release: v0.53.3 [skip ci]

CHANGELOG.md

@@ -2,6 +2,18 @@
 
 All notable changes to this project will be documented in this file.
 
+## [0.53.3] - 2026-09-19
+
+### Bug Fixes
+
+- *(ci)* Check out API-created dep branch via remote-tracking ref
+
+## [0.53.2] - 2026-09-19
+
+### Bug Fixes
+
+- *(ci)* Create dep-PR branches via POST /branches
+
 ## [0.53.1] - 2026-09-19
 
 ### Bug Fixes

README.md

@@ -16,12 +16,12 @@ quality badges.
 
 [![CI](https://git.oblachno.oblachno.fyi/oblachno-oss/devx/actions/workflows/ci.yml/badge.svg)](https://git.oblachno.oblachno.fyi/oblachno-oss/devx/actions)
 [![License: GPL-3.0](https://img.shields.io/badge/license-GPL--3.0-blue)](https://git.oblachno.oblachno.fyi/oblachno-oss/devx/src/branch/master/LICENSE)
-[![Coverage](https://git.oblachno.oblachno.fyi/oblachno-oss/devx/raw/commit/a421bc187886bab9a60be6f7616531b14846b84e/coverage.svg)](https://git.oblachno.oblachno.fyi/oblachno-oss/devx/actions)
+[![Coverage](https://git.oblachno.oblachno.fyi/oblachno-oss/devx/raw/commit/b7c6d5dd189be76f753c340a77cdc2938392d6ea/coverage.svg)](https://git.oblachno.oblachno.fyi/oblachno-oss/devx/actions)
-[![Tests](https://git.oblachno.oblachno.fyi/oblachno-oss/devx/raw/commit/a421bc187886bab9a60be6f7616531b14846b84e/tests.svg)](https://git.oblachno.oblachno.fyi/oblachno-oss/devx/actions)
+[![Tests](https://git.oblachno.oblachno.fyi/oblachno-oss/devx/raw/commit/b7c6d5dd189be76f753c340a77cdc2938392d6ea/tests.svg)](https://git.oblachno.oblachno.fyi/oblachno-oss/devx/actions)
-[![Docs](https://git.oblachno.oblachno.fyi/oblachno-oss/devx/raw/commit/a421bc187886bab9a60be6f7616531b14846b84e/docs.svg)](https://git.oblachno.oblachno.fyi/oblachno-oss/devx/wiki)
+[![Docs](https://git.oblachno.oblachno.fyi/oblachno-oss/devx/raw/commit/b7c6d5dd189be76f753c340a77cdc2938392d6ea/docs.svg)](https://git.oblachno.oblachno.fyi/oblachno-oss/devx/wiki)
-[![Code Quality](https://git.oblachno.oblachno.fyi/oblachno-oss/devx/raw/commit/a421bc187886bab9a60be6f7616531b14846b84e/quality.svg)](https://git.oblachno.oblachno.fyi/oblachno-oss/devx/actions)
+[![Code Quality](https://git.oblachno.oblachno.fyi/oblachno-oss/devx/raw/commit/b7c6d5dd189be76f753c340a77cdc2938392d6ea/quality.svg)](https://git.oblachno.oblachno.fyi/oblachno-oss/devx/actions)
-[![Version](https://git.oblachno.oblachno.fyi/oblachno-oss/devx/raw/commit/a421bc187886bab9a60be6f7616531b14846b84e/version.svg)](https://git.oblachno.oblachno.fyi/oblachno-oss/devx/releases)
+[![Version](https://git.oblachno.oblachno.fyi/oblachno-oss/devx/raw/commit/b7c6d5dd189be76f753c340a77cdc2938392d6ea/version.svg)](https://git.oblachno.oblachno.fyi/oblachno-oss/devx/releases)
-[![Python](https://git.oblachno.oblachno.fyi/oblachno-oss/devx/raw/commit/a421bc187886bab9a60be6f7616531b14846b84e/python.svg)](https://www.python.org/downloads/)
+[![Python](https://git.oblachno.oblachno.fyi/oblachno-oss/devx/raw/commit/b7c6d5dd189be76f753c340a77cdc2938392d6ea/python.svg)](https://www.python.org/downloads/)
 
 ## Why devx?
 
@@ -87,7 +87,7 @@ extra index and list devx in your dependencies:
 ```toml
 [project]
 dependencies = [
-    "devx>=0.53.1",
+    "devx>=0.53.3",
 ]
 
 [tool.pip]
@@ -101,8 +101,8 @@ pip install -e .
 ```
 
 > **Note:** If your project requires a specific devx version, pin it in
-> `dependencies` (for example, `"devx==0.53.1"`) or use a version constraint
+> `dependencies` (for example, `"devx==0.53.3"`) or use a version constraint
-> (for example, `"devx>=0.53.1,<0.54"`).
+> (for example, `"devx>=0.53.3,<0.54"`).
 
