From 918fbcea12efa453ae4b244902b0d615e1abe0d5 Mon Sep 17 00:00:00 2001
From: Andoni Duarte Pintado <andoni@isc.org>
Date: Fri, 22 May 2026 17:38:40 +0200
Subject: [PATCH 1/2] Include common Gitlab CI YAML from isc-projects/bind9-qa

The template file .gitlab-ci-common.yml is to be used across ISC
projects, while it is maintained in the isc-projects/bind9-qa project.

(cherry picked from commit 1c31e6fea91f72c3282b47400d51b00aed5a9e15)
---
 .gitlab-ci.yml | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/.gitlab-ci.yml b/.gitlab-ci.yml
index 6d5c8908a8..a51b88ddc0 100644
--- a/.gitlab-ci.yml
+++ b/.gitlab-ci.yml
@@ -112,6 +112,10 @@ workflow:
   auto_cancel:
     on_new_commit: interruptible
 
+include:
+  - project: 'isc-projects/bind9-qa'
+    file: '/.gitlab-ci-common.yml'
+
 stages:
   - autoconf
   - quick-checks

From e4ccf36de65e272eca579426f549cfc2b93402dd Mon Sep 17 00:00:00 2001
From: Andoni Duarte Pintado <andoni@isc.org>
Date: Mon, 9 Mar 2026 17:30:09 +0100
Subject: [PATCH 2/2] Add rule for the stable tags in CI and use for job
 update-stable-tag

The update-stable-tag job should only be run for the stable tag, which
is used by Read the Docs to build the docs for the "stable" version.

A new rule called rule_tag_open_source_stable is introduced, in order to
prevent the job from appearing in the pipeline for non-stable versions.
Having this rule in YAML is necessary, because if it were in the script
itself, the job would show up in the pipeline.

Besides, the new rule allows other jobs to be run only for the stable
tag in the future, without modifying their internal logic.

The CI variable STABLE_VERSION contains a regular expression in
Gitlab CI sense[1]: it uses the RE2 syntax[2] and must be enclosed by
slashes (i.e. /.../). It must be updated every time the minor version
is changed: releasing v9.22 will require changing STABLE_VERSION from
"/v9.20/" to "/v9.22/".

The variable is imported from common Gitlab CI YAML in the project
isc-projects/bind9-qa, so as to maintain it in a central place.

[1]: https://docs.gitlab.com/ci/jobs/job_rules/#compare-a-variable-to-a-regular-expression
[2]: https://github.com/google/re2/wiki/Syntax

(cherry picked from commit 38e80f542e93dc7baa2558e856a10e0c521e112c)
---
 .gitlab-ci.yml | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/.gitlab-ci.yml b/.gitlab-ci.yml
index a51b88ddc0..fcd4049a14 100644
--- a/.gitlab-ci.yml
+++ b/.gitlab-ci.yml
@@ -330,6 +330,9 @@ stages:
 .rule_tag_open_source: &rule_tag_open_source
   - if: '$CI_PROJECT_NAMESPACE == "isc-private" && $CI_COMMIT_TAG != null && $CI_COMMIT_TAG !~ /-S/'
 
+.rule_tag_open_source_stable: &rule_tag_open_source_stable
+  - if: '$CI_PROJECT_NAMESPACE == "isc-private" && $CI_COMMIT_TAG != null && $CI_COMMIT_TAG =~ $STABLE_VERSION_REGEX'
+
 .rule_tag_open_source_maintenance: &rule_tag_open_source_maintenance
   - if: '$CI_PROJECT_NAMESPACE == "isc-private" && $CI_COMMIT_TAG != null && $CI_COMMIT_TAG !~ /-S/ && $RELEASE_TYPE != "security"'
 
@@ -2463,7 +2466,7 @@ update-stable-tag:
     - >
       "$CI_PROJECT_DIR"/bind9-qa/releng/update_stable_tag.py --tag "$CI_COMMIT_TAG"
   rules:
-    - *rule_tag_open_source
+    - *rule_tag_open_source_stable
   artifacts:
     paths:
       - bind9/