From: Nicki Křížek <nicki@isc.org>
Date: Tue, 25 Mar 2025 15:51:24 +0000 (+0100)
Subject: Allow pushing branches and tags to customer git repos
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=abf98ace18e8e49050e38077cb681449e51d3b3e;p=thirdparty%2Fbind9.git

Allow pushing branches and tags to customer git repos

For pipelines in the private repository, add an optional manual job,
which allows the current branch to be pushed into the specified
customer's git repository. This can be useful to provide patch previews
for early testing.

For tags created in a private repository, add a manual job which pushes
the created tag to all entitled customers.

(cherry picked from commit 378b412e94a40ee74ab5c9edfb3a2059612a59ff)
---

diff --git a/.gitlab-ci.yml b/.gitlab-ci.yml
index 945f5d774db..14aa850a49a 100644
--- a/.gitlab-ci.yml
+++ b/.gitlab-ci.yml
@@ -700,6 +700,47 @@ release:
       - "*.tar.gz"
     expire_in: "1 day"
 
+.customer-git: &customer_git
+  <<: *base_image
+  stage: release
+  when: manual
+  variables:  # ensure clean git environment and sufficient history
+    GIT_STRATEGY: clone
+    GIT_DEPTH: 1000
+
+# To trigger this job and push a branch to a customer, you must set the
+# CUSTOMER job variable by clicking on the manual job (not the play button) and
+# set it to the name of the target customer.
+customer-git:branch:
+  <<: *customer_git
+  needs: []
+  rules:
+    - if: '$CI_PROJECT_NAMESPACE == "isc-private" && $CI_PIPELINE_SOURCE == "merge_request_event"'
+      variables:
+        BRANCH: '$CI_MERGE_REQUEST_SOURCE_BRANCH_NAME'
+    - if: '$CI_PROJECT_NAMESPACE == "isc-private" && $CI_PIPELINE_SOURCE =~ /^(api|pipeline|trigger|web)$/'
+      variables:
+        BRANCH: '$CI_COMMIT_BRANCH'
+  before_script:
+    - test -n "$CUSTOMER"
+    - git clone --depth 1 https://gitlab.isc.org/isc-projects/bind9-qa.git
+  script:
+    - git checkout -b "$BRANCH"  # ensure refs/heads/$BRANCH exists; GitLab clones with detached HEAD
+    - bind9-qa/releng/push_to_customer_repository.py --branch "$BRANCH" --customer "$CUSTOMER" --force
+
+customer-git:tag:
+  <<: *customer_git
+  needs:
+    - job: release
+      artifacts: false
+  rules:
+    - if: '$CI_PROJECT_NAMESPACE == "isc-private" && $CI_COMMIT_TAG != null'
+  before_script:
+    - git clone --depth 1 https://gitlab.isc.org/isc-projects/bind9-qa.git
+    - git clone --depth 1 "https://token:${ISC_CUSTOMERS_WRITE_TOKEN}@gitlab.isc.org/isc-customers/isc-customer-settings.git"
+  script:
+    - bind9-qa/releng/push_to_customer_repository.py --tag "$CI_COMMIT_TAG" --entitlements isc-customer-settings/entitlements.yaml --force
+
 # Coverity Scan analysis upload
 
 .coverity_cache_prep: &coverity_cache_prep