ci: refresh with latest lcitool manifest

This refresh switches the CI for contributors to be triggered by merge
requests. Pushing to a branch in a fork will no longer run CI pipelines,
in order to avoid consuming CI minutes. To regain the original behaviour
contributors can opt-in to a pipeline on push

   git push <remote> -o ci.variable=RUN_PIPELINE=1

This variable can also be set globally on the repository, though this is
not recommended. Upstream repo pushes to branches will run CI.

The use of containers has changed in this update, with only the upstream
repo creating containers, in order to avoid consuming contributors'
limited storage quotas. A fork with existing container images may delete
them. Containers will be rebuilt upstream when pushing commits with CI
changes to the default branch. Any other scenario with CI changes will
simply install build pre-requisite packages in a throaway environment,
using the ci/buildenv/ scripts. These scripts may also be used on a
contributor's local machines.

With pipelines triggered by merge requests, it is also now possible to
workaround the inability of contributors to run pipelines if they have
run out of CI quota. A project member can trigger a pipeline from the
merge request, which will run in context of upstream, however, note
this should only be done after reviewing the code for any malicious
CI changes.

Signed-off-by: Daniel P. Berrangé <berrange@redhat.com>

30 files changed, 1166 insertions, 341 deletions

diff --git a/.gitlab-ci.yml b/.gitlab-ci.yml
index 429ed46..563497e 100644
--- a/.gitlab-ci.yml
+++ b/.gitlab-ci.yml
@@ -15,10 +15,8 @@ stages:
   export CFLAGS="-Werror"
 
 .native_git_build_job:
-  extends: .gitlab_native_build_job
-  before_script:
-    - *git_build_vars
   script:
+    - *git_build_vars
     - pushd "$PWD"
     - mkdir -p "$SCRATCH_DIR"
     - cd "$SCRATCH_DIR"
@@ -33,31 +31,62 @@ stages:
     - $PYTHON setup.py sdist
     - if test -x /usr/bin/rpmbuild && test "$RPM" != "skip" ; then rpmbuild --nodeps -ta dist/libvirt-python*tar.gz ; fi
 
+.native_git_build_job_prebuilt_env:
+  extends:
+    - .native_git_build_job
+    - .gitlab_native_build_job_prebuilt_env
+
+.native_git_build_job_local_env:
+  extends:
+    - .native_git_build_job
+    - .gitlab_native_build_job_local_env
+
 .native_build_job:
-  extends: .gitlab_native_build_job
-  before_script:
+  script:
     - export MAKEFLAGS="-j$(getconf _NPROCESSORS_ONLN)"
     - export CFLAGS="-Werror"
-  script:
     - $PYTHON setup.py build
     - $PYTHON -m pip install .
     - $PYTHON setup.py test
     - $PYTHON setup.py sdist
     - if test -x /usr/bin/rpmbuild && test "$RPM" != "skip" ; then rpmbuild --nodeps -ta dist/libvirt-python*tar.gz ; fi
 
+.native_build_job_prebuilt_env:
+  extends:
+    - .native_build_job
+    - .gitlab_native_build_job_prebuilt_env
+
+.native_build_job_local_env:
+  extends:
+    - .native_build_job
+    - .gitlab_native_build_job_local_env
+
 include: '/ci/gitlab.yml'
 
