.gitlab-ci.yml: Move coverity build to internal Heimdal
[samba.git] / .gitlab-ci-main.yml
index 1850db0a66a0cedeca52ac6303120ad999865bae..3925d48e330a7cdb7dc5b894a4788ac6e798e31e 100644 (file)
@@ -30,8 +30,11 @@ variables:
   #
   GIT_STRATEGY: fetch
   GIT_DEPTH: "3"
-  # "--enable-coverage" or ""
-  SAMBA_CI_AUTOBUILD_ENABLE_COVERAGE: ""
+  #
+  # Use GZip by default, it is fast and is good enough.  Other options include --xz
+
+  SAMBA_TESTBASE_TAR_OPTIONS: -z
+
   #
   # we run autobuild.py inside a samba CI docker image located on gitlab's registry
   # overwrite this variable if you want use your own image registry.
@@ -44,28 +47,26 @@ variables:
   # Set this to the contents of bootstrap/sha1sum.txt
   # which is generated by bootstrap/template.py --render
   #
-  SAMBA_CI_CONTAINER_TAG: f25e1fa0a828f428ade0e4f37d8a646ff1e207d4
+  SAMBA_CI_CONTAINER_TAG: 21a93787675107f010836bbfa5e8542c272bc4b0
   #
-  # We use the ubuntu1804 image as default as
-  # it matches what we have on sn-devel-184.
+  # We use the ubuntu2204 image as default as
+  # it matches what we have on atb-devel-224
   #
-  SAMBA_CI_CONTAINER_IMAGE: ubuntu1804
+  SAMBA_CI_CONTAINER_IMAGE: ubuntu2204
   #
   # The following images are available
   # Please see the samba-o3 sections at the end of this file!
   # We should run that for each available image
   #
-  SAMBA_CI_CONTAINER_IMAGE_ubuntu1604: ubuntu1604
-  SAMBA_CI_CONTAINER_IMAGE_ubuntu1804: ubuntu1804
   SAMBA_CI_CONTAINER_IMAGE_ubuntu2004: ubuntu2004
-  SAMBA_CI_CONTAINER_IMAGE_debian9: debian9
-  SAMBA_CI_CONTAINER_IMAGE_debian10: debian10
-  SAMBA_CI_CONTAINER_IMAGE_opensuse151: opensuse151
-  SAMBA_CI_CONTAINER_IMAGE_opensuse152: opensuse152
-  SAMBA_CI_CONTAINER_IMAGE_fedora32: fedora32
-  SAMBA_CI_CONTAINER_IMAGE_fedora33: fedora33
+  SAMBA_CI_CONTAINER_IMAGE_ubuntu2204: ubuntu2204
+  SAMBA_CI_CONTAINER_IMAGE_debian11: debian11
+  SAMBA_CI_CONTAINER_IMAGE_debian11_32bit: debian11-32bit
+  SAMBA_CI_CONTAINER_IMAGE_debian12: debian12
+  SAMBA_CI_CONTAINER_IMAGE_opensuse155: opensuse155
+  SAMBA_CI_CONTAINER_IMAGE_fedora38: fedora38
   SAMBA_CI_CONTAINER_IMAGE_centos7: centos7
-  SAMBA_CI_CONTAINER_IMAGE_centos8: centos8
+  SAMBA_CI_CONTAINER_IMAGE_centos8s: centos8s
 
 include:
   # The image creation details are specified in a separate file
@@ -85,13 +86,30 @@ include:
   interruptible: true
   timeout: 2h
 
