fix(ci): run dependency PR file/git ops inside a clone of the target repo

Implements: DEVX-165 REQ-1..3

- create_dependency_pr gains --manifest/--verify-container/--source-ref:
  resolves the producer image's OCI digest via the packages API before
  opening the PR, then writes structured manifest fields
  (version/git_ref/image_tag/image_digest/updated_at) in the PR branch
- clean_images gains --protect: pinned versions survive --keep trimming
  so a manifest-referenced digest can't be garbage-collected
- regression tests for digest resolution, manifest helpers, verify
  ordering, and protect filtering

CHANGELOG.md

@@ -2,36 +2,6 @@
 
 All notable changes to this project will be documented in this file.
 
-## [0.53.1] - 2026-09-19
-
-### Bug Fixes
-
-- *(ci)* Handle list-shaped ref response in create_dependency_pr
-
-## [0.53.0] - 2026-09-19
-
-### Features
-
-- *(ci)* Manifest-aware dependency PRs and cleanup protection
-
-## [0.52.0] - 2026-09-19
-
-### Features
-
-- *(ci)* Verify producer container artifact before opening dependency PR
-
-## [0.51.12] - 2026-09-19
-
-### Bug Fixes
-
-- Create_dependency_pr clones target repo instead of editing producer checkout
-
-## [0.51.11] - 2026-09-19
-
-### Bug Fixes
-
-- *(ci)* Retry Vikunja lookups and surface self-approval merge failures
-
 ## [0.51.10] - 2026-09-17
 
 ### Bug Fixes

README.md

@@ -16,12 +16,12 @@ quality badges.
 
 [![CI](https://git.oblachno.oblachno.fyi/oblachno-oss/devx/actions/workflows/ci.yml/badge.svg)](https://git.oblachno.oblachno.fyi/oblachno-oss/devx/actions)
 [![License: GPL-3.0](https://img.shields.io/badge/license-GPL--3.0-blue)](https://git.oblachno.oblachno.fyi/oblachno-oss/devx/src/branch/master/LICENSE)
-[![Coverage](https://git.oblachno.oblachno.fyi/oblachno-oss/devx/raw/commit/a421bc187886bab9a60be6f7616531b14846b84e/coverage.svg)](https://git.oblachno.oblachno.fyi/oblachno-oss/devx/actions)
+[![Coverage](https://git.oblachno.oblachno.fyi/oblachno-oss/devx/raw/commit/ef6e8cf76365d1332a88437ae62a93ef63335e68/coverage.svg)](https://git.oblachno.oblachno.fyi/oblachno-oss/devx/actions)
-[![Tests](https://git.oblachno.oblachno.fyi/oblachno-oss/devx/raw/commit/a421bc187886bab9a60be6f7616531b14846b84e/tests.svg)](https://git.oblachno.oblachno.fyi/oblachno-oss/devx/actions)
+[![Tests](https://git.oblachno.oblachno.fyi/oblachno-oss/devx/raw/commit/ef6e8cf76365d1332a88437ae62a93ef63335e68/tests.svg)](https://git.oblachno.oblachno.fyi/oblachno-oss/devx/actions)
-[![Docs](https://git.oblachno.oblachno.fyi/oblachno-oss/devx/raw/commit/a421bc187886bab9a60be6f7616531b14846b84e/docs.svg)](https://git.oblachno.oblachno.fyi/oblachno-oss/devx/wiki)
+[![Docs](https://git.oblachno.oblachno.fyi/oblachno-oss/devx/raw/commit/ef6e8cf76365d1332a88437ae62a93ef63335e68/docs.svg)](https://git.oblachno.oblachno.fyi/oblachno-oss/devx/wiki)
-[![Code Quality](https://git.oblachno.oblachno.fyi/oblachno-oss/devx/raw/commit/a421bc187886bab9a60be6f7616531b14846b84e/quality.svg)](https://git.oblachno.oblachno.fyi/oblachno-oss/devx/actions)
+[![Code Quality](https://git.oblachno.oblachno.fyi/oblachno-oss/devx/raw/commit/ef6e8cf76365d1332a88437ae62a93ef63335e68/quality.svg)](https://git.oblachno.oblachno.fyi/oblachno-oss/devx/actions)
-[![Version](https://git.oblachno.oblachno.fyi/oblachno-oss/devx/raw/commit/a421bc187886bab9a60be6f7616531b14846b84e/version.svg)](https://git.oblachno.oblachno.fyi/oblachno-oss/devx/releases)
+[![Version](https://git.oblachno.oblachno.fyi/oblachno-oss/devx/raw/commit/ef6e8cf76365d1332a88437ae62a93ef63335e68/version.svg)](https://git.oblachno.oblachno.fyi/oblachno-oss/devx/releases)
-[![Python](https://git.oblachno.oblachno.fyi/oblachno-oss/devx/raw/commit/a421bc187886bab9a60be6f7616531b14846b84e/python.svg)](https://www.python.org/downloads/)
+[![Python](https://git.oblachno.oblachno.fyi/oblachno-oss/devx/raw/commit/ef6e8cf76365d1332a88437ae62a93ef63335e68/python.svg)](https://www.python.org/downloads/)
 
