.gitlab-ci.yml: Move coverity build to internal Heimdal
[samba.git] / .gitlab-ci-main.yml
index f74c8052101b595671be155d01999f82845a3222..3925d48e330a7cdb7dc5b894a4788ac6e798e31e 100644 (file)
@@ -30,8 +30,11 @@ variables:
   #
   GIT_STRATEGY: fetch
   GIT_DEPTH: "3"
-  # "--enable-coverage" or ""
-  SAMBA_CI_AUTOBUILD_ENABLE_COVERAGE: ""
+  #
+  # Use GZip by default, it is fast and is good enough.  Other options include --xz
+
+  SAMBA_TESTBASE_TAR_OPTIONS: -z
+
   #
   # we run autobuild.py inside a samba CI docker image located on gitlab's registry
   # overwrite this variable if you want use your own image registry.
@@ -44,51 +47,69 @@ variables:
   # Set this to the contents of bootstrap/sha1sum.txt
   # which is generated by bootstrap/template.py --render
   #
-  SAMBA_CI_CONTAINER_TAG: c4c00eb35cae36d8d6e752ee01fd943432993721
+  SAMBA_CI_CONTAINER_TAG: 21a93787675107f010836bbfa5e8542c272bc4b0
   #
-  # We use the ubuntu1804 image as default as
-  # it matches what we have on sn-devel-184.
+  # We use the ubuntu2204 image as default as
+  # it matches what we have on atb-devel-224
   #
-  SAMBA_CI_CONTAINER_IMAGE: ubuntu1804
+  SAMBA_CI_CONTAINER_IMAGE: ubuntu2204
   #
   # The following images are available
   # Please see the samba-o3 sections at the end of this file!
   # We should run that for each available image
   #
-  SAMBA_CI_CONTAINER_IMAGE_ubuntu1604: ${SAMBA_CI_CONTAINER_REGISTRY}/samba-ci-ubuntu1604:${SAMBA_CI_CONTAINER_TAG}
-  SAMBA_CI_CONTAINER_IMAGE_ubuntu1804: ${SAMBA_CI_CONTAINER_REGISTRY}/samba-ci-ubuntu1804:${SAMBA_CI_CONTAINER_TAG}
-  SAMBA_CI_CONTAINER_IMAGE_ubuntu2004: ${SAMBA_CI_CONTAINER_REGISTRY}/samba-ci-ubuntu2004:${SAMBA_CI_CONTAINER_TAG}
-  SAMBA_CI_CONTAINER_IMAGE_debian9: ${SAMBA_CI_CONTAINER_REGISTRY}/samba-ci-debian9:${SAMBA_CI_CONTAINER_TAG}
-  SAMBA_CI_CONTAINER_IMAGE_debian10: ${SAMBA_CI_CONTAINER_REGISTRY}/samba-ci-debian10:${SAMBA_CI_CONTAINER_TAG}
-  SAMBA_CI_CONTAINER_IMAGE_opensuse151: ${SAMBA_CI_CONTAINER_REGISTRY}/samba-ci-opensuse151:${SAMBA_CI_CONTAINER_TAG}
-  SAMBA_CI_CONTAINER_IMAGE_opensuse152: ${SAMBA_CI_CONTAINER_REGISTRY}/samba-ci-opensuse152:${SAMBA_CI_CONTAINER_TAG}
-  SAMBA_CI_CONTAINER_IMAGE_fedora32: ${SAMBA_CI_CONTAINER_REGISTRY}/samba-ci-fedora32:${SAMBA_CI_CONTAINER_TAG}
-  SAMBA_CI_CONTAINER_IMAGE_fedora33: ${SAMBA_CI_CONTAINER_REGISTRY}/samba-ci-fedora33:${SAMBA_CI_CONTAINER_TAG}
-  SAMBA_CI_CONTAINER_IMAGE_centos7: ${SAMBA_CI_CONTAINER_REGISTRY}/samba-ci-centos7:${SAMBA_CI_CONTAINER_TAG}
-  SAMBA_CI_CONTAINER_IMAGE_centos8: ${SAMBA_CI_CONTAINER_REGISTRY}/samba-ci-centos8:${SAMBA_CI_CONTAINER_TAG}
+  SAMBA_CI_CONTAINER_IMAGE_ubuntu2004: ubuntu2004
+  SAMBA_CI_CONTAINER_IMAGE_ubuntu2204: ubuntu2204
+  SAMBA_CI_CONTAINER_IMAGE_debian11: debian11
+  SAMBA_CI_CONTAINER_IMAGE_debian11_32bit: debian11-32bit
+  SAMBA_CI_CONTAINER_IMAGE_debian12: debian12
+  SAMBA_CI_CONTAINER_IMAGE_opensuse155: opensuse155
+  SAMBA_CI_CONTAINER_IMAGE_fedora38: fedora38
+  SAMBA_CI_CONTAINER_IMAGE_centos7: centos7
+  SAMBA_CI_CONTAINER_IMAGE_centos8s: centos8s
 
 include:
   # The image creation details are specified in a separate file
   # See bootstrap/README.md for details
   - 'bootstrap/.gitlab-ci.yml'
 
+.shared_runner_build_image:
+  extends: .shared_runner_build
+  variables:
+    SAMBA_CI_JOB_IMAGE: ${SAMBA_CI_CONTAINER_IMAGE}
+  image: ${SAMBA_CI_CONTAINER_REGISTRY}/samba-ci-${SAMBA_CI_JOB_IMAGE}:${SAMBA_CI_CONTAINER_TAG}
+
 .shared_template:
+  extends: .shared_runner_build_image
   # All Samba jobs are interruptible, this avoids burning CPU when a
   # newer branch is pushed.
   interruptible: true
   timeout: 2h
 
+  # Otherwise we run twice, once on push and once on MR
+  # https://forum.gitlab.com/t/new-rules-syntax-and-detached-pipelines/37292
+  rules:
+    - if: $CI_MERGE_REQUEST_ID
+      when: never
+    - when: on_success
+
   variables:
     AUTOBUILD_JOB_NAME: $CI_JOB_NAME
-  image: ${SAMBA_CI_CONTAINER_REGISTRY}/samba-ci-${SAMBA_CI_CONTAINER_IMAGE}:${SAMBA_CI_CONTAINER_TAG}
   stage: build
-  tags:
-    - docker
-    - shared
   cache:
-    key: ccache.${CI_JOB_NAME}
+    key: ccache.${CI_JOB_NAME}.${SAMBA_CI_JOB_IMAGE}.${SAMBA_CI_FLAVOR}
     paths:
       - ccache
+
+  # This is overridden in many cases, but ensures none of the other
+  # main jobs start until and unless this build finishes.  However
+  # this also ensures we do not download artifacts from any build
+  # unless we specifically depend on it, saving bandwidth
+
+  needs:
+    - job: samba-def-build
+      artifacts: false
+
   before_script:
     - uname -a
     - lsb_release -a
@@ -104,6 +125,8 @@ include:
       # See bootstrap/.gitlab-ci.yml how to generate a new image
     - echo "SAMBA_CI_CONTAINER_REGISTRY[${SAMBA_CI_CONTAINER_REGISTRY}]"
     - echo "SAMBA_CI_CONTAINER_TAG[${SAMBA_CI_CONTAINER_TAG}]"
+    - echo "SAMBA_CI_JOB_IMAGE[${SAMBA_CI_JOB_IMAGE}]"
+    - echo "CI_JOB_IMAGE[${CI_JOB_IMAGE}]"
     - bootstrap/template.py --sha1sum > /tmp/sha1sum-template.txt
     - diff -u bootstrap/sha1sum.txt /tmp/sha1sum-template.txt
     - echo "${SAMBA_CI_CONTAINER_TAG}" > /tmp/sha1sum-tag.txt
@@ -116,6 +139,8 @@ include:
     - export CXX="ccache c++"
     - ccache -z -M 500M
     - ccache -s
+      # We are already running .gitlab-ci directives from this repo, remove additional checks that break our CI
+    - git config --global --add safe.directory `pwd`
   after_script:
     - mount
     - df -h
@@ -128,6 +153,7 @@ include:
       - "*.stdout"
       - "*.stderr"
       - "*.info"
+      - public
       - system-info.txt
   retry:
     max: 2
@@ -137,7 +163,6 @@ include:
       - api_failure
       - runner_unsupported
       - stale_schedule
-      - job_execution_timeout
       - archived_failure
       - scheduler_failure
       - data_integrity_failure
@@ -145,7 +170,7 @@ include:
   script:
     # gitlab predefines CI_JOB_NAME for each job. The gitlab job usually matches the
     # autobuild name, which means we can define a default template that runs most autobuild jobs
-    - script/autobuild.py $AUTOBUILD_JOB_NAME $SAMBA_CI_AUTOBUILD_ENABLE_COVERAGE  --verbose --nocleanup --keeplogs --tail --full-testbase /tmp/samba-testbase
+    - script/autobuild.py $AUTOBUILD_JOB_NAME $SAMBA_CI_AUTOBUILD_ENABLE_COVERAGE  --verbose --nocleanup --keeplogs --tail --full-testbase /builds/samba-testbase
 
 # Ensure when adding a new job below that you also add it to
 # the dependencies for 'pages' below for the code coverage page
@@ -154,18 +179,19 @@ include:
 others:
   extends: .shared_template
   script:
-    - script/autobuild.py ldb      $SAMBA_CI_AUTOBUILD_ENABLE_COVERAGE --verbose --nocleanup --keeplogs --tail --full-testbase /tmp/samba-testbase/ldb
-    - script/autobuild.py pidl     $SAMBA_CI_AUTOBUILD_ENABLE_COVERAGE --verbose --nocleanup --keeplogs --tail --full-testbase /tmp/samba-testbase/pidl
-    - script/autobuild.py replace  $SAMBA_CI_AUTOBUILD_ENABLE_COVERAGE --verbose --nocleanup --keeplogs --tail --full-testbase /tmp/samba-testbase/replace
-    - script/autobuild.py talloc   $SAMBA_CI_AUTOBUILD_ENABLE_COVERAGE --verbose --nocleanup --keeplogs --tail --full-testbase /tmp/samba-testbase/talloc
-    - script/autobuild.py tdb      $SAMBA_CI_AUTOBUILD_ENABLE_COVERAGE --verbose --nocleanup --keeplogs --tail --full-testbase /tmp/samba-testbase/tdb
-    - script/autobuild.py tevent   $SAMBA_CI_AUTOBUILD_ENABLE_COVERAGE --verbose --nocleanup --keeplogs --tail --full-testbase /tmp/samba-testbase/tevent
-    - script/autobuild.py samba-xc $SAMBA_CI_AUTOBUILD_ENABLE_COVERAGE --verbose --nocleanup --keeplogs --tail --full-testbase /tmp/samba-testbase/samba-xc
-    - script/autobuild.py docs-xml $SAMBA_CI_AUTOBUILD_ENABLE_COVERAGE --verbose --nocleanup --keeplogs --tail --full-testbase /tmp/samba-testbase/docs-xml
+    - script/autobuild.py ldb      $SAMBA_CI_AUTOBUILD_ENABLE_COVERAGE --verbose --nocleanup --keeplogs --tail --full-testbase /builds/samba-testbase/ldb
+    - script/autobuild.py pidl     $SAMBA_CI_AUTOBUILD_ENABLE_COVERAGE --verbose --nocleanup --keeplogs --tail --full-testbase /builds/samba-testbase/pidl
+    - script/autobuild.py replace  $SAMBA_CI_AUTOBUILD_ENABLE_COVERAGE --verbose --nocleanup --keeplogs --tail --full-testbase /builds/samba-testbase/replace
+    - script/autobuild.py talloc   $SAMBA_CI_AUTOBUILD_ENABLE_COVERAGE --verbose --nocleanup --keeplogs --tail --full-testbase /builds/samba-testbase/talloc
+    - script/autobuild.py tdb      $SAMBA_CI_AUTOBUILD_ENABLE_COVERAGE --verbose --nocleanup --keeplogs --tail --full-testbase /builds/samba-testbase/tdb
+    - script/autobuild.py tevent   $SAMBA_CI_AUTOBUILD_ENABLE_COVERAGE --verbose --nocleanup --keeplogs --tail --full-testbase /builds/samba-testbase/tevent
+    - script/autobuild.py samba-xc $SAMBA_CI_AUTOBUILD_ENABLE_COVERAGE --verbose --nocleanup --keeplogs --tail --full-testbase /builds/samba-testbase/samba-xc
+    - script/autobuild.py docs-xml $SAMBA_CI_AUTOBUILD_ENABLE_COVERAGE --verbose --nocleanup --keeplogs --tail --full-testbase /builds/samba-testbase/docs-xml
 
