fix: read Gitea repo-variable data field; fail closed on unknown nightly status

get_repo_variable read the value field, but Gitea returns the payload in
data — every read returned None, so the nightly gate always treated real
status as bootstrap-allow (run 5800 recorded passed while integration
tests failed). Unknown non-empty statuses also allowed deploys; they now
block (fail closed).

Also backfills correct bg/de/pl/ru/zh translations across the catalog and
removes stray nested keys polluting every entry.

Generated with [Devin](https://devin.ai)

Co-Authored-By: Devin <158243242+devin-ai-integration[bot]@users.noreply.github.com>

docs/specs/DEVX-162.md

@@ -0,0 +1,55 @@
+# DEVX-162: Fix Gitea repo-variable read contract and fail closed on unknown nightly status
+
+## Problem
+
+`GiteaClient.get_repo_variable()` reads `body["value"]`, but the deployed
+Gitea returns the variable payload in the `data` field:
+
+```json
+{"owner_id":0,"repo_id":1,"name":"NIGHTLY_STATUS","data":"passed:5842","description":""}
+```
+
+Every read therefore returns `None`. `devx.ci.nightly_gate --action check`
+interprets `None` as "bootstrap — allow deploy," so a real `failed:<run>` status
+is invisible and the gate is permanently fail-open. Infra nightly run 5800 set
+`NIGHTLY_STATUS=passed:5800` while platform/customer integration tests were
+still failing — and even a correct `failed` value would have been ignored.
+
+Additionally, an unrecognized non-empty status currently allows deploys
+(fail-open instead of fail-closed).
+
+Verified against the live API: `POST`/`PUT` accept `{"value": ...}` and work;
+only the GET response uses `data`. The earlier `DEVX-162` spec (registry push
+race) is preserved as `DEVX-162-registry-push-race-historical.md`.
+
+## Approach
+
+1. `src/devx/api_clients.py` — `get_repo_variable` reads `data` first and falls
+   back to `value` for older server/fixture compatibility. Write path unchanged
+   (PUT/POST `{"value": ...}` verified live: 201/204).
+2. `src/devx/ci/nightly_gate.py` — unknown non-empty status blocks the deploy
+   (fail closed) instead of allowing it. Unset (bootstrap) still allows.
+3. Tests cover the `data` field, the `value` fallback, and fail-closed unknown
+   status.
+
+## Test Plan
+
+- `pytest tests/unit/test_api_clients.py tests/unit/test_nightly_gate.py`
+- `make lint-all` (ruff, pyright, bandit, translations)
+
+## Deploy Plan
+
+Merge via auto-merge; post-merge workflow publishes a new devx package to the
+Gitea PyPI registry and opens the infra dependency-bump PR automatically.
+
+## Rollback Plan
+
+Revert the commit; infra's pinned devx version keeps the previous behavior
+until the dependency PR lands.
+
+## Acceptance Criteria
+
+- [x] `get_repo_variable` returns the `data` field and falls back to `value`.
+- [x] Unknown nightly status exits non-zero and writes `nightly-gate-passed=false`.
+- [x] Unit tests cover `data`, `value` fallback and fail-closed unknown status.
+- [x] `make lint-all` and unit tests pass.

src/devx/api_clients.py

@@ -392,7 +392,10 @@ class GiteaClient:
         """
         try:
             r = self._request("GET", f"/actions/variables/{name}")
-            return r.json().get("value")
+            body = r.json()
+            if "data" in body:
+                return body["data"]
+            return body.get("value")
         except APIError as e:
             if e.status == 404:
                 return None

src/devx/ci/nightly_gate.py

@@ -97,10 +97,17 @@ def cli(repo: str, action: str, run_id: str, github_output: bool) -> None:
                 write_github_output("nightly-status", status)
             raise click.ClickException(_("Nightly gate failed — staging deploy blocked."))
         else:
-            click.echo(f"[nightly-gate] Unknown nightly status: {status} — allowing deploy.")
+            click.echo(
+                _(
+                    "[nightly-gate] Unknown nightly status: {status} — blocking deploy (fail closed).",
+                    status=status,
+                ),
+                err=True,
+            )
             if github_output:
-                write_github_output("nightly-gate-passed", "true")
+                write_github_output("nightly-gate-passed", "false")
                 write_github_output("nightly-status", status)
+            raise click.ClickException(_("Unknown nightly status — staging deploy blocked."))
 
     elif action == "set-passed":
         set_nightly_status(client, f"passed:{run_id}" if run_id else "passed")

tests/unit/test_api_clients.py

@@ -923,6 +923,12 @@ class TestGiteaClientActions:
         )
 
     def test_get_repo_variable_returns_value(self) -> None:
+        client = GiteaClient("https://git.example.com", "tok", "owner", "repo")
+        client._session.request = MagicMock(return_value=_mock_response({"data": "v0.28.1"}))
+        result = client.get_repo_variable("PRODUCTION_DEPLOY_TAG")
+        assert result == "v0.28.1"
+
+    def test_get_repo_variable_falls_back_to_value(self) -> None:
         client = GiteaClient("https://git.example.com", "tok", "owner", "repo")
         client._session.request = MagicMock(return_value=_mock_response({"value": "v0.28.1"}))
         result = client.get_repo_variable("PRODUCTION_DEPLOY_TAG")

tests/unit/test_nightly_gate.py

@@ -71,6 +71,17 @@ class TestCli:
         assert result.exit_code != 0
         assert "blocked" in result.output.lower()
 
+    @patch("devx.ci.nightly_gate.GiteaClient")
+    @patch("devx.ci.nightly_gate.get_ci_token")
+    def test_check_unknown_status_blocks_deploy(self, mock_token: MagicMock, mock_client_cls: MagicMock) -> None:
+        mock_token.return_value = "fake-token"
+        mock_client = mock_client_cls.return_value
+        mock_client.get_repo_variable.return_value = "garbage-value"
+        runner = CliRunner()
+        result = runner.invoke(cli, ["--repo", "oblachno/infra", "--action", "check"])
+        assert result.exit_code != 0
+        assert "fail closed" in result.output.lower()
+
     @patch("devx.ci.nightly_gate.GiteaClient")
     @patch("devx.ci.nightly_gate.get_ci_token")
     def test_set_passed(self, mock_token: MagicMock, mock_client_cls: MagicMock) -> None: