gitlab CI: generate the CI script from a template

All the distro-specific stuff is the same template anyway, so let's generate
this (like we already do in libevdev and the ci-templates).

Signed-off-by: Peter Hutterer <peter.hutterer@who-t.net>

3 files changed, 847 insertions, 12 deletions

diff --git a/.gitlab-ci.yml b/.gitlab-ci.yml
index fe12139f..e59c4a5d 100644
--- a/.gitlab-ci.yml
+++ b/.gitlab-ci.yml
@@ -29,6 +29,7 @@
 include:
   # Alpine container builder template
   - project: 'wayland/ci-templates'
+    ref: *template_sha
     file: '/templates/alpine.yml'
   # Arch container builder template
   - project: 'wayland/ci-templates'
@@ -128,6 +129,22 @@ variables:
 #                                                               #
 #################################################################
 
+# Re-generate the CI script and make sure it's the one currently checked in
+# If this job fails, re-generate the gitlab-ci.yml script, see
+# $SRCDIR/.gitlab-ci/generate-gitlab-ci.py
+#
+check-ci-script:
+  image: golang:alpine
+  stage: prep
+  before_script:
+    - apk add python3 git
+    - pip3 install --user jinja2
+  script:
+    - python3 ./.gitlab-ci/generate-gitlab-ci.py
+    - git diff --exit-code && exit 0 || true
+    - echo "Committed gitlab-ci.yml differs from generated gitlab-ci.yml. Please verify"
+    - exit 1
+
 #
 # Verify that commit messages are as expected, signed-off, etc.
 #
@@ -202,7 +219,7 @@ fedora:30@container-prep:
   stage: prep
   variables:
     GIT_STRATEGY: none
-    FEDORA_VERSION: 30
+    FEDORA_VERSION: '30'
     DISTRIB_FLAVOR: fedora
     DISTRIB_VERSION: $FEDORA_VERSION
     TAG: $FEDORA_TAG
@@ -215,12 +232,11 @@ fedora:31@container-prep:
   stage: prep
   variables:
     GIT_STRATEGY: none
-    FEDORA_VERSION: 31
+    FEDORA_VERSION: '31'
     DISTRIB_FLAVOR: fedora
     DISTRIB_VERSION: $FEDORA_VERSION
     TAG: $FEDORA_TAG
 
-
 ubuntu:19.10@container-prep:
   extends:
     - .ubuntu@container-build
@@ -229,7 +245,7 @@ ubuntu:19.10@container-prep:
   stage: prep
   variables:
     GIT_STRATEGY: none
-    UBUNTU_VERSION: "19.10"
+    UBUNTU_VERSION: '19.10'
     DISTRIB_FLAVOR: ubuntu
     DISTRIB_VERSION: $UBUNTU_VERSION
     TAG: $UBUNTU_TAG
@@ -242,12 +258,11 @@ ubuntu:19.04@container-prep:
   stage: prep
   variables:
     GIT_STRATEGY: none
-    UBUNTU_VERSION: "19.04"
+    UBUNTU_VERSION: '19.04'
     DISTRIB_FLAVOR: ubuntu
     DISTRIB_VERSION: $UBUNTU_VERSION
     TAG: $UBUNTU_TAG
 
-
 arch:rolling@container-prep:
   extends:
     - .arch@container-build
@@ -256,7 +271,7 @@ arch:rolling@container-prep:
   stage: prep
   variables:
     GIT_STRATEGY: none
-    ARCH_VERSION: rolling
+    ARCH_VERSION: 'rolling'
     DISTRIB_FLAVOR: archlinux
     DISTRIB_VERSION: $ARCH_VERSION
     TAG: $ARCH_TAG
@@ -269,11 +284,12 @@ alpine:latest@container-prep:
   stage: prep
   variables:
     GIT_STRATEGY: none
-    ALPINE_VERSION: latest
+    ALPINE_VERSION: 'latest'
     DISTRIB_FLAVOR: alpine
     DISTRIB_VERSION: $ALPINE_VERSION
     TAG: $ALPINE_TAG
 
+
 .freebsd@container-prep:
   extends:
     - .policy
@@ -397,7 +413,7 @@ fedora:30@container-clean:
     - .container-clean
   variables:
     GIT_STRATEGY: none
-    FEDORA_VERSION: 30
+    FEDORA_VERSION: '30'
     CURRENT_CONTAINER_IMAGE: $FEDORA_CONTAINER_IMAGE
 
 fedora:31@container-clean:
@@ -405,7 +421,7 @@ fedora:31@container-clean:
     - .container-clean
   variables:
     GIT_STRATEGY: none
-    FEDORA_VERSION: 31
