chore: update badge URLs to commit 81d1d948 [skip ci]

Co-authored-by: emil User <emil.simeonov@tutanota.com>

.gitea/workflows/ci.yml

@@ -33,21 +33,40 @@ jobs:
       - uses: actions/checkout@v4
         with:
           fetch-depth: 0
+      # Implements: REQ-1 (DEVX-176) — docs-only changes skip the heavy
+      # quality steps. Detection needs only git, so it runs before setup.
+      - name: Detect docs-only change
+        id: docs-only
+        if: github.event_name == 'pull_request'
+        run: |
+          HEAD="${{ github.event.pull_request.head.sha || github.sha }}"
+          DOCS_ONLY=true
+          while IFS= read -r f; do
+            case "$f" in
+              docs/*|*.md|.devin/*) ;;
+              *) DOCS_ONLY=false; break;;
+            esac
+          done < <(git diff --name-only "origin/master...$HEAD")
+          echo "docs-only=$DOCS_ONLY" >> "$GITHUB_OUTPUT"
+          echo "docs-only=$DOCS_ONLY"
       - name: Set up environment
         env:
           CI_GITEA_API_TOKEN: ${{ secrets.CI_GITEA_API_TOKEN }}
         run: make setup-image
       # --- quality steps ---
       - name: Lint all
+        if: steps.docs-only.outputs.docs-only != 'true'
         run: |
           . .venv/bin/activate 2>/dev/null || true
           export PATH="$HOME/.local/bin:$PATH"
           make lint-all
       - name: Unit tests with 100% coverage
+        if: steps.docs-only.outputs.docs-only != 'true'
         run: |
           . .venv/bin/activate 2>/dev/null || true
           make pytest-cov
       - name: Check unit test speed
+        if: steps.docs-only.outputs.docs-only != 'true'
         run: |
           . .venv/bin/activate 2>/dev/null || true
           python3 -m devx.tools.check_test_speed --max-seconds 15 --max-single-seconds 0.5
@@ -60,10 +79,12 @@ jobs:
           export PATH="$HOME/.local/bin:$PATH"
           make devx-docs-check
       - name: Translation completeness check
+        if: steps.docs-only.outputs.docs-only != 'true'
         run: |
           . .venv/bin/activate 2>/dev/null || true
           python3 -m devx.ci.check_translations
       - name: Dependency security scan
+        if: steps.docs-only.outputs.docs-only != 'true'
         run: |
           . .venv/bin/activate 2>/dev/null || true
           # Install pip in venv if missing (needed by pip-audit)
@@ -71,6 +92,7 @@ jobs:
           PIPAPI_PYTHON_LOCATION=$PWD/.venv/bin/python \
             pip-audit --desc --skip-editable 2>&1 || true
       - name: Workflow dry-run validation
+        if: steps.docs-only.outputs.docs-only != 'true'
         run: |
           . .venv/bin/activate 2>/dev/null || true
           export PATH="$HOME/.local/bin:$PATH"
@@ -137,19 +159,9 @@ jobs:
           . .venv/bin/activate 2>/dev/null || true
           export PATH