Commit 518c76566d for bind
commit 518c76566da4833b8274b0afde6144ee273da9ce
Author: Štěpán Balážik <stepan@isc.org>
Date: Tue Sep 22 14:53:44 2026 +0200
Scope CI secrets to per-job environments
CI/CD variables were visible to every job, including merge-request
jobs that run code from the source branch. Put each job that needs a
secret into an environment named after the secrets it uses, so that
the variables can be restricted with environment_scope globs, see
https://docs.gitlab.com/ci/environments/.
The environment name is a list of the parts below, joined with "-".
Each variable gets the scope "*<part>*", so it reaches exactly the
jobs whose environment name contains that part. No part is a
substring of another, so the globs cannot overlap. The "access"
action makes GitLab record no deployment [1] for the job.
api BIND_TEAM_API_TOKEN
customer ISC_CUSTOMERS_WRITE_TOKEN
danger DANGER_GITLAB_API_TOKEN
distros ISC_CUSTOMERS_DISTROS_API_TOKEN
staging STAGING_HOST, STAGING_DIR, STAGING_USER_UPLOAD,
STAGING_USER_ACTIONS
write BIND_TEAM_WRITE_TOKEN
zulip ZULIP_API_KEY, ZULIP_SERVER_URL
[1] https://docs.gitlab.com/ci/environments/deployments/
Assisted-by: Claude:claude-fable-5-1
diff --git a/.gitlab-ci.yml b/.gitlab-ci.yml
index 459a30fd9a..16c6667322 100644
--- a/.gitlab-ci.yml
+++ b/.gitlab-ci.yml
@@ -823,6 +823,9 @@ shfmt:
danger:
<<: *quick_checks_job
+ environment:
+ name: api-danger
+ action: access
script:
- pip install git+https://gitlab.isc.org/isc-projects/hazard.git
- hazard
@@ -1892,6 +1895,9 @@ sign:
staging:
<<: *signer_ssh_job
+ environment:
+ name: staging
+ action: access
variables:
RELEASE_TARBALL: bind-${CI_COMMIT_TAG}-release.tar.gz
SSH_SCRIPT_RUNNER_PRE: |-
@@ -1915,6 +1921,9 @@ staging:
publish-private:
<<: *signer_ssh_job
+ environment:
+ name: staging
+ action: access
variables:
SSH_SCRIPT_CLIENT: |-
ssh "${STAGING_USER_ACTIONS}@${STAGING_HOST}" "publish-private ${CI_COMMIT_TAG}"
@@ -1935,6 +1944,9 @@ publish-private:
publish:
<<: *signer_ssh_job
+ environment:
+ name: staging
+ action: access
before_script:
- TODAY="$(date +%Y-%m-%d)"
- SCHEDULED_PUBLICATION="$(curl -m 5 -s "https://gitlab.isc.org/isc-projects/bind9-qa/-/raw/main/releng/metadata.json" | jq -r ".schedule.public")"
@@ -1954,6 +1966,9 @@ publish:
publish-cleanup:
<<: *base_image
+ environment:
+ name: distros-zulip
+ action: access
stage: release
script:
- *git_clone_bind9-qa
@@ -1982,6 +1997,9 @@ publish-cleanup:
assign-milestones:
<<: *manual_release_job_qa
+ environment:
+ name: write
+ action: access
needs:
- job: sign
artifacts: false
@@ -2031,6 +2049,9 @@ assign-milestones:
rpms-cloudsmith-build:
<<: *rpm_build_job
+ environment:
+ name: write
+ action: access
variables:
SERVICE: cloudsmith
rules:
@@ -2042,6 +2063,9 @@ rpms-cloudsmith-build:
rpms-cloudsmith-build-private:
<<: *rpm_build_job_private
+ environment:
+ name: write
+ action: access
variables:
SERVICE: cloudsmith
rules:
@@ -2055,6 +2079,9 @@ rpms-cloudsmith-build-private:
rpms-cloudsmith-publish:
<<: *rpm_publish_job
+ environment:
+ name: write
+ action: access
variables:
SERVICE: cloudsmith
needs:
@@ -2065,6 +2092,9 @@ rpms-cloudsmith-publish:
rpms-cloudsmith-publish-private:
<<: *rpm_publish_job
+ environment:
+ name: write
+ action: access
variables:
SERVICE: cloudsmith
needs:
@@ -2077,6 +2107,9 @@ rpms-cloudsmith-publish-private:
rpms-copr:
<<: *rpm_build_job
+ environment:
+ name: write
+ action: access
variables:
SERVICE: copr
rules:
@@ -2103,6 +2136,9 @@ rpms-copr:
update-docker-image:
<<: *base_image
<<: *manual_release_job
+ environment:
+ name: write-zulip
+ action: access
variables:
RELEASE_DIRECTORY: "bind-${CI_COMMIT_TAG}-release"
script:
@@ -2136,6 +2172,9 @@ update-docker-image:
prepare-release-announcement:
<<: *printing_press_job
+ environment:
+ name: write-zulip
+ action: access
variables:
DOCUMENT: release-announcement
rules:
@@ -2147,6 +2186,9 @@ prepare-release-announcement:
prepare-evn:
<<: *printing_press_job
+ environment:
+ name: write
+ action: access
variables:
DOCUMENT: evn
rules:
@@ -2156,6 +2198,9 @@ prepare-evn:
prepare-preannouncement:
<<: *printing_press_job
+ environment:
+ name: write
+ action: access
variables:
DOCUMENT: security-preannouncement
rules:
@@ -2165,6 +2210,9 @@ prepare-preannouncement:
prepare-packager-notification:
<<: *printing_press_job
+ environment:
+ name: distros-write-zulip
+ action: access
before_script:
- *git_clone_bind9-qa
# produce distros_git_url.txt to be immediately read by printing_press_mr.py
@@ -2179,6 +2227,9 @@ prepare-packager-notification:
prepare-post-disclosure-notification:
<<: *printing_press_job
+ environment:
+ name: write
+ action: access
variables:
DOCUMENT: post-disclosure-notification
rules:
@@ -2188,6 +2239,9 @@ prepare-post-disclosure-notification:
merge-tag:
<<: *manual_release_job_qa
+ environment:
+ name: write
+ action: access
variables:
GIT_DEPTH: 100
needs:
@@ -2206,6 +2260,9 @@ merge-tag:
cherry-pick-tag:
<<: *manual_release_job_qa
+ environment:
+ name: write
+ action: access
variables:
GIT_DEPTH: 100
needs:
@@ -2219,6 +2276,9 @@ cherry-pick-tag:
update-stable-tag:
<<: *manual_release_job_qa
+ environment:
+ name: write
+ action: access
needs:
# TODO: if necessary, update job name after pushing tags from within CI is implemented
- job: publish
@@ -2251,6 +2311,9 @@ update-stable-tag:
# set it to the name of the target customer.
customer-git:branch:
<<: *customer_git
+ environment:
+ name: customer
+ action: access
needs: []
rules:
- if: '$CI_PROJECT_NAMESPACE == "isc-private" && $CI_PIPELINE_SOURCE == "merge_request_event"'
@@ -2269,6 +2332,9 @@ customer-git:branch:
customer-git:tag:
<<: *customer_git
+ environment:
+ name: customer
+ action: access
needs:
- job: release
artifacts: false
@@ -2351,24 +2417,36 @@ respdiff:recent-named:
shotgun:udp:
<<: *shotgun_job
+ environment:
+ name: zulip
+ action: access
variables:
SHOTGUN_SCENARIO: udp
SHOTGUN_TRAFFIC_MULTIPLIER: 15
shotgun:tcp:
<<: *shotgun_job
+ environment:
+ name: zulip
+ action: access
variables:
SHOTGUN_SCENARIO: tcp
SHOTGUN_TRAFFIC_MULTIPLIER: 12
shotgun:dot:
<<: *shotgun_job
+ environment:
+ name: zulip
+ action: access
variables:
SHOTGUN_SCENARIO: dot
SHOTGUN_TRAFFIC_MULTIPLIER: 5
shotgun:doh-get:
<<: *shotgun_job
+ environment:
+ name: zulip
+ action: access
variables:
SHOTGUN_SCENARIO: doh-get
SHOTGUN_TRAFFIC_MULTIPLIER: 2
@@ -2470,6 +2548,9 @@ pairwise:
backports:
<<: *post_merge
+ environment:
+ name: write
+ action: access
rules:
- if: '$CI_PIPELINE_SOURCE == "push" && ($CI_COMMIT_REF_NAME =~ /^security-(main|bind-9\.[0-9]+)$/ || $CI_COMMIT_REF_NAME =~ /^bind-9\.[0-9]+$/ || $CI_COMMIT_REF_NAME == $CI_DEFAULT_BRANCH)'
script:
@@ -2480,6 +2561,9 @@ backports:
merged-metadata:
<<: *post_merge
+ environment:
+ name: write
+ action: access
rules:
- if: '$CI_PIPELINE_SOURCE == "push" && ($CI_COMMIT_REF_NAME =~ /^security-(main|bind-9\.[0-9]+)$/ || $CI_COMMIT_REF_NAME =~ /^bind-9\.[0-9]+(-sub)?$/ || $CI_COMMIT_REF_NAME =~ /^v9\.[0-9]+\.[0-9]+-release$/ || $CI_COMMIT_REF_NAME == $CI_DEFAULT_BRANCH)'
script:
@@ -2576,5 +2660,8 @@ autorebase-trigger-security:
autorebase-security:
<<: *autorebase
+ environment:
+ name: api-write-zulip
+ action: access
rules:
- if: '$CI_PROJECT_NAMESPACE == "isc-private" && $CI_PIPELINE_SOURCE == "pipeline" && $CI_COMMIT_REF_NAME =~ /^security-(main|bind-9\.[0-9]+)$/ && $REBASE_ONLY == "1" && $CI_COMMIT_REF_NAME =~ $AUTOREBASED_BRANCHES'