+    FEDORA_VERSION: '31'
     CURRENT_CONTAINER_IMAGE: $FEDORA_CONTAINER_IMAGE
 
 ubuntu:19.10@container-clean:
@@ -413,7 +429,7 @@ ubuntu:19.10@container-clean:
     - .container-clean
   variables:
     GIT_STRATEGY: none
-    UBUNTU_VERSION: "19.10"
+    UBUNTU_VERSION: '19.10'
     CURRENT_CONTAINER_IMAGE: $UBUNTU_CONTAINER_IMAGE
 
 ubuntu:19.04@container-clean:
@@ -421,7 +437,7 @@ ubuntu:19.04@container-clean:
     - .container-clean
   variables:
     GIT_STRATEGY: none
-    UBUNTU_VERSION: "19.04"
+    UBUNTU_VERSION: '19.04'
     CURRENT_CONTAINER_IMAGE: $UBUNTU_CONTAINER_IMAGE
 
 arch:rolling@container-clean:
@@ -429,6 +445,7 @@ arch:rolling@container-clean:
     - .container-clean
   variables:
     GIT_STRATEGY: none
+    ARCH_VERSION: 'rolling'
     CURRENT_CONTAINER_IMAGE: $ARCH_CONTAINER_IMAGE
 
 alpine:latest@container-clean:
@@ -436,8 +453,10 @@ alpine:latest@container-clean:
     - .container-clean
   variables:
     GIT_STRATEGY: none
+    ALPINE_VERSION: 'latest'
     CURRENT_CONTAINER_IMAGE: $ALPINE_CONTAINER_IMAGE
 
+
 freebsd:11.2@container-clean:
   extends:
     - .container-clean
diff --git a/.gitlab-ci/generate-gitlab-ci.py b/.gitlab-ci/generate-gitlab-ci.py
new file mode 100755
index 00000000..5c382b9b
--- /dev/null
+++ b/.gitlab-ci/generate-gitlab-ci.py
@@ -0,0 +1,30 @@
+#!/usr/bin/env python3
+# vim: set expandtab shiftwidth=4:
+
+# This file generates the .gitlab-ci.yml file that defines the pipeline.
+
+import jinja2
+
+distributions = [
+    {'name': 'fedora', 'version': '30'},
+    {'name': 'fedora', 'version': '31'},
+    {'name': 'ubuntu', 'version': '19.10'},
+    {'name': 'ubuntu', 'version': '19.04'},
+    {'name': 'arch', 'version': 'rolling',
+     'flavor': 'archlinux'},  # see https://gitlab.freedesktop.org/wayland/ci-templates/merge_requests/19
+    {'name': 'alpine', 'version': 'latest'},
+]
+
+
+def generate_template():
+    env = jinja2.Environment(loader=jinja2.FileSystemLoader('./.gitlab-ci'),
+                             trim_blocks=True, lstrip_blocks=True)
+
+    template = env.get_template('gitlab-ci.tmpl')
+    config = {'distributions': distributions}
+    with open('.gitlab-ci.yml', 'w') as fd:
+        template.stream(config).dump(fd)
+
+
+if __name__ == '__main__':
+    generate_template()
diff --git a/.gitlab-ci/gitlab-ci.tmpl b/.gitlab-ci/gitlab-ci.tmpl
new file mode 100644
index 00000000..cb0aad28
--- /dev/null
+++ b/.gitlab-ci/gitlab-ci.tmpl
@@ -0,0 +1,786 @@
+# vim: set expandtab shiftwidth=2 tabstop=8 textwidth=0:
+#
+# This is a bit complicated for two reasons:
+# - we really want to run dnf/apt/... only once, updating on the test runner for
+#   each job takes forever. So we create a container image for each distribution
+#   tested, then run the tests on this container image.
+#
+#   Creating a container image is time-consuming, so we only do so for pushes to
+#   libinput directly (not merge requests) and if the current image is 'old'.
+#
+# - GitLab only allows one script: set per job but we have a bunch of commands
+#   we need to re-run for each build (meson && ninja && etc). YAML cannot merge
+#   arrays templates so we're screwed.
+#
+#   So instead we use a default_build template and override everything with
+#   variables. The only two variables that matter:
+#     MESON_ARGS=-Denable-something=true
+#     NINJA_ARGS=dist ... to run 'ninja -C builddir dist'
+#   Note that you cannot use scripts: in any target if you expect default_build
+#   to work.
+#
+#
+# All jobs must follow the naming scheme of
+# <distribution>:<version>@activity:
+#  e.g. fedora:31@build-default
+
+.templates_sha: &template_sha b7030c2cd0d6ccc5f6d4f8299bafa4daa9240d71 # see https://docs.gitlab.com/ee/ci/yaml/#includefile
+
+include:
+  {% for distribution in distributions|map(attribute='name')|unique()|sort() %}
+  # {{ distribution.capitalize() }} container builder template
+  - project: 'wayland/ci-templates'
+    ref: *template_sha
+    file: '/templates/{{distribution}}.yml'
+  {% endfor %}
+
+stages:
+  - prep             # prep work like rebuilding the container images if there is a change
+  - build            # for actually building and testing things in a container
+  - VM               # for running the test suite in a VM
+  - valgrind         # for running the test suite under valgrind in a VM
+  - distro           # distribs test
+  - deploy           # trigger wayland's website generation
+  - container_clean  # clean up unused container images
+
+variables:
+  ###############################################################################
+  # This is the list of packages required to build libinput with the default    #
+  # configuration.                                                              #
+  #                                                                             #
+  # Run dnf install/apt-get install/.. with the list of packages for your       #
+  # distribution                                                                #
+  #                                                                             #
+  # See the documentation here:                                                 #
+  # https://wayland.freedesktop.org/libinput/doc/latest/building_libinput.html  #
+  ###############################################################################
+  FEDORA_RPMS:        'git gcc gcc-c++ pkgconf-pkg-config meson check-devel libudev-devel libevdev-devel doxygen graphviz python3-sphinx python3-recommonmark python3-sphinx_rtd_theme libwacom-devel cairo-devel   gtk3-devel   glib2-devel    mtdev-devel diffutils'
+  FEDORA_QEMU_RPMS:   'git gcc gcc-c++ pkgconf-pkg-config meson check-devel libudev-devel libevdev-devel doxygen graphviz python3-sphinx python3-recommonmark python3-sphinx_rtd_theme libwacom-devel cairo-devel   gtk3-devel   glib2-devel    mtdev-devel diffutils valgrind'
+  UBUNTU_CUSTOM_DEBS: 'git gcc g++     pkg-config         meson check       libudev-dev   libevdev-dev   doxygen graphviz python3-sphinx python3-recommonmark python3-sphinx-rtd-theme libwacom-dev   libcairo2-dev libgtk-3-dev libglib2.0-dev libmtdev-dev'
+  ARCH_PKGS:          'git gcc         pkgconfig          meson check       libsystemd    libevdev       doxygen graphviz python-sphinx  python-recommonmark  python-sphinx_rtd_theme  libwacom                     gtk3                        mtdev      diffutils'
+  FREEBSD_BUILD_PKGS: 'meson'
+  FREEBSD_PKGS:       'libepoll-shim                                        libudev-devd  libevdev                                                                                     libwacom                     gtk3                        libmtdev   '
+  ALPINE_PKGS:        'git gcc build-base pkgconfig       meson check-dev   eudev-dev     libevdev-dev                                                                                 libwacom-dev   cairo-dev     gtk+3.0-dev  mtdev-dev bash'
+  ############################ end of package lists #############################
+
+  # these tags should be updated each time the list of packages is updated
+  # changing these will force rebuilding the associated image
+  # Note: these tags have no meaning and are not tied to a particular
+  # libinput version
+  FEDORA_TAG:  '2019-12-12.0'
+  UBUNTU_TAG:  '2019-12-12.0'
+  ARCH_TAG:    '2019-12-12.0'
+  ALPINE_TAG:  '2019-12-12.0'
+  FREEBSD_TAG: '2019-12-12.0'
+  QEMU_TAG:    'qemu-vm-2019-12-12.0'
+
+  UBUNTU_EXEC: "bash .gitlab-ci/ubuntu_install.sh $UBUNTU_CUSTOM_DEBS"
+
+  UPSTREAM_REPO: libinput/libinput
+  BUILDAH_IMAGE:           $CI_REGISTRY/wayland/ci-templates/buildah:latest
+  FEDORA_CONTAINER_IMAGE:  $CI_REGISTRY_IMAGE/fedora/$FEDORA_VERSION:$FEDORA_TAG
+  UBUNTU_CONTAINER_IMAGE:  $CI_REGISTRY_IMAGE/ubuntu/$UBUNTU_VERSION:$UBUNTU_TAG
+  ARCH_CONTAINER_IMAGE:    $CI_REGISTRY_IMAGE/archlinux/rolling:$ARCH_TAG
+  ALPINE_CONTAINER_IMAGE:  $CI_REGISTRY_IMAGE/alpine/latest:$ALPINE_TAG
+  FREEBSD_CONTAINER_IMAGE: $CI_REGISTRY_IMAGE/freebsd/11.2:$FREEBSD_TAG
+  QEMU_CONTAINER_IMAGE:    $CI_REGISTRY_IMAGE/fedora/$FEDORA_VERSION:$QEMU_TAG
+
+  MESON_BUILDDIR: "build dir"
+  NINJA_ARGS: ''
+  MESON_ARGS: ''
+  MESON_TEST_ARGS: '--no-suite=hardware'
+
+  # udev isn't available/working properly in the containers
+  UDEV_NOT_AVAILABLE: 1
+  GIT_DEPTH: 1
+
+.policy:
+  retry:
+    max: 2
+    when:
+      - runner_system_failure
+      - stuck_or_timeout_failure
+  # cancel run when a newer version is pushed to the branch
+  interruptible: true
+
+.default_artifacts:
+  artifacts:
+    name: "meson-logs-$CI_JOB_NAME"
+    when: always
+    expire_in: 1 week
+    paths:
+      - $MESON_BUILDDIR/meson-logs
+    reports:
+      junit: $MESON_BUILDDIR/junit-*.xml
+
+#################################################################
+#                                                               #
+#                          prep stage                           #
+#                                                               #
+#################################################################
+
+# Re-generate the CI script and make sure it's the one currently checked in
+# If this job fails, re-generate the gitlab-ci.yml script, see
+# $SRCDIR/.gitlab-ci/generate-gitlab-ci.py
+#
+check-ci-script:
+  image: golang:alpine
+  stage: prep
+  before_script:
+    - apk add python3 git
+    - pip3 install --user jinja2
+  script:
+    - python3 ./.gitlab-ci/generate-gitlab-ci.py
+    - git diff --exit-code && exit 0 || true
+    - echo "Committed gitlab-ci.yml differs from generated gitlab-ci.yml. Please verify"
+    - exit 1
+
+#
+# Verify that commit messages are as expected, signed-off, etc.
+#
+
+check-commit:
+  image: golang:alpine
+  stage: prep
+  before_script:
+    - apk add python3 git
+  script:
+    - pip3 install GitPython
+    - pip3 install pytest
+    - |
+      pytest --junitxml=results.xml \
+             --tb=line \
+             --assert=plain \
+             ./.gitlab-ci/check-commit.py
+  except:
+    - master@libinput/libinput
+  variables:
+    GIT_DEPTH: 100
+  artifacts:
+    reports:
+      junit: results.xml
+
+#
+# This stage will recreate the container images only if the image
+# is too old or if it is missing some dependencies.
+#
+
+.pull_upstream_or_rebuild:
+  before_script:
+    # log in to the registry
+    - podman login -u $CI_REGISTRY_USER -p $CI_REGISTRY_PASSWORD $CI_REGISTRY
+
+    # get the full container image name (DISTRIB_VERSION still has indirections)
+    - IMAGE=$(eval echo "$DISTRIB_FLAVOR/$DISTRIB_VERSION:$TAG")
+
+    # force rebuild if schedule, reuse otherwise
+    - if [[ $CI_PIPELINE_SOURCE == "schedule" ]] ; then touch .scheduled; fi
+    # pull the latest upstream image if it exists
+    - test -e .scheduled || skopeo copy --dest-creds $CI_REGISTRY_USER:$CI_REGISTRY_PASSWORD
+                                 docker://$CI_REGISTRY/$UPSTREAM_REPO/$IMAGE
+                                 docker://$CI_REGISTRY_IMAGE/$IMAGE && exit 0 || true ;
+
+    # check if our image is already in the current registry
+    - test -e .scheduled || skopeo inspect docker://$CI_REGISTRY_IMAGE/$IMAGE > /dev/null && exit 0 || true ;
+
+fedora:30@qemu-prep:
+  extends:
+    - .fedora@qemu-build
+    - .policy
+    - .pull_upstream_or_rebuild
+  stage: prep
+  tags:
+    - kvm
+  variables:
+    GIT_STRATEGY: none
+    FEDORA_VERSION: 30
+    FEDORA_TAG: $QEMU_TAG
+    FEDORA_RPMS: $FEDORA_QEMU_RPMS
+    DISTRIB_FLAVOR: fedora
+    DISTRIB_VERSION: $FEDORA_VERSION
+    TAG: $QEMU_TAG
+  allow_failure: true
+
+{% for distro in distributions %}
+{{distro.name}}:{{distro.version}}@container-prep:
+  extends:
+    - .{{distro.name}}@container-build
+    - .policy
+    - .pull_upstream_or_rebuild
+  stage: prep
+  variables:
+    GIT_STRATEGY: none
+    {{distro.name.upper()}}_VERSION: '{{distro.version}}'
+    DISTRIB_FLAVOR: {{distro.flavor|default(distro.name)}}
+    DISTRIB_VERSION: ${{distro.name.upper()}}_VERSION
+    TAG: ${{distro.name.upper()}}_TAG
+
+{% endfor %}
+
+.freebsd@container-prep:
+  extends:
+    - .policy
+    - .pull_upstream_or_rebuild
+  stage: prep
+  image: $BUILDAH_IMAGE
+  script:
+    - export BUILDAH_RUN="buildah run --isolation chroot"
+    - export BUILDAH_COMMIT="buildah commit --format docker"
+    - buildcntr=$(buildah from --quiet  myfreeweb/freebsd-cross:latest)
+    - $BUILDAH_RUN $buildcntr apk add --no-cache $FREEBSD_BUILD_PKGS
+    - $BUILDAH_RUN $buildcntr pkg -r /freebsd update -f
+    - $BUILDAH_RUN $buildcntr pkg -r /freebsd install -y $FREEBSD_PKGS
+    - buildah config --workingdir /app $buildcntr
+    # tag the current container
+    - $BUILDAH_COMMIT $buildcntr $FREEBSD_CONTAINER_IMAGE
+    # clean up the working container
+    - buildah rm $buildcntr
+
+    # push the container image to the libinput registry
+    - podman push --quiet $FREEBSD_CONTAINER_IMAGE
+    - skopeo copy --dest-creds $CI_REGISTRY_USER:$CI_REGISTRY_PASSWORD
+        docker://$FREEBSD_CONTAINER_IMAGE
+        docker://$CI_REGISTRY_IMAGE/freebsd/$FREEBSD_VERSION:$CI_JOB_ID
+
+freebsd:11.2@container-prep:
+  extends:
+    - .freebsd@container-prep
+  variables:
+    GIT_STRATEGY: none
+    FREEBSD_VERSION: "11.2"
+    DISTRIB_FLAVOR: freebsd
+    DISTRIB_VERSION: $FREEBSD_VERSION
+    TAG: $FREEBSD_TAG
+
+
+#################################################################
