gitlab-ci: refactor to rules: and ditch old only: syntax

Adding workflow: is required, otherwise there would be duplicate
pipelines for all users in the @fdroid group.  There would be "branch
pipelines" and "merge request pipelines".  Confusingly, only jobs with
rules: get duplicated.

.gitlab-ci.yml

@@ -1,5 +1,16 @@
 ---
 
+# Use merge request pipelines when a merge request is open for the branch.
+# Use branch pipelines when a merge request is not open for the branch.
+# https://docs.gitlab.com/ci/yaml/workflow/#switch-between-branch-pipelines-and-merge-request-pipelines
+workflow:
+  rules:
+    - if: $CI_PIPELINE_SOURCE == 'merge_request_event'
+    - if: $CI_COMMIT_BRANCH && $CI_OPEN_MERGE_REQUESTS
+      when: never
+    - if: $CI_COMMIT_BRANCH
+
+
 variables:
   pip: pip3 --timeout 100 --retries 10
   # speed up git checkout phase
@@ -94,8 +105,8 @@ metadata_v0:
 debian_testing:
   image: debian:testing
   <<: *apt-template
-  only:
-    - master@fdroid/fdroidserver
+  rules:
+    - if: $CI_COMMIT_BRANCH == "master" && $CI_PROJECT_PATH == "fdroid/fdroidserver"
   script:
     - apt-get install
         aapt
@@ -123,8 +134,8 @@ debian_testing:
 ubuntu_lts_ppa:
   image: ubuntu:latest
   <<: *apt-template
-  only:
-    - master@fdroid/fdroidserver
+  rules:
+    - if: $CI_COMMIT_BRANCH == "master" && $CI_PROJECT_PATH == "fdroid/fdroidserver"
   script:
     - export ANDROID_HOME=/usr/lib/android-sdk
     - apt-get install gnupg
@@ -188,11 +199,11 @@ ubuntu_jammy_pip:
 gradlew-fdroid:
   image: debian:bookworm-slim
   <<: *apt-template
-  only:
-    changes:
-      - .gitlab-ci.yml
-      - gradlew-fdroid
-      - tests/test_gradlew-fdroid
+  rules:
+    - changes:
+        - .gitlab-ci.yml
+        - gradlew-fdroid
+        - tests/test_gradlew-fdroid
   script:
     - apt-get install ca-certificates curl default-jdk-headless shellcheck unzip
     - shellcheck --severity=error --color gradlew-fdroid tests/test_gradlew-fdroid
@@ -255,10 +266,7 @@ lint_format_bandit_checks:
 safety:
   image: debian:bookworm-slim
   rules:
-    # once only:/changes: are ported to rules:, this could be removed:
-    - if: $CI_PIPELINE_SOURCE == "merge_request_event"
-      when: never
-    - if: $CI_PIPELINE_SOURCE == "push" && $SAFETY_API_KEY
+    - if: $SAFETY_API_KEY
       changes:
         - .gitlab-ci.yml
         - .safety-policy.yml
@@ -283,11 +291,7 @@ safety:
 yamllint:
   image: debian:bookworm-slim
   rules:
-    # once only:/changes: are ported to rules:, this could be removed:
-    - if: $CI_PIPELINE_SOURCE == "merge_request_event"
-      when: never
-    - if: $CI_PIPELINE_SOURCE == "push"
-      changes:
+    - changes:
         - .gitlab-ci.yml
         - .safety-policy.yml
         - .yamllint
@@ -308,7 +312,6 @@ yamllint:
         tests/*/*/.*.yml
 
 
-# Run all the various linters and static analysis tools.
 locales:
   image: debian:bookworm-slim
   variables:
@@ -380,8 +383,8 @@ fedora_latest:
 macOS:
   tags:
     - saas-macos-medium-m1
-  only:
-    - master@fdroid/fdroidserver
+  rules:
+    - if: $CI_COMMIT_BRANCH == "master" && $CI_PROJECT_PATH == "fdroid/fdroidserver"
   script:
     - export HOMEBREW_CURL_RETRIES=10
     - brew update > /dev/null
@@ -446,16 +449,16 @@ gradle:
 # Run an actual build in a simple, faked version of the buildserver guest VM.
 fdroid build:
   image: registry.gitlab.com/fdroid/fdroidserver:buildserver
-  only:
-    changes:
-      - .gitlab-ci.yml
-      - fdroidserver/build.py
-      - fdroidserver/common.py
-      - fdroidserver/exception.py
-      - fdroidserver/metadata.py
-      - fdroidserver/net.py
-      - fdroidserver/scanner.py
-      - fdroidserver/vmtools.py
+  rules:
+    - changes:
+        - .gitlab-ci.yml
+        - fdroidserver/build.py
+        - fdroidserver/common.py
+        - fdroidserver/exception.py
+        - fdroidserver/metadata.py
+        - fdroidserver/net.py
+        - fdroidserver/scanner.py
+        - fdroidserver/vmtools.py
   cache:
     key: "$CI_JOB_NAME"
     paths:
@@ -516,11 +519,11 @@ fdroid build:
 plugin_fetchsrclibs:
   image: debian:bookworm-slim
   <<: *apt-template
-  only:
-    changes:
-      - .gitlab-ci.yml
-      - examples/fdroid_fetchsrclibs.py
-      - fdroidserver/__main__.py
+  rules:
+    - changes:
+        - .gitlab-ci.yml
+        - examples/fdroid_fetchsrclibs.py
+        - fdroidserver/__main__.py
   script:
     - apt-get install
         curl
@@ -560,8 +563,8 @@ plugin_fetchsrclibs:
 servergitmirrors:
   image: debian:bookworm-slim
   <<: *apt-template
-  only:
-    - master@fdroid/fdroidserver
+  rules:
+    - if: $CI_COMMIT_BRANCH == "master" && $CI_PROJECT_PATH == "fdroid/fdroidserver"
   script:
     - apt-get install
         default-jdk-headless
@@ -622,8 +625,8 @@ Build documentation:
 Windows:
   tags:
     - windows
-  only:
-    - windows
+  rules:
+    - if: $CI_COMMIT_BRANCH == "windows"
   script:
     - Import-Module "$env:ChocolateyInstall\helpers\chocolateyProfile.psm1"
     - choco install --no-progress -y git --force --params "/GitAndUnixToolsOnPath"
@@ -686,13 +689,12 @@ pages:
 docker:
   dependencies:
     - fdroid build
-  only:
-    changes:
-      - .gitlab-ci.yml
-      - makebuildserver
-      - buildserver/*
-    variables:
-      - $CI_COMMIT_BRANCH == "master" || $CI_PROJECT_NAMESPACE != "fdroid"
+  rules:
+    - if: $CI_COMMIT_BRANCH == "master" && $CI_PROJECT_PATH == "fdroid/fdroidserver"
+      changes:
+        - .gitlab-ci.yml
+        - makebuildserver
+        - buildserver/*
   image: docker:dind
   services:
     - docker:dind