feat: extract reusable dev/CI tools from GRM into devx package

Port core modules (config, exceptions, i18n, api_clients, gitea_cli),
14 CI scripts, 6 dev tools, 5 molecule tools, CLI entry point, workflows,
Makefile, tests (784 tests, 100% coverage), and documentation from GRM.

The devx package is published to the Gitea PyPI registry and consumed
by GRM, infra, and other oblachno-oss projects as a pip dependency.

Generated with [Devin](https://devin.ai)

Co-Authored-By: Devin <158243242+devin-ai-integration[bot]@users.noreply.github.com>

.gitea/actionlint.yaml

@@ -0,0 +1,4 @@
+# actionlint configuration for Gitea Actions workflows
+self-hosted-runner:
+  labels:
+    - docker

.gitea/workflows/ci.yml

@@ -0,0 +1,152 @@
+name: CI
+
+on:
+  pull_request:
+    types: [opened, synchronize]
+  workflow_dispatch:
+
+jobs:
+  quality:
+    runs-on: docker
+    timeout-minutes: 10
+    steps:
+      - uses: actions/checkout@v4
+      - name: Set up environment
+        run: make setup-quality
+      - name: Lint all
+        run: |
+          . .venv/bin/activate
+          export PATH="$HOME/.local/bin:$PATH"
+          make lint-all
+      - name: Unit tests with 100% coverage
+        run: |
+          . .venv/bin/activate
+          make pytest-cov
+      - name: Check unit test speed
+        env:
+          PYTHONPATH: src
+        run: |
+          . .venv/bin/activate
+          python -m devx.tools.check_test_speed --max-seconds 10
+      - name: Documentation coverage check
+        env:
+          PYTHONPATH: src
+        run: |
+          . .venv/bin/activate
+          python -m devx.ci.doc_coverage --fail-on-missing
+      - name: Translation completeness check
+        env:
+          PYTHONPATH: src
+        run: |
+          . .venv/bin/activate
+          python -m devx.ci.check_translations
+      - name: Dependency security scan
+        run: |
+          . .venv/bin/activate
+          # Install pip in venv if missing (needed by pip-audit)
+          .venv/bin/python -m ensurepip 2>/dev/null || true
+          PIPAPI_PYTHON_LOCATION=$PWD/.venv/bin/python \
+            pip-audit --desc --skip-editable 2>&1 || true
+      - name: Workflow dry-run validation
+        run: |
+          . .venv/bin/activate
+          export PATH="$HOME/.local/bin:$PATH"
+          # Best-effort: only runs if act_runner is installed
+          if command -v act_runner >/dev/null 2>&1; then
+            make workflow-dryrun
+          else
+            echo "act_runner not found — skipping workflow dry-run (static lint still passed)"
+          fi
+
+  detect-changes:
+    runs-on: docker
+    timeout-minutes: 10
+    outputs:
+      user-facing-changed: ${{ steps.detect.outputs.user-facing-changed }}
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+      - name: Set up environment
+        run: make setup-ci
+      - name: Detect changed paths
+        id: detect
+        env:
+          PYTHONPATH: src
+        run: |
+          . .venv/bin/activate
+          python -m devx.ci.classify_changes \
+            --base "origin/master" \
+            --head "${{ github.event.pull_request.head.sha || github.sha }}" \
+            --github-output
+
+  release-dry-run:
+    needs: [quality, detect-changes]
+    if: needs.detect-changes.outputs.user-facing-changed == 'true'
+    runs-on: docker
+    timeout-minutes: 10
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+      - name: Set up environment
+        run: make setup-release
+      - name: Release dry-run validation
+        env:
+          PYTHONPATH: src
+        run: |
+          . .venv/bin/activate
+          export PATH="$HOME/.local/bin:$PATH"
+          python -m devx.ci.release --dry-run || true
+
+  pr-review:
+    if: github.event_name == 'pull_request'
+    runs-on: docker
+    timeout-minutes: 10
+    steps:
+      - uses: actions/checkout@v4
+      - name: Set up environment
+        run: make setup-ci
+      - name: Run automated PR review
+        env:
+          REPO_TOKEN: ${{ secrets.REPO_TOKEN }}
+          PYTHONPATH: src
+        run: |
+          set -euo pipefail
+          . .venv/bin/activate
+          python -m devx.ci.pr_review \
+            "${{ github.event.number }}" \
+            "${{ github.repository }}"
+
+  auto-merge:
+    # Auto-merge runs after all CI checks pass. It reads the task ID
+    # from .taskid file, validates the PR title, and squash-merges.
+    # No manual label or review needed — CI is the quality gate.
+    needs: [quality, detect-changes, pr-review]
+    if: github.event_name == 'pull_request'
+    runs-on: docker
+    timeout-minutes: 10
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+          token: ${{ secrets.REPO_TOKEN }}
+      - name: Install dependencies
+        run: |
+          python3 -m pip install --break-system-packages requests python-dotenv click
+          python3 -m pip install --break-system-packages -e .
+      - name: Squash merge with task ID
+        env:
+          REPO_TOKEN: ${{ secrets.REPO_TOKEN }}
+          VIKUNJA_TOKEN: ${{ secrets.VIKUNJA_TOKEN }}
+          PYTHONPATH: src
+          HEAD_REF: ${{ github.head_ref }}
+          PR_TITLE: ${{ github.event.pull_request.title }}
+          REPOSITORY: ${{ github.repository }}
+          PR_NUMBER: ${{ github.event.number }}
+        run: |
+          python -m devx.ci.auto_merge \
+            "$HEAD_REF" \
+            "$PR_TITLE" \
+            "$REPOSITORY" \
+            "$PR_NUMBER"

