DEVX-126: ci: consolidate CI and post-merge workflows

AGENTS.md

@@ -50,7 +50,7 @@ Workflow YAML files (`.gitea/workflows/*.yml`) are verified with two tools:
 
 Both run via `make workflow-check` and are part of `make lint-all`.
 The pre-commit hook runs actionlint automatically when workflow files change.
-The CI `quality` job runs `make setup-quality` then `make lint-all`.
+The CI `validate` job runs `make setup-image` then `make lint-all`.
 CI also runs a best-effort `make workflow-dryrun` step (skipped if act_runner is not installed in the CI Docker image).
 
 ## Architecture
@@ -148,13 +148,13 @@ Every change to master goes through this workflow. No exceptions.
 ### Branch Protection (Required Gitea Settings)
 
 Branch protection and labels are automatically configured by
-`python -m devx.tools.configure_repo`, which runs as a `configure-repo` job in
-the post-merge workflow on every push to master.
+`python -m devx.tools.configure_repo`, which runs as a step in the
+`detect-and-configure` job in the post-merge workflow on every push to master.
 
 The following rules are enforced for `master`:
 - **Require pull request**: No direct pushes to master
 - **Require approval review**: At least 1 `APPROVE` review before merge
-- **Require status checks**: CI quality must pass
+- **Require status checks**: CI validate must pass
 - **Block force pushes**: No history rewriting on master
 
 ### 1. Create Vikunja Task
@@ -192,8 +192,9 @@ docs: update README
 
 ### 6. Review the PR
 
-**Automated review (CI `pr-review` job):** Every PR triggers an automated
-review via `python -m devx.ci.pr_review`. This job posts a review with
+**Automated review (CI `validate` job):** Every PR triggers an automated
+review via `python -m devx.ci.pr_review` as a step in the `validate` job.
+This posts a review with
 `COMMENT` (no issues) or `REQUEST_CHANGES` (issues found):
 
 - Architecture compliance (no subprocess in CLI, no hardcoded URLs)
@@ -216,7 +217,7 @@ Once all checklist items are verified and comments are addressed, approve
 the PR. Then add the `ready-to-merge` label. The auto-merge workflow will:
 1. **Validate** PR title format (`DEVX-N: <vikunja task title>`) and match against Vikunja task title
 2. **Check** that at least one substantive APPROVE review exists
-3. Wait for all CI checks to pass (including the `pr-review` job)
+3. Wait for all CI checks to pass (including the `validate` job)
 4. Squash-merge with title: `DEVX-N: <conventional commit message>`
 5. The post-merge workflow marks the Vikunja task as done
 6. The release workflow automatically versions, tags, and publishes
@@ -227,36 +228,27 @@ the PR. Then add the `ready-to-merge` label. The auto-merge workflow will:
 ### Automated Release Pipeline
 
 After a PR is merged to master, the **post-merge workflow**
-(`.gitea/workflows/post-merge.yml`) runs automatically:
+(`.gitea/workflows/post-merge.yml`) runs automatically. Consolidated
+into 2 jobs (from 7) to reduce runner overhead:
 
-1. **detect-type** — Checks if the commit is a regular merge or a
-   release commit (`release: vX.Y.Z`). All subsequent jobs skip for
-   release commits (except badges).
+1. **detect-and-configure** — Configures repo (branch protection, labels),
+   detects release commit, validates commit message. Outputs `is-release`
+   and `is-automated` for the next job.
 
-2. **release** — Runs `python -m devx.ci.release` which:
-   - Checks for user-facing changes via `python -m devx.ci.classify_changes`
-   - Uses **git-cliff** to calculate the next semver version from conventional commits
-   - Updates `__version__` in `src/devx/__init__.py` (single source of truth)
-   - Updates `CHANGELOG.md` with the new version section
-   - Runs `make lint-ruff` and `make pytest-cov` to verify the release is healthy
-   - Commits with `release: vX.Y.Z [skip ci]` prefix
-   - Creates an annotated tag `vX.Y.Z` on the release commit
-   - Pushes both the commit and tag to master
-
-3. **sync-wiki** — Syncs documentation to the Gitea wiki. Runs for ALL
-   non-release commits (not only when release succeeds), so docs-only
-   changes still update the wiki.
-
-4. **badges** — Generates and pushes quality badge SVGs to the `badges` branch.
-   Uses `if: always()` so it runs on every push, including release commits.
-
-5. **vikunja** — Marks the corresponding Vikunja task as done. Runs for ALL
-   non-release commits (not only when release succeeds), so infrastructure-only
-   changes still update the task tracker.
-
-6. **publish** — Runs after release succeeds (needs: release). Builds and
-   publishes the package to the Gitea PyPI registry. Gets the tag from the
-   release job's `tag` output (written via `GITHUB_OUTPUT`).
+2. **release-and-maintain** — Runs all post-merge maintenance as
+   conditional steps:
+   - **release** (if not a release commit) — Runs `python -m devx.ci.release`
+     which checks for user-facing changes via `classify_changes`, uses
+     git-cliff for semver, updates `__version__`, updates `CHANGELOG.md`,
+     runs lint+tests, commits with `release: vX.Y.Z [skip ci]`, creates
+     annotated tag, pushes to master.
+   - **publish** (if release created a tag) — Builds and publishes the
+     package to the Gitea PyPI registry. Checks out the release tag
+     within the same job.
+   - **sync-wiki** (if not automated) — Syncs documentation to the Gitea wiki.
+   - **vikunja** (if not automated) — Marks the corresponding Vikunja task as done.
+   - **badges** (always) — Generates and pushes quality badge SVGs to the
+     `badges` branch. Fetches latest master first to pick up release commits.
 
 ### Smart CI: User-Facing vs Workflow-Only Changes
 
@@ -362,12 +354,11 @@ dependency is skipped, even if the condition explicitly allows
 
 ```yaml
 auto-merge:
-  needs: [quality, detect-changes, pr-review, molecule-tests]
+  needs: [validate, molecule-tests]
   if: >-
     always() &&
     github.event_name == 'pull_request' &&
-    needs.quality.result == 'success' &&
-    needs.pr-review.result == 'success' &&
+    needs.validate.result == 'success' &&
     (needs.molecule-tests.result == 'success' || needs.molecule-tests.result == 'skipped')
 ```
 
@@ -505,9 +496,9 @@ to eliminate the 40-120s setup tax on every CI job:
 
 | Image | Contains | Used by jobs |
 |-------|----------|-------------|
-| `ci-base-latest` | Python 3.12 + devx[ci] + tea | detect-changes, detect-type, validate-commit-msg, pr-review, auto-merge, sync-wiki, vikunja, configure-repo |
-| `ci-quality-latest` | ci-base + devx[lint] + actionlint + checkmake + hadolint | quality, badges |
-| `ci-full-latest` | ci-quality + devx[release,molecule,deploy] + git-cliff + OpenTofu | release, publish, release-dry-run, molecule-tests, deploy jobs |
+| `ci-base-latest` | Python 3.12 + devx[ci] + tea | auto-merge, detect-and-configure |
+| `ci-quality-latest` | ci-base + devx[lint] + actionlint + checkmake + hadolint | (badges in release-and-maintain uses ci-full) |
+| `ci-full-latest` | ci-quality + devx[release,molecule,deploy] + git-cliff + OpenTofu | validate, release-and-maintain, molecule-tests, build-and-push |
 
 **Build process** (in `build-images.yml` workflow):
 1. `ci-base` builds FROM `gitea/runner-images:ubuntu-latest`
@@ -520,9 +511,9 @@ Each image is tagged `latest` and pushed to
 **Using images in workflows**:
 ```yaml
 jobs:
-  quality:
+  validate:
     runs-on: docker
-    container: git.oblachno.oblachno.fyi/oblachno-oss/runner-images/ci-quality:latest
+    container: git.oblachno.oblachno.fyi/oblachno-oss/runner-images/ci-full:latest
     steps:
       - uses: actions/checkout@v4
       - name: Set up environment
@@ -604,7 +595,7 @@ the user should not need to specify which profile to use.
 
 | Profile | Purpose |
 |---------|---------|
-| `ci-investigator` | Investigate CI failures (quality, release, publish, wiki sync, image build) |
+| `ci-investigator` | Investigate CI failures (validate, release-and-maintain, build-images) |
 | `dep-upgrader` | Python dependency upgrades in pyproject.toml with dep-doc validation |
 | `docker-image-builder` | Build/push/cleanup 3-tier runner images (ci-base, ci-quality, ci-full) |
 | `doc-sync-specialist` | Doc coverage, doc linting, wiki sync integrity |
@@ -614,7 +605,7 @@ the user should not need to specify which profile to use.
 
 | Trigger | Profile | Mode |
 |---------|---------|------|
-| CI run failure (quality, release, publish, sync-wiki, build-images) | `ci-investigator` | Background |
+| CI run failure (validate, release-and-maintain, build-images) | `ci-investigator` | Background |
 | PR ready for review | `pr-reviewer` | Foreground |
 | Dependency upgrade requested | `dep-upgrader` | Background |
 | Docker image build/push needed | `docker-image-builder` | Background |