release: v0.48.2 [skip ci]

DEVX-152: fix: remove dead translation keys and add missing one
Co-authored-by: emil User <emil.simeonov@tutanota.com>
2026-08-09 01:00:50 +00:00 · 2026-08-09 00:59:55 +00:00 · 2026-08-08 21:45:53 +00:00 · 2026-08-08 21:45:17 +00:00 · 2026-08-08 21:44:37 +00:00 · 2026-08-08 21:26:31 +00:00
19 changed files with 588 additions and 1026 deletions
@@ -128,7 +128,6 @@ src/devx/
 └── molecule/            # Optional molecule testing helpers (for Ansible projects)
    ├── discover_runners.py    # Dynamic Gitea runner discovery
    ├── distribute_molecule.py # Distribute molecule scenarios across runners (LPT scheduling, --roles-root for multi-role)
-    ├── molecule_ci_guard.py   # Run molecule with cross-runner fail-fast (--roles-root)
    ├── molecule_all.py        # Run all molecule scenarios locally
    ├── start_docker.py        # Ensure Docker daemon is running for molecule tests
    └── platforms.py           # Supported molecule platforms
@@ -2,6 +2,30 @@

 All notable changes to this project will be documented in this file.

+## [0.48.2] - 2026-08-09
+
+### Bug Fixes
+
+- Remove dead translation keys and add missing one
+
+## [0.48.1] - 2026-08-08
+
+### Bug Fixes
+
+- *(setup)* Extract version from filename for mirror installs
+
+## [0.48.0] - 2026-08-08
+
+### Features
+
+- *(setup)* Mirror Ansible collections from Gitea registry with auth
+
+## [0.47.10] - 2026-08-05
+
+### Bug Fixes
+
+- Unique molecule container names per CI runner
+
 ## [0.47.9] - 2026-08-03

 ### Bug Fixes
@@ -16,12 +16,12 @@ quality badges.

 [![CI](https://git.oblachno.oblachno.fyi/oblachno-oss/devx/actions/workflows/ci.yml/badge.svg)](https://git.oblachno.oblachno.fyi/oblachno-oss/devx/actions)
 [![License: GPL-3.0](https://img.shields.io/badge/license-GPL--3.0-blue)](https://git.oblachno.oblachno.fyi/oblachno-oss/devx/src/branch/master/LICENSE)
-[![Coverage](https://git.oblachno.oblachno.fyi/oblachno-oss/devx/raw/commit/7640b110dca9ada68de0ce502c2fee1977c88e9f/coverage.svg)](https://git.oblachno.oblachno.fyi/oblachno-oss/devx/actions)
-[![Tests](https://git.oblachno.oblachno.fyi/oblachno-oss/devx/raw/commit/7640b110dca9ada68de0ce502c2fee1977c88e9f/tests.svg)](https://git.oblachno.oblachno.fyi/oblachno-oss/devx/actions)
-[![Docs](https://git.oblachno.oblachno.fyi/oblachno-oss/devx/raw/commit/7640b110dca9ada68de0ce502c2fee1977c88e9f/docs.svg)](https://git.oblachno.oblachno.fyi/oblachno-oss/devx/wiki)
-[![Code Quality](https://git.oblachno.oblachno.fyi/oblachno-oss/devx/raw/commit/7640b110dca9ada68de0ce502c2fee1977c88e9f/quality.svg)](https://git.oblachno.oblachno.fyi/oblachno-oss/devx/actions)
-[![Version](https://git.oblachno.oblachno.fyi/oblachno-oss/devx/raw/commit/7640b110dca9ada68de0ce502c2fee1977c88e9f/version.svg)](https://git.oblachno.oblachno.fyi/oblachno-oss/devx/releases)
-[![Python](https://git.oblachno.oblachno.fyi/oblachno-oss/devx/raw/commit/7640b110dca9ada68de0ce502c2fee1977c88e9f/python.svg)](https://www.python.org/downloads/)
+[![Coverage](https://git.oblachno.oblachno.fyi/oblachno-oss/devx/raw/commit/3ae96e9fe24eb247be074f92e4a9153033dc1ed7/coverage.svg)](https://git.oblachno.oblachno.fyi/oblachno-oss/devx/actions)
+[![Tests](https://git.oblachno.oblachno.fyi/oblachno-oss/devx/raw/commit/3ae96e9fe24eb247be074f92e4a9153033dc1ed7/tests.svg)](https://git.oblachno.oblachno.fyi/oblachno-oss/devx/actions)
+[![Docs](https://git.oblachno.oblachno.fyi/oblachno-oss/devx/raw/commit/3ae96e9fe24eb247be074f92e4a9153033dc1ed7/docs.svg)](https://git.oblachno.oblachno.fyi/oblachno-oss/devx/wiki)
+[![Code Quality](https://git.oblachno.oblachno.fyi/oblachno-oss/devx/raw/commit/3ae96e9fe24eb247be074f92e4a9153033dc1ed7/quality.svg)](https://git.oblachno.oblachno.fyi/oblachno-oss/devx/actions)
+[![Version](https://git.oblachno.oblachno.fyi/oblachno-oss/devx/raw/commit/3ae96e9fe24eb247be074f92e4a9153033dc1ed7/version.svg)](https://git.oblachno.oblachno.fyi/oblachno-oss/devx/releases)
+[![Python](https://git.oblachno.oblachno.fyi/oblachno-oss/devx/raw/commit/3ae96e9fe24eb247be074f92e4a9153033dc1ed7/python.svg)](https://www.python.org/downloads/)

 ## Why devx?

@@ -87,7 +87,7 @@ extra index and list devx in your dependencies:
 ```toml
 [project]
 dependencies = [
-    "devx>=0.47.9",
+    "devx>=0.48.2",
 ]

 [tool.pip]
@@ -101,8 +101,8 @@ pip install -e .
 ```

 > **Note:** If your project requires a specific devx version, pin it in
-> `dependencies` (for example, `"devx==0.47.9"`) or use a version constraint
-> (for example, `"devx>=0.47.9,<0.48"`).
+> `dependencies` (for example, `"devx==0.48.2"`) or use a version constraint
+> (for example, `"devx>=0.48.2,<0.49"`).

 ### Optional extras

@@ -226,10 +226,6 @@ python -m devx.molecule.distribute_molecule --runner-index 1 --max-runners 3
 python -m devx.molecule.distribute_molecule --list              # list all scenarios
 python -m devx.molecule.distribute_molecule --list-platforms    # list platforms

-# Run molecule tests with cross-runner fail-fast
-python -m devx.molecule.molecule_ci_guard pair1 pair2
-python -m devx.molecule.molecule_ci_guard --roles-root ansible/roles pair1 pair2
-
 # Run all molecule scenarios locally (sequential)
 python -m devx.molecule.molecule_all
 python -m devx.molecule.molecule_all --bin .venv/bin
@@ -303,7 +299,6 @@ devx --version
 | `devx molecule all` | Run all molecule scenarios on all supported platforms |
 | `devx molecule discover-runners` | Discover available Gitea Actions runners |
 | `devx molecule distribute` | Distribute molecule test pairs across parallel runners |
-| `devx molecule guard` | Run molecule tests with CI failure polling |

 See [CLI Commands](https://git.oblachno.oblachno.fyi/oblachno-oss/devx/wiki/CLI-Commands)
 in the wiki for full command documentation with examples.
@@ -12,12 +12,12 @@ project to be reusable across all oblachno-oss repositories.

 [![CI](https://git.oblachno.oblachno.fyi/oblachno-oss/devx/actions/workflows/ci.yml/badge.svg)](https://git.oblachno.oblachno.fyi/oblachno-oss/devx/actions)
 [![License: GPL-3.0](https://img.shields.io/badge/license-GPL--3.0-blue)](https://git.oblachno.oblachno.fyi/oblachno-oss/devx/src/branch/master/LICENSE)
-[![Coverage](https://git.oblachno.oblachno.fyi/oblachno-oss/devx/raw/commit/7640b110dca9ada68de0ce502c2fee1977c88e9f/coverage.svg)](https://git.oblachno.oblachno.fyi/oblachno-oss/devx/actions)
-[![Tests](https://git.oblachno.oblachno.fyi/oblachno-oss/devx/raw/commit/7640b110dca9ada68de0ce502c2fee1977c88e9f/tests.svg)](https://git.oblachno.oblachno.fyi/oblachno-oss/devx/actions)
-[![Docs](https://git.oblachno.oblachno.fyi/oblachno-oss/devx/raw/commit/7640b110dca9ada68de0ce502c2fee1977c88e9f/docs.svg)](https://git.oblachno.oblachno.fyi/oblachno-oss/devx/wiki)
-[![Code Quality](https://git.oblachno.oblachno.fyi/oblachno-oss/devx/raw/commit/7640b110dca9ada68de0ce502c2fee1977c88e9f/quality.svg)](https://git.oblachno.oblachno.fyi/oblachno-oss/devx/actions)
-[![Version](https://git.oblachno.oblachno.fyi/oblachno-oss/devx/raw/commit/7640b110dca9ada68de0ce502c2fee1977c88e9f/version.svg)](https://git.oblachno.oblachno.fyi/oblachno-oss/devx/releases)
-[![Python](https://git.oblachno.oblachno.fyi/oblachno-oss/devx/raw/commit/7640b110dca9ada68de0ce502c2fee1977c88e9f/python.svg)](https://www.python.org/downloads/)
+[![Coverage](https://git.oblachno.oblachno.fyi/oblachno-oss/devx/raw/commit/3ae96e9fe24eb247be074f92e4a9153033dc1ed7/coverage.svg)](https://git.oblachno.oblachno.fyi/oblachno-oss/devx/actions)
+[![Tests](https://git.oblachno.oblachno.fyi/oblachno-oss/devx/raw/commit/3ae96e9fe24eb247be074f92e4a9153033dc1ed7/tests.svg)](https://git.oblachno.oblachno.fyi/oblachno-oss/devx/actions)
+[![Docs](https://git.oblachno.oblachno.fyi/oblachno-oss/devx/raw/commit/3ae96e9fe24eb247be074f92e4a9153033dc1ed7/docs.svg)](https://git.oblachno.oblachno.fyi/oblachno-oss/devx/wiki)
+[![Code Quality](https://git.oblachno.oblachno.fyi/oblachno-oss/devx/raw/commit/3ae96e9fe24eb247be074f92e4a9153033dc1ed7/quality.svg)](https://git.oblachno.oblachno.fyi/oblachno-oss/devx/actions)
+[![Version](https://git.oblachno.oblachno.fyi/oblachno-oss/devx/raw/commit/3ae96e9fe24eb247be074f92e4a9153033dc1ed7/version.svg)](https://git.oblachno.oblachno.fyi/oblachno-oss/devx/releases)
+[![Python](https://git.oblachno.oblachno.fyi/oblachno-oss/devx/raw/commit/3ae96e9fe24eb247be074f92e4a9153033dc1ed7/python.svg)](https://www.python.org/downloads/)

 ## Overview

@@ -74,14 +74,14 @@ Add devx to your `pyproject.toml` dependencies and configure the registry:
 ```toml
 [project]
 dependencies = [
-    "devx>=0.47.9",
+    "devx>=0.48.2",
 ]

 [tool.pip]
 extra-index-url = "https://git.oblachno.oblachno.fyi/api/packages/oblachno-oss/pypi/simple"
 ```

-Pin a specific version if needed: `"devx==0.47.9"` or `"devx>=0.47.9,<0.48"`.
+Pin a specific version if needed: `"devx==0.48.2"` or `"devx>=0.48.2,<0.49"`.