+  # Otherwise we run twice, once on push and once on MR
+  # https://forum.gitlab.com/t/new-rules-syntax-and-detached-pipelines/37292
+  rules:
+    - if: $CI_MERGE_REQUEST_ID
+      when: never
+    - when: on_success
+
   variables:
     AUTOBUILD_JOB_NAME: $CI_JOB_NAME
   stage: build
   cache:
-    key: ccache.${CI_JOB_NAME}.${SAMBA_CI_JOB_IMAGE}
+    key: ccache.${CI_JOB_NAME}.${SAMBA_CI_JOB_IMAGE}.${SAMBA_CI_FLAVOR}
     paths:
       - ccache
+
+  # This is overridden in many cases, but ensures none of the other
+  # main jobs start until and unless this build finishes.  However
+  # this also ensures we do not download artifacts from any build
+  # unless we specifically depend on it, saving bandwidth
+
+  needs:
+    - job: samba-def-build
+      artifacts: false
+
   before_script:
     - uname -a
     - lsb_release -a
@@ -121,6 +139,8 @@ include:
     - export CXX="ccache c++"
     - ccache -z -M 500M
     - ccache -s
+      # We are already running .gitlab-ci directives from this repo, remove additional checks that break our CI
+    - git config --global --add safe.directory `pwd`
   after_script:
     - mount
     - df -h
@@ -133,6 +153,7 @@ include:
       - "*.stdout"
       - "*.stderr"
       - "*.info"
+      - public
       - system-info.txt
   retry:
     max: 2
@@ -142,7 +163,6 @@ include:
       - api_failure
       - runner_unsupported
       - stale_schedule
-      - job_execution_timeout
       - archived_failure
       - scheduler_failure
       - data_integrity_failure
@@ -150,7 +170,7 @@ include:
   script:
     # gitlab predefines CI_JOB_NAME for each job. The gitlab job usually matches the
     # autobuild name, which means we can define a default template that runs most autobuild jobs
-    - script/autobuild.py $AUTOBUILD_JOB_NAME $SAMBA_CI_AUTOBUILD_ENABLE_COVERAGE  --verbose --nocleanup --keeplogs --tail --full-testbase /tmp/samba-testbase
+    - script/autobuild.py $AUTOBUILD_JOB_NAME $SAMBA_CI_AUTOBUILD_ENABLE_COVERAGE  --verbose --nocleanup --keeplogs --tail --full-testbase /builds/samba-testbase
 
 # Ensure when adding a new job below that you also add it to
 # the dependencies for 'pages' below for the code coverage page
@@ -159,18 +179,19 @@ include:
 others:
   extends: .shared_template
   script:
-    - script/autobuild.py ldb      $SAMBA_CI_AUTOBUILD_ENABLE_COVERAGE --verbose --nocleanup --keeplogs --tail --full-testbase /tmp/samba-testbase/ldb
-    - script/autobuild.py pidl     $SAMBA_CI_AUTOBUILD_ENABLE_COVERAGE --verbose --nocleanup --keeplogs --tail --full-testbase /tmp/samba-testbase/pidl
-    - script/autobuild.py replace  $SAMBA_CI_AUTOBUILD_ENABLE_COVERAGE --verbose --nocleanup --keeplogs --tail --full-testbase /tmp/samba-testbase/replace
-    - script/autobuild.py talloc   $SAMBA_CI_AUTOBUILD_ENABLE_COVERAGE --verbose --nocleanup --keeplogs --tail --full-testbase /tmp/samba-testbase/talloc
-    - script/autobuild.py tdb      $SAMBA_CI_AUTOBUILD_ENABLE_COVERAGE --verbose --nocleanup --keeplogs --tail --full-testbase /tmp/samba-testbase/tdb
-    - script/autobuild.py tevent   $SAMBA_CI_AUTOBUILD_ENABLE_COVERAGE --verbose --nocleanup --keeplogs --tail --full-testbase /tmp/samba-testbase/tevent
-    - script/autobuild.py samba-xc $SAMBA_CI_AUTOBUILD_ENABLE_COVERAGE --verbose --nocleanup --keeplogs --tail --full-testbase /tmp/samba-testbase/samba-xc
-    - script/autobuild.py docs-xml $SAMBA_CI_AUTOBUILD_ENABLE_COVERAGE --verbose --nocleanup --keeplogs --tail --full-testbase /tmp/samba-testbase/docs-xml
+    - script/autobuild.py ldb      $SAMBA_CI_AUTOBUILD_ENABLE_COVERAGE --verbose --nocleanup --keeplogs --tail --full-testbase /builds/samba-testbase/ldb
+    - script/autobuild.py pidl     $SAMBA_CI_AUTOBUILD_ENABLE_COVERAGE --verbose --nocleanup --keeplogs --tail --full-testbase /builds/samba-testbase/pidl
+    - script/autobuild.py replace  $SAMBA_CI_AUTOBUILD_ENABLE_COVERAGE --verbose --nocleanup --keeplogs --tail --full-testbase /builds/samba-testbase/replace
+    - script/autobuild.py talloc   $SAMBA_CI_AUTOBUILD_ENABLE_COVERAGE --verbose --nocleanup --keeplogs --tail --full-testbase /builds/samba-testbase/talloc
+    - script/autobuild.py tdb      $SAMBA_CI_AUTOBUILD_ENABLE_COVERAGE --verbose --nocleanup --keeplogs --tail --full-testbase /builds/samba-testbase/tdb
+    - script/autobuild.py tevent   $SAMBA_CI_AUTOBUILD_ENABLE_COVERAGE --verbose --nocleanup --keeplogs --tail --full-testbase /builds/samba-testbase/tevent
+    - script/autobuild.py samba-xc $SAMBA_CI_AUTOBUILD_ENABLE_COVERAGE --verbose --nocleanup --keeplogs --tail --full-testbase /builds/samba-testbase/samba-xc
+    - script/autobuild.py docs-xml $SAMBA_CI_AUTOBUILD_ENABLE_COVERAGE --verbose --nocleanup --keeplogs --tail --full-testbase /builds/samba-testbase/docs-xml
 