 .shared_template_build_only:
   extends: .shared_template
-  timeout: 45m
+  timeout: 2h
+  needs:
   artifacts:
     expire_in: 1 week
     paths:
@@ -173,42 +199,54 @@ others:
       - "*.stderr"
       - "*.info"
       - system-info.txt
-      - samba-testbase.tar.gz
+      - samba-testbase.tar
   script:
     # gitlab predefines CI_JOB_NAME for each job. The gitlab job usually matches the
     # autobuild name, which means we can define a default template that runs most autobuild jobs
-    - script/autobuild.py $AUTOBUILD_JOB_NAME $SAMBA_CI_AUTOBUILD_ENABLE_COVERAGE  --verbose --nocleanup --keeplogs --tail --full-testbase /tmp/samba-testbase
+    - script/autobuild.py $AUTOBUILD_JOB_NAME $SAMBA_CI_AUTOBUILD_ENABLE_COVERAGE  --verbose --nocleanup --keeplogs --tail --full-testbase /builds/samba-testbase
     # On success we need to pack everything into an artifacts file
     # which needs to be in the git checkout.
     # As tar doesn't handle hardlink of read-only files,
     # we remember the acls and add write permissions
     # before creating the archive. The consumer will apply
     # the acls again.
-    - cp -a /sha1sum.txt /tmp/samba-testbase/image-sha1sum.txt
-    - cp -a /tmp/commit.txt /tmp/samba-testbase/commit.txt
-    - pushd /tmp && getfacl -R samba-testbase > samba-testbase.acl.dump && popd
-    - chmod -R +w /tmp/samba-testbase
-    - mv /tmp/samba-testbase.acl.dump /tmp/samba-testbase/
-    - tar cfz samba-testbase.tar.gz /tmp/samba-testbase
-    - ls -la samba-testbase.tar.gz
-    - sha1sum samba-testbase.tar.gz
+    - cp -a /sha1sum.txt /builds/samba-testbase/image-sha1sum.txt
+    - cp -a /tmp/commit.txt /builds/samba-testbase/commit.txt
+    - ln -s /builds/samba-testbase/${AUTOBUILD_JOB_NAME}/ /builds/samba-testbase/build_subdir_link
+    - pushd /builds && getfacl -R samba-testbase > samba-testbase.acl.dump && popd
+    - chmod -R +w /builds/samba-testbase
+    - mv /builds/samba-testbase.acl.dump /builds/samba-testbase/
+    - tar $SAMBA_TESTBASE_TAR_OPTIONS -cf samba-testbase.tar /builds/samba-testbase
+    - ls -la samba-testbase.tar
+    - sha1sum samba-testbase.tar
 