 ### Optional extras

@@ -104,8 +104,8 @@ devx is a self-contained Python package under `src/devx/`:
 - **Dev tools** (`devx.tools`) — setup, install_tools, check_test_speed,
  configure_repo, generate_badges, generate_cliff_config, install_checkmake
 - **Molecule tools** (`devx.molecule`) — Optional, for projects with Ansible
-  roles: distribute_molecule, molecule_ci_guard, molecule_all, discover_runners,
-  start_docker, platforms
+  roles: distribute_molecule, molecule_all, discover_runners, start_docker,
+  platforms

 See [Architecture](Architecture) for the full package structure, module
 descriptions, design principles, and data flow diagrams.
@@ -132,7 +132,7 @@ devx provides a `devx` CLI with three command groups:

 - `devx ci <command>` — CI/CD automation (17 commands)
 - `devx tools <command>` — Developer tools (9 commands)
- `devx molecule <command>` — Molecule testing (4 commands, optional)
+- `devx molecule <command>` — Molecule testing (3 commands, optional)

 See [CLI Commands](CLI-Commands) for full command documentation with examples.

@@ -50,7 +50,6 @@ src/devx/
    ├── __init__.py
    ├── discover_runners.py      # Dynamic Gitea runner discovery
    ├── distribute_molecule.py   # Distribute scenarios across runners
-    ├── molecule_ci_guard.py     # Run molecule with cross-runner fail-fast
    ├── molecule_all.py          # Run all molecule scenarios locally
    ├── start_docker.py          # Ensure Docker is available for molecule
    └── platforms.py             # Supported molecule platforms
@@ -300,9 +299,9 @@ Distributes files matching a glob pattern across N parallel runners

 ### `integration_guard.py`

-Runs pytest with the same cross-runner failure detection mechanism used by
-`molecule_ci_guard`. If any other integration-tests matrix runner reports
-failure, the current pytest subprocess is killed and this runner exits early.
+Runs pytest with cross-runner failure detection. A background thread polls
+the Gitea API. If any other integration-tests matrix runner reports failure,
+the current pytest subprocess is killed and this runner exits early.

 ## Developer tools (`devx.tools`)

@@ -382,13 +381,6 @@ the supported OS platform matrix. Supports `--roles-root` for multi-role
 repositories, `--list` to list scenarios, and `--list-platforms` to list
 platforms.

-### `molecule_ci_guard.py`
-
-Runs molecule tests sequentially while polling the Gitea API for other runner
-failures. If any other molecule matrix runner reports failure, the current
-molecule subprocess is killed and this runner exits early. Supports both
-single-role (4-part) and multi-role (5-part) pair encoding.
-
 ### `molecule_all.py`

 Runs all molecule scenarios on all supported OS platforms sequentially.
@@ -478,15 +478,6 @@ python -m devx.molecule.distribute_molecule --list
 python -m devx.molecule.distribute_molecule --list-platforms
 ```

-### `molecule_ci_guard.py`
-
-Runs molecule tests sequentially while polling the Gitea API for other runner
-failures. Aborts early if another runner fails the same job.
-
-```bash
-python -m devx.molecule.molecule_ci_guard [--roles-root <dir>] pair1 pair2 ...
-```
-
 ### `validate_commit_msg.py`

 Validates commit messages. On feature branches: conventional commits only
@@ -531,29 +531,3 @@ Options:
 - `--list-platforms` — list all platforms, one per line
 - `--roles-root <dir>` — roles root directory for multi-role repos (default:
  `ansible/roles`)
-
-### `devx molecule guard`
-
-Run molecule tests sequentially with CI failure polling. A background thread
-polls the Gitea API. If any other molecule matrix runner reports failure, the
-current molecule subprocess is killed and this runner exits early with code 1.
-
-```bash
-devx molecule guard pair1 pair2 pair3
-devx molecule guard --roles-root ansible/roles pair1 pair2
-```
-
-Each pair is encoded as:
- **Single-role (4-part):** `scenario|platform_name|platform_image|platform_command`
- **Multi-role (5-part):** `role|scenario|platform_name|platform_image|platform_command`
-
-Options:
- `--roles-root <dir>` — roles root directory for multi-role repos
-
-Environment variables:
- `GITEA_URL` — base URL of the Gitea instance
- `CI_GITEA_TOKEN` — API token with repo access
- `RUN_ID` — workflow run ID (`GITHUB_RUN_ID`)
- `JOB_NAME` — base job name (`GITHUB_JOB`)
- `MATRIX_INDEX` — current matrix index (runner-index)
- `GITEA_REPOSITORY` — repository in `owner/repo` format
@@ -48,12 +48,12 @@ Add devx to your `pyproject.toml`:
 ```toml
 [project]
 dependencies = [
-    "devx>=0.47.9",
+    "devx>=0.48.2",
 ]