-api-coverage:
-  image: $CI_REGISTRY_IMAGE/ci-centos-stream-8:latest
+.api_coverage_job:
   stage: sanity_checks
-  needs:
-    - job: x86_64-centos-stream-8-git
-      artifacts: true
-  before_script:
-    - *git_build_vars
   script:
+    - *git_build_vars
     - LIBVIRT_API_COVERAGE=1 $PYTHON setup.py test
-  rules:
-    - if: '$CI_PIPELINE_SOURCE == "push"'
-      allow_failure: true
-    - if: '$CI_PIPELINE_SOURCE == "schedule"'
+  allow_failure: true
+
+api_coverage_prebuilt_env:
+  extends:
+    - .api_coverage_job
+    - .gitlab_native_build_job_prebuilt_env
+  needs:
+    - job: x86_64-centos-stream-8-git-prebuilt-env
+      artifacts: true
+  variables:
+    NAME: centos-stream-8
+
+api_coverage_local_env:
+  extends:
+    - .api_coverage_job
+    - .gitlab_native_build_job_local_env
+  needs:
+    - job: x86_64-centos-stream-8-git-local-env
+      artifacts: true
+  variables:
+    IMAGE: quay.io/centos/centos:stream8
+    NAME: centos-stream-8
diff --git a/ci/buildenv/centos-stream-8.sh b/ci/buildenv/centos-stream-8.sh
new file mode 100644
index 0000000..2afcbfc
--- /dev/null
+++ b/ci/buildenv/centos-stream-8.sh
@@ -0,0 +1,55 @@
+# THIS FILE WAS AUTO-GENERATED
+#
+#  $ lcitool manifest ci/manifest.yml
+#
+# https://gitlab.com/libvirt/libvirt-ci
+
+function install_buildenv() {
+    dnf distro-sync -y
+    dnf install 'dnf-command(config-manager)' -y
+    dnf config-manager --set-enabled -y powertools
+    dnf install -y centos-release-advanced-virtualization
+    dnf install -y epel-release
+    dnf install -y epel-next-release
+    dnf install -y \
+        ca-certificates \
+        ccache \
+        cpp \
+        gcc \
+        gettext \
+        git \
+        glib2-devel \
+        glibc-devel \
+        glibc-langpack-en \
+        gnutls-devel \
+        libnl3-devel \
+        libtirpc-devel \
+        libvirt-devel \
+        libxml2 \
+        libxml2-devel \
+        libxslt \
+        make \
+        meson \
+        ninja-build \
+        perl \
+        pkgconfig \
+        python3 \
+        python3-devel \
+        python3-docutils \
+        python3-lxml \
+        python3-pip \
+        python3-pytest \
+        python3-setuptools \
+        rpcgen \
+        rpm-build
+    rpm -qa | sort > /packages.txt
+    mkdir -p /usr/libexec/ccache-wrappers
+    ln -s /usr/bin/ccache /usr/libexec/ccache-wrappers/cc
+    ln -s /usr/bin/ccache /usr/libexec/ccache-wrappers/gcc
+}
+
+export CCACHE_WRAPPERSDIR="/usr/libexec/ccache-wrappers"
+export LANG="en_US.UTF-8"
+export MAKE="/usr/bin/make"
+export NINJA="/usr/bin/ninja"
+export PYTHON="/usr/bin/python3"
diff --git a/ci/buildenv/centos-stream-9.sh b/ci/buildenv/centos-stream-9.sh
new file mode 100644
index 0000000..d1cda05
--- /dev/null
+++ b/ci/buildenv/centos-stream-9.sh
@@ -0,0 +1,36 @@
+# THIS FILE WAS AUTO-GENERATED
+#
+#  $ lcitool manifest ci/manifest.yml
+#
+# https://gitlab.com/libvirt/libvirt-ci
+
+function install_buildenv() {
+    dnf distro-sync -y
+    dnf install 'dnf-command(config-manager)' -y
+    dnf config-manager --set-enabled -y crb
+    dnf install -y epel-release
+    dnf install -y epel-next-release
+    dnf install -y \
+        ca-certificates \
+        ccache \
+        gcc \
+        git \
+        glibc-langpack-en \
+        libvirt-devel \
+        pkgconfig \
+        python3 \
+        python3-devel \
+        python3-lxml \
+        python3-pip \
+        python3-pytest \
+        python3-setuptools \
+        rpm-build
+    rpm -qa | sort > /packages.txt
+    mkdir -p /usr/libexec/ccache-wrappers
+    ln -s /usr/bin/ccache /usr/libexec/ccache-wrappers/cc
+    ln -s /usr/bin/ccache /usr/libexec/ccache-wrappers/gcc
+}
+
+export CCACHE_WRAPPERSDIR="/usr/libexec/ccache-wrappers"
+export LANG="en_US.UTF-8"
+export PYTHON="/usr/bin/python3"
diff --git a/ci/buildenv/debian-10.sh b/ci/buildenv/debian-10.sh
new file mode 100644
index 0000000..d0f9581
--- /dev/null
+++ b/ci/buildenv/debian-10.sh
@@ -0,0 +1,35 @@
+# THIS FILE WAS AUTO-GENERATED
+#
+#  $ lcitool manifest ci/manifest.yml
+#
+# https://gitlab.com/libvirt/libvirt-ci
+
+function install_buildenv() {
+    export DEBIAN_FRONTEND=noninteractive
+    apt-get update
+    apt-get dist-upgrade -y
+    apt-get install --no-install-recommends -y \
+            ca-certificates \
+            ccache \
+            gcc \
+            git \
+            libvirt-dev \
+            locales \
+            pkgconf \
+            python3 \
+            python3-dev \
+            python3-lxml \
+            python3-pip \
+            python3-pytest \
+            python3-setuptools
+    sed -Ei 's,^# (en_US\.UTF-8 .*)$,\1,' /etc/locale.gen
+    dpkg-reconfigure locales
+    dpkg-query --showformat '${Package}_${Version}_${Architecture}\n' --show > /packages.txt
+    mkdir -p /usr/libexec/ccache-wrappers
+    ln -s /usr/bin/ccache /usr/libexec/ccache-wrappers/cc
+    ln -s /usr/bin/ccache /usr/libexec/ccache-wrappers/gcc
+}
+
+export CCACHE_WRAPPERSDIR="/usr/libexec/ccache-wrappers"
+export LANG="en_US.UTF-8"
+export PYTHON="/usr/bin/python3"
diff --git a/ci/buildenv/debian-sid.sh b/ci/buildenv/debian-sid.sh
new file mode 100644
index 0000000..d0f9581
--- /dev/null
+++ b/ci/buildenv/debian-sid.sh
@@ -0,0 +1,35 @@
+# THIS FILE WAS AUTO-GENERATED
+#
+#  $ lcitool manifest ci/manifest.yml
+#
+# https://gitlab.com/libvirt/libvirt-ci
+
+function install_buildenv() {
+    export DEBIAN_FRONTEND=noninteractive
+    apt-get update
+    apt-get dist-upgrade -y
+    apt-get install --no-install-recommends -y \
+            ca-certificates \
+            ccache \
+            gcc \
+            git \
+            libvirt-dev \
+            locales \
+            pkgconf \
+            python3 \
+            python3-dev \
+            python3-lxml \
+            python3-pip \
+            python3-pytest \
+            python3-setuptools
+    sed -Ei 's,^# (en_US\.UTF-8 .*)$,\1,' /etc/locale.gen
+    dpkg-reconfigure locales
+    dpkg-query --showformat '${Package}_${Version}_${Architecture}\n' --show > /packages.txt
+    mkdir -p /usr/libexec/ccache-wrappers
+    ln -s /usr/bin/ccache /usr/libexec/ccache-wrappers/cc
+    ln -s /usr/bin/ccache /usr/libexec/ccache-wrappers/gcc
+}
+
+export CCACHE_WRAPPERSDIR="/usr/libexec/ccache-wrappers"
+export LANG="en_US.UTF-8"
+export PYTHON="/usr/bin/python3"
diff --git a/ci/buildenv/fedora-35.sh b/ci/buildenv/fedora-35.sh
new file mode 100644
index 0000000..a7d0e1b
--- /dev/null
+++ b/ci/buildenv/fedora-35.sh
@@ -0,0 +1,32 @@
+# THIS FILE WAS AUTO-GENERATED
+#
+#  $ lcitool manifest ci/manifest.yml
+#
+# https://gitlab.com/libvirt/libvirt-ci
+
+function install_buildenv() {
+    dnf update -y
+    dnf install -y \
+        ca-certificates \
+        ccache \
+        gcc \
+        git \
+        glibc-langpack-en \
+        libvirt-devel \
+        pkgconfig \
+        python3 \
+        python3-devel \
+        python3-lxml \
+        python3-pip \
+        python3-pytest \
+        python3-setuptools \
+        rpm-build
+    rpm -qa | sort > /packages.txt
+    mkdir -p /usr/libexec/ccache-wrappers
+    ln -s /usr/bin/ccache /usr/libexec/ccache-wrappers/cc
+    ln -s /usr/bin/ccache /usr/libexec/ccache-wrappers/gcc
+}
+
+export CCACHE_WRAPPERSDIR="/usr/libexec/ccache-wrappers"
+export LANG="en_US.UTF-8"
+export PYTHON="/usr/bin/python3"
diff --git a/ci/buildenv/fedora-36.sh b/ci/buildenv/fedora-36.sh
new file mode 100644
index 0000000..a7d0e1b
--- /dev/null
+++ b/ci/buildenv/fedora-36.sh
@@ -0,0 +1,32 @@
+# THIS FILE WAS AUTO-GENERATED
+#
+#  $ lcitool manifest ci/manifest.yml
+#
+# https://gitlab.com/libvirt/libvirt-ci
+
+function install_buildenv() {
+    dnf update -y
+    dnf install -y \
+        ca-certificates \
+        ccache \
+        gcc \
+        git \
+        glibc-langpack-en \
+        libvirt-devel \
+        pkgconfig \
+        python3 \
+        python3-devel \
+        python3-lxml \
+        python3-pip \
+        python3-pytest \
+        python3-setuptools \
+        rpm-build
+    rpm -qa | sort > /packages.txt
+    mkdir -p /usr/libexec/ccache-wrappers
+    ln -s /usr/bin/ccache /usr/libexec/ccache-wrappers/cc
+    ln -s /usr/bin/ccache /usr/libexec/ccache-wrappers/gcc
+}
+
+export CCACHE_WRAPPERSDIR="/usr/libexec/ccache-wrappers"
+export LANG="en_US.UTF-8"
+export PYTHON="/usr/bin/python3"
diff --git a/ci/buildenv/fedora-rawhide.sh b/ci/buildenv/fedora-rawhide.sh
new file mode 100644
index 0000000..6c25b8d
--- /dev/null
+++ b/ci/buildenv/fedora-rawhide.sh
@@ -0,0 +1,33 @@
+# THIS FILE WAS AUTO-GENERATED
+#
+#  $ lcitool manifest ci/manifest.yml
+#
+# https://gitlab.com/libvirt/libvirt-ci
+
+function install_buildenv() {
+    dnf update -y --nogpgcheck fedora-gpg-keys
+    dnf distro-sync -y
+    dnf install -y \
+        ca-certificates \
+        ccache \
+        gcc \
+        git \
+        glibc-langpack-en \
+        libvirt-devel \
+        pkgconfig \
+        python3 \
+        python3-devel \
+        python3-lxml \
+        python3-pip \
+        python3-pytest \
+        python3-setuptools \
+        rpm-build
+    rpm -qa | sort > /packages.txt
+    mkdir -p /usr/libexec/ccache-wrappers
+    ln -s /usr/bin/ccache /usr/libexec/ccache-wrappers/cc
+    ln -s /usr/bin/ccache /usr/libexec/ccache-wrappers/gcc
+}
+
+export CCACHE_WRAPPERSDIR="/usr/libexec/ccache-wrappers"
+export LANG="en_US.UTF-8"
+export PYTHON="/usr/bin/python3"
diff --git a/ci/buildenv/opensuse-leap-153.sh b/ci/buildenv/opensuse-leap-153.sh
new file mode 100644
index 0000000..5be5468
--- /dev/null
+++ b/ci/buildenv/opensuse-leap-153.sh
@@ -0,0 +1,32 @@
+# THIS FILE WAS AUTO-GENERATED
+#
+#  $ lcitool manifest ci/manifest.yml
+#
+# https://gitlab.com/libvirt/libvirt-ci
+
+function install_buildenv() {
+    zypper update -y
+    zypper install -y \
+           ca-certificates \
+           ccache \
+           gcc \
+           git \
+           glibc-locale \
+           libvirt-devel \
+           pkgconfig \
+           python3-base \
+           python3-devel \
+           python3-lxml \
+           python3-pip \
+           python3-pytest \
+           python3-setuptools \
+           rpm-build
+    rpm -qa | sort > /packages.txt
+    mkdir -p /usr/libexec/ccache-wrappers
+    ln -s /usr/bin/ccache /usr/libexec/ccache-wrappers/cc
+    ln -s /usr/bin/ccache /usr/libexec/ccache-wrappers/gcc
+}
+
+export CCACHE_WRAPPERSDIR="/usr/libexec/ccache-wrappers"
+export LANG="en_US.UTF-8"
+export PYTHON="/usr/bin/python3"
diff --git a/ci/buildenv/opensuse-tumbleweed.sh b/ci/buildenv/opensuse-tumbleweed.sh
new file mode 100644
index 0000000..7162e49
--- /dev/null
+++ b/ci/buildenv/opensuse-tumbleweed.sh
@@ -0,0 +1,32 @@
+# THIS FILE WAS AUTO-GENERATED
+#
+#  $ lcitool manifest ci/manifest.yml
+#
+# https://gitlab.com/libvirt/libvirt-ci
+
+function install_buildenv() {
+    zypper dist-upgrade -y
+    zypper install -y \
+           ca-certificates \
+           ccache \
+           gcc \
+           git \
+           glibc-locale \
+           libvirt-devel \
+           pkgconfig \
+           python3-base \
+           python3-devel \
+           python3-lxml \
+           python3-pip \
+           python3-pytest \
+           python3-setuptools \
+           rpm-build
+    rpm -qa | sort > /packages.txt
+    mkdir -p /usr/libexec/ccache-wrappers
+    ln -s /usr/bin/ccache /usr/libexec/ccache-wrappers/cc
+    ln -s /usr/bin/ccache /usr/libexec/ccache-wrappers/gcc
+}
+
+export CCACHE_WRAPPERSDIR="/usr/libexec/ccache-wrappers"
+export LANG="en_US.UTF-8"
+export PYTHON="/usr/bin/python3"
diff --git a/ci/buildenv/ubuntu-2004.sh b/ci/buildenv/ubuntu-2004.sh
new file mode 100644
index 0000000..d0f9581
--- /dev/null
+++ b/ci/buildenv/ubuntu-2004.sh
@@ -0,0 +1,35 @@
+# THIS FILE WAS AUTO-GENERATED
+#
+#  $ lcitool manifest ci/manifest.yml
+#
+# https://gitlab.com/libvirt/libvirt-ci
+
+function install_buildenv() {
+    export DEBIAN_FRONTEND=noninteractive
+    apt-get update
+    apt-get dist-upgrade -y
+    apt-get install --no-install-recommends -y \
+            ca-certificates \
+            ccache \
+            gcc \
+            git \
+            libvirt-dev \
+            locales \
+            pkgconf \
+            python3 \
+            python3-dev \
+            python3-lxml \
+            python3-pip \
+            python3-pytest \
+            python3-setuptools
+    sed -Ei 's,^# (en_US\.UTF-8 .*)$,\1,' /etc/locale.gen
+    dpkg-reconfigure locales
+    dpkg-query --showformat '${Package}_${Version}_${Architecture}\n' --show > /packages.txt
+    mkdir -p /usr/libexec/ccache-wrappers
+    ln -s /usr/bin/ccache /usr/libexec/ccache-wrappers/cc
+    ln -s /usr/bin/ccache /usr/libexec/ccache-wrappers/gcc
+}
+
+export CCACHE_WRAPPERSDIR="/usr/libexec/ccache-wrappers"
+export LANG="en_US.UTF-8"
+export PYTHON="/usr/bin/python3"
diff --git a/ci/buildenv/ubuntu-2204.sh b/ci/buildenv/ubuntu-2204.sh
new file mode 100644
index 0000000..d0f9581
--- /dev/null
+++ b/ci/buildenv/ubuntu-2204.sh
@@ -0,0 +1,35 @@
+# THIS FILE WAS AUTO-GENERATED
+#
+#  $ lcitool manifest ci/manifest.yml
+#
+# https://gitlab.com/libvirt/libvirt-ci
+
+function install_buildenv() {
+    export DEBIAN_FRONTEND=noninteractive
+    apt-get update
+    apt-get dist-upgrade -y
+    apt-get install --no-install-recommends -y \
+            ca-certificates \
+            ccache \
+            gcc \
+            git \
+            libvirt-dev \
+            locales \
+            pkgconf \
+            python3 \
+            python3-dev \
+            python3-lxml \
+            python3-pip \
+            python3-pytest \
+            python3-setuptools
+    sed -Ei 's,^# (en_US\.UTF-8 .*)$,\1,' /etc/locale.gen
+    dpkg-reconfigure locales
+    dpkg-query --showformat '${Package}_${Version}_${Architecture}\n' --show > /packages.txt
+    mkdir -p /usr/libexec/ccache-wrappers
+    ln -s /usr/bin/ccache /usr/libexec/ccache-wrappers/cc
+    ln -s /usr/bin/ccache /usr/libexec/ccache-wrappers/gcc
+}
+
+export CCACHE_WRAPPERSDIR="/usr/libexec/ccache-wrappers"
+export LANG="en_US.UTF-8"
+export PYTHON="/usr/bin/python3"
diff --git a/ci/containers/centos-stream-8.Dockerfile b/ci/containers/centos-stream-8.Dockerfile
index fff1a19..2abe78e 100644
--- a/ci/containers/centos-stream-8.Dockerfile
+++ b/ci/containers/centos-stream-8.Dockerfile
@@ -6,11 +6,12 @@
 