 .shared_template_test_only:
-  extends: .shared_template
+  extends:
+    - .shared_template
+    - .shared_runner_test
   stage: test_only
   script:
+    # Print the Kerberos version to check we ended up with the right one
+    # in the runner. We do not have configure output to recognize it
+    # otherwise.
+    - if [ -x "$(command -v krb5-config)" ]; then krb5-config --version; fi
     # We unpack the artifacts file created by the .shared_template_build_only
     # run we depend on
-    - ls -la samba-testbase.tar.gz
-    - sha1sum samba-testbase.tar.gz
-    - tar xfz samba-testbase.tar.gz -C /
-    - diff -u /tmp/samba-testbase/image-sha1sum.txt /sha1sum.txt
-    - diff -u /tmp/samba-testbase/commit.txt /tmp/commit.txt
-    - mv /tmp/samba-testbase/samba-testbase.acl.dump /tmp/samba-testbase.acl.dump
-    - pushd /tmp && setfacl --restore=/tmp/samba-testbase.acl.dump && popd
+    - ls -la samba-testbase.tar
+    - sha1sum samba-testbase.tar
+    - tar $SAMBA_TESTBASE_TAR_OPTIONS -xf samba-testbase.tar -C /
+    - diff -u /builds/samba-testbase/image-sha1sum.txt /sha1sum.txt
+    - diff -u /builds/samba-testbase/commit.txt /tmp/commit.txt
+    - mv /builds/samba-testbase/samba-testbase.acl.dump /builds/samba-testbase.acl.dump
+    - pushd /builds && setfacl --restore=/builds/samba-testbase.acl.dump && popd
+    - ls -la /builds/samba-testbase/
+    - ls -la /builds/samba-testbase/build_subdir_link
+    - ls -la /builds/samba-testbase/build_subdir_link/
+    - if [ -n "$SAMBA_CI_AUTOBUILD_ENABLE_COVERAGE" ]; then find /builds/samba-testbase/build_subdir_link/ -type d -printf "'%p'\n" | xargs chmod u+w; fi
+    - ls -la /builds/samba-testbase/build_subdir_link/
     # gitlab predefines CI_JOB_NAME for each job. The gitlab job usually matches the
     # autobuild name, which means we can define a default template that runs most autobuild jobs
-    - script/autobuild.py $AUTOBUILD_JOB_NAME $SAMBA_CI_AUTOBUILD_ENABLE_COVERAGE --skip-dependencies --verbose --nocleanup --keeplogs --tail --full-testbase /tmp/samba-testbase
+    - script/autobuild.py $AUTOBUILD_JOB_NAME $SAMBA_CI_AUTOBUILD_ENABLE_COVERAGE --skip-dependencies --verbose --nocleanup --keeplogs --tail --full-testbase /builds/samba-testbase
 
 samba-def-build:
   extends: .shared_template_build_only
@@ -219,16 +257,22 @@ samba-def-build:
   needs:
     - job: samba-def-build
       artifacts: true
+    - job: samba-codecheck
 
 samba-mit-build:
   extends: .shared_template_build_only
+  variables:
+    SAMBA_CI_JOB_IMAGE: ${SAMBA_CI_CONTAINER_IMAGE_fedora38}
   stage: build_first
 
 .needs_samba-mit-build:
   extends: .shared_template_test_only
+  variables:
+    SAMBA_CI_JOB_IMAGE: ${SAMBA_CI_CONTAINER_IMAGE_fedora38}
   needs:
     - job: samba-mit-build
       artifacts: true
+    - job: samba-codecheck
 
 samba-h5l-build:
   extends: .shared_template_build_only
@@ -239,6 +283,15 @@ samba-h5l-build:
     - job: samba-h5l-build
       artifacts: true
 
+samba-without-smb1-build:
+  extends: .shared_template_build_only
+
+.needs_samba-without-smb1-build:
+  extends: .shared_template_test_only
+  needs:
+    - job: samba-without-smb1-build
+      artifacts: true
+
 samba-nt4-build:
   extends: .shared_template_build_only
 
@@ -262,10 +315,15 @@ samba:
 
 samba-mitkrb5:
   extends: .shared_template
+  variables:
+    SAMBA_CI_JOB_IMAGE: ${SAMBA_CI_CONTAINER_IMAGE_fedora38}
 
 samba-minimal-smbd:
   extends: .shared_template
 
+samba-nopython:
+  extends: .shared_template
+
 samba-admem:
   extends: .needs_samba-def-build
 
@@ -275,7 +333,10 @@ samba-ad-dc-2:
 samba-ad-dc-3:
   extends: .needs_samba-def-build
 
-samba-ad-dc-4:
+samba-ad-dc-4a:
+  extends: .needs_samba-def-build
+
+samba-ad-dc-4b:
   extends: .needs_samba-def-build
 
 samba-ad-dc-5:
@@ -298,7 +359,9 @@ samba-libs:
 
 samba-fuzz:
   extends: .shared_template
-  image: ${SAMBA_CI_CONTAINER_REGISTRY}/samba-ci-ubuntu1604:${SAMBA_CI_CONTAINER_TAG}
+  variables:
+    # We match what Google is running over at oss-fuzz
+    SAMBA_CI_JOB_IMAGE: ${SAMBA_CI_CONTAINER_IMAGE_ubuntu2004}
 
 ctdb:
   extends: .shared_template
@@ -312,75 +375,102 @@ samba-ad-dc-ntvfs:
 samba-admem-mit:
   extends: .needs_samba-mit-build
 
