implement a new tag system for all veloren runners, including

- project tag:
   - `veloren/veloren`: for the veloren repo only
   - `veloren/*`: for projects thats are in the veloren namespace, e.g. usefull for smaller projects that dont have their own tag
   - `*/*` for projects by 3rd parties, e.g. personal projects
 - trusted tag:
   - `owned`:  The runner is hosted on veloren hardware
   - `trusted`: The runner is hosted by a private person, trusted by the veloren devs
   - NONE: if no special trust is given in a runner
 - check/build tag:
   - `check`: a job only performs a check and NO executable is build for users
   - `build`: the job contains atleast 1 executable that can be run by users
   - NONE: neither a check nor a executable is build, e.g. usefull for pages or meta jobs
 - publish tag:
   - `publish`: this job produces a artifact that is automatically pushed to users
   - NONE: no artifact is pushed automatically to users
 - pin tags:
   - `benchmark`: pin a runner to a specific job for the cause of benchmarks
   - `veloren/*:macos`: runs on a native macos runner ONLY, this needs to be a modified project tag, as otherwise also normal checks would run on this runner.
   - NONE: no runner is pinned

.gitlab-ci.yml

@@ -25,7 +25,7 @@ default:
       - runner_system_failure
       - stuck_or_timeout_failure
   tags:
-    - veloren-build
+    - veloren/veloren
 
 # NOTE: overriden for the `.tmacos` template so relevant changes need to be mirrored there
 before_script:

.gitlab/CI/build.gitlab-ci.yml

@@ -2,8 +2,7 @@ unittests:
   extends: .recompile-branch
   stage: build
   image: registry.gitlab.com/veloren/veloren-docker-ci/cache/quality:${CACHE_IMAGE_TAG}
-  tags:
-    - veloren-build
+  tags: ["veloren/veloren", "check"]
   variables:
     GIT_DEPTH: 9999999999999
   script:
@@ -17,6 +16,7 @@ translation:
   extends: .release
   stage: build
   image: registry.gitlab.com/veloren/veloren-docker-ci/cache/quality:${CACHE_IMAGE_TAG}
+  tags: ["veloren/veloren", "check"]
   script:
     - ln -s /dockercache/target target
     - cat ./.gitlab/scripts/translation.sh
@@ -36,8 +36,7 @@ benchmarks:
   extends: .release
   stage: build
   image: registry.gitlab.com/veloren/veloren-docker-ci/cache/bench:${CACHE_IMAGE_TAG}
-  tags:
-    - veloren-benchmark
+  tags: ["veloren/veloren", "check", "benchmark"]
   script:
     - unset DISABLE_GIT_LFS_CHECK
     - ln -s /dockercache/target target
@@ -60,8 +59,7 @@ coverage:
   extends: .release
   stage: build
   image: registry.gitlab.com/veloren/veloren-docker-ci/cache/tarpaulin:${CACHE_IMAGE_TAG}
-  tags:
-    - veloren-build
+  tags: ["veloren/veloren", "check"]
   script:
     - ln -s /dockercache/target target
     - cat ./.gitlab/scripts/coverage.sh
@@ -150,54 +148,57 @@ linux:
   extends:
     - .tlinux
     - .release
+  tags: ["veloren/veloren", "build", "publish", "trusted"]
 
 windows:
   extends:
     - .twindows
     - .release
+  tags: ["veloren/veloren", "build", "publish", "trusted"]
 
 macos:
   extends:
     - .tmacos
     - .release
     - .tmacos-master-cache
+  tags: ["veloren/veloren:macos", "build", "publish", "trusted"]
 
 # build on schedule quickfix till airshipper 0.5
 air-linux:
   extends:
     - .tlinux
     - .release-nightly-tmp-fix-airshipper
-  tags:
-    - veloren-publish
+  tags: ["veloren/veloren", "build", "publish", "trusted"]
 
 air-windows:
   extends:
     - .twindows
     - .release-nightly-tmp-fix-airshipper
-  tags:
-    - veloren-publish
+  tags: ["veloren/veloren", "build", "publish", "trusted"]
 
 air-macos:
   extends:
     - .tmacos
     - .release-nightly-tmp-fix-airshipper
     - .tmacos-master-cache
-  tags:
-    - veloren-publish
+  tags: ["veloren/veloren:macos", "build", "publish", "trusted"]
 
 # if NOT release or master, allow optional builds
 opt-linux:
   extends:
     - .tlinux
     - .optional-release
+  tags: ["veloren/veloren", "build"]
 
 opt-windows:
   extends:
     - .twindows
     - .optional-release
+  tags: ["veloren/veloren", "build"]
 
 opt-macos:
   extends:
     - .tmacos
     - .optional-release
     - .tmacos-mr-cache
+  tags: ["veloren/veloren:macos", "build"]

.gitlab/CI/check.gitlab-ci.yml

@@ -3,8 +3,7 @@ code-quality:
   extends: .recompile-branch
   stage: check
   image: registry.gitlab.com/veloren/veloren-docker-ci/cache/quality:${CACHE_IMAGE_TAG}
-  tags:
-    - veloren-build
+  tags: ["veloren/veloren", "check"]
   script:
     - ln -s /dockercache/target target
     - cat ./.gitlab/scripts/code-quality.sh
@@ -14,8 +13,7 @@ security:
   extends: .recompile-branch
   stage: check
   image: registry.gitlab.com/veloren/veloren-docker-ci/cache/quality:${CACHE_IMAGE_TAG}
-  tags:
-    - veloren-build
+  tags: ["veloren/veloren", "check"]
   allow_failure: true
   script:
     - ln -s /dockercache/target target

.gitlab/CI/publish.gitlab-ci.yml

@@ -19,6 +19,7 @@ docker:
   image:
     name: gcr.io/kaniko-project/executor:debug
     entrypoint: [""]
+  tags: ["veloren/veloren", "publish", "trusted"]
   dependencies:
     - linux
   before_script:
@@ -35,8 +36,7 @@ docker-nightly:
   image:
     name: gcr.io/kaniko-project/executor:debug
     entrypoint: [""]
-  tags:
-    - veloren-publish
+  tags: ["veloren/veloren", "publish", "trusted"]
   dependencies:
     - air-linux
   before_script:
@@ -51,8 +51,7 @@ docker-nightly:
 tag-nightly:
   extends: .publish-nightly
   image: registry.gitlab.com/veloren/veloren-docker-ci/cache/quality:${CACHE_IMAGE_TAG}
-  tags:
-    - veloren-benchmark
+  tags: ["veloren/veloren", "publish", "trusted"]
   script:
     - git config --global user.email "gitlab-veloren-bot@veloren.net"
     - git config --global user.name "veloren-bot"
@@ -64,6 +63,7 @@ tag-nightly:
 pages:
   extends: .publish
   image: registry.gitlab.com/veloren/veloren-docker-ci/cache/quality:${CACHE_IMAGE_TAG}
+  tags: ["veloren/veloren", "publish"]
   artifacts:
     paths:
       - public