Commit dd97410a81 for bind

commit dd97410a8104997ccb8690e9ded1733ce460ceaa
Merge: adafa1e443 9dc7156c02
Author: Štěpán Balážik <stepan@isc.org>
Date:   Thu Sep 24 12:42:04 2026 +0000

    chg: ci: Scope CI secrets to per-job environments

    CI/CD variables were visible to every job, including merge-request
    jobs that run code from the source branch.  Put each job that needs a
    secret into an environment named after the secrets it uses, so that
    the variables can be restricted with environment_scope globs, see
    https://docs.gitlab.com/ci/environments/.

    The environment name is a list of the parts below, joined with `-`.
    Each variable gets the scope `*<part>*`, so it reaches exactly the
    jobs whose environment name contains that part.  No part is a
    substring of another, so the globs cannot overlap.  The "access"
    action makes GitLab record no deployment [1] for the job.

    ```
      api       BIND_TEAM_API_TOKEN
      customer  ISC_CUSTOMERS_WRITE_TOKEN
      danger    DANGER_GITLAB_API_TOKEN
      distros   ISC_CUSTOMERS_DISTROS_API_TOKEN
      staging   STAGING_HOST, STAGING_DIR, STAGING_USER_UPLOAD,
                STAGING_USER_ACTIONS
      write     BIND_TEAM_WRITE_TOKEN
      zulip     ZULIP_API_KEY, ZULIP_SERVER_URL
    ```

    [1] https://docs.gitlab.com/ci/environments/deployments/

    Merge branch 'stepan/scope-ci-secrets-to-per-job-environments' into 'main'

    See merge request isc-projects/bind9!12743