 [project.optional-dependencies]
 dev = [
-    "devx>=0.47.9",
+    "devx>=0.48.2",
 ]
 ```

@@ -1,3 +1,3 @@
 """devx — reusable development and CI/CD tools for oblachno-oss projects."""

-__version__ = "0.47.9"
+__version__ = "0.48.2"
@@ -52,7 +52,6 @@ REQUIRED_SCRIPTS = [
    "detect_release_commit.py",
    "push_badges.py",
    "distribute_molecule.py",
-    "molecule_ci_guard.py",
    "validate_commit_msg.py",
 ]

@@ -1,10 +1,9 @@
 #!/usr/bin/env python3
 """Run integration tests with cross-runner failure detection.

-Wraps ``pytest`` with the same Gitea API polling mechanism used by
-``molecule_ci_guard``. If any other integration-tests matrix runner
-reports failure, the current pytest subprocess is killed and this runner
-exits early with code 1.
+Wraps ``pytest`` with Gitea API polling. If any other integration-tests
+matrix runner reports failure, the current pytest subprocess is killed
+and this runner exits early with code 1.

 Usage::

@@ -35,17 +34,62 @@ import threading
 import time

 import click
+import requests

 from devx.config import REPO_NAME, REPO_OWNER
 from devx.i18n import _
-from devx.molecule.molecule_ci_guard import (
-    poll_for_other_failures,
-)
 from devx.tokens import get_ci_token

 POLL_INTERVAL = 10


+def get_running_jobs(gitea_url: str, owner: str, repo: str, token: str, run_id: int) -> list[dict]:
+    """Return jobs for the given workflow run."""
+    url = f"{gitea_url}/api/v1/repos/{owner}/{repo}/actions/runs/{run_id}/jobs"
+    headers = {"Authorization": f"token {token}"}
+    response = requests.get(url, headers=headers, timeout=30)
+    response.raise_for_status()
+    data = response.json()
+    return data.get("jobs", [])
+
+
+def any_other_runner_failed(jobs: list[dict], current_job_name: str, current_index: int) -> bool:
+    """Return True if any other matrix job has failed."""
+    for job in jobs:
+        name = job.get("name", "")
+        if not name.startswith(current_job_name):
+            continue
+        if name == f"{current_job_name} ({current_index})" or name == current_job_name:
+            continue
+        if job.get("conclusion") == "failure":
+            return True
+    return False
+
+
+def poll_for_other_failures(
+    gitea_url: str,
+    owner: str,
+    repo: str,
+    token: str,
+    run_id: int,
+    job_name: str,
+    current_index: int,
+    stop_event: threading.Event,
+    failed_event: threading.Event,
+) -> None:
+    """Background thread: poll API and signal if another runner fails."""
+    while not stop_event.is_set():
+        try:
+            jobs = get_running_jobs(gitea_url, owner, repo, token, run_id)
+            if any_other_runner_failed(jobs, job_name, current_index):
+                click.echo(_("Another runner failed. Stopping this runner early."))
+                failed_event.set()
+                return
+        except requests.RequestException as exc:
+            click.echo(_("API poll warning: {exc}", exc=exc))
+        stop_event.wait(POLL_INTERVAL)
+
+
@click.command(context_settings={"ignore_unknown_options": True})
@click.argument("pytest_args", nargs=-1, type=click.UNPROCESSED, required=True)
 def cli(pytest_args: tuple[str, ...]) -> None:
@@ -259,13 +259,6 @@ def molecule_discover_runners(args: tuple[str, ...]) -> None:
    _run_module("devx.molecule.discover_runners", list(args))


-@molecule.command("guard")
-@click.argument("args", nargs=-1)
-def molecule_guard(args: tuple[str, ...]) -> None:
-    """Run molecule tests sequentially with CI failure polling."""
-    _run_module("devx.molecule.molecule_ci_guard", list(args))
-
-
@molecule.command("all")
@click.argument("args", nargs=-1)
 def molecule_all(args: tuple[str, ...]) -> None:
@@ -1,289 +0,0 @@
-#!/usr/bin/env python3
-"""Run molecule tests sequentially while polling Gitea for other runner failures.
-
-Each pair is encoded as one of:
-
- **Single-role (4-part):** ``scenario|platform_name|platform_image|platform_command``
- **Multi-role (5-part):** ``role|scenario|platform_name|platform_image|platform_command``
-
-Pairs are executed one at a time (molecule scenarios share temp directories and
-Docker networks, so parallel execution within a single runner is unsafe).
-
-A background thread polls the Gitea API. If any other molecule matrix runner
-reports failure, the current molecule subprocess is killed and this runner
-exits early with code 1.
-
-Usage::
-
-    # Single-role
-    python3 -m devx.molecule.molecule_ci_guard pair1 pair2 ...
-    # Multi-role
-    python3 -m devx.molecule.molecule_ci_guard --roles-root ansible/roles pair1 pair2 ...
-
-Environment variables:
-    GITEA_URL           Base URL of the Gitea instance.
-    CI_GITEA_API_TOKEN  API token with repo access (CI_GITEA_TOKEN accepted for legacy).
-    RUN_ID              Workflow run ID (GITHUB_RUN_ID).
-    JOB_NAME            Base job name (GITHUB_JOB), e.g. "molecule-tests".
-    MATRIX_INDEX        Current matrix index (runner-index).
-    GITEA_REPOSITORY    Repository in "owner/repo" format.
-"""
-
-from __future__ import annotations
-
-import contextlib
-import os
-import signal
-import subprocess  # nosec B404
-import sys
-import threading
-import time
-from pathlib import Path
-
-import click
-import requests
-
-from devx.config import REPO_NAME, REPO_OWNER
-from devx.i18n import _
-from devx.tokens import get_ci_token
-
-POLL_INTERVAL = 10
-
-
-def get_running_jobs(gitea_url: str, owner: str, repo: str, token: str, run_id: int) -> list[dict]:
-    """Return jobs for the given workflow run."""
-    url = f"{gitea_url}/api/v1/repos/{owner}/{repo}/actions/runs/{run_id}/jobs"
-    headers = {"Authorization": f"token {token}"}
-    response = requests.get(url, headers=headers, timeout=30)
-    response.raise_for_status()
-    data = response.json()
-    return data.get("jobs", [])
-
-
-def any_other_runner_failed(jobs: list[dict], current_job_name: str, current_index: int) -> bool:
-    """Return True if any other molecule matrix job has failed."""
-    for job in jobs:
-        name = job.get("name", "")
-        if not name.startswith(current_job_name):
-            continue
-        if name == f"{current_job_name} ({current_index})" or name == current_job_name:
-            continue
-        if job.get("conclusion") == "failure":
-            return True
-    return False
-
-
-def poll_for_other_failures(
-    gitea_url: str,
-    owner: str,
-    repo: str,
-    token: str,
-    run_id: int,
-    job_name: str,
-    current_index: int,
-    stop_event: threading.Event,
-    failed_event: threading.Event,
-) -> None:
-    """Background thread: poll API and signal if another runner fails."""
-    while not stop_event.is_set():
-        try:
-            jobs = get_running_jobs(gitea_url, owner, repo, token, run_id)
-            if any_other_runner_failed(jobs, job_name, current_index):
-                click.echo(_("Another molecule runner failed. Stopping this runner early."))
-                failed_event.set()
-                return
-        except requests.RequestException as exc:
-            click.echo(_("API poll warning: {exc}", exc=exc))
-        stop_event.wait(POLL_INTERVAL)
-
-
-def build_molecule_cmd(scenario: str) -> list[str]:
-    """Build the molecule command for a scenario."""
-    cmd = ["molecule", "test"]
-    if scenario != "default":
-        cmd.extend(["-s", scenario])
-    return cmd
-
-
-def parse_pair(pair: str) -> tuple[str, str, str, str, str]:
-    """Parse a pair string into (role, scenario, platform_name, platform_image, platform_command).
-
-    Supports both 4-part (single-role) and 5-part (multi-role) formats.
-    For 4-part pairs, role is empty (caller uses default role dir).
-    Spaces in the command field are encoded as ``__SPACE__`` to survive
-    shell word-splitting when ``$TEST_PAIRS`` is expanded unquoted.
-    """
-    parts = pair.split("|")
-    if len(parts) == 4:
-        return "", parts[0], parts[1], parts[2], parts[3].replace("__SPACE__", " ")
-    if len(parts) == 5:
-        return parts[0], parts[1], parts[2], parts[3], parts[4].replace("__SPACE__", " ")
-    raise click.ClickException(f"Invalid pair format: {pair!r} (expected 4 or 5 pipe-delimited parts)")
-
-
-def build_env_for_pair(pair: str, base_env: dict[str, str]) -> dict[str, str]:
-    """Build environment for a single molecule pair."""
-    _role, _scenario, platform_name, platform_image, platform_command = parse_pair(pair)
-    env = base_env.copy()
-    # Append runner index to platform name when running in CI matrix to avoid
-    # Docker container name conflicts when multiple runners share the same Docker host.
-    matrix_index = env.get("MATRIX_INDEX")
-    if matrix_index:
-        platform_name = f"{platform_name}-r{matrix_index}"
-    env["MOLECULE_PLATFORM_NAME"] = platform_name
-    env["MOLECULE_PLATFORM_IMAGE"] = platform_image
-    if platform_command:
-        env["MOLECULE_PLATFORM_COMMAND"] = platform_command
-    elif "MOLECULE_PLATFORM_COMMAND" in env:
-        del env["MOLECULE_PLATFORM_COMMAND"]
-    env["ANSIBLE_ALLOW_BROKEN_CONDITIONALS"] = "true"
-    # Use a fresh MOLECULE_HOME per pair to avoid stale config cache
-    # from previous CI runs (causes "Instances missing" errors).
-    if "MOLECULE_HOME" not in env:
-        import tempfile
-
-        env["MOLECULE_HOME"] = tempfile.mkdtemp(prefix="molecule-ci-")
-    return env
-
-
-def resolve_role_dir(role: str, roles_root: Path | None, repo_root: Path) -> Path:
-    """Resolve the working directory for a molecule pair.
-
-    For multi-role pairs (role non-empty), uses ``roles_root/role``.
-    For single-role pairs, auto-discovers the first role with a molecule/
-    subdirectory under ``repo_root/ansible/roles/``.
-    """
-    if role:
-        if roles_root is None:
-            roles_root = repo_root / "ansible" / "roles"
-        return roles_root / role
-    roles_dir = repo_root / "ansible" / "roles"
-    if roles_dir.is_dir():
-        role_dirs = sorted(d for d in roles_dir.iterdir() if (d / "molecule").is_dir())
-        if role_dirs:
-            return role_dirs[0]
-    return roles_dir / "role"  # will produce a clear "not found" error
-
-
-@click.command()
-@click.argument("pairs", nargs=-1, required=True)
-@click.option(
-    "--roles-root",
-    type=click.Path(exists=True, file_okay=False, path_type=Path),
-    default=None,
-    help="Root directory for multi-role pairs (e.g. ansible/roles). Required when pairs use 5-part format.",
-)
-def cli(pairs: tuple[str, ...], roles_root: Path | None) -> None:
-    """Run molecule pairs sequentially, stop if another CI runner fails."""
-    gitea_url = os.environ.get("GITEA_URL", "")
-    try:
-        token = get_ci_token()
-    except click.ClickException:
-        token = None
-    run_id = int(os.environ.get("RUN_ID", "0"))
-    job_name = os.environ.get("JOB_NAME", "molecule-tests")
-    current_index = int(os.environ.get("MATRIX_INDEX", "0"))
-    repository = os.environ.get("GITEA_REPOSITORY", "")
-    owner, _sep, repo = repository.partition("/")
-    if not owner or not repo:
-        owner, repo = REPO_OWNER, REPO_NAME
-
-    if not all([gitea_url, token, run_id]):
-        click.echo(_("GITEA_URL/CI_GITEA_TOKEN/RUN_ID not set; running without cross-runner cancellation."))
-
-    # When devx is installed as a pip package, __file__ resolves to the
-    # site-packages directory, not the repo root. Use GITHUB_WORKSPACE
-    # (set by Gitea Actions) or cwd as the repo root.
-    repo_root = Path(os.environ.get("GITHUB_WORKSPACE", os.getcwd())).resolve()
-
-    base_env = os.environ.copy()
-    base_env.setdefault("DOCKER_HOST", f"unix:///run/user/{os.getuid()}/docker.sock")
-    base_env.setdefault("ANSIBLE_INJECT_INVOCATION", "1")
