.codeclimate.yml

----
-version: "2"
-plugins:
-  structure:
-    enabled: false
-  duplication:
-    enabled: false
-  gofmt:
-    enabled: true
-  golint:
-    enabled: true
-    checks:
-      GoLint/Comments/DocComments:
-        enabled: false
-      GoLint/Naming/MixedCaps:
-        enabled: false
-      GoLint/Naming/PackageNames:
-        enabled: false
-  govet:
-    enabled: true
-  gocyclo:
-    enabled: true
-    config:
-      over: 9
-    exclude_patterns:
-    - vendor/
-    - helpers/shell_escape.go
-    - executors/kubernetes/executor_kubernetes_test.go
-    - executors/kubernetes/util_test.go
-    - executors/kubernetes/exec_test.go
-    - executors/parallels/
-    - executors/virtualbox/
-  fixme:
-    enabled: false
-  shellcheck:
-    enabled: false
-exclude_patterns:
-- vendor/
-- .gopath/

.editorconfig

+# top-most EditorConfig file
+root = true
+
+# Unix-style newlines with a newline ending every file
+[*]
+end_of_line = lf
+trim_trailing_whitespace = true
+insert_final_newline = true
+indent_style = space
+charset = utf-8
+
+[*.{md,markdown}]
+trim_trailing_whitespace = false
+
+[*.{go,mod}]
+indent_style = tab
+max_line_length = 120
+
+[Makefile*]
+indent_style = tab

.gitattributes

+*.sh		text eol=lf
+ci/version	text eol=lf

.gitignore

 *.iml
 config.toml
+config.toml.lock
 .project
 out
 builds/
+vendor/
 commands/helpers/archive.zip
-executors/docker/bindata.go
-dockerfiles/checksums
-dockerfiles/alpine/gitlab-runner-linux-amd64
-dockerfiles/alpine/checksums
-dockerfiles/build/gitlab-runner-helper
-dockerfiles/ubuntu/gitlab-runner_amd64.deb
-dockerfiles/ubuntu/checksums
+dockerfiles/**/checksums-*
+dockerfiles/runner/*/install-deps
+dockerfiles/runner/alpine/gitlab-runner-linux-*
+dockerfiles/runner/ubuntu/gitlab-runner_*.deb
+dockerfiles/runner/ubi-fips/gitlab-runner-linux-*
+dockerfiles/runner/ubi-fips/gitlab-runner_*.rpm
+dockerfiles/runner-helper/binaries/
+.DS_Store
 .idea/
-.editorconfig
 tests/ubuntu/.vagrant
 artifacts
 tmp/gitlab-test
-/.gopath/
+/.tmp/
+
+# Ignore all editorconfig files except the root one
+.editorconfig
+!/.editorconfig
+
+testsdefinitions.txt
+/.testoutput/
+/.cover/
+
+/.vagrant/
+
+ci/.test-failures.servercore*.txt.updated
+
+# Ignore Visual Studio Code internals
+/.vscode
+/debug
+debug.test
 