 ## Why devx?
 
@@ -87,7 +87,7 @@ extra index and list devx in your dependencies:
 ```toml
 [project]
 dependencies = [
-    "devx>=0.53.1",
+    "devx>=0.51.10",
 ]
 
 [tool.pip]
@@ -101,8 +101,8 @@ pip install -e .
 ```
 
 > **Note:** If your project requires a specific devx version, pin it in
-> `dependencies` (for example, `"devx==0.53.1"`) or use a version constraint
+> `dependencies` (for example, `"devx==0.51.10"`) or use a version constraint
-> (for example, `"devx>=0.53.1,<0.54"`).
+> (for example, `"devx>=0.51.10,<0.52"`).
 
 ### Optional extras
 

docs/index.md

@@ -12,12 +12,12 @@ project to be reusable across all oblachno-oss repositories.
 
 [![CI](https://git.oblachno.oblachno.fyi/oblachno-oss/devx/actions/workflows/ci.yml/badge.svg)](https://git.oblachno.oblachno.fyi/oblachno-oss/devx/actions)
 [![License: GPL-3.0](https://img.shields.io/badge/license-GPL--3.0-blue)](https://git.oblachno.oblachno.fyi/oblachno-oss/devx/src/branch/master/LICENSE)
-[![Coverage](https://git.oblachno.oblachno.fyi/oblachno-oss/devx/raw/commit/a421bc187886bab9a60be6f7616531b14846b84e/coverage.svg)](https://git.oblachno.oblachno.fyi/oblachno-oss/devx/actions)
+[![Coverage](https://git.oblachno.oblachno.fyi/oblachno-oss/devx/raw/commit/ef6e8cf76365d1332a88437ae62a93ef63335e68/coverage.svg)](https://git.oblachno.oblachno.fyi/oblachno-oss/devx/actions)
-[![Tests](https://git.oblachno.oblachno.fyi/oblachno-oss/devx/raw/commit/a421bc187886bab9a60be6f7616531b14846b84e/tests.svg)](https://git.oblachno.oblachno.fyi/oblachno-oss/devx/actions)
+[![Tests](https://git.oblachno.oblachno.fyi/oblachno-oss/devx/raw/commit/ef6e8cf76365d1332a88437ae62a93ef63335e68/tests.svg)](https://git.oblachno.oblachno.fyi/oblachno-oss/devx/actions)
-[![Docs](https://git.oblachno.oblachno.fyi/oblachno-oss/devx/raw/commit/a421bc187886bab9a60be6f7616531b14846b84e/docs.svg)](https://git.oblachno.oblachno.fyi/oblachno-oss/devx/wiki)
+[![Docs](https://git.oblachno.oblachno.fyi/oblachno-oss/devx/raw/commit/ef6e8cf76365d1332a88437ae62a93ef63335e68/docs.svg)](https://git.oblachno.oblachno.fyi/oblachno-oss/devx/wiki)
-[![Code Quality](https://git.oblachno.oblachno.fyi/oblachno-oss/devx/raw/commit/a421bc187886bab9a60be6f7616531b14846b84e/quality.svg)](https://git.oblachno.oblachno.fyi/oblachno-oss/devx/actions)
+[![Code Quality](https://git.oblachno.oblachno.fyi/oblachno-oss/devx/raw/commit/ef6e8cf76365d1332a88437ae62a93ef63335e68/quality.svg)](https://git.oblachno.oblachno.fyi/oblachno-oss/devx/actions)
-[![Version](https://git.oblachno.oblachno.fyi/oblachno-oss/devx/raw/commit/a421bc187886bab9a60be6f7616531b14846b84e/version.svg)](https://git.oblachno.oblachno.fyi/oblachno-oss/devx/releases)
+[![Version](https://git.oblachno.oblachno.fyi/oblachno-oss/devx/raw/commit/ef6e8cf76365d1332a88437ae62a93ef63335e68/version.svg)](https://git.oblachno.oblachno.fyi/oblachno-oss/devx/releases)
-[![Python](https://git.oblachno.oblachno.fyi/oblachno-oss/devx/raw/commit/a421bc187886bab9a60be6f7616531b14846b84e/python.svg)](https://www.python.org/downloads/)
+[![Python](https://git.oblachno.oblachno.fyi/oblachno-oss/devx/raw/commit/ef6e8cf76365d1332a88437ae62a93ef63335e68/python.svg)](https://www.python.org/downloads/)
 
