From 0734ec2a68b4a97f9e080096dfd679d5584a265d Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Micha=C5=82=20K=C4=99pie=C5=84?= <michal@isc.org>
Date: Mon, 27 Oct 2025 05:15:09 +0100
Subject: [PATCH] Deduplicate triggering rules for tag pipeline jobs

Define and use more YAML anchors for triggering rules commonly used by
tag pipeline jobs.  This builds on top of the work done in commit
675d9c74251fee8ec034e87bdd43e7da97119a5d, improving readability and
reuse.
---
 .gitlab-ci.yml | 16 +++++++++++-----
 1 file changed, 11 insertions(+), 5 deletions(-)

diff --git a/.gitlab-ci.yml b/.gitlab-ci.yml
index fa94f93b3d..68702ce65c 100644
--- a/.gitlab-ci.yml
+++ b/.gitlab-ci.yml
@@ -306,6 +306,12 @@ stages:
 .rule_tag: &rule_tag
   - if: '$CI_PROJECT_NAMESPACE == "isc-private" && $CI_COMMIT_TAG != null'
 
+.rule_tag_open_source: &rule_tag_open_source
+  - if: '$CI_PROJECT_NAMESPACE == "isc-private" && $CI_COMMIT_TAG != null && $CI_COMMIT_TAG !~ /-S/'
+
+.rule_tag_security_or_subscription: &rule_tag_security_or_subscription
+  - if: '$CI_PROJECT_NAMESPACE == "isc-private" && $CI_COMMIT_TAG != null && ($RELEASE_TYPE == "security" || $CI_COMMIT_TAG =~ /-S/)'
+
 .rule_source_other_than_mr: &rule_source_other_than_mr
   - if: '$CI_PIPELINE_SOURCE =~ /^(api|pipeline|schedule|trigger|web)$/ && $REBASE_ONLY != "1"'
 
@@ -1712,7 +1718,7 @@ staging:
     - job: sign
       artifacts: true
   rules:
-    - if: '$CI_COMMIT_TAG != null'
+    - *rule_tag
 
 # Job copying a staged release to a secret location
 
@@ -1732,7 +1738,7 @@ publish-private:
     - job: staging
       artifacts: false
   rules:
-    - if: '$CI_COMMIT_TAG != null && ($CI_COMMIT_TAG =~ /-S/ || $RELEASE_TYPE == "security")'
+    - *rule_tag_security_or_subscription
 
 # Job copying a staged release to a well-known location
 
@@ -1749,7 +1755,7 @@ publish:
     - job: staging
       artifacts: false
   rules:
-    - if: '$CI_COMMIT_TAG != null && $CI_COMMIT_TAG !~ /-S/'
+    - *rule_tag_open_source
 
 # Job creating the release announcement MR in Printing Press
 
@@ -1765,7 +1771,7 @@ prepare-release-announcement:
     - bind9-qa/releng/prepare_release_announcement.py --metadata bind9-qa/releng/metadata.json
   needs: []
   rules:
-    - if: '$CI_COMMIT_TAG != null && $CI_COMMIT_TAG !~ /-S/'
+    - *rule_tag_open_source
   artifacts:
     paths:
       - printing-press/
@@ -1785,7 +1791,7 @@ merge-tag:
     - bind9-qa/releng/merge_tag.py --tag "$CI_COMMIT_TAG"
   needs: []
   rules:
-    - if: '$CI_COMMIT_TAG != null && $CI_COMMIT_TAG !~ /-S/'
+    - *rule_tag_open_source
   artifacts:
     paths:
       - bind9/