 # Ignore the generated binary
-/gitlab-runner
+/gitlab-runner*
+node_modules

.gitlab-ci.yml

 stages:
-- prepare
-- prebuild
-- test
 - build
+- qa
+- test
+- test kubernetes integration
+- coverage
 - package
 - release
-- cleanup
-
-variables:
-  CI_IMAGE: registry.gitlab.com/gitlab-org/gitlab-runner/ci:1.8.7-0
-  GOROOT: /usr/local/go
-
-image: $CI_IMAGE
-
-# Skip all jobs except the ones that begin and end with 'docs'.
-# Used for commits including ONLY documentation changes.
-# https://docs.gitlab.com/ce/development/writing_documentation.html#testing
-.except_docs: &except_docs
-  except:
-  - /(^docs[\/-].*|.*-docs$)/
-
-.docker: &docker
-  <<: *except_docs
-  services:
-  - docker:dind
-  variables: &docker_variables
-    CI_IMAGE: registry.gitlab.com/gitlab-org/gitlab-runner/ci:1.8.7-0
-    DOCKER_DRIVER: overlay
-    DOCKER_HOST: tcp://docker:2375
-  tags:
-  - docker
-
-#
-# Prepare stage
-#
-
-.image_builder: &image_builder
-  <<: *docker
-  stage: prepare
-  image: docker:git
-  script:
-  - source ./ci/build_ci_image
-
-prepare ci image:
-  <<: *image_builder
-  variables:
-    BUILD_IMAGE: $CI_IMAGE
-    BUILD_DOCKERFILE: ./dockerfiles/ci/Dockerfile
-  only:
-  - /\Adocker-ci-image\/.*/
-
-prepare alpine-no-root image:
-  <<: *image_builder
-  variables:
-    BUILD_IMAGE: registry.gitlab.com/gitlab-org/gitlab-runner/alpine-no-root:latest
-    BUILD_DOCKERFILE: ./tests/dockerfiles/alpine-no-root/Dockerfile
-  only:
-  - /\Adocker-alpine-no-root-image\/.*/
-
-#
-# Prebuild stage
-#
-
-bindata:
-  <<: *docker
-  stage: prebuild
-  script:
-  - make docker
-  artifacts:
-    paths:
-    - out/docker/prebuilt-x86_64.tar.xz
-    - out/docker/prebuilt-arm.tar.xz
-    - executors/docker/bindata.go
-    - .gopath/bin
-    - .gopath/.ok
-    expire_in: 7d
-
-clone test repo:
-  <<: *except_docs
-  stage: prebuild
-  script:
-  - mkdir tmp
-  - succeed=0
-  - for i in {1..3}; do git clone https://gitlab.com/gitlab-org/gitlab-test.git tmp/gitlab-test && succeed=1 && break; echo "retrying"; done
-  - '[[ "$succeed" -eq 1 ]]'
-  artifacts:
-    paths:
-    - tmp/gitlab-test
-    expire_in: 7d
-
-# Review docs base
-.review-docs: &review-docs
-  image: ruby:2.4-alpine
-  before_script:
-    - gem install gitlab --no-doc
-    # We need to download the script rather than clone the repo since the
-    # review-docs-cleanup job will not be able to run when the branch gets
-    # deleted (when merging the MR).
-    - apk add --update openssl
-    - wget https://gitlab.com/gitlab-org/gitlab-ce/raw/master/scripts/trigger-build-docs
-    - chmod 755 trigger-build-docs
-  cache: {}
-  dependencies: []
-  variables:
-    GIT_STRATEGY: none
-  when: manual
-  only:
-    - branches
-
-# Trigger a docs build in gitlab-docs
-# Useful to preview the docs changes live
-# https://docs.gitlab.com/ee/development/writing_documentation.html#previewing-the-changes-live
-review-docs-deploy:
-  <<: *review-docs
-  stage: prebuild
-  environment:
-    name: review-docs/$CI_COMMIT_REF_NAME
-    # DOCS_REVIEW_APPS_DOMAIN and DOCS_GITLAB_REPO_SUFFIX are secret variables
-    # Discussion: https://gitlab.com/gitlab-org/gitlab-ce/merge_requests/14236/diffs#note_40140693
-    url: http://$DOCS_GITLAB_REPO_SUFFIX-$CI_COMMIT_REF_SLUG.$DOCS_REVIEW_APPS_DOMAIN/$DOCS_GITLAB_REPO_SUFFIX
-    on_stop: review-docs-cleanup
-  script:
-    - ./trigger-build-docs deploy
-
-# Cleanup remote environment of gitlab-docs
-review-docs-cleanup:
-  <<: *review-docs
-  stage: cleanup
-  environment:
-    name: review-docs/$CI_COMMIT_REF_NAME
-    action: stop
-  script:
-    - ./trigger-build-docs cleanup
-
-#
-# Test stage
-#
-
-codequality:
-  <<: *except_docs
-  stage: test
-  image: docker:git
-  services:
-    - docker:dind
-  variables:
-    DOCKER_DRIVER: overlay2
-    CODECLIMATE_FORMAT: json
-  cache: {}
-  dependencies: []
-  script:
-    - ./scripts/codequality analyze -f json --dev | tee codeclimate.json
-  artifacts:
-    paths: [codeclimate.json]
-    expire_in: 1 week
-
-unit tests (no race):
-  <<: *docker
-  stage: test
-  retry: 2
-  script:
-    - source ci/touch_make_dependencies
-    - make test
-
-unit tests:
-  <<: *docker
-  stage: test
-  allow_failure: true
-  script:
-    - source ci/touch_make_dependencies
-    - CGO_ENABLED=1 TESTFLAGS="-cover -race" make test
-
-docs check links:
-  image: "registry.gitlab.com/gitlab-org/gitlab-build-images:nanoc-bootstrap-ruby-2.4-alpine"
-  stage: test
-  cache: {}
-  dependencies: []
-  before_script: []
-  script:
-    - mv docs/ /nanoc/content/
-    - cd /nanoc
-    # Build HTML from Markdown
-    - bundle exec nanoc
-    # Check the internal links
-    - bundle exec nanoc check internal_links
-
-integration windows:
-  <<: *except_docs
-  stage: test
-  before_script:
-  - $GODIR = "$env:GOPATH\src\gitlab.com\gitlab-org"
-  - $target_path = "$GODIR\gitlab-runner"
-  - $current_path = pwd
-  - md $GODIR -Force
-  - if (Test-Path $target_path) { cmd /c rmdir $target_path }
-  - cmd /c mklink /D $target_path $current_path
-  - cd $GODIR\gitlab-runner
-  script:
-  - $packages = (go list ./... | findstr -v "\/vendor\/" | Out-String | %{$_ -replace "\r\n"," "})
-  - $testCommand = "go test $packages"
-  - Invoke-Expression $testCommand
-  - if ( $LASTEXITCODE -ne 0 ) { exit $LASTEXITCODE }
-  allow_failure: true
-  only:
-  - /.*/@gitlab-org/gitlab-runner
-  tags:
-  - integration
-  - windows
-
-race conditions detector:
-  <<: *docker
-  stage: test
-  script:
-  - source ci/touch_make_dependencies
-  - make check_race_conditions
-
-git 1.7.1:
-  <<: *except_docs
-  image: centos:6
-  stage: test
-  variables:
-    GOROOT: /usr/local/go
-    GOPATH: /go
-    CGO_ENABLED: 0
-    OUR_PACKAGES: gitlab.com/gitlab-org/gitlab-runner/executors/shell gitlab.com/gitlab-org/gitlab-runner/shells
-  before_script:
-    - yum install -y -q git && git version
-    - curl https://storage.googleapis.com/golang/go1.8.7.linux-amd64.tar.gz | tar zx -C $(dirname "$GOROOT")
-    - export PATH=${GOROOT}/bin:$PATH
-    - source ci/touch_make_dependencies
-  script:
-    - make test
-
-#
-# Build stage
-#
-
-.binaries: &binaries
-  <<: *except_docs
-  stage: build
-  script:
-  - source ci/touch_make_dependencies
-  - export platforms=$(echo $CI_JOB_NAME | sed 's|binaries ||')
-  - make build BUILD_PLATFORMS="-osarch='$platforms'"
-  artifacts:
-    paths:
-    - out/binaries/
-    expire_in: 7d
-  tags:
-  - docker
-
-binaries darwin/386 darwin/amd64: *binaries
-binaries freebsd/386 freebsd/amd64 freebsd/arm: *binaries
-binaries linux/386 linux/amd64 linux/arm: *binaries
-binaries windows/386 windows/amd64: *binaries
-
-#
-# Package stage
-#
-
-.packages: &packages
-  <<: *except_docs
-  stage: package
-  script:
-  - mkdir -p out/docker
-  - touch out/docker/prebuilt-x86_64.tar.xz
-  - touch out/docker/prebuilt-arm.tar.xz
-  - touch executors/docker/bindata.go
-  - source ci/touch_make_dependencies
-  - make ${CI_JOB_NAME}
-  artifacts:
-    paths:
-    - out/deb/
-    - out/rpm/
-    expire_in: 7d
-  tags:
-  - docker
-
-package-deb: *packages
-package-rpm: *packages
-
-#
-# Release stage
-#
-
-.release_docker_images: &release_docker_images
-  <<: *docker
-  stage: release
-  variables: &release_docker_images_variables
-    <<: *docker_variables
-    PUBLISH_IMAGES: "true"
-    PUSH_TO_DOCKER_HUB: "true"
-    DOCKER_MACHINE_VERSION: "0.14.0"
-    DOCKER_MACHINE_CHECKSUM: "a4c69bffb78d3cfe103b89dae61c3ea11cc2d1a91c4ff86e630c9ae88244db02"
-    DUMB_INIT_VERSION: "1.0.2"
-    DUMB_INIT_CHECKSUM: "a8defac40aaca2ca0896c7c5adbc241af60c7c3df470c1a4c469a860bd805429"
-  script:
-  - source ci/touch_make_dependencies
-  - make release_docker_images
-  tags:
-  - release
-
-.release: &release
-  <<: *except_docs
-  stage: release
-  before_script:
-  - source ci/touch_make_dependencies
-  tags:
-  - release
-
-.release_s3: &release_s3
-  <<: *release
-  script:
-  - make release_s3
-
-.release_packagecloud: &release_packagecloud
-  <<: *release
-  script:
-  - make release_packagecloud
-
-.release_development: &release_development
-  only:
-  - branches@gitlab-org/gitlab-runner
-  except:
-  - master@gitlab-org/gitlab-runner
-  - /(^docs[\/-].*|.*-docs$)/
-
-.release_bleeding_edge: &release_bleeding_edge
-  only:
-  - master@gitlab-org/gitlab-runner
-  - /\Av[0-9]+\.[0-9]+\.[0-9]+-rc[0-9]+\Z/@gitlab-org/gitlab-runner
-
-.release_stable: &release_stable
-  only:
-  - /\Av[0-9]+\.[0-9]+\.[0-9]+\Z/@gitlab-org/gitlab-runner
-
-development S3:
-  <<: *release_s3
-  <<: *release_development
-  environment:
-    name: development/s3/${CI_COMMIT_REF_NAME}
-    url: https://gitlab-runner-downloads.s3.amazonaws.com/${CI_COMMIT_REF_NAME}/index.html
-
-development docker images:
-  <<: *release_docker_images
-  variables:
-    <<: *release_docker_images_variables
-    PUBLISH_IMAGES: "false"
-    PUSH_TO_DOCKER_HUB: "false"
-  only:
-  - branches
-  except:
-  - master
-  - /(^docs[\/-].*|.*-docs$)/
-  tags:
-  - docker
-
-bleeding edge S3:
-  <<: *release_s3
-  <<: *release_bleeding_edge
-  environment:
-    name: bleeding_edge/s3
-    url: https://gitlab-runner-downloads.s3.amazonaws.com/${CI_COMMIT_REF_NAME}/index.html
-
-bleeding edge packagecloud:
-  <<: *release_packagecloud
-  <<: *release_bleeding_edge
-  environment:
-    name: bleeding_edge/packagecloud
-    url: https://packages.gitlab.com/runner/unstable
-
-bleeding edge docker images:
-  <<: *release_docker_images
-  <<: *release_bleeding_edge
-  environment:
-    name: bleeding_edge/docker_images
-    url: https://hub.docker.com/r/gitlab/gitlab-runner/tags/
-
-stable S3:
-  <<: *release_s3
-  <<: *release_stable
-  environment:
-    name: stable/s3
-    url: https://gitlab-runner-downloads.s3.amazonaws.com/${CI_COMMIT_REF_NAME}/index.html
-
-stable packagecloud:
-  <<: *release_packagecloud
-  <<: *release_stable
-  environment:
-    name: stable/packagecloud
-    url: https://packages.gitlab.com/runner/gitlab-runner
-
-stable docker images:
-  <<: *release_docker_images
-  <<: *release_stable
-  environment:
-    name: stable/docker_images
-    url: https://hub.docker.com/r/gitlab/gitlab-runner/tags/
+- postrelease
+- deploy
+- docs
+
+include:
+- local: /.gitlab/ci/_project_canonical.gitlab-ci.yml
+  rules:
+    - if: $CI_PROJECT_PATH == "gitlab-org/gitlab-runner" || $CI_PROJECT_PATH == "gitlab-org/security/gitlab-runner"
+      when: always
+- local: /.gitlab/ci/_project_fork.gitlab-ci.yml
+  rules:
+    - if: $CI_PROJECT_PATH == "gitlab-org/gitlab-runner" || $CI_PROJECT_PATH == "gitlab-org/security/gitlab-runner"
+      when: never
+    - if: $CI_PROJECT_PATH
+- local: /.gitlab/ci/_common.gitlab-ci.yml
+- local: /.gitlab/ci/_rules.gitlab-ci.yml
+- local: /.gitlab/ci/build.gitlab-ci.yml
+- local: /.gitlab/ci/qa.gitlab-ci.yml
+- local: /.gitlab/ci/test.gitlab-ci.yml
+- local: /.gitlab/ci/test-kubernetes-integration.gitlab-ci.yml
+- local: /.gitlab/ci/coverage.gitlab-ci.yml
+- local: /.gitlab/ci/package.gitlab-ci.yml
+- local: /.gitlab/ci/release.gitlab-ci.yml
+- local: /.gitlab/ci/postrelease.gitlab-ci.yml
+- local: /.gitlab/ci/deploy.gitlab-ci.yml
+- local: /.gitlab/ci/docs.gitlab-ci.yml
+- component: ${CI_SERVER_FQDN}/gitlab-org/components/danger-review/danger-review@2.0.0
+  inputs:
+    job_stage: qa
+  rules:
+    - if: '$CI_SERVER_HOST == "gitlab.com"'

.gitlab/CODEOWNERS

+# When adding a group as a code owner, make sure to invite the group to the
+# project here: https://gitlab.com/gitlab-org/gitlab-runner/-/project_members
+# As described in https://docs.gitlab.com/ee/user/project/code_owners.html
+
+* @gitlab-com/runner-maintainers
+.editorconfig   @gitlab-com/runner-group @gitlab-com/runner-maintainers
+.gitattributes  @gitlab-com/runner-group @gitlab-com/runner-maintainers
+.gitignore      @gitlab-com/runner-group @gitlab-com/runner-maintainers
+
+[Documentation]
+.markdownlint.yml @gitlab-com/runner-docs-maintainers
+/docs/ @gitlab-com/runner-docs-maintainers

.gitlab/changelog.yml

+default_scope: other
+names:
+  new-feature: New features
+  security-fix: Security fixes
+  fix: Bug fixes
+  maintenance: Maintenance
+  runner-distribution: GitLab Runner distribution
+  documentation: Documentation changes
+  other: Other changes
+order:
+- new-feature
+- security-fix
+- fix
+- maintenance
+- runner-distribution
+- documentation
+- other
+label_matchers:
+- labels:
+  - runner-distribution
+  scope: runner-distribution
+- labels:
+    - type::feature
+  scope: new-feature
+- labels:
+  - feature::addition
+  scope: new-feature
+- labels:
+  - security
+  scope: security-fix
+- labels:
+  - type::bug
+  scope: fix
+- labels:
+  - type::maintenance
+  scope: maintenance
+- labels:
+  - feature::enhancement
+  scope: maintenance
+- labels:
+  - technical debt
+  scope: maintenance
+- labels:
+  - tooling::pipelines
+  scope: maintenance
+- labels:
+  - tooling::workflow
+  scope: maintenance
+- labels:
+  - documentation
+  scope: documentation
+authorship_labels:
+- Community contribution
+skip_changelog_labels:
+- skip-changelog
+