.gitea/workflows/post-merge.yml

@@ -0,0 +1,236 @@
+name: Post-merge
+
+# Runs on every push to master. A single workflow with conditional jobs
+# replaces separate workflows for release, wiki sync, badges, and
+# Vikunja task updates.
+#
+# Job dependency graph:
+#
+#   detect-type ──┬── release (skip if release commit)
+#                 ├── sync-wiki (skip if release commit)
+#                 ├── badges (ALWAYS runs — even on release commits)
+#                 ├── vikunja (skip if release commit)
+#                 └── configure-repo (skip if release commit)
+#
+# The badges job depends on release so it picks up the latest version
+# number. It uses `if: always()` with no is-release condition so it
+# runs on every push to master, including release commits. This
+# ensures badges (tests, coverage, version, etc.) are always current.
+#
+# When release creates a "release: vX.Y.Z" commit, the release
+# commit's post-merge run still updates badges (version badge picks
+# up the new version). Other jobs skip. The tag push triggers publish.yml.
+
+on:
+  push:
+    branches: [master]
+
+jobs:
+  detect-type:
+    runs-on: docker
+    timeout-minutes: 10
+    outputs:
+      is-release: ${{ steps.check.outputs.is-release }}
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          fetch-depth: 1
+      - name: Install dependencies
+        run: |
+          python3 -m pip install --break-system-packages requests python-dotenv click
+          python3 -m pip install --break-system-packages -e .
+      - name: Check if this is a release commit
+        id: check
+        env:
+          PYTHONPATH: src
+        run: python -m devx.ci.detect_release_commit
+
+  validate-commit-msg:
+    needs: [detect-type]
+    if: needs.detect-type.outputs.is-release == 'false'
+    runs-on: docker
+    timeout-minutes: 5
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          fetch-depth: 1
+      - name: Install dependencies
+        run: |
+          python3 -m pip install --break-system-packages click python-dotenv
+          python3 -m pip install --break-system-packages -e .
+      - name: Validate latest commit message
+        env:
+          PYTHONPATH: src
+        run: |
+          git log -1 --format=%B > commit-msg.txt
+          python -m devx.ci.validate_commit_msg commit-msg.txt --branch master
+          rm -f commit-msg.txt
+
+  release:
+    needs: [detect-type]
+    if: needs.detect-type.outputs.is-release == 'false'
+    runs-on: docker
+    timeout-minutes: 10
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+          token: ${{ secrets.REPO_TOKEN }}
+      - name: Set up environment
+        run: make setup-release
+      - name: Configure git
+        run: |
+          git config user.name "devx-ci-bot"
+          git config user.email "devx-ci-bot@oblachno.fyi"
+      - name: Run release
+        env:
+          PYTHONPATH: src
+        run: |
+          . .venv/bin/activate
+          export PATH="$HOME/.local/bin:$PATH"
+          python -m devx.ci.release
+      - name: Notify on failure
+        if: failure()
+        env:
+          REPO_TOKEN: ${{ secrets.REPO_TOKEN }}
+          PYTHONPATH: src
+        run: |
+          export PATH="$HOME/.local/bin:$PATH"
+          python -m devx.ci.notify_failure \
+            --repo "${{ github.repository }}" \
+            --run-id "${{ github.run_id }}" \
+            --workflow "post-merge/release" \
+            --commit "${{ github.sha }}"
+
+  sync-wiki:
+    needs: [detect-type]
+    if: needs.detect-type.outputs.is-release == 'false'
+    runs-on: docker
+    timeout-minutes: 10
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+      - name: Set up environment
+        run: make setup-ci
+      - name: Sync documentation to wiki
+        env:
+          REPO_TOKEN: ${{ secrets.REPO_TOKEN }}
+          PYTHONPATH: src
+        run: |
+          . .venv/bin/activate
+          python -m devx.ci.sync_wiki --repo "${{ github.repository }}" --strict
+      - name: Notify on failure
+        if: failure()
+        env:
+          REPO_TOKEN: ${{ secrets.REPO_TOKEN }}
+          PYTHONPATH: src
+        run: |
+          export PATH="$HOME/.local/bin:$PATH"
+          python -m devx.ci.notify_failure \
+            --repo "${{ github.repository }}" \
+            --run-id "${{ github.run_id }}" \
+            --workflow "post-merge/sync-wiki" \
+            --commit "${{ github.sha }}"
+
+  badges:
+    needs: [detect-type, release]
+    if: always()
+    runs-on: docker
+    timeout-minutes: 10
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+          ref: master
+          token: ${{ secrets.REPO_TOKEN }}
+      - name: Fetch latest master
+        run: |
+          git fetch origin master
+          git reset --hard origin/master
+      - name: Set up environment
+        run: make setup-ci
+      - name: Generate and push badges
+        env:
+          PRE_COMMIT_ALLOW_NO_CONFIG: "1"
+        run: |
+          . .venv/bin/activate
+          python -m devx.ci.push_badges
+      - name: Notify on failure
+        if: failure()
+        env:
+          REPO_TOKEN: ${{ secrets.REPO_TOKEN }}
+          PYTHONPATH: src
+        run: |
+          export PATH="$HOME/.local/bin:$PATH"
+          python -m devx.ci.notify_failure \
+            --repo "${{ github.repository }}" \
+            --run-id "${{ github.run_id }}" \
+            --workflow "post-merge/badges" \
+            --commit "${{ github.sha }}"
+
+  vikunja:
+    needs: [detect-type]
+    if: needs.detect-type.outputs.is-release == 'false'
+    runs-on: docker
+    timeout-minutes: 10
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+      - name: Install dependencies
+        run: |
+          python3 -m pip install --break-system-packages requests python-dotenv click
+          python3 -m pip install --break-system-packages -e .
+      - name: Update Vikunja task
+        env:
+          VIKUNJA_TOKEN: ${{ secrets.VIKUNJA_TOKEN }}
+          PYTHONPATH: src
+        run: python -m devx.ci.post_merge --git-sha "${{ github.sha }}"
+      - name: Notify on failure
+        if: failure()
+        env:
+          REPO_TOKEN: ${{ secrets.REPO_TOKEN }}
+          PYTHONPATH: src
+        run: |
+          export PATH="$HOME/.local/bin:$PATH"
+          python -m devx.tools.install_tools --tool tea
+          tea login add --name devx --url "${{ github.server_url }}" --token "$REPO_TOKEN" || true
+          tea login default devx || true
+          python -m devx.ci.notify_failure \
+            --repo "${{ github.repository }}" \
+            --run-id "${{ github.run_id }}" \
+            --workflow "post-merge/vikunja" \
+            --commit "${{ github.sha }}"
+
+  configure-repo:
+    needs: [detect-type]
+    if: needs.detect-type.outputs.is-release == 'false'
+    runs-on: docker
+    timeout-minutes: 10
+    steps:
+      - uses: actions/checkout@v4
+      - name: Install dependencies
+        run: |
+          python3 -m pip install --break-system-packages requests python-dotenv click
+          python3 -m pip install --break-system-packages -e .
+      - name: Ensure branch protection and labels
+        env:
+          REPO_TOKEN: ${{ secrets.REPO_TOKEN }}
+          PYTHONPATH: src
+        run: python -m devx.tools.configure_repo
+      - name: Notify on failure
+        if: failure()
+        env:
+          REPO_TOKEN: ${{ secrets.REPO_TOKEN }}
+          PYTHONPATH: src
+        run: |
+          export PATH="$HOME/.local/bin:$PATH"
+          python -m devx.tools.install_tools --tool tea
+          tea login add --name devx --url "${{ github.server_url }}" --token "$REPO_TOKEN" || true
+          tea login default devx || true
+          python -m devx.ci.notify_failure \
+            --repo "${{ github.repository }}" \
+            --run-id "${{ github.run_id }}" \
+            --workflow "post-merge/configure-repo" \
+            --commit "${{ github.sha }}"

