From 8a0e2dfe974678a1d9cba6cd2f536e53ea4728a4 Mon Sep 17 00:00:00 2001
From: =?utf8?q?Micha=C5=82=20K=C4=99pie=C5=84?= <michal@isc.org>
Date: Mon, 27 Oct 2025 05:15:09 +0100
Subject: [PATCH] Deduplicate triggering rules for tag pipeline jobs

Define and use more YAML anchors for triggering rules commonly used by
tag pipeline jobs.  This builds on top of the work done in commit
675d9c74251fee8ec034e87bdd43e7da97119a5d, improving readability and
reuse.

(cherry picked from commit 0734ec2a68b4a97f9e080096dfd679d5584a265d)
---
 .gitlab-ci.yml | 16 +++++++++++-----
 1 file changed, 11 insertions(+), 5 deletions(-)

diff --git a/.gitlab-ci.yml b/.gitlab-ci.yml
index 737a3ea43ad..8b77cf85b08 100644
--- a/.gitlab-ci.yml
+++ b/.gitlab-ci.yml
@@ -278,6 +278,12 @@ stages:
 .rule_tag: &rule_tag
   - if: '$CI_PROJECT_NAMESPACE == "isc-private" && $CI_COMMIT_TAG != null'
 
+.rule_tag_open_source: &rule_tag_open_source
+  - if: '$CI_PROJECT_NAMESPACE == "isc-private" && $CI_COMMIT_TAG != null && $CI_COMMIT_TAG !~ /-S/'
+
+.rule_tag_security_or_subscription: &rule_tag_security_or_subscription
+  - if: '$CI_PROJECT_NAMESPACE == "isc-private" && $CI_COMMIT_TAG != null && ($RELEASE_TYPE == "security" || $CI_COMMIT_TAG =~ /-S/)'
+
 .rule_source_other_than_mr: &rule_source_other_than_mr
   - if: '$CI_PIPELINE_SOURCE =~ /^(api|pipeline|schedule|trigger|web)$/ && $REBASE_ONLY != "1"'
 
@@ -1665,7 +1671,7 @@ staging:
     - job: sign
       artifacts: true
   rules:
-    - if: '$CI_COMMIT_TAG != null'
+    - *rule_tag
 
 # Job copying a staged release to a secret location
 
@@ -1685,7 +1691,7 @@ publish-private:
     - job: staging
       artifacts: false
   rules:
-    - if: '$CI_COMMIT_TAG != null && ($CI_COMMIT_TAG =~ /-S/ || $RELEASE_TYPE == "security")'
+    - *rule_tag_security_or_subscription
 
 # Job copying a staged release to a well-known location
 
@@ -1702,7 +1708,7 @@ publish:
     - job: staging
       artifacts: false
   rules:
-    - if: '$CI_COMMIT_TAG != null && $CI_COMMIT_TAG !~ /-S/'
+    - *rule_tag_open_source
 
 # Job creating the release announcement MR in Printing Press
 
@@ -1718,7 +1724,7 @@ prepare-release-announcement:
     - bind9-qa/releng/prepare_release_announcement.py --metadata bind9-qa/releng/metadata.json
   needs: []
   rules:
-    - if: '$CI_COMMIT_TAG != null && $CI_COMMIT_TAG !~ /-S/'
+    - *rule_tag_open_source
   artifacts:
     paths:
       - printing-press/
@@ -1738,7 +1744,7 @@ merge-tag:
     - bind9-qa/releng/merge_tag.py --tag "$CI_COMMIT_TAG"
   needs: []
   rules:
-    - if: '$CI_COMMIT_TAG != null && $CI_COMMIT_TAG !~ /-S/'
+    - *rule_tag_open_source
   artifacts:
     paths:
       - bind9/
-- 
2.47.3