diff --git a/.pre-commit-config.yaml b/.pre-commit-config.yaml
index 4badf4ceeba996c80b83b3e0cd893461033c483b..c8ea4c9f500828bcdf806d0c8bca3b2997c042e2 100644
--- a/.pre-commit-config.yaml
+++ b/.pre-commit-config.yaml
@@ -7,12 +7,12 @@ repos:
       - id: isort
         args: [--settings-path, "pyproject.toml"]
   - repo: https://github.com/psf/black
-    rev: 22.3.0
+    rev: 22.10.0
     hooks:
       - id: black
         exclude: bob/devtools/templates/setup.py
   - repo: https://gitlab.com/pycqa/flake8
-    rev: 4.0.1
+    rev: 3.9.2
     hooks:
       - id: flake8
         exclude: |
@@ -21,7 +21,7 @@ repos:
                   deps/bob-devel/run_test.py
               )$
   - repo: https://github.com/pre-commit/pre-commit-hooks
-    rev: v4.1.0
+    rev: v4.3.0
     hooks:
       - id: check-ast
         exclude: bob/devtools/templates/setup.py
@@ -33,4 +33,5 @@ repos:
       - id: check-added-large-files
         exclude: bob/devtools/templates/setup.py
       - id: check-yaml
+        args: ['--unsafe']
         exclude: .*/meta.*.yaml
diff --git a/bob/devtools/data/gitlab-ci/docs.yaml b/bob/devtools/data/gitlab-ci/docs.yaml
index acfe2f792447f8cea5c429d0129dfb8103ce39a8..ade9700e623f307e98be92bd7206eac425aedcff 100644
--- a/bob/devtools/data/gitlab-ci/docs.yaml
+++ b/bob/devtools/data/gitlab-ci/docs.yaml
@@ -29,8 +29,8 @@ stages:
     - python3 bootstrap.py -vv channel base
     - source ${CONDA_ROOT}/etc/profile.d/conda.sh
     - conda activate base
-    - if [[ $CI_RUNNER_TAGS == *"docker,"* ]]; then git config --global --add safe.directory ${CI_PROJECT_DIR}; fi
     - conda clean --all
+    - git config --global --add safe.directory ${CI_PROJECT_DIR}
   cache:
     paths:
       - .cache/torch
diff --git a/bob/devtools/data/gitlab-ci/nightlies.yaml b/bob/devtools/data/gitlab-ci/nightlies.yaml
index 68fbf97d461b3c4694ef80e5cba4de3137c77881..49681f2f53f58b5f372413613f1cdc27785eeb3f 100644
--- a/bob/devtools/data/gitlab-ci/nightlies.yaml
+++ b/bob/devtools/data/gitlab-ci/nightlies.yaml
@@ -21,7 +21,6 @@ stages:
     - curl --silent "${BOOTSTRAP}" --output "bootstrap.py"
     - python3 bootstrap.py -vv channel base
     - source ${CONDA_ROOT}/etc/profile.d/conda.sh
-    - if [[ $CI_RUNNER_TAGS == *"docker,"* ]]; then git config --global --add safe.directory ${CI_PROJECT_DIR}; fi
     - conda activate base
     - conda clean --all
   cache:
@@ -48,6 +47,19 @@ stages:
   variables:
     # The version of cuda at Idiap
     CONDA_OVERRIDE_CUDA: "11.6"
+  before_script:
+    - !reference [.bootstrap, before_script]
+    - git config --global --add safe.directory ${CI_PROJECT_DIR}
+    - bdt ci check -vv
+
+.build_macos_template:
+  extends: .build_template
+  tags:
+    - bob
+    - macos
+  before_script:
+    - !reference [.bootstrap, before_script]
+    - bdt ci check -vv
 
 build_linux_39:
   extends: .build_linux_template
@@ -64,50 +76,45 @@ build_linux_310:
     key: 'build-py310'
 
 build_macos_intel_39:
-  extends: .build_template
+  extends: .build_macos_template
   variables:
     PYTHON_VERSION: "3.9"
   tags:
-    - bob
-    - macos
+    - !reference [.build_macos_template, tags]
     - intel
   cache:
     key: 'build-py39'
 
 build_macos_intel_310:
-  extends: .build_template
+  extends: .build_macos_template
   variables:
     PYTHON_VERSION: "3.10"
   tags:
-    - bob
-    - macos
+    - !reference [.build_macos_template, tags]
     - intel
   cache:
     key: 'build-py310'
 
 build_macos_arm_39:
-  extends: .build_template
+  extends: .build_macos_template
   variables:
     PYTHON_VERSION: "3.9"
   tags:
-    - bob
-    - macos
+    - !reference [.build_macos_template, tags]
     - arm
   cache:
     key: 'build-py39'
 
 build_macos_arm_310:
-  extends: .build_template
+  extends: .build_macos_template
   variables:
     PYTHON_VERSION: "3.10"
   tags:
-    - bob
-    - macos
+    - !reference [.build_macos_template, tags]
     - arm
   cache:
     key: 'build-py310'
 