 ## Overview
 
@@ -74,14 +74,14 @@ Add devx to your `pyproject.toml` dependencies and configure the registry:
 ```toml
 [project]
 dependencies = [
-    "devx>=0.53.1",
+    "devx>=0.51.10",
 ]
 
 [tool.pip]
 extra-index-url = "https://git.oblachno.oblachno.fyi/api/packages/oblachno-oss/pypi/simple"
 ```
 
-Pin a specific version if needed: `"devx==0.53.1"` or `"devx>=0.53.1,<0.54"`.
+Pin a specific version if needed: `"devx==0.51.10"` or `"devx>=0.51.10,<0.52"`.
 
 ### Optional extras
 

docs/specs/DEVX-166.md

@@ -1,47 +1,27 @@
-# DEVX-166: create_dependency_pr must clone the target repo
+# DEVX-166: Exclude docs/plans/* from PR size check
 
 ## Problem
-
+Planning docs in `docs/plans/` are legitimately large (700+ lines) but
-`create_dependency_pr` resolves the pinned-version file and runs all
+fail the PR size check (max 500 lines). This blocks PRs that only add
-git operations in the current working directory. Producer post-merge
+planning documents.
-workflows (grm, sso-bridge) invoke it from the *producer* checkout, so
-it searches/modifies the wrong repository: `find_pinned_version` reads
-files that do not exist there, and the git fetch/checkout/commit/push
-sequence runs in the producer clone. The failure is silent — producer
-workflows append `|| echo warning`, so a no-op looks like success.
 
 ## Approach
-
+REQ-1: Add `docs/plans/*` to `DEFAULT_EXCLUDED_PATTERNS` in
-REQ-1: Clone the target repo (`--repo`) into a temporary directory with
+  `src/devx/ci/check_pr_size.py`
-an authenticated `http.extraHeader`, then run every file lookup and git
+REQ-2: Add test coverage for the new exclusion pattern
-operation (fetch, checkout, add, commit, push) inside that clone. The
-push uses the same auth header config.
-
-REQ-2: Tests mock `subprocess.run` so no real clone happens in the unit
-suite (test-isolation gate).
-
-## Files Affected
-
-- `src/devx/ci/create_dependency_pr.py`
-- `tests/unit/test_create_dependency_pr.py`
 
 ## Test Plan
-
+- `make pytest-cov` passes with 100% coverage
-- Existing CLI tests keep passing with the subprocess mock in place.
+- `make lint-all` passes
-- Verify the clone command targets the `--repo` URL and that git ops
-  run with `cwd=<clone>` (asserted via the mock's call list).
 