 ### Optional extras
 

docs/index.md

@@ -12,12 +12,12 @@ project to be reusable across all oblachno-oss repositories.
 
 [![CI](https://git.oblachno.oblachno.fyi/oblachno-oss/devx/actions/workflows/ci.yml/badge.svg)](https://git.oblachno.oblachno.fyi/oblachno-oss/devx/actions)
 [![License: GPL-3.0](https://img.shields.io/badge/license-GPL--3.0-blue)](https://git.oblachno.oblachno.fyi/oblachno-oss/devx/src/branch/master/LICENSE)
-[![Coverage](https://git.oblachno.oblachno.fyi/oblachno-oss/devx/raw/commit/a421bc187886bab9a60be6f7616531b14846b84e/coverage.svg)](https://git.oblachno.oblachno.fyi/oblachno-oss/devx/actions)
+[![Coverage](https://git.oblachno.oblachno.fyi/oblachno-oss/devx/raw/commit/b7c6d5dd189be76f753c340a77cdc2938392d6ea/coverage.svg)](https://git.oblachno.oblachno.fyi/oblachno-oss/devx/actions)
-[![Tests](https://git.oblachno.oblachno.fyi/oblachno-oss/devx/raw/commit/a421bc187886bab9a60be6f7616531b14846b84e/tests.svg)](https://git.oblachno.oblachno.fyi/oblachno-oss/devx/actions)
+[![Tests](https://git.oblachno.oblachno.fyi/oblachno-oss/devx/raw/commit/b7c6d5dd189be76f753c340a77cdc2938392d6ea/tests.svg)](https://git.oblachno.oblachno.fyi/oblachno-oss/devx/actions)
-[![Docs](https://git.oblachno.oblachno.fyi/oblachno-oss/devx/raw/commit/a421bc187886bab9a60be6f7616531b14846b84e/docs.svg)](https://git.oblachno.oblachno.fyi/oblachno-oss/devx/wiki)
+[![Docs](https://git.oblachno.oblachno.fyi/oblachno-oss/devx/raw/commit/b7c6d5dd189be76f753c340a77cdc2938392d6ea/docs.svg)](https://git.oblachno.oblachno.fyi/oblachno-oss/devx/wiki)
-[![Code Quality](https://git.oblachno.oblachno.fyi/oblachno-oss/devx/raw/commit/a421bc187886bab9a60be6f7616531b14846b84e/quality.svg)](https://git.oblachno.oblachno.fyi/oblachno-oss/devx/actions)
+[![Code Quality](https://git.oblachno.oblachno.fyi/oblachno-oss/devx/raw/commit/b7c6d5dd189be76f753c340a77cdc2938392d6ea/quality.svg)](https://git.oblachno.oblachno.fyi/oblachno-oss/devx/actions)
-[![Version](https://git.oblachno.oblachno.fyi/oblachno-oss/devx/raw/commit/a421bc187886bab9a60be6f7616531b14846b84e/version.svg)](https://git.oblachno.oblachno.fyi/oblachno-oss/devx/releases)
+[![Version](https://git.oblachno.oblachno.fyi/oblachno-oss/devx/raw/commit/b7c6d5dd189be76f753c340a77cdc2938392d6ea/version.svg)](https://git.oblachno.oblachno.fyi/oblachno-oss/devx/releases)
-[![Python](https://git.oblachno.oblachno.fyi/oblachno-oss/devx/raw/commit/a421bc187886bab9a60be6f7616531b14846b84e/python.svg)](https://www.python.org/downloads/)
+[![Python](https://git.oblachno.oblachno.fyi/oblachno-oss/devx/raw/commit/b7c6d5dd189be76f753c340a77cdc2938392d6ea/python.svg)](https://www.python.org/downloads/)
 
