ci: Drop optimization to run tests with code changes only

We have recently started an experiment where we changed our tests jobs
to only run in case there are some actual code changes. This change has
proven to be very fragile as we had many contexts now where we didn't
run any test jobs despite some code changes.

The original intent of this change was to skip running tests when we
know that there were only documentation changes. Our CI rules don't have
such a condition though, which means that we are forced to express the
opposite rule that there were only code changes. This has the downside
though that we now fail open (that is we err on the side of running too
few CI jobs) instead of failing closed (which would be to rather run too
many CI jobs). This is not a good failure mode though as it is now quite
easy for us to miss test failures introduced by a merge request.

Drop the optimization again and always run tests, regardless of which
files have changed.

1 files changed, 12 insertions, 33 deletions

diff --git a/.gitlab-ci.yml b/.gitlab-ci.yml
index c045d280d..9b629ee79 100644
--- a/.gitlab-ci.yml
+++ b/.gitlab-ci.yml
@@ -138,31 +138,11 @@ workflow:
     when: always
     expire_in: 1 week
 
-.only_code_changes: &only_code_changes
-  changes:
-    - "**.go"
-    - "**.proto"
-    - "**.sql"
-    - "{,**/}go.{mod,sum}"
-    - Makefile
-    - .gitlab-ci.yml
-
 .rules_run_always: &rules_run_always
     - if: $CI_MERGE_REQUEST_IID
     - if: $CI_COMMIT_BRANCH == $CI_DEFAULT_BRANCH
     - if: '$CI_COMMIT_BRANCH =~ /^[\d-]+-stable$/'
 
-.rules_run_on_code_change: &rules_run_on_code_change
-    - if: $CI_MERGE_REQUEST_IID
-      <<: *only_code_changes
-    - if: $CI_COMMIT_BRANCH == $CI_DEFAULT_BRANCH
-      <<: *only_code_changes
-    - if: '$CI_COMMIT_BRANCH =~ /^[\d-]+-stable$/'
-      <<: *only_code_changes
-    - if: $CI_PIPELINE_SOURCE == "merge_request_event"
-      when: manual
-      allow_failure: true
-
 .rules_run_on_merge: &rules_run_on_merge
     # We only execute these rules in the main Gitaly repository. This is
     # because jobs which run conditionally when being merged may depend on
@@ -208,8 +188,8 @@ build:
       - GO_VERSION: [ "1.20" ]
         TEST_BOOT_ARGS: "--bundled-git"
       - GIT_VERSION: "v2.41.0"
-  only:
-    <<: *only_code_changes
+  rules:
+    - *rules_run_always
 
 build:binaries:
   needs: []
@@ -217,8 +197,6 @@ build:binaries:
   cache:
     - *cache_deps_configuration
     - *cache_go_configuration
-  only:
-    - tags
   script:
     # Just in case we start running CI builds on other architectures in future
     - go version
@@ -233,8 +211,9 @@ build:binaries:
   parallel:
     matrix:
       - GO_VERSION: [ "1.20" ]
-  only:
-    <<: *only_code_changes
+  rules:
+    - *rules_run_always
+    - if: $CI_COMMIT_TAG
 
 test:
   <<: *test_definition
@@ -256,7 +235,7 @@ test:
       - POSTGRES_VERSION: "11-alpine"
         TEST_TARGET: [ test, test-with-praefect ]
   rules:
-    - *rules_run_on_code_change
+    - *rules_run_always
 
 test:pgbouncer:
   <<: *test_definition
@@ -287,7 +266,7 @@ test:pgbouncer:
     # can reach Postgres.
     TEST_TARGET: "test-with-praefect"
   rules:
-    - *rules_run_on_code_change
+    - *rules_run_always
 
 test:nightly:
   <<: *test_definition
@@ -311,7 +290,7 @@ test:praefect_smoke:
     - ./_build/bin/praefect -config config.praefect.toml sql-ping
     - ./_build/bin/praefect -config config.praefect.toml sql-migrate
   rules:
-    - *rules_run_on_code_change
+    - *rules_run_always
 
 
 test:sha256:
@@ -321,7 +300,7 @@ test:sha256:
       - TEST_TARGET: [ test, test-with-praefect ]
         TEST_WITH_SHA256: "YesPlease"
   rules:
-    - *rules_run_on_code_change
+    - *rules_run_always
 
 
 test:fips:
@@ -428,7 +407,7 @@ verify:
       - proto/go/gitalypb/*
     when: on_failure
   rules:
-    - *rules_run_on_code_change
+    - *rules_run_always
 
 dbschema:
   needs: []
@@ -449,7 +428,7 @@ dbschema:
       - _support/praefect-schema.sql
     when: on_failure
   rules:
-    - *rules_run_on_code_change
+    - *rules_run_always
 
 semgrep-sast:
   needs: []
@@ -459,7 +438,7 @@ semgrep-sast:
   rules:
     - if: $SAST_DISABLED
       when: never
-    - *rules_run_on_code_change
+    - *rules_run_always
 
 license_scanning:
   needs: []