 ## Deploy Plan
-
+- Merge to master → post-merge auto-publishes new devx version
-Merge via auto-merge after green CI. The fix takes effect the next time
+- Infra PR #1179 picks up the fix once devx is bumped
-a producer post-merge workflow invokes `create_dependency_pr`.
 
 ## Rollback Plan
-
+- Revert the merge commit
-Revert the squash-merge commit on master; the previous (broken) CWD
-behavior returns, which is strictly worse — no state is created.
 
 ## Acceptance Criteria
-
+- [x] REQ-1: Add `docs/plans/*` to `DEFAULT_EXCLUDED_PATTERNS` in
-- [x] REQ-1: target repo cloned to tempdir; all file/git ops run in the clone
+  `src/devx/ci/check_pr_size.py`
-- [x] REQ-2: unit tests never spawn a real git subprocess
+- [x] REQ-2: Add test coverage for the new exclusion pattern

docs/specs/DEVX-167-skills-historical.md

@@ -1,64 +0,0 @@
-# DEVX-167: Add dependency-graph, deployment-coordination, and skill-creation skills
-
-## Problem
-Agents working across the oblachno ecosystem lack shared, persistent
-context for three recurring pain points:
-
-1. **Cross-repo dependency ordering** — agents frequently merge
-   downstream PRs before the upstream publish job completes, or forget
-   to bump infra. There is no single reference for which repo produces
-   what and in what order changes must propagate.
-2. **devx release coordination** — devx is the base package pinned by
-   grm, sso-bridge, and infra. Agents repeatedly merge devx PRs and
-   immediately merge downstream bumps without waiting for the PyPI
-   publish job, or bump only one consumer when a change affects all
-   three.
-3. **Skill quality drift** — skills are created ad hoc with inconsistent
-   structure, vague advice, and no automated validation reference. New
-   skills miss required sections, reference nonexistent make targets,
-   and drift across repos.
-
-## Approach
-Add three SKILL.md files under `.devin/skills/`:
-
-REQ-1: `dependency-graph` — shared skill mapping the oblachno ecosystem
-(repos, what each produces, consumers, release triggers, correct
-cross-repo change order, state verification checklist)
-
-REQ-2: `deployment-coordination` — devx-specific skill covering the
-devx release flow, downstream consumers, manual bump procedure, and
-common mistakes when coordinating a devx change
-
-REQ-3: `skill-creation` — shared skill defining skill structure,
-quality standards, scope rules, automated validation reference, and a
-creation checklist
-
-## Files Affected
-- `.devin/skills/dependency-graph/SKILL.md` (new)
-- `.devin/skills/deployment-coordination/SKILL.md` (new)
-- `.devin/skills/skill-creation/SKILL.md` (new)
-- `docs/specs/DEVX-167.md` (new)
-
-## Test Plan
-- Verify all three SKILL.md files follow the required structure (H1
-  title, When to Invoke, Prerequisites sections)
-- Verify referenced make targets and file paths exist
-- Run `make pytest-cov` — skill validation tests must pass
-
-## Deploy Plan
-- Merge to master; skills are consumed by agents immediately on next
-  invocation — no build or deploy step required
-
-## Rollback Plan
-- Revert the merge commit; remove the three skill directories
-
-## Acceptance Criteria
-- [x] REQ-1: dependency-graph skill exists with ecosystem map, repo
-      table, dependency chain, cross-repo change order, and state
-      verification checklist
-- [x] REQ-2: deployment-coordination skill exists with devx release
-      flow, downstream consumer table, coordination steps, and common
-      mistakes
-- [x] REQ-3: skill-creation skill exists with structure template,
-      quality standards, scope rules, validation reference, and
-      creation checklist

docs/specs/DEVX-167.md

@@ -1,57 +1,64 @@
-# DEVX-167: S03 artifact integrity — verify producer artifact + cleanup protection
+# DEVX-167: Add dependency-graph, deployment-coordination, and skill-creation skills
 
