
@@ -60,9 +56,7 @@ format:
 lint:
   stage: lint
   needs: []
-  rules:
-    - if: $CI_PIPELINE_SOURCE == 'merge_request_event'
-    - if: $CI_PIPELINE_SOURCE == 'push'
+  extends: .all-pipelines
   image:
     name: $HAPROXY_REGISTRY_GO/golang:latest-alpine
     entrypoint: [""]
@@ -91,6 +85,7 @@ commit-policy:
   needs: []
   variables:
     GIT_DEPTH: "0"
+  # MR-only: needs an MR commit range.
   rules:
     - if: $CI_PIPELINE_SOURCE == 'merge_request_event'
   image:

.gitlab/security.yml

@@ -1,9 +1,7 @@
 license:
   stage: security
   needs: ["tidy"]
-  rules:
-    - if: $CI_PIPELINE_SOURCE == 'merge_request_event'
-    - if: $CI_PIPELINE_SOURCE == 'push'
+  extends: .all-pipelines
   image:
     name: $HAPROXY_REGISTRY_GO/golang:latest-alpine
     entrypoint: [""]
@@ -27,9 +25,7 @@ license:
 govulncheck:
   stage: security
   needs: []
-  rules:
-    - if: $CI_PIPELINE_SOURCE == 'merge_request_event'
-    - if: $CI_PIPELINE_SOURCE == 'push'
+  extends: .all-pipelines
   image:
     name: $HAPROXY_REGISTRY_GO/golang:latest-alpine
     entrypoint: [""]

.gitlab/test.yml

@@ -4,9 +4,7 @@
 test-e2e:
   stage: test
   needs: []
-  rules:
-    - if: $CI_PIPELINE_SOURCE == 'merge_request_event'
-    - if: $CI_PIPELINE_SOURCE == 'push'
+  extends: .all-pipelines
   image: $CI_REGISTRY_GO/docker:$DOCKER_VERSION-go$GO_VERSION
   services:
     - name: $CI_REGISTRY_GO/docker:$DOCKER_VERSION-dind
@@ -40,9 +38,7 @@ test-e2e:
 test:
   stage: test
   needs: []
-  rules:
-    - if: $CI_PIPELINE_SOURCE == 'merge_request_event'
-    - if: $CI_PIPELINE_SOURCE == 'push'
+  extends: .all-pipelines
   image:
     name: $HAPROXY_REGISTRY_GO/golang:latest-alpine
     entrypoint: [""]