 .shared_template_build_only:
   extends: .shared_template
-  timeout: 45m
+  timeout: 2h
+  needs:
   artifacts:
     expire_in: 1 week
     paths:
@@ -178,25 +199,26 @@ others:
       - "*.stderr"
       - "*.info"
       - system-info.txt
-      - samba-testbase.tar.gz
+      - samba-testbase.tar
   script:
     # gitlab predefines CI_JOB_NAME for each job. The gitlab job usually matches the
     # autobuild name, which means we can define a default template that runs most autobuild jobs
-    - script/autobuild.py $AUTOBUILD_JOB_NAME $SAMBA_CI_AUTOBUILD_ENABLE_COVERAGE  --verbose --nocleanup --keeplogs --tail --full-testbase /tmp/samba-testbase
+    - script/autobuild.py $AUTOBUILD_JOB_NAME $SAMBA_CI_AUTOBUILD_ENABLE_COVERAGE  --verbose --nocleanup --keeplogs --tail --full-testbase /builds/samba-testbase
     # On success we need to pack everything into an artifacts file
     # which needs to be in the git checkout.
     # As tar doesn't handle hardlink of read-only files,
     # we remember the acls and add write permissions
     # before creating the archive. The consumer will apply
     # the acls again.
-    - cp -a /sha1sum.txt /tmp/samba-testbase/image-sha1sum.txt
-    - cp -a /tmp/commit.txt /tmp/samba-testbase/commit.txt
-    - pushd /tmp && getfacl -R samba-testbase > samba-testbase.acl.dump && popd
-    - chmod -R +w /tmp/samba-testbase
-    - mv /tmp/samba-testbase.acl.dump /tmp/samba-testbase/
-    - tar cfz samba-testbase.tar.gz /tmp/samba-testbase
-    - ls -la samba-testbase.tar.gz
-    - sha1sum samba-testbase.tar.gz
+    - cp -a /sha1sum.txt /builds/samba-testbase/image-sha1sum.txt
+    - cp -a /tmp/commit.txt /builds/samba-testbase/commit.txt
+    - ln -s /builds/samba-testbase/${AUTOBUILD_JOB_NAME}/ /builds/samba-testbase/build_subdir_link
+    - pushd /builds && getfacl -R samba-testbase > samba-testbase.acl.dump && popd
+    - chmod -R +w /builds/samba-testbase
+    - mv /builds/samba-testbase.acl.dump /builds/samba-testbase/
+    - tar $SAMBA_TESTBASE_TAR_OPTIONS -cf samba-testbase.tar /builds/samba-testbase
+    - ls -la samba-testbase.tar
+    - sha1sum samba-testbase.tar
 