 FROM quay.io/centos/centos:stream8
 
-RUN dnf update -y && \
+RUN dnf distro-sync -y && \
     dnf install 'dnf-command(config-manager)' -y && \
     dnf config-manager --set-enabled -y powertools && \
     dnf install -y centos-release-advanced-virtualization && \
     dnf install -y epel-release && \
+    dnf install -y epel-next-release && \
     dnf install -y \
         ca-certificates \
         ccache \
@@ -49,8 +50,8 @@ RUN dnf update -y && \
     ln -s /usr/bin/ccache /usr/libexec/ccache-wrappers/cc && \
     ln -s /usr/bin/ccache /usr/libexec/ccache-wrappers/gcc
 
+ENV CCACHE_WRAPPERSDIR "/usr/libexec/ccache-wrappers"
 ENV LANG "en_US.UTF-8"
 ENV MAKE "/usr/bin/make"
 ENV NINJA "/usr/bin/ninja"
 ENV PYTHON "/usr/bin/python3"
-ENV CCACHE_WRAPPERSDIR "/usr/libexec/ccache-wrappers"
diff --git a/ci/containers/centos-stream-9.Dockerfile b/ci/containers/centos-stream-9.Dockerfile
new file mode 100644
index 0000000..d7da77c
--- /dev/null
+++ b/ci/containers/centos-stream-9.Dockerfile
@@ -0,0 +1,38 @@
+# THIS FILE WAS AUTO-GENERATED
+#
+#  $ lcitool manifest ci/manifest.yml
+#
+# https://gitlab.com/libvirt/libvirt-ci
+
+FROM quay.io/centos/centos:stream9
+
+RUN dnf distro-sync -y && \
+    dnf install 'dnf-command(config-manager)' -y && \
+    dnf config-manager --set-enabled -y crb && \
+    dnf install -y epel-release && \
+    dnf install -y epel-next-release && \
+    dnf install -y \
+        ca-certificates \
+        ccache \
+        gcc \
+        git \
+        glibc-langpack-en \
+        libvirt-devel \
+        pkgconfig \
+        python3 \
+        python3-devel \
+        python3-lxml \
+        python3-pip \
+        python3-pytest \
+        python3-setuptools \
+        rpm-build && \
+    dnf autoremove -y && \
+    dnf clean all -y && \
+    rpm -qa | sort > /packages.txt && \
+    mkdir -p /usr/libexec/ccache-wrappers && \
+    ln -s /usr/bin/ccache /usr/libexec/ccache-wrappers/cc && \
+    ln -s /usr/bin/ccache /usr/libexec/ccache-wrappers/gcc
+
+ENV CCACHE_WRAPPERSDIR "/usr/libexec/ccache-wrappers"
+ENV LANG "en_US.UTF-8"
+ENV PYTHON "/usr/bin/python3"
diff --git a/ci/containers/debian-10.Dockerfile b/ci/containers/debian-10.Dockerfile
index 0def4f5..800ffd4 100644
--- a/ci/containers/debian-10.Dockerfile
+++ b/ci/containers/debian-10.Dockerfile
@@ -11,19 +11,19 @@ RUN export DEBIAN_FRONTEND=noninteractive && \
     apt-get install -y eatmydata && \
     eatmydata apt-get dist-upgrade -y && \
     eatmydata apt-get install --no-install-recommends -y \
-            ca-certificates \
-            ccache \
-            gcc \
-            git \
-            libvirt-dev \
-            locales \
-            pkgconf \
-            python3 \
-            python3-dev \
-            python3-lxml \
-            python3-pip \
-            python3-pytest \
-            python3-setuptools && \
+                      ca-certificates \
+                      ccache \
+                      gcc \
+                      git \
+                      libvirt-dev \
+                      locales \
+                      pkgconf \
+                      python3 \
+                      python3-dev \
+                      python3-lxml \
+                      python3-pip \
+                      python3-pytest \
+                      python3-setuptools && \
     eatmydata apt-get autoremove -y && \
     eatmydata apt-get autoclean -y && \
     sed -Ei 's,^# (en_US\.UTF-8 .*)$,\1,' /etc/locale.gen && \
@@ -33,6 +33,6 @@ RUN export DEBIAN_FRONTEND=noninteractive && \
     ln -s /usr/bin/ccache /usr/libexec/ccache-wrappers/cc && \
     ln -s /usr/bin/ccache /usr/libexec/ccache-wrappers/gcc
 
