release: v0.48.0 [skip ci]

Co-authored-by: emil User <emil.simeonov@tutanota.com>

.vale/styles/Google/AMPM.yml

@@ -1,9 +0,0 @@
-extends: existence
-message: "Use 'AM' or 'PM' (preceded by a space)."
-link: "https://developers.google.com/style/word-list"
-level: error
-nonword: true
-tokens:
-  - '\d{1,2}[AP]M\b'
-  - '\d{1,2} ?[ap]m\b'
-  - '\d{1,2} ?[aApP]\.[mM]\.'

.vale/styles/Google/Acronyms.yml

@@ -1,64 +0,0 @@
-extends: conditional
-message: "Spell out '%s', if it's unfamiliar to the audience."
-link: 'https://developers.google.com/style/abbreviations'
-level: suggestion
-ignorecase: false
-# Ensures that the existence of 'first' implies the existence of 'second'.
-first: '\b([A-Z]{3,5})\b'
-second: '(?:\b[A-Z][a-z]+ )+\(([A-Z]{3,5})\)'
-# ... with the exception of these:
-exceptions:
-  - API
-  - ASP
-  - CLI
-  - CPU
-  - CSS
-  - CSV
-  - DEBUG
-  - DOM
-  - DPI
-  - FAQ
-  - GCC
-  - GDB
-  - GET
-  - GPU
-  - GTK
-  - GUI
-  - HTML
-  - HTTP
-  - HTTPS
-  - IDE
-  - JAR
-  - JSON
-  - JSX
-  - LESS
-  - LLDB
-  - NET
-  - NOTE
-  - NVDA
-  - OSS
-  - PATH
-  - PDF
-  - PHP
-  - POST
-  - RAM
-  - REPL
-  - RSA
-  - SCM
-  - SCSS
-  - SDK
-  - SQL
-  - SSH
-  - SSL
-  - SVG
-  - TBD
-  - TCP
-  - TODO
-  - URI
-  - URL
-  - USB
-  - UTF
-  - XML
-  - XSS
-  - YAML
-  - ZIP

.vale/styles/Google/Colons.yml

@@ -1,8 +0,0 @@
-extends: existence
-message: "'%s' should be in lowercase."
-link: 'https://developers.google.com/style/colons'
-nonword: true
-level: warning
-scope: sentence
-tokens:
-  - '(?<!:[^ ]+?):\s[A-Z]'

.vale/styles/Google/Contractions.yml

@@ -1,30 +0,0 @@
-extends: substitution
-message: "Use '%s' instead of '%s'."
-link: 'https://developers.google.com/style/contractions'
-level: suggestion
-ignorecase: true
-action:
-  name: replace
-swap:
-  are not: aren't
-  cannot: can't
-  could not: couldn't
-  did not: didn't
-  do not: don't
-  does not: doesn't
-  has not: hasn't
-  have not: haven't
-  how is: how's
-  is not: isn't
-  it is: it's
-  should not: shouldn't
-  that is: that's
-  they are: they're
-  was not: wasn't
-  we are: we're
-  we have: we've
-  were not: weren't
-  what is: what's
-  when is: when's
-  where is: where's
-  will not: won't

.vale/styles/Google/DateFormat.yml

@@ -1,9 +0,0 @@
-extends: existence
-message: "Use 'July 31, 2016' format, not '%s'."
-link: 'https://developers.google.com/style/dates-times'
-ignorecase: true
-level: error
-nonword: true
-tokens:
-  - '\d{1,2}(?:\.|/)\d{1,2}(?:\.|/)\d{4}'
-  - '\d{1,2} (?:Jan(?:uary)?|Feb(?:ruary)?|Mar(?:ch)?|Apr(?:il)|May|Jun(?:e)|Jul(?:y)|Aug(?:ust)|Sep(?:tember)?|Oct(?:ober)|Nov(?:ember)?|Dec(?:ember)?) \d{4}'

.vale/styles/Google/Ellipses.yml

@@ -1,9 +0,0 @@
-extends: existence
-message: "In general, don't use an ellipsis."
-link: 'https://developers.google.com/style/ellipses'
-nonword: true
-level: warning
-action:
-  name: remove
-tokens:
-  - '\.\.\.'

.vale/styles/Google/EmDash.yml

@@ -1,13 +0,0 @@
-extends: existence
-message: "Don't put a space before or after a dash."
-link: "https://developers.google.com/style/dashes"
-nonword: true
-level: error
-action:
-  name: edit
-  params:
-    - trim
-    - " "
-tokens:
-  - '\s[—–]\s'
-

.vale/styles/Google/Exclamation.yml

@@ -1,12 +0,0 @@
-extends: existence
-message: "Don't use exclamation points in text."
-link: "https://developers.google.com/style/exclamation-points"
-nonword: true
-level: error
-action:
-  name: edit
-  params:
-    - trim_right
-    - "!"
-tokens:
-  - '\w+!(?:\s|$)'

.vale/styles/Google/FirstPerson.yml

@@ -1,13 +0,0 @@
-extends: existence
-message: "Avoid first-person pronouns such as '%s'."
-link: 'https://developers.google.com/style/pronouns#personal-pronouns'
-ignorecase: true
-level: warning
-nonword: true
-tokens:
-  - (?:^|\s)I\s
-  - (?:^|\s)I,\s
-  - \bI'm\b
-  - \bme\b
-  - \bmy\b
-  - \bmine\b

.vale/styles/Google/Gender.yml

@@ -1,9 +0,0 @@
-extends: existence
-message: "Don't use '%s' as a gender-neutral pronoun."
-link: 'https://developers.google.com/style/pronouns#gender-neutral-pronouns'
-level: error
-ignorecase: true
-tokens:
-  - he/she
-  - s/he
-  - \(s\)he

.vale/styles/Google/GenderBias.yml

@@ -1,43 +0,0 @@
-extends: substitution
-message: "Consider using '%s' instead of '%s'."
-ignorecase: true
-link: "https://developers.google.com/style/inclusive-documentation"
-level: error
-action:
-  name: replace
-swap:
-  (?:alumna|alumnus): graduate
-  (?:alumnae|alumni): graduates
-  air(?:m[ae]n|wom[ae]n): pilot(s)
-  anchor(?:m[ae]n|wom[ae]n): anchor(s)
-  authoress: author
-  camera(?:m[ae]n|wom[ae]n): camera operator(s)
-  door(?:m[ae]|wom[ae]n): concierge(s)
-  draft(?:m[ae]n|wom[ae]n): drafter(s)
-  fire(?:m[ae]n|wom[ae]n): firefighter(s)
-  fisher(?:m[ae]n|wom[ae]n): fisher(s)
-  fresh(?:m[ae]n|wom[ae]n): first-year student(s)
-  garbage(?:m[ae]n|wom[ae]n): waste collector(s)
-  lady lawyer: lawyer
-  ladylike: courteous
-  mail(?:m[ae]n|wom[ae]n): mail carriers
-  man and wife: husband and wife
-  man enough: strong enough
-  mankind: human kind|humanity
-  manmade: manufactured
-  manpower: personnel
-  middle(?:m[ae]n|wom[ae]n): intermediary
-  news(?:m[ae]n|wom[ae]n): journalist(s)
-  ombuds(?:man|woman): ombuds
-  oneupmanship: upstaging
-  poetess: poet
-  police(?:m[ae]n|wom[ae]n): police officer(s)
-  repair(?:m[ae]n|wom[ae]n): technician(s)
-  sales(?:m[ae]n|wom[ae]n): salesperson or sales people
-  service(?:m[ae]n|wom[ae]n): soldier(s)
-  steward(?:ess)?: flight attendant
-  tribes(?:m[ae]n|wom[ae]n): tribe member(s)
-  waitress: waiter
-  woman doctor: doctor
-  woman scientist[s]?: scientist(s)
-  work(?:m[ae]n|wom[ae]n): worker(s)

.vale/styles/Google/HeadingPunctuation.yml

@@ -1,13 +0,0 @@
-extends: existence
-message: "Don't put a period at the end of a heading."
-link: "https://developers.google.com/style/capitalization#capitalization-in-titles-and-headings"
-nonword: true
-level: warning
-scope: heading
-action:
-  name: edit
-  params:
-    - trim_right
-    - "."
-tokens:
-  - '[a-z0-9][.]\s*$'

.vale/styles/Google/Headings.yml

@@ -1,29 +0,0 @@
-extends: capitalization
-message: "'%s' should use sentence-style capitalization."
-link: "https://developers.google.com/style/capitalization#capitalization-in-titles-and-headings"
-level: warning
-scope: heading
-match: $sentence
-indicators:
-  - ":"
-exceptions:
-  - Azure
-  - CLI
-  - Cosmos
-  - Docker
-  - Emmet
-  - gRPC
-  - I
-  - Kubernetes
-  - Linux
-  - macOS
-  - Marketplace
-  - MongoDB
-  - REPL
-  - Studio
-  - TypeScript
-  - URLs
-  - Visual
-  - VS
-  - Windows
-  - JSON

.vale/styles/Google/Latin.yml

@@ -1,11 +0,0 @@
-extends: substitution
-message: "Use '%s' instead of '%s'."
-link: 'https://developers.google.com/style/abbreviations'
-ignorecase: true
-level: error
-nonword: true
-action:
-  name: replace
-swap:
-  '\b(?:eg|e\.g\.)(?=[\s,;])': for example
-  '\b(?:ie|i\.e\.)(?=[\s,;])': that is

.vale/styles/Google/LyHyphens.yml

@@ -1,14 +0,0 @@
-extends: existence
-message: "'%s' doesn't need a hyphen."
-link: "https://developers.google.com/style/hyphens"
-level: error
-ignorecase: false
-nonword: true
-action:
-  name: edit
-  params:
-    - regex
-    - "-"
-    - " "
-tokens:
-  - '\b[^\s-]+ly-\w+\b'

.vale/styles/Google/OptionalPlurals.yml

@@ -1,12 +0,0 @@
-extends: existence
-message: "Don't use plurals in parentheses such as in '%s'."
-link: "https://developers.google.com/style/plurals-parentheses"
-level: error
-nonword: true
-action:
-  name: edit
-  params:
-    - trim_right
-    - "(s)"
-tokens:
-  - '\b\w+\(s\)'

.vale/styles/Google/Ordinal.yml

@@ -1,7 +0,0 @@
-extends: existence
-message: "Spell out all ordinal numbers ('%s') in text."
-link: 'https://developers.google.com/style/numbers'
-level: error
-nonword: true
-tokens:
-  - \d+(?:st|nd|rd|th)

.vale/styles/Google/OxfordComma.yml

@@ -1,7 +0,0 @@
-extends: existence
-message: "Use the Oxford comma in '%s'."
-link: 'https://developers.google.com/style/commas'
-scope: sentence
-level: warning
-tokens:
-  - '(?:[^,]+,){1,}\s\w+\s(?:and|or)'

.vale/styles/Google/Parens.yml

@@ -1,7 +0,0 @@
-extends: existence
-message: "Use parentheses judiciously."
-link: 'https://developers.google.com/style/parentheses'
-nonword: true
-level: suggestion
-tokens:
-  - '\(.+\)'

.vale/styles/Google/Passive.yml

@@ -1,184 +0,0 @@
-extends: existence
-link: 'https://developers.google.com/style/voice'
-message: "In general, use active voice instead of passive voice ('%s')."
-ignorecase: true
-level: suggestion
-raw:
-  - \b(am|are|were|being|is|been|was|be)\b\s*
-tokens:
-  - '[\w]+ed'
-  - awoken
-  - beat
-  - become
-  - been
-  - begun
-  - bent
-  - beset
-  - bet
-  - bid
-  - bidden
-  - bitten
-  - bled
-  - blown
-  - born
-  - bought
-  - bound
-  - bred
-  - broadcast
-  - broken
-  - brought
-  - built
-  - burnt
-  - burst
-  - cast
-  - caught
-  - chosen
-  - clung
-  - come
-  - cost
-  - crept
-  - cut
-  - dealt
-  - dived
-  - done
-  - drawn
-  - dreamt
-  - driven
-  - drunk
-  - dug
-  - eaten
-  - fallen
-  - fed
-  - felt
-  - fit
-  - fled
-  - flown
-  - flung
-  - forbidden
-  - foregone
-  - forgiven
-  - forgotten
-  - forsaken
-  - fought
-  - found
-  - frozen
-  - given
-  - gone
-  - gotten
-  - ground
-  - grown
-  - heard
-  - held
-  - hidden
-  - hit
-  - hung
-  - hurt
-  - kept
-  - knelt
-  - knit
-  - known
-  - laid
-  - lain
-  - leapt
-  - learnt
-  - led
-  - left
-  - lent
-  - let
-  - lighted
-  - lost
-  - made
-  - meant
-  - met
-  - misspelt
-  - mistaken
-  - mown
-  - overcome
-  - overdone
-  - overtaken
-  - overthrown
-  - paid
-  - pled
-  - proven
-  - put
-  - quit
-  - read
-  - rid
-  - ridden
-  - risen
-  - run
-  - rung
-  - said
-  - sat
-  - sawn
-  - seen
-  - sent
-  - set
-  - sewn
-  - shaken
-  - shaven
-  - shed
-  - shod
-  - shone
-  - shorn
-  - shot
-  - shown
-  - shrunk
-  - shut
-  - slain
-  - slept
-  - slid
-  - slit
-  - slung
-  - smitten
-  - sold
-  - sought
-  - sown
-  - sped
-  - spent
-  - spilt
-  - spit
-  - split
-  - spoken
-  - spread
-  - sprung
-  - spun
-  - stolen
-  - stood
-  - stridden
-  - striven
-  - struck
-  - strung
-  - stuck
-  - stung
-  - stunk
-  - sung
-  - sunk
-  - swept
-  - swollen
-  - sworn
-  - swum
-  - swung
-  - taken
-  - taught
-  - thought
-  - thrived
-  - thrown
-  - thrust
-  - told
-  - torn
-  - trodden
-  - understood
-  - upheld
-  - upset
-  - wed
-  - wept
-  - withheld
-  - withstood
-  - woken
-  - won
-  - worn
-  - wound
-  - woven
-  - written
-  - wrung

.vale/styles/Google/Periods.yml

@@ -1,7 +0,0 @@
-extends: existence
-message: "Don't use periods with acronyms or initialisms such as '%s'."
-link: 'https://developers.google.com/style/abbreviations'
-level: error
-nonword: true
-tokens:
-  - '\b(?:[A-Z]\.){3,}'

.vale/styles/Google/Quotes.yml

@@ -1,7 +0,0 @@
-extends: existence
-message: "Commas and periods go inside quotation marks."
-link: 'https://developers.google.com/style/quotation-marks'
-level: error
-nonword: true
-tokens:
-  - '"[^"]+"[.,?]'

.vale/styles/Google/Ranges.yml

@@ -1,7 +0,0 @@
-extends: existence
-message: "Don't add words such as 'from' or 'between' to describe a range of numbers."
-link: 'https://developers.google.com/style/hyphens'
-nonword: true
-level: warning
-tokens:
-  - '(?:from|between)\s\d+\s?-\s?\d+'

.vale/styles/Google/Semicolons.yml

@@ -1,8 +0,0 @@
-extends: existence
-message: "Use semicolons judiciously."
-link: 'https://developers.google.com/style/semicolons'
-nonword: true
-scope: sentence
-level: suggestion
-tokens:
-  - ';'

.vale/styles/Google/Slang.yml

@@ -1,11 +0,0 @@
-extends: existence
-message: "Don't use internet slang abbreviations such as '%s'."
-link: 'https://developers.google.com/style/abbreviations'
-ignorecase: true
-level: error
-tokens:
-  - 'tl;dr'
-  - ymmv
-  - rtfm
-  - imo
-  - fwiw

.vale/styles/Google/Spacing.yml

@@ -1,10 +0,0 @@
-extends: existence
-message: "'%s' should have one space."
-link: 'https://developers.google.com/style/sentence-spacing'
-level: error
-nonword: true
-action:
-  name: remove
-tokens:
-  - '[a-z][.?!] {2,}[A-Z]'
-  - '[a-z][.?!][A-Z]'

.vale/styles/Google/Spelling.yml

@@ -1,10 +0,0 @@
-extends: existence
-message: "In general, use American spelling instead of '%s'."
-link: 'https://developers.google.com/style/spelling'
-ignorecase: true
-level: warning
-tokens:
-  - '(?:\w+)nised?'
-  - 'colour'
-  - 'labour'
-  - 'centre'

.vale/styles/Google/Units.yml

@@ -1,8 +0,0 @@
-extends: existence
-message: "Put a nonbreaking space between the number and the unit in '%s'."
-link: "https://developers.google.com/style/units-of-measure"
-nonword: true
-level: error
-tokens:
-  - \b\d+(?:B|kB|MB|GB|TB)
-  - \b\d+(?:ns|ms|s|min|h|d)

.vale/styles/Google/We.yml

@@ -1,11 +0,0 @@
-extends: existence
-message: "Try to avoid using first-person plural like '%s'."
-link: 'https://developers.google.com/style/pronouns#personal-pronouns'
-level: warning
-ignorecase: true
-tokens:
-  - we
-  - we'(?:ve|re)
-  - ours?
-  - us
-  - let's

.vale/styles/Google/Will.yml

@@ -1,7 +0,0 @@
-extends: existence
-message: "Avoid using '%s'."
-link: 'https://developers.google.com/style/tense'
-ignorecase: true
-level: warning
-tokens:
-  - will

.vale/styles/Google/WordList.yml

@@ -1,80 +0,0 @@
-extends: substitution
-message: "Use '%s' instead of '%s'."
-link: "https://developers.google.com/style/word-list"
-level: warning
-ignorecase: false
-action:
-  name: replace
-swap:
-  "(?:API Console|dev|developer) key": API key
-  "(?:cell ?phone|smart ?phone)": phone|mobile phone
-  "(?:dev|developer|APIs) console": API console
-  "(?:e-mail|Email|E-mail)": email
-  "(?:file ?path|path ?name)": path
-  "(?:kill|terminate|abort)": stop|exit|cancel|end
-  "(?:OAuth ?2|Oauth)": OAuth 2.0
-  "(?:ok|Okay)": OK|okay
-  "(?:WiFi|wifi)": Wi-Fi
-  '[\.]+apk': APK
-  '3\-D': 3D
-  'Google (?:I\-O|IO)': Google I/O
-  "tap (?:&|and) hold": touch & hold
-  "un(?:check|select)": clear
-  above: preceding
-  account name: username
-  action bar: app bar
-  admin: administrator
-  Ajax: AJAX
-  a\.k\.a|aka: or|also known as
-  Android device: Android-powered device
-  android: Android
-  API explorer: APIs Explorer
-  application: app
-  approx\.: approximately
-  authN: authentication
-  authZ: authorization
-  autoupdate: automatically update
-  cellular data: mobile data
-  cellular network: mobile network
-  chapter: documents|pages|sections
-  check box: checkbox
-  CLI: command-line tool
-  click on: click|click in
-  Cloud: Google Cloud Platform|GCP
-  Container Engine: Kubernetes Engine
-  content type: media type
-  curated roles: predefined roles
-  data are: data is
-  Developers Console: Google API Console|API Console
-  disabled?: turn off|off
-  ephemeral IP address: ephemeral external IP address
-  fewer data: less data
-  file name: filename
-  firewalls: firewall rules
-  functionality: capability|feature
-  Google account: Google Account
-  Google accounts: Google Accounts
-  Googling: search with Google
-  grayed-out: unavailable
-  HTTPs: HTTPS
-  in order to: to
-  ingest: import|load
-  k8s: Kubernetes
-  long press: touch & hold
-  network IP address: internal IP address
-  omnibox: address bar
-  open-source: open source
-  overview screen: recents screen
-  regex: regular expression
-  SHA1: SHA-1|HAS-SHA1
-  sign into: sign in to
-  sign-?on: single sign-on
-  static IP address: static external IP address
-  stylesheet: style sheet
-  synch: sync
-  tablename: table name
-  tablet: device
-  touch: tap
-  url: URL
-  vs\.: versus
-  World Wide Web: web

AGENTS.md

@@ -71,7 +71,7 @@ src/devx/
 ├── translations.json    # Translation strings (en, bg, de, pl, ru, zh)
 ├── ci/                  # CI/CD automation modules (run by workflows)
 │   ├── release.py       # Automated versioning, tagging, changelog
-│   ├── publish.py       # Build and publish to Gitea PyPI registry (--skip-build for non-Python repos)
+│   ├── publish.py       # Build, publish to Gitea PyPI registry, create Gitea release (with retry)
 │   ├── auto_merge.py    # Squash-merge PRs with task ID validation
 │   ├── check_auto_merge_ready.py  # Pre-merge validation gate (branch, PR title, Vikunja, behind-master)
 │   ├── _shared.py      # Shared utilities (get_latest_tag)
@@ -310,6 +310,20 @@ by `python -m devx.tools.install_tools` and configured by
 - `create_pr()` / `merge_pr()` / `review_pr()` — Pull request operations
 - `create_release()` / `list_releases()` — Release management
 
+**`devx.gitea_cli.configure_tea_login()`** — Configures tea login in
+containerized CI environments where `make setup` was not called. Used by
+`publish.py` (`--auto-login`) and `notify_failure.py` (`--auto-login`).
+Raises `TeaCLIError` if login configuration fails — this prevents cryptic
+"no available login" errors from subsequent tea commands.
+
+**Error handling**: `TeaCLI._run()` includes both stdout and stderr in
+`TeaCLIError` messages, because `tea` writes some errors (for example,
+"no available login") to stdout, not stderr.
+
+**Release creation retry**: `publish.py` retries Gitea release creation
+up to 3 times with exponential backoff (2s, 4s) on transient failures.
+"Already exists" errors are treated as success (idempotent).
+
 ### git-cliff Commit Preprocessing
 
 Merge commits on master have the format `DEVX-N: <conventional commit>`. The

CHANGELOG.md

@@ -2,6 +2,72 @@
 
 All notable changes to this project will be documented in this file.
 
+## [0.48.0] - 2026-08-08
+
+### Features
+
+- *(setup)* Mirror Ansible collections from Gitea registry with auth
+
+## [0.47.10] - 2026-08-05
+
+### Bug Fixes
+
+- Unique molecule container names per CI runner
+
+## [0.47.9] - 2026-08-03
+
+### Bug Fixes
+
+- Unique molecule container names per CI runner
+
+## [0.47.8] - 2026-08-03
+
+### Bug Fixes
+
+- Increase CI_SCALE_FACTOR default from 4 to 6
+
+## [0.47.7] - 2026-08-03
+
+### Bug Fixes
+
+- Scale check_test_speed limits on CI runners
+
+## [0.47.6] - 2026-08-03
+
+### Bug Fixes
+
+- Configure git auth in setup_image for git+https deps
+
+## [0.47.5] - 2026-08-03
+
+### Bug Fixes
+
+- Push wiki to main branch instead of master
+
+## [0.47.4] - 2026-08-03
+
+### Bug Fixes
+
+- Add User-Agent header to _download in install_tools
+
+## [0.47.3] - 2026-07-17
+
+### Bug Fixes
+
+- Bake promtool into ci-full image, add download timeout, speed up tests
+
+## [0.47.2] - 2026-07-17
+
+### Bug Fixes
+
+- Add retry logic to TeaCLI for transient HTTP errors (502/503/504/429)
+
+## [0.47.1] - 2026-07-16
+
+### Bug Fixes
+
+- Tea CLI login failure handling, error messages, release retry
+
 ## [0.47.0] - 2026-07-14
 
 ### Features

README.md

@@ -16,12 +16,12 @@ quality badges.
 
 [![CI](https://git.oblachno.oblachno.fyi/oblachno-oss/devx/actions/workflows/ci.yml/badge.svg)](https://git.oblachno.oblachno.fyi/oblachno-oss/devx/actions)
 [![License: GPL-3.0](https://img.shields.io/badge/license-GPL--3.0-blue)](https://git.oblachno.oblachno.fyi/oblachno-oss/devx/src/branch/master/LICENSE)
-[![Coverage](https://git.oblachno.oblachno.fyi/oblachno-oss/devx/raw/commit/7502419923835a8aeaa5b6de655b63a1b83cc816/coverage.svg)](https://git.oblachno.oblachno.fyi/oblachno-oss/devx/actions)
-[![Tests](https://git.oblachno.oblachno.fyi/oblachno-oss/devx/raw/commit/7502419923835a8aeaa5b6de655b63a1b83cc816/tests.svg)](https://git.oblachno.oblachno.fyi/oblachno-oss/devx/actions)
-[![Docs](https://git.oblachno.oblachno.fyi/oblachno-oss/devx/raw/commit/7502419923835a8aeaa5b6de655b63a1b83cc816/docs.svg)](https://git.oblachno.oblachno.fyi/oblachno-oss/devx/wiki)
-[![Code Quality](https://git.oblachno.oblachno.fyi/oblachno-oss/devx/raw/commit/7502419923835a8aeaa5b6de655b63a1b83cc816/quality.svg)](https://git.oblachno.oblachno.fyi/oblachno-oss/devx/actions)
-[![Version](https://git.oblachno.oblachno.fyi/oblachno-oss/devx/raw/commit/7502419923835a8aeaa5b6de655b63a1b83cc816/version.svg)](https://git.oblachno.oblachno.fyi/oblachno-oss/devx/releases)
-[![Python](https://git.oblachno.oblachno.fyi/oblachno-oss/devx/raw/commit/7502419923835a8aeaa5b6de655b63a1b83cc816/python.svg)](https://www.python.org/downloads/)
+[![Coverage](https://git.oblachno.oblachno.fyi/oblachno-oss/devx/raw/commit/8cca99efebc53b4a55839dec0e715a4bfcf5350a/coverage.svg)](https://git.oblachno.oblachno.fyi/oblachno-oss/devx/actions)
+[![Tests](https://git.oblachno.oblachno.fyi/oblachno-oss/devx/raw/commit/8cca99efebc53b4a55839dec0e715a4bfcf5350a/tests.svg)](https://git.oblachno.oblachno.fyi/oblachno-oss/devx/actions)
+[![Docs](https://git.oblachno.oblachno.fyi/oblachno-oss/devx/raw/commit/8cca99efebc53b4a55839dec0e715a4bfcf5350a/docs.svg)](https://git.oblachno.oblachno.fyi/oblachno-oss/devx/wiki)
+[![Code Quality](https://git.oblachno.oblachno.fyi/oblachno-oss/devx/raw/commit/8cca99efebc53b4a55839dec0e715a4bfcf5350a/quality.svg)](https://git.oblachno.oblachno.fyi/oblachno-oss/devx/actions)
+[![Version](https://git.oblachno.oblachno.fyi/oblachno-oss/devx/raw/commit/8cca99efebc53b4a55839dec0e715a4bfcf5350a/version.svg)](https://git.oblachno.oblachno.fyi/oblachno-oss/devx/releases)
+[![Python](https://git.oblachno.oblachno.fyi/oblachno-oss/devx/raw/commit/8cca99efebc53b4a55839dec0e715a4bfcf5350a/python.svg)](https://www.python.org/downloads/)
 
 ## Why devx?
 
@@ -87,7 +87,7 @@ extra index and list devx in your dependencies:
 ```toml
 [project]
 dependencies = [
-    "devx>=0.47.0",
+    "devx>=0.48.0",
 ]
 
 [tool.pip]
@@ -101,8 +101,8 @@ pip install -e .
 ```
 
 > **Note:** If your project requires a specific devx version, pin it in
-> `dependencies` (for example, `"devx==0.47.0"`) or use a version constraint
-> (for example, `"devx>=0.47.0,<0.48"`).
+> `dependencies` (for example, `"devx==0.48.0"`) or use a version constraint
+> (for example, `"devx>=0.48.0,<0.49"`).
 
 ### Optional extras
 

docker/ci-full/Dockerfile

@@ -20,5 +20,6 @@ COPY . /tmp/devx
 RUN pip install --no-cache-dir /tmp/devx[release,molecule,deploy] \
     && rm -rf /tmp/devx
 
-# Install git-cliff (changelog generator for release job) and OpenTofu (for infra deploy jobs)
-RUN python3 -m devx.tools.install_tools --tool git-cliff --tool tofu
+# Install git-cliff (changelog generator for release job), OpenTofu (for infra deploy jobs),
+# and promtool (Prometheus rule validator — used by every infra CI run for alert validation)
+RUN python3 -m devx.tools.install_tools --tool git-cliff --tool tofu --tool promtool

docs/index.md

@@ -12,12 +12,12 @@ project to be reusable across all oblachno-oss repositories.
 
 [![CI](https://git.oblachno.oblachno.fyi/oblachno-oss/devx/actions/workflows/ci.yml/badge.svg)](https://git.oblachno.oblachno.fyi/oblachno-oss/devx/actions)
 [![License: GPL-3.0](https://img.shields.io/badge/license-GPL--3.0-blue)](https://git.oblachno.oblachno.fyi/oblachno-oss/devx/src/branch/master/LICENSE)
-[![Coverage](https://git.oblachno.oblachno.fyi/oblachno-oss/devx/raw/commit/7502419923835a8aeaa5b6de655b63a1b83cc816/coverage.svg)](https://git.oblachno.oblachno.fyi/oblachno-oss/devx/actions)
-[![Tests](https://git.oblachno.oblachno.fyi/oblachno-oss/devx/raw/commit/7502419923835a8aeaa5b6de655b63a1b83cc816/tests.svg)](https://git.oblachno.oblachno.fyi/oblachno-oss/devx/actions)
-[![Docs](https://git.oblachno.oblachno.fyi/oblachno-oss/devx/raw/commit/7502419923835a8aeaa5b6de655b63a1b83cc816/docs.svg)](https://git.oblachno.oblachno.fyi/oblachno-oss/devx/wiki)
-[![Code Quality](https://git.oblachno.oblachno.fyi/oblachno-oss/devx/raw/commit/7502419923835a8aeaa5b6de655b63a1b83cc816/quality.svg)](https://git.oblachno.oblachno.fyi/oblachno-oss/devx/actions)
-[![Version](https://git.oblachno.oblachno.fyi/oblachno-oss/devx/raw/commit/7502419923835a8aeaa5b6de655b63a1b83cc816/version.svg)](https://git.oblachno.oblachno.fyi/oblachno-oss/devx/releases)
-[![Python](https://git.oblachno.oblachno.fyi/oblachno-oss/devx/raw/commit/7502419923835a8aeaa5b6de655b63a1b83cc816/python.svg)](https://www.python.org/downloads/)
+[![Coverage](https://git.oblachno.oblachno.fyi/oblachno-oss/devx/raw/commit/8cca99efebc53b4a55839dec0e715a4bfcf5350a/coverage.svg)](https://git.oblachno.oblachno.fyi/oblachno-oss/devx/actions)
+[![Tests](https://git.oblachno.oblachno.fyi/oblachno-oss/devx/raw/commit/8cca99efebc53b4a55839dec0e715a4bfcf5350a/tests.svg)](https://git.oblachno.oblachno.fyi/oblachno-oss/devx/actions)
+[![Docs](https://git.oblachno.oblachno.fyi/oblachno-oss/devx/raw/commit/8cca99efebc53b4a55839dec0e715a4bfcf5350a/docs.svg)](https://git.oblachno.oblachno.fyi/oblachno-oss/devx/wiki)
+[![Code Quality](https://git.oblachno.oblachno.fyi/oblachno-oss/devx/raw/commit/8cca99efebc53b4a55839dec0e715a4bfcf5350a/quality.svg)](https://git.oblachno.oblachno.fyi/oblachno-oss/devx/actions)
+[![Version](https://git.oblachno.oblachno.fyi/oblachno-oss/devx/raw/commit/8cca99efebc53b4a55839dec0e715a4bfcf5350a/version.svg)](https://git.oblachno.oblachno.fyi/oblachno-oss/devx/releases)
+[![Python](https://git.oblachno.oblachno.fyi/oblachno-oss/devx/raw/commit/8cca99efebc53b4a55839dec0e715a4bfcf5350a/python.svg)](https://www.python.org/downloads/)
 
 ## Overview
 
@@ -74,14 +74,14 @@ Add devx to your `pyproject.toml` dependencies and configure the registry:
 ```toml
 [project]
 dependencies = [
-    "devx>=0.47.0",
+    "devx>=0.48.0",
 ]
 
 [tool.pip]
 extra-index-url = "https://git.oblachno.oblachno.fyi/api/packages/oblachno-oss/pypi/simple"
 ```
 
-Pin a specific version if needed: `"devx==0.47.0"` or `"devx>=0.47.0,<0.48"`.
+Pin a specific version if needed: `"devx==0.48.0"` or `"devx>=0.48.0,<0.49"`.
 
 ### Optional extras
 

docs/user/getting-started.md

@@ -48,12 +48,12 @@ Add devx to your `pyproject.toml`:
 ```toml
 [project]
 dependencies = [
-    "devx>=0.47.0",
+    "devx>=0.48.0",
 ]
 
 [project.optional-dependencies]
 dev = [
-    "devx>=0.47.0",
+    "devx>=0.48.0",
 ]
 ```
 

src/devx/__init__.py

@@ -1,3 +1,3 @@
 """devx — reusable development and CI/CD tools for oblachno-oss projects."""
 
-__version__ = "0.47.0"
+__version__ = "0.48.0"

src/devx/ci/publish.py

@@ -4,6 +4,10 @@
 Uses git-cliff to generate the release notes from conventional commits.
 Uses the ``tea`` Gitea CLI for release creation.
 
+Gitea release creation is retried up to 3 times with exponential backoff
+(2s, 4s) to handle transient failures (network timeouts, 5xx errors).
+If the release already exists, it is treated as success (idempotent).
+
 Publishing destinations (checked in order):
   1. **Gitea PyPI registry** — if ``--registry-url`` is given (or
      ``DEVX_PYPI_REGISTRY_URL`` env var is set, or ``GITEA_API_URL``
@@ -27,6 +31,7 @@ from pathlib import Path
 
 import click
 from dotenv import load_dotenv  # pyright: ignore[reportMissingImports,reportUnknownVariableType]
+from tenacity import retry, retry_if_exception_type, stop_after_attempt, wait_exponential
 
 from devx.config import GITEA_API_URL, REPO_OWNER
 from devx.gitea_cli import TeaCLI, TeaCLIError, configure_tea_login
@@ -312,13 +317,7 @@ def main(
 
     release_body = generate_release_notes(tag)
 
-    try:
-        tea.create_release(repo, tag=tag, title=tag, body=release_body)
-    except TeaCLIError as e:
-        if "already" in str(e).lower() and "release" in str(e).lower():
-            click.echo(_("Gitea release {tag} already exists — skipping creation.", tag=tag))
-            return
-        raise click.ClickException(_("Release creation failed: {error}", error=str(e))) from None
+    _create_release_with_retry(tea, repo, tag, release_body)
 
     click.echo(
         _(
@@ -328,5 +327,36 @@ def main(
     )
 
 
+def _create_release_with_retry(tea: TeaCLI, repo: str, tag: str, release_body: str) -> None:
+    """Create a Gitea release with retry for transient failures.
+
+    Retries up to 3 times with exponential backoff (2s, 4s) on TeaCLIError
+    unless the error indicates the release already exists (which is treated
+    as success). This handles transient issues like network timeouts, Gitea
+    rate limiting, or temporary 5xx errors that caused CI run #2822 to fail.
+    """
+
+    @retry(
+        stop=stop_after_attempt(3),
+        wait=wait_exponential(multiplier=2, min=2, max=10),
+        retry=retry_if_exception_type(TeaCLIError),
+        reraise=True,
+    )
+    def _attempt() -> None:
+        try:
+            tea.create_release(repo, tag=tag, title=tag, body=release_body)
+        except TeaCLIError as e:
+            error_str = str(e).lower()
+            if "already" in error_str and "release" in error_str:
+                click.echo(_("Gitea release {tag} already exists — skipping creation.", tag=tag))
+                return
+            raise
+
+    try:
+        _attempt()
+    except TeaCLIError as e:
+        raise click.ClickException(_("Release creation failed: {error}", error=str(e))) from None
+
+
 if __name__ == "__main__":  # pragma: no cover
     main()

src/devx/ci/sync_wiki.py

@@ -252,7 +252,7 @@ def commit_and_push(wiki_dir: Path, wiki_url: str, dry_run: bool) -> bool:
 
     # Push
     result = subprocess.run(  # nosec
-        ["git", "push", "--force", wiki_url, "HEAD:master"],
+        ["git", "push", "--force", wiki_url, "HEAD:main"],
         cwd=wiki_dir,
         capture_output=True,
         text=True,

src/devx/gitea_cli.py

@@ -40,27 +40,46 @@ Usage::
 from __future__ import annotations
 
 import json
+import logging
 import shutil
 import subprocess  # nosec B404
 from typing import Any
 
 import click
+from tenacity import (
+    before_sleep_log,
+    retry,
+    retry_if_exception_type,
+    stop_after_attempt,
+    wait_exponential,
+)
 
-from devx.config import GITEA_API_URL
+from devx.config import GITEA_API_URL, MAX_RETRIES, RETRY_BACKOFF_BASE, RETRY_STATUS_CODES
 from devx.i18n import _
 from devx.tokens import get_ci_token
 
+logger = logging.getLogger("gitea_cli")
+
 
 class TeaCLIError(Exception):
     """Raised when a tea CLI command fails."""
 
 
+class _TransientTeaError(TeaCLIError):
+    """Tea CLI error caused by a transient HTTP status (502/503/504/429)."""
+
+
 def configure_tea_login(login_name: str = "devx") -> None:
     """Configure tea CLI login from CI_GITEA_API_TOKEN and DEVX_GITEA_API_URL.
 
     Idempotent: if a login with the same name already exists, it is not re-added.
     Skips silently if tea is not installed or no token is set.
 
+    Raises ``TeaCLIError`` if the login add or default command fails. This is
+    critical because subsequent tea commands (e.g. ``releases create``) will
+    fail with a cryptic "no available login" error if the login was not
+    configured successfully.
+
     Used by CI scripts (publish, notify_failure) that need tea login but
     run in containerized environments where ``make setup`` was not called.
     """
@@ -88,18 +107,31 @@ def configure_tea_login(login_name: str = "devx") -> None:
         return
 
     click.echo(_("Configuring tea login '{name}' for {url}...", name=login_name, url=gitea_url))
-    subprocess.run(  # nosec B603
+    add_result = subprocess.run(  # nosec B603
         [tea_bin, "login", "add", "--name", login_name, "--url", gitea_url, "--token", token],
         capture_output=True,
         text=True,
         check=False,
     )
-    subprocess.run(  # nosec B603
+    if add_result.returncode != 0:
+        raise TeaCLIError(
+            f"tea login add failed (rc={add_result.returncode})\n"
+            f"stdout: {add_result.stdout.strip()}\n"
+            f"stderr: {add_result.stderr.strip()}"
+        )
+
+    default_result = subprocess.run(  # nosec B603
         [tea_bin, "login", "default", login_name],
         capture_output=True,
         text=True,
         check=False,
     )
+    if default_result.returncode != 0:
+        raise TeaCLIError(
+            f"tea login default failed (rc={default_result.returncode})\n"
+            f"stdout: {default_result.stdout.strip()}\n"
+            f"stderr: {default_result.stderr.strip()}"
+        )
 
 
 class TeaCLI:
@@ -122,6 +154,10 @@ class TeaCLI:
     def _run(self, args: list[str], json_output: bool = True) -> str:
         """Run a tea command and return stdout.
 
+        Retries up to ``MAX_RETRIES`` times on transient HTTP errors
+        (502/503/504/429) detected in stderr/stdout, with exponential
+        backoff. Non-transient errors fail immediately.
+
         Args:
             args: Command arguments (without the leading ``tea``).
             json_output: If True, append ``--output json`` to the command.
@@ -130,25 +166,50 @@ class TeaCLI:
             stdout as a string.
 
         Raises:
-            TeaCLIError: If the command fails.
+            TeaCLIError: If the command fails after retries are exhausted.
         """
         cmd = [self._tea, *args]
         if json_output:
             cmd.extend(["--output", "json"])
+
+        def _execute() -> str:
+            try:
+                result = subprocess.run(  # nosec B603
+                    cmd,
+                    capture_output=True,
+                    text=True,
+                    check=False,
+                )
+            except FileNotFoundError as e:
+                raise TeaCLIError(f"tea binary not found ('{self._tea}'). Install tea or add it to PATH.") from e
+            if result.returncode != 0:
+                parts = [
+                    f"tea command failed (rc={result.returncode}): {' '.join(args)}",
+                    f"stdout: {result.stdout.strip()}" if result.stdout.strip() else "",
+                    f"stderr: {result.stderr.strip()}" if result.stderr.strip() else "",
+                ]
+                msg = "\n".join(p for p in parts if p)
+                combined = f"{result.stdout} {result.stderr}".lower()
+                if any(str(code) in combined for code in RETRY_STATUS_CODES):
+                    raise _TransientTeaError(msg)
+                raise TeaCLIError(msg)
+            return result.stdout.strip()
+
+        retry_decorator = retry(
+            stop=stop_after_attempt(MAX_RETRIES),
+            wait=wait_exponential(
+                multiplier=RETRY_BACKOFF_BASE,
+                min=RETRY_BACKOFF_BASE,
+                max=RETRY_BACKOFF_BASE**MAX_RETRIES,
+            ),
+            retry=retry_if_exception_type(_TransientTeaError),
+            before_sleep=before_sleep_log(logger, logging.WARNING),
+            reraise=True,
+        )
         try:
-            result = subprocess.run(  # nosec B603
-                cmd,
-                capture_output=True,
-                text=True,
-                check=False,
-            )
-        except FileNotFoundError as e:
-            raise TeaCLIError(f"tea binary not found ('{self._tea}'). Install tea or add it to PATH.") from e
-        if result.returncode != 0:
-            raise TeaCLIError(
-                f"tea command failed (rc={result.returncode}): {' '.join(args)}\nstderr: {result.stderr.strip()}"
-            )
-        return result.stdout.strip()
+            return retry_decorator(_execute)()
+        except _TransientTeaError as e:
+            raise TeaCLIError(str(e)) from e
 
     def _run_raw(self, args: list[str]) -> str:
         """Run a tea command without JSON output and return stdout."""

src/devx/make/devx.mak

@@ -309,7 +309,7 @@ devx-lint: devx-lint-ruff devx-lint-format devx-typecheck devx-lint-bandit devx-
 # ── Testing ───────────────────────────────────────────────────────────────────
 
 devx-test-unit:
-	@$(DEVX_BIN)/pytest $(DEVX_TEST_PATHS) -q --no-cov
+	@$(DEVX_BIN)/pytest $(DEVX_TEST_PATHS) -q --no-cov -n 8
 
 devx-pytest-cov:
 	@$(DEVX_BIN)/pytest $(DEVX_TEST_PATHS) -n auto --cov=$(DEVX_COV_PKG) --cov-report=term-missing --cov-fail-under=100

src/devx/molecule/molecule_ci_guard.py

@@ -125,6 +125,11 @@ def build_env_for_pair(pair: str, base_env: dict[str, str]) -> dict[str, str]:
     """Build environment for a single molecule pair."""
     _role, _scenario, platform_name, platform_image, platform_command = parse_pair(pair)
     env = base_env.copy()
+    # Append runner index to platform name when running in CI matrix to avoid
+    # Docker container name conflicts when multiple runners share the same Docker host.
+    matrix_index = env.get("MATRIX_INDEX")
+    if matrix_index:
+        platform_name = f"{platform_name}-r{matrix_index}"
     env["MOLECULE_PLATFORM_NAME"] = platform_name
     env["MOLECULE_PLATFORM_IMAGE"] = platform_image
     if platform_command:
@@ -246,18 +251,62 @@ def cli(pairs: tuple[str, ...], roles_root: Path | None) -> None:
                             with contextlib.suppress(ProcessLookupError):
                                 os.killpg(os.getpgid(process.pid), signal.SIGKILL)
                             process.wait()
+                        # Clean up containers left behind by the killed test.
+                        click.echo(_("Cleaning up: running molecule destroy for {scenario}", scenario=scenario))
+                        destroy_cmd = ["molecule", "destroy"]
+                        if scenario != "default":
+                            destroy_cmd.extend(["-s", scenario])
+                        with contextlib.suppress(subprocess.SubprocessError, OSError):
+                            subprocess.run(  # nosec B603, B607
+                                destroy_cmd,
+                                cwd=str(cwd),
+                                env=env,
+                                check=False,
+                                capture_output=True,
+                                timeout=120,
+                            )
                         sys.exit(1)
                     time.sleep(1)
             except KeyboardInterrupt:
                 with contextlib.suppress(ProcessLookupError):
                     os.killpg(os.getpgid(process.pid), signal.SIGTERM)
                 process.wait()
+                # Clean up containers left behind by the interrupted test.
+                click.echo(_("Cleaning up: running molecule destroy for {scenario}", scenario=scenario))
+                destroy_cmd = ["molecule", "destroy"]
+                if scenario != "default":
+                    destroy_cmd.extend(["-s", scenario])
+                with contextlib.suppress(subprocess.SubprocessError, OSError):
+                    subprocess.run(  # nosec B603, B607
+                        destroy_cmd,
+                        cwd=str(cwd),
+                        env=env,
+                        check=False,
+                        capture_output=True,
+                        timeout=120,
+                    )
                 sys.exit(1)
 
             rc = process.returncode
 
             if rc != 0:
                 click.echo(_("FAILED: {pair} exited with code {code}", pair=pair, code=rc))
+                # Run molecule destroy to clean up containers left behind by the
+                # failed test. Without this, containers stay running and accumulate
+                # on the runner, consuming disk/memory and degrading CI performance.
+                click.echo(_("Cleaning up: running molecule destroy for {scenario}", scenario=scenario))
+                destroy_cmd = ["molecule", "destroy"]
+                if scenario != "default":
+                    destroy_cmd.extend(["-s", scenario])
+                with contextlib.suppress(subprocess.SubprocessError, OSError):
+                    subprocess.run(  # nosec B603, B607
+                        destroy_cmd,
+                        cwd=str(cwd),
+                        env=env,
+                        check=False,
+                        capture_output=True,
+                        timeout=120,
+                    )
                 sys.exit(rc)
 
             click.echo(_("PASSED: {pair}", pair=pair))

src/devx/tools/check_test_speed.py

@@ -11,6 +11,18 @@ Usage:
 The module runs ``make test-unit`` with ``PYTEST_ADDOPTS=--durations=0`` so
 that pytest emits per-test timing lines alongside the summary.  Both the
 total wall-clock time and individual test durations are parsed and validated.
+
+CI runner scaling
+-----------------
+CI runners (Gitea Actions Docker containers) are typically 5-8x slower than
+local development machines due to shared CPU, fewer cores, and container
+overhead.  When the ``CI`` environment variable is set (standard CI
+convention), both the total and per-test limits are multiplied by
+``CI_SCALE_FACTOR`` (default 6) to account for this.  This keeps the local
+budget strict while preventing false failures on slower CI runners.
+
+The scale factor can be overridden via the ``DEVX_CI_SCALE_FACTOR``
+environment variable.
 """
 
 from __future__ import annotations
@@ -27,6 +39,12 @@ DEFAULT_MAX_SECONDS = 10.0
 DEFAULT_MAX_SINGLE_SECONDS = 0.5
 TEST_COMMAND = ["make", "test-unit"]
 
+# CI runners are typically 5-8x slower than local machines (shared CPU,
+# fewer cores, container overhead).  Scale limits up when running on CI
+# so the gate catches real regressions, not infrastructure slowness.
+CI_SCALE_FACTOR = float(os.environ.get("DEVX_CI_SCALE_FACTOR", "6"))
+_IS_CI = bool(os.environ.get("CI") or os.environ.get("GITEA_ACTIONS"))
+
 # Matches pytest summary line: "234 passed in 0.70s"
 _TIMING_RE = re.compile(r"(\d+) passed.* in ([0-9.]+)s")
 
@@ -38,6 +56,13 @@ _TIMING_RE = re.compile(r"(\d+) passed.* in ([0-9.]+)s")
 _DURATION_LINE_RE = re.compile(r"^(\d+\.?\d*)s\s+call\s+(.+)$")
 
 
+def _ci_scale_limit(limit: float) -> float:
+    """Scale a time limit by the CI factor when running on CI."""
+    if _IS_CI:
+        return limit * CI_SCALE_FACTOR
+    return limit
+
+
 def run_tests() -> tuple[str, str]:
     """Execute the unit-test suite and return (stdout, stderr).
 
@@ -123,21 +148,38 @@ def check_per_test_speed(
 
 def main(max_seconds: float, max_single_seconds: float) -> None:
     """Run tests, parse timings, and enforce both budgets."""
+    # Scale limits for CI runners (slower CPU, fewer workers).
+    effective_max = _ci_scale_limit(max_seconds)
+    effective_single = _ci_scale_limit(max_single_seconds)
+
+    if _IS_CI:
+        click.echo(
+            _(
+                "[check-test-speed] CI environment detected — scaling limits by {factor}x "
+                "(total: {orig}s → {eff}s, per-test: {orig_s}s → {eff_s}s)",
+                factor=CI_SCALE_FACTOR,
+                orig=max_seconds,
+                eff=effective_max,
+                orig_s=max_single_seconds,
+                eff_s=effective_single,
+            )
+        )
+
     stdout, stderr = run_tests()
     combined = stdout + "\n" + stderr
     click.echo(combined, err=False)
 
     duration = parse_duration(combined)
-    check_speed(duration, max_seconds)
+    check_speed(duration, effective_max)
 
-    if max_single_seconds > 0:
+    if effective_single > 0:
         per_test = parse_per_test_durations(combined)
-        violations = check_per_test_speed(per_test, max_single_seconds)
+        violations = check_per_test_speed(per_test, effective_single)
         if violations:
             msg = _(
                 "Per-test speed check FAILED: {count} test(s) exceed {limit}s limit.",
                 count=len(violations),
-                limit=max_single_seconds,
+                limit=effective_single,
             )
             click.echo(f"\n{msg}", err=True)
             for v in violations:
@@ -148,8 +190,8 @@ def main(max_seconds: float, max_single_seconds: float) -> None:
         _(
             "Unit tests passed in {duration:.2f}s (under {max}s limit, all tests under {single}s per-test limit).",
             duration=duration,
-            max=max_seconds,
-            single=max_single_seconds,
+            max=effective_max,
+            single=effective_single,
         )
     )
 

src/devx/tools/install_tools.py

@@ -65,8 +65,14 @@ def _ensure_target_dir() -> Path:
 
 
 def _download(url: str, dest: Path) -> None:
-    """Download a file from ``url`` to ``dest``."""
-    urllib.request.urlretrieve(url, dest)  # nosec B310
+    """Download a file from ``url`` to ``dest`` with a 60s timeout.
+
+    A User-Agent header is set because some CDNs (e.g. dl.gitea.com)
+    return 403 to requests with Python's default User-Agent.
+    """
+    req = urllib.request.Request(url, headers={"User-Agent": "devx/install-tools"})
+    with urllib.request.urlopen(req, timeout=60) as resp, open(dest, "wb") as f:  # nosec B310
+        shutil.copyfileobj(resp, f)
 
 
 def _download_and_extract_tarball(url: str, binary_name: str) -> Path:

src/devx/tools/setup.py

@@ -15,6 +15,7 @@ from pathlib import Path
 
 import click
 from dotenv import load_dotenv  # pyright: ignore[reportMissingImports,reportUnknownVariableType]
+from tenacity import retry, stop_after_attempt, wait_exponential
 
 from devx.tokens import get_developer_token
 
@@ -56,13 +57,112 @@ def _install_pre_commit_hooks(bin_dir: str) -> None:
 
 
 def _install_ansible_collections(bin_dir: str) -> None:
-    """Install required Ansible Galaxy collections if requirements exist."""
+    """Install required Ansible Galaxy collections if requirements exist.
+
+    If the requirements file uses ``type: url`` entries pointing to the
+    Gitea package registry, downloads them with authentication (using
+    ``CI_GITEA_TOKEN`` / ``CI_GITEA_API_TOKEN``) and installs from local
+    files with ``--offline``.  Falls back to direct galaxy install if the
+    mirror download fails or no token is available.
+
+    Retries up to 3 times with exponential backoff to handle transient
+    network timeouts when contacting galaxy.ansible.com.
+    """
     galaxy = shutil.which("ansible-galaxy") or str(Path(bin_dir) / "ansible-galaxy")
     requirements = Path("ansible/requirements.yml")
     if not requirements.exists():
         click.echo("  ansible/requirements.yml not found — skipping collections.")
         return
-    _run([galaxy, "collection", "install", "-r", str(requirements)])
+
+    # Try Gitea mirror first if requirements use type: url
+    if _try_gitea_mirror_install(galaxy, requirements):
+        return
+
+    # Fall back to direct galaxy install with retries
+    @retry(stop=stop_after_attempt(3), wait=wait_exponential(multiplier=2, min=2, max=10), reraise=True)
+    def _do_install() -> None:
+        _run([galaxy, "collection", "install", "-r", str(requirements)])
+
+    _do_install()
+
+
+def _try_gitea_mirror_install(galaxy: str, requirements: Path) -> bool:
+    """Download ``type: url`` entries from Gitea with auth and install locally.
+
+    Returns ``True`` if the mirror install succeeded, ``False`` to fall back
+    to direct galaxy install.
+    """
+    import tempfile
+    import urllib.request  # noqa: PTH123  # nosec B404
+
+    import yaml  # pyright: ignore[reportMissingImports]
+
+    try:
+        data = yaml.safe_load(requirements.read_text())
+    except Exception:
+        return False
+
+    collections = data.get("collections", []) if data else []
+    url_entries = [c for c in collections if c.get("type") == "url"]
+    if not url_entries:
+        return False
+
+    # Resolve Gitea token for authenticated downloads
+    token = os.environ.get("CI_GITEA_API_TOKEN", "").strip()
+    if not token:
+        token = os.environ.get("CI_GITEA_TOKEN", "").strip()
+    if not token:
+        token = os.environ.get("DEVELOPER_GITEA_API_TOKEN", "").strip()
+    if not token:
+        click.echo("  No Gitea token found — falling back to galaxy.ansible.com")
+        return False
+
+    # Download each tarball with auth
+    tmpdir = Path(tempfile.mkdtemp(prefix="ansible-collections-"))
+    local_entries = []
+    try:
+        for entry in url_entries:
+            source = entry.get("source", "")
+            if "/api/packages/" not in source:
+                local_entries.append(entry)
+                continue
+            filename = source.rsplit("/", 1)[-1]
+            dest = tmpdir / filename
+            click.echo(f"  Downloading {entry.get('name', filename)} from Gitea mirror...")
+            req = urllib.request.Request(source)  # nosec B310
+            req.add_header("Authorization", f"token {token}")
+            try:
+                with urllib.request.urlopen(req, timeout=30) as resp:  # noqa: PTH123  # nosec B310
+                    dest.write_bytes(resp.read())
+            except Exception as e:
+                click.echo(f"  WARN: mirror download failed for {entry.get('name')}: {e}")
+                click.echo("  Falling back to galaxy.ansible.com")
+                return False
+            local_entries.append(
+                {
+                    "name": entry["name"],
+                    "version": entry.get("version"),
+                    "type": "file",
+                    "source": str(dest),
+                }
+            )
+
+        # Add non-url entries as-is
+        for entry in collections:
+            if entry.get("type") != "url":
+                local_entries.append(entry)
+
+        # Write local requirements file
+        local_req = tmpdir / "requirements.yml"
+        local_req.write_text(yaml.dump({"collections": local_entries}))
+
+        click.echo("  Installing collections from Gitea mirror (offline)...")
+        _run([galaxy, "collection", "install", "-r", str(local_req), "--offline"])
+        return True
+    finally:
+        import shutil as _shutil
+
+        _shutil.rmtree(tmpdir, ignore_errors=True)
 
 
 def _configure_tea_login() -> None:

src/devx/tools/setup_image.py

@@ -81,6 +81,17 @@ def _install_in_image(
             username,
             token,
         )
+        # Configure git URL rewrite so git+https dependencies can authenticate
+        subprocess.run(  # nosec B603, B607
+            [
+                "git",
+                "config",
+                "--global",
+                f"url.https://{username}:{token}@{gitea_host}/.insteadOf",
+                f"https://{gitea_host}/",
+            ],
+            check=True,
+        )
 
     click.echo(f"[setup-image] Linked {opt_venv}" + (f" with [{extras}]" if extras else "") + ".")
     subprocess.run(cmd, check=True, env=env)  # nosec B603

src/devx/translations.json

@@ -3822,5 +3822,21 @@
     "pl": "importlib.reload({mod}) called {n} time(s) in test '{test}' — odd count leaves module in modified state. Add a final reload to restore defaults or wrap in try/finally.",
     "ru": "importlib.reload({mod}) called {n} time(s) in test '{test}' — odd count leaves module in modified state. Add a final reload to restore defaults or wrap in try/finally.",
     "zh": "importlib.reload({mod}) called {n} time(s) in test '{test}' — odd count leaves module in modified state. Add a final reload to restore defaults or wrap in try/finally."
+  },
+  "[check-test-speed] CI environment detected — scaling limits by {factor}x (total: {orig}s → {eff}s, per-test: {orig_s}s → {eff_s}s)": {
+    "en": "[check-test-speed] CI environment detected — scaling limits by {factor}x (total: {orig}s → {eff}s, per-test: {orig_s}s → {eff_s}s)",
+    "bg": "[check-test-speed] CI environment detected — scaling limits by {factor}x (total: {orig}s → {eff}s, per-test: {orig_s}s → {eff_s}s)",
+    "de": "[check-test-speed] CI environment detected — scaling limits by {factor}x (total: {orig}s → {eff}s, per-test: {orig_s}s → {eff_s}s)",
+    "pl": "[check-test-speed] CI environment detected — scaling limits by {factor}x (total: {orig}s → {eff}s, per-test: {orig_s}s → {eff_s}s)",
+    "ru": "[check-test-speed] CI environment detected — scaling limits by {factor}x (total: {orig}s → {eff}s, per-test: {orig_s}s → {eff_s}s)",
+    "zh": "[check-test-speed] CI environment detected — scaling limits by {factor}x (total: {orig}s → {eff}s, per-test: {orig_s}s → {eff_s}s)"
+  },
+  "Cleaning up: running molecule destroy for {scenario}": {
+    "en": "Cleaning up: running molecule destroy for {scenario}",
+    "bg": "Изчистване: изпълнение на molecule destroy за {scenario}",
+    "de": "Aufräumen: molecule destroy wird ausgeführt für {scenario}",
+    "pl": "Czyszczenie: uruchamianie molecule destroy dla {scenario}",
+    "ru": "Очистка: запуск molecule destroy для {scenario}",
+    "zh": "清理：正在为 {scenario} 运行 molecule destroy"
   }
 }

tests/unit/test_check_test_speed.py

@@ -10,6 +10,7 @@ from devx.tools.check_test_speed import (
     DEFAULT_MAX_SECONDS,
     DEFAULT_MAX_SINGLE_SECONDS,
     TEST_COMMAND,
+    _ci_scale_limit,
     check_per_test_speed,
     check_speed,
     cli,
@@ -144,7 +145,26 @@ def test_main_module_block() -> None:
         mock_cli.assert_called_once_with([])
 
 
+class TestCiScaleLimit:
+    def test_no_scaling_when_not_ci(self) -> None:
+        with patch("devx.tools.check_test_speed._IS_CI", False):
+            assert _ci_scale_limit(10.0) == 10.0
+            assert _ci_scale_limit(0.5) == 0.5
+
+    def test_scales_when_ci(self) -> None:
+        with patch("devx.tools.check_test_speed._IS_CI", True):
+            with patch("devx.tools.check_test_speed.CI_SCALE_FACTOR", 4.0):
+                assert _ci_scale_limit(10.0) == 40.0
+                assert _ci_scale_limit(0.5) == 2.0
+
+    def test_custom_scale_factor(self) -> None:
+        with patch("devx.tools.check_test_speed._IS_CI", True):
+            with patch("devx.tools.check_test_speed.CI_SCALE_FACTOR", 2.5):
+                assert _ci_scale_limit(10.0) == 25.0
+
+
 class TestMain:
+    @patch("devx.tools.check_test_speed._IS_CI", False)
     @patch("devx.tools.check_test_speed.run_tests")
     @patch("devx.tools.check_test_speed.parse_duration")
     @patch("devx.tools.check_test_speed.check_speed")
@@ -174,6 +194,7 @@ class TestMain:
         mock_parse_per.assert_called_once()
         mock_check_per.assert_called_once_with([], DEFAULT_MAX_SINGLE_SECONDS)
 
+    @patch("devx.tools.check_test_speed._IS_CI", False)
     @patch("devx.tools.check_test_speed.run_tests")
     @patch("devx.tools.check_test_speed.parse_duration")
     def test_slow_total_exits(
@@ -189,6 +210,7 @@ class TestMain:
         assert result.exit_code == 1
         assert "too slow" in result.output.lower()
 
+    @patch("devx.tools.check_test_speed._IS_CI", False)
     @patch("devx.tools.check_test_speed.run_tests")
     @patch("devx.tools.check_test_speed.parse_duration")
     @patch("devx.tools.check_test_speed.check_speed")
@@ -213,6 +235,7 @@ class TestMain:
         assert "Per-test speed check FAILED" in result.output
         assert "test_slow" in result.output
 
+    @patch("devx.tools.check_test_speed._IS_CI", False)
     @patch("devx.tools.check_test_speed.run_tests")
     def test_parse_failure_exits(
         self,
@@ -225,6 +248,7 @@ class TestMain:
         assert result.exit_code == 1
         assert "Could not parse" in result.output
 
+    @patch("devx.tools.check_test_speed._IS_CI", False)
     @patch("devx.tools.check_test_speed.run_tests")
     @patch("devx.tools.check_test_speed.parse_duration")
     @patch("devx.tools.check_test_speed.check_speed")
@@ -248,6 +272,7 @@ class TestMain:
         assert result.exit_code == 0
         mock_check.assert_called_once_with(0.5, 1.5)
 
+    @patch("devx.tools.check_test_speed._IS_CI", False)
     @patch("devx.tools.check_test_speed.run_tests")
     @patch("devx.tools.check_test_speed.parse_duration")
     @patch("devx.tools.check_test_speed.check_speed")
@@ -270,6 +295,7 @@ class TestMain:
         mock_parse_per.assert_not_called()
         mock_check_per.assert_not_called()
 
+    @patch("devx.tools.check_test_speed._IS_CI", False)
     @patch("devx.tools.check_test_speed.run_tests")
     @patch("devx.tools.check_test_speed.parse_duration")
     @patch("devx.tools.check_test_speed.check_speed")
@@ -292,3 +318,32 @@ class TestMain:
         result = runner.invoke(cli, ["--max-single-seconds", "1.0"])
         assert result.exit_code == 0
         mock_check_per.assert_called_once_with([], 1.0)
+
+    @patch("devx.tools.check_test_speed._IS_CI", True)
+    @patch("devx.tools.check_test_speed.CI_SCALE_FACTOR", 4.0)
+    @patch("devx.tools.check_test_speed.run_tests")
+    @patch("devx.tools.check_test_speed.parse_duration")
+    @patch("devx.tools.check_test_speed.check_speed")
+    @patch("devx.tools.check_test_speed.parse_per_test_durations")
+    @patch("devx.tools.check_test_speed.check_per_test_speed")
+    def test_ci_scales_limits(
+        self,
+        mock_check_per: MagicMock,
+        mock_parse_per: MagicMock,
+        mock_check: MagicMock,
+        mock_parse: MagicMock,
+        mock_run: MagicMock,
+    ) -> None:
+        mock_run.return_value = ("out\n", "err\n")
+        mock_parse.return_value = 30.0  # would fail local (10s) but pass CI (40s)
+        mock_parse_per.return_value = []
+        mock_check_per.return_value = []
+
+        runner = CliRunner()
+        result = runner.invoke(cli, [])
+        assert result.exit_code == 0
+        assert "CI environment detected" in result.output
+        assert "scaling limits by 4.0x" in result.output
+        # check_speed called with scaled limit
+        mock_check.assert_called_once_with(30.0, 40.0)
+        mock_check_per.assert_called_once_with([], 2.0)

tests/unit/test_gitea_cli.py

@@ -1,4 +1,4 @@
-"""Unit tests for scripts/gitea_cli.py."""
+"""Unit tests for devx/gitea_cli.py."""
 
 from __future__ import annotations
 
@@ -7,7 +7,13 @@ from unittest.mock import MagicMock, patch
 
 import pytest
 
-from devx.gitea_cli import TeaCLI, TeaCLIError, _extract_issue_number, _extract_pr_number, configure_tea_login
+from devx.gitea_cli import (
+    TeaCLI,
+    TeaCLIError,
+    _extract_issue_number,
+    _extract_pr_number,
+    configure_tea_login,
+)
 
 
 class TestExtractIssueNumber:
@@ -77,6 +83,25 @@ class TestTeaCLIRun:
             with pytest.raises(TeaCLIError, match="auth error"):
                 cli._run(["labels", "list"])
 
+    def test_run_failure_includes_stdout(self) -> None:
+        """tea writes some errors to stdout (e.g. 'no available login')."""
+        cli = TeaCLI(tea_bin="/fake/tea")
+        mock_result = MagicMock(returncode=1, stdout="no available login", stderr="")
+        with patch("subprocess.run", return_value=mock_result):
+            with pytest.raises(TeaCLIError, match="no available login"):
+                cli._run(["releases", "create"])
+
+    def test_run_failure_includes_both_stdout_and_stderr(self) -> None:
+        """When both stdout and stderr have content, both are included."""
+        cli = TeaCLI(tea_bin="/fake/tea")
+        mock_result = MagicMock(returncode=1, stdout="partial error", stderr="auth error")
+        with patch("subprocess.run", return_value=mock_result):
+            with pytest.raises(TeaCLIError, match="partial error"):
+                cli._run(["labels", "list"])
+            with patch("subprocess.run", return_value=mock_result):
+                with pytest.raises(TeaCLIError, match="auth error"):
+                    cli._run(["labels", "list"])
+
     def test_run_tea_not_found_raises_tea_error(self) -> None:
         cli = TeaCLI(tea_bin="tea")
         with patch("subprocess.run", side_effect=FileNotFoundError("tea not found")):
@@ -100,6 +125,46 @@ class TestTeaCLIRun:
         cmd = mock_run.call_args[0][0]
         assert "--output" not in cmd
 
+    def test_run_retries_on_502(self) -> None:
+        """Transient 502 errors should be retried, then succeed."""
+        cli = TeaCLI(tea_bin="/fake/tea")
+        fail_result = MagicMock(returncode=1, stdout="", stderr="502 Bad Gateway")
+        success_result = MagicMock(returncode=0, stdout='[{"id": 1}]', stderr="")
+        with patch("subprocess.run", side_effect=[fail_result, success_result]) as mock_run:
+            with patch("tenacity.nap.time.sleep"):
+                output = cli._run(["labels", "list"])
+        assert output == '[{"id": 1}]'
+        assert mock_run.call_count == 2
+
+    def test_run_retries_on_503_then_fails(self) -> None:
+        """If all retries are exhausted on 503, raise TeaCLIError."""
+        cli = TeaCLI(tea_bin="/fake/tea")
+        fail_result = MagicMock(returncode=1, stdout="", stderr="503 Service Unavailable")
+        with patch("subprocess.run", return_value=fail_result):
+            with patch("tenacity.nap.time.sleep"):
+                with pytest.raises(TeaCLIError, match="503"):
+                    cli._run(["issues", "create"])
+        # MAX_RETRIES=3, so 3 attempts total
+
+    def test_run_no_retry_on_non_transient_error(self) -> None:
+        """Non-transient errors (e.g. auth) should fail immediately without retry."""
+        cli = TeaCLI(tea_bin="/fake/tea")
+        fail_result = MagicMock(returncode=1, stdout="", stderr="auth error")
+        with patch("subprocess.run", return_value=fail_result) as mock_run:
+            with pytest.raises(TeaCLIError, match="auth error"):
+                cli._run(["labels", "list"])
+        assert mock_run.call_count == 1
+
+    def test_run_retries_on_429_in_stdout(self) -> None:
+        """429 rate limit in stdout should trigger retry."""
+        cli = TeaCLI(tea_bin="/fake/tea")
+        fail_result = MagicMock(returncode=1, stdout="429 Too Many Requests", stderr="")
+        success_result = MagicMock(returncode=0, stdout="ok", stderr="")
+        with patch("subprocess.run", side_effect=[fail_result, success_result]):
+            with patch("tenacity.nap.time.sleep"):
+                output = cli._run(["releases", "create"])
+        assert output == "ok"
+
 
 class TestRepoArg:
     def test_with_repo_arg(self) -> None:
@@ -380,9 +445,11 @@ class TestConfigureTeaLogin:
     def test_configures_login_when_not_present(self, mock_subprocess: MagicMock, mock_which: MagicMock) -> None:
         """configure_tea_login adds login when not already configured."""
         mock_list = MagicMock(returncode=0, stdout="")
-        mock_subprocess.return_value = mock_list
+        mock_add = MagicMock(returncode=0, stdout="Login successful", stderr="")
+        mock_default = MagicMock(returncode=0, stdout="", stderr="")
+        mock_subprocess.side_effect = [mock_list, mock_add, mock_default]
         configure_tea_login()
-        assert mock_subprocess.call_count >= 2  # login list + login add + login default
+        assert mock_subprocess.call_count == 3  # login list + login add + login default
 
