ci: cram: gate arming builds on component selection

An automatic CRAM job waits for a manual build only when that build is
non-optional and not allowed to fail. Leaving the manual build default
in place would skip the downstream job initially and could run it after
a failed build.

Override rules on the six builds consumed by automatic CRAM jobs. Make
a build blocking exactly when its board's automatic job is armed, using
the same changes anchors and label policy. Keep variable and skip
stand-down paths manual and non-blocking.

GitLab gives a manual job selected through rules the real default of
allow_failure: false. Scope the explicit non-blocking fallback to merge
request pipelines so non-arming MRs do not block, while push, web, API,
and branch pipelines retain their existing implicit blocking form.

Preserve schedule, designated-branch, and release-tag behavior. Leave
the x86_64 and extender builds unchanged.

Assisted-by: codex:gpt-5.6-sol
References: CI-9
Signed-off-by: Petr Štetiar <petr.stetiar@prplfoundation.org>

.gitlab-ci.yml

@@ -136,24 +136,144 @@ stages:
 
 build test mxl_x86_osp_tb341_v2 mxl_wlan_hostap_ng_wav700 prpl cellular security thread:
   extends: .build test config
+  rules:
+    - if: '$CI_PIPELINE_SOURCE == "schedule"'
+      when: never
+    - if: '$CI_COMMIT_BRANCH == $CI_DESIGNATED_BRANCH'
+    - if: '$CI_COMMIT_TAG =~ /^prplware-v[0-9]+\.[0-9]+\.[0-9]+.*$/'
+    - if: '$CI_PIPELINE_SOURCE == "merge_request_event" && $CRAM_COMPONENTS != null'
+      when: manual
+      allow_failure: true
+    - if: '$CI_PIPELINE_SOURCE == "merge_request_event" && $CI_MERGE_REQUEST_LABELS =~ /(^|,)cram::skip($|,)/'
+      when: manual
+      allow_failure: true
+    - if: '$CI_PIPELINE_SOURCE == "merge_request_event" && $CI_MERGE_REQUEST_LABELS =~ /(^|,)cram::(full|prplmesh|lcm|prplos)($|,)/'
+      when: manual
+      allow_failure: false
+    - if: '$CI_PIPELINE_SOURCE == "merge_request_event"'
+      changes: *cram_changes_mxl25641_hdk_6
+      when: manual
+      allow_failure: false
+    - if: '$CI_PIPELINE_SOURCE == "merge_request_event"'
+      when: manual
+      allow_failure: true
+    - when: manual
 
 build test mvebu prpl security:
   extends: .build test config
+  rules:
+    - if: '$CI_PIPELINE_SOURCE == "schedule"'
+      when: never
+    - if: '$CI_COMMIT_BRANCH == $CI_DESIGNATED_BRANCH'
+    - if: '$CI_COMMIT_TAG =~ /^prplware-v[0-9]+\.[0-9]+\.[0-9]+.*$/'
+    - if: '$CI_PIPELINE_SOURCE == "merge_request_event" && $CRAM_COMPONENTS != null'
+      when: manual
+      allow_failure: true
+    - if: '$CI_PIPELINE_SOURCE == "merge_request_event" && $CI_MERGE_REQUEST_LABELS =~ /(^|,)cram::skip($|,)/'
+      when: manual
+      allow_failure: true
+    - if: '$CI_PIPELINE_SOURCE == "merge_request_event"'
+      changes: *cram_changes_turris_omnia
+      when: manual
+      allow_failure: false
+    - if: '$CI_PIPELINE_SOURCE == "merge_request_event"'
+      when: manual
+      allow_failure: true
+    - when: manual
 
 build test x86_64 prpl security:
   extends: .build test config
 
 build test ipq807x prpl security:
   extends: .build test config
+  rules:
+    - if: '$CI_PIPELINE_SOURCE == "schedule"'
+      when: never
+    - if: '$CI_COMMIT_BRANCH == $CI_DESIGNATED_BRANCH'
+    - if: '$CI_COMMIT_TAG =~ /^prplware-v[0-9]+\.[0-9]+\.[0-9]+.*$/'
+    - if: '$CI_PIPELINE_SOURCE == "merge_request_event" && $CRAM_COMPONENTS != null'
+      when: manual
+      allow_failure: true
+    - if: '$CI_PIPELINE_SOURCE == "merge_request_event" && $CI_MERGE_REQUEST_LABELS =~ /(^|,)cram::skip($|,)/'
+      when: manual
+      allow_failure: true
+    - if: '$CI_PIPELINE_SOURCE == "merge_request_event"'
+      changes: *cram_changes_prpl_haze
+      when: manual
+      allow_failure: false
+    - if: '$CI_PIPELINE_SOURCE == "merge_request_event"'
+      when: manual
+      allow_failure: true
+    - when: manual
 
 build test mtk_filogic prpl security:
   extends: .build test config
+  rules:
+    - if: '$CI_PIPELINE_SOURCE == "schedule"'
+      when: never
+    - if: '$CI_COMMIT_BRANCH == $CI_DESIGNATED_BRANCH'
+    - if: '$CI_COMMIT_TAG =~ /^prplware-v[0-9]+\.[0-9]+\.[0-9]+.*$/'
+    - if: '$CI_PIPELINE_SOURCE == "merge_request_event" && $CRAM_COMPONENTS != null'
+      when: manual
+      allow_failure: true
+    - if: '$CI_PIPELINE_SOURCE == "merge_request_event" && $CI_MERGE_REQUEST_LABELS =~ /(^|,)cram::skip($|,)/'
+      when: manual
+      allow_failure: true
+    - if: '$CI_PIPELINE_SOURCE == "merge_request_event"'
+      changes: *cram_changes_arcadyan_mozart
+      when: manual
+      allow_failure: false
+    - if: '$CI_PIPELINE_SOURCE == "merge_request_event"'
+      when: manual
+      allow_failure: true
+    - when: manual
 