 .shared_template_test_only:
   extends:
@@ -204,18 +226,27 @@ others:
     - .shared_runner_test
   stage: test_only
   script:
+    # Print the Kerberos version to check we ended up with the right one
+    # in the runner. We do not have configure output to recognize it
+    # otherwise.
+    - if [ -x "$(command -v krb5-config)" ]; then krb5-config --version; fi
     # We unpack the artifacts file created by the .shared_template_build_only
     # run we depend on
-    - ls -la samba-testbase.tar.gz
-    - sha1sum samba-testbase.tar.gz
-    - tar xfz samba-testbase.tar.gz -C /
-    - diff -u /tmp/samba-testbase/image-sha1sum.txt /sha1sum.txt
-    - diff -u /tmp/samba-testbase/commit.txt /tmp/commit.txt
-    - mv /tmp/samba-testbase/samba-testbase.acl.dump /tmp/samba-testbase.acl.dump
-    - pushd /tmp && setfacl --restore=/tmp/samba-testbase.acl.dump && popd
+    - ls -la samba-testbase.tar
+    - sha1sum samba-testbase.tar
+    - tar $SAMBA_TESTBASE_TAR_OPTIONS -xf samba-testbase.tar -C /
+    - diff -u /builds/samba-testbase/image-sha1sum.txt /sha1sum.txt
+    - diff -u /builds/samba-testbase/commit.txt /tmp/commit.txt
+    - mv /builds/samba-testbase/samba-testbase.acl.dump /builds/samba-testbase.acl.dump
+    - pushd /builds && setfacl --restore=/builds/samba-testbase.acl.dump && popd
+    - ls -la /builds/samba-testbase/
+    - ls -la /builds/samba-testbase/build_subdir_link
+    - ls -la /builds/samba-testbase/build_subdir_link/
+    - if [ -n "$SAMBA_CI_AUTOBUILD_ENABLE_COVERAGE" ]; then find /builds/samba-testbase/build_subdir_link/ -type d -printf "'%p'\n" | xargs chmod u+w; fi
+    - ls -la /builds/samba-testbase/build_subdir_link/
     # gitlab predefines CI_JOB_NAME for each job. The gitlab job usually matches the
     # autobuild name, which means we can define a default template that runs most autobuild jobs
-    - script/autobuild.py $AUTOBUILD_JOB_NAME $SAMBA_CI_AUTOBUILD_ENABLE_COVERAGE --skip-dependencies --verbose --nocleanup --keeplogs --tail --full-testbase /tmp/samba-testbase
+    - script/autobuild.py $AUTOBUILD_JOB_NAME $SAMBA_CI_AUTOBUILD_ENABLE_COVERAGE --skip-dependencies --verbose --nocleanup --keeplogs --tail --full-testbase /builds/samba-testbase
 
 samba-def-build:
   extends: .shared_template_build_only
@@ -226,16 +257,22 @@ samba-def-build:
   needs:
     - job: samba-def-build
       artifacts: true
+    - job: samba-codecheck
 
 samba-mit-build:
   extends: .shared_template_build_only
+  variables:
+    SAMBA_CI_JOB_IMAGE: ${SAMBA_CI_CONTAINER_IMAGE_fedora38}
   stage: build_first
 
 .needs_samba-mit-build:
   extends: .shared_template_test_only
+  variables:
+    SAMBA_CI_JOB_IMAGE: ${SAMBA_CI_CONTAINER_IMAGE_fedora38}
   needs:
     - job: samba-mit-build
       artifacts: true
+    - job: samba-codecheck
 
 samba-h5l-build:
   extends: .shared_template_build_only
@@ -246,6 +283,15 @@ samba-h5l-build:
     - job: samba-h5l-build
       artifacts: true
 
+samba-without-smb1-build:
+  extends: .shared_template_build_only
+
+.needs_samba-without-smb1-build:
+  extends: .shared_template_test_only
+  needs:
+    - job: samba-without-smb1-build
+      artifacts: true
+
 samba-nt4-build:
   extends: .shared_template_build_only
 
@@ -269,10 +315,15 @@ samba:
 
 samba-mitkrb5:
   extends: .shared_template
+  variables:
+    SAMBA_CI_JOB_IMAGE: ${SAMBA_CI_CONTAINER_IMAGE_fedora38}
 
 samba-minimal-smbd:
   extends: .shared_template
 
+samba-nopython:
+  extends: .shared_template
+
 samba-admem:
   extends: .needs_samba-def-build
 