 ## Overview
 
@@ -74,14 +74,14 @@ Add devx to your `pyproject.toml` dependencies and configure the registry:
 ```toml
 [project]
 dependencies = [
-    "devx>=0.53.1",
+    "devx>=0.53.3",
 ]
 
 [tool.pip]
 extra-index-url = "https://git.oblachno.oblachno.fyi/api/packages/oblachno-oss/pypi/simple"
 ```
 
-Pin a specific version if needed: `"devx==0.53.1"` or `"devx>=0.53.1,<0.54"`.
+Pin a specific version if needed: `"devx==0.53.3"` or `"devx>=0.53.3,<0.54"`.
 
 ### Optional extras
 

docs/specs/DEVX-169.md

@@ -0,0 +1,33 @@
+# DEVX-169: create_dependency_pr uses branches API
+
+## Problem
+
+After DEVX-168, dep-PR creation fails at `POST /git/refs` with
+`HTTP 405 Method Not Allowed` — this Gitea version does not implement the
+createRef endpoint. Observed creating the sso_bridge 0.4.1 infra
+dependency PR.
+
+## Approach
+
+REQ-1: Create the dependency branch via `POST /branches` with
+`new_branch_name`/`old_branch_name` (from master). An already-exists
+error is tolerated; other API errors fail closed.
+
+## Test Plan
+
+- Branch creation calls `POST /branches` with the expected payload.
+- 422 already-exists is tolerated and the PR is still created.
+- Other API errors abort with a branch-creation failure.
+
+## Deploy Plan
+
+devx release tag; producers pick it up via pin bumps.
+
+## Rollback Plan
+
+Revert; dep-PR creation stays broken (status quo).
+
+## Acceptance Criteria
+
+- [x] REQ-1: branch creation uses the branches API; already-exists
+  tolerated; failures surface. Covered by unit tests at 100% coverage.

docs/specs/DEVX-170.md

@@ -0,0 +1,33 @@
+# DEVX-170: create_dependency_pr checks out the API-created branch
+
+## Problem
+
+After DEVX-169 the dependency branch is created via `POST /branches`, but
+`git fetch origin <branch>` only populates `FETCH_HEAD`. The follow-up
+`git checkout <branch>` fails silently (`check=False`), commits land on
+the wrong ref, and `git push origin <branch>` fails with
+`src refspec does not match any`. Observed creating the sso_bridge 0.4.1
+infra dependency PR.
+
+## Approach
+
+REQ-1: Fetch the API-created branch into `refs/remotes/origin/<branch>`
+and force-create the local branch with `git checkout -B <branch>
+origin/<branch>`, both with `check=True` so failures surface.
+
+## Test Plan
+
+- Unit test asserts the fetch refspec and `checkout -B` invocations.
+
+## Deploy Plan
+
+devx release tag; producers pick it up via pin bumps.
+
+## Rollback Plan
+
+Revert; dep-PR creation stays broken (status quo).
+
+## Acceptance Criteria
+
+- [x] REQ-1: the clone checks out the API-created branch so commit and
+  push target `deps/<pkg>-<version>`; covered by unit tests.

docs/user/getting-started.md

@@ -48,12 +48,12 @@ Add devx to your `pyproject.toml`:
 ```toml
 [project]
 dependencies = [
-    "devx>=0.53.1",
+    "devx>=0.53.3",
 ]
 
 [project.optional-dependencies]
 dev = [
-    "devx>=0.53.1",
+    "devx>=0.53.3",
 ]
 ```
 

src/devx/__init__.py

@@ -6,4 +6,4 @@ create_dependency_pr, auto_merge, release, publish), developer tooling
 molecule testing helpers for Ansible projects.
 """
 