+ENV CCACHE_WRAPPERSDIR "/usr/libexec/ccache-wrappers"
 ENV LANG "en_US.UTF-8"
 ENV PYTHON "/usr/bin/python3"
-ENV CCACHE_WRAPPERSDIR "/usr/libexec/ccache-wrappers"
diff --git a/ci/containers/debian-sid.Dockerfile b/ci/containers/debian-sid.Dockerfile
index ad0f52d..33a1bd5 100644
--- a/ci/containers/debian-sid.Dockerfile
+++ b/ci/containers/debian-sid.Dockerfile
@@ -11,19 +11,19 @@ RUN export DEBIAN_FRONTEND=noninteractive && \
     apt-get install -y eatmydata && \
     eatmydata apt-get dist-upgrade -y && \
     eatmydata apt-get install --no-install-recommends -y \
-            ca-certificates \
-            ccache \
-            gcc \
-            git \
-            libvirt-dev \
-            locales \
-            pkgconf \
-            python3 \
-            python3-dev \
-            python3-lxml \
-            python3-pip \
-            python3-pytest \
-            python3-setuptools && \
+                      ca-certificates \
+                      ccache \
+                      gcc \
+                      git \
+                      libvirt-dev \
+                      locales \
+                      pkgconf \
+                      python3 \
+                      python3-dev \
+                      python3-lxml \
+                      python3-pip \
+                      python3-pytest \
+                      python3-setuptools && \
     eatmydata apt-get autoremove -y && \
     eatmydata apt-get autoclean -y && \
     sed -Ei 's,^# (en_US\.UTF-8 .*)$,\1,' /etc/locale.gen && \
@@ -33,6 +33,6 @@ RUN export DEBIAN_FRONTEND=noninteractive && \
     ln -s /usr/bin/ccache /usr/libexec/ccache-wrappers/cc && \
     ln -s /usr/bin/ccache /usr/libexec/ccache-wrappers/gcc
 
+ENV CCACHE_WRAPPERSDIR "/usr/libexec/ccache-wrappers"
 ENV LANG "en_US.UTF-8"
 ENV PYTHON "/usr/bin/python3"
-ENV CCACHE_WRAPPERSDIR "/usr/libexec/ccache-wrappers"
diff --git a/ci/containers/fedora-35.Dockerfile b/ci/containers/fedora-35.Dockerfile
index 8980e0b..d52ee48 100644
--- a/ci/containers/fedora-35.Dockerfile
+++ b/ci/containers/fedora-35.Dockerfile
@@ -18,20 +18,20 @@ exec "$@"' > /usr/bin/nosync && \
     chmod +x /usr/bin/nosync && \
     nosync dnf update -y && \
     nosync dnf install -y \
-        ca-certificates \
-        ccache \
-        gcc \
-        git \
-        glibc-langpack-en \
-        libvirt-devel \
-        pkgconfig \
-        python3 \
-        python3-devel \
-        python3-lxml \
-        python3-pip \
-        python3-pytest \
-        python3-setuptools \
-        rpm-build && \
+               ca-certificates \
+               ccache \
+               gcc \
+               git \
+               glibc-langpack-en \
+               libvirt-devel \
+               pkgconfig \
+               python3 \
+               python3-devel \
+               python3-lxml \
+               python3-pip \
+               python3-pytest \
+               python3-setuptools \
+               rpm-build && \
     nosync dnf autoremove -y && \
     nosync dnf clean all -y && \
     rpm -qa | sort > /packages.txt && \
@@ -39,6 +39,6 @@ exec "$@"' > /usr/bin/nosync && \
     ln -s /usr/bin/ccache /usr/libexec/ccache-wrappers/cc && \
     ln -s /usr/bin/ccache /usr/libexec/ccache-wrappers/gcc
 
+ENV CCACHE_WRAPPERSDIR "/usr/libexec/ccache-wrappers"
 ENV LANG "en_US.UTF-8"
 ENV PYTHON "/usr/bin/python3"
-ENV CCACHE_WRAPPERSDIR "/usr/libexec/ccache-wrappers"
diff --git a/ci/containers/fedora-34.Dockerfile b/ci/containers/fedora-36.Dockerfile
index 2e3c2ae..6764152 100644
--- a/ci/containers/fedora-34.Dockerfile
+++ b/ci/containers/fedora-36.Dockerfile
@@ -4,7 +4,7 @@
 #
 # https://gitlab.com/libvirt/libvirt-ci
 
-FROM registry.fedoraproject.org/fedora:34
+FROM registry.fedoraproject.org/fedora:36
 
 RUN dnf install -y nosync && \
     echo -e '#!/bin/sh\n\
@@ -18,20 +18,20 @@ exec "$@"' > /usr/bin/nosync && \
     chmod +x /usr/bin/nosync && \
     nosync dnf update -y && \
     nosync dnf install -y \
-        ca-certificates \
-        ccache \
-        gcc \
-        git \
-        glibc-langpack-en \
-        libvirt-devel \
-        pkgconfig \
-        python3 \
-        python3-devel \
-        python3-lxml \
-        python3-pip \
-        python3-pytest \
-        python3-setuptools \
-        rpm-build && \
+               ca-certificates \
+               ccache \
+               gcc \
+               git \
+               glibc-langpack-en \
+               libvirt-devel \
+               pkgconfig \
+               python3 \
+               python3-devel \
+               python3-lxml \
+               python3-pip \
+               python3-pytest \
+               python3-setuptools \
+               rpm-build && \
     nosync dnf autoremove -y && \
     nosync dnf clean all -y && \
     rpm -qa | sort > /packages.txt && \
@@ -39,6 +39,6 @@ exec "$@"' > /usr/bin/nosync && \
     ln -s /usr/bin/ccache /usr/libexec/ccache-wrappers/cc && \
     ln -s /usr/bin/ccache /usr/libexec/ccache-wrappers/gcc
 
+ENV CCACHE_WRAPPERSDIR "/usr/libexec/ccache-wrappers"
 ENV LANG "en_US.UTF-8"
 ENV PYTHON "/usr/bin/python3"
-ENV CCACHE_WRAPPERSDIR "/usr/libexec/ccache-wrappers"
diff --git a/ci/containers/fedora-rawhide.Dockerfile b/ci/containers/fedora-rawhide.Dockerfile
index 7ad90a6..c07e9e8 100644
--- a/ci/containers/fedora-rawhide.Dockerfile
+++ b/ci/containers/fedora-rawhide.Dockerfile
@@ -19,20 +19,20 @@ exec "$@"' > /usr/bin/nosync && \
     chmod +x /usr/bin/nosync && \
     nosync dnf distro-sync -y && \
     nosync dnf install -y \
-        ca-certificates \
-        ccache \
-        gcc \
-        git \
-        glibc-langpack-en \
-        libvirt-devel \
-        pkgconfig \
-        python3 \
-        python3-devel \
-        python3-lxml \
-        python3-pip \
-        python3-pytest \
-        python3-setuptools \
-        rpm-build && \
+               ca-certificates \
+               ccache \
+               gcc \
+               git \
+               glibc-langpack-en \
+               libvirt-devel \
+               pkgconfig \
+               python3 \
+               python3-devel \
+               python3-lxml \
+               python3-pip \
+               python3-pytest \
+               python3-setuptools \
+               rpm-build && \
     nosync dnf autoremove -y && \
     nosync dnf clean all -y && \
     rpm -qa | sort > /packages.txt && \
@@ -40,6 +40,6 @@ exec "$@"' > /usr/bin/nosync && \
     ln -s /usr/bin/ccache /usr/libexec/ccache-wrappers/cc && \
     ln -s /usr/bin/ccache /usr/libexec/ccache-wrappers/gcc
 
+ENV CCACHE_WRAPPERSDIR "/usr/libexec/ccache-wrappers"
 ENV LANG "en_US.UTF-8"
 ENV PYTHON "/usr/bin/python3"
-ENV CCACHE_WRAPPERSDIR "/usr/libexec/ccache-wrappers"
diff --git a/ci/containers/opensuse-leap-152.Dockerfile b/ci/containers/opensuse-leap-153.Dockerfile
index c90905e..e399517 100644
--- a/ci/containers/opensuse-leap-152.Dockerfile
+++ b/ci/containers/opensuse-leap-153.Dockerfile
@@ -4,7 +4,7 @@
 #
 # https://gitlab.com/libvirt/libvirt-ci
 
-FROM registry.opensuse.org/opensuse/leap:15.2
+FROM registry.opensuse.org/opensuse/leap:15.3
 
 RUN zypper update -y && \
     zypper install -y \
@@ -28,6 +28,6 @@ RUN zypper update -y && \
     ln -s /usr/bin/ccache /usr/libexec/ccache-wrappers/cc && \
     ln -s /usr/bin/ccache /usr/libexec/ccache-wrappers/gcc
 