.gitlab/ci/_common.gitlab-ci.yml

+variables:
+  # renovate: datasource=docker depName=golang allowedVersions=/1\.21\..+/
+  # When updating GO_VERSION, update Go versions in docs/development/_index.md
+  # or the 'docs:check development docs Go version' job will fail
+  GO_VERSION: "1.23.2"
+  RUNNER_IMAGES_REGISTRY: registry.gitlab.com/gitlab-org/ci-cd/runner-tools/base-images
+  RUNNER_IMAGES_VERSION: "0.0.6"
+  RUNNER_IMAGES_WINDOWS_GO_URL: https://gitlab.com/api/v4/projects/gitlab-org%2fci-cd%2frunner-tools%2fbase-images/packages/generic/runner-images/v${RUNNER_IMAGES_VERSION}/golang-windows-amd64.zip
+  CI_IMAGE: "${RUNNER_IMAGES_REGISTRY}/ci:${RUNNER_IMAGES_VERSION}"
+  # Feature flags
+  FF_SCRIPT_SECTIONS: "true"
+  FF_USE_FASTZIP: "true"
+  FF_USE_NEW_BASH_EVAL_STRATEGY: "true"
+  FF_TIMESTAMPS: "true"
+  # Following variables are used in some jobs to install specified software
+  RELEASE_INDEX_GEN_VERSION: "latest"
+  DOCKER_VERSION: 27.3.1
+  LICENSE_MANAGEMENT_SETUP_CMD: echo "Skip setup. Dependency already vendored"
+  DOCS_GITLAB_REPO_SUFFIX: "runner"
+  # We're overriding rules for the jobs that we want to run.
+  # This will disable all other rules.
+  DEPENDENCY_SCANNING_DISABLED: "true"
+  TRANSFER_METER_FREQUENCY: "5s"
+  CACHE_COMPRESSION_FORMAT: tarzstd
+  GO111MODULE: "on"
+  # renovate: datasource=docker depName=redhat/ubi9-micro versioning=redhat allowedVersions=/9\.4-[0-9]+/
+  PACKAGES_ITERATION: "1"
+
+default:
+  image: $CI_IMAGE
+  tags:
+    - !reference [.instance-default]
+  retry:
+    max: 2
+    when:
+      - runner_system_failure
+
+.no_cache:
+  cache: {}
+
+.no_dependencies:
+  dependencies: []
+
+.no_cache_and_dependencies:
+  extends:
+    - .no_cache
+    - .no_dependencies
+
+.docker:
+  services:
+    - docker:${DOCKER_VERSION}-dind
+  variables:
+    DOCKER_HOST: "unix:///certs/client/docker.sock"
+    BUILDX_BAKE_ENTITLEMENTS_FS: 0
+  tags:
+    - !reference [.instance-default-docker]
+
+.go-cache:
+  variables:
+    GODEBUG: gocachetest=1
+    GOCACHE: $CI_PROJECT_DIR/.gocache-$CI_COMMIT_REF_PROTECTED
+  before_script:
+    - mkdir -p "$GOCACHE"
+    - ./ci/touch_git
+  cache:
+    paths:
+      - $CI_PROJECT_DIR/.gocache-false/
+    key: "${CI_JOB_NAME}-${CI_COMMIT_REF_SLUG}"
+
+.go-cache-windows:
+  variables:
+    GODEBUG: gocachetest=1
+    GOCACHE: $CI_PROJECT_DIR\.gocache-$CI_COMMIT_REF_PROTECTED
+  before_script:
+    - New-Item -Path "$Env:GOCACHE" -Type Directory -Force
+    - $env:GOCACHE = (Resolve-Path $env:GOCACHE).Path
+    - ./ci/touch_git.ps1
+  cache:
+    paths:
+      - $CI_PROJECT_DIR\.gocache-false\
+    key: "${CI_JOB_NAME}-${CI_COMMIT_REF_SLUG}"
+
+.windows-dependency-checksums:
+  variables:
+    GIT_WINDOWS_AMD64_CHECKSUM: "36498716572394918625476ca207df3d5f8b535a669e9aad7a99919d0179848c"
+    GIT_LFS_WINDOWS_AMD64_CHECKSUM: "94435072f6b3a6f9064b277760c8340e432b5ede0db8205d369468b9be52c6b6"
+    PWSH_WINDOWS_AMD64_CHECKSUM: "ED331A04679B83D4C013705282D1F3F8D8300485EB04C081F36E11EAF1148BD0"
+
+.windows1809_variables:
+  variables:
+    WINDOWS_VERSION: servercore1809
+    WINDOWS_PREBUILT: servercore-ltsc2019
+
+.windows1809:
+  extends:
+    - .windows1809_variables
+  tags:
+    - !reference [.instance-windows-2019]
+
+.windows1809_nano:
+  extends:
+    - .windows1809
+  variables:
+    WINDOWS_VERSION: nanoserver1809
+    WINDOWS_PREBUILT: nanoserver-ltsc2019
+
+.windows21H2_variables:
+  variables:
+    WINDOWS_VERSION: servercore21H2
+    WINDOWS_PREBUILT: servercore-ltsc2022
+
+.windows21H2:
+  extends:
+    - .windows21H2_variables
+  tags:
+    - !reference [.instance-windows-2022]
+
+.windows21H2_nano:
+  extends:
+    - .windows21H2
+  variables:
+    WINDOWS_VERSION: nanoserver21H2
+    WINDOWS_PREBUILT: nanoserver-ltsc2022
+
+# .stage_done is used as a sentinel at stage n for stage n-1 completion, so we can kick off builds in later stages
+# without explicitly waiting for the completion of the n-1 stage
+.stage_done:
+  extends:
+    - .no_cache_and_dependencies
+    - .rules:merge_request_pipelines
+  image: alpine:latest
+  variables:
+    GIT_STRATEGY: none
+  script:
+    - exit 0

.gitlab/ci/_project_canonical.gitlab-ci.yml

+.instance-default: gitlab-org
+.instance-default-docker: gitlab-org-docker
+
+.instance-2xlarge: saas-linux-2xlarge-amd64
+.instance-medium: saas-linux-medium-amd64
+
+.instance-windows-2019: windows-1809
+.instance-windows-2022: windows-21h1

.gitlab/ci/_project_fork.gitlab-ci.yml

+.instance-default: gitlab-org
+.instance-default-docker: gitlab-org-docker
+
+.instance-2xlarge: gitlab-org-docker
+.instance-medium: gitlab-org-docker
+
+# we don't use windows instances on forks, but these
+# still need to be present because they're referenced,
+# so we just provide a bogus tag name
+.instance-windows-2019: not-intended-for-forks
+.instance-windows-2022: not-intended-for-forks
\ No newline at end of file