-__version__ = "0.53.1"
+__version__ = "0.53.3"

src/devx/ci/create_dependency_pr.py

@@ -344,26 +344,34 @@ def cli(
 
     # Create branch via API
     try:
-        master_ref = client._request("GET", "/git/refs/heads/master").json()
+        # Implements: REQ-1 — Gitea lacks POST /git/refs; create the branch
-        # Implements: REQ-1 — Gitea returns a list of matching refs
+        # from master via the branches API.
-        if isinstance(master_ref, list):
+        client._request(
-            master_ref = next(
+            "POST",
-                (r for r in master_ref if r.get("ref") == "refs/heads/master"),
+            "/branches",
-                master_ref[0] if master_ref else {},
+            json={"new_branch_name": branch_name, "old_branch_name": base_branch},
-            )
+        )
-        master_sha = master_ref.get("object", {}).get("sha", "")
-        if not master_sha:
-            raise click.ClickException("Could not get master SHA")
-        client._request("POST", "/git/refs", json={"ref": f"refs/heads/{branch_name}", "sha": master_sha})
     except APIError as e:
         if "already exists" in str(e).lower():
             click.echo(f"[dep-pr] Branch {branch_name} already exists")
         else:
             raise click.ClickException(_("Failed to create branch: {error}", error=str(e))) from None
 
-    # Check out the API-created branch inside the target clone.
+    # Check out the API-created branch inside the target clone. A plain
-    subprocess.run(["git", "fetch", "origin", f"{branch_name}"], check=False, capture_output=True, cwd=workdir)  # nosec B603 B607
+    # fetch only populates FETCH_HEAD — fetch into the remote-tracking ref
-    subprocess.run(["git", "checkout", branch_name], check=False, capture_output=True, cwd=workdir)  # nosec B603 B607
+    # and force-create the local branch from it.
+    subprocess.run(  # nosec B603 B607
+        ["git", "fetch", "origin", f"{branch_name}:refs/remotes/origin/{branch_name}"],
+        check=True,
+        capture_output=True,
+        cwd=workdir,
+    )
+    subprocess.run(  # nosec B603 B607
+        ["git", "checkout", "-B", branch_name, f"origin/{branch_name}"],
+        check=True,
+        capture_output=True,
+        cwd=workdir,
+    )
 
     if manifest_path:
         fields = {

tests/unit/test_create_dependency_pr.py

@@ -462,10 +462,10 @@ class TestCliManifestMode:
         assert args[1:4] == ("oblachno", "sso-bridge", "0.2.4")
 
 
-class TestMasterRefParsing:
+class TestBranchCreation:
-    """Gitea's /git/refs/heads/<branch> returns a list, not an object."""
+    """Branch creation uses the branches API (Gitea lacks POST /git/refs)."""
 
-    def _invoke(self, client: MagicMock) -> object:
+    def _invoke(self) -> object:
         runner = CliRunner()
         return runner.invoke(
             cli,
@@ -481,31 +481,10 @@ class TestMasterRefParsing:
             ],
         )
 
-    @patch("devx.ci.create_dependency_pr.create_vikunja_task", return_value=None)
+    def _client(self, mock_client_cls: MagicMock) -> MagicMock:
-    @patch("devx.ci.create_dependency_pr.update_manifest", return_value=True)
-    @patch("devx.ci.create_dependency_pr.read_manifest_version", return_value="0.9.0")
-    @patch("devx.ci.create_dependency_pr.find_existing_pr", return_value=None)
-    @patch("devx.ci.create_dependency_pr.GiteaClient")
-    @patch("devx.ci.create_dependency_pr.get_ci_token", return_value="tok")
-    def test_list_shaped_ref_response(
-        self,
-        _token: MagicMock,
-        mock_client_cls: MagicMock,
-        _find: MagicMock,
-        _read: MagicMock,
-        _update: MagicMock,
-        _task: MagicMock,
-    ) -> None:
         client = mock_client_cls.return_value
-        resp = MagicMock()
-        resp.json.return_value = [{"ref": "refs/heads/master", "object": {"sha": "abc123"}}]
-        client._request.return_value = resp
         client.create_pr.return_value = {"number": 1}
-        result = self._invoke(client)
+        return client
-        assert result.exit_code == 0
-        assert "Created PR" in result.output
-        post = client._request.call_args_list[-1]
-        assert post.kwargs["json"]["sha"] == "abc123"
 