@@ -282,7 +333,10 @@ samba-ad-dc-2:
 samba-ad-dc-3:
   extends: .needs_samba-def-build
 
-samba-ad-dc-4:
+samba-ad-dc-4a:
+  extends: .needs_samba-def-build
+
+samba-ad-dc-4b:
   extends: .needs_samba-def-build
 
 samba-ad-dc-5:
@@ -306,7 +360,8 @@ samba-libs:
 samba-fuzz:
   extends: .shared_template
   variables:
-    SAMBA_CI_JOB_IMAGE: ${SAMBA_CI_CONTAINER_IMAGE_ubuntu1604}
+    # We match what Google is running over at oss-fuzz
+    SAMBA_CI_JOB_IMAGE: ${SAMBA_CI_CONTAINER_IMAGE_ubuntu2004}
 
 ctdb:
   extends: .shared_template
@@ -320,7 +375,10 @@ samba-ad-dc-ntvfs:
 samba-admem-mit:
   extends: .needs_samba-mit-build
 
-samba-ad-dc-4-mitkrb5:
+samba-addc-mit-4a:
+  extends: .needs_samba-mit-build
+
+samba-addc-mit-4b:
   extends: .needs_samba-mit-build
 
 # This task is run first to ensure we compile before we start the
@@ -328,18 +386,28 @@ samba-ad-dc-4-mitkrb5:
 samba-fips:
   extends: .shared_template
   variables:
-    SAMBA_CI_JOB_IMAGE: ${SAMBA_CI_CONTAINER_IMAGE_fedora33}
+    SAMBA_CI_JOB_IMAGE: ${SAMBA_CI_CONTAINER_IMAGE_fedora38}
+
+samba-codecheck:
+  extends: .shared_template
+  needs:
+  variables:
+    SAMBA_CI_JOB_IMAGE: ${SAMBA_CI_CONTAINER_IMAGE_fedora38}
+  stage: build_first
 
 .private_test_only:
   extends: .private_runner_test
   stage: test_private
-  only:
-    variables:
+  rules:
+      # See above, to avoid a duplicate CI on the MR (these rules override the others)
+    - if: $CI_MERGE_REQUEST_ID
+      when: never
+
       # These jobs are only run if the gitlab repo has private runners available.
       # To enable private jobs, you must add the following var and value to
       # your gitlab repo by navigating to:
       # settings -> CI/CD -> Environment variables
-      - $SUPPORT_PRIVATE_TEST == "yes"
+    - if: $SUPPORT_PRIVATE_TEST == "yes"
 
 .needs_samba-def-build-private:
   extends:
@@ -356,6 +424,11 @@ samba-fips:
     - .needs_samba-h5l-build
     - .private_test_only
 
+.needs_samba-without-smb1-build-private:
+  extends:
+    - .needs_samba-without-smb1-build
+    - .private_test_only
+
 .needs_samba-nt4-build-private:
   extends:
     - .needs_samba-nt4-build
@@ -369,16 +442,29 @@ samba-fips:
 samba-fileserver:
   extends: .needs_samba-h5l-build-private
 
+samba-fileserver-without-smb1:
+  extends: .needs_samba-without-smb1-build-private
+
+# This is a full build without the AD DC so we test the build with MIT
+# Kerberos from the default system (Ubuntu 22.04 at this stage).
+# Runtime behaviour checked via the ktest (static ccache and keytab)
+# environment
+samba-ktest-mit:
+ extends: .shared_template
+
 samba-ad-dc-1:
   extends: .needs_samba-def-build-private
 
 samba-nt4:
   extends: .needs_samba-nt4-build-private
 
-samba-ad-dc-1-mitkrb5:
+samba-addc-mit-1:
   extends: .needs_samba-mit-build-private
 
-samba-no-opath:
+samba-no-opath1:
+  extends: .needs_samba-no-opath-build-private
+
+samba-no-opath2:
   extends: .needs_samba-no-opath-build-private
 
