test reference

pipelines/compliance.yml

@@ -14,7 +14,7 @@ version:
   extends: .version
   stage: .pre
   rules:
-    - if: $CI_COMMIT_BRANCH == $CI_DEFAULT_BRANCH || $CI_COMMIT_BRANCH =~ '/^release/'
+    - !reference [.default_rules, rules]
 
 secret_detection:
   stage: validate
@@ -27,6 +27,4 @@ sonarqube:
   stage: validate
   allow_failure: true
   rules:
-    - if: $CI_COMMIT_BRANCH == $CI_DEFAULT_BRANCH || $CI_COMMIT_BRANCH =~ '/^release/' || $CI_MERGE_REQUEST_IID
-      exists:
-        - "sonar-project.properties"  
+    - !reference [.sonarqube_rules, rules]

pipelines/docker-build.yml

@@ -31,6 +31,6 @@ docker-push:
     - job: version
       artifacts: true        
   rules:
-    - if: $CI_COMMIT_BRANCH == $CI_DEFAULT_BRANCH || $CI_COMMIT_BRANCH =~ '/^release/'
+    - if: $CI_PIPELINE_SOURCE == $CI_DEFAULT_BRANCH || $CI_COMMIT_BRANCH =~ '/^release/'
       exists:
         - "Dockerfile"  

pipelines/security.yml

@@ -15,7 +15,7 @@ generate_sbom:
       optional: true
       artifacts: true
   rules:
-    - if: $CI_COMMIT_BRANCH == $CI_DEFAULT_BRANCH || $CI_COMMIT_BRANCH =~ '/^release/' || $CI_MERGE_REQUEST_IID
+    - !reference [.default_rules, mr-rules]
 
 generate_cve:
   extends: .generate_cve
@@ -24,4 +24,4 @@ generate_cve:
     - job: generate_sbom
       artifacts: true
   rules:
-    - if: $CI_COMMIT_BRANCH == $CI_DEFAULT_BRANCH || $CI_COMMIT_BRANCH =~ '/^release/' || $CI_MERGE_REQUEST_IID
+    - !reference [.default_rules, mr-rules]

rules/mr-rules.yml

@@ -0,0 +1,3 @@
+.default_rules:
+  rules:
+    - if: $CI_COMMIT_BRANCH == $CI_DEFAULT_BRANCH || $CI_COMMIT_BRANCH =~ '/^release/' || $CI_MERGE_REQUEST_IID

rules/rules.yml

@@ -0,0 +1,9 @@
+.default_rules:
+  rules:
+    - if: $CI_COMMIT_BRANCH == $CI_DEFAULT_BRANCH || $CI_COMMIT_BRANCH =~ '/^release/'
+
+.sonarqube_rules:
+  rules:
+    - if: $CI_COMMIT_BRANCH == $CI_DEFAULT_BRANCH || $CI_COMMIT_BRANCH =~ '/^release/'
+      exists:
+        - "sonar-project.properties"