-samba-ad-dc-4-mitkrb5:
+samba-addc-mit-4a:
+  extends: .needs_samba-mit-build
+
+samba-addc-mit-4b:
   extends: .needs_samba-mit-build
 
 # This task is run first to ensure we compile before we start the
 # main run as it is the fastest full compile of Samba.
 samba-fips:
   extends: .shared_template
-  image: $SAMBA_CI_CONTAINER_IMAGE_fedora33
+  variables:
+    SAMBA_CI_JOB_IMAGE: ${SAMBA_CI_CONTAINER_IMAGE_fedora38}
+
+samba-codecheck:
+  extends: .shared_template
+  needs:
+  variables:
+    SAMBA_CI_JOB_IMAGE: ${SAMBA_CI_CONTAINER_IMAGE_fedora38}
+  stage: build_first
 
-.private_runner:
+.private_test_only:
+  extends: .private_runner_test
   stage: test_private
-  tags:
-    - docker
-    - samba-ci-private
-  only:
-    variables:
+  rules:
+      # See above, to avoid a duplicate CI on the MR (these rules override the others)
+    - if: $CI_MERGE_REQUEST_ID
+      when: never
+
       # These jobs are only run if the gitlab repo has private runners available.
       # To enable private jobs, you must add the following var and value to
       # your gitlab repo by navigating to:
       # settings -> CI/CD -> Environment variables
-      - $SUPPORT_PRIVATE_TEST == "yes"
+    - if: $SUPPORT_PRIVATE_TEST == "yes"
 
 .needs_samba-def-build-private:
   extends:
     - .needs_samba-def-build
-    - .private_runner
+    - .private_test_only
 
 .needs_samba-mit-build-private:
   extends:
     - .needs_samba-mit-build
-    - .private_runner
+    - .private_test_only
 
 .needs_samba-h5l-build-private:
   extends:
     - .needs_samba-h5l-build
-    - .private_runner
+    - .private_test_only
+
+.needs_samba-without-smb1-build-private:
+  extends:
+    - .needs_samba-without-smb1-build
+    - .private_test_only
 
 .needs_samba-nt4-build-private:
   extends:
     - .needs_samba-nt4-build
-    - .private_runner
+    - .private_test_only
 
 .needs_samba-no-opath-build-private:
   extends:
     - .needs_samba-no-opath-build
-    - .private_runner
+    - .private_test_only
 
 samba-fileserver:
   extends: .needs_samba-h5l-build-private
 
+samba-fileserver-without-smb1:
+  extends: .needs_samba-without-smb1-build-private
+
+# This is a full build without the AD DC so we test the build with MIT
+# Kerberos from the default system (Ubuntu 22.04 at this stage).
+# Runtime behaviour checked via the ktest (static ccache and keytab)
+# environment
+samba-ktest-mit:
+ extends: .shared_template
+
 samba-ad-dc-1:
   extends: .needs_samba-def-build-private
 
 samba-nt4:
   extends: .needs_samba-nt4-build-private
 
-samba-ad-dc-1-mitkrb5:
+samba-addc-mit-1:
   extends: .needs_samba-mit-build-private
 
-samba-no-opath:
+samba-no-opath1:
+  extends: .needs_samba-no-opath-build-private
+
+samba-no-opath2:
   extends: .needs_samba-no-opath-build-private
 
 # 'pages' is a special job which can publish artifacts in `public` dir to gitlab pages
 pages:
-  image: ${SAMBA_CI_CONTAINER_REGISTRY}/samba-ci-${SAMBA_CI_CONTAINER_IMAGE}:${SAMBA_CI_CONTAINER_TAG}
+  extends: .shared_runner_build_image
   stage: report
-  tags:
-    - docker
-    - shared
   dependencies:  # tell gitlab to download artifacts for these jobs
     - others
     - samba
@@ -388,30 +478,40 @@ pages:
     - samba-admem
     - samba-ad-dc-2
     - samba-ad-dc-3
-    - samba-ad-dc-4
+    - samba-ad-dc-4a
+    - samba-ad-dc-4b
     - samba-ad-dc-5
     - samba-ad-dc-6
     - samba-libs
     - samba-minimal-smbd
+    - samba-nopython
     - samba-fuzz
     # - ctdb  # TODO
     - samba-ctdb
     - samba-ad-dc-ntvfs
     - samba-admem-mit
-    - samba-ad-dc-4-mitkrb5
+    - samba-addc-mit-4a
+    - samba-addc-mit-4b
     - samba-ad-back1
     - samba-ad-back2
     - samba-fileserver
+    - samba-fileserver-without-smb1
     - samba-ad-dc-1
     - samba-nt4
     - samba-schemaupgrade
-    - samba-ad-dc-1-mitkrb5
+    - samba-addc-mit-1
     - samba-fips
+    - samba-no-opath1
+    - samba-no-opath2
+    - ubuntu2204-samba-o3
   script:
+    - ls -la *.info
     - ./configure.developer
     - make -j
+    - ls -la *.info
     - lcov $(ls *.info | xargs -I{} echo -n "-a {} ") -o all.info
-    - genhtml all.info --output-directory public --prefix=$(pwd) --title "coverage report for $CI_COMMIT_REF_NAME $CI_COMMIT_SHORT_SHA"
+    - ls -la *.info
+    - genhtml all.info --ignore-errors source --output-directory public --prefix=$(pwd) --title "coverage report for $CI_COMMIT_REF_NAME $CI_COMMIT_SHORT_SHA"
   artifacts:
     expire_in: 30 days
     paths:
@@ -422,15 +522,14 @@ pages:
 
 # Coverity Scan
 coverity:
+  extends: .shared_runner_build_image
+  variables:
+    SAMBA_CI_JOB_IMAGE: ${SAMBA_CI_CONTAINER_IMAGE_opensuse155}
   stage: build
-  image: $SAMBA_CI_CONTAINER_IMAGE_fedora33
-  tags:
-    - docker
-    - shared
   script:
     - wget https://scan.coverity.com/download/linux64 --post-data "token=$COVERITY_SCAN_TOKEN&project=$COVERITY_SCAN_PROJECT_NAME" -O /tmp/coverity_tool.tgz
     - tar xf /tmp/coverity_tool.tgz
-    - ./configure.developer --with-system-mitkrb5 --with-experimental-mit-ad-dc
+    - ./configure.developer --with-cluster-support
     - cov-analysis-linux64-*/bin/cov-build --dir cov-int make -j$(nproc)
     - tar czf cov-int.tar.gz cov-int
     - curl
@@ -454,59 +553,93 @@ coverity:
     paths:
       - cov-int/*.txt
 
+debian11-samba-32bit:
+  extends: .shared_template
+  variables:
+    AUTOBUILD_JOB_NAME: samba-32bit
+    SAMBA_CI_JOB_IMAGE: ${SAMBA_CI_CONTAINER_IMAGE_debian11_32bit}
+
 #
 # We build samba-o3 on all supported distributions
 #
 