     @patch("devx.ci.create_dependency_pr.create_vikunja_task", return_value=None)
     @patch("devx.ci.create_dependency_pr.update_manifest", return_value=True)
@@ -513,7 +492,7 @@ class TestMasterRefParsing:
     @patch("devx.ci.create_dependency_pr.find_existing_pr", return_value=None)
     @patch("devx.ci.create_dependency_pr.GiteaClient")
     @patch("devx.ci.create_dependency_pr.get_ci_token", return_value="tok")
-    def test_empty_ref_list_fails(
+    def test_creates_branch_via_branches_api(
         self,
         _token: MagicMock,
         mock_client_cls: MagicMock,
@@ -522,10 +501,83 @@ class TestMasterRefParsing:
         _update: MagicMock,
         _task: MagicMock,
     ) -> None:
-        client = mock_client_cls.return_value
+        client = self._client(mock_client_cls)
-        resp = MagicMock()
+        result = self._invoke()
-        resp.json.return_value = []
+        assert result.exit_code == 0
-        client._request.return_value = resp
+        assert "Created PR" in result.output
-        result = self._invoke(client)
+        post = client._request.call_args
+        assert post.args[:2] == ("POST", "/branches")
+        assert post.kwargs["json"] == {
+            "new_branch_name": "deps/sso_bridge-0.9.1",
+            "old_branch_name": "master",
+        }
+
+    @patch("devx.ci.create_dependency_pr.create_vikunja_task", return_value=None)
+    @patch("devx.ci.create_dependency_pr.update_manifest", return_value=True)
+    @patch("devx.ci.create_dependency_pr.read_manifest_version", return_value="0.9.0")
+    @patch("devx.ci.create_dependency_pr.find_existing_pr", return_value=None)
+    @patch("devx.ci.create_dependency_pr.GiteaClient")
+    @patch("devx.ci.create_dependency_pr.get_ci_token", return_value="tok")
+    def test_existing_branch_tolerated(
+        self,
+        _token: MagicMock,
+        mock_client_cls: MagicMock,
+        _find: MagicMock,
+        _read: MagicMock,
+        _update: MagicMock,
+        _task: MagicMock,
+    ) -> None:
+        from devx.exceptions import APIError
+
+        client = self._client(mock_client_cls)
+        client._request.side_effect = APIError(422, "branch already exists")
+        result = self._invoke()
+        assert result.exit_code == 0
+        assert "already exists" in result.output.lower()
+
+    @patch("devx.ci.create_dependency_pr.create_vikunja_task", return_value=None)
+    @patch("devx.ci.create_dependency_pr.update_manifest", return_value=True)
+    @patch("devx.ci.create_dependency_pr.read_manifest_version", return_value="0.9.0")
+    @patch("devx.ci.create_dependency_pr.find_existing_pr", return_value=None)
+    @patch("devx.ci.create_dependency_pr.GiteaClient")
+    @patch("devx.ci.create_dependency_pr.get_ci_token", return_value="tok")
+    def test_branch_api_error_fails(
+        self,
+        _token: MagicMock,
+        mock_client_cls: MagicMock,
+        _find: MagicMock,
+        _read: MagicMock,
+        _update: MagicMock,
+        _task: MagicMock,
+    ) -> None:
+        from devx.exceptions import APIError
+
+        client = self._client(mock_client_cls)
+        client._request.side_effect = APIError(500, "boom")
+        result = self._invoke()
         assert result.exit_code != 0
-        assert "master SHA" in str(result.exception) or "master SHA" in result.output
+        assert "Failed to create branch" in result.output
+
+    @patch("devx.ci.create_dependency_pr.create_vikunja_task", return_value=None)
+    @patch("devx.ci.create_dependency_pr.update_manifest", return_value=True)
+    @patch("devx.ci.create_dependency_pr.read_manifest_version", return_value="0.9.0")
+    @patch("devx.ci.create_dependency_pr.find_existing_pr", return_value=None)
+    @patch("devx.ci.create_dependency_pr.GiteaClient")
+    @patch("devx.ci.create_dependency_pr.get_ci_token", return_value="tok")
+    def test_checks_out_remote_tracking_branch(
+        self,
+        _token: MagicMock,
+        mock_client_cls: MagicMock,
+        _find: MagicMock,
+        _read: MagicMock,
+        _update: MagicMock,
+        _task: MagicMock,
+    ) -> None:
+        import subprocess
+
+        self._client(mock_client_cls)
+        result = self._invoke()
+        assert result.exit_code == 0
+        calls = [c.args[0] for c in subprocess.run.call_args_list]
+        assert ["git", "fetch", "origin", "deps/sso_bridge-0.9.1:refs/remotes/origin/deps/sso_bridge-0.9.1"] in calls
+        assert ["git", "checkout", "-B", "deps/sso_bridge-0.9.1", "origin/deps/sso_bridge-0.9.1"] in calls