From 9f323ad040095717d9d6708a66cd6ae745aca741 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Petr=20=C5=A0pa=C4=8Dek?= <pspacek@isc.org>
Date: Tue, 10 Mar 2026 18:01:16 +0100
Subject: [PATCH 1/3] Generate token for early Git access in
 prepare-package-notification

---
 .gitlab-ci.yml | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/.gitlab-ci.yml b/.gitlab-ci.yml
index 2ffb46e163..dc1bc57efd 100644
--- a/.gitlab-ci.yml
+++ b/.gitlab-ci.yml
@@ -2050,6 +2050,11 @@ prepare-preannouncement:
 
 prepare-package-notification:
   <<: *printing_press_job
+  before_script:
+    - *git_clone_bind9-qa
+    # produce distros_git_url.txt to be immediately read by printing_press_mr.py
+    - >
+      "$CI_PROJECT_DIR"/bind9-qa/releng/manage_distros_token.py create
   variables:
     DOCUMENT: packager-notification
   rules:

From 98cbde5233c788936f8aeb6231c65db74d9f7fbc Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Petr=20=C5=A0pa=C4=8Dek?= <pspacek@isc.org>
Date: Tue, 10 Mar 2026 18:04:51 +0100
Subject: [PATCH 2/3] Delete early access token when code is published

Technically this is not necessary because the token expires in one week
after creation, and new code would have got there only one week before
the next public release, but better be safe than sorry.

Catch is, after_script gets executed even if a job fails or is
canceled. Delete distros token only if publication succeeded.
---
 .gitlab-ci.yml | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/.gitlab-ci.yml b/.gitlab-ci.yml
index dc1bc57efd..43c3c82f02 100644
--- a/.gitlab-ci.yml
+++ b/.gitlab-ci.yml
@@ -1947,6 +1947,8 @@ publish:
   variables:
     SSH_SCRIPT_CLIENT: |-
       ssh "${STAGING_USER_ACTIONS}@${STAGING_HOST}" "publish ${CI_COMMIT_TAG}"
+  after_script:
+    - if [ "${CI_JOB_STATUS}" = "success" ]; then "$CI_PROJECT_DIR"/bind9-qa/releng/manage_distros_token.py delete; fi
   artifacts:
     paths:
       - publish-${CI_COMMIT_TAG}.log

From 50e18f6720b385f3adf9992e348e966a7f322539 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Micha=C5=82=20K=C4=99pie=C5=84?= <michal@isc.org>
Date: Thu, 12 Mar 2026 12:27:36 +0100
Subject: [PATCH 3/3] Fix a typo in job name

As hinted upon by the comment preceding it, the job preparing packager
notifications was (rather unsurprisingly) supposed to be called
"prepare-packager-notification".  Fix the typo in its name.
---
 .gitlab-ci.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.gitlab-ci.yml b/.gitlab-ci.yml
index 43c3c82f02..c731808714 100644
--- a/.gitlab-ci.yml
+++ b/.gitlab-ci.yml
@@ -2050,7 +2050,7 @@ prepare-preannouncement:
 
 # Job preparing a packager notification MR in Printing Press
 
-prepare-package-notification:
+prepare-packager-notification:
   <<: *printing_press_job
   before_script:
     - *git_clone_bind9-qa