release: v0.53.1 [skip ci]

CHANGELOG.md

@@ -2,6 +2,12 @@
 
 All notable changes to this project will be documented in this file.
 
+## [0.53.1] - 2026-09-19
+
+### Bug Fixes
+
+- *(ci)* Handle list-shaped ref response in create_dependency_pr
+
 ## [0.53.0] - 2026-09-19
 
 ### Features

README.md

@@ -16,12 +16,12 @@ quality badges.
 
 [![CI](https://git.oblachno.oblachno.fyi/oblachno-oss/devx/actions/workflows/ci.yml/badge.svg)](https://git.oblachno.oblachno.fyi/oblachno-oss/devx/actions)
 [![License: GPL-3.0](https://img.shields.io/badge/license-GPL--3.0-blue)](https://git.oblachno.oblachno.fyi/oblachno-oss/devx/src/branch/master/LICENSE)
-[![Coverage](https://git.oblachno.oblachno.fyi/oblachno-oss/devx/raw/commit/cc45ecc4b25334441272067865dc0ca96000751c/coverage.svg)](https://git.oblachno.oblachno.fyi/oblachno-oss/devx/actions)
+[![Coverage](https://git.oblachno.oblachno.fyi/oblachno-oss/devx/raw/commit/a421bc187886bab9a60be6f7616531b14846b84e/coverage.svg)](https://git.oblachno.oblachno.fyi/oblachno-oss/devx/actions)
-[![Tests](https://git.oblachno.oblachno.fyi/oblachno-oss/devx/raw/commit/cc45ecc4b25334441272067865dc0ca96000751c/tests.svg)](https://git.oblachno.oblachno.fyi/oblachno-oss/devx/actions)
+[![Tests](https://git.oblachno.oblachno.fyi/oblachno-oss/devx/raw/commit/a421bc187886bab9a60be6f7616531b14846b84e/tests.svg)](https://git.oblachno.oblachno.fyi/oblachno-oss/devx/actions)
-[![Docs](https://git.oblachno.oblachno.fyi/oblachno-oss/devx/raw/commit/cc45ecc4b25334441272067865dc0ca96000751c/docs.svg)](https://git.oblachno.oblachno.fyi/oblachno-oss/devx/wiki)
+[![Docs](https://git.oblachno.oblachno.fyi/oblachno-oss/devx/raw/commit/a421bc187886bab9a60be6f7616531b14846b84e/docs.svg)](https://git.oblachno.oblachno.fyi/oblachno-oss/devx/wiki)
-[![Code Quality](https://git.oblachno.oblachno.fyi/oblachno-oss/devx/raw/commit/cc45ecc4b25334441272067865dc0ca96000751c/quality.svg)](https://git.oblachno.oblachno.fyi/oblachno-oss/devx/actions)
+[![Code Quality](https://git.oblachno.oblachno.fyi/oblachno-oss/devx/raw/commit/a421bc187886bab9a60be6f7616531b14846b84e/quality.svg)](https://git.oblachno.oblachno.fyi/oblachno-oss/devx/actions)
-[![Version](https://git.oblachno.oblachno.fyi/oblachno-oss/devx/raw/commit/cc45ecc4b25334441272067865dc0ca96000751c/version.svg)](https://git.oblachno.oblachno.fyi/oblachno-oss/devx/releases)
+[![Version](https://git.oblachno.oblachno.fyi/oblachno-oss/devx/raw/commit/a421bc187886bab9a60be6f7616531b14846b84e/version.svg)](https://git.oblachno.oblachno.fyi/oblachno-oss/devx/releases)
-[![Python](https://git.oblachno.oblachno.fyi/oblachno-oss/devx/raw/commit/cc45ecc4b25334441272067865dc0ca96000751c/python.svg)](https://www.python.org/downloads/)
+[![Python](https://git.oblachno.oblachno.fyi/oblachno-oss/devx/raw/commit/a421bc187886bab9a60be6f7616531b14846b84e/python.svg)](https://www.python.org/downloads/)
 
 ## Why devx?
 
@@ -87,7 +87,7 @@ extra index and list devx in your dependencies:
 ```toml
 [project]
 dependencies = [
-    "devx>=0.53.0",
+    "devx>=0.53.1",
 ]
 
 [tool.pip]
@@ -101,8 +101,8 @@ pip install -e .
 ```
 
 > **Note:** If your project requires a specific devx version, pin it in
-> `dependencies` (for example, `"devx==0.53.0"`) or use a version constraint
+> `dependencies` (for example, `"devx==0.53.1"`) or use a version constraint
-> (for example, `"devx>=0.53.0,<0.54"`).
+> (for example, `"devx>=0.53.1,<0.54"`).
 
 ### Optional extras
 

docs/index.md

@@ -12,12 +12,12 @@ project to be reusable across all oblachno-oss repositories.
 