+# This job, which matches the main CI, needs to still do coverage so
+# we show the coverage on the "none" environment tests
+#
+# We want --enable-coverage specified here otherwise we will have a
+# different set of build options on the coverage build and can fail
+# when -O3 gets combined with --enable-coverage in the scheduled
+# builds.
+
+ubuntu2204-samba-o3:
+  extends: .shared_template
+  variables:
+    AUTOBUILD_JOB_NAME: samba-o3
+    SAMBA_CI_JOB_IMAGE: ${SAMBA_CI_CONTAINER_IMAGE_ubuntu2204}
+    SAMBA_CI_AUTOBUILD_ENABLE_COVERAGE: "--enable-coverage"
+  rules:
+    # See above, to avoid a duplicate CI on the MR (these rules override the others)
+    - if: $CI_MERGE_REQUEST_ID
+      when: never
+    # do not run o3 builds (which run a lot of VMs) if told not to
+    # (this uses the same variable as autobuild.py)
+    - if: $AUTOBUILD_SKIP_SAMBA_O3 == "1"
+      when: never
+
+# All other jobs do not want code coverage.
 .samba-o3-template:
   extends: .shared_template
   variables:
     AUTOBUILD_JOB_NAME: samba-o3
-  only:
-    variables:
-      # do not run o3 for coverage since they are using different images
-      - $SAMBA_CI_AUTOBUILD_ENABLE_COVERAGE == ""
-
-ubuntu1804-samba-o3:
-  extends: .samba-o3-template
-  image: $SAMBA_CI_CONTAINER_IMAGE_ubuntu1804
+  rules:
+    # See above, to avoid a duplicate CI on the MR (these rules override the others)
+    - if: $CI_MERGE_REQUEST_ID
+      when: never
+    # do not run o3 builds (which run a lot of VMs) if told not to
+    # (this uses the same variable as autobuild.py)
+    - if: $AUTOBUILD_SKIP_SAMBA_O3 == "1"
+      when: never
+    # do not run o3 for coverage since they are using different images
+    - if: $SAMBA_CI_AUTOBUILD_ENABLE_COVERAGE == ""
 
 ubuntu2004-samba-o3:
   extends: .samba-o3-template
-  image: $SAMBA_CI_CONTAINER_IMAGE_ubuntu2004
+  variables:
+    SAMBA_CI_JOB_IMAGE: ${SAMBA_CI_CONTAINER_IMAGE_ubuntu2004}
 
-debian10-samba-o3:
+debian11-samba-o3:
   extends: .samba-o3-template
-  image: $SAMBA_CI_CONTAINER_IMAGE_debian10
+  variables:
+    SAMBA_CI_JOB_IMAGE: ${SAMBA_CI_CONTAINER_IMAGE_debian11}
 
-opensuse151-samba-o3:
+debian12-samba-o3:
   extends: .samba-o3-template
-  image: $SAMBA_CI_CONTAINER_IMAGE_opensuse151
+  variables:
+    SAMBA_CI_JOB_IMAGE: ${SAMBA_CI_CONTAINER_IMAGE_debian12}
 
-opensuse152-samba-o3:
+opensuse155-samba-o3:
   extends: .samba-o3-template
-  image: $SAMBA_CI_CONTAINER_IMAGE_opensuse152
+  variables:
+    SAMBA_CI_JOB_IMAGE: ${SAMBA_CI_CONTAINER_IMAGE_opensuse155}
 
 centos7-samba-o3:
   extends: .samba-o3-template
-  image: $SAMBA_CI_CONTAINER_IMAGE_centos7
   variables:
+    SAMBA_CI_JOB_IMAGE: ${SAMBA_CI_CONTAINER_IMAGE_centos7}
     # Git on CentOS doesn't support shallow git cloning
     GIT_DEPTH: ""
     # We need a newer GnuTLS version on CentOS7
-    PKG_CONFIG_PATH: "/usr/lib64/compat-gnutls34/pkgconfig:/usr/lib64/compat-nettle32/pkgconfig"
+    PKG_CONFIG_PATH: "/usr/lib64/compat-gnutls37/pkgconfig:/usr/lib64/compat-nettle32/pkgconfig"
 
-centos8-samba-o3:
+centos8s-samba-o3:
   extends: .samba-o3-template
-  image: $SAMBA_CI_CONTAINER_IMAGE_centos8
-
-fedora32-samba-o3:
-  extends: .samba-o3-template
-  image: $SAMBA_CI_CONTAINER_IMAGE_fedora32
+  variables:
+    SAMBA_CI_JOB_IMAGE: ${SAMBA_CI_CONTAINER_IMAGE_centos8s}
 
-fedora33-samba-o3:
+fedora38-samba-o3:
   extends: .samba-o3-template
-  image: $SAMBA_CI_CONTAINER_IMAGE_fedora33
+  variables:
+    SAMBA_CI_JOB_IMAGE: ${SAMBA_CI_CONTAINER_IMAGE_fedora38}
 
 #
 # Keep the samba-o3 sections at the end ...