.gitlab/ci/_rules.gitlab-ci.yml

+####################
+# Changes patterns #
+####################
+
+.code-backstage-patterns: &code-backstage-patterns
+  - ".gitlab-ci.yml"
+  - ".golangci.yml"
+  - ".gitlab/ci/**/*"
+  - ".gitattributes"
+  - "Makefile*"
+  - "**/*.go"
+  - "{ci,dockerfiles,packaging,scripts,tests}/**/*"
+  - "**/testdata/**/*"
+  - "go.*"
+  - "tmp/gitlab-test/**"
+  - "VERSION"
+
+.docs-patterns: &docs-patterns
+  - ".vale.ini"
+  - ".markdownlint.yml"
+  - "docs/**/*"
+  - "scripts/lint-docs"
+
+
+##############
+# Conditions #
+##############
+
+.if-not-canonical-namespace: &if-not-canonical-namespace
+  if: '$CI_PROJECT_NAMESPACE !~ /^gitlab-org($|\/)/'
+
+.if-default-branch: &if-default-branch
+  if: '$CI_COMMIT_BRANCH == $CI_DEFAULT_BRANCH'
+
+.if-release-candidate-tag: &if-release-candidate-tag
+  if: '$CI_COMMIT_TAG =~ /^v[0-9]+\.[0-9]+\.[0-9]+-rc[0-9]+/'
+
+.if-stable-release-tag: &if-stable-release-tag
+  if: '$CI_COMMIT_TAG =~ /^v[0-9]+\.[0-9]+\.[0-9]+$/'
+
+.if-merge-request-pipeline: &if-merge-request-pipeline
+  if: $CI_PIPELINE_SOURCE == "merge_request_event"
+
+.if-runner-merge-request-pipeline: &if-runner-merge-request-pipeline
+  if: $CI_PIPELINE_SOURCE == "merge_request_event" && $CI_PROJECT_PATH == "gitlab-org/gitlab-runner"
+
+.if-runner-security-merge-request-pipeline: &if-runner-security-merge-request-pipeline
+  if: $CI_PIPELINE_SOURCE == "merge_request_event" && $CI_PROJECT_PATH == "gitlab-org/security/gitlab-runner"
+
+.if-runner-default-branch: &if-runner-default-branch
+  if: $CI_COMMIT_BRANCH == $CI_DEFAULT_BRANCH && $CI_PROJECT_PATH == "gitlab-org/gitlab-runner"
+
+.if-runner-or-security-runner-default-branch: &if-runner-or-security-runner-default-branch
+  if: $CI_COMMIT_BRANCH == $CI_DEFAULT_BRANCH && ($CI_PROJECT_PATH == "gitlab-org/gitlab-runner" || $CI_PROJECT_PATH == "gitlab-org/security/gitlab-runner")
+
+.if-runner-or-security-runner-stable-ref: &if-runner-or-security-runner-stable-ref
+  if: $CI_COMMIT_REF_NAME =~ /\A[0-9]+-[0-9]+-stable\z/ && ($CI_PROJECT_PATH == "gitlab-org/gitlab-runner" || $CI_PROJECT_PATH == "gitlab-org/security/gitlab-runner")
+
+.if-runner-release-ref: &if-runner-release-ref
+  if: $CI_COMMIT_REF_NAME =~ /\Av[0-9]+\.[0-9]+\.[0-9]+(-rc[0-9]+)?\z/ && $CI_PROJECT_PATH == "gitlab-org/gitlab-runner"
+
+.if-runner-stable-release-ref: &if-runner-stable-release-ref
+  if: $CI_COMMIT_REF_NAME =~ /\Av[0-9]+\.[0-9]+\.[0-9]+?\z/ && $CI_PROJECT_PATH == "gitlab-org/gitlab-runner"
+
+.if-security-runner-release-ref: &if-security-runner-release-ref
+  if: $CI_COMMIT_REF_NAME =~ /\Av[0-9]+\.[0-9]+\.[0-9]+?\z/ && $CI_PROJECT_PATH == "gitlab-org/security/gitlab-runner"
+
+.if-runner-bleeding-edge-release-ref: &if-runner-bleeding-edge-release-ref
+  if: $CI_COMMIT_REF_NAME =~ /\Av[0-9]+\.[0-9]+\.[0-9]+-rc[0-9]+\z/ && $CI_PROJECT_PATH == "gitlab-org/gitlab-runner"
+
+.if-runner-or-security-bleeding-edge-release-ref: &if-runner-or-security-bleeding-edge-release-ref
+  if: $CI_COMMIT_REF_NAME =~ /\Av[0-9]+\.[0-9]+\.[0-9]+-rc[0-9]+\z/ && ($CI_PROJECT_PATH == "gitlab-org/gitlab-runner" || $CI_PROJECT_PATH == "gitlab-org/security/gitlab-runner")
+
+########################
+# Default branch rules #
+########################
+
+.rules:default-branch-only:no_docs:
+  rules:
+  - <<: *if-runner-or-security-runner-default-branch
+    changes: *code-backstage-patterns
+
+.rules:default-branch-only:no_docs:always:
+  rules:
+  - <<: *if-runner-or-security-runner-default-branch
+    changes: *code-backstage-patterns
+    when: always
+
+#######################
+# Merge Request rules #
+#######################
+
+.rules:merge_request_pipelines:
+  rules:
+  - <<: *if-merge-request-pipeline
+  - <<: *if-runner-or-security-runner-default-branch
+  - <<: *if-runner-or-security-runner-stable-ref
+  - <<: *if-runner-release-ref
+  - <<: *if-security-runner-release-ref
+
+.rules:merge_request_pipelines:no_docs:
+  rules:
+  - <<: *if-merge-request-pipeline
+    changes: *code-backstage-patterns
+  - <<: *if-runner-or-security-runner-default-branch
+    changes: *code-backstage-patterns
+  - <<: *if-runner-or-security-runner-stable-ref
+    changes: *code-backstage-patterns
+  - <<: *if-runner-release-ref
+    changes: *code-backstage-patterns
+  - <<: *if-security-runner-release-ref
+    changes: *code-backstage-patterns
+
+.rules:merge_request_pipelines:no_docs:no-community-mr:
+  rules:
+  - <<: *if-not-canonical-namespace
+    when: never
+  - <<: *if-merge-request-pipeline
+    changes: *code-backstage-patterns
+  - <<: *if-runner-or-security-runner-default-branch
+    changes: *code-backstage-patterns
+  - <<: *if-runner-or-security-runner-stable-ref
+    changes: *code-backstage-patterns
+  - <<: *if-runner-release-ref
+    changes: *code-backstage-patterns
+  - <<: *if-security-runner-release-ref
+    changes: *code-backstage-patterns
+
+# Rules cannot be merged, instead of opt for creating a new rule like this one
+.rules:merge_request_pipelines:no_docs:only_canonical:
+  rules:
+    - <<: *if-not-canonical-namespace
+      when: never
+    - <<: *if-runner-merge-request-pipeline
+      changes: *code-backstage-patterns
+    - <<: *if-runner-default-branch
+      changes: *code-backstage-patterns
+    - <<: *if-runner-stable-release-ref
+      changes: *code-backstage-patterns
+    - <<: *if-runner-release-ref
+      changes: *code-backstage-patterns
+
+.rules:merge_request_pipelines:no_docs:always:
+  rules:
+  - <<: *if-merge-request-pipeline
+    changes: *code-backstage-patterns
+    when: always
+  - <<: *if-runner-or-security-runner-default-branch
+    changes: *code-backstage-patterns
+    when: always
+  - <<: *if-runner-or-security-runner-stable-ref
+    changes: *code-backstage-patterns
+    when: always
+  - <<: *if-runner-release-ref
+    changes: *code-backstage-patterns
+    when: always
+  - <<: *if-security-runner-release-ref
+    changes: *code-backstage-patterns
+    when: always
+
+#################
+# Release rules #
+#################
+
+.rules:release:all:
+  rules:
+  - <<: *if-not-canonical-namespace
+    when: never
+  - <<: *if-default-branch
+  - <<: *if-release-candidate-tag
+  - <<: *if-stable-release-tag
+
+.rules:release:bleeding-edge:
+  rules:
+  - <<: *if-runner-default-branch
+    changes: *code-backstage-patterns
+  - <<: *if-runner-bleeding-edge-release-ref
+    changes: *code-backstage-patterns
+
+.rules:release-or-security:bleeding-edge-or-stable:
+  rules:
+    - <<: *if-runner-or-security-runner-default-branch
+      changes: *code-backstage-patterns
+    - <<: *if-runner-or-security-bleeding-edge-release-ref
+      changes: *code-backstage-patterns
+    - <<: *if-runner-or-security-runner-stable-ref
+      changes: *code-backstage-patterns
+
+.rules:release:stable-or-rc:
+  rules:
+  - if: $CI_COMMIT_TAG =~ /^v[0-9]+\.[0-9]+\.[0-9]+(-rc[0-9]+)?$/ && $CI_PROJECT_PATH == "gitlab-org/gitlab-runner"
+    changes: *code-backstage-patterns
+    when: on_success
+  - if: $CI_COMMIT_TAG =~ /^v[0-9]+\.[0-9]+\.[0-9]+(-rc[0-9]+)?$/ && $CI_PROJECT_PATH == "gitlab-org/security/gitlab-runner"
+    changes: *code-backstage-patterns
+    when: manual
+
+.rules:release:stable:branch:
+  rules:
+  - <<: *if-runner-stable-release-ref
+    changes: *code-backstage-patterns
+  - <<: *if-security-runner-release-ref
+    changes: *code-backstage-patterns
+
+.rules:release:stable:branch:ignore-changes:
+  rules:
+  - <<: *if-runner-stable-release-ref
+  - <<: *if-security-runner-release-ref
+
+.rules:release:development:merge-requests:
+  rules:
+  - <<: *if-runner-merge-request-pipeline
+    changes: *code-backstage-patterns
+  - <<: *if-runner-security-merge-request-pipeline
+    changes: *code-backstage-patterns
+
+.rules:release:development:merge-requests:no-community-mr:
+  rules:
+  - <<: *if-not-canonical-namespace
+    when: never
+  - <<: *if-runner-merge-request-pipeline
+    changes: *code-backstage-patterns
+  - <<: *if-runner-security-merge-request-pipeline
+    changes: *code-backstage-patterns
+
+.rules:runner-only:release:development:merge-requests:
+  rules:
+  - <<: *if-runner-merge-request-pipeline
+    changes: *code-backstage-patterns
+
+.rules:build:test:images:merge-requests:
+  rules:
+  - <<: *if-runner-merge-request-pipeline
+    changes:
+    - tests/dockerfiles/*
+
+.rules:prepare:test-ci-scripts:merge-requests:
+  rules:
+    - <<: *if-runner-merge-request-pipeline
+
+##############
+# Docs rules #
+##############
+
+.rules:docs:skip:
+  rules:
+  - changes: *docs-patterns
+    when: never
+  - when: on_success
+
+.rules:docs:review:
+  rules:
+  - <<: *if-not-canonical-namespace
+    when: never
+  - <<: *if-merge-request-pipeline
+    when: manual

.gitlab/ci/build.gitlab-ci.yml

+helper images:
+  tags:
+    - saas-linux-2xlarge-amd64
+  extends:
+  - .docker
+  - .rules:merge_request_pipelines:no_docs
+  stage: build
+  needs:
+    - 'binaries'
+  script:
+  - ./ci/touch_git
+  - make helper-images
+  - ls -alh out/helper-images/
+  retry: 2
+  artifacts:
+    paths:
+    - out/helper-images/
+    expire_in: 7d
+  parallel:
+    matrix:
+      - TARGETS:
+        - alpine alpine-pwsh ubuntu ubuntu-pwsh ubi-fips
+        - windows-nanoserver-ltsc2019 windows-servercore-ltsc2019
+        - windows-nanoserver-ltsc2022 windows-servercore-ltsc2022
+
+prebuilt helper images:
+  tags:
+    - !reference [.instance-2xlarge]
+  extends:
+  - .docker
+  - .rules:merge_request_pipelines:no_docs
+  stage: build
+  image: "${RUNNER_IMAGES_REGISTRY}/ci:${RUNNER_IMAGES_VERSION}-prebuilt-images"
+  needs:
+    - 'helper images: [alpine alpine-pwsh ubuntu ubuntu-pwsh ubi-fips]'
+  script:
+  - make prebuilt-helper-images
+  - ls -alh out/helper-images/
+  artifacts:
+    paths:
+    - out/helper-images/*.tar.xz
+    - out/helper-images/*.tar.zst
+    expire_in: 7d
+
+prebuilt helper images windows 2019:
+  tags:
+    - !reference [.instance-2xlarge]
+  extends:
+  - prebuilt helper images
+  - .rules:merge_request_pipelines:no_docs:no-community-mr
+  needs:
+    - 'helper images: [windows-nanoserver-ltsc2019 windows-servercore-ltsc2019]'
+
+prebuilt helper images windows 2022:
+  tags:
+    - !reference [.instance-2xlarge]
+  extends:
+  - prebuilt helper images
+  - .rules:merge_request_pipelines:no_docs:no-community-mr
+  needs:
+    - 'helper images: [windows-nanoserver-ltsc2022 windows-servercore-ltsc2022]'
+
+runner images:
+  tags:
+    - !reference [.instance-2xlarge]
+  extends:
+  - .docker
+  - .rules:merge_request_pipelines:no_docs
+  stage: build
+  needs:
+    - 'binaries'
+  script:
+  - ./ci/touch_git
+  - TARGETS="ubuntu alpine ubi-fips" make runner-images
+  - ls -alh out/runner-images/
+  retry: 2
+  artifacts:
+    paths:
+    - out/runner-images/
+    expire_in: 7d
+
+test images:
+  extends:
+  - .docker
+  - .rules:build:test:images:merge-requests
+  stage: build
+  needs:
+    - 'binaries'
+  script:
+  - docker buildx create --name builder --use --driver docker-container default || true
+  - echo "${CI_REGISTRY_PASSWORD}" | docker login --username "${CI_REGISTRY_USER}" --password-stdin "${CI_REGISTRY}"
+  - cd tests/dockerfiles && docker buildx bake --progress plain tests-images --set *.output="type=registry,compression=zstd"
+  - docker logout "${CI_REGISTRY}"
+
+binaries:
+  image: "${RUNNER_IMAGES_REGISTRY}/ubi-go:${RUNNER_IMAGES_VERSION}"
+  tags:
+    - !reference [.instance-2xlarge]
+  extends:
+  - .rules:merge_request_pipelines:no_docs
+  - .go-cache
+  stage: build
+  needs: []
+  script:
+  - go mod download
+  - make -j$(($(nproc) * 2)) helper-bin helper-bin-fips runner-bin runner-bin-fips
+  artifacts:
+    paths:
+    - out/binaries/gitlab-runner*
+    expire_in: 7d
+
+clone test repo:
+  extends:
+  - .rules:merge_request_pipelines:no_docs
+  - .no_cache_and_dependencies
+  stage: build
+  image: alpine:latest
+  needs: []
+  variables:
+    GIT_STRATEGY: none
+  script:
+  - apk add git
+  - mkdir tmp
+  - succeed=0
+  - for i in {1..3}; do git clone https://gitlab.com/gitlab-org/ci-cd/gitlab-runner-pipeline-tests/gitlab-test tmp/gitlab-test && succeed=1 && break; echo "retrying"; done
+  - '[[ "$succeed" -eq 1 ]]'
+  artifacts:
+    paths:
+    - tmp/gitlab-test
+    expire_in: 7d
+
+rpm verify fips:
+  stage: build
+  extends:
+  - .rules:merge_request_pipelines:no_docs
+  stage: build
+  image: "registry.gitlab.com/gitlab-org/cloud-native/container-dependencies-finder/cdf:main"
+  needs:
+    - 'runner images'
+    - 'helper images: [alpine alpine-pwsh ubuntu ubuntu-pwsh ubi-fips]'
+  variables:
+    # VERBOSE: 1
+    OCI_TARS: |-
+      runner=out/runner-images/ubi-fips.tar
+      helper=out/helper-images/ubi-fips-x86_64.tar
+  script:
+  - ci/rpm_verify_fips
+  artifacts:
+    paths:
+    - logs/
+    expire_in: 7d
+
+# prepare done is used as a sentinel for "Prepare" stage completion, so we can kick off builds in later stages
+# without waiting for the completion of the Prebuild stage
+prepare done:
+  stage: build
+  extends:
+  - .stage_done

.gitlab/ci/coverage.gitlab-ci.yml

+.coverage_job:
+  extends:
+  - .rules:merge_request_pipelines:no_docs:always
+  stage: coverage
+
+test coverage report:
+  extends:
+  - .coverage_job
+  coverage: /regular total:\s+\(statements\)\s+\d+.\d+\%/
+  needs:
+  - unit test
+  - integration test
+  - job: windows 1809 integration tests
+    optional: true
+  - job: windows 21H2 integration tests
+    optional: true
+  - job: windows 1809 unit tests
+    optional: true
+  - job: windows 21H2 unit tests
+    optional: true
+  script:
+  - make cobertura_report
+  - test -z "$(find .splitic -name 'junit_servercore1809_*.xml' -maxdepth 1 -print -quit)" || splitic junit-check -quarantined ci/.test-failures.servercore1809.txt .splitic/junit_servercore1809_*.xml
+  - test -z "$(find .splitic -name 'junit_servercore21H2_*.xml' -maxdepth 1 -print -quit)" || splitic junit-check -quarantined ci/.test-failures.servercore21H2.txt .splitic/junit_servercore21H2_*.xml
+  artifacts:
+    reports:
+      coverage_report:
+        coverage_format: cobertura
+        path: out/cobertura/cobertura-*coverage.xml
+    paths:
+    - out/coverage/
+    expire_in: 7d
+    expose_as: 'Code Coverage'
+
+# Disable this for now since
+# https://gitlab.com/gitlab-org/gitlab/-/issues/365885 block us from upgrading
+# to go 1.18.x. Re-enable this when the above ticket is fixed.
+#code navigation: # See https://docs.gitlab.com/ee/user/project/code_intelligence.html#configuration
+  #extends:
+  #- .coverage_job
+  #allow_failure: true # recommended
+  #needs:
+  #- prepare done
+  #image: sourcegraph/lsif-go:v1.9.0
+  #script:
+  #- lsif-go
+  #artifacts:
+    #reports:
+      #lsif: dump.lsif

.gitlab/ci/deploy.gitlab-ci.yml

+# This job should only run if the UBI images downstream pipeline is successful. 
+# It does not depend on it since the pipeline incorrectly assumes that it has passed
+# when the trigger job is just created. Instead it depends on the whole postreleases stage.
+trigger deploy to kubernetes:
+  stage: deploy
+  variables:
+    UPSTREAM_CI_COMMIT_REF: $CI_COMMIT_BRANCH
+    UPSTREAM_CI_COMMIT_SHORT_SHA: $CI_COMMIT_SHORT_SHA
+  rules:
+    # Override rules in .trigger-downstream-pipeline-ref to remove MR pipelines
+    - if: '$CI_PROJECT_NAMESPACE !~ /^gitlab-org($|\/)/'
+      when: never
+    - if: $CI_PROJECT_PATH != "gitlab-org/gitlab-runner"
+      when: never
+    - if: $CI_PIPELINE_SOURCE == "merge_request_event"
+      when: never
+    - if: $CI_COMMIT_BRANCH == $CI_DEFAULT_BRANCH
+      changes: !reference [.code-backstage-patterns]
+      variables:
+        UPSTREAM_CI_COMMIT_REF: $CI_COMMIT_REF_NAME
+    - if: $CI_COMMIT_REF_NAME =~ /\Av[0-9]+\.[0-9]+\.[0-9]+?\z/
+      changes: !reference [.code-backstage-patterns]
+      variables:
+        UPSTREAM_CI_COMMIT_REF: $CI_COMMIT_REF_NAME
+    - if: $CI_COMMIT_REF_NAME =~ /\Av[0-9]+\.[0-9]+\.[0-9]+(-rc[0-9]+)?\z/
+      changes: !reference [.code-backstage-patterns]
+      variables:
+        UPSTREAM_CI_COMMIT_REF: $CI_COMMIT_REF_NAME
+  trigger:
+    project: gitlab-org/ci-cd/runner-tools/runner-kubernetes-infra
+

.gitlab/ci/docs.gitlab-ci.yml

+.review-docs:
+  stage: docs
+  extends:
+  - .rules:docs:review
+  - .no_cache_and_dependencies
+  image: ruby:3.3-alpine
+  needs: []
+  before_script:
+  - gem install gitlab --no-doc
+  # We need to download the script rather than clone the repo since the
+  # review-docs-cleanup job will not be able to run when the branch gets
+  # deleted (when merging the MR).
+  - apk add --update openssl
+  - wget https://gitlab.com/gitlab-org/gitlab/-/raw/master/scripts/trigger-build.rb
+  - chmod 755 trigger-build.rb
+  variables:
+    GIT_STRATEGY: none
+    # By default, deploy the Review App using the `main` branch of the `gitlab-org/gitlab-docs` project
+    DOCS_BRANCH: main
+  allow_failure: true
+
+# Trigger a docs build in docs-gitlab-com project
+# Useful to preview the docs changes live
+# https://docs.gitlab.com/development/documentation/review_apps/
+review-docs-deploy:
+  extends:
+  - .review-docs
+  environment:
+    name: review-docs/mr-${CI_MERGE_REQUEST_IID}
+    auto_stop_in: 2 weeks
+    url: https://docs.gitlab.com/upstream-review-mr-${DOCS_GITLAB_REPO_SUFFIX}-${CI_MERGE_REQUEST_IID}/${DOCS_GITLAB_REPO_SUFFIX}
+    on_stop: review-docs-cleanup
+  script:
+  - ./trigger-build.rb docs deploy
+
+# Cleanup remote environment of docs-gitlab-com
+review-docs-cleanup:
+  extends:
+  - .review-docs
+  environment:
+    name: review-docs/mr-${CI_MERGE_REQUEST_IID}
+    action: stop
+  script:
+  - ./trigger-build.rb docs cleanup

.gitlab/ci/package.gitlab-ci.yml

+.packages:
+  extends:
+  - .rules:merge_request_pipelines:no_docs
+  stage: package
+  environment:
+    name: package/$PKGS/$CI_COMMIT_REF_NAME
+  needs:
+  - 'prebuilt helper images'
+  - 'binaries'
+  before_script:
+  - |
+    # checking GPG signing support
+    if [ -f "$GPG_KEY_PATH" ]; then
+      cat ${GPG_KEY_PATH} | gpg --batch --no-tty --allow-secret-key-import --import -
+      export GPG_KEYID=$(gpg --with-colon --list-secret-keys | head -n1 | cut -d : -f 5)
+      export GPG_PASSPHRASE=$(cat ${GPG_PASSPHRASE_PATH})
+    else
+      echo -e "\033[0;31m****** GPG signing disabled ******\033[0m"
+    fi
+  script:
+  - mage package:prepare
+  - mage package:verifyIterationVariable
+  - mage package:$PKGS
+  artifacts:
+    paths:
+    - out/deb/
+    - out/rpm/
+    expire_in: 7d
+
+package-deb:
+  extends:
+  - .packages
+  parallel:
+    matrix:
+    - PKGS:
+      - deb64
+      - debArm64
+      - deb32
+      - debArm32
+      - debIbm
+      - debRiscv64
+
+package-rpm:
+  extends:
+  - .packages
+  parallel:
+    matrix:
+    - PKGS:
+      - rpm64
+      - rpmArm64
+      - rpm32
+      - rpmArm32
+      - rpmIbm
+      - rpmRiscv64
+      - rpmFips
+
+package-helpers:
+  extends:
+  - .packages
+  script:
+  - mage package:prepare
+  - mage package:verifyIterationVariable
+  - mage package:helpersDeb
+  - mage package:helpersRpm

