DEVX-1: fix: allow release bot to push to protected master

src/devx/tools/configure_repo.py

@@ -38,12 +38,17 @@ def _default_branch_protection_config() -> dict[str, Any]:
     The ``status_check_contexts`` are read from the ``DEVX_STATUS_CHECKS``
     environment variable (comma-separated) or default to just the quality
     check context.
+
+    The ``push_whitelist_usernames`` is read from ``DEVX_PUSH_WHITELIST``
+    (comma-separated) to allow the release bot to push directly to master.
     """
+    push_whitelist = os.environ.get("DEVX_PUSH_WHITELIST", "")
+    whitelist = [u.strip() for u in push_whitelist.split(",") if u.strip()]
     return {
         "branch_name": "master",
         "enable_push": True,
         "enable_push_whitelist": True,
-        "push_whitelist_usernames": [],
+        "push_whitelist_usernames": whitelist,
         "enable_status_check": True,
         "status_check_contexts": _default_status_checks(),
         "required_approvals": 0,