+#                                                               #
+#                   container clean stage                       #
+#                 run during the clean stage                    #
+#                                                               #
+#################################################################
+
+#
+# This stage will look for the container images we currently have in
+# the registry and will remove any that are not tagged with the provided
+# $container_image:$tag
+#
+.container-clean:
+  extends:
+    - .policy
+  stage: container_clean
+  image: $BUILDAH_IMAGE
+  script:
+    # get the full container image name (CURRENT_CONTAINER_IMAGE still has indirections)
+    - CONTAINER_IMAGE=$(eval echo "$CURRENT_CONTAINER_IMAGE")
+    - GITLAB=$(echo $CI_PROJECT_URL | cut -f3 -d/)
+    - REPOSITORY=$(echo $CONTAINER_IMAGE | cut -f2- -d/ | cut -f1 -d:)
+    - IMAGE_PATH=$(echo $CONTAINER_IMAGE | cut -f1 -d:)
+    - LATEST_TAG=$(echo $CONTAINER_IMAGE | cut -f2 -d:)
+
+    # log in to the registry (read only)
+    - podman login -u $CI_REGISTRY_USER -p $CI_REGISTRY_PASSWORD $CI_REGISTRY
+
+    # get the r/w token from the settings to access the registry
+    #
+    # each developer needs to register a secret variable that contains
+    # a personal token with api access. The token
+    # - must be named PERSONAL_TOKEN_$USER (for example PERSONAL_TOKEN_bentiss)
+    # - must be registered in the CI/CD Variables section as type file
+    # - value must be a netrc file as a single-line string:
+    #   default login <user> password <token value>
+    #   e.g. "default login bentiss password 1235abcde"
+    - tokenname="PERSONAL_TOKEN_$GITLAB_USER_LOGIN"
+    - netrcfile=$(eval echo "\$$tokenname")
+    - if [[ ! -f "$netrcfile" ]]; then
+         echo "No netrc file found or token is missing, skipping job" && false;
+      fi
+
+    # request a token for the registry API
+    - REGISTRY_TOKEN=$(curl https://$GITLAB/jwt/auth --get
+                             --silent --show-error
+                             -d client_id=docker
+                             -d offline_token=true
+                             -d service=container_registry
+                             -d "scope=repository:$REPOSITORY:pull,*"
+                             --fail
+                             --netrc-file "$netrcfile"
+                             | sed -r 's/(\{"token":"|"\})//g')
+
+    # get the digest of the latest image
+    - LATEST_MANIFEST=$(skopeo inspect docker://$IMAGE_PATH:$LATEST_TAG | jq -r '.Digest')
+
+    # get the list of tags
+    - TAGS=$(skopeo inspect docker://$IMAGE_PATH:$LATEST_TAG | jq -r '.RepoTags[]')
+    # FIXME: is the above command working properly? If not, use below:
+    # - TAGS=$(curl -X GET -H "accept:application/vnd.docker.distribution.manifest.v2+json"
+    #                      -H "authorization:Bearer $REGISTRY_TOKEN"
+    #                      https://$CI_REGISTRY/v2/$REPOSITORY/tags/list | jq -r '.tags[]')
+
+    # iterate over the tags
+    - for tag in $TAGS;
+      do
+        MANIFEST=$(skopeo inspect docker://$IMAGE_PATH:$tag | jq -r '.Digest');
+        if test x"$MANIFEST" != x"$LATEST_MANIFEST";
+          then
+            echo removing $tag as $MANIFEST;
+            curl https://$CI_REGISTRY/v2/$REPOSITORY/manifests/$MANIFEST --silent
+                 -H "accept:application/vnd.docker.distribution.manifest.v2+json"
+                 -H "authorization:Bearer $REGISTRY_TOKEN"
+                 --fail --show-error -X DELETE || true
+          ;fi
+      ;done
+  dependencies: []
+  allow_failure: true
+  only:
+    - schedules
+
+{% for distro in distributions %}
+{{distro.name}}:{{distro.version}}@container-clean:
+  extends:
+    - .container-clean
+  variables:
+    GIT_STRATEGY: none
+    {{distro.name.upper()}}_VERSION: '{{distro.version}}'
+    CURRENT_CONTAINER_IMAGE: ${{distro.name.upper()}}_CONTAINER_IMAGE
+
+{% endfor %}
+
+freebsd:11.2@container-clean:
+  extends:
+    - .container-clean
+  variables:
+    GIT_STRATEGY: none
+    CURRENT_CONTAINER_IMAGE: $FREEBSD_CONTAINER_IMAGE
+
+#################################################################
+#                                                               #
+#                       build stage                             #
+#                                                               #
+#################################################################
+
+.build@template:
+  extends:
+    - .policy
+    - .default_artifacts
+  stage: build
+  script:
+    - .gitlab-ci/meson-build.sh
+  dependencies: []
+
+#
+# Fedora
+#
+
+.check_tainted: &check_tainted |
+  # make sure the kernel is not tainted
+  if [[ "$(ssh localhost -p 5555 cat /proc/sys/kernel/tainted)" -gt 0 ]];
+  then
+    echo tainted kernel ;
+    exit 1 ;
+  fi
+
+# Run in a test suite. Special variables:
+# - SUITES: the meson test suites to run, or
+# - SUITE_NAMES: all elements will be expanded to libinput-test-suite-$value
+# Set one or the other, not both.
+.fedora:30@test-suite-vm:
+  extends:
+    - .policy
+  stage: VM
+  image: $QEMU_CONTAINER_IMAGE
+  tags:
+    - kvm
+  variables:
+    FEDORA_VERSION: 30
+    MESON_BUILDDIR: build_dir
+    # remove the global --no-suite=hardware
+    MESON_TEST_ARGS: ''
+  before_script:
+    - if ! [[ -z $SUITE_NAMES ]]; then SUITES=$(echo $SUITE_NAMES | sed 's/\([^ ]*\)/libinput-test-suite-\1/g'); fi
+    - echo "Testing $SUITES"
+  script:
+    # start our vm, no args required
+    - /app/start_vm.sh || (echo "Error - Failed to start the VM." && exit 1)
+
+    - *check_tainted
+
+    - "scp -P 5555 -r $PWD localhost:"
+    - echo "CI_JOB_ID=\"$CI_JOB_ID\"" > sshenv
+    - echo "CI_JOB_NAME=\"$CI_JOB_NAME\"" >> sshenv
+    - echo "MESON_BUILDDIR=\"$MESON_BUILDDIR\"" >> sshenv
+    - echo "MESON_TEST_ARGS=\"$MESON_TEST_ARGS $SUITES\"" >> sshenv
+    - echo "NINJA_ARGS=\"$NINJA_ARGS\"" >> sshenv
+    - "scp -P 5555 sshenv localhost:~/$CI_PROJECT_NAME/.meson_environment"
+    - ssh localhost -p 5555 "cd $CI_PROJECT_NAME ; .gitlab-ci/meson-build.sh" && touch .success || true
+    # no matter the results of the tests, we want to fetch the logs
+    - scp -P 5555 -r localhost:$CI_PROJECT_NAME/$MESON_BUILDDIR .
+
+    - *check_tainted
+
+    - ssh localhost -p 5555 halt || true
+    - sleep 2
+    - pkill qemu || true
+
+    - if [[ ! -e .success ]] ;
+      then
+        exit 1 ;
+      fi
+  artifacts:
+    name: "qemu-meson-logs-$CI_JOB_NAME"
+    when: always
+    expire_in: 1 week
+    paths:
+      - $MESON_BUILDDIR/meson-logs
+      - console.out
+    reports:
+      junit: $MESON_BUILDDIR/junit-*.xml
+
+  allow_failure: true
+  retry:
+    max: 2
+    when: script_failure
+  needs: ['fedora:30@qemu-prep']
+
+# in reverse order of duration to get the slowest ones started first
+fedora:30@vm-touchpad:
+  extends:
+    - .fedora:30@test-suite-vm
+  variables:
+    SUITE_NAMES: 'touchpad'
+
+fedora:30@vm-tap:
+  extends:
+    - .fedora:30@test-suite-vm
+  variables:
+    SUITE_NAMES: 'tap'
+
+fedora:30@vm-tablet:
+  extends:
+    - .fedora:30@test-suite-vm
+  variables:
+    SUITE_NAMES: 'tablet'
+
+fedora:30@vm-gestures-device:
+  extends:
+    - .fedora:30@test-suite-vm
+  variables:
+    SUITE_NAMES: 'gestures device'
+
+fedora:30@vm-others:
+  extends:
+    - .fedora:30@test-suite-vm
+  variables:
+    SUITE_NAMES: 'context config misc events totem udev lid log timer tablet-mode quirks trackball pad path keyboard switch touch trackpoint'
