fix up CI to run in 3rd party MR pipelines

.gitlab-ci.yml

@@ -15,6 +15,8 @@ lint:
     - go mod tidy
     - diff --color=always go.mod "${CI_PROJECT_DIR}/go.mod"
     - diff --color=always go.sum "${CI_PROJECT_DIR}/go.sum"
+  rules:
+    - when: on_success
 
 .build:
   stage: build
@@ -63,9 +65,18 @@ lint:
       - "*.deb"
       - "*.1"
     expire_in: 1 month
+  rules:
+    - if: '$CI_PROJECT_NAMESPACE == "signald" && $CI_COMMIT_REF_PROTECTED == "true"'
+      when: on_success
+    - when: manual
+      allow_failure: true
 
 build:x86:
   extends: .build
+  rules:
+    - when: on_success
+  rules:
+    - when: on_success
 
 build:aarch64:
   tags: [arm-builder]
@@ -101,11 +112,16 @@ build:cross-compile:
           - amd64
       - GOOS: darwin
         GOARCH: amd64
+  rules:
+    - when: on_success
+
 
 build:x86:deb:
   extends: .build-deb
   before_script:
   - "sed -i 's/^Architecture:.*/Architecture: amd64/g' debian/control"
+  rules:
+    - when: on_success
 
 build:aarch64:deb:
   extends: .build-deb
@@ -137,10 +153,17 @@ publish deb:
   only:
     - main
     - tags
+  rules:
+    - if: '$CI_PROJECT_NAMESPACE == "signald" && $CI_COMMIT_REF_PROTECTED == "true"'
+      when: on_success
+    - when: manual
+      allow_failure: true
+
 
 signald.org:
   stage: publish
   needs: ["build:x86"]
   trigger: signald/signald.org
-  only:
+  rules:
-    - main
+    - if: '$CI_PROJECT_NAMESPACE == "signald" && $CI_COMMIT_REF_PROTECTED == "true"'
+      when: on_success