From a8bdbdfb90bef8de79d9aae98428f286920601d1 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Petr=20=C5=A0pa=C4=8Dek?= <pspacek@isc.org>
Date: Tue, 10 Mar 2026 18:01:16 +0100
Subject: [PATCH 1/3] Generate token for early Git access in
 prepare-package-notification

(cherry picked from commit 9f323ad040095717d9d6708a66cd6ae745aca741)
---
 .gitlab-ci.yml | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/.gitlab-ci.yml b/.gitlab-ci.yml
index bb4d52b0d6..ce902251c0 100644
--- a/.gitlab-ci.yml
+++ b/.gitlab-ci.yml
@@ -2130,6 +2130,11 @@ prepare-preannouncement:
 
 prepare-package-notification:
   <<: *printing_press_job
+  before_script:
+    - *git_clone_bind9-qa
+    # produce distros_git_url.txt to be immediately read by printing_press_mr.py
+    - >
+      "$CI_PROJECT_DIR"/bind9-qa/releng/manage_distros_token.py create
   variables:
     DOCUMENT: packager-notification
   rules:

From 984e03098c23cf1934c7eae6b3bd6da147f74d99 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Petr=20=C5=A0pa=C4=8Dek?= <pspacek@isc.org>
Date: Tue, 10 Mar 2026 18:04:51 +0100
Subject: [PATCH 2/3] Delete early access token when code is published

Technically this is not necessary because the token expires in one week
after creation, and new code would have got there only one week before
the next public release, but better be safe than sorry.

Catch is, after_script gets executed even if a job fails or is
canceled. Delete distros token only if publication succeeded.

(cherry picked from commit 98cbde5233c788936f8aeb6231c65db74d9f7fbc)
---
 .gitlab-ci.yml | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/.gitlab-ci.yml b/.gitlab-ci.yml
index ce902251c0..76374b3532 100644
--- a/.gitlab-ci.yml
+++ b/.gitlab-ci.yml
@@ -2027,6 +2027,8 @@ publish:
   variables:
     SSH_SCRIPT_CLIENT: |-
       ssh "${STAGING_USER_ACTIONS}@${STAGING_HOST}" "publish ${CI_COMMIT_TAG}"
+  after_script:
+    - if [ "${CI_JOB_STATUS}" = "success" ]; then "$CI_PROJECT_DIR"/bind9-qa/releng/manage_distros_token.py delete; fi
   artifacts:
     paths:
       - publish-${CI_COMMIT_TAG}.log

From a877e86dd81c48b1ba957cea3b7bebd38bebed80 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Micha=C5=82=20K=C4=99pie=C5=84?= <michal@isc.org>
Date: Thu, 12 Mar 2026 12:27:36 +0100
Subject: [PATCH 3/3] Fix a typo in job name

As hinted upon by the comment preceding it, the job preparing packager
notifications was (rather unsurprisingly) supposed to be called
"prepare-packager-notification".  Fix the typo in its name.

(cherry picked from commit 50e18f6720b385f3adf9992e348e966a7f322539)
---
 .gitlab-ci.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.gitlab-ci.yml b/.gitlab-ci.yml
index 76374b3532..19a02bae11 100644
--- a/.gitlab-ci.yml
+++ b/.gitlab-ci.yml
@@ -2130,7 +2130,7 @@ prepare-preannouncement:
 
 # Job preparing a packager notification MR in Printing Press
 
-prepare-package-notification:
+prepare-packager-notification:
   <<: *printing_press_job
   before_script:
     - *git_clone_bind9-qa