What are 'rules' in GitLab CI/CD and how do they control when jobs run?

deploy-prod:
  stage: deploy
  script:
    - ./deploy.sh production
  rules:
    - if: $CI_COMMIT_BRANCH == "main"     # only run on main branch
      when: on_success                     # (default) run if prior stages passed
    - if: $CI_PIPELINE_SOURCE == "schedule"
      when: on_success
    - when: never                          # never run for any other condition

# Common rules patterns:
job-on-mr:
  rules:
    - if: $CI_PIPELINE_SOURCE == "merge_request_event"

job-on-tag:
  rules:
    - if: $CI_COMMIT_TAG                   # runs when a git tag is pushed

job-manual-on-prod:
  rules:
    - if: $CI_COMMIT_BRANCH == "main"
      when: manual                         # must be manually triggered in UI

job-with-changes:
  rules:
    - changes:                             # only run if these files changed
        - src/**/*
        - package.json

job-allow-fail:
  rules:
    - if: $CI_COMMIT_BRANCH == "main"
      allow_failure: true                  # pipeline passes even if this fails