 # 'pages' is a special job which can publish artifacts in `public` dir to gitlab pages
@@ -392,30 +478,40 @@ pages:
     - samba-admem
     - samba-ad-dc-2
     - samba-ad-dc-3
-    - samba-ad-dc-4
+    - samba-ad-dc-4a
+    - samba-ad-dc-4b
     - samba-ad-dc-5
     - samba-ad-dc-6
     - samba-libs
     - samba-minimal-smbd
+    - samba-nopython
     - samba-fuzz
     # - ctdb  # TODO
     - samba-ctdb
     - samba-ad-dc-ntvfs
     - samba-admem-mit
-    - samba-ad-dc-4-mitkrb5
+    - samba-addc-mit-4a
+    - samba-addc-mit-4b
     - samba-ad-back1
     - samba-ad-back2
     - samba-fileserver
+    - samba-fileserver-without-smb1
     - samba-ad-dc-1
     - samba-nt4
     - samba-schemaupgrade
-    - samba-ad-dc-1-mitkrb5
+    - samba-addc-mit-1
     - samba-fips
+    - samba-no-opath1
+    - samba-no-opath2
+    - ubuntu2204-samba-o3
   script:
+    - ls -la *.info
     - ./configure.developer
     - make -j
+    - ls -la *.info
     - lcov $(ls *.info | xargs -I{} echo -n "-a {} ") -o all.info
-    - genhtml all.info --output-directory public --prefix=$(pwd) --title "coverage report for $CI_COMMIT_REF_NAME $CI_COMMIT_SHORT_SHA"
+    - ls -la *.info
+    - genhtml all.info --ignore-errors source --output-directory public --prefix=$(pwd) --title "coverage report for $CI_COMMIT_REF_NAME $CI_COMMIT_SHORT_SHA"
   artifacts:
     expire_in: 30 days
     paths:
@@ -428,12 +524,12 @@ pages:
 coverity:
   extends: .shared_runner_build_image
   variables:
-    SAMBA_CI_JOB_IMAGE: ${SAMBA_CI_CONTAINER_IMAGE_fedora33}
+    SAMBA_CI_JOB_IMAGE: ${SAMBA_CI_CONTAINER_IMAGE_opensuse155}
   stage: build
   script:
     - wget https://scan.coverity.com/download/linux64 --post-data "token=$COVERITY_SCAN_TOKEN&project=$COVERITY_SCAN_PROJECT_NAME" -O /tmp/coverity_tool.tgz
     - tar xf /tmp/coverity_tool.tgz
-    - ./configure.developer --with-cluster-support --with-system-mitkrb5 --with-experimental-mit-ad-dc
+    - ./configure.developer --with-cluster-support
     - cov-analysis-linux64-*/bin/cov-build --dir cov-int make -j$(nproc)
     - tar czf cov-int.tar.gz cov-int
     - curl
@@ -457,43 +553,74 @@ coverity:
     paths:
       - cov-int/*.txt
 
+debian11-samba-32bit:
+  extends: .shared_template
+  variables:
+    AUTOBUILD_JOB_NAME: samba-32bit
+    SAMBA_CI_JOB_IMAGE: ${SAMBA_CI_CONTAINER_IMAGE_debian11_32bit}
+
 #
 # We build samba-o3 on all supported distributions
 #
 
