Commit 3696c2c43e for bind

commit 3696c2c43e8bb3a9ee2e8c432b45521c74224d72
Author: Andoni Duarte Pintado <andoni@isc.org>
Date:   Tue Aug 25 19:54:29 2026 +0200

    Monitor build and publish status for RPM packages

    Add monitor-build and monitor-publish jobs that check the status of RPM
    build and publish jobs. They work by polling the respective service
    (Cloudsmith, Copr) pipeline. The jobs run until either the build
    or publication is successful, report a failure or time out. The scripts
    notify this via Zulip.

    Publish jobs now depend on the corresponding build monitor instead
    of the build job.

    Since polling can time out, they run on the default runner (no
    "smalljob" tag).

diff --git a/.gitlab-ci.yml b/.gitlab-ci.yml
index cf8c5cb22f..bdc45b2388 100644
--- a/.gitlab-ci.yml
+++ b/.gitlab-ci.yml
@@ -2056,15 +2056,20 @@ assign-milestones:
   rules:
     - *rule_tag

-# Jobs to update RPMs
+# Jobs to update RPMs (anchors)

 .rpm-build-job-common: &rpm_build_job_common
   <<: *manual_release_job_qa
+  allow_failure: false
   # prevent Git push races between pipelines started for different tags
   resource_group: "rpm-build-${SERVICE}"
   after_script:
     - git -C bind/ remote get-url origin | sed "s|\.git$|/-/commit/$(cat commit.txt)|"
     - git -C bind/ show --color "$(cat commit.txt)" | sed "s|^$| |"
+  artifacts:
+    paths:
+      - commit.txt
+    expire_in: "1 month"

 .rpm-build-job: &rpm_build_job
   <<: *rpm_build_job_common
@@ -2086,9 +2091,47 @@ assign-milestones:

 .rpm-publish-job: &rpm_publish_job
   <<: *manual_release_job_qa
+  allow_failure: false
   script:
     - >
       "${CI_PROJECT_DIR}"/bind9-qa/releng/update_rpms.py publish --service "${SERVICE}" --commit "$(cat "commit.txt")"
+  artifacts:
+    paths:
+      - commit.txt
+    expire_in: "1 month"
+
+.monitor-rpm-job-common: &monitor_rpm_job_common
+  <<: *base_image
+  environment:
+    name: write-zulip
+    action: access
+  stage: release
+  before_script:
+    - *git_clone_bind9-qa
+  after_script:
+    - |
+      if [ "${CI_JOB_STATUS}" = "timedout" ]; then
+        MSG="RPM monitoring timed out for ${CI_JOB_NAME}"
+        MSG="${MSG}, check [job ${CI_JOB_ID}](${CI_JOB_URL})"
+        echo "$MSG" > message.txt
+        "$CI_PROJECT_DIR"/bind9-qa/releng/message_zulip.py --message message.txt --channel bind9-qa --topic "RPM build errors"
+      fi
+  artifacts:
+    paths:
+      - commit.txt
+    expire_in: "1 month"
+
+.monitor-rpm-build-job: &monitor_rpm_build_job
+  <<: *monitor_rpm_job_common
+  script:
+    - >
+      "${CI_PROJECT_DIR}"/bind9-qa/releng/update_rpms.py monitor-build --service "${SERVICE}" --version "${CI_COMMIT_TAG}" --commit "$(cat "commit.txt")"
+
+.monitor-rpm-publish-job: &monitor_rpm_publish_job
+  <<: *monitor_rpm_job_common
+  script:
+    - >
+      "${CI_PROJECT_DIR}"/bind9-qa/releng/update_rpms.py monitor-publish --service "${SERVICE}" --commit "$(cat "commit.txt")"

 # Update Cloudsmith packages

@@ -2101,10 +2144,16 @@ rpms-cloudsmith-build:
     SERVICE: cloudsmith
   rules:
     - *rule_tag_open_source_maintenance
-  artifacts:
-    paths:
-      - commit.txt
-    expire_in: "1 month"
+
+monitor-rpms-cloudsmith-build:
+  <<: *monitor_rpm_build_job
+  variables:
+    SERVICE: cloudsmith
+  rules:
+    - *rule_tag_open_source_maintenance
+  needs:
+    - job: rpms-cloudsmith-build
+      artifacts: true

 rpms-cloudsmith-build-private:
   <<: *rpm_build_job_private
@@ -2115,10 +2164,16 @@ rpms-cloudsmith-build-private:
     SERVICE: cloudsmith
   rules:
     - *rule_tag_security_or_subscription
-  artifacts:
-    paths:
-      - commit.txt
-    expire_in: "1 month"
+
+monitor-rpms-cloudsmith-build-private:
+  <<: *monitor_rpm_build_job
+  variables:
+    SERVICE: cloudsmith
+  rules:
+    - *rule_tag_security_or_subscription
+  needs:
+    - job: rpms-cloudsmith-build-private
+      artifacts: true

 # Publish Cloudsmith packages

@@ -2130,7 +2185,17 @@ rpms-cloudsmith-publish:
   variables:
     SERVICE: cloudsmith
   needs:
-    - job: rpms-cloudsmith-build
+    - job: monitor-rpms-cloudsmith-build
+      artifacts: true
+  rules:
+    - *rule_tag_open_source_maintenance
+
+monitor-rpms-cloudsmith-publish:
+  <<: *monitor_rpm_publish_job
+  variables:
+    SERVICE: cloudsmith
+  needs:
+    - job: rpms-cloudsmith-publish
       artifacts: true
   rules:
     - *rule_tag_open_source_maintenance
@@ -2143,7 +2208,17 @@ rpms-cloudsmith-publish-private:
   variables:
     SERVICE: cloudsmith
   needs:
-    - job: rpms-cloudsmith-build-private
+    - job: monitor-rpms-cloudsmith-build-private
+      artifacts: true
+  rules:
+    - *rule_tag_security_or_subscription
+
+monitor-rpms-cloudsmith-publish-private:
+  <<: *monitor_rpm_publish_job
+  variables:
+    SERVICE: cloudsmith
+  needs:
+    - job: rpms-cloudsmith-publish-private
       artifacts: true
   rules:
     - *rule_tag_security_or_subscription
@@ -2160,6 +2235,16 @@ rpms-copr:
   rules:
     - *rule_tag_open_source

+monitor-rpms-copr:
+  <<: *monitor_rpm_build_job
+  variables:
+    SERVICE: copr
+  needs:
+    - job: rpms-copr
+      artifacts: true
+  rules:
+    - *rule_tag_open_source
+
 # Setting the FORCE_CVE_IDS environment variable to a comma-separated
 # list of CVE IDs enables overriding the autodetected ones.
 #