Migrate Container-Scanning CI template to rules syntax

See https://gitlab.com/gitlab-org/gitlab/-/issues/36541

changelogs/unreleased/e2300-cs-template.yml

+---
+title: Migrate Container-Scanning template to rules syntax
+merge_request: 30775
+author:
+type: changed

ee/spec/lib/gitlab/ci/templates/container_scanning_gitlab_ci_yaml_spec.rb

+# frozen_string_literal: true
+
+require 'spec_helper'
+
+describe 'Container-Scanning.gitlab-ci.yml' do
+  subject(:template) { Gitlab::Template::GitlabCiYmlTemplate.find('Container-Scanning') }
+
+  describe 'the created pipeline' do
+    let(:user) { create(:admin) }
+    let(:default_branch) { 'master' }
+    let(:project) { create(:project, :custom_repo, files: { 'README.txt' => '' }) }
+    let(:service) { Ci::CreatePipelineService.new(project, user, ref: 'master' ) }
+    let(:pipeline) { service.execute!(:push) }
+    let(:build_names) { pipeline.builds.pluck(:name) }
+
+    before do
+      stub_ci_pipeline_yaml_file(template.content)
+      allow_any_instance_of(Ci::BuildScheduleWorker).to receive(:perform).and_return(true)
+      allow(project).to receive(:default_branch).and_return(default_branch)
+    end
+
+    context 'when project has no license' do
+      it 'includes no jobs' do
+        expect { pipeline }.to raise_error(Ci::CreatePipelineService::CreateError)
+      end
+    end
+
+    context 'when project has Ultimate license' do
+      let(:license) { create(:license, plan: License::ULTIMATE_PLAN) }
+
+      before do
+        allow(License).to receive(:current).and_return(license)
+      end
+
+      context 'by default' do
+        it 'includes job' do
+          expect(build_names).to match_array(%w[container_scanning])
+        end
+      end
+
+      context 'when CONTAINER_SCANNING_DISABLED=1' do
+        before do
+          create(:ci_variable, project: project, key: 'CONTAINER_SCANNING_DISABLED', value: '1')
+        end
+
+        it 'includes no jobs' do
+          expect { pipeline }.to raise_error(Ci::CreatePipelineService::CreateError)
+        end
+      end
+    end
+  end
+end

lib/gitlab/ci/templates/Security/Container-Scanning.gitlab-ci.yml

@@ -25,11 +25,8 @@ container_scanning:
     reports:
       container_scanning: gl-container-scanning-report.json
   dependencies: []
-  only:
-    refs:
-      - branches
-    variables:
-      - $GITLAB_FEATURES =~ /\bcontainer_scanning\b/
-  except:
-    variables:
-      - $CONTAINER_SCANNING_DISABLED
+  rules:
+    - if: $CONTAINER_SCANNING_DISABLED
+      when: never
+    - if: $CI_COMMIT_BRANCH &&
+          $GITLAB_FEATURES =~ /\bcontainer_scanning\b/