From: Andoni Duarte Pintado <andoni@isc.org>
Date: Mon, 9 Mar 2026 16:30:09 +0000 (+0100)
Subject: Add rule for the stable tags in CI and use for job update-stable-tag
X-Git-Url: http://git.ipfire.org/gitweb/index.cgi?a=commitdiff_plain;h=e4ccf36de65e272eca579426f549cfc2b93402dd;p=thirdparty%2Fbind9.git

Add rule for the stable tags in CI and use for job update-stable-tag

The update-stable-tag job should only be run for the stable tag, which
is used by Read the Docs to build the docs for the "stable" version.

A new rule called rule_tag_open_source_stable is introduced, in order to
prevent the job from appearing in the pipeline for non-stable versions.
Having this rule in YAML is necessary, because if it were in the script
itself, the job would show up in the pipeline.

Besides, the new rule allows other jobs to be run only for the stable
tag in the future, without modifying their internal logic.

The CI variable STABLE_VERSION contains a regular expression in
Gitlab CI sense[1]: it uses the RE2 syntax[2] and must be enclosed by
slashes (i.e. /.../). It must be updated every time the minor version
is changed: releasing v9.22 will require changing STABLE_VERSION from
"/v9.20/" to "/v9.22/".

The variable is imported from common Gitlab CI YAML in the project
isc-projects/bind9-qa, so as to maintain it in a central place.

[1]: https://docs.gitlab.com/ci/jobs/job_rules/#compare-a-variable-to-a-regular-expression
[2]: https://github.com/google/re2/wiki/Syntax

(cherry picked from commit 38e80f542e93dc7baa2558e856a10e0c521e112c)
---

diff --git a/.gitlab-ci.yml b/.gitlab-ci.yml
index a51b88ddc09..fcd4049a146 100644
--- a/.gitlab-ci.yml
+++ b/.gitlab-ci.yml
@@ -330,6 +330,9 @@ stages:
 .rule_tag_open_source: &rule_tag_open_source
   - if: '$CI_PROJECT_NAMESPACE == "isc-private" && $CI_COMMIT_TAG != null && $CI_COMMIT_TAG !~ /-S/'
 
+.rule_tag_open_source_stable: &rule_tag_open_source_stable
+  - if: '$CI_PROJECT_NAMESPACE == "isc-private" && $CI_COMMIT_TAG != null && $CI_COMMIT_TAG =~ $STABLE_VERSION_REGEX'
+
 .rule_tag_open_source_maintenance: &rule_tag_open_source_maintenance
   - if: '$CI_PROJECT_NAMESPACE == "isc-private" && $CI_COMMIT_TAG != null && $CI_COMMIT_TAG !~ /-S/ && $RELEASE_TYPE != "security"'
 
@@ -2463,7 +2466,7 @@ update-stable-tag:
     - >
       "$CI_PROJECT_DIR"/bind9-qa/releng/update_stable_tag.py --tag "$CI_COMMIT_TAG"
   rules:
-    - *rule_tag_open_source
+    - *rule_tag_open_source_stable
   artifacts:
     paths:
       - bind9/