     @patch.dict("os.environ", {"CI_GITEA_TOKEN": "tok"})
     @patch("devx.gitea_cli.shutil.which", return_value="/usr/bin/tea")
@@ -393,3 +460,37 @@ class TestConfigureTeaLogin:
         mock_subprocess.return_value = mock_list
         configure_tea_login()
         assert mock_subprocess.call_count == 1  # only login list, no add
+
+    @patch.dict("os.environ", {"CI_GITEA_TOKEN": "tok"})
+    @patch("devx.gitea_cli.shutil.which", return_value="/usr/bin/tea")
+    @patch("devx.gitea_cli.subprocess.run")
+    def test_raises_on_login_add_failure(self, mock_subprocess: MagicMock, mock_which: MagicMock) -> None:
+        """configure_tea_login raises TeaCLIError if tea login add fails."""
+        mock_list = MagicMock(returncode=0, stdout="")
+        mock_add = MagicMock(returncode=1, stdout="", stderr="invalid token")
+        mock_subprocess.side_effect = [mock_list, mock_add]
+        with pytest.raises(TeaCLIError, match="login add failed"):
+            configure_tea_login()
+
+    @patch.dict("os.environ", {"CI_GITEA_TOKEN": "tok"})
+    @patch("devx.gitea_cli.shutil.which", return_value="/usr/bin/tea")
+    @patch("devx.gitea_cli.subprocess.run")
+    def test_raises_on_login_default_failure(self, mock_subprocess: MagicMock, mock_which: MagicMock) -> None:
+        """configure_tea_login raises TeaCLIError if tea login default fails."""
+        mock_list = MagicMock(returncode=0, stdout="")
+        mock_add = MagicMock(returncode=0, stdout="Login successful", stderr="")
+        mock_default = MagicMock(returncode=1, stdout="", stderr="login not found")
+        mock_subprocess.side_effect = [mock_list, mock_add, mock_default]
+        with pytest.raises(TeaCLIError, match="login default failed"):
+            configure_tea_login()
+
+    @patch.dict("os.environ", {"CI_GITEA_TOKEN": "tok"})
+    @patch("devx.gitea_cli.shutil.which", return_value="/usr/bin/tea")
+    @patch("devx.gitea_cli.subprocess.run")
+    def test_login_add_failure_includes_stdout(self, mock_subprocess: MagicMock, mock_which: MagicMock) -> None:
+        """Error message includes stdout when tea writes errors there."""
+        mock_list = MagicMock(returncode=0, stdout="")
+        mock_add = MagicMock(returncode=1, stdout="Error: invalid username", stderr="")
+        mock_subprocess.side_effect = [mock_list, mock_add]
+        with pytest.raises(TeaCLIError, match="invalid username"):
+            configure_tea_login()

tests/unit/test_install_tools.py

@@ -1,6 +1,7 @@
 from __future__ import annotations
 
 import platform
+import urllib.request
 from pathlib import Path
 from unittest.mock import patch
 
@@ -47,13 +48,29 @@ class TestDownload:
     def test_download(self, tmp_path: Path) -> None:
         dest = tmp_path / "file.bin"
 
-        def _write_file(url: str, path: Path) -> tuple[str, None]:
-            Path(path).write_bytes(b"data")
-            return str(path), None
+        class _FakeResponse:
+            def __init__(self) -> None:
+                self._sent = False
 
-        with patch("urllib.request.urlretrieve", side_effect=_write_file) as mock_retrieve:
+            def __enter__(self) -> _FakeResponse:
+                return self
+
+            def __exit__(self, *args: object) -> None:
+                pass
+
+            def read(self, n: int = -1) -> bytes:
+                if self._sent:
+                    return b""
+                self._sent = True
+                return b"data"
+
+        with patch("urllib.request.urlopen", return_value=_FakeResponse()) as mock_urlopen:
             install_tools._download("https://example.com/file", dest)
-        mock_retrieve.assert_called_once()
+        mock_urlopen.assert_called_once()
+        call_args = mock_urlopen.call_args
+        req = call_args.args[0]
+        assert isinstance(req, urllib.request.Request)
+        assert req.get_header("User-agent") == "devx/install-tools"
         assert dest.read_bytes() == b"data"
 
 

tests/unit/test_molecule_ci_guard.py

@@ -102,6 +102,16 @@ class TestBuildEnvForPair:
         env = build_env_for_pair("default|ubuntu-2204|img:latest|", {"MOLECULE_HOME": "/custom/home"})
         assert env["MOLECULE_HOME"] == "/custom/home"
 
+    def test_appends_matrix_index_to_platform_name(self) -> None:
+        """When MATRIX_INDEX is set, platform name gets a unique suffix."""
+        env = build_env_for_pair("default|ubuntu-2604|img:latest|sleep infinity", {"MATRIX_INDEX": "3"})
+        assert env["MOLECULE_PLATFORM_NAME"] == "ubuntu-2604-r3"
+
+    def test_no_matrix_index_keeps_platform_name(self) -> None:
+        """Without MATRIX_INDEX, platform name is unchanged."""
+        env = build_env_for_pair("default|ubuntu-2604|img:latest|sleep infinity", {})
+        assert env["MOLECULE_PLATFORM_NAME"] == "ubuntu-2604"
+
 
 class TestPollForOtherFailures:
     def test_sets_failed_event_when_other_runner_fails(self) -> None:

tests/unit/test_publish.py

@@ -387,8 +387,10 @@ class TestMain:
     @patch("devx.ci.publish.TeaCLI")
     @patch("devx.ci.publish.publish_to_pypi")
     @patch("devx.ci.publish.build_package")
+    @patch("time.sleep")
     def test_release_failure_raises_click(
         self,
+        mock_sleep: MagicMock,
         mock_build: MagicMock,
         mock_publish: MagicMock,
         mock_tea_cls: MagicMock,
@@ -397,6 +399,7 @@ class TestMain:
         mock_tag: MagicMock,
         mock_login: MagicMock,
     ) -> None:
+        """Release creation failure after retries raises ClickException."""
         mock_tea = MagicMock()
         mock_tea.list_releases.return_value = []
         mock_tea.create_release.side_effect = TeaCLIError("server error")
@@ -405,6 +408,8 @@ class TestMain:
         result = runner.invoke(main, ["v1.0.0", "owner/repo"])
         assert result.exit_code == 1
         assert "Release creation failed" in result.output
+        # Retried 3 times (stop_after_attempt(3))
+        assert mock_tea.create_release.call_count == 3
 
     @patch("devx.ci.publish.subprocess.run")
     @patch("devx.ci.publish.get_latest_tag", return_value="v0.1.0")
@@ -496,8 +501,10 @@ class TestMain:
     @patch("devx.ci.publish.publish_to_gitea_registry")
     @patch("devx.ci.publish.publish_to_pypi")
     @patch("devx.ci.publish.build_package")
+    @patch("time.sleep")
     def test_create_release_already_exists_is_idempotent(
         self,
+        mock_sleep: MagicMock,
         mock_build: MagicMock,
         mock_publish: MagicMock,
         mock_gitea_pub: MagicMock,
@@ -507,7 +514,7 @@ class TestMain:
         mock_tag: MagicMock,
         mock_login: MagicMock,
     ) -> None:
-        """If create_release fails with 'already exists', treat as success."""
+        """If create_release fails with 'already exists', treat as success (no retry)."""
         mock_tea = MagicMock()
         mock_tea.list_releases.side_effect = TeaCLIError("api error")
         mock_tea.create_release.side_effect = TeaCLIError("there is already a release for this tag")
@@ -516,6 +523,8 @@ class TestMain:
         result = runner.invoke(main, ["v1.0.0", "owner/repo"])
         assert result.exit_code == 0
         assert "already exists" in result.output
+        # "already exists" is caught immediately — no retry
+        assert mock_tea.create_release.call_count == 1
 
     @patch("devx.ci.publish.subprocess.run")
     @patch("devx.ci.publish.get_latest_tag", return_value="v0.1.0")
@@ -526,8 +535,10 @@ class TestMain:
     @patch("devx.ci.publish.publish_to_gitea_registry")
     @patch("devx.ci.publish.publish_to_pypi")
     @patch("devx.ci.publish.build_package")
+    @patch("time.sleep")
     def test_create_release_other_error_raises(
         self,
+        mock_sleep: MagicMock,
         mock_build: MagicMock,
         mock_publish: MagicMock,
         mock_gitea_pub: MagicMock,
@@ -537,7 +548,7 @@ class TestMain:
         mock_tag: MagicMock,
         mock_login: MagicMock,
     ) -> None:
-        """If create_release fails with a non-'already exists' error, raise."""
+        """If create_release fails with a non-'already exists' error, raise after retries."""
         mock_tea = MagicMock()
         mock_tea.list_releases.side_effect = TeaCLIError("api error")
         mock_tea.create_release.side_effect = TeaCLIError("network error")
@@ -546,6 +557,75 @@ class TestMain:
         result = runner.invoke(main, ["v1.0.0", "owner/repo"])
         assert result.exit_code != 0
         assert "Release creation failed" in result.output
+        # Retried 3 times before giving up
+        assert mock_tea.create_release.call_count == 3
+
+
+class TestReleaseRetry:
+    """Tests for retry logic on transient release creation failures."""
+
+    @patch("devx.ci.publish.subprocess.run")
+    @patch("devx.ci.publish.get_latest_tag", return_value="v0.1.0")
+    @patch("devx.gitea_cli.configure_tea_login")
+    @patch.dict("os.environ", {"CI_GITEA_TOKEN": "gitea-tok"})
+    @patch("devx.ci.publish.generate_release_notes", return_value="Release notes")
+    @patch("devx.ci.publish.TeaCLI")
+    @patch("devx.ci.publish.build_package")
+    @patch("time.sleep")
+    def test_transient_failure_retried_and_succeeds(
+        self,
+        mock_sleep: MagicMock,
+        mock_build: MagicMock,
+        mock_tea_cls: MagicMock,
+        mock_notes: MagicMock,
+        mock_run: MagicMock,
+        mock_tag: MagicMock,
+        mock_login: MagicMock,
+    ) -> None:
+        """Transient failure on first attempt succeeds on retry."""
+        mock_tea = MagicMock()
+        mock_tea.list_releases.return_value = []
+        mock_tea.create_release.side_effect = [
+            TeaCLIError("connection timeout"),
+            None,  # second attempt succeeds
+        ]
+        mock_tea_cls.return_value = mock_tea
+        runner = CliRunner()
+        result = runner.invoke(main, ["v1.0.0", "owner/repo", "--skip-build"])
+        assert result.exit_code == 0
+        assert "Gitea release v1.0.0 created" in result.output
+        assert mock_tea.create_release.call_count == 2
+        mock_sleep.assert_called()  # slept between attempts
+
+    @patch("devx.ci.publish.subprocess.run")
+    @patch("devx.ci.publish.get_latest_tag", return_value="v0.1.0")
+    @patch("devx.gitea_cli.configure_tea_login")
+    @patch.dict("os.environ", {"CI_GITEA_TOKEN": "gitea-tok"})
+    @patch("devx.ci.publish.generate_release_notes", return_value="Release notes")
+    @patch("devx.ci.publish.TeaCLI")
+    @patch("devx.ci.publish.build_package")
+    @patch("time.sleep")
+    def test_all_retries_exhausted_raises(
+        self,
+        mock_sleep: MagicMock,
+        mock_build: MagicMock,
+        mock_tea_cls: MagicMock,
+        mock_notes: MagicMock,
+        mock_run: MagicMock,
+        mock_tag: MagicMock,
+        mock_login: MagicMock,
+    ) -> None:
+        """All 3 retry attempts fail — raises ClickException."""
+        mock_tea = MagicMock()
+        mock_tea.list_releases.return_value = []
+        mock_tea.create_release.side_effect = TeaCLIError("503 service unavailable")
+        mock_tea_cls.return_value = mock_tea
+        runner = CliRunner()
+        result = runner.invoke(main, ["v1.0.0", "owner/repo", "--skip-build"])
+        assert result.exit_code == 1
+        assert "Release creation failed" in result.output
+        assert mock_tea.create_release.call_count == 3
+        assert mock_sleep.call_count == 2  # slept between 3 attempts (2 sleeps)
 
 
 class TestFromTag:

tests/unit/test_setup.py

@@ -14,6 +14,7 @@ from devx.tools.setup import (
     _install_pre_commit_hooks,
     _install_python_deps,
     _run,
+    _try_gitea_mirror_install,
     _verify,
     main,
 )
@@ -106,6 +107,7 @@ class TestInstallAnsibleCollections:
         with patch("devx.tools.setup.Path") as mock_path:
             mock_path.return_value.exists.return_value = True
             mock_path.return_value.__str__ = lambda _: str(req)
+            mock_path.return_value.read_text = lambda: req.read_text()
             _install_ansible_collections(".venv/bin")
         mock_run.assert_called_once()
 
@@ -114,6 +116,251 @@ class TestInstallAnsibleCollections:
         _install_ansible_collections(".venv/bin")
         mock_run.assert_not_called()
 