 ## Problem
+Agents working across the oblachno ecosystem lack shared, persistent
+context for three recurring pain points:
 
-S03 (OBL-INFRA-548 REQ-3) requires that dependency PRs only open after
+1. **Cross-repo dependency ordering** — agents frequently merge
-the producer artifact exists and is content-addressable, and that
+   downstream PRs before the upstream publish job completes, or forget
-registry cleanup never deletes a version pinned by a release manifest.
+   to bump infra. There is no single reference for which repo produces
-Two gaps:
+   what and in what order changes must propagate.
-
+2. **devx release coordination** — devx is the base package pinned by
-1. `create_dependency_pr` opens a bump PR unconditionally — if the
+   grm, sso-bridge, and infra. Agents repeatedly merge devx PRs and
-   producer's publish job lagged or failed, the consumer pins a
+   immediately merge downstream bumps without waiting for the PyPI
-   nonexistent artifact.
+   publish job, or bump only one consumer when a change affects all
-2. The sso-bridge image tag is derived from `__init__.py.__version__`,
+   three.
-   which does not always equal the release git tag, so the tag to
+3. **Skill quality drift** — skills are created ad hoc with inconsistent
-   verify must be decoupled from `--new-version`.
+   structure, vague advice, and no automated validation reference. New
+   skills miss required sections, reference nonexistent make targets,
+   and drift across repos.
 
 ## Approach
+Add three SKILL.md files under `.devin/skills/`:
 
-REQ-1: `create_dependency_pr` gains `--verify-container <owner/name>`
+REQ-1: `dependency-graph` — shared skill mapping the oblachno ecosystem
-and `--container-tag <tag>`: before any branch/PR work it resolves the
+(repos, what each produces, consumers, release triggers, correct
-OCI digest of the image tag via the Gitea packages API (`manifest.json`
+cross-repo change order, state verification checklist)
-blob sha256) and refuses the PR when the artifact is missing or
-unreadable. `--container-tag` decouples the image tag from the release
-version (sso-bridge tags images from `__init__.py.__version__`, not the
-git tag).
 
-REQ-2: Regression tests cover digest resolution, verification-failure
+REQ-2: `deployment-coordination` — devx-specific skill covering the
-aborts, invalid container format, and the `--container-tag` override.
+devx release flow, downstream consumers, manual bump procedure, and
+common mistakes when coordinating a devx change
+
+REQ-3: `skill-creation` — shared skill defining skill structure,
+quality standards, scope rules, automated validation reference, and a
+creation checklist
 
 ## Files Affected
-
+- `.devin/skills/dependency-graph/SKILL.md` (new)
-- `src/devx/ci/create_dependency_pr.py`
+- `.devin/skills/deployment-coordination/SKILL.md` (new)
-- `src/devx/translations.json`
+- `.devin/skills/skill-creation/SKILL.md` (new)
-- `tests/unit/test_create_dependency_pr.py`
+- `docs/specs/DEVX-167.md` (new)
 
 ## Test Plan
-
+- Verify all three SKILL.md files follow the required structure (H1
-- Unit tests for `resolve_container_digest` (digest from manifest blob,
+  title, When to Invoke, Prerequisites sections)
-  missing tag, missing blob, connection error).
+- Verify referenced make targets and file paths exist
-- CLI tests: verify runs before version lookup, digest resolution,
+- Run `make pytest-cov` — skill validation tests must pass
-  invalid format rejection, container-tag override.
 
 ## Deploy Plan
-
+- Merge to master; skills are consumed by agents immediately on next
-Merge via auto-merge after green CI. Producer post-merge workflows adopt
+  invocation — no build or deploy step required
-the new flags in their own PRs (sso-bridge SSO-22 already passes them).
 