-
 # Periodic cleanup of beta packages
 .cleanup_template:
   extends: .bootstrap
diff --git a/bob/devtools/data/gitlab-ci/noarch.yaml b/bob/devtools/data/gitlab-ci/noarch.yaml
index 75641c5f21535b66aa548e8470fa21a703d8b473..3edaa22ff6e123fee2279bdeb0cf42b47c0b5ed6 100644
--- a/bob/devtools/data/gitlab-ci/noarch.yaml
+++ b/bob/devtools/data/gitlab-ci/noarch.yaml
@@ -23,10 +23,7 @@ stages:
     - curl --silent "${BOOTSTRAP}" --output "bootstrap.py"
     - python3 bootstrap.py -vv channel base
     - source ${CONDA_ROOT}/etc/profile.d/conda.sh
-    # for conda inspect during builds (on macos)
-    - if [[ $CI_RUNNER_TAGS == *"docker,"* ]]; then git config --global --add safe.directory ${CI_PROJECT_DIR}; fi
     - conda activate base
-    - bdt ci check -vv
     - conda clean --all
   cache:
     paths:
@@ -59,6 +56,10 @@ build_linux:
   variables:
     PYTHON_VERSION: "3.10"
     BUILD_EGG: "true"
+  before_script:
+    - !reference [.bootstrap, before_script]
+    - git config --global --add safe.directory ${CI_PROJECT_DIR}
+    - bdt ci check -vv
   script:
     - bdt ci build -vv
     - bdt ci readme -vv dist/*.zip
@@ -83,6 +84,9 @@ build_macos_intel:
     - bob
     - macos
     - intel
+  before_script:
+    - !reference [.bootstrap, before_script]
+    - bdt ci check -vv
 
 
 build_macos_arm:
@@ -95,6 +99,9 @@ build_macos_arm:
     - bob
     - macos
     - arm
+  before_script:
+    - !reference [.bootstrap, before_script]
+    - bdt ci check -vv
 
 
 # Test targets (not normally used)
diff --git a/bob/devtools/data/gitlab-ci/python-package.yaml b/bob/devtools/data/gitlab-ci/python-package.yaml
index e1bae1dfc3955edf8526fb2b7c86e6316e4826d9..4fba94e2f9eaac1f7725f71c04fe2411b1ff1855 100644
--- a/bob/devtools/data/gitlab-ci/python-package.yaml
+++ b/bob/devtools/data/gitlab-ci/python-package.yaml
@@ -26,7 +26,7 @@ build:
     - docker
   stage: build
   before_script:
-    - if [[ $CI_RUNNER_TAGS == *"docker,"* ]]; then git config --global --add safe.directory ${CI_PROJECT_DIR}; fi
+    - git config --global --add safe.directory ${CI_PROJECT_DIR}
     - pip install twine pre-commit sphinx sphinx-rtd-theme
   script:
     - "[ -r .pre-commit-config.yaml ] && pre-commit run --all-files --show-diff-on-failure --verbose"
diff --git a/bob/devtools/data/gitlab-ci/single-package.yaml b/bob/devtools/data/gitlab-ci/single-package.yaml
index 75f5db26fa55ad8171d88f2f2eb88b528f9d9b34..d05d1bb2167489415d501d01a42d880b6eb7a5fe 100644
--- a/bob/devtools/data/gitlab-ci/single-package.yaml
+++ b/bob/devtools/data/gitlab-ci/single-package.yaml
@@ -23,10 +23,7 @@ stages:
     - curl --silent "${BOOTSTRAP}" --output "bootstrap.py"
     - python3 bootstrap.py -vv channel base
     - source ${CONDA_ROOT}/etc/profile.d/conda.sh
-    # for conda inspect during builds (on macos)
     - conda activate base
-    - if [[ $CI_RUNNER_TAGS == *"docker,"* ]]; then git config --global --add safe.directory ${CI_PROJECT_DIR}; fi
-    - bdt ci check -vv
     - conda clean --all
   cache:
     paths:
@@ -61,6 +58,10 @@ stages:
   # make sure we use the same image as conda-forge:
   # https://github.com/conda-forge/conda-forge-pinning-feedstock/blob/main/recipe/conda_build_config.yaml
   image: quay.io/condaforge/linux-anvil-cos7-x86_64
+  before_script:
+    - !reference [.bootstrap, before_script]
+    - git config --global --add safe.directory ${CI_PROJECT_DIR}
+    - bdt ci check -vv
   artifacts:
     paths:
       - ${CONDA_ROOT}/conda-bld/linux-64/*.conda
@@ -76,6 +77,9 @@ stages:
     - bob
     - macos
     - intel
+  before_script:
+    - !reference [.bootstrap, before_script]
+    - bdt ci check -vv
   artifacts:
     paths:
       - ${CONDA_ROOT}/conda-bld/osx-64/*.conda
@@ -88,6 +92,9 @@ stages:
     - bob
     - macos
     - arm
+  before_script:
+    - !reference [.bootstrap, before_script]
+    - bdt ci check -vv
   artifacts:
     paths:
       - ${CONDA_ROOT}/conda-bld/osx-arm64/*.conda