-.samba-o3-template:
+# This job, which matches the main CI, needs to still do coverage so
+# we show the coverage on the "none" environment tests
+#
+# We want --enable-coverage specified here otherwise we will have a
+# different set of build options on the coverage build and can fail
+# when -O3 gets combined with --enable-coverage in the scheduled
+# builds.
+
+ubuntu2204-samba-o3:
   extends: .shared_template
   variables:
     AUTOBUILD_JOB_NAME: samba-o3
-  only:
-    variables:
-      # do not run o3 for coverage since they are using different images
-      - $SAMBA_CI_AUTOBUILD_ENABLE_COVERAGE == ""
-
-ubuntu1804-samba-o3:
-  extends: .samba-o3-template
+    SAMBA_CI_JOB_IMAGE: ${SAMBA_CI_CONTAINER_IMAGE_ubuntu2204}
+    SAMBA_CI_AUTOBUILD_ENABLE_COVERAGE: "--enable-coverage"
+  rules:
+    # See above, to avoid a duplicate CI on the MR (these rules override the others)
+    - if: $CI_MERGE_REQUEST_ID
+      when: never
+    # do not run o3 builds (which run a lot of VMs) if told not to
+    # (this uses the same variable as autobuild.py)
+    - if: $AUTOBUILD_SKIP_SAMBA_O3 == "1"
+      when: never
+
+# All other jobs do not want code coverage.
+.samba-o3-template:
+  extends: .shared_template
   variables:
-    SAMBA_CI_JOB_IMAGE: ${SAMBA_CI_CONTAINER_IMAGE_ubuntu1804}
+    AUTOBUILD_JOB_NAME: samba-o3
+  rules:
+    # See above, to avoid a duplicate CI on the MR (these rules override the others)
+    - if: $CI_MERGE_REQUEST_ID
+      when: never
+    # do not run o3 builds (which run a lot of VMs) if told not to
+    # (this uses the same variable as autobuild.py)
+    - if: $AUTOBUILD_SKIP_SAMBA_O3 == "1"
+      when: never
+    # do not run o3 for coverage since they are using different images
+    - if: $SAMBA_CI_AUTOBUILD_ENABLE_COVERAGE == ""
 
 ubuntu2004-samba-o3:
   extends: .samba-o3-template
   variables:
     SAMBA_CI_JOB_IMAGE: ${SAMBA_CI_CONTAINER_IMAGE_ubuntu2004}
 
-debian10-samba-o3:
+debian11-samba-o3:
   extends: .samba-o3-template
   variables:
-    SAMBA_CI_JOB_IMAGE: ${SAMBA_CI_CONTAINER_IMAGE_debian10}
+    SAMBA_CI_JOB_IMAGE: ${SAMBA_CI_CONTAINER_IMAGE_debian11}
 
-opensuse151-samba-o3:
+debian12-samba-o3:
   extends: .samba-o3-template
   variables:
-    SAMBA_CI_JOB_IMAGE: ${SAMBA_CI_CONTAINER_IMAGE_opensuse151}
+    SAMBA_CI_JOB_IMAGE: ${SAMBA_CI_CONTAINER_IMAGE_debian12}
 
-opensuse152-samba-o3:
+opensuse155-samba-o3:
   extends: .samba-o3-template
   variables:
-    SAMBA_CI_JOB_IMAGE: ${SAMBA_CI_CONTAINER_IMAGE_opensuse152}
+    SAMBA_CI_JOB_IMAGE: ${SAMBA_CI_CONTAINER_IMAGE_opensuse155}
 
 centos7-samba-o3:
   extends: .samba-o3-template
@@ -502,22 +629,17 @@ centos7-samba-o3:
     # Git on CentOS doesn't support shallow git cloning
     GIT_DEPTH: ""
     # We need a newer GnuTLS version on CentOS7
-    PKG_CONFIG_PATH: "/usr/lib64/compat-gnutls34/pkgconfig:/usr/lib64/compat-nettle32/pkgconfig"
-
-centos8-samba-o3:
-  extends: .samba-o3-template
-  variables:
-    SAMBA_CI_JOB_IMAGE: ${SAMBA_CI_CONTAINER_IMAGE_centos8}
+    PKG_CONFIG_PATH: "/usr/lib64/compat-gnutls37/pkgconfig:/usr/lib64/compat-nettle32/pkgconfig"
 
-fedora32-samba-o3:
+centos8s-samba-o3:
   extends: .samba-o3-template
   variables:
-    SAMBA_CI_JOB_IMAGE: ${SAMBA_CI_CONTAINER_IMAGE_fedora32}
+    SAMBA_CI_JOB_IMAGE: ${SAMBA_CI_CONTAINER_IMAGE_centos8s}
 
-fedora33-samba-o3:
+fedora38-samba-o3:
   extends: .samba-o3-template
   variables:
-    SAMBA_CI_JOB_IMAGE: ${SAMBA_CI_CONTAINER_IMAGE_fedora33}
+    SAMBA_CI_JOB_IMAGE: ${SAMBA_CI_CONTAINER_IMAGE_fedora38}
 
 #
 # Keep the samba-o3 sections at the end ...