From 293c4810fe6e007736dc06df029c0049f42b8e14 Mon Sep 17 00:00:00 2001
From: Jonathan Klee <jonathan.klee@e.email>
Date: Wed, 11 Mar 2026 18:01:29 +0100
Subject: [PATCH 1/2] ci: introduce ai-review

---
 .gitlab-ci.yml | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/.gitlab-ci.yml b/.gitlab-ci.yml
index 21075797c..912b19f85 100644
--- a/.gitlab-ci.yml
+++ b/.gitlab-ci.yml
@@ -12,12 +12,16 @@ variables:
 stages:
   - auto-merge-main
   - build
+  - ai-review
   - publish
 
 include:
   - project: "e/templates"
     ref: main
     file: "/.gitlab/gitlab-ci/gitlab-ci-auto-merge-main.yml"
+  - project: "e/os/ai-review"
+    ref: main
+    file: ".gitlab-ci.yml"
 
 auto_merge_main:
   extends: .auto-merge-main
-- 
GitLab


From 98b87bf7646cd23e830a1f879b5e842d6ed07259 Mon Sep 17 00:00:00 2001
From: Jonathan Klee <jonathan.klee@e.email>
Date: Thu, 12 Mar 2026 08:33:41 +0100
Subject: [PATCH 2/2] ci: restrict automatic release jobs to protected refs

---
 .gitlab-ci.yml | 13 ++++++++++---
 1 file changed, 10 insertions(+), 3 deletions(-)

diff --git a/.gitlab-ci.yml b/.gitlab-ci.yml
index 912b19f85..f7ee8111b 100644
--- a/.gitlab-ci.yml
+++ b/.gitlab-ci.yml
@@ -35,15 +35,21 @@ before_script:
 
 .rules_merge_request_ref:
   rules: &rules_merge_request_ref
-    - if: "$CI_COMMIT_BRANCH && $CI_OPEN_MERGE_REQUESTS"
+    - if: '$CI_PIPELINE_SOURCE == "push" && $CI_COMMIT_BRANCH && $CI_OPEN_MERGE_REQUESTS'
       when: never
     - when: always
 
 .rules_protected_ref:
   rules: &rules_protected_ref
+    - if: '$CI_PIPELINE_SOURCE == "push" && $CI_COMMIT_BRANCH && $CI_OPEN_MERGE_REQUESTS'
+      when: never
     - if: '$CI_COMMIT_REF_PROTECTED == "true"'
       when: always
-    - if: "$CI_COMMIT_BRANCH && $CI_OPEN_MERGE_REQUESTS"
+    - when: manual
+
+.rules_manual_ref:
+  rules: &rules_manual_ref
+    - if: '$CI_PIPELINE_SOURCE == "push" && $CI_COMMIT_BRANCH && $CI_OPEN_MERGE_REQUESTS'
       when: never
     - when: manual
 
@@ -87,6 +93,7 @@ before_script:
 
 build-release:
   extends: .build
+  rules: *rules_protected_ref
   allow_failure: false
   cache:
     key: ${CI_PROJECT_ID}
@@ -125,7 +132,7 @@ build-debug:
 
 generate-apks:
   stage: build
-  rules: *rules_protected_ref
+  rules: *rules_manual_ref
   allow_failure: true
   needs:
     - job: build-release
-- 
GitLab