+    @patch("tenacity.nap.time.sleep")
+    @patch("devx.tools.setup.shutil.which", return_value="/usr/local/bin/ansible-galaxy")
+    @patch("devx.tools.setup._run")
+    def test_retries_on_transient_failure(
+        self, mock_run: MagicMock, mock_which: MagicMock, mock_sleep: MagicMock, tmp_path: Path
+    ) -> None:
+        """ansible-galaxy install should retry on transient network errors."""
+        import subprocess as _subprocess
+
+        req = tmp_path / "ansible" / "requirements.yml"
+        req.parent.mkdir(parents=True)
+        req.write_text("collections: []")
+        # First call fails (timeout), second succeeds
+        mock_run.side_effect = [
+            _subprocess.CalledProcessError(1, ["ansible-galaxy", "collection", "install"]),
+            None,
+        ]
+        with patch("devx.tools.setup.Path") as mock_path:
+            mock_path.return_value.exists.return_value = True
+            mock_path.return_value.__str__ = lambda _: str(req)
+            mock_path.return_value.read_text = lambda: req.read_text()
+            _install_ansible_collections(".venv/bin")
+        assert mock_run.call_count == 2
+
+    @patch("tenacity.nap.time.sleep")
+    @patch("devx.tools.setup.shutil.which", return_value="/usr/local/bin/ansible-galaxy")
+    @patch("devx.tools.setup._run")
+    def test_exhausts_retries_then_raises(
+        self, mock_run: MagicMock, mock_which: MagicMock, mock_sleep: MagicMock, tmp_path: Path
+    ) -> None:
+        """After 3 attempts, the error should propagate."""
+        import subprocess as _subprocess
+
+        req = tmp_path / "ansible" / "requirements.yml"
+        req.parent.mkdir(parents=True)
+        req.write_text("collections: []")
+        mock_run.side_effect = _subprocess.CalledProcessError(1, ["ansible-galaxy"])
+        with patch("devx.tools.setup.Path") as mock_path:
+            mock_path.return_value.exists.return_value = True
+            mock_path.return_value.__str__ = lambda _: str(req)
+            mock_path.return_value.read_text = lambda: req.read_text()
+            with pytest.raises(_subprocess.CalledProcessError):
+                _install_ansible_collections(".venv/bin")
+        assert mock_run.call_count == 3
+
+    @patch("devx.tools.setup._try_gitea_mirror_install", return_value=True)
+    @patch("devx.tools.setup.shutil.which", return_value="/usr/local/bin/ansible-galaxy")
+    @patch("devx.tools.setup._run")
+    def test_mirror_install_skips_galaxy_fallback(
+        self, mock_run: MagicMock, mock_which: MagicMock, mock_mirror: MagicMock, tmp_path: Path
+    ) -> None:
+        """When mirror install succeeds, galaxy fallback is not called."""
+        req = tmp_path / "ansible" / "requirements.yml"
+        req.parent.mkdir(parents=True)
+        req.write_text("collections: []")
+        with patch("devx.tools.setup.Path") as mock_path:
+            mock_path.return_value.exists.return_value = True
+            mock_path.return_value.__str__ = lambda _: str(req)
+            mock_path.return_value.read_text = lambda: req.read_text()
+            _install_ansible_collections(".venv/bin")
+        # _run should not be called because mirror install returns True
+        mock_run.assert_not_called()
+
+
+class TestTryGiteaMirrorInstall:
+    """Tests for _try_gitea_mirror_install — Gitea mirror with auth + fallback."""
+
+    _GITEA_URL = "https://git.example.com/api/packages/org/generic/ansible-collections/1.0.0/ansible-posix-1.0.0.tar.gz"
+
+    @patch.dict(os.environ, {}, clear=True)
+    def test_no_url_entries_returns_false(self, tmp_path: Path) -> None:
+        """Requirements without type: url entries should return False."""
+        req = tmp_path / "requirements.yml"
+        req.write_text("collections:\n  - name: ansible.posix\n    version: '1.0.0'\n")
+        result = _try_gitea_mirror_install("ansible-galaxy", req)
+        assert result is False
+
+    @patch.dict(os.environ, {}, clear=True)
+    def test_no_token_returns_false(self, tmp_path: Path) -> None:
+        """No Gitea token set → return False to fall back to galaxy."""
+        req = tmp_path / "requirements.yml"
+        req.write_text(
+            "collections:\n"
+            "  - name: ansible.posix\n"
+            "    version: '1.0.0'\n"
+            "    type: url\n"
+            f"    source: '{self._GITEA_URL}'\n"
+        )
+        result = _try_gitea_mirror_install("ansible-galaxy", req)
+        assert result is False
+
+    @patch.dict(os.environ, {"CI_GITEA_TOKEN": "tok123"}, clear=True)
+    def test_yaml_parse_error_returns_false(self, tmp_path: Path) -> None:
+        """Malformed YAML → return False."""
+        req = tmp_path / "requirements.yml"
+        req.write_text("not: valid: yaml: [[")
+        result = _try_gitea_mirror_install("ansible-galaxy", req)
+        assert result is False
+
+    @patch("devx.tools.setup._run")
+    @patch("urllib.request.urlopen")
+    @patch.dict(os.environ, {"CI_GITEA_TOKEN": "tok123"}, clear=True)
+    def test_successful_mirror_install(self, mock_urlopen: MagicMock, mock_run: MagicMock, tmp_path: Path) -> None:
+        """Valid URL entries + token → downloads with auth and installs offline."""
+        req = tmp_path / "requirements.yml"
+        req.write_text(
+            f"collections:\n"
+            f"  - name: ansible.posix\n"
+            f"    version: '1.0.0'\n"
+            f"    type: url\n"
+            f"    source: '{self._GITEA_URL}'\n"
+        )
+        mock_resp = MagicMock()
+        mock_resp.read.return_value = b"fake-tarball"
+        mock_resp.__enter__ = lambda _: mock_resp
+        mock_resp.__exit__ = lambda *a: None
+        mock_urlopen.return_value = mock_resp
+
+        result = _try_gitea_mirror_install("ansible-galaxy", req)
+        assert result is True
+
+        # Verify auth header was added
+        call_args = mock_urlopen.call_args[0][0]
+        assert call_args.get_header("Authorization") == "token tok123"
+
+        # Verify offline install was called
+        install_cmd = mock_run.call_args[0][0]
+        assert "collection" in install_cmd
+        assert "install" in install_cmd
+        assert "--offline" in install_cmd
+
+    @patch("urllib.request.urlopen")
+    @patch.dict(os.environ, {"CI_GITEA_TOKEN": "tok123"}, clear=True)
+    def test_download_failure_returns_false(self, mock_urlopen: MagicMock, tmp_path: Path) -> None:
+        """Download failure → return False to fall back to galaxy."""
+        req = tmp_path / "requirements.yml"
+        req.write_text(
+            f"collections:\n"
+            f"  - name: ansible.posix\n"
+            f"    version: '1.0.0'\n"
+            f"    type: url\n"
+            f"    source: '{self._GITEA_URL}'\n"
+        )
+        mock_urlopen.side_effect = Exception("401 Unauthorized")
+
+        result = _try_gitea_mirror_install("ansible-galaxy", req)
+        assert result is False
+
+    @patch("devx.tools.setup._run")
+    @patch("urllib.request.urlopen")
+    @patch.dict(os.environ, {"CI_GITEA_API_TOKEN": "tok456"}, clear=True)
+    def test_prefers_api_token_over_legacy(self, mock_urlopen: MagicMock, mock_run: MagicMock, tmp_path: Path) -> None:
+        """CI_GITEA_API_TOKEN takes priority over CI_GITEA_TOKEN."""
+        req = tmp_path / "requirements.yml"
+        req.write_text(
+            f"collections:\n"
+            f"  - name: ansible.posix\n"
+            f"    version: '1.0.0'\n"
+            f"    type: url\n"
+            f"    source: '{self._GITEA_URL}'\n"
+        )
+        mock_resp = MagicMock()
+        mock_resp.read.return_value = b"fake-tarball"
+        mock_resp.__enter__ = lambda _: mock_resp
+        mock_resp.__exit__ = lambda *a: None
+        mock_urlopen.return_value = mock_resp
+
+        result = _try_gitea_mirror_install("ansible-galaxy", req)
+        assert result is True
+
+        call_args = mock_urlopen.call_args[0][0]
+        assert call_args.get_header("Authorization") == "token tok456"
+
+    @patch("devx.tools.setup._run")
+    @patch("urllib.request.urlopen")
+    @patch.dict(os.environ, {"DEVELOPER_GITEA_API_TOKEN": "tok789"}, clear=True)
+    def test_developer_token_fallback(self, mock_urlopen: MagicMock, mock_run: MagicMock, tmp_path: Path) -> None:
+        """DEVELOPER_GITEA_API_TOKEN is used when CI tokens are absent."""
+        req = tmp_path / "requirements.yml"
+        req.write_text(
+            f"collections:\n"
+            f"  - name: ansible.posix\n"
+            f"    version: '1.0.0'\n"
+            f"    type: url\n"
+            f"    source: '{self._GITEA_URL}'\n"
+        )
+        mock_resp = MagicMock()
+        mock_resp.read.return_value = b"fake-tarball"
+        mock_resp.__enter__ = lambda _: mock_resp
+        mock_resp.__exit__ = lambda *a: None
+        mock_urlopen.return_value = mock_resp
+
+        result = _try_gitea_mirror_install("ansible-galaxy", req)
+        assert result is True
+
+        call_args = mock_urlopen.call_args[0][0]
+        assert call_args.get_header("Authorization") == "token tok789"
+
+    @patch("devx.tools.setup._run")
+    @patch("urllib.request.urlopen")
+    @patch.dict(os.environ, {"CI_GITEA_TOKEN": "tok123"}, clear=True)
+    def test_non_gitea_url_passed_through(self, mock_urlopen: MagicMock, mock_run: MagicMock, tmp_path: Path) -> None:
+        """URL entries not pointing to /api/packages/ are kept as-is (no download)."""
+        external_url = "https://galaxy.ansible.com/download/ansible-posix-1.0.0.tar.gz"
+        req = tmp_path / "requirements.yml"
+        req.write_text(
+            f"collections:\n"
+            f"  - name: ansible.posix\n"
+            f"    version: '1.0.0'\n"
+            f"    type: url\n"
+            f"    source: '{external_url}'\n"
+        )
+        # Should not call urlopen since the URL is not a Gitea package URL
+        result = _try_gitea_mirror_install("ansible-galaxy", req)
+        assert result is True
+        mock_urlopen.assert_not_called()
+
+    @patch("devx.tools.setup._run")
+    @patch("urllib.request.urlopen")
+    @patch.dict(os.environ, {"CI_GITEA_TOKEN": "tok123"}, clear=True)
+    def test_mixed_entries_gitea_and_non_gitea(
+        self, mock_urlopen: MagicMock, mock_run: MagicMock, tmp_path: Path
+    ) -> None:
+        """Mix of Gitea URL entries and regular galaxy entries."""
+        req = tmp_path / "requirements.yml"
+        req.write_text(
+            f"collections:\n"
+            f"  - name: ansible.posix\n"
+            f"    version: '1.0.0'\n"
+            f"    type: url\n"
+            f"    source: '{self._GITEA_URL}'\n"
+            f"  - name: community.general\n"
+            f"    version: '13.0.0'\n"
+        )
+        mock_resp = MagicMock()
+        mock_resp.read.return_value = b"fake-tarball"
+        mock_resp.__enter__ = lambda _: mock_resp
+        mock_resp.__exit__ = lambda *a: None
+        mock_urlopen.return_value = mock_resp
+
+        result = _try_gitea_mirror_install("ansible-galaxy", req)
+        assert result is True
+        # Only the Gitea URL entry should trigger a download
+        mock_urlopen.assert_called_once()
+
 
 class TestConfigureTeaLogin:
     @patch("devx.tools.setup.shutil.which", return_value=None)