ci: Fix missing pipelines on user pipelines in MRs

Oops. We were being a bit too extensive with our rules and also skipping
the container stage for user (non-marge) pipelines in MRs unless
image-tags.yml had changed. We can't actually do this, because we might
still need to run the jobs to copy the containers into the user's
namespace, even if we don't need to rebuild them.

Signed-off-by: Daniel Stone <daniels@collabora.com>
Part-of: <https://gitlab.freedesktop.org/mesa/mesa/-/merge_requests/35491>

.gitlab-ci.yml

@@ -55,6 +55,11 @@ workflow:
     - if: &is-merge-request $CI_PIPELINE_SOURCE == "merge_request_event"
     # Push to a branch on a fork
     - if: &is-push-to-fork $CI_PROJECT_NAMESPACE != "mesa" && $CI_PIPELINE_SOURCE == "push"
+    # a pipeline running within the upstream project
+    - if: &is-upstream-pipeline $CI_PROJECT_PATH == $FDO_UPSTREAM_REPO
+    # an MR pipeline running within the upstream project, usually true for
+    # those with the Developer role or above
+    - if: &is-upstream-mr-pipeline $CI_PROJECT_PATH == $FDO_UPSTREAM_REPO && $CI_PIPELINE_SOURCE == "merge_request_event"
     # Nightly pipeline
     - if: &is-scheduled-pipeline $CI_PIPELINE_SOURCE == "schedule"
       variables:
@@ -245,16 +250,25 @@ include:
       changes: &image_tags_path
         - .gitlab-ci/image-tags.yml
       when: on_success
-    # Same as above, but for pre-merge pipelines
+    # Skip everything for pre-merge and merge pipelines which don't change
+    # anything in the build; we only do this for marge-bot and not user
+    # pipelines in a MR, because we might still need to run it to copy the
+    # container into the user's namespace.
+    - if: *is-merge-attempt
+      when: never
+    # Any MR pipeline which changes image-tags.yml needs to be able to
+    # rebuild the containers
     - if: *is-merge-request
       changes: *image_tags_path
       when: manual
-    # Skip everything for pre-merge and merge pipelines which don't change
+    # ... if the MR pipeline runs as mesa/mesa and does not need a container
-    # anything in the build
+    # rebuild, we can skip it
-    - if: *is-merge-attempt
+    - if: *is-upstream-mr-pipeline
       when: never
+    # ... however for MRs running inside the user namespace, we may need to
+    # run these jobs to copy the container images from upstream
     - if: *is-merge-request
-      when: never
+      when: manual
     # Build everything after someone bypassed the CI
     - if: *is-push-to-upstream-default-branch
       when: on_success
@@ -264,6 +278,9 @@ include:
     # Scheduled pipelines reuse already-built containers
     - if: *is-scheduled-pipeline
       when: never
+    # Any other pipeline in the upstream should reuse already-built containers
+    - if: *is-upstream-pipeline
+      when: never
     # Allow building everything in fork pipelines, but build nothing unless
     # manually triggered
     - when: manual