.gitlab/ci/postrelease.gitlab-ci.yml

+.trigger-downstream-pipeline-ref:
+  stage: postrelease
+  variables:
+    UPSTREAM_CI_COMMIT_REF: $CI_COMMIT_BRANCH
+    UPSTREAM_CI_COMMIT_SHORT_SHA: $CI_COMMIT_SHORT_SHA
+  rules:
+    # copy of .rules:merge_request_pipelines:no_docs:only_canonical, slightly modified for variables
+    - if: '$CI_PROJECT_NAMESPACE !~ /^gitlab-org($|\/)/'
+      when: never
+    - if: $CI_PROJECT_PATH != "gitlab-org/gitlab-runner"
+      when: never
+    - if: $CI_PIPELINE_SOURCE == "merge_request_event"
+      changes: !reference [.code-backstage-patterns]
+      variables:
+        UPSTREAM_CI_COMMIT_REF: "refs/merge-requests/${CI_MERGE_REQUEST_IID}/merge"
+    - if: $CI_COMMIT_BRANCH == $CI_DEFAULT_BRANCH
+      changes: !reference [.code-backstage-patterns]
+      variables:
+        UPSTREAM_CI_COMMIT_REF: $CI_COMMIT_REF_NAME
+    - if: $CI_COMMIT_REF_NAME =~ /\Av[0-9]+\.[0-9]+\.[0-9]+?\z/
+      changes: !reference [.code-backstage-patterns]
+      variables:
+        UPSTREAM_CI_COMMIT_REF: $CI_COMMIT_REF_NAME
+    - if: $CI_COMMIT_REF_NAME =~ /\Av[0-9]+\.[0-9]+\.[0-9]+(-rc[0-9]+)?\z/
+      changes: !reference [.code-backstage-patterns]
+      variables:
+        UPSTREAM_CI_COMMIT_REF: $CI_COMMIT_REF_NAME
+
+trigger UBI images build:
+  extends:
+    - .trigger-downstream-pipeline-ref
+  variables:
+    BUILD_RELEASE: $CI_COMMIT_REF_NAME
+    BUILD_RELEASE_SHA: $CI_COMMIT_SHORT_SHA
+  trigger:
+    strategy: depend
+    project: gitlab-org/ci-cd/gitlab-runner-ubi-images
+
+trigger runner-incept tests:
+  extends:
+    - .trigger-downstream-pipeline-ref
+  needs:
+    - binaries
+    - "helper images"
+  trigger:
+    project: gitlab-org/ci-cd/tests/runner-incept
+    # strategy: depend
+
+static QA:
+  extends:
+  - .rules:merge_request_pipelines:no_docs
+  - .no_cache
+  stage: postrelease
+  image: alpine:3.14.2
+  needs:
+  - code_quality
+  script: |
+    if [ "$(cat gl-code-quality-report.json)" != "[]" ] ; then
+      apk add -U --no-cache jq > /dev/null
+      jq -C . gl-code-quality-report.json
+      exit 1
+    fi
+
+.verify-resources:
+  extends:
+    - .rules:merge_request_pipelines:no_docs
+    - .docker
+  stage: postrelease
+  script:
+    - mage resources:verifyAll
+
+verify development resources:
+  extends:
+  - .verify-resources
+  - .rules:release:development:merge-requests
+  needs:
+  - job: "development docker images"
+    artifacts: true
+
+verify bleeding edge resources:
+  extends:
+  - .verify-resources
+  - .rules:release:bleeding-edge
+  needs:
+  - job: "bleeding edge docker images"
+    artifacts: true
+
+verify stable resources:
+  extends:
+  - .verify-resources
+  - .rules:release:stable:branch
+  needs:
+  - job: "stable docker images"
+    artifacts: true
+
+stable gitlab release:
+  stage: postrelease
+  extends:
+  - .rules:release:stable-or-rc
+  dependencies: []
+  image: registry.gitlab.com/gitlab-org/release-cli:latest
+  variables:
+    CHANGELOG: https://gitlab.com/gitlab-org/gitlab-runner/blob/$CI_COMMIT_TAG/CHANGELOG.md
+    S3: https://gitlab-runner-downloads.s3.amazonaws.com/$CI_COMMIT_TAG
+    # Setting the CI_PROJECT_ID variable explicitly because we're running this job
+    # also from the https://gitlab.com/gitlab-org/security/gitlab-runner fork. But it
+    # should still create the release entry in the canonical one.
+    CI_PROJECT_ID: 250833
+  environment:
+    name: stable/gitlab
+    url: https://gitlab.com/gitlab-org/gitlab-runner/-/releases
+  before_script: []
+  script:
+  - echo "Releasing to $S3"
+  release:
+    name: '$CI_COMMIT_TAG'
+    description: |
+      See [the changelog]($CHANGELOG) :rocket:
+
+      GitLab Runner documentation can be found at https://docs.gitlab.com/runner/.
+    tag_name: '$CI_COMMIT_TAG'
+    ref: '$CI_COMMIT_TAG'
+    assets:
+      links:
+      # binaries
+      - name: 'binary: Linux amd64'
+        url: '$S3/binaries/gitlab-runner-linux-amd64'
+        filepath: '/binaries/gitlab-runner-linux-amd64'
+      - name: 'binary: Linux amd64-fips'
+        url: '$S3/binaries/gitlab-runner-linux-amd64-fips'
+        filepath: '/binaries/gitlab-runner-linux-amd64-fips'
+      - name: 'binary: Linux 386'
+        url: '$S3/binaries/gitlab-runner-linux-386'
+        filepath: '/binaries/gitlab-runner-linux-386'
+      - name: 'binary: Linux arm'
+        url: '$S3/binaries/gitlab-runner-linux-arm'
+        filepath: '/binaries/gitlab-runner-linux-arm'
+      - name: 'binary: Linux ppc64el'
+        url: '$S3/binaries/gitlab-runner-linux-ppc64el'
+        filepath: '/binaries/gitlab-runner-linux-ppc64el'
+      - name: 'binary: Linux s390x'
+        url: '$S3/binaries/gitlab-runner-linux-s390x'
+        filepath: '/binaries/gitlab-runner-linux-s390x'
+      - name: 'binary: Linux riscv64'
+        url: '$S3/binaries/gitlab-runner-linux-riscv64'
+        filepath: '/binaries/gitlab-runner-linux-riscv64'
+
+      - name: 'binary: macOS amd64'
+        url: '$S3/binaries/gitlab-runner-darwin-amd64'
+        filepath: '/binaries/gitlab-runner-darwin-amd64'
+      - name: 'binary: macOS arm64'
+        url: '$S3/binaries/gitlab-runner-darwin-arm64'
+        filepath: '/binaries/gitlab-runner-darwin-arm64'
+
+      - name: 'binary: FreeBSD amd64'
+        url: '$S3/binaries/gitlab-runner-freebsd-amd64'
+        filepath: '/binaries/gitlab-runner-freebsd-amd64'
+      - name: 'binary: FreeBSD arm'
+        url: '$S3/binaries/gitlab-runner-freebsd-arm'
+        filepath: '/binaries/gitlab-runner-freebsd-arm'
+      - name: 'binary: FreeBSD 386'
+        url: '$S3/binaries/gitlab-runner-freebsd-386'
+        filepath: '/binaries/gitlab-runner-freebsd-386'
+
+      - name: 'binary: Windows amd64'
+        url: '$S3/binaries/gitlab-runner-windows-amd64.zip'
+        filepath: '/binaries/gitlab-runner-windows-amd64.zip'
+      - name: 'binary: Windows i386'
+        url: '$S3/binaries/gitlab-runner-windows-386.zip'
+        filepath: '/binaries/gitlab-runner-windows-386.zip'
+
+      # DEB packages
+      - name: 'package: DEB amd64'
+        url: '$S3/deb/gitlab-runner_amd64.deb'
+        filepath: '/packages/deb/gitlab-runner_amd64.deb'
+      - name: 'package: DEB i686'
+        url: '$S3/deb/gitlab-runner_i686.deb'
+        filepath: '/packages/deb/gitlab-runner_i686.deb'
+      - name: 'package: DEB armel'
+        url: '$S3/deb/gitlab-runner_armel.deb'
+        filepath: '/packages/deb/gitlab-runner_armel.deb'
+      - name: 'package: DEB armhf'
+        url: '$S3/deb/gitlab-runner_armhf.deb'
+        filepath: '/packages/deb/gitlab-runner_armhf.deb'
+      - name: 'package: DEB aarch64'
+        url: '$S3/deb/gitlab-runner_aarch64.deb'
+        filepath: '/packages/deb/gitlab-runner_aarch64.deb'
+      - name: 'package: DEB arm64'
+        url: '$S3/deb/gitlab-runner_arm64.deb'
+        filepath: '/packages/deb/gitlab-runner_arm64.deb'
+      - name: 'package: DEB ppc64el'
+        url: '$S3/deb/gitlab-runner_ppc64el.deb'
+        filepath: '/packages/deb/gitlab-runner_ppc64el.deb'
+      - name: 'package: DEB s390x'
+        url: '$S3/deb/gitlab-runner_s390x.deb'
+        filepath: '/packages/deb/gitlab-runner_s390x.deb'
+      - name: 'package: DEB riscv64'
+        url: '$S3/deb/gitlab-runner_riscv64.deb'
+        filepath: '/packages/deb/gitlab-runner_riscv64.deb'
+
+      # RPM packages
+      - name: 'package: RPM amd64'
+        url: '$S3/rpm/gitlab-runner_amd64.rpm'
+        filepath: '/packages/rpm/gitlab-runner_amd64.rpm'
+      - name: 'package: RPM amd64-fips'
+        url: '$S3/rpm/gitlab-runner_amd64-fips.rpm'
+        filepath: '/packages/rpm/gitlab-runner_amd64-fips.rpm'
+      - name: 'package: RPM i686'
+        url: '$S3/rpm/gitlab-runner_i686.rpm'
+        filepath: '/packages/rpm/gitlab-runner_i686.rpm'
+      - name: 'package: RPM arm'
+        url: '$S3/rpm/gitlab-runner_arm.rpm'
+        filepath: '/packages/rpm/gitlab-runner_arm.rpm'
+      - name: 'package: RPM armhf'
+        url: '$S3/rpm/gitlab-runner_armhf.rpm'
+        filepath: '/packages/rpm/gitlab-runner_armhf.rpm'
+      - name: 'package: RPM arm64'
+        url: '$S3/rpm/gitlab-runner_arm64.rpm'
+        filepath: '/packages/rpm/gitlab-runner_arm64.rpm'
+      - name: 'package: RPM aarch64'
+        url: '$S3/rpm/gitlab-runner_aarch64.rpm'
+        filepath: '/packages/rpm/gitlab-runner_aarch64.rpm'
+      - name: 'package: RPM ppc64le'
+        url: '$S3/rpm/gitlab-runner_ppc64le.rpm'
+        filepath: '/packages/rpm/gitlab-runner_ppc64le.rpm'
+      - name: 'package: RPM s390x'
+        url: '$S3/rpm/gitlab-runner_s390x.rpm'
+        filepath: '/packages/rpm/gitlab-runner_s390x.rpm'
+      - name: 'package: RPM riscv64'
+        url: '$S3/rpm/gitlab-runner_riscv64.rpm'
+        filepath: '/packages/rpm/gitlab-runner_riscv64.rpm'
+
+      # Other files
+      - name: 'checksums'
+        url: '$S3/release.sha256'
+        filepath: '/release.sha256'
+      - name: 'checksums GPG signature'
+        url: '$S3/release.sha256.asc'
+        filepath: '/release.sha256.asc'
+      - name: 'other release artifacts'
+        url: '$S3/index.html'
+        filepath: '/index.html'