+
+fedora:30@vm-pointer:
+  extends:
+    - .fedora:30@test-suite-vm
+  variables:
+    SUITE_NAMES: 'pointer'
+
+fedora:30@valgrind-touchpad:
+  stage: valgrind
+  extends:
+    - fedora:30@vm-touchpad
+  variables:
+    MESON_TEST_ARGS: '--setup=valgrind'
+
+fedora:30@valgrind-tap:
+  stage: valgrind
+  extends:
+    - fedora:30@vm-tap
+  variables:
+    MESON_TEST_ARGS: '--setup=valgrind'
+
+fedora:30@valgrind-tablet:
+  stage: valgrind
+  extends:
+    - fedora:30@vm-tablet
+  variables:
+    MESON_TEST_ARGS: '--setup=valgrind'
+
+fedora:30@valgrind-gestures-device:
+  stage: valgrind
+  extends:
+    - fedora:30@vm-gestures-device
+  variables:
+    MESON_TEST_ARGS: '--setup=valgrind'
+
+
+fedora:30@valgrind-others:
+  stage: valgrind
+  extends:
+    - fedora:30@vm-others
+  variables:
+    MESON_TEST_ARGS: '--setup=valgrind'
+
+fedora:30@valgrind-pointer:
+  stage: valgrind
+  extends:
+    - fedora:30@vm-pointer
+  variables:
+    MESON_TEST_ARGS: '--setup=valgrind'
+
+.fedora-build@template:
+  extends:
+    - .build@template
+  image: $FEDORA_CONTAINER_IMAGE
+
+fedora:31@default-build:
+  stage: distro
+  extends:
+    - .fedora-build@template
+  variables:
+    FEDORA_VERSION: 31
+  needs: ['fedora:31@container-prep']
+
+fedora:30@default-build:
+  stage: distro
+  extends:
+    - .fedora-build@template
+  variables:
+    FEDORA_VERSION: 30
+  needs: ['fedora:30@container-prep']
+
+fedora:30@default-build-release:
+  stage: distro
+  extends:
+    - .fedora-build@template
+  variables:
+    FEDORA_VERSION: 30
+    MESON_ARGS: "-Dbuildtype=release"
+    CFLAGS: "-Werror"
+  needs: ['fedora:30@container-prep']
+
+fedora:30@scan-build:
+  extends:
+    - .fedora-build@template
+  variables:
+    FEDORA_VERSION: 30
+    NINJA_ARGS: scan-build
+  before_script:
+    - dnf install -y clang-analyzer findutils
+  after_script:
+    - test ! -d "$MESON_BUILDDIR"/meson-logs/scanbuild && exit 0
+    - test $(find "$MESON_BUILDDIR"/meson-logs/scanbuild -maxdepth 0 ! -empty -exec echo "not empty" \; | wc -l) -eq 0 && exit 0
+    - echo "Check scan-build results"
+    - /bin/false
+  needs: ['fedora:30@container-prep']
+
+# Below jobs are build option combinations. We only
+# run them on one image, they shouldn't fail on one distro
+# when they succeed on another.
+
+fedora:30@build-no-libwacom:
+  extends:
+    - .fedora-build@template
+  variables:
+    FEDORA_VERSION: 30
+    MESON_ARGS: "-Dlibwacom=false"
+  needs: ['fedora:30@container-prep']
+
+fedora:30@build-no-libwacom-nodeps:
+  extends:
+    - .fedora-build@template
+  variables:
+    FEDORA_VERSION: 30
+    MESON_ARGS: "-Dlibwacom=false"
+  before_script:
+    - dnf remove -y libwacom libwacom-devel
+  needs: ['fedora:30@container-prep']
+
+fedora:30@build-no-docs:
+  extends:
+    - .fedora-build@template
+  variables:
+    FEDORA_VERSION: 30
+    MESON_ARGS: "-Ddocumentation=false"
+  needs: ['fedora:30@container-prep']
+
+fedora:30@build-no-docs-nodeps:
+  extends:
+    - .fedora-build@template
+  variables:
+    FEDORA_VERSION: 30
+    MESON_ARGS: "-Ddocumentation=false"
+  before_script:
+    - dnf remove -y doxygen graphviz
+  needs: ['fedora:30@container-prep']
+
+fedora:30@build-no-debuggui:
+  extends:
+    - .fedora-build@template
+  variables:
+    FEDORA_VERSION: 30
+    MESON_ARGS: "-Ddebug-gui=false"
+  needs: ['fedora:30@container-prep']
+
+fedora:30@build-no-debuggui-nodeps:
+  extends:
+    - .fedora-build@template
+  variables:
+    FEDORA_VERSION: 30
+    MESON_ARGS: "-Ddebug-gui=false"
+  before_script:
+    - dnf remove -y gtk3-devel
+  needs: ['fedora:30@container-prep']
+
+fedora:30@build-no-tests:
+  extends:
+    - .fedora-build@template
+  variables:
+    FEDORA_VERSION: 30
+    MESON_ARGS: "-Dtests=false"
+  needs: ['fedora:30@container-prep']
+
+fedora:30@build-no-tests-nodeps:
+  extends:
+    - .fedora-build@template
+  variables:
+    FEDORA_VERSION: 30
+    MESON_ARGS: "-Dtests=false"
+  before_script:
+    - dnf remove -y check-devel
+  needs: ['fedora:30@container-prep']
+
+fedora:30@valgrind:
+  extends:
+    - .fedora-build@template
+  variables:
+    FEDORA_VERSION: 30
+    MESON_TEST_ARGS: '--suite=valgrind --no-suite=hardware --setup=valgrind'
+  before_script:
+    - dnf install -y valgrind
+  needs: ['fedora:30@container-prep']
+
+# Python checks, only run on Fedora
+
+fedora:30@usr-bin-env-python:
+  extends:
+    - .fedora-build@template
+  variables:
+    FEDORA_VERSION: 30
+  script:
+    - |
+      if git grep -l '^#!/usr/bin/python'; then
+        echo "Use '/usr/bin/env python3' in the above files";
+        /bin/false
+      fi
+  needs: ['fedora:30@container-prep']
+
+fedora:30@flake8:
+  extends:
+    - .fedora-build@template
+  variables:
+    FEDORA_VERSION: 30
+  before_script:
+    - dnf install -y python3-flake8
+  script:
+    - flake8-3 --ignore=W501,E501,W504 $(git grep -l '^#!/usr/bin/env python3')
+  needs: ['fedora:30@container-prep']
+
+#
+# Ubuntu
+#
+
+.ubuntu@template:
+  stage: distro
+  extends:
+    - .build@template
+  image: $UBUNTU_CONTAINER_IMAGE
+
+ubuntu:19.10@default-build:
+  extends:
+    - .ubuntu@template
+  variables:
+    UBUNTU_VERSION: "19.10"
+  needs: ['ubuntu:19.10@container-prep']
+
+ubuntu:19.04@default-build:
+  extends:
+    - .ubuntu@template
+  variables:
+    UBUNTU_VERSION: "19.04"
+  needs: ['ubuntu:19.04@container-prep']
+
+#
+# Arch
+#
+.arch@template:
+  stage: distro
+  extends:
+    - .build@template
+  image: $ARCH_CONTAINER_IMAGE
+
+arch:rolling@default-build:
+  extends:
+    - .arch@template
+  needs: ['arch:rolling@container-prep']
+
+#
+# Alpine
+#
+
+.alpine@template:
+  stage: distro
+  extends:
+    - .build@template
+  image: $ALPINE_CONTAINER_IMAGE
+
+alpine:latest@default-build:
+  extends:
+    - .alpine@template
+  needs: ['alpine:latest@container-prep']
+  variables:
+    # alpine doesn't have python-recommonmark
+    MESON_ARGS: '-Ddocumentation=false'
+    # We don't run the tests on alpine. The litest-selftest fails
+    # for any tcase_add_exit_test/tcase_add_test_raise_signal
+    # but someone more invested in musl will have to figure that out.
+    MESON_TEST_ARGS: ''
+
+#
+# FreeBSD
+#
+.freebsd@template:
+  stage: distro
+  extends:
+    - .build@template
+  image: $FREEBSD_CONTAINER_IMAGE
+  variables:
+    MESON_ARGS: '--cross-file freebsd -Ddocumentation=false -Dtests=false -Depoll-dir=/freebsd/usr/local/'
+    # Can't run FreeBSD tests on Linux machine, so MESON_TEST_ARGS shouldn't be "test"
+    MESON_TEST_ARGS: ''
+
+freebsd:11.2@default-build:
+  extends:
+    - .freebsd@template
+  needs: ['freebsd:11.2@container-prep']
+
+#
+# deploy
+#
+
+wayland-web:
+  image: $BUILDAH_IMAGE
+  stage: deploy
+  script:
+    # Requirements:
+    # - variable WAYLAND_WEB_TOKEN defined as type File in libinput's CI/CD settings
+    # - content of that file is the token value, as generated by the Pipeline Triggers
+    #   of the wayland.freedesktop.org project.
+    - curl --request POST
+           --form "token=<$WAYLAND_WEB_TOKEN"
+           --form ref=master
+           https://gitlab.freedesktop.org/api/v4/projects/wayland${SLASH}wayland${DOT}freedesktop${DOT}org/trigger/pipeline
+  only:
+    refs:
+      - master
+    variables:
+      - $CI_PROJECT_PATH == "libinput/libinput"
+  dependencies: []
+  variables:
+    DOT: "%2E"
+    SLASH: "%2F"
+