+ENV CCACHE_WRAPPERSDIR "/usr/libexec/ccache-wrappers"
 ENV LANG "en_US.UTF-8"
 ENV PYTHON "/usr/bin/python3"
-ENV CCACHE_WRAPPERSDIR "/usr/libexec/ccache-wrappers"
diff --git a/ci/containers/opensuse-tumbleweed.Dockerfile b/ci/containers/opensuse-tumbleweed.Dockerfile
index f9ba881..4dee9d4 100644
--- a/ci/containers/opensuse-tumbleweed.Dockerfile
+++ b/ci/containers/opensuse-tumbleweed.Dockerfile
@@ -28,6 +28,6 @@ RUN zypper dist-upgrade -y && \
     ln -s /usr/bin/ccache /usr/libexec/ccache-wrappers/cc && \
     ln -s /usr/bin/ccache /usr/libexec/ccache-wrappers/gcc
 
+ENV CCACHE_WRAPPERSDIR "/usr/libexec/ccache-wrappers"
 ENV LANG "en_US.UTF-8"
 ENV PYTHON "/usr/bin/python3"
-ENV CCACHE_WRAPPERSDIR "/usr/libexec/ccache-wrappers"
diff --git a/ci/containers/ubuntu-2004.Dockerfile b/ci/containers/ubuntu-2004.Dockerfile
index 63419a7..d2167b0 100644
--- a/ci/containers/ubuntu-2004.Dockerfile
+++ b/ci/containers/ubuntu-2004.Dockerfile
@@ -11,19 +11,19 @@ RUN export DEBIAN_FRONTEND=noninteractive && \
     apt-get install -y eatmydata && \
     eatmydata apt-get dist-upgrade -y && \
     eatmydata apt-get install --no-install-recommends -y \
-            ca-certificates \
-            ccache \
-            gcc \
-            git \
-            libvirt-dev \
-            locales \
-            pkgconf \
-            python3 \
-            python3-dev \
-            python3-lxml \
-            python3-pip \
-            python3-pytest \
-            python3-setuptools && \
+                      ca-certificates \
+                      ccache \
+                      gcc \
+                      git \
+                      libvirt-dev \
+                      locales \
+                      pkgconf \
+                      python3 \
+                      python3-dev \
+                      python3-lxml \
+                      python3-pip \
+                      python3-pytest \
+                      python3-setuptools && \
     eatmydata apt-get autoremove -y && \
     eatmydata apt-get autoclean -y && \
     sed -Ei 's,^# (en_US\.UTF-8 .*)$,\1,' /etc/locale.gen && \
@@ -33,6 +33,6 @@ RUN export DEBIAN_FRONTEND=noninteractive && \
     ln -s /usr/bin/ccache /usr/libexec/ccache-wrappers/cc && \
     ln -s /usr/bin/ccache /usr/libexec/ccache-wrappers/gcc
 
+ENV CCACHE_WRAPPERSDIR "/usr/libexec/ccache-wrappers"
 ENV LANG "en_US.UTF-8"
 ENV PYTHON "/usr/bin/python3"
-ENV CCACHE_WRAPPERSDIR "/usr/libexec/ccache-wrappers"
diff --git a/ci/containers/ubuntu-1804.Dockerfile b/ci/containers/ubuntu-2204.Dockerfile
index 74a73c7..901077d 100644
--- a/ci/containers/ubuntu-1804.Dockerfile
+++ b/ci/containers/ubuntu-2204.Dockerfile
@@ -4,26 +4,26 @@
 #
 # https://gitlab.com/libvirt/libvirt-ci
 
-FROM docker.io/library/ubuntu:18.04
+FROM docker.io/library/ubuntu:22.04
 
 RUN export DEBIAN_FRONTEND=noninteractive && \
     apt-get update && \
     apt-get install -y eatmydata && \
     eatmydata apt-get dist-upgrade -y && \
     eatmydata apt-get install --no-install-recommends -y \
-            ca-certificates \
-            ccache \
-            gcc \
-            git \
-            libvirt-dev \
-            locales \
-            pkgconf \
-            python3 \
-            python3-dev \
-            python3-lxml \
-            python3-pip \
-            python3-pytest \
-            python3-setuptools && \
+                      ca-certificates \
+                      ccache \
+                      gcc \
+                      git \
+                      libvirt-dev \
+                      locales \
+                      pkgconf \
+                      python3 \
+                      python3-dev \
+                      python3-lxml \
+                      python3-pip \
+                      python3-pytest \
+                      python3-setuptools && \
     eatmydata apt-get autoremove -y && \
     eatmydata apt-get autoclean -y && \
     sed -Ei 's,^# (en_US\.UTF-8 .*)$,\1,' /etc/locale.gen && \
@@ -33,6 +33,6 @@ RUN export DEBIAN_FRONTEND=noninteractive && \
     ln -s /usr/bin/ccache /usr/libexec/ccache-wrappers/cc && \
     ln -s /usr/bin/ccache /usr/libexec/ccache-wrappers/gcc
 
+ENV CCACHE_WRAPPERSDIR "/usr/libexec/ccache-wrappers"
 ENV LANG "en_US.UTF-8"
 ENV PYTHON "/usr/bin/python3"
-ENV CCACHE_WRAPPERSDIR "/usr/libexec/ccache-wrappers"
diff --git a/ci/gitlab.yml b/ci/gitlab.yml
index 6556b0a..bdc5e0a 100644
--- a/ci/gitlab.yml
+++ b/ci/gitlab.yml
@@ -5,223 +5,78 @@
 # https://gitlab.com/libvirt/libvirt-ci
 
 
-.container_job:
-  image: docker:stable
-  stage: containers
-  needs: []
-  services:
-    - docker:dind
-  before_script:
-    - export TAG="$CI_REGISTRY_IMAGE/ci-$NAME:latest"
-    - export COMMON_TAG="$CI_REGISTRY/libvirt/libvirt-python/ci-$NAME:latest"
-    - docker info
-    - docker login registry.gitlab.com -u "$CI_REGISTRY_USER" -p "$CI_REGISTRY_PASSWORD"
-  script:
-    - docker pull "$TAG" || docker pull "$COMMON_TAG" || true
-    - docker build --cache-from "$TAG" --cache-from "$COMMON_TAG" --tag "$TAG" -f "ci/containers/$NAME.Dockerfile" ci/containers
-    - docker push "$TAG"
-  after_script:
-    - docker logout
-
-
-.gitlab_native_build_job:
-  image: $CI_REGISTRY_IMAGE/ci-$NAME:latest
-  stage: builds
-
-
-.gitlab_cross_build_job:
-  image: $CI_REGISTRY_IMAGE/ci-$NAME-cross-$CROSS:latest
-  stage: builds
-
-
-check-dco:
-  stage: sanity_checks
-  needs: []
-  image: registry.gitlab.com/libvirt/libvirt-ci/check-dco:master
-  script:
-    - /check-dco libvirt
-  except:
-    variables:
-      - $CI_PROJECT_NAMESPACE == 'libvirt'
-  variables:
-    GIT_DEPTH: 1000
-
-
-# Native container jobs
-
-x86_64-centos-stream-8-container:
-  extends: .container_job
-  allow_failure: false
-  variables:
-    NAME: centos-stream-8
-
-
-x86_64-debian-10-container:
-  extends: .container_job
-  allow_failure: false
-  variables:
-    NAME: debian-10
-
-
-x86_64-debian-sid-container:
-  extends: .container_job
-  allow_failure: false
-  variables:
-    NAME: debian-sid
-
-
-x86_64-fedora-34-container:
-  extends: .container_job
-  allow_failure: false
-  variables:
-    NAME: fedora-34
-
-
-x86_64-fedora-35-container:
-  extends: .container_job
-  allow_failure: false
-  variables:
-    NAME: fedora-35
-
-
-x86_64-fedora-rawhide-container:
-  extends: .container_job
-  allow_failure: false
-  variables:
-    NAME: fedora-rawhide
-
-
-x86_64-opensuse-leap-152-container:
-  extends: .container_job
-  allow_failure: false
-  variables:
-    NAME: opensuse-leap-152
-
-
-x86_64-opensuse-tumbleweed-container:
-  extends: .container_job
-  allow_failure: false
-  variables:
-    NAME: opensuse-tumbleweed
-
-
-x86_64-ubuntu-1804-container:
-  extends: .container_job
-  allow_failure: false
-  variables:
-    NAME: ubuntu-1804
-
-
-x86_64-ubuntu-2004-container:
-  extends: .container_job
-  allow_failure: false
-  variables:
-    NAME: ubuntu-2004
-
-
-# Native build jobs
-
-x86_64-centos-stream-8:
-  extends: .native_build_job
-  needs:
-    - x86_64-centos-stream-8-container
-  allow_failure: false
-  variables:
-    NAME: centos-stream-8
-
-
-x86_64-centos-stream-8-git:
-  extends: .native_git_build_job
-  needs:
-    - x86_64-centos-stream-8-container
-  allow_failure: false
-  variables:
-    NAME: centos-stream-8
-  artifacts:
-    expire_in: 2 days
-    paths:
-      - scratch
-      - build
-
-
-x86_64-debian-10:
-  extends: .native_build_job
-  needs:
-    - x86_64-debian-10-container
-  allow_failure: false
-  variables:
-    NAME: debian-10
-
-
-x86_64-debian-sid:
-  extends: .native_build_job
-  needs:
-    - x86_64-debian-sid-container
-  allow_failure: false
-  variables:
-    NAME: debian-sid
-
-
-x86_64-fedora-34:
-  extends: .native_build_job
-  needs:
-    - x86_64-fedora-34-container
-  allow_failure: false
-  variables:
-    NAME: fedora-34
-
-
-x86_64-fedora-35:
-  extends: .native_build_job
-  needs:
-    - x86_64-fedora-35-container
-  allow_failure: false
-  variables:
-    NAME: fedora-35
-
+# Variables that can be set to control the behaviour of
+# pipelines that are run
+#
+#  - RUN_PIPELINE - force creation of a CI pipeline when
+#    pushing to a branch in a forked repository. Official
+#    CI pipelines are triggered when merge requests are
+#    created/updated. Setting this variable to a non-empty
+#    value allows CI testing prior to opening a merge request.
+#
+#  - RUN_CONTAINER_BUILDS - CI pipelines in upstream only
+#    publish containers if CI file changes are detected.
+#    Setting this variable to a non-empty value will force
+#    re-publishing, even when no file changes are detected.
+#    Typically to use from a scheduled job once a month.
+#
+#  - RUN_UPSTREAM_NAMESPACE - the upstream namespace is
+#    configured to default to 'libvirt'. When testing
+#    changes to CI it might be useful to use a different
+#    upstream. Setting this variable will override the
+#    namespace considered to be upstream.
+#
+# These can be set as git push options
+#
+#  $ git push -o ci.variable=RUN_PIPELINE=1
+#
+# Aliases can be set for common usage
+#
+#  $ git config --local alias.push-ci "push -o ci.variable=RUN_PIPELINE=1"
+#
+# Allowing the less verbose invocation
+#
+#  $ git push-ci
+#
+# Pipeline variables can also be set in the repository
+# pipeline config globally, or set against scheduled pipelines
 