.gitea/workflows/publish.yml

@@ -0,0 +1,49 @@
+name: Publish Release
+
+on:
+  push:
+    tags:
+      - 'v*'
+
+jobs:
+  publish:
+    runs-on: docker
+    timeout-minutes: 10
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+      - name: Install dependencies
+        run: |
+          python3 -m pip install --break-system-packages build twine requests python-dotenv click
+          python3 -m pip install --break-system-packages -e .
+      - name: Install CI tools
+        run: |
+          export PATH="$HOME/.local/bin:$PATH"
+          python -m devx.tools.install_tools --tool git-cliff --tool tea
+      - name: Configure tea login
+        env:
+          REPO_TOKEN: ${{ secrets.REPO_TOKEN }}
+        run: |
+          export PATH="$HOME/.local/bin:$PATH"
+          tea login add --name devx --url "${{ github.server_url }}" --token "$REPO_TOKEN" || true
+          tea login default devx || true
+      - name: Build and publish release
+        env:
+          REPO_TOKEN: ${{ secrets.REPO_TOKEN }}
+          PYTHONPATH: src
+        run: |
+          export PATH="$HOME/.local/bin:$PATH"
+          python -m devx.ci.publish "${{ github.ref_name }}" "${{ github.repository }}"
+      - name: Notify on failure
+        if: failure()
+        env:
+          REPO_TOKEN: ${{ secrets.REPO_TOKEN }}
+          PYTHONPATH: src
+        run: |
+          export PATH="$HOME/.local/bin:$PATH"
+          python -m devx.ci.notify_failure \
+            --repo "${{ github.repository }}" \
+            --run-id "${{ github.run_id }}" \
+            --workflow "publish" \
+            --commit "${{ github.sha }}"