.gitlab/ci/prepare.gitlab-ci.yml

+.image_builder:
+  extends:
+  - .docker
+  stage: prepare
+  image: docker:${DOCKER_VERSION}-git
+  script:
+  - apk add --no-cache --upgrade curl
+  - source ./ci/build_ci_image
+
+prepare ci image:
+  extends:
+  - .image_builder
+  - .rules:prepare:ci:image:merge-requests
+  variables:
+    BUILD_IMAGE: $CI_IMAGE
+    BUILD_DOCKERFILE: ./dockerfiles/ci/Dockerfile
+    PWSH_VERSION: "7.4.6-1"
+
+prepare alpine-no-root image:
+  extends:
+  - .image_builder
+  - .rules:prepare:alpine-no-root:image:merge-requests
+  variables:
+    BUILD_IMAGE: registry.gitlab.com/gitlab-org/gitlab-runner/alpine-no-root:latest
+    BUILD_DOCKERFILE: ./tests/dockerfiles/alpine-no-root/Dockerfile
+
+prepare alpine-entrypoint image:
+  extends:
+  - .image_builder
+  - .rules:prepare:alpine-entrypoint:image:merge-requests
+  variables:
+    BUILD_IMAGE: registry.gitlab.com/gitlab-org/gitlab-runner/alpine-entrypoint:latest
+    BUILD_DOCKERFILE: ./tests/dockerfiles/alpine-entrypoint/Dockerfile
+
+prepare alpine-entrypoint-stderr image:
+  extends:
+  - .image_builder
+  - .rules:prepare:alpine-entrypoint:image:merge-requests
+  variables:
+    BUILD_IMAGE: registry.gitlab.com/gitlab-org/gitlab-runner/alpine-entrypoint-stderr:latest
+    BUILD_DOCKERFILE: ./tests/dockerfiles/alpine-entrypoint/Dockerfile.stderr
+
+prepare alpine-entrypoint-pre-post-trap image:
+  extends:
+  - .image_builder
+  - .rules:prepare:alpine-entrypoint:image:merge-requests
+  variables:
+    BUILD_IMAGE: registry.gitlab.com/gitlab-org/gitlab-runner/alpine-entrypoint-pre-post-trap:latest
+    BUILD_DOCKERFILE: ./tests/dockerfiles/alpine-entrypoint/Dockerfile.pre-post-trap
+
+prepare powershell-entrypoint-pre-post-trap image:
+  extends:
+  - .image_builder
+  - .rules:prepare:powershell-entrypoint:image:merge-requests
+  variables:
+    BUILD_IMAGE: registry.gitlab.com/gitlab-org/gitlab-runner/powershell-entrypoint-pre-post-trap:latest
+    BUILD_DOCKERFILE: ./tests/dockerfiles/powershell-entrypoint/Dockerfile.pre-post-trap
+
+prepare alpine-id-overflow image:
+  extends:
+  - .image_builder
+  - .rules:prepare:alpine-id-overflow:image:merge-requests
+  variables:
+    BUILD_IMAGE: registry.gitlab.com/gitlab-org/gitlab-runner/alpine-id-overflow:latest
+    BUILD_DOCKERFILE: ./tests/dockerfiles/alpine-id-overflow/Dockerfile
+
+prepare helper-entrypoint image:
+  extends:
+  - .docker
+  - .rules:prepare:gitlab-runner-helper-entrypoint:image:merge-requests
+  stage: prepare
+  variables:
+    BUILD_DOCKERFILE_BASEDIR: ./tests/dockerfiles/gitlab-runner-helper-entrypoint
+    BUILD_IMAGE: registry.gitlab.com/gitlab-org/gitlab-runner/helper-entrypoint:latest
+    BUILD_DOCKERFILE: "$BUILD_DOCKERFILE_BASEDIR/dockerfile"
+  script:
+  - make helper-bin-host
+  - mkdir -p "$BUILD_DOCKERFILE_BASEDIR/binaries/"
+  - cp out/binaries/gitlab-runner-helper/gitlab-runner-helper.x86_64 "$BUILD_DOCKERFILE_BASEDIR/binaries/gitlab-runner-helper"
+  - source ./ci/build_ci_image
+
+prepare go fips:
+  extends:
+    - .docker
+    - .rules:prepare:go-fips:image:merge-requests
+  stage: prepare
+  image: docker:${DOCKER_VERSION}-git
+  variables:
+    BUILD_IMAGE: $GO_FIPS_IMAGE
+    GO_VERSION: $GO_FIPS_VERSION
+    GO_FIPS_BASE_IMAGE: "redhat/${GO_FIPS_UBI_VERSION}-minimal:latest"
+  script:
+    - apk add --no-cache --upgrade curl make bash
+    - make go-fips-docker
+
+prepare ubi base:
+  extends:
+    - .docker
+    - .rules:prepare:ubi-base:image:merge-requests
+  timeout: 4h
+  stage: prepare
+  image: docker:${DOCKER_VERSION}-git
+  script:
+    - apk add --no-cache --upgrade curl make bash
+    - make ubi-fips-base-docker
+
+test ci scripts:
+  stage: prepare
+  extends:
+    - .rules:prepare:test-ci-scripts:merge-requests
+  needs:
+    - job: "prepare ci image"
+      optional: true
+  script:
+    - make test_go_scripts

.gitlab/ci/qa.gitlab-ci.yml

+check version definition:
+  stage: qa
+  extends:
+  - .rules:merge_request_pipelines
+  needs: []
+  script:
+  - grep -E '^[0-9]+\.[0-9]+\.[0-9]+$' VERSION
+
+check modules:
+  stage: qa
+  extends:
+  - .rules:merge_request_pipelines:no_docs
+  - .no_cache_and_dependencies
+  needs:
+  - 'prepare done'
+  script:
+  - make check_modules
+
+check generated files:
+  stage: qa
+  extends:
+  - .rules:merge_request_pipelines:no_docs
+  - .no_cache_and_dependencies
+  needs:
+  - 'prepare done'
+  script:
+  - make check_generated_files
+
+check magefiles:
+  stage: qa
+  extends:
+    - .rules:merge_request_pipelines:no_docs
+    - .no_cache_and_dependencies
+  needs:
+    - 'prepare done'
+  script:
+    - make check_magefiles
+
+check test directives:
+  stage: qa
+  extends:
+  - .rules:merge_request_pipelines:no_docs
+  - .no_cache_and_dependencies
+  needs:
+  - 'prepare done'
+  script:
+  - make check_test_directives
+
+code_quality:
+  stage: qa
+  extends:
+  - .rules:merge_request_pipelines:no_docs
+  - .no_dependencies
+  # Use GOCACHE instead of GOLANGCI_LINT_CACHE
+  # to avoid [false lint positives](https://gitlab.com/gitlab-org/gitlab-runner/-/merge_requests/2187#note_373008672)
+  - .go-cache
+  image: registry.gitlab.com/gitlab-org/ci-cd/runner-tools/runner-linters:1.62.0-go1.23.3
+  needs: []
+  allow_failure: true
+  variables:
+    REPORT_FILE: gl-code-quality-report.json
+    LINT_FLAGS: "--color never --timeout 15m"
+    OUT_FORMAT: code-climate
+    GOLANGLINT_VERSION: "" # Don't add version suffix to Makefile's GOLANGLINT (use plain golangci-lint from image)
+  before_script:
+  - !reference [.go-cache, before_script]
+  # Ensure the goargs linter plugin is available at .tmp/goargs.so to suit .golangci.yml
+  - mkdir .tmp && ln -s /usr/lib/goargs.so .tmp/goargs.so
+  # Copy the Docker image's golangci-lint to the location expected by `make lint` so that it is not built
+  - cp $(which golangci-lint) .tmp/golangci-lint
+  script:
+  # Write the code coverage report to gl-code-quality-report.json
+  # and print linting issues to stdout in the format: path/to/file:line description
+  - make --silent lint | tee ${REPORT_FILE}
+  timeout: 15 minutes
+  artifacts:
+    reports:
+      codequality: ${REPORT_FILE}
+    paths:
+    - ${REPORT_FILE}
+    when: always
+    expire_in: 7d
+
+mage tests:
+    extends:
+    - .rules:merge_request_pipelines:no_docs
+    stage: qa
+    needs:
+    - 'prepare done'
+    script:
+    - make mage-test
+
+# Perform documentation linting and link checking on Markdown files
+docs:lint markdown:
+  image: registry.gitlab.com/gitlab-org/technical-writing/docs-gitlab-com/lint-markdown:alpine-3.20-vale-3.9.3-markdownlint2-0.17.1-lychee-0.15.1
+  stage: qa
+  extends:
+  - .rules:merge_request_pipelines
+  - .no_cache_and_dependencies
+  needs: []
+  script:
+  # Lint content and Markdown, and check links
+  - make lint-docs VALE_MIN_ALERT_LEVEL=error
+
+docs:check feature flags:
+  stage: qa
+  extends:
+  - .rules:merge_request_pipelines
+  - .no_cache_and_dependencies
+  script:
+  - cp docs/configuration/feature-flags.md docs/configuration/feature-flags.md.orig
+  - make update_feature_flags_docs
+  - |
+    diff docs/configuration/feature-flags.md.orig docs/configuration/feature-flags.md || (
+      echo
+      echo "Feature Flags list in documentation is not up-to-date"
+      echo "Run 'make update_feature_flags_docs' to update it"
+      echo
+      exit 1
+    )
+
+docs:check development docs Go version:
+  extends:
+  - .rules:merge_request_pipelines
+  - .no_cache_and_dependencies
+  stage: qa
+  script:
+    - export GO_VERSION=$(cat .gitlab/ci/_common.gitlab-ci.yml | yq '.variables.GO_VERSION')
+    - export EXIT_CODE=0
+    - grep $GO_VERSION docs/development/_index.md || EXIT_CODE=$?
+    - if [ $EXIT_CODE -ne 0 ]; then echo "Make sure to update all Go versions in docs/development/_index.md to $GO_VERSION"; exit 1; fi
+
+docs:check Kubernetes API docs:
+  extends:
+  - .rules:merge_request_pipelines
+  - .no_cache_and_dependencies
+  stage: qa
+  script:
+    - cp docs/executors/kubernetes/_index.md docs/executors/kubernetes/_index.md.orig
+    - mage k8s:generatePermissionsDocs
+    - |
+        diff docs/executors/kubernetes/_index.md.orig docs/executors/kubernetes/_index.md || (
+          echo
+          echo "Kubernetes API list in documentation is not up-to-date"
+          echo "Run 'mage k8s:generatePermissionsDocs' to update it"
+          echo
+          exit 1
+        )
+
+# This jobs is triggered weekly and needs the PACKAGECLOUD_TOKEN variable scope to the autogen/docs environment to run.
+docs:check supported distros package docs:
+  rules:
+    - if: $CI_PIPELINE_SOURCE == "schedule" && $CI_COMMIT_BRANCH == $CI_DEFAULT_BRANCH && $CI_PROJECT_PATH == "gitlab-org/gitlab-runner"
+  stage: qa
+  environment:
+    name: autogen/docs
+    url: https://packages.gitlab.com/runner/gitlab-runner
+  script:
+    - cp docs/install/linux-repository.md docs/install/linux-repository.md.orig
+    - mage package:docs
+    - |
+      diff docs/install/linux-repository.md.orig docs/install/linux-repository.md || (
+        echo
+        echo "Supported distributions documentation is not up-to-date"
+        echo "Run 'mage package:docs' to update it"
+        echo
+        exit 1
+      )
+
+docs:check Hugo build:
+  image: ${CI_DEPENDENCY_PROXY_DIRECT_GROUP_IMAGE_PREFIX}/hugomods/hugo:exts-0.142.0
+  extends:
+  - .rules:merge_request_pipelines
+  - .no_cache_and_dependencies
+  stage: qa
+  before_script:
+    - apk add --no-cache git make nodejs npm bash
+    - git clone --depth 1 https://gitlab.com/gitlab-org/technical-writing/docs-gitlab-com.git
+    - cd docs-gitlab-com
+    - make add-latest-icons
+    # Copy the current project's docs to the appropriate location in the docs website
+    - mkdir content/runner
+    - cp -r ../docs/* content/runner/
+  script:
+    # Test that Hugo will build
+    - hugo --gc --printPathWarnings --panicOnWarning
+    # Test for invalid index pages
+    # See https://gitlab.com/gitlab-org/technical-writing/docs-gitlab-com/-/blob/main/scripts/check-index-filenames.sh
+    - make check-index-pages SEARCH_DIR="../docs"