-
-    stop_event = threading.Event()
-    failed_event = threading.Event()
-
-    if gitea_url and token and run_id:
-        poller = threading.Thread(
-            target=poll_for_other_failures,
-            args=(
-                gitea_url,
-                owner,
-                repo,
-                token,
-                run_id,
-                job_name,
-                current_index,
-                stop_event,
-                failed_event,
-            ),
-            daemon=True,
-        )
-        poller.start()
-
-    try:
-        for pair in pairs:
-            if failed_event.is_set():
-                sys.exit(1)
-
-            role, scenario, platform_name, _img, _cmd = parse_pair(pair)
-            click.echo(_("Running: {scenario} on {platform}", scenario=scenario, platform=platform_name))
-
-            cmd = build_molecule_cmd(scenario)
-            env = build_env_for_pair(pair, base_env)
-            cwd = resolve_role_dir(role, roles_root, repo_root)
-
-            process = subprocess.Popen(  # nosec B603
-                cmd,
-                cwd=str(cwd),
-                env=env,
-                preexec_fn=os.setsid,
-            )
-
-            try:
-                while process.poll() is None:
-                    if failed_event.is_set():
-                        with contextlib.suppress(ProcessLookupError):
-                            os.killpg(os.getpgid(process.pid), signal.SIGTERM)
-                        try:
-                            process.wait(timeout=10)
-                        except subprocess.TimeoutExpired:
-                            with contextlib.suppress(ProcessLookupError):
-                                os.killpg(os.getpgid(process.pid), signal.SIGKILL)
-                            process.wait()
-                        sys.exit(1)
-                    time.sleep(1)
-            except KeyboardInterrupt:
-                with contextlib.suppress(ProcessLookupError):
-                    os.killpg(os.getpgid(process.pid), signal.SIGTERM)
-                process.wait()
-                sys.exit(1)
-
-            rc = process.returncode
-
-            if rc != 0:
-                click.echo(_("FAILED: {pair} exited with code {code}", pair=pair, code=rc))
-                sys.exit(rc)
-
-            click.echo(_("PASSED: {pair}", pair=pair))
-
-            # Prune Docker data between scenarios to prevent disk exhaustion
-            # in Docker-in-Docker molecule containers (each scenario pulls
-            # hundreds of MB of images that accumulate across pairs).
-            with contextlib.suppress(subprocess.SubprocessError, OSError):
-                subprocess.run(  # nosec B603, B607
-                    ["docker", "system", "prune", "-af", "--volumes"],
-                    check=False,
-                    capture_output=True,
-                    timeout=60,
-                )
-
-        click.echo(_("All molecule tests passed."))
-    finally:
-        stop_event.set()
-
-    sys.exit(0)
-
-
-if __name__ == "__main__":  # pragma: no cover
-    cli()
@@ -15,6 +15,7 @@ from pathlib import Path

 import click
 from dotenv import load_dotenv  # pyright: ignore[reportMissingImports,reportUnknownVariableType]
+from tenacity import retry, stop_after_attempt, wait_exponential

 from devx.tokens import get_developer_token

@@ -56,13 +57,116 @@ def _install_pre_commit_hooks(bin_dir: str) -> None:


 def _install_ansible_collections(bin_dir: str) -> None:
-    """Install required Ansible Galaxy collections if requirements exist."""
+    """Install required Ansible Galaxy collections if requirements exist.
+
+    If the requirements file uses ``type: url`` entries pointing to the
+    Gitea package registry, downloads them with authentication (using
+    ``CI_GITEA_TOKEN`` / ``CI_GITEA_API_TOKEN``) and installs from local
+    files with ``--offline``.  Falls back to direct galaxy install if the
+    mirror download fails or no token is available.
+
+    Retries up to 3 times with exponential backoff to handle transient
+    network timeouts when contacting galaxy.ansible.com.
+    """
    galaxy = shutil.which("ansible-galaxy") or str(Path(bin_dir) / "ansible-galaxy")
    requirements = Path("ansible/requirements.yml")
    if not requirements.exists():
        click.echo("  ansible/requirements.yml not found — skipping collections.")
        return
-    _run([galaxy, "collection", "install", "-r", str(requirements)])
+
+    # Try Gitea mirror first if requirements use type: url
+    if _try_gitea_mirror_install(galaxy, requirements):
+        return
+
+    # Fall back to direct galaxy install with retries
+    @retry(stop=stop_after_attempt(3), wait=wait_exponential(multiplier=2, min=2, max=10), reraise=True)
+    def _do_install() -> None:
+        _run([galaxy, "collection", "install", "-r", str(requirements)])
+
+    _do_install()
+
+
+def _try_gitea_mirror_install(galaxy: str, requirements: Path) -> bool:
+    """Download ``type: url`` entries from Gitea with auth and install locally.
+
+    Returns ``True`` if the mirror install succeeded, ``False`` to fall back
+    to direct galaxy install.
+    """
+    import tempfile
+    import urllib.request  # noqa: PTH123  # nosec B404
+
+    import yaml  # pyright: ignore[reportMissingImports]
+
+    try:
+        data = yaml.safe_load(requirements.read_text())
+    except Exception:
+        return False
+
+    collections = data.get("collections", []) if data else []
+    url_entries = [c for c in collections if c.get("type") == "url"]
+    if not url_entries:
+        return False
+
+    # Resolve Gitea token for authenticated downloads
+    token = os.environ.get("CI_GITEA_API_TOKEN", "").strip()
+    if not token:
+        token = os.environ.get("CI_GITEA_TOKEN", "").strip()
+    if not token:
+        token = os.environ.get("DEVELOPER_GITEA_API_TOKEN", "").strip()
+    if not token:
+        click.echo("  No Gitea token found — falling back to galaxy.ansible.com")
+        return False
+
+    # Download each tarball with auth
+    tmpdir = Path(tempfile.mkdtemp(prefix="ansible-collections-"))
+    local_entries = []
+    try:
+        for entry in url_entries:
+            source = entry.get("source", "")
+            if "/api/packages/" not in source:
+                local_entries.append(entry)
+                continue
+            filename = source.rsplit("/", 1)[-1]
+            dest = tmpdir / filename
+            click.echo(f"  Downloading {entry.get('name', filename)} from Gitea mirror...")
+            req = urllib.request.Request(source)  # nosec B310
+            req.add_header("Authorization", f"token {token}")
+            try:
+                with urllib.request.urlopen(req, timeout=30) as resp:  # noqa: PTH123  # nosec B310
+                    dest.write_bytes(resp.read())
+            except Exception as e:
+                click.echo(f"  WARN: mirror download failed for {entry.get('name')}: {e}")
+                click.echo("  Falling back to galaxy.ansible.com")
+                return False
+            # Extract version from filename (e.g. ansible-posix-2.2.2.tar.gz)
+            import re
+
+            ver_match = re.search(r"(\d+\.\d+\.\d+)", filename)
+            local_entries.append(
+                {
+                    "name": entry["name"],
+                    "version": ver_match.group(1) if ver_match else entry.get("version"),
+                    "type": "file",
+                    "source": str(dest),
+                }
+            )
+
+        # Add non-url entries as-is
+        for entry in collections:
+            if entry.get("type") != "url":
+                local_entries.append(entry)
+
+        # Write local requirements file
+        local_req = tmpdir / "requirements.yml"
+        local_req.write_text(yaml.dump({"collections": local_entries}))
+
+        click.echo("  Installing collections from Gitea mirror (offline)...")
+        _run([galaxy, "collection", "install", "-r", str(local_req), "--offline"])
+        return True
+    finally:
+        import shutil as _shutil
+
+        _shutil.rmtree(tmpdir, ignore_errors=True)


 def _configure_tea_login() -> None:
@@ -783,14 +783,6 @@
    "ru": "Additional directory to scan (default: scripts, tests). Can be repeated.",
    "zh": "Additional directory to scan (default: scripts, tests). Can be repeated."
  },
-  "All molecule tests passed.": {
-    "bg": "All molecule tests passed.",
-    "de": "All molecule tests passed.",
-    "en": "All molecule tests passed.",
-    "pl": "Wszystkie testy molecule zakończone pomyślnie.",
-    "ru": "All molecule tests passed.",
-    "zh": "All molecule tests passed."
-  },
  "Allow empty tag (PR mode where SHA is concrete).": {
    "bg": "Позволи празен таг (PR режим, където SHA е конкретен).",
    "de": "Leeren Tag zulassen (PR-Modus, in dem SHA konkret ist).",
@@ -799,13 +791,13 @@
    "ru": "Разрешить пустой тег (режим PR, где SHA конкретен).",
    "zh": "允许空标签（SHA 为具体值的 PR 模式）。"
  },
-  "Another molecule runner failed. Stopping this runner early.": {
-    "bg": "Another molecule runner failed. Stopping this runner early.",
-    "de": "Another molecule runner failed. Stopping this runner early.",
-    "en": "Another molecule runner failed. Stopping this runner early.",
-    "pl": "Inny runner molecule zakończył się niepowodzeniem. Wczesne zatrzymanie tego runnera.",
-    "ru": "Another molecule runner failed. Stopping this runner early.",
-    "zh": "Another molecule runner failed. Stopping this runner early."
+  "Another runner failed. Stopping this runner early.": {
+    "bg": "Друг runner се провали. Спиране на този runner по-рано.",
+    "de": "Ein anderer Runner ist fehlgeschlagen. Dieser Runner wird vorzeitig gestoppt.",
+    "en": "Another runner failed. Stopping this runner early.",
+    "pl": "Inny runner zakończył się niepowodzeniem. Wczesne zatrzymanie tego runnera.",
+    "ru": "Другой runner завершился с ошибкой. Останавливаю этот runner досрочно.",
+    "zh": "另一个 runner 失败。提前停止此 runner。"
  },
  "Assigned {count} files to runner {runner_index}": {
    "bg": "Assigned {count} files to runner {runner_index}",
@@ -1495,14 +1487,6 @@
    "ru": "FAILED: {count} undocumented dependency/ies",
    "zh": "FAILED: {count} undocumented dependency/ies"
  },
-  "FAILED: {pair} exited with code {code}": {
-    "bg": "FAILED: {pair} exited with code {code}",
-    "de": "FAILED: {pair} exited with code {code}",
-    "en": "FAILED: {pair} exited with code {code}",
-    "pl": "NIEUDANE: {pair} zakończone kodem {code}",
-    "ru": "FAILED: {pair} exited with code {code}",
-    "zh": "FAILED: {pair} exited with code {code}"
-  },
  "Failed images: {names}": {
    "bg": "Failed images: {names}",
    "de": "Failed images: {names}",
@@ -2263,14 +2247,6 @@
    "ru": "PASS: All documentation checks passed!",
    "zh": "PASS: All documentation checks passed!"
  },
-  "PASSED: {pair}": {
-    "bg": "PASSED: {pair}",
-    "de": "PASSED: {pair}",
-    "en": "PASSED: {pair}",
-    "pl": "UDANE: {pair}",
-    "ru": "PASSED: {pair}",
-    "zh": "PASSED: {pair}"
-  },
  "PR #{pr} rebased successfully. A new CI run will start automatically.\nIf auto-merge is enabled (ready-to-merge label), the next CI run\nwill attempt to merge this PR.": {
    "bg": "PR #{pr} rebased successfully. A new CI run will start automatically.\nIf auto-merge is enabled (ready-to-merge label), the next CI run\nwill attempt to merge this PR.",
    "de": "PR #{pr} rebased successfully. A new CI run will start automatically.\nIf auto-merge is enabled (ready-to-merge label), the next CI run\nwill attempt to merge this PR.",
@@ -2743,14 +2719,6 @@
    "ru": "Running: {cmd}",
    "zh": "Running: {cmd}"
  },
-  "Running: {scenario} on {platform}": {
-    "bg": "Running: {scenario} on {platform}",
-    "de": "Running: {scenario} on {platform}",
-    "en": "Running: {scenario} on {platform}",
-    "pl": "Uruchamianie: {scenario} na {platform}",
-    "ru": "Running: {scenario} on {platform}",
-    "zh": "Running: {scenario} on {platform}"
-  },
  "SSH key set up successfully": {
    "bg": "SSH ключът е настроен успешно",
    "de": "SSH-Schlüssel erfolgreich eingerichtet",
@@ -3831,4 +3799,4 @@
    "ru": "[check-test-speed] CI environment detected — scaling limits by {factor}x (total: {orig}s → {eff}s, per-test: {orig_s}s → {eff_s}s)",
    "zh": "[check-test-speed] CI environment detected — scaling limits by {factor}x (total: {orig}s → {eff}s, per-test: {orig_s}s → {eff_s}s)"
  }
-}
+}
@@ -40,7 +40,6 @@ class TestCliGroups:
        result = runner.invoke(cli, ["molecule", "--help"])
        assert result.exit_code == 0
        assert "distribute" in result.output
-        assert "guard" in result.output
        assert "all" in result.output


@@ -231,13 +230,6 @@ class TestMoleculeCommands:
        assert result.exit_code == 0
        mock_run.assert_called_once_with("devx.molecule.discover_runners", [])

-    @patch("devx.cli._run_module")
-    def test_molecule_guard(self, mock_run: MagicMock) -> None:
-        runner = CliRunner()
-        result = runner.invoke(cli, ["molecule", "guard"])
-        assert result.exit_code == 0
-        mock_run.assert_called_once_with("devx.molecule.molecule_ci_guard", [])
-
    @patch("devx.cli._run_module")
    def test_molecule_all(self, mock_run: MagicMock) -> None:
        runner = CliRunner()
@@ -7,6 +7,7 @@ import subprocess  # nosec B404
 import time
 from unittest.mock import MagicMock, patch

+import pytest
 from click.testing import CliRunner

 from devx.ci.integration_guard import cli
@@ -111,9 +112,8 @@ class TestCli:
                clear=True,
            ),
            patch("devx.ci.integration_guard.POLL_INTERVAL", 0.01),
-            patch("devx.molecule.molecule_ci_guard.POLL_INTERVAL", 0.01),
            patch("devx.ci.integration_guard.subprocess.Popen") as mock_popen,
-            patch("devx.molecule.molecule_ci_guard.get_running_jobs", side_effect=get_jobs_side_effect),
+            patch("devx.ci.integration_guard.get_running_jobs", side_effect=get_jobs_side_effect),
            patch("os.killpg") as mock_killpg,
            patch("os.getpgid") as mock_getpgid,
            patch("time.sleep", side_effect=lambda x: real_sleep(0)),
@@ -158,9 +158,8 @@ class TestCli:
                clear=True,
            ),
            patch("devx.ci.integration_guard.POLL_INTERVAL", 0.01),
-            patch("devx.molecule.molecule_ci_guard.POLL_INTERVAL", 0.01),
            patch("devx.ci.integration_guard.subprocess.Popen") as mock_popen,
-            patch("devx.molecule.molecule_ci_guard.get_running_jobs", side_effect=get_jobs_side_effect),
+            patch("devx.ci.integration_guard.get_running_jobs", side_effect=get_jobs_side_effect),
            patch("os.killpg", side_effect=ProcessLookupError("no such process")),
            patch("os.getpgid") as mock_getpgid,
            patch("time.sleep", side_effect=lambda x: real_sleep(0)),
@@ -203,9 +202,8 @@ class TestCli:
                clear=True,
            ),
            patch("devx.ci.integration_guard.POLL_INTERVAL", 0.01),
-            patch("devx.molecule.molecule_ci_guard.POLL_INTERVAL", 0.01),
            patch("devx.ci.integration_guard.subprocess.Popen") as mock_popen,
-            patch("devx.molecule.molecule_ci_guard.get_running_jobs", side_effect=get_jobs_side_effect),
+            patch("devx.ci.integration_guard.get_running_jobs", side_effect=get_jobs_side_effect),
            patch("os.killpg") as mock_killpg,
            patch("os.getpgid") as mock_getpgid,
            patch("time.sleep", side_effect=lambda x: real_sleep(0)),
@@ -289,3 +287,125 @@ def test_main_module_block() -> None:
    namespace = dict(ig.__dict__)
    exec(compile(source, ig.__file__, "exec"), namespace)
    assert callable(namespace["cli"])
+
+
+class TestGetRunningJobs:
+    def test_returns_jobs(self) -> None:
+        with patch("devx.ci.integration_guard.requests.get") as mock_get:
+            mock_response = MagicMock()
+            mock_response.json.return_value = {
+                "jobs": [
+                    {"name": "integration-tests (0)", "conclusion": "success"},
+                    {"name": "integration-tests (1)", "conclusion": "failure"},
+                ]
+            }
+            mock_response.raise_for_status.return_value = None
+            mock_get.return_value = mock_response
+
+            from devx.ci.integration_guard import get_running_jobs
+
+            jobs = get_running_jobs("https://gitea.example", "owner", "repo", "token", 123)
+            assert len(jobs) == 2
+            mock_get.assert_called_once()
+
+    def test_raises_on_request_error(self) -> None:
+        import requests
+
+        with patch("devx.ci.integration_guard.requests.get") as mock_get:
+            mock_get.side_effect = requests.RequestException("boom")
+            with pytest.raises(requests.RequestException):
+                from devx.ci.integration_guard import get_running_jobs
+
+                get_running_jobs("https://gitea.example", "owner", "repo", "token", 123)
+
+
+class TestAnyOtherRunnerFailed:
+    def test_detects_other_failure(self) -> None:
+        from devx.ci.integration_guard import any_other_runner_failed
+
+        jobs = [
+            {"name": "integration-tests (0)", "conclusion": "success"},
+            {"name": "integration-tests (1)", "conclusion": "failure"},
+            {"name": "integration-tests (2)", "conclusion": "running"},
+        ]
+        assert any_other_runner_failed(jobs, "integration-tests", 0) is True
+
+    def test_ignores_current_runner(self) -> None:
+        from devx.ci.integration_guard import any_other_runner_failed
+
+        jobs = [
+            {"name": "integration-tests (0)", "conclusion": "failure"},
+            {"name": "integration-tests (1)", "conclusion": "success"},
+        ]
+        assert any_other_runner_failed(jobs, "integration-tests", 0) is False
+
+    def test_ignores_non_matching_jobs(self) -> None:
+        from devx.ci.integration_guard import any_other_runner_failed
+
+        jobs = [
+            {"name": "quality", "conclusion": "failure"},
+            {"name": "integration-tests (1)", "conclusion": "success"},
+        ]
+        assert any_other_runner_failed(jobs, "integration-tests", 0) is False
+
+
+class TestPollForOtherFailures:
+    def test_sets_failed_event_when_other_runner_fails(self) -> None:
+        from devx.ci.integration_guard import poll_for_other_failures
+
+        stop_event = MagicMock()
+        failed_event = MagicMock()
+
+        def side_effect(*args, **kwargs):
+            if stop_event.wait.call_count < 1:
+                return [
+                    {"name": "integration-tests (0)", "conclusion": "success"},
+                    {"name": "integration-tests (1)", "conclusion": "failure"},
+                ]
+            return []
+
+        with patch("devx.ci.integration_guard.get_running_jobs") as mock_get_jobs:
+            mock_get_jobs.side_effect = side_effect
+            stop_event.is_set.side_effect = [False, False]
+            stop_event.wait.return_value = True
+
+            poll_for_other_failures(
+                "https://gitea.example",
+                "owner",
+                "repo",
+                "token",
+                123,
+                "integration-tests",
+                0,
+                stop_event,
+                failed_event,
+            )
+
+            failed_event.set.assert_called_once()
+
+    def test_poll_warns_on_api_error(self) -> None:
+        import requests
+
+        from devx.ci.integration_guard import poll_for_other_failures
+
+        stop_event = MagicMock()
+        failed_event = MagicMock()
+
+        with patch("devx.ci.integration_guard.get_running_jobs") as mock_get_jobs:
+            mock_get_jobs.side_effect = requests.RequestException("boom")
+            stop_event.is_set.side_effect = [False, True]
+            stop_event.wait.return_value = True
+
+            poll_for_other_failures(
+                "https://gitea.example",
+                "owner",
+                "repo",
+                "token",
+                123,
+                "integration-tests",
+                0,
+                stop_event,
+                failed_event,
+            )
+
+            failed_event.set.assert_not_called()
@@ -1,591 +0,0 @@
-"""Unit tests for scripts/ci/molecule_ci_guard.py."""
-
-from __future__ import annotations
-
-import os
-import subprocess  # nosec B404
-import time
-from pathlib import Path
-from unittest.mock import MagicMock, patch
-
-import click
-import pytest
-import requests
-
-from devx.molecule.molecule_ci_guard import (
-    any_other_runner_failed,
-    build_env_for_pair,
-    build_molecule_cmd,
-    cli,
-    get_running_jobs,
-    parse_pair,
-    poll_for_other_failures,
-    resolve_role_dir,
-)
-
-
-class TestGetRunningJobs:
-    def test_returns_jobs(self) -> None:
-        with patch("devx.molecule.molecule_ci_guard.requests.get") as mock_get:
-            mock_response = MagicMock()
-            mock_response.json.return_value = {
-                "jobs": [
-                    {"name": "molecule-tests (0)", "conclusion": "success"},
-                    {"name": "molecule-tests (1)", "conclusion": "failure"},
-                ]
-            }
-            mock_response.raise_for_status.return_value = None
-            mock_get.return_value = mock_response
-
-            jobs = get_running_jobs("https://gitea.example", "owner", "repo", "token", 123)
-            assert len(jobs) == 2
-            mock_get.assert_called_once()
-
-    def test_raises_on_request_error(self) -> None:
-        with patch("devx.molecule.molecule_ci_guard.requests.get") as mock_get:
-            mock_get.side_effect = requests.RequestException("boom")
-            with pytest.raises(requests.RequestException):
-                get_running_jobs("https://gitea.example", "owner", "repo", "token", 123)
-
-
-class TestAnyOtherRunnerFailed:
-    def test_detects_other_failure(self) -> None:
-        jobs = [
-            {"name": "molecule-tests (0)", "conclusion": "success"},
-            {"name": "molecule-tests (1)", "conclusion": "failure"},
-            {"name": "molecule-tests (2)", "conclusion": "running"},
-        ]
-        assert any_other_runner_failed(jobs, "molecule-tests", 0) is True
-
-    def test_ignores_current_runner(self) -> None:
-        jobs = [
-            {"name": "molecule-tests (0)", "conclusion": "failure"},
-            {"name": "molecule-tests (1)", "conclusion": "success"},
-        ]
-        assert any_other_runner_failed(jobs, "molecule-tests", 0) is False
-
-    def test_ignores_non_molecule_jobs(self) -> None:
-        jobs = [
-            {"name": "quality", "conclusion": "failure"},
-            {"name": "molecule-tests (1)", "conclusion": "success"},
-        ]
-        assert any_other_runner_failed(jobs, "molecule-tests", 0) is False
-
-
-class TestBuildMoleculeCmd:
-    def test_default_scenario(self) -> None:
-        assert build_molecule_cmd("default") == ["molecule", "test"]
-
-    def test_named_scenario(self) -> None:
-        assert build_molecule_cmd("lifecycle") == ["molecule", "test", "-s", "lifecycle"]
-
-
-class TestBuildEnvForPair:
-    def test_with_command(self) -> None:
-        env = build_env_for_pair("default|ubuntu-2204|img:latest|/lib/systemd/systemd", {})
-        assert env["MOLECULE_PLATFORM_NAME"] == "ubuntu-2204"
-        assert env["MOLECULE_PLATFORM_IMAGE"] == "img:latest"
-        assert env["MOLECULE_PLATFORM_COMMAND"] == "/lib/systemd/systemd"
-        assert env["ANSIBLE_ALLOW_BROKEN_CONDITIONALS"] == "true"
-
-    def test_without_command(self) -> None:
-        env = build_env_for_pair("default|ubuntu-2204|img:latest|", {})
-        assert env["MOLECULE_PLATFORM_NAME"] == "ubuntu-2204"
-        assert "MOLECULE_PLATFORM_COMMAND" not in env
-
-    def test_without_command_removes_existing(self) -> None:
-        env = build_env_for_pair("default|ubuntu-2204|img:latest|", {"MOLECULE_PLATFORM_COMMAND": "old"})
-        assert "MOLECULE_PLATFORM_COMMAND" not in env
-
-    def test_preserves_existing_molecule_home(self) -> None:
-        """When MOLECULE_HOME is already set, it is not overridden."""
-        env = build_env_for_pair("default|ubuntu-2204|img:latest|", {"MOLECULE_HOME": "/custom/home"})
-        assert env["MOLECULE_HOME"] == "/custom/home"
-
-    def test_appends_matrix_index_to_platform_name(self) -> None:
-        """When MATRIX_INDEX is set, platform name gets a unique suffix."""
-        env = build_env_for_pair("default|ubuntu-2604|img:latest|sleep infinity", {"MATRIX_INDEX": "3"})
-        assert env["MOLECULE_PLATFORM_NAME"] == "ubuntu-2604-r3"
-
-    def test_no_matrix_index_keeps_platform_name(self) -> None:
-        """Without MATRIX_INDEX, platform name is unchanged."""
-        env = build_env_for_pair("default|ubuntu-2604|img:latest|sleep infinity", {})
-        assert env["MOLECULE_PLATFORM_NAME"] == "ubuntu-2604"
-
-
-class TestPollForOtherFailures:
-    def test_sets_failed_event_when_other_runner_fails(self) -> None:
-        stop_event = MagicMock()
-        failed_event = MagicMock()
-
-        def side_effect(*args, **kwargs):
-            if stop_event.wait.call_count < 1:
-                return [
-                    {"name": "molecule-tests (0)", "conclusion": "success"},
-                    {"name": "molecule-tests (1)", "conclusion": "failure"},
-                ]
-            return []
-
-        with patch("devx.molecule.molecule_ci_guard.get_running_jobs") as mock_get_jobs:
-            mock_get_jobs.side_effect = side_effect
-            stop_event.is_set.side_effect = [False, False]
-            stop_event.wait.return_value = True
-
-            poll_for_other_failures(
-                "https://gitea.example",
-                "owner",
-                "repo",
-                "token",
-                123,
-                "molecule-tests",
-                0,
-                stop_event,
-                failed_event,
-            )
-
-            failed_event.set.assert_called_once()
-
-    def test_poll_warns_on_api_error(self) -> None:
-        stop_event = MagicMock()
-        failed_event = MagicMock()
-
-        with patch("devx.molecule.molecule_ci_guard.get_running_jobs") as mock_get_jobs:
-            mock_get_jobs.side_effect = requests.RequestException("boom")
-            stop_event.is_set.side_effect = [False, True]
-            stop_event.wait.return_value = True
-
-            poll_for_other_failures(
-                "https://gitea.example",
-                "owner",
-                "repo",
-                "token",
-                123,
-                "molecule-tests",
-                0,
-                stop_event,
-                failed_event,
-            )
-
-            failed_event.set.assert_not_called()
-
-
-class TestCli:
-    def test_all_pass(self) -> None:
-        from click.testing import CliRunner
-
-        with (
-            patch("devx.molecule.molecule_ci_guard.subprocess.Popen") as mock_popen,
-            patch("devx.molecule.molecule_ci_guard.subprocess.run"),
-            patch("devx.molecule.molecule_ci_guard.subprocess.run") as mock_run,
-            patch("time.sleep"),
-        ):
-            proc = MagicMock()
-            proc.poll.return_value = 0
-            proc.returncode = 0
-            mock_popen.return_value = proc
-            mock_run.return_value = MagicMock(returncode=0)
-
-            runner = CliRunner()
-            result = runner.invoke(cli, ["default|ubuntu-2204|img:latest|"])
-            assert result.exit_code == 0
-            assert "All molecule tests passed" in result.output
-            # Verify Docker prune was called between scenarios
-            mock_run.assert_called_once_with(
-                ["docker", "system", "prune", "-af", "--volumes"],
-                check=False,
-                capture_output=True,
-                timeout=60,
-            )
-
-    @patch("devx.molecule.molecule_ci_guard.get_ci_token", side_effect=click.ClickException("no token"))
-    def test_missing_token_runs_without_polling(self, mock_token: MagicMock) -> None:
-        """When no token is available, cross-runner polling is skipped."""
-        from click.testing import CliRunner
-
-        with (
-            patch("devx.molecule.molecule_ci_guard.subprocess.Popen") as mock_popen,
-            patch("devx.molecule.molecule_ci_guard.subprocess.run"),
-            patch("devx.molecule.molecule_ci_guard.subprocess.run") as mock_run,
-            patch("devx.molecule.molecule_ci_guard.poll_for_other_failures") as mock_poll,
-            patch("time.sleep"),
-        ):
-            proc = MagicMock()
-            proc.poll.return_value = 0
-            proc.returncode = 0
-            mock_popen.return_value = proc
-            mock_run.return_value = MagicMock(returncode=0)
-
-            runner = CliRunner()
-            result = runner.invoke(cli, ["default|ubuntu-2204|img:latest|"])
-            assert result.exit_code == 0
-            mock_poll.assert_not_called()
-
-    def test_invalid_pair_format_raises(self) -> None:
-        """Pair with fewer than 2 parts should raise."""
-        from click.testing import CliRunner
-
-        with (
-            patch("devx.molecule.molecule_ci_guard.subprocess.Popen"),
-            patch("devx.molecule.molecule_ci_guard.subprocess.run"),
-        ):
-            runner = CliRunner()
-            result = runner.invoke(cli, ["invalid_no_pipe"])
-        assert result.exit_code != 0
-        assert "Invalid pair format" in result.output
-
-    def test_failure_exits_nonzero(self) -> None:
-        from click.testing import CliRunner
-
-        with (
-            patch("devx.molecule.molecule_ci_guard.subprocess.Popen") as mock_popen,
-            patch("devx.molecule.molecule_ci_guard.subprocess.run"),
-            patch("devx.molecule.molecule_ci_guard.subprocess.run"),
-            patch("time.sleep"),
-        ):
-            proc = MagicMock()
-            proc.poll.return_value = 1
-            proc.returncode = 1
-            mock_popen.return_value = proc
-
-            runner = CliRunner()
-            result = runner.invoke(cli, ["default|ubuntu-2204|img:latest|"])
-            assert result.exit_code == 1
-            assert "FAILED" in result.output
-
-    def test_exits_before_starting_when_already_failed(self) -> None:
-        from click.testing import CliRunner
-
-        with (
-            patch.dict(
-                os.environ,
-                {
-                    "GITEA_URL": "https://gitea.example",
-                    "CI_GITEA_TOKEN": "token",
-                    "RUN_ID": "123",
-                    "JOB_NAME": "molecule-tests",
-                    "MATRIX_INDEX": "0",
-                    "GITEA_REPOSITORY": "my-org/my-repo",
-                    "PATH": os.environ.get("PATH", ""),
-                },
-                clear=True,
-            ),
-            patch("devx.molecule.molecule_ci_guard.POLL_INTERVAL", 0.01),
-            patch("devx.molecule.molecule_ci_guard.subprocess.Popen") as mock_popen,
-            patch("devx.molecule.molecule_ci_guard.subprocess.run"),
-            patch("devx.molecule.molecule_ci_guard.subprocess.run"),
-            patch("devx.molecule.molecule_ci_guard.get_running_jobs") as mock_get_jobs,
-            patch("time.sleep"),
-        ):
-            mock_get_jobs.return_value = [
-                {"name": "molecule-tests (0)", "conclusion": "running"},
-                {"name": "molecule-tests (1)", "conclusion": "failure"},
-            ]
-            proc = MagicMock()
-            proc.poll.return_value = 0
-            proc.returncode = 0
-            mock_popen.return_value = proc
-
-            runner = CliRunner()
-            result = runner.invoke(cli, ["default|ubuntu-2204|img:latest|"])
-            assert result.exit_code == 1
-            assert "Another molecule runner failed" in result.output
-
-    def test_keyboard_interrupt_kills_process(self) -> None:
-        from click.testing import CliRunner
-
-        with (
-            patch("devx.molecule.molecule_ci_guard.subprocess.Popen") as mock_popen,
-            patch("devx.molecule.molecule_ci_guard.subprocess.run"),
-            patch("devx.molecule.molecule_ci_guard.subprocess.run"),
-            patch("time.sleep", side_effect=KeyboardInterrupt),
-            patch("os.killpg") as mock_killpg,
-            patch("os.getpgid") as mock_getpgid,
-        ):
-            mock_getpgid.return_value = 123
-            proc = MagicMock()
-            proc.poll.return_value = None
-            proc.wait.return_value = 0
-            mock_popen.return_value = proc
-
-            runner = CliRunner()
-            result = runner.invoke(cli, ["default|ubuntu-2204|img:latest|"])
-            assert result.exit_code == 1
-            mock_killpg.assert_called()
-
-    def test_exits_when_other_runner_fails(self) -> None:
-        from click.testing import CliRunner
-
-        real_sleep = time.sleep
-        call_count = [0]
-
-        def get_jobs_side_effect(*args, **kwargs):
-            call_count[0] += 1
-            if call_count[0] < 2:
-                return [{"name": "molecule-tests (1)", "conclusion": "running"}]
-            return [
-                {"name": "molecule-tests (0)", "conclusion": "running"},
-                {"name": "molecule-tests (1)", "conclusion": "failure"},
-            ]
-
-        with (
-            patch.dict(
-                os.environ,
-                {
-                    "GITEA_URL": "https://gitea.example",
-                    "CI_GITEA_TOKEN": "token",
-                    "RUN_ID": "123",
-                    "JOB_NAME": "molecule-tests",
-                    "MATRIX_INDEX": "0",
-                    "GITEA_REPOSITORY": "my-org/my-repo",
-                    "PATH": os.environ.get("PATH", ""),
-                },
-                clear=True,
-            ),
-            patch("devx.molecule.molecule_ci_guard.POLL_INTERVAL", 0.01),
-            patch("devx.molecule.molecule_ci_guard.subprocess.Popen") as mock_popen,
-            patch("devx.molecule.molecule_ci_guard.subprocess.run"),
-            patch("devx.molecule.molecule_ci_guard.get_running_jobs", side_effect=get_jobs_side_effect),
-            patch("os.killpg") as mock_killpg,
-            patch("os.getpgid") as mock_getpgid,
-            patch("time.sleep", side_effect=lambda x: real_sleep(0)),
-        ):
-            mock_getpgid.return_value = 123
-            proc = MagicMock()
-            proc.poll.return_value = None
-            proc.wait.return_value = 0
-            mock_popen.return_value = proc
-
-            runner = CliRunner()
-            result = runner.invoke(cli, ["default|ubuntu-2204|img:latest|"])
-            assert result.exit_code == 1
-            mock_killpg.assert_called()
-
-    def test_default_owner_repo_fallback(self) -> None:
-        from click.testing import CliRunner
-
-        real_sleep = time.sleep
-
-        with (
-            patch.dict(
-                os.environ,
-                {
-                    "GITEA_URL": "https://gitea.example",
-                    "CI_GITEA_TOKEN": "token",
-                    "RUN_ID": "123",
-                    "JOB_NAME": "molecule-tests",
-                    "MATRIX_INDEX": "0",
-                    "GITEA_REPOSITORY": "invalid",
-                    "PATH": os.environ.get("PATH", ""),
-                },
-                clear=True,
-            ),
-            patch("devx.molecule.molecule_ci_guard.POLL_INTERVAL", 0.01),
-            patch("devx.molecule.molecule_ci_guard.subprocess.Popen") as mock_popen,
-            patch("devx.molecule.molecule_ci_guard.subprocess.run"),
-            patch("devx.molecule.molecule_ci_guard.subprocess.run") as mock_run,
-            patch("devx.molecule.molecule_ci_guard.get_running_jobs") as mock_get_jobs,
-            patch("time.sleep", side_effect=lambda x: real_sleep(0)),
-        ):
-            mock_get_jobs.return_value = [{"name": "molecule-tests (1)", "conclusion": "success"}]
-            proc = MagicMock()
-            proc.poll.return_value = 0
-            proc.returncode = 0
-            mock_popen.return_value = proc
-            mock_run.return_value = MagicMock(returncode=0)
-
-            runner = CliRunner()
-            result = runner.invoke(cli, ["default|ubuntu-2204|img:latest|"])
-            assert result.exit_code == 0
-
-    def test_exits_when_other_runner_fails_with_process_lookup_error(self) -> None:
-        from click.testing import CliRunner
-
-        real_sleep = time.sleep
-        call_count = [0]
-
-        def get_jobs_side_effect(*args, **kwargs):
-            call_count[0] += 1
-            if call_count[0] < 2:
-                return [{"name": "molecule-tests (1)", "conclusion": "running"}]
-            return [
-                {"name": "molecule-tests (0)", "conclusion": "running"},
-                {"name": "molecule-tests (1)", "conclusion": "failure"},
-            ]
-
-        with (
-            patch.dict(
-                os.environ,
-                {
-                    "GITEA_URL": "https://gitea.example",
-                    "CI_GITEA_TOKEN": "token",
-                    "RUN_ID": "123",
-                    "JOB_NAME": "molecule-tests",
-                    "MATRIX_INDEX": "0",
-                    "GITEA_REPOSITORY": "my-org/my-repo",
-                    "PATH": os.environ.get("PATH", ""),
-                },
-                clear=True,
-            ),
-            patch("devx.molecule.molecule_ci_guard.POLL_INTERVAL", 0.01),
-            patch("devx.molecule.molecule_ci_guard.subprocess.Popen") as mock_popen,
-            patch("devx.molecule.molecule_ci_guard.subprocess.run"),
-            patch("devx.molecule.molecule_ci_guard.get_running_jobs", side_effect=get_jobs_side_effect),
-            patch("os.killpg") as mock_killpg,
-            patch("os.getpgid") as mock_getpgid,
-            patch("time.sleep", side_effect=lambda x: real_sleep(0)),
-        ):
-            mock_getpgid.return_value = 123
-            mock_killpg.side_effect = ProcessLookupError("no such process")
-            proc = MagicMock()
-            proc.poll.return_value = None
-            proc.wait.return_value = 0
-            mock_popen.return_value = proc
-
-            runner = CliRunner()
-            result = runner.invoke(cli, ["default|ubuntu-2204|img:latest|"])
-            assert result.exit_code == 1
-
-    def test_exits_when_other_runner_fails_with_timeout(self) -> None:
-        from click.testing import CliRunner
-
-        real_sleep = time.sleep
-        call_count = [0]
-
-        def get_jobs_side_effect(*args, **kwargs):
-            call_count[0] += 1
-            if call_count[0] < 2:
-                return [{"name": "molecule-tests (1)", "conclusion": "running"}]
-            return [
-                {"name": "molecule-tests (0)", "conclusion": "running"},
-                {"name": "molecule-tests (1)", "conclusion": "failure"},
-            ]
-
-        with (
-            patch.dict(
-                os.environ,
-                {
-                    "GITEA_URL": "https://gitea.example",
-                    "CI_GITEA_TOKEN": "token",
-                    "RUN_ID": "123",
-                    "JOB_NAME": "molecule-tests",
-                    "MATRIX_INDEX": "0",
-                    "GITEA_REPOSITORY": "my-org/my-repo",
-                    "PATH": os.environ.get("PATH", ""),
-                },
-                clear=True,
-            ),
-            patch("devx.molecule.molecule_ci_guard.POLL_INTERVAL", 0.01),
-            patch("devx.molecule.molecule_ci_guard.subprocess.Popen") as mock_popen,
-            patch("devx.molecule.molecule_ci_guard.subprocess.run"),
-            patch("devx.molecule.molecule_ci_guard.get_running_jobs", side_effect=get_jobs_side_effect),
-            patch("os.killpg") as mock_killpg,
-            patch("os.getpgid") as mock_getpgid,
-            patch("time.sleep", side_effect=lambda x: real_sleep(0)),
-        ):
-            mock_getpgid.return_value = 123
-            mock_killpg.side_effect = [None, ProcessLookupError("no such process")]
-            proc = MagicMock()
-            proc.poll.return_value = None
-            proc.wait.side_effect = [subprocess.TimeoutExpired("cmd", 10)]
-            mock_popen.return_value = proc
-
-            runner = CliRunner()
-            result = runner.invoke(cli, ["default|ubuntu-2204|img:latest|"])
-            assert result.exit_code == 1
-
-
-def test_main_module_block() -> None:
-    import devx.molecule.molecule_ci_guard as mg
-
-    with open(mg.__file__) as f:
-        source = f.read()
-    source = source.replace('if __name__ == "__main__":\n    cli()\n', "")
-    namespace = dict(mg.__dict__)
-    exec(compile(source, mg.__file__, "exec"), namespace)
-    assert callable(namespace["cli"])
-
-
-class TestParsePair:
-    def test_single_role_4_part(self) -> None:
-        role, scenario, name, image, cmd = parse_pair("default|ubuntu-2204|ubuntu:22.04|")
-        assert role == ""
-        assert scenario == "default"
-        assert name == "ubuntu-2204"
-        assert image == "ubuntu:22.04"
-        assert cmd == ""
-
-    def test_multi_role_5_part(self) -> None:
-        role, scenario, name, image, cmd = parse_pair("gitea-runner|default|ubuntu-2204|ubuntu:22.04|")
-        assert role == "gitea-runner"
-        assert scenario == "default"
-        assert name == "ubuntu-2204"
-        assert image == "ubuntu:22.04"
-        assert cmd == ""
-
-    def test_multi_role_with_command(self) -> None:
-        role, scenario, name, image, cmd = parse_pair(
-            "docker-base|lifecycle|archlinux|archlinux:latest|/usr/lib/systemd/systemd"
-        )
-        assert role == "docker-base"
-        assert scenario == "lifecycle"
-        assert cmd == "/usr/lib/systemd/systemd"
-
-    def test_invalid_pair_raises(self) -> None:
-        with pytest.raises(click.ClickException, match="Invalid pair format"):
-            parse_pair("only|two|parts")
-
-    def test_too_many_parts_raises(self) -> None:
-        with pytest.raises(click.ClickException, match="Invalid pair format"):
-            parse_pair("a|b|c|d|e|f")
-
-
-class TestResolveRoleDir:
-    def test_multi_role_with_roles_root(self, tmp_path: Path) -> None:
-        roles_root = tmp_path / "ansible" / "roles"
-        roles_root.mkdir(parents=True)
-        result = resolve_role_dir("gitea-runner", roles_root, tmp_path)
-        assert result == roles_root / "gitea-runner"
-
-    def test_multi_role_default_roles_root(self, tmp_path: Path) -> None:
-        result = resolve_role_dir("docker-base", None, tmp_path)
-        assert result == tmp_path / "ansible" / "roles" / "docker-base"
-
-    def test_single_role_auto_discovers(self, tmp_path: Path) -> None:
-        """Single-role mode auto-discovers first role with molecule/ dir."""
-        roles_dir = tmp_path / "ansible" / "roles"
-        (roles_dir / "my_role" / "molecule").mkdir(parents=True)
-        result = resolve_role_dir("", None, tmp_path)
-        assert result == roles_dir / "my_role"
-
-    def test_single_role_no_roles_returns_fallback(self, tmp_path: Path) -> None:
-        """When no roles exist, returns a fallback path (will error at runtime)."""
-        result = resolve_role_dir("", None, tmp_path)
-        assert "roles" in str(result)
-
-
-class TestCliMultiRole:
-    def test_multi_role_pair_passes(self, tmp_path: Path) -> None:
-        from click.testing import CliRunner
-
-        roles_root = tmp_path / "ansible" / "roles"
-        (roles_root / "gitea-runner").mkdir(parents=True)
-
-        with (
-            patch("devx.molecule.molecule_ci_guard.subprocess.Popen") as mock_popen,
-            patch("devx.molecule.molecule_ci_guard.subprocess.run"),
-            patch("devx.molecule.molecule_ci_guard.subprocess.run") as mock_run,
-            patch("time.sleep"),
-        ):
-            proc = MagicMock()
-            proc.poll.return_value = 0
-            proc.returncode = 0
-            mock_popen.return_value = proc
-            mock_run.return_value = MagicMock(returncode=0)
-
-            runner = CliRunner()
-            result = runner.invoke(
-                cli,
-                ["--roles-root", str(roles_root), "gitea-runner|default|ubuntu-2204|ubuntu:22.04|"],
-            )
-            assert result.exit_code == 0
-            assert "All molecule tests passed" in result.output
@@ -14,6 +14,7 @@ from devx.tools.setup import (
    _install_pre_commit_hooks,
    _install_python_deps,
    _run,
+    _try_gitea_mirror_install,
    _verify,
    main,
 )
@@ -106,6 +107,7 @@ class TestInstallAnsibleCollections:
        with patch("devx.tools.setup.Path") as mock_path:
            mock_path.return_value.exists.return_value = True
            mock_path.return_value.__str__ = lambda _: str(req)
+            mock_path.return_value.read_text = lambda: req.read_text()
            _install_ansible_collections(".venv/bin")
        mock_run.assert_called_once()

@@ -114,6 +116,251 @@ class TestInstallAnsibleCollections:
        _install_ansible_collections(".venv/bin")
        mock_run.assert_not_called()

+    @patch("tenacity.nap.time.sleep")
+    @patch("devx.tools.setup.shutil.which", return_value="/usr/local/bin/ansible-galaxy")
+    @patch("devx.tools.setup._run")
+    def test_retries_on_transient_failure(
+        self, mock_run: MagicMock, mock_which: MagicMock, mock_sleep: MagicMock, tmp_path: Path
+    ) -> None:
+        """ansible-galaxy install should retry on transient network errors."""
+        import subprocess as _subprocess
+
+        req = tmp_path / "ansible" / "requirements.yml"
+        req.parent.mkdir(parents=True)
+        req.write_text("collections: []")
+        # First call fails (timeout), second succeeds
+        mock_run.side_effect = [
+            _subprocess.CalledProcessError(1, ["ansible-galaxy", "collection", "install"]),
+            None,
+        ]
+        with patch("devx.tools.setup.Path") as mock_path:
+            mock_path.return_value.exists.return_value = True
+            mock_path.return_value.__str__ = lambda _: str(req)
+            mock_path.return_value.read_text = lambda: req.read_text()
+            _install_ansible_collections(".venv/bin")
+        assert mock_run.call_count == 2
+
+    @patch("tenacity.nap.time.sleep")
+    @patch("devx.tools.setup.shutil.which", return_value="/usr/local/bin/ansible-galaxy")
+    @patch("devx.tools.setup._run")
+    def test_exhausts_retries_then_raises(
+        self, mock_run: MagicMock, mock_which: MagicMock, mock_sleep: MagicMock, tmp_path: Path
+    ) -> None:
+        """After 3 attempts, the error should propagate."""
+        import subprocess as _subprocess
+
+        req = tmp_path / "ansible" / "requirements.yml"
+        req.parent.mkdir(parents=True)
+        req.write_text("collections: []")
+        mock_run.side_effect = _subprocess.CalledProcessError(1, ["ansible-galaxy"])
+        with patch("devx.tools.setup.Path") as mock_path:
+            mock_path.return_value.exists.return_value = True
+            mock_path.return_value.__str__ = lambda _: str(req)
+            mock_path.return_value.read_text = lambda: req.read_text()
+            with pytest.raises(_subprocess.CalledProcessError):
+                _install_ansible_collections(".venv/bin")
+        assert mock_run.call_count == 3
+
+    @patch("devx.tools.setup._try_gitea_mirror_install", return_value=True)
+    @patch("devx.tools.setup.shutil.which", return_value="/usr/local/bin/ansible-galaxy")
+    @patch("devx.tools.setup._run")
+    def test_mirror_install_skips_galaxy_fallback(
+        self, mock_run: MagicMock, mock_which: MagicMock, mock_mirror: MagicMock, tmp_path: Path
+    ) -> None:
+        """When mirror install succeeds, galaxy fallback is not called."""
+        req = tmp_path / "ansible" / "requirements.yml"
+        req.parent.mkdir(parents=True)
+        req.write_text("collections: []")
+        with patch("devx.tools.setup.Path") as mock_path:
+            mock_path.return_value.exists.return_value = True
+            mock_path.return_value.__str__ = lambda _: str(req)
+            mock_path.return_value.read_text = lambda: req.read_text()
+            _install_ansible_collections(".venv/bin")
+        # _run should not be called because mirror install returns True
+        mock_run.assert_not_called()
+
+
+class TestTryGiteaMirrorInstall:
+    """Tests for _try_gitea_mirror_install — Gitea mirror with auth + fallback."""
+
+    _GITEA_URL = "https://git.example.com/api/packages/org/generic/ansible-collections/1.0.0/ansible-posix-1.0.0.tar.gz"
+
+    @patch.dict(os.environ, {}, clear=True)
+    def test_no_url_entries_returns_false(self, tmp_path: Path) -> None:
+        """Requirements without type: url entries should return False."""
+        req = tmp_path / "requirements.yml"
+        req.write_text("collections:\n  - name: ansible.posix\n    version: '1.0.0'\n")
+        result = _try_gitea_mirror_install("ansible-galaxy", req)
+        assert result is False
+
+    @patch.dict(os.environ, {}, clear=True)
+    def test_no_token_returns_false(self, tmp_path: Path) -> None:
+        """No Gitea token set → return False to fall back to galaxy."""
+        req = tmp_path / "requirements.yml"
+        req.write_text(
+            "collections:\n"
+            "  - name: ansible.posix\n"
+            "    version: '1.0.0'\n"
+            "    type: url\n"
+            f"    source: '{self._GITEA_URL}'\n"
+        )
+        result = _try_gitea_mirror_install("ansible-galaxy", req)
+        assert result is False
+
+    @patch.dict(os.environ, {"CI_GITEA_TOKEN": "tok123"}, clear=True)
+    def test_yaml_parse_error_returns_false(self, tmp_path: Path) -> None:
+        """Malformed YAML → return False."""
+        req = tmp_path / "requirements.yml"
+        req.write_text("not: valid: yaml: [[")
+        result = _try_gitea_mirror_install("ansible-galaxy", req)
+        assert result is False
+
+    @patch("devx.tools.setup._run")
+    @patch("urllib.request.urlopen")
+    @patch.dict(os.environ, {"CI_GITEA_TOKEN": "tok123"}, clear=True)
+    def test_successful_mirror_install(self, mock_urlopen: MagicMock, mock_run: MagicMock, tmp_path: Path) -> None:
+        """Valid URL entries + token → downloads with auth and installs offline."""
+        req = tmp_path / "requirements.yml"
+        req.write_text(
+            f"collections:\n"
+            f"  - name: ansible.posix\n"
+            f"    version: '1.0.0'\n"
+            f"    type: url\n"
+            f"    source: '{self._GITEA_URL}'\n"
+        )
+        mock_resp = MagicMock()
+        mock_resp.read.return_value = b"fake-tarball"
+        mock_resp.__enter__ = lambda _: mock_resp
+        mock_resp.__exit__ = lambda *a: None
+        mock_urlopen.return_value = mock_resp
+
+        result = _try_gitea_mirror_install("ansible-galaxy", req)
+        assert result is True
+
+        # Verify auth header was added
+        call_args = mock_urlopen.call_args[0][0]
+        assert call_args.get_header("Authorization") == "token tok123"
+
+        # Verify offline install was called
+        install_cmd = mock_run.call_args[0][0]
+        assert "collection" in install_cmd
+        assert "install" in install_cmd
+        assert "--offline" in install_cmd
+
+    @patch("urllib.request.urlopen")
+    @patch.dict(os.environ, {"CI_GITEA_TOKEN": "tok123"}, clear=True)
+    def test_download_failure_returns_false(self, mock_urlopen: MagicMock, tmp_path: Path) -> None:
+        """Download failure → return False to fall back to galaxy."""
+        req = tmp_path / "requirements.yml"
+        req.write_text(
+            f"collections:\n"
+            f"  - name: ansible.posix\n"
+            f"    version: '1.0.0'\n"
+            f"    type: url\n"
+            f"    source: '{self._GITEA_URL}'\n"
+        )
+        mock_urlopen.side_effect = Exception("401 Unauthorized")
+
+        result = _try_gitea_mirror_install("ansible-galaxy", req)
+        assert result is False
+
+    @patch("devx.tools.setup._run")
+    @patch("urllib.request.urlopen")
+    @patch.dict(os.environ, {"CI_GITEA_API_TOKEN": "tok456"}, clear=True)
+    def test_prefers_api_token_over_legacy(self, mock_urlopen: MagicMock, mock_run: MagicMock, tmp_path: Path) -> None:
+        """CI_GITEA_API_TOKEN takes priority over CI_GITEA_TOKEN."""
+        req = tmp_path / "requirements.yml"
+        req.write_text(
+            f"collections:\n"
+            f"  - name: ansible.posix\n"
+            f"    version: '1.0.0'\n"
+            f"    type: url\n"
+            f"    source: '{self._GITEA_URL}'\n"
+        )
+        mock_resp = MagicMock()
+        mock_resp.read.return_value = b"fake-tarball"
+        mock_resp.__enter__ = lambda _: mock_resp
+        mock_resp.__exit__ = lambda *a: None
+        mock_urlopen.return_value = mock_resp
+
+        result = _try_gitea_mirror_install("ansible-galaxy", req)
+        assert result is True
+
+        call_args = mock_urlopen.call_args[0][0]
+        assert call_args.get_header("Authorization") == "token tok456"
+
+    @patch("devx.tools.setup._run")
+    @patch("urllib.request.urlopen")
+    @patch.dict(os.environ, {"DEVELOPER_GITEA_API_TOKEN": "tok789"}, clear=True)
+    def test_developer_token_fallback(self, mock_urlopen: MagicMock, mock_run: MagicMock, tmp_path: Path) -> None:
+        """DEVELOPER_GITEA_API_TOKEN is used when CI tokens are absent."""
+        req = tmp_path / "requirements.yml"
+        req.write_text(
+            f"collections:\n"
+            f"  - name: ansible.posix\n"
+            f"    version: '1.0.0'\n"
+            f"    type: url\n"
+            f"    source: '{self._GITEA_URL}'\n"
+        )
+        mock_resp = MagicMock()
+        mock_resp.read.return_value = b"fake-tarball"
+        mock_resp.__enter__ = lambda _: mock_resp
+        mock_resp.__exit__ = lambda *a: None
+        mock_urlopen.return_value = mock_resp
+
+        result = _try_gitea_mirror_install("ansible-galaxy", req)
+        assert result is True
+
+        call_args = mock_urlopen.call_args[0][0]
+        assert call_args.get_header("Authorization") == "token tok789"
+
+    @patch("devx.tools.setup._run")
+    @patch("urllib.request.urlopen")
+    @patch.dict(os.environ, {"CI_GITEA_TOKEN": "tok123"}, clear=True)
+    def test_non_gitea_url_passed_through(self, mock_urlopen: MagicMock, mock_run: MagicMock, tmp_path: Path) -> None:
+        """URL entries not pointing to /api/packages/ are kept as-is (no download)."""
+        external_url = "https://galaxy.ansible.com/download/ansible-posix-1.0.0.tar.gz"
+        req = tmp_path / "requirements.yml"
+        req.write_text(
+            f"collections:\n"
+            f"  - name: ansible.posix\n"
+            f"    version: '1.0.0'\n"
+            f"    type: url\n"
+            f"    source: '{external_url}'\n"
+        )
+        # Should not call urlopen since the URL is not a Gitea package URL
+        result = _try_gitea_mirror_install("ansible-galaxy", req)
+        assert result is True
+        mock_urlopen.assert_not_called()
+
+    @patch("devx.tools.setup._run")
+    @patch("urllib.request.urlopen")
+    @patch.dict(os.environ, {"CI_GITEA_TOKEN": "tok123"}, clear=True)
+    def test_mixed_entries_gitea_and_non_gitea(
+        self, mock_urlopen: MagicMock, mock_run: MagicMock, tmp_path: Path
+    ) -> None:
+        """Mix of Gitea URL entries and regular galaxy entries."""
+        req = tmp_path / "requirements.yml"
+        req.write_text(
+            f"collections:\n"
+            f"  - name: ansible.posix\n"
+            f"    version: '1.0.0'\n"
+            f"    type: url\n"
+            f"    source: '{self._GITEA_URL}'\n"
+            f"  - name: community.general\n"
+            f"    version: '13.0.0'\n"
+        )
+        mock_resp = MagicMock()
+        mock_resp.read.return_value = b"fake-tarball"
+        mock_resp.__enter__ = lambda _: mock_resp
+        mock_resp.__exit__ = lambda *a: None
+        mock_urlopen.return_value = mock_resp
+
+        result = _try_gitea_mirror_install("ansible-galaxy", req)
+        assert result is True
+        # Only the Gitea URL entry should trigger a download
+        mock_urlopen.assert_called_once()
+

 class TestConfigureTeaLogin:
    @patch("devx.tools.setup.shutil.which", return_value=None)
Author	SHA1	Message	Date
devx-ci-bot	9cdbdde6da	release: v0.48.2 [skip ci]	2026-08-09 01:00:50 +00:00
emilandemo	bd4530094e	DEVX-152: fix: remove dead translation keys and add missing one Post-merge / detect-and-configure (push) Successful in 18s Details Post-merge / release-and-maintain (push) Successful in 1m13s Details Co-authored-by: emil User <emil.simeonov@tutanota.com>	2026-08-09 00:59:55 +00:00
gitea-actions-bot	4d0aa326a1	chore: update badge URLs to commit `3ae96e9f` [skip ci]	2026-08-08 21:45:53 +00:00
devx-ci-bot	a13fbddce6	release: v0.48.1 [skip ci]	2026-08-08 21:45:17 +00:00
emilandemo	8fddcff237	DEVX-151: fix(setup): extract version from filename for mirror installs Post-merge / detect-and-configure (push) Successful in 9s Details Post-merge / release-and-maintain (push) Successful in 1m2s Details Co-authored-by: emil User <emil.simeonov@tutanota.com>	2026-08-08 21:44:37 +00:00
gitea-actions-bot	dede38cbe8	chore: update badge URLs to commit `b91ca06b` [skip ci]	2026-08-08 21:26:31 +00:00
devx-ci-bot	8f3c483eff	release: v0.48.0 [skip ci]	2026-08-08 21:25:56 +00:00
emilandemo	30389ff3e7	DEVX-150: feat(setup): mirror Ansible collections from Gitea registry with auth Post-merge / detect-and-configure (push) Successful in 26s Details Post-merge / release-and-maintain (push) Successful in 1m0s Details Co-authored-by: emil User <emil.simeonov@tutanota.com>	2026-08-08 21:25:00 +00:00
gitea-actions-bot	ef1ff15593	chore: update badge URLs to commit `8cca99ef` [skip ci]	2026-08-05 19:04:47 +00:00
devx-ci-bot	0d0580c4fd	release: v0.47.10 [skip ci]	2026-08-05 19:03:37 +00:00
kiretoandemo	ed3bd75367	DEVX-149: fix: unique molecule container names per CI runner Post-merge / detect-and-configure (push) Successful in 30s Details Post-merge / release-and-maintain (push) Successful in 2m22s Details Co-authored-by: kireto <kireto@oblachno.com>	2026-08-05 19:01:54 +00:00
gitea-actions-bot	ed0a282a52	chore: update badge URLs to commit `ef796e01` [skip ci]	2026-08-03 23:02:08 +00:00