-x86_64-fedora-rawhide:
-  extends: .native_build_job
-  needs:
-    - x86_64-fedora-rawhide-container
-  allow_failure: false
-  variables:
-    NAME: fedora-rawhide
 
+variables:
+  RUN_UPSTREAM_NAMESPACE: libvirt
 
-x86_64-opensuse-leap-152:
-  extends: .native_build_job
-  needs:
-    - x86_64-opensuse-leap-152-container
-  allow_failure: false
-  variables:
-    NAME: opensuse-leap-152
-    RPM: skip
 
+workflow:
+  rules:
+    # upstream+forks: Avoid duplicate pipelines on pushes, if a MR is open
+    - if: '$CI_PIPELINE_SOURCE == "push" && $CI_OPEN_MERGE_REQUESTS'
+      when: never
 
-x86_64-opensuse-tumbleweed:
-  extends: .native_build_job
-  needs:
-    - x86_64-opensuse-tumbleweed-container
-  allow_failure: false
-  variables:
-    NAME: opensuse-tumbleweed
-    RPM: skip
+    # upstream+forks: Avoid pipelines on tag pushes
+    - if: '$CI_PIPELINE_SOURCE == "push" && $CI_COMMIT_TAG'
+      when: never
 
+    # upstream+forks: Allow pipelines in scenarios we've figured out job rules
+    - if: '$CI_PIPELINE_SOURCE =~ /^(push|merge_request_event|api|web|schedule)$/'
+      when: always
 
-x86_64-ubuntu-1804:
-  extends: .native_build_job
-  needs:
-    - x86_64-ubuntu-1804-container
-  allow_failure: false
-  variables:
-    NAME: ubuntu-1804
+    # upstream+forks: Avoid all other pipelines
+    - when: never
 
 
-x86_64-ubuntu-2004:
-  extends: .native_build_job
-  needs:
-    - x86_64-ubuntu-2004-container
-  allow_failure: false
-  variables:
-    NAME: ubuntu-2004
+debug:
+  image: docker.io/library/alpine:3
+  stage: sanity_checks
+  needs: []
+  script:
+    - printenv | sort
+  rules:
+    - if: '$RUN_DEBUG'
+      when: always
+
+include:
+  - local: '/ci/gitlab/container-templates.yml'
+  - local: '/ci/gitlab/build-templates.yml'
+  - local: '/ci/gitlab/sanity-checks.yml'
+  - local: '/ci/gitlab/containers.yml'
+  - local: '/ci/gitlab/builds.yml'
diff --git a/ci/gitlab/build-templates.yml b/ci/gitlab/build-templates.yml
new file mode 100644
index 0000000..1a30baa
--- /dev/null
+++ b/ci/gitlab/build-templates.yml
@@ -0,0 +1,117 @@
+# THIS FILE WAS AUTO-GENERATED
+#
+#  $ lcitool manifest ci/manifest.yml
+#
+# https://gitlab.com/libvirt/libvirt-ci
+
+
+#
+# We use pre-built containers for any pipelines that are:
+#
+#  - Validating code committed on default upstream branch
+#  - Validating patches targetting default upstream branch
+#    which do not have CI changes
+#
+# We use a local build env for any pipelines that are:
+#
+#  - Validating code committed to a non-default upstream branch
+#  - Validating patches targetting a non-default upstream branch
+#  - Validating patches targetting default upstream branch which
+#    include CI changes
+#  - Validating code committed to a fork branch
+#
+# Note: the rules across the prebuilt_env and local_env templates
+# should be logical inverses, such that jobs are mutually exclusive
+#
+.gitlab_native_build_job_prebuilt_env:
+  image: $CI_REGISTRY/$RUN_UPSTREAM_NAMESPACE/libvirt-python/ci-$NAME:latest
+  stage: builds
+  before_script:
+    - cat /packages.txt
+  rules:
+    # upstream: pushes to the default branch
+    - if: '$CI_PROJECT_NAMESPACE == $RUN_UPSTREAM_NAMESPACE && $CI_PIPELINE_SOURCE == "push" && $CI_COMMIT_BRANCH == $CI_DEFAULT_BRANCH && $JOB_OPTIONAL'
+      when: manual
+      allow_failure: true
+    - if: '$CI_PROJECT_NAMESPACE == $RUN_UPSTREAM_NAMESPACE && $CI_PIPELINE_SOURCE == "push" && $CI_COMMIT_BRANCH == $CI_DEFAULT_BRANCH'
+      when: on_success
+
+    # upstream: other web/api/scheduled pipelines targetting the default branch
+    - if: '$CI_PROJECT_NAMESPACE == $RUN_UPSTREAM_NAMESPACE && $CI_PIPELINE_SOURCE =~ /(web|api|schedule)/ && $CI_COMMIT_REF_NAME == $CI_DEFAULT_BRANCH && $JOB_OPTIONAL'
+      when: manual
+      allow_failure: true
+    - if: '$CI_PROJECT_NAMESPACE == $RUN_UPSTREAM_NAMESPACE && $CI_PIPELINE_SOURCE =~ /(web|api|schedule)/ && $CI_COMMIT_REF_NAME == $CI_DEFAULT_BRANCH'
+      when: on_success
+
+    # upstream+forks: merge requests targetting the default branch, without CI changes
+    - if: '$CI_PIPELINE_SOURCE == "merge_request_event" && $CI_MERGE_REQUEST_TARGET_BRANCH_NAME == $CI_DEFAULT_BRANCH'
+      changes:
+        - ci/gitlab/container-templates.yml
+        - ci/containers/$NAME.Dockerfile
+      when: never
+    - if: '$CI_PIPELINE_SOURCE == "merge_request_event" && $CI_MERGE_REQUEST_TARGET_BRANCH_NAME == $CI_DEFAULT_BRANCH && $JOB_OPTIONAL'
+      when: manual
+      allow_failure: true
+    - if: '$CI_PIPELINE_SOURCE == "merge_request_event" && $CI_MERGE_REQUEST_TARGET_BRANCH_NAME == $CI_DEFAULT_BRANCH'
+      when: on_success
+
+    # upstream+forks: that's all folks
+    - when: never
+
+.gitlab_native_build_job_local_env:
+  image: $IMAGE
+  stage: builds
+  before_script:
+    - source ci/buildenv/$NAME.sh
+    - install_buildenv
+    - cat /packages.txt
+  rules:
+    # upstream: pushes to a non-default branch
+    - if: '$CI_PROJECT_NAMESPACE == $RUN_UPSTREAM_NAMESPACE && $CI_PIPELINE_SOURCE == "push" && $CI_COMMIT_BRANCH != $CI_DEFAULT_BRANCH && $JOB_OPTIONAL'
+      when: manual
+      allow_failure: true
+    - if: '$CI_PROJECT_NAMESPACE == $RUN_UPSTREAM_NAMESPACE && $CI_PIPELINE_SOURCE == "push" && $CI_COMMIT_BRANCH != $CI_DEFAULT_BRANCH'
+      when: on_success
+
+    - if: '$CI_PROJECT_NAMESPACE != $RUN_UPSTREAM_NAMESPACE && $CI_PIPELINE_SOURCE == "push" && $RUN_PIPELINE && $JOB_OPTIONAL'
+      when: manual
+      allow_failure: true
+    - if: '$CI_PROJECT_NAMESPACE != $RUN_UPSTREAM_NAMESPACE && $CI_PIPELINE_SOURCE == "push" && $RUN_PIPELINE'
+      when: on_success
+
+    # upstream: other web/api/scheduled pipelines targetting non-default branches
+    - if: '$CI_PROJECT_NAMESPACE == $RUN_UPSTREAM_NAMESPACE && $CI_PIPELINE_SOURCE =~ /(web|api|schedule)/ && $CI_COMMIT_REF_NAME != $CI_DEFAULT_BRANCH && $JOB_OPTIONAL'
+      when: manual
+      allow_failure: true
+    - if: '$CI_PROJECT_NAMESPACE == $RUN_UPSTREAM_NAMESPACE && $CI_PIPELINE_SOURCE =~ /(web|api|schedule)/ && $CI_COMMIT_REF_NAME != $CI_DEFAULT_BRANCH'
+      when: on_success
+
+    # forks: other web/api/scheduled pipelines
+    - if: '$CI_PROJECT_NAMESPACE != $RUN_UPSTREAM_NAMESPACE && $CI_PIPELINE_SOURCE =~ /(web|api|schedule)/ && $JOB_OPTIONAL'
+      when: manual
+      allow_failure: true
+    - if: '$CI_PROJECT_NAMESPACE != $RUN_UPSTREAM_NAMESPACE && $CI_PIPELINE_SOURCE =~ /(web|api|schedule)/'
+      when: on_success
+
+    # upstream+forks: merge requests targetting the default branch, with CI changes
+    - if: '$CI_PIPELINE_SOURCE == "merge_request_event" && $CI_MERGE_REQUEST_TARGET_BRANCH_NAME == $CI_DEFAULT_BRANCH && $JOB_OPTIONAL'
+      changes:
+        - ci/gitlab/container-templates.yml
+        - ci/containers/$NAME.Dockerfile
+      when: manual
+      allow_failure: true
+    - if: '$CI_PIPELINE_SOURCE == "merge_request_event" && $CI_MERGE_REQUEST_TARGET_BRANCH_NAME == $CI_DEFAULT_BRANCH'
+      changes:
+        - ci/gitlab/container-templates.yml
+        - ci/containers/$NAME.Dockerfile
+      when: on_success
+
+    # upstream+forks: merge requests targetting non-default branches
+    - if: '$CI_PIPELINE_SOURCE == "merge_request_event" && $CI_MERGE_REQUEST_TARGET_BRANCH_NAME != $CI_DEFAULT_BRANCH && $JOB_OPTIONAL'
+      when: manual
+      allow_failure: true
+    - if: '$CI_PIPELINE_SOURCE == "merge_request_event" && $CI_MERGE_REQUEST_TARGET_BRANCH_NAME != $CI_DEFAULT_BRANCH'
+      when: on_success
+
+    # upstream+forks: that's all folks
+    - when: never
diff --git a/ci/gitlab/builds.yml b/ci/gitlab/builds.yml
new file mode 100644
index 0000000..0cd4533
--- /dev/null
+++ b/ci/gitlab/builds.yml
@@ -0,0 +1,237 @@
+# THIS FILE WAS AUTO-GENERATED
+#
+#  $ lcitool manifest ci/manifest.yml
+#
+# https://gitlab.com/libvirt/libvirt-ci
+
+
+# Native build jobs
+
+x86_64-centos-stream-8-prebuilt-env:
+  extends: .native_build_job_prebuilt_env
+  needs:
+    - job: x86_64-centos-stream-8-container
+      optional: true
+  allow_failure: false
+  variables:
+    NAME: centos-stream-8
+
+x86_64-centos-stream-8-local-env:
+  extends: .native_build_job_local_env
+  needs: []
+  allow_failure: false
+  variables:
+    IMAGE: quay.io/centos/centos:stream8
+    NAME: centos-stream-8
+
+
+x86_64-centos-stream-8-git-prebuilt-env:
+  extends: .native_git_build_job_prebuilt_env
+  needs:
+    - job: x86_64-centos-stream-8-container
+      optional: true
+  allow_failure: false
+  variables:
+    NAME: centos-stream-8
+  artifacts:
+    expire_in: 2 days
+    paths:
+      - scratch
+      - build
+
+x86_64-centos-stream-8-git-local-env:
+  extends: .native_git_build_job_local_env
+  needs: []
+  allow_failure: false
+  variables:
+    IMAGE: quay.io/centos/centos:stream8
+    NAME: centos-stream-8
+  artifacts:
+    expire_in: 2 days
+    paths:
+      - scratch
+      - build
+
+
+x86_64-centos-stream-9-prebuilt-env:
+  extends: .native_build_job_prebuilt_env
+  needs:
+    - job: x86_64-centos-stream-9-container
+      optional: true
+  allow_failure: false
+  variables:
+    NAME: centos-stream-9
+
+x86_64-centos-stream-9-local-env:
+  extends: .native_build_job_local_env
+  needs: []
+  allow_failure: false
+  variables:
+    IMAGE: quay.io/centos/centos:stream9
+    NAME: centos-stream-9
+
+
+x86_64-debian-10-prebuilt-env:
+  extends: .native_build_job_prebuilt_env
+  needs:
+    - job: x86_64-debian-10-container
+      optional: true
+  allow_failure: false
+  variables:
+    NAME: debian-10
+
+x86_64-debian-10-local-env:
+  extends: .native_build_job_local_env
+  needs: []
+  allow_failure: false
+  variables:
+    IMAGE: docker.io/library/debian:10-slim
+    NAME: debian-10
+
+
+x86_64-debian-sid-prebuilt-env:
+  extends: .native_build_job_prebuilt_env
+  needs:
+    - job: x86_64-debian-sid-container
+      optional: true
+  allow_failure: false
+  variables:
+    NAME: debian-sid
+
+x86_64-debian-sid-local-env:
+  extends: .native_build_job_local_env
+  needs: []
+  allow_failure: false
+  variables:
+    IMAGE: docker.io/library/debian:sid-slim
+    NAME: debian-sid
+
+
+x86_64-fedora-35-prebuilt-env:
+  extends: .native_build_job_prebuilt_env
+  needs:
+    - job: x86_64-fedora-35-container
+      optional: true
+  allow_failure: false
+  variables:
+    NAME: fedora-35
+
+x86_64-fedora-35-local-env:
+  extends: .native_build_job_local_env
+  needs: []
+  allow_failure: false
+  variables:
+    IMAGE: registry.fedoraproject.org/fedora:35
+    NAME: fedora-35
+
+
+x86_64-fedora-36-prebuilt-env:
+  extends: .native_build_job_prebuilt_env
+  needs:
+    - job: x86_64-fedora-36-container
+      optional: true
+  allow_failure: false
+  variables:
+    NAME: fedora-36
+
+x86_64-fedora-36-local-env:
+  extends: .native_build_job_local_env
+  needs: []
+  allow_failure: false
+  variables:
+    IMAGE: registry.fedoraproject.org/fedora:36
+    NAME: fedora-36
+
+
+x86_64-fedora-rawhide-prebuilt-env:
+  extends: .native_build_job_prebuilt_env
+  needs:
+    - job: x86_64-fedora-rawhide-container
+      optional: true
+  allow_failure: false
+  variables:
+    NAME: fedora-rawhide
+
+x86_64-fedora-rawhide-local-env:
+  extends: .native_build_job_local_env
+  needs: []
+  allow_failure: false
+  variables:
+    IMAGE: registry.fedoraproject.org/fedora:rawhide
+    NAME: fedora-rawhide
+
+
+x86_64-opensuse-leap-153-prebuilt-env:
+  extends: .native_build_job_prebuilt_env
+  needs:
+    - job: x86_64-opensuse-leap-153-container
+      optional: true
+  allow_failure: false
+  variables:
+    NAME: opensuse-leap-153
+    RPM: skip
+
+x86_64-opensuse-leap-153-local-env:
+  extends: .native_build_job_local_env
+  needs: []
+  allow_failure: false
+  variables:
+    IMAGE: registry.opensuse.org/opensuse/leap:15.3
+    NAME: opensuse-leap-153
+    RPM: skip
+
+
+x86_64-opensuse-tumbleweed-prebuilt-env:
+  extends: .native_build_job_prebuilt_env
+  needs:
+    - job: x86_64-opensuse-tumbleweed-container
+      optional: true
+  allow_failure: false
+  variables:
+    NAME: opensuse-tumbleweed
+    RPM: skip
+
+x86_64-opensuse-tumbleweed-local-env:
+  extends: .native_build_job_local_env
+  needs: []
+  allow_failure: false
+  variables:
+    IMAGE: registry.opensuse.org/opensuse/tumbleweed:latest
+    NAME: opensuse-tumbleweed
+    RPM: skip
+
+
+x86_64-ubuntu-2004-prebuilt-env:
+  extends: .native_build_job_prebuilt_env
+  needs:
+    - job: x86_64-ubuntu-2004-container
+      optional: true
+  allow_failure: false
+  variables:
+    NAME: ubuntu-2004
+
+x86_64-ubuntu-2004-local-env:
+  extends: .native_build_job_local_env
+  needs: []
+  allow_failure: false
+  variables:
+    IMAGE: docker.io/library/ubuntu:20.04
+    NAME: ubuntu-2004
+
+
+x86_64-ubuntu-2204-prebuilt-env:
+  extends: .native_build_job_prebuilt_env
+  needs:
+    - job: x86_64-ubuntu-2204-container
+      optional: true
+  allow_failure: false
+  variables:
+    NAME: ubuntu-2204
+
+x86_64-ubuntu-2204-local-env:
+  extends: .native_build_job_local_env
+  needs: []
+  allow_failure: false
+  variables:
+    IMAGE: docker.io/library/ubuntu:22.04
+    NAME: ubuntu-2204
diff --git a/ci/gitlab/container-templates.yml b/ci/gitlab/container-templates.yml
new file mode 100644
index 0000000..a577028
--- /dev/null
+++ b/ci/gitlab/container-templates.yml
@@ -0,0 +1,44 @@
+# THIS FILE WAS AUTO-GENERATED
+#
+#  $ lcitool manifest ci/manifest.yml
+#
+# https://gitlab.com/libvirt/libvirt-ci
+
+
+# We want to publish containers with tag 'latest':
+#
+#  - In upstream, for push to default branch with CI changes.
+#  - In upstream, on request, for scheduled/manual pipelines
+#    against default branch
+#
+# Note: never publish from merge requests since they have non-committed code
+#
+.container_job:
+  image: docker:stable
+  stage: containers
+  needs: []
+  services:
+    - docker:dind
+  before_script:
+    - export TAG="$CI_REGISTRY_IMAGE/ci-$NAME:latest"
+    - docker info
+    - docker login "$CI_REGISTRY" -u "$CI_REGISTRY_USER" -p "$CI_REGISTRY_PASSWORD"
+  script:
+    - docker build --tag "$TAG" -f "ci/containers/$NAME.Dockerfile" ci/containers ;
+    - docker push "$TAG"
+  after_script:
+    - docker logout
+  rules:
+    # upstream: publish containers if there were CI changes on the default branch
+    - if: '$CI_PROJECT_NAMESPACE == $RUN_UPSTREAM_NAMESPACE && $CI_PIPELINE_SOURCE == "push" && $CI_COMMIT_BRANCH == $CI_DEFAULT_BRANCH'
+      when: on_success
+      changes:
+        - ci/gitlab/container-templates.yml
+        - ci/containers/$NAME.Dockerfile
+
+    # upstream: allow force re-publishing containers on default branch for web/api/scheduled pipelines
+    - if: '$CI_PROJECT_NAMESPACE == $RUN_UPSTREAM_NAMESPACE && $CI_PIPELINE_SOURCE =~ /(web|api|schedule)/ && $CI_COMMIT_REF_NAME == $CI_DEFAULT_BRANCH && $RUN_CONTAINER_BUILDS == "1"'
+      when: on_success
+
+    # upstream+forks: that's all folks
+    - when: never
diff --git a/ci/gitlab/containers.yml b/ci/gitlab/containers.yml
new file mode 100644
index 0000000..2ebe5dd
--- /dev/null
+++ b/ci/gitlab/containers.yml
@@ -0,0 +1,84 @@
+# THIS FILE WAS AUTO-GENERATED
+#
+#  $ lcitool manifest ci/manifest.yml
+#
+# https://gitlab.com/libvirt/libvirt-ci
+
+
+# Native container jobs
+
+x86_64-centos-stream-8-container:
+  extends: .container_job
+  allow_failure: false
+  variables:
+    NAME: centos-stream-8
+
+
+x86_64-centos-stream-9-container:
+  extends: .container_job
+  allow_failure: false
+  variables:
+    NAME: centos-stream-9
+
+
+x86_64-debian-10-container:
+  extends: .container_job
+  allow_failure: false
+  variables:
+    NAME: debian-10
+
+
+x86_64-debian-sid-container:
+  extends: .container_job
+  allow_failure: false
+  variables:
+    NAME: debian-sid
+
+
+x86_64-fedora-35-container:
+  extends: .container_job
+  allow_failure: false
+  variables:
+    NAME: fedora-35
+
+
+x86_64-fedora-36-container:
+  extends: .container_job
+  allow_failure: false
+  variables:
+    NAME: fedora-36
+
+
+x86_64-fedora-rawhide-container:
+  extends: .container_job
+  allow_failure: false
+  variables:
+    NAME: fedora-rawhide
+
+
+x86_64-opensuse-leap-153-container:
+  extends: .container_job
+  allow_failure: false
+  variables:
+    NAME: opensuse-leap-153
+
+
+x86_64-opensuse-tumbleweed-container:
+  extends: .container_job
+  allow_failure: false
+  variables:
+    NAME: opensuse-tumbleweed
+
+
+x86_64-ubuntu-2004-container:
+  extends: .container_job
+  allow_failure: false
+  variables:
+    NAME: ubuntu-2004
+
+
+x86_64-ubuntu-2204-container:
+  extends: .container_job
+  allow_failure: false
+  variables:
+    NAME: ubuntu-2204
diff --git a/ci/gitlab/sanity-checks.yml b/ci/gitlab/sanity-checks.yml
new file mode 100644
index 0000000..f843c7f
--- /dev/null
+++ b/ci/gitlab/sanity-checks.yml
@@ -0,0 +1,26 @@
+# THIS FILE WAS AUTO-GENERATED
+#
+#  $ lcitool manifest ci/manifest.yml
+#
+# https://gitlab.com/libvirt/libvirt-ci
+
+
+check-dco:
+  stage: sanity_checks
+  needs: []
+  image: registry.gitlab.com/libvirt/libvirt-ci/check-dco:master
+  script:
+    - /check-dco "$RUN_UPSTREAM_NAMESPACE"
+  rules:
+    # upstream+forks: Run pipelines on MR
+    - if: '$CI_PIPELINE_SOURCE =~ "merge_request_event"'
+      when: on_success
+
+    # forks: pushes to branches with pipeline requested
+    - if: '$CI_PROJECT_NAMESPACE != $RUN_UPSTREAM_NAMESPACE && $CI_PIPELINE_SOURCE == "push" && $CI_COMMIT_BRANCH && $RUN_PIPELINE'
+      when: on_success
+
+    # upstream+forks: that's all folks
+    - when: never
+  variables:
+    GIT_DEPTH: 1000
diff --git a/ci/manifest.yml b/ci/manifest.yml
index 5b008b6..7532126 100644
--- a/ci/manifest.yml
+++ b/ci/manifest.yml
@@ -25,17 +25,19 @@ targets:
             - scratch
             - build
 
+  centos-stream-9: x86_64
+
   debian-10: x86_64
 
   debian-sid: x86_64
 
-  fedora-34: x86_64
-
   fedora-35: x86_64
 
+  fedora-36: x86_64
+
   fedora-rawhide: x86_64
 
-  opensuse-leap-152:
+  opensuse-leap-153:
     jobs:
       - arch: x86_64
         variables:
@@ -47,6 +49,6 @@ targets:
         variables:
           RPM: skip
 
-  ubuntu-1804: x86_64
-
   ubuntu-2004: x86_64
+
+  ubuntu-2204: x86_64