.gitlab/ci/release.gitlab-ci.yml

+# S3 Releases
+#############
+
+.release_s3:
+  stage: release
+  dependencies:
+  - 'prebuilt helper images'
+  - 'binaries'
+  - 'package-deb'
+  - 'package-rpm'
+  - 'package-helpers'
+  before_script:
+  - ./ci/touch_git
+  - |
+    # checking GPG signing support
+    if [ -f "$GPG_KEY_PATH" ]; then
+      export GPG_KEY=$(cat ${GPG_KEY_PATH})
+      export GPG_PASSPHRASE=$(cat ${GPG_PASSPHRASE_PATH})
+    else
+      echo -e "\033[0;31m****** GPG signing disabled ******\033[0m"
+    fi
+  script:
+  - make release_s3
+  tags:
+  - !reference [.instance-medium]
+
+.release_packagecloud:
+  stage: release
+  dependencies:
+  - 'package-deb'
+  - 'package-rpm'
+  - 'package-helpers'
+  before_script:
+  - ./ci/touch_git
+  script:
+  - mage packagecloud:push deb "$CI_JOB_NAME" "$DIST_FLAVOR"
+  - mage packagecloud:push rpm "$CI_JOB_NAME" "$DIST_FLAVOR"
+
+.release_artifacts:
+  artifacts:
+    paths:
+      - out/release_artifacts/*
+
+development S3:
+  extends:
+  - .release_s3
+  - .rules:runner-only:release:development:merge-requests
+  environment:
+    name: development/s3/${CI_COMMIT_REF_NAME}
+    url: https://gitlab-runner-downloads.s3.amazonaws.com/${CI_COMMIT_REF_NAME}/index.html
+
+bleeding edge S3:
+  extends:
+  - .release_s3
+  - .rules:release:bleeding-edge
+  environment:
+    name: bleeding_edge/s3
+    url: https://gitlab-runner-downloads.s3.amazonaws.com/${CI_COMMIT_REF_NAME}/index.html
+
+stable S3:
+  extends:
+  - .release_s3
+  - .rules:release:stable:branch
+  environment:
+    name: stable/s3
+    url: https://gitlab-runner-downloads.s3.amazonaws.com/${CI_COMMIT_REF_NAME}/index.html
+
+bleeding edge packagecloud:
+  extends:
+  - .release_packagecloud
+  - .rules:release:bleeding-edge
+  environment:
+    name: bleeding_edge/packagecloud
+    url: https://packages.gitlab.com/runner/unstable
+  variables:
+    PACKAGE_CLOUD_NAMESPACE: runner/unstable
+  parallel:
+    matrix:
+    - DIST_FLAVOR:
+      - debian
+      - ubuntu
+      - el
+      - fedora
+      - amazon
+      - sles
+      - opensuse
+
+stable packagecloud:
+  extends:
+  - .release_packagecloud
+  - .rules:release:stable:branch
+  environment:
+    name: stable/packagecloud
+    url: https://packages.gitlab.com/runner/gitlab-runner
+  parallel:
+    matrix:
+    - DIST_FLAVOR:
+      - debian
+      - ubuntu
+      - raspbian
+      - linuxmint
+      - el
+      - ol
+      - fedora
+      - amazon
+      - sles
+      - opensuse
+
+# Image Registry Releases
+#########################
+
+development docker images:
+  stage: release
+  extends:
+  - .docker
+  - .go-cache
+  - .rules:release:development:merge-requests
+  dependencies:
+  - 'helper images'
+  - 'runner images'
+  artifacts:
+    paths:
+      - out/release_artifacts/*
+  script:
+    - echo "${CI_REGISTRY_PASSWORD}" | docker login --username "${CI_REGISTRY_USER}" --password-stdin "${CI_REGISTRY}"
+    - (cd scripts/pusher && go build)
+    - tags=$(make print_image_tags)
+    # dev gitlab registry images
+    - (cd scripts/pusher && ./pusher runner-images.json "${CI_REGISTRY_IMAGE}/gitlab-runner-dev" $tags)
+    - (cd scripts/pusher && ./pusher helper-images.json "${CI_REGISTRY_IMAGE}/gitlab-runner-helper-dev" $tags)
+
+bleeding edge docker images:
+  stage: release
+  extends:
+  - .docker
+  - .go-cache
+  - .rules:release:bleeding-edge
+  environment:
+    name: bleeding_edge/docker_images/linux
+    url: https://hub.docker.com/r/gitlab/gitlab-runner/tags/
+  dependencies:
+  - 'helper images'
+  - 'runner images'
+  artifacts:
+    paths:
+      - out/release_artifacts/*
+  script:
+    - echo "${CI_REGISTRY_PASSWORD}" | docker login --username "${CI_REGISTRY_USER}" --password-stdin "${CI_REGISTRY}"
+    - echo "${DOCKER_HUB_PASSWORD}" | docker login --username "${DOCKER_HUB_USER}" --password-stdin "registry.hub.docker.com/gitlab"
+    - (cd scripts/pusher && go build)
+    - tags=$(make print_image_tags)
+    # bleeding gitlab registry images
+    - (cd scripts/pusher && ./pusher runner-images.json "${CI_REGISTRY_IMAGE}" $tags)
+    - (cd scripts/pusher && ./pusher helper-images.json "${CI_REGISTRY_IMAGE}/gitlab-runner-helper" $tags)
+    # bleeding docker hub registry images
+    - (cd scripts/pusher && ./pusher runner-images.json "registry.hub.docker.com/gitlab/gitlab-runner" $tags)
+    - (cd scripts/pusher && ./pusher helper-images.json "registry.hub.docker.com/gitlab/gitlab-runner-helper" $tags)
+
+stable docker images:
+  stage: release
+  variables:
+    # Setting the CI_PROJECT_ID and CI_REGISTRY_IMAGE variable explicitly because we're
+    # running this job also from the https://gitlab.com/gitlab-org/security/gitlab-runner
+    # fork. But it should still create the release entry in the canonical one.
+    CI_REGISTRY: registry.gitlab.com
+    CI_REGISTRY_IMAGE: registry.gitlab.com/gitlab-org/gitlab-runner
+  extends:
+  - .docker
+  - .go-cache
+  - .rules:release:stable:branch
+  environment:
+    name: stable/docker_images/linux
+    url: https://hub.docker.com/r/gitlab/gitlab-runner/tags/
+  dependencies:
+  - 'helper images'
+  - 'runner images'
+  artifacts:
+    paths:
+      - out/release_artifacts/*
+  script:
+    - echo "${CI_REGISTRY_PASSWORD}" | docker login --username "${CI_REGISTRY_USER}" --password-stdin "${CI_REGISTRY}"
+    - echo "${DOCKER_HUB_PASSWORD}" | docker login --username "${DOCKER_HUB_USER}" --password-stdin "registry.hub.docker.com/gitlab"
+    - aws --region us-east-1 ecr-public get-login-password | docker login --username "AWS" --password-stdin "public.ecr.aws/gitlab"
+    - (cd scripts/pusher && go build)
+    - tags=$(make print_image_tags)
+    # stable gitlab registry images
+    - (cd scripts/pusher && ./pusher runner-images.json "${CI_REGISTRY_IMAGE}" $tags)
+    - (cd scripts/pusher && ./pusher helper-images.json "${CI_REGISTRY_IMAGE}/gitlab-runner-helper" $tags)
+    # stable docker hub registry images
+    - (cd scripts/pusher && ./pusher runner-images.json "registry.hub.docker.com/gitlab/gitlab-runner" $tags)
+    - (cd scripts/pusher && ./pusher helper-images.json "registry.hub.docker.com/gitlab/gitlab-runner-helper" $tags)
+    # stable aws registry images
+    - (cd scripts/pusher && ./pusher runner-images.json "public.ecr.aws/gitlab/gitlab-runner" $tags)
+    - (cd scripts/pusher && ./pusher helper-images.json "public.ecr.aws/gitlab/gitlab-runner-helper" $tags)