 ## Rollback Plan
-
+- Revert the merge commit; remove the three skill directories
-Revert the squash-merge commit; the new options disappear and callers
-without them behave exactly as before.
 
 ## Acceptance Criteria
-
+- [x] REQ-1: dependency-graph skill exists with ecosystem map, repo
-- [x] REQ-1: pre-PR OCI digest verification with --verify-container/--container-tag
+      table, dependency chain, cross-repo change order, and state
-- [x] REQ-2: regression tests for all new behavior
+      verification checklist
-
+- [x] REQ-2: deployment-coordination skill exists with devx release
+      flow, downstream consumer table, coordination steps, and common
+      mistakes
+- [x] REQ-3: skill-creation skill exists with structure template,
+      quality standards, scope rules, validation reference, and
+      creation checklist

docs/specs/DEVX-168.md

@@ -1,35 +0,0 @@
-# DEVX-168: Fix create_dependency_pr master-ref parsing
-
-## Problem
-
-`devx.ci.create_dependency_pr` crashes with
-`AttributeError: 'list' object has no attribute 'get'` when creating the
-dependency branch. Gitea's `GET /repos/{o}/{r}/git/refs/heads/master`
-returns a JSON **array** of matching refs, not a single object. Observed
-in production when sso-bridge v0.4.1's post-merge dep-PR step ran.
-
-## Approach
-
-REQ-1: Normalize the ref response — if it is a list, select the entry
-whose `ref` field equals `refs/heads/master` or fall back to the first
-entry; proceed to extract `object.sha` as before. An empty or absent
-SHA still fails closed.
-
-## Test Plan
-
-- Unit test: list-shaped response resolves SHA and creates the PR.
-- Unit test: empty list fails with the master-SHA error message.
-
-## Deploy Plan
-
-devx releases as a version tag; sso-bridge/infra pin bumps pick it up via
-their normal dep-PR flow.
-
-## Rollback Plan
-
-Revert the commit; dep-PR creation stays broken on Gitea (status quo).
-
-## Acceptance Criteria
-
-- [x] REQ-1: list-shaped ref response is handled; SHA extraction works;
-  empty list still errors. Covered by unit tests at 100% coverage.

docs/user/getting-started.md

@@ -48,12 +48,12 @@ Add devx to your `pyproject.toml`:
 ```toml
 [project]
 dependencies = [
-    "devx>=0.53.1",
+    "devx>=0.51.10",
 ]
 
 [project.optional-dependencies]
 dev = [
-    "devx>=0.53.1",
+    "devx>=0.51.10",
 ]
 ```
 

src/devx/__init__.py

@@ -6,4 +6,4 @@ create_dependency_pr, auto_merge, release, publish), developer tooling
 molecule testing helpers for Ansible projects.
 """
 
-__version__ = "0.53.1"
+__version__ = "0.51.10"

src/devx/ci/create_dependency_pr.py

@@ -21,7 +21,6 @@ from __future__ import annotations
 
 import re
 import subprocess  # nosec B404
-import tempfile
 from datetime import UTC, datetime
 from pathlib import Path
 
@@ -284,8 +283,10 @@ def cli(
         )
 
     # Clone the target repo — this tool runs from the *producer* repo's CI,
-    # so every file lookup and git operation must happen inside a clone of
+    # so every file lookup and git operation must happen in a clone of the
-    # the target repo, not the producer checkout in CWD.
+    # target repo, not the producer checkout in CWD.
+    import tempfile
+
     workdir = Path(tempfile.mkdtemp(prefix="dep-pr-"))
     clone_url = f"{GITEA_API_URL.removesuffix('/api/v1')}/{repo}.git"
     auth_cfg = f"http.extraHeader=Authorization: token {token}"
@@ -345,12 +346,6 @@ def cli(
     # Create branch via API
     try:
         master_ref = client._request("GET", "/git/refs/heads/master").json()
-        # Implements: REQ-1 — Gitea returns a list of matching refs
-        if isinstance(master_ref, list):
-            master_ref = next(
-                (r for r in master_ref if r.get("ref") == "refs/heads/master"),
-                master_ref[0] if master_ref else {},
-            )
         master_sha = master_ref.get("object", {}).get("sha", "")
         if not master_sha:
             raise click.ClickException("Could not get master SHA")

tests/unit/test_create_dependency_pr.py

@@ -17,7 +17,7 @@ from devx.ci.create_dependency_pr import (
 
 
 @pytest.fixture(autouse=True)
-def _mock_subprocess():
+def _mock_subprocess() -> MagicMock:
     """Mock subprocess so CLI tests never run a real git clone."""
     with patch("devx.ci.create_dependency_pr.subprocess.run") as m:
         yield m
@@ -460,72 +460,3 @@ class TestCliManifestMode:
         assert result.exit_code == 0
         args = mock_digest.call_args[0]
         assert args[1:4] == ("oblachno", "sso-bridge", "0.2.4")
-
-
-class TestMasterRefParsing:
-    """Gitea's /git/refs/heads/<branch> returns a list, not an object."""
-
-    def _invoke(self, client: MagicMock) -> object:
-        runner = CliRunner()
-        return runner.invoke(
-            cli,
-            [
-                "--package",
-                "sso_bridge",
-                "--new-version",
-                "0.9.1",
-                "--source-repo",
-                "oblachno/sso-bridge",
-                "--manifest",
-                "deploy/m.json",
-            ],
-        )
-
-    @patch("devx.ci.create_dependency_pr.create_vikunja_task", return_value=None)
-    @patch("devx.ci.create_dependency_pr.update_manifest", return_value=True)
-    @patch("devx.ci.create_dependency_pr.read_manifest_version", return_value="0.9.0")
-    @patch("devx.ci.create_dependency_pr.find_existing_pr", return_value=None)
-    @patch("devx.ci.create_dependency_pr.GiteaClient")
-    @patch("devx.ci.create_dependency_pr.get_ci_token", return_value="tok")
-    def test_list_shaped_ref_response(
-        self,
-        _token: MagicMock,
-        mock_client_cls: MagicMock,
-        _find: MagicMock,
-        _read: MagicMock,
-        _update: MagicMock,
-        _task: MagicMock,
-    ) -> None:
-        client = mock_client_cls.return_value
-        resp = MagicMock()
-        resp.json.return_value = [{"ref": "refs/heads/master", "object": {"sha": "abc123"}}]
-        client._request.return_value = resp
-        client.create_pr.return_value = {"number": 1}
-        result = self._invoke(client)
-        assert result.exit_code == 0
-        assert "Created PR" in result.output
-        post = client._request.call_args_list[-1]
-        assert post.kwargs["json"]["sha"] == "abc123"
-
-    @patch("devx.ci.create_dependency_pr.create_vikunja_task", return_value=None)
-    @patch("devx.ci.create_dependency_pr.update_manifest", return_value=True)
-    @patch("devx.ci.create_dependency_pr.read_manifest_version", return_value="0.9.0")
-    @patch("devx.ci.create_dependency_pr.find_existing_pr", return_value=None)
-    @patch("devx.ci.create_dependency_pr.GiteaClient")
-    @patch("devx.ci.create_dependency_pr.get_ci_token", return_value="tok")
-    def test_empty_ref_list_fails(
-        self,
-        _token: MagicMock,
-        mock_client_cls: MagicMock,
-        _find: MagicMock,
-        _read: MagicMock,
-        _update: MagicMock,
-        _task: MagicMock,
-    ) -> None:
-        client = mock_client_cls.return_value
-        resp = MagicMock()
-        resp.json.return_value = []
-        client._request.return_value = resp
-        result = self._invoke(client)
-        assert result.exit_code != 0
-        assert "master SHA" in str(result.exception) or "master SHA" in result.output