 build test airoha_an7581 prpl security:
   extends: .build test config
+  rules:
+    - if: '$CI_PIPELINE_SOURCE == "schedule"'
+      when: never
+    - if: '$CI_COMMIT_BRANCH == $CI_DESIGNATED_BRANCH'
+    - if: '$CI_COMMIT_TAG =~ /^prplware-v[0-9]+\.[0-9]+\.[0-9]+.*$/'
+    - if: '$CI_PIPELINE_SOURCE == "merge_request_event" && $CRAM_COMPONENTS != null'
+      when: manual
+      allow_failure: true
+    - if: '$CI_PIPELINE_SOURCE == "merge_request_event" && $CI_MERGE_REQUEST_LABELS =~ /(^|,)cram::skip($|,)/'
+      when: manual
+      allow_failure: true
+    - if: '$CI_PIPELINE_SOURCE == "merge_request_event"'
+      changes: *cram_changes_nokia_valyrian
+      when: manual
+      allow_failure: false
+    - if: '$CI_PIPELINE_SOURCE == "merge_request_event"'
+      when: manual
+      allow_failure: true
+    - when: manual
 
 build test qca_ipq95xx prpl cellular security thread:
   extends: .build test config
+  rules:
+    - if: '$CI_PIPELINE_SOURCE == "schedule"'
+      when: never
+    - if: '$CI_COMMIT_BRANCH == $CI_DESIGNATED_BRANCH'
+    - if: '$CI_COMMIT_TAG =~ /^prplware-v[0-9]+\.[0-9]+\.[0-9]+.*$/'
+    - if: '$CI_PIPELINE_SOURCE == "merge_request_event" && $CRAM_COMPONENTS != null'
+      when: manual
+      allow_failure: true
+    - if: '$CI_PIPELINE_SOURCE == "merge_request_event" && $CI_MERGE_REQUEST_LABELS =~ /(^|,)cram::skip($|,)/'
+      when: manual
+      allow_failure: true
+    - if: '$CI_PIPELINE_SOURCE == "merge_request_event" && $CI_MERGE_REQUEST_LABELS =~ /(^|,)cram::(full|prplmesh|lcm|prplos)($|,)/'
+      when: manual
+      allow_failure: false
+    - if: '$CI_PIPELINE_SOURCE == "merge_request_event"'
+      changes: *cram_changes_wnc_freedom
+      when: manual
+      allow_failure: false
+    - if: '$CI_PIPELINE_SOURCE == "merge_request_event"'
+      when: manual
+      allow_failure: true
+    - when: manual
 
 build test qca_ipq95xx extender_minimal cellular security thread:
   extends: .build test config

.gitlab/tests/cram/README.md

@@ -157,6 +157,31 @@ it reserves no hardware. The `lint cram component manifest` job and the four
 named component jobs also remain manual and non-gating. Play a named component
 job directly when an explicit bucket is more useful than the computed result.
 
+### Build consent and job states
+
+Automatic selection never starts a build. Playing a board's manual build is
+the consent action; after a successful build, an armed `[auto]` job starts
+without another click. Cross-cutting changes arm only Freedom and OSPv2, while
+a board-specific change can arm its owning non-priority board.
+
+The dependency on the manual build affects the state GitLab displays:
+
+- `created` means `[auto]` is armed and waiting for a required, blocking build.
+- `manual` means the job is directly playable now, as with named component
+  jobs or an `[auto]` job whose manual fallback is available after its build.
+- `skipped` can mean **skipped until the build runs**: a dormant `[auto]` job
+  whose required build is still an unplayed, non-blocking manual job is shown
+  as skipped rather than manual/created. Playing and completing that build
+  makes the downstream job available; the selection was not deleted.
+
+The last state also covers the creation-time `cram::skip` scenario: the label
+makes both the build and `[auto]` fallback non-blocking, so GitLab displays the
+downstream job as `skipped`. If `cram::skip` is added only after pipeline
+creation, the runtime label check exits an already-armed job green before
+labgrid reservation. Other empty results (`nothing-mapped` and the guarded
+coarse/runtime drift case) also log their reason and exit before any DUT
+interaction; resolver or malformed-matrix errors remain failures.
+
 To start named component jobs automatically, set the pipeline-level
 `CRAM_COMPONENTS`
 variable to a comma-separated list containing one or more of `full`,
@@ -172,6 +197,15 @@ CRAM_COMPONENTS=lcm,prplos
 CRAM_COMPONENTS=full
 ```
 
+### Kill switches
+
+Use the narrowest suitable control:
+
+1. Add `cram::skip` to disable automatic selection for one MR.
+2. Run one pipeline with `CRAM_COMPONENTS=none`.
+3. Set the project CI variable `CRAM_COMPONENTS=none` for a global stand-down.
+4. Revert the CI wiring commit for the hard rollback.
+
 Release tag pipelines (`prplware-v*`) start the `full` jobs automatically;
 the other buckets stay manual there. Scheduled pipelines never create cram
 jobs, because they also never create the build jobs these jobs need. The job