 [![CI](https://git.oblachno.oblachno.fyi/oblachno-oss/devx/actions/workflows/ci.yml/badge.svg)](https://git.oblachno.oblachno.fyi/oblachno-oss/devx/actions)
 [![License: GPL-3.0](https://img.shields.io/badge/license-GPL--3.0-blue)](https://git.oblachno.oblachno.fyi/oblachno-oss/devx/src/branch/master/LICENSE)
-[![Coverage](https://git.oblachno.oblachno.fyi/oblachno-oss/devx/raw/commit/cc45ecc4b25334441272067865dc0ca96000751c/coverage.svg)](https://git.oblachno.oblachno.fyi/oblachno-oss/devx/actions)
+[![Coverage](https://git.oblachno.oblachno.fyi/oblachno-oss/devx/raw/commit/a421bc187886bab9a60be6f7616531b14846b84e/coverage.svg)](https://git.oblachno.oblachno.fyi/oblachno-oss/devx/actions)
-[![Tests](https://git.oblachno.oblachno.fyi/oblachno-oss/devx/raw/commit/cc45ecc4b25334441272067865dc0ca96000751c/tests.svg)](https://git.oblachno.oblachno.fyi/oblachno-oss/devx/actions)
+[![Tests](https://git.oblachno.oblachno.fyi/oblachno-oss/devx/raw/commit/a421bc187886bab9a60be6f7616531b14846b84e/tests.svg)](https://git.oblachno.oblachno.fyi/oblachno-oss/devx/actions)
-[![Docs](https://git.oblachno.oblachno.fyi/oblachno-oss/devx/raw/commit/cc45ecc4b25334441272067865dc0ca96000751c/docs.svg)](https://git.oblachno.oblachno.fyi/oblachno-oss/devx/wiki)
+[![Docs](https://git.oblachno.oblachno.fyi/oblachno-oss/devx/raw/commit/a421bc187886bab9a60be6f7616531b14846b84e/docs.svg)](https://git.oblachno.oblachno.fyi/oblachno-oss/devx/wiki)
-[![Code Quality](https://git.oblachno.oblachno.fyi/oblachno-oss/devx/raw/commit/cc45ecc4b25334441272067865dc0ca96000751c/quality.svg)](https://git.oblachno.oblachno.fyi/oblachno-oss/devx/actions)
+[![Code Quality](https://git.oblachno.oblachno.fyi/oblachno-oss/devx/raw/commit/a421bc187886bab9a60be6f7616531b14846b84e/quality.svg)](https://git.oblachno.oblachno.fyi/oblachno-oss/devx/actions)
-[![Version](https://git.oblachno.oblachno.fyi/oblachno-oss/devx/raw/commit/cc45ecc4b25334441272067865dc0ca96000751c/version.svg)](https://git.oblachno.oblachno.fyi/oblachno-oss/devx/releases)
+[![Version](https://git.oblachno.oblachno.fyi/oblachno-oss/devx/raw/commit/a421bc187886bab9a60be6f7616531b14846b84e/version.svg)](https://git.oblachno.oblachno.fyi/oblachno-oss/devx/releases)
-[![Python](https://git.oblachno.oblachno.fyi/oblachno-oss/devx/raw/commit/cc45ecc4b25334441272067865dc0ca96000751c/python.svg)](https://www.python.org/downloads/)
+[![Python](https://git.oblachno.oblachno.fyi/oblachno-oss/devx/raw/commit/a421bc187886bab9a60be6f7616531b14846b84e/python.svg)](https://www.python.org/downloads/)
 
 ## Overview
 
@@ -74,14 +74,14 @@ Add devx to your `pyproject.toml` dependencies and configure the registry:
 ```toml
 [project]
 dependencies = [
-    "devx>=0.53.0",
+    "devx>=0.53.1",
 ]
 
 [tool.pip]
 extra-index-url = "https://git.oblachno.oblachno.fyi/api/packages/oblachno-oss/pypi/simple"
 ```
 
-Pin a specific version if needed: `"devx==0.53.0"` or `"devx>=0.53.0,<0.54"`.
+Pin a specific version if needed: `"devx==0.53.1"` or `"devx>=0.53.1,<0.54"`.
 
 ### Optional extras
 

docs/specs/DEVX-168.md

@@ -0,0 +1,35 @@
+# DEVX-168: Fix create_dependency_pr master-ref parsing
+
+## Problem
+
+`devx.ci.create_dependency_pr` crashes with
+`AttributeError: 'list' object has no attribute 'get'` when creating the
+dependency branch. Gitea's `GET /repos/{o}/{r}/git/refs/heads/master`
+returns a JSON **array** of matching refs, not a single object. Observed
+in production when sso-bridge v0.4.1's post-merge dep-PR step ran.
+
+## Approach
+
+REQ-1: Normalize the ref response — if it is a list, select the entry
+whose `ref` field equals `refs/heads/master` or fall back to the first
+entry; proceed to extract `object.sha` as before. An empty or absent
+SHA still fails closed.
+
+## Test Plan
+
+- Unit test: list-shaped response resolves SHA and creates the PR.
+- Unit test: empty list fails with the master-SHA error message.
+
+## Deploy Plan
+
+devx releases as a version tag; sso-bridge/infra pin bumps pick it up via
+their normal dep-PR flow.
+
+## Rollback Plan
+
+Revert the commit; dep-PR creation stays broken on Gitea (status quo).
+
+## Acceptance Criteria
+
+- [x] REQ-1: list-shaped ref response is handled; SHA extraction works;
+  empty list still errors. Covered by unit tests at 100% coverage.

docs/user/getting-started.md

@@ -48,12 +48,12 @@ Add devx to your `pyproject.toml`:
 ```toml
 [project]
 dependencies = [
-    "devx>=0.53.0",
+    "devx>=0.53.1",
 ]
 
 [project.optional-dependencies]
 dev = [
-    "devx>=0.53.0",
+    "devx>=0.53.1",
 ]
 ```
 

src/devx/__init__.py

@@ -6,4 +6,4 @@ create_dependency_pr, auto_merge, release, publish), developer tooling
 molecule testing helpers for Ansible projects.
 """
 
-__version__ = "0.53.0"
+__version__ = "0.53.1"

src/devx/ci/create_dependency_pr.py

@@ -345,6 +345,12 @@ def cli(
     # Create branch via API
     try:
         master_ref = client._request("GET", "/git/refs/heads/master").json()
+        # Implements: REQ-1 — Gitea returns a list of matching refs
+        if isinstance(master_ref, list):
+            master_ref = next(
+                (r for r in master_ref if r.get("ref") == "refs/heads/master"),
+                master_ref[0] if master_ref else {},
+            )
         master_sha = master_ref.get("object", {}).get("sha", "")
         if not master_sha:
             raise click.ClickException("Could not get master SHA")

tests/unit/test_create_dependency_pr.py

@@ -460,3 +460,72 @@ class TestCliManifestMode:
         assert result.exit_code == 0
         args = mock_digest.call_args[0]
         assert args[1:4] == ("oblachno", "sso-bridge", "0.2.4")
+
+
+class TestMasterRefParsing:
+    """Gitea's /git/refs/heads/<branch> returns a list, not an object."""
+
+    def _invoke(self, client: MagicMock) -> object:
+        runner = CliRunner()
+        return runner.invoke(
+            cli,
+            [
+                "--package",
+                "sso_bridge",
+                "--new-version",
+                "0.9.1",
+                "--source-repo",
+                "oblachno/sso-bridge",
+                "--manifest",
+                "deploy/m.json",
+            ],
+        )
+
+    @patch("devx.ci.create_dependency_pr.create_vikunja_task", return_value=None)
+    @patch("devx.ci.create_dependency_pr.update_manifest", return_value=True)
+    @patch("devx.ci.create_dependency_pr.read_manifest_version", return_value="0.9.0")
+    @patch("devx.ci.create_dependency_pr.find_existing_pr", return_value=None)
+    @patch("devx.ci.create_dependency_pr.GiteaClient")
+    @patch("devx.ci.create_dependency_pr.get_ci_token", return_value="tok")
+    def test_list_shaped_ref_response(
+        self,
+        _token: MagicMock,
+        mock_client_cls: MagicMock,
+        _find: MagicMock,
+        _read: MagicMock,
+        _update: MagicMock,
+        _task: MagicMock,
+    ) -> None:
+        client = mock_client_cls.return_value
+        resp = MagicMock()
+        resp.json.return_value = [{"ref": "refs/heads/master", "object": {"sha": "abc123"}}]
+        client._request.return_value = resp
+        client.create_pr.return_value = {"number": 1}
+        result = self._invoke(client)
+        assert result.exit_code == 0
+        assert "Created PR" in result.output
+        post = client._request.call_args_list[-1]
+        assert post.kwargs["json"]["sha"] == "abc123"
+
+    @patch("devx.ci.create_dependency_pr.create_vikunja_task", return_value=None)
+    @patch("devx.ci.create_dependency_pr.update_manifest", return_value=True)
+    @patch("devx.ci.create_dependency_pr.read_manifest_version", return_value="0.9.0")
+    @patch("devx.ci.create_dependency_pr.find_existing_pr", return_value=None)
+    @patch("devx.ci.create_dependency_pr.GiteaClient")
+    @patch("devx.ci.create_dependency_pr.get_ci_token", return_value="tok")
+    def test_empty_ref_list_fails(
+        self,
+        _token: MagicMock,
+        mock_client_cls: MagicMock,
+        _find: MagicMock,
+        _read: MagicMock,
+        _update: MagicMock,
+        _task: MagicMock,
+    ) -> None:
+        client = mock_client_cls.return_value
+        resp = MagicMock()
+        resp.json.return_value = []
+        client._request.return_value = resp
+        result = self._invoke(client)
+        assert result.exit_code != 0
+        assert "master SHA" in str(result.exception) or "master SHA" in result.output