From 873b1e721413547e0164d76caf7e6f6b260727d1 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Micha=C5=82=20K=C4=99pie=C5=84?= <michal@isc.org>
Date: Thu, 7 May 2026 17:45:35 +0200
Subject: [PATCH] Enable automatic backports for security fixes

Ensure the "backports" CI job is created when new changes are merged
into security-* branches.  This enables using backport automation for
security fixes.

(cherry picked from commit 88b94a2019397e9c85d49c59aac4e2a11db5f779)
---
 .gitlab-ci.yml | 3 +--
 1 file changed, 1 insertion(+), 2 deletions(-)

diff --git a/.gitlab-ci.yml b/.gitlab-ci.yml
index 789c82b81a..bc5568164b 100644
--- a/.gitlab-ci.yml
+++ b/.gitlab-ci.yml
@@ -2419,8 +2419,7 @@ pairwise:
 backports:
   <<: *post_merge
   rules:
-    # -sub branches are handled manually
-    - if: '$CI_PIPELINE_SOURCE == "push" && ($CI_COMMIT_REF_NAME =~ /^bind-9.[0-9]+$/ || $CI_COMMIT_REF_NAME == $CI_DEFAULT_BRANCH)'
+    - if: '$CI_PIPELINE_SOURCE == "push" && ($CI_COMMIT_REF_NAME =~ /^security-(main|bind-9\.[0-9]+)$/ || $CI_COMMIT_REF_NAME =~ /^bind-9.[0-9]+$/ || $CI_COMMIT_REF_NAME == $CI_DEFAULT_BRANCH)'
   script:
     # CI job token is not sufficient for push operations
     - git remote get-url origin | sed -e "s/gitlab-ci-token:$CI_JOB_TOKEN/oauth2:$BIND_TEAM_WRITE_TOKEN/" | xargs git remote set-url --push origin