From 4c0a013b07d594ed87d73ca0780f10d2980909e5 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Petr=20=C5=A0pa=C4=8Dek?= <pspacek@isc.org>
Date: Tue, 10 Mar 2026 18:01:16 +0100
Subject: [PATCH 1/3] Generate token for early Git access in
 prepare-package-notification

(cherry picked from commit 9f323ad040095717d9d6708a66cd6ae745aca741)
---
 .gitlab-ci.yml | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/.gitlab-ci.yml b/.gitlab-ci.yml
index 76f43b5ced..732c57eae8 100644
--- a/.gitlab-ci.yml
+++ b/.gitlab-ci.yml
@@ -1945,6 +1945,11 @@ prepare-preannouncement:
 
 prepare-package-notification:
   <<: *printing_press_job
+  before_script:
+    - *git_clone_bind9-qa
+    # produce distros_git_url.txt to be immediately read by printing_press_mr.py
+    - >
+      "$CI_PROJECT_DIR"/bind9-qa/releng/manage_distros_token.py create
   variables:
     DOCUMENT: packager-notification
   rules:

From 28565ff3ca8bddd51d85bf0c393a3500581bde3c Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Petr=20=C5=A0pa=C4=8Dek?= <pspacek@isc.org>
Date: Tue, 10 Mar 2026 18:04:51 +0100
Subject: [PATCH 2/3] Delete early access token when code is published

Technically this is not necessary because the token expires in one week
after creation, and new code would have got there only one week before
the next public release, but better be safe than sorry.

Catch is, after_script gets executed even if a job fails or is
canceled. Delete distros token only if publication succeeded.

(cherry picked from commit 98cbde5233c788936f8aeb6231c65db74d9f7fbc)
---
 .gitlab-ci.yml | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/.gitlab-ci.yml b/.gitlab-ci.yml
index 732c57eae8..8c60147089 100644
--- a/.gitlab-ci.yml
+++ b/.gitlab-ci.yml
@@ -1842,6 +1842,8 @@ publish:
   variables:
     SSH_SCRIPT_CLIENT: |-
       ssh "${STAGING_USER_ACTIONS}@${STAGING_HOST}" "publish ${CI_COMMIT_TAG}"
+  after_script:
+    - if [ "${CI_JOB_STATUS}" = "success" ]; then "$CI_PROJECT_DIR"/bind9-qa/releng/manage_distros_token.py delete; fi
   artifacts:
     paths:
       - publish-${CI_COMMIT_TAG}.log

From 9079ce8aaa65db9a20a063daaba50ea20298d0d2 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Micha=C5=82=20K=C4=99pie=C5=84?= <michal@isc.org>
Date: Thu, 12 Mar 2026 12:27:36 +0100
Subject: [PATCH 3/3] Fix a typo in job name

As hinted upon by the comment preceding it, the job preparing packager
notifications was (rather unsurprisingly) supposed to be called
"prepare-packager-notification".  Fix the typo in its name.

(cherry picked from commit 50e18f6720b385f3adf9992e348e966a7f322539)
---
 .gitlab-ci.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.gitlab-ci.yml b/.gitlab-ci.yml
index 8c60147089..eed7ed8ae5 100644
--- a/.gitlab-ci.yml
+++ b/.gitlab-ci.yml
@@ -1945,7 +1945,7 @@ prepare-preannouncement:
 
 # Job preparing a packager notification MR in Printing Press
 
-prepare-package-notification:
+prepare-packager-notification:
   <<: *printing_press_job
   before_script:
     - *git_clone_bind9-qa