release: v0.1.2 [skip ci]

.gitea/workflows/post-merge.yml

@@ -7,10 +7,15 @@ name: Post-merge
 # Job dependency graph:
 #
 #   detect-type ──┬── release (skip if release commit)
-#                 ├── sync-wiki (skip if release commit)
 #                 ├── badges (ALWAYS runs — even on release commits)
-#                 ├── vikunja (skip if release commit)
-#                 └── configure-repo (skip if release commit)
+#                 ├── configure-repo (independent — skip if release commit)
+#                 ├── sync-wiki (needs release — skip if release commit/fails)
+#                 └── vikunja (needs release — skip if release commit/fails)
+#
+# sync-wiki and vikunja depend on release succeeding so that the wiki
+# and task tracker are only updated when the code is actually released.
+# If release fails, they are skipped to avoid leaving the wiki or
+# Vikunja in an inconsistent state with the codebase on master.
 #
 # The badges job depends on release so it picks up the latest version
 # number. It uses `if: always()` with no is-release condition so it
@@ -106,7 +111,7 @@ jobs:
             --commit "${{ github.sha }}"
 
   sync-wiki:
-    needs: [detect-type]
+    needs: [detect-type, release]
     if: needs.detect-type.outputs.is-release == 'false'
     runs-on: docker
     timeout-minutes: 10
@@ -173,7 +178,7 @@ jobs:
             --commit "${{ github.sha }}"
 
   vikunja:
-    needs: [detect-type]
+    needs: [detect-type, release]
     if: needs.detect-type.outputs.is-release == 'false'
     runs-on: docker
     timeout-minutes: 10
@@ -221,7 +226,6 @@ jobs:
       - name: Ensure branch protection and labels
         env:
           REPO_TOKEN: ${{ secrets.REPO_TOKEN }}
-          DEVX_PUSH_WHITELIST: "emil"
           PYTHONPATH: src
         run: python3 -m devx.tools.configure_repo --repo devx --owner oblachno-oss
       - name: Notify on failure

.taskid

@@ -1 +1 @@
-DEVX-1
+DEVX-2

CHANGELOG.md

@@ -4,6 +4,10 @@ All notable changes to this project will be documented in this file.
 
 ## [0.1.0] - 2026-06-22
 
+## [0.1.0] - 2026-06-22
+
+## [0.1.0] - 2026-06-22
+
 ### Features
 
 - Extract reusable dev/CI tools from GRM into devx package

src/devx/tools/configure_repo.py

@@ -39,16 +39,15 @@ def _default_branch_protection_config() -> dict[str, Any]:
     environment variable (comma-separated) or default to just the quality
     check context.
 
-    The ``push_whitelist_usernames`` is read from ``DEVX_PUSH_WHITELIST``
-    (comma-separated) to allow the release bot to push directly to master.
+    Push whitelist is disabled — the release script pushes directly to
+    master (release commits). Since there are no manual reviews yet,
+    requiring PRs for every push adds complexity without benefit.
     """
-    push_whitelist = os.environ.get("DEVX_PUSH_WHITELIST", "")
-    whitelist = [u.strip() for u in push_whitelist.split(",") if u.strip()]
     return {
         "branch_name": "master",
         "enable_push": True,
-        "enable_push_whitelist": True,
-        "push_whitelist_usernames": whitelist,
+        "enable_push_whitelist": False,
+        "push_whitelist_usernames": [],
         "enable_status_check": True,
         "status_check_contexts": _default_status_checks(),
         "required_approvals": 0,

tests/unit/test_configure_repo.py

@@ -31,7 +31,7 @@ class TestDefaultConfigs:
         config = _default_branch_protection_config()
         assert config["branch_name"] == "master"
         assert config["enable_push"] is True
-        assert config["enable_push_whitelist"] is True
+        assert config["enable_push_whitelist"] is False
         assert config["required_approvals"] == 0
         assert isinstance(config["status_check_contexts"], list)
         assert "CI / quality (pull_request)" in config["status_check_contexts"]
@@ -45,16 +45,6 @@ class TestDefaultConfigs:
             config = _default_branch_protection_config()
             assert config["status_check_contexts"] == ["check1", "check2", "check3"]
 
-    def test_push_whitelist_from_env(self) -> None:
-        with patch.dict("os.environ", {"DEVX_PUSH_WHITELIST": "emil, alice"}):
-            config = _default_branch_protection_config()
-            assert config["push_whitelist_usernames"] == ["emil", "alice"]
-
-    def test_push_whitelist_empty_by_default(self) -> None:
-        with patch.dict("os.environ", {}, clear=True):
-            config = _default_branch_protection_config()
-            assert config["push_whitelist_usernames"] == []
-
 
 class TestConfigureRepo:
     @patch.dict("os.environ", {"REPO_TOKEN": "tok"}, clear=True)