From 8a404e8acd9ca8bcc885f0c5f14bec13f0631ecb Mon Sep 17 00:00:00 2001
From: Andoni Duarte Pintado <andoni@isc.org>
Date: Thu, 19 Feb 2026 10:04:51 +0100
Subject: [PATCH] Add job to update BIND9 Docker images for release

This commit adds a new CI job to update the BIND9 version in the
isc-projects/bind9-docker project, which will cause the docker images
to be rebuilt for release. Previously a manual step.

A notification is sent to the relevant Mattermost channel.

(cherry picked from commit 0ad724558ec0e66b3125250a3ac92197a9b864f6)
---
 .gitlab-ci.yml | 33 +++++++++++++++++++++++++++++++++
 1 file changed, 33 insertions(+)

diff --git a/.gitlab-ci.yml b/.gitlab-ci.yml
index bf56801afa..8d497f8f0a 100644
--- a/.gitlab-ci.yml
+++ b/.gitlab-ci.yml
@@ -2071,6 +2071,39 @@ publish:
       - printing-press/
     when: on_failure
 
+# Job updating the Docker image for a specific release
+
+update-docker-image:
+  <<: *base_image
+  <<: *manual_release_job
+  variables:
+    RELEASE_DIRECTORY: "bind-${CI_COMMIT_TAG}-release"
+  script:
+    - VERSION="${CI_COMMIT_TAG#v}"
+    - CHECKSUM="$(sha256sum "${RELEASE_DIRECTORY}/bind-${VERSION}.tar.xz" | awk '{print $1}')"
+    - BRANCH="${CI_COMMIT_TAG%.*}"
+    - DOCKER_PROJECT="https://gitlab.isc.org/isc-projects/bind9-docker"
+    - CLONE_URL="https://oauth2:${BIND_TEAM_WRITE_TOKEN}@${DOCKER_PROJECT#https://}"
+    - git clone --depth 1 --branch "${BRANCH}" "${CLONE_URL}" docker-project
+    - cd docker-project
+    - sed -E -i Dockerfile -e "s/^(ARG BIND9_VERSION=).*/\1${VERSION}/"
+    - sed -E -i Dockerfile -e "s/^(ARG BIND9_CHECKSUM=).*/\1${CHECKSUM}/"
+    - git commit -m "Version bump to ${VERSION}" Dockerfile
+    - git push
+    - COMMIT_SHA="$(git log -n1 --format=%H)"
+    - MSG="Docker image for BIND ${BRANCH} updated to version ${CI_COMMIT_TAG}, commit [${COMMIT_SHA}](${DOCKER_PROJECT}/-/commit/${COMMIT_SHA})"
+    - |
+      curl -s -o /dev/null -X POST -H "Content-Type: application/json" -d '{"channel": "packaging", "text": "'"${MSG}"'"}' "${MATTERMOST_WEBHOOK_URL}"
+  needs:
+    - job: release
+      artifacts: true
+    - job: publish
+      artifacts: false
+  rules:
+    - *rule_tag_open_source
+  tags:
+    - smalljob
+
 # Job creating the release announcement MR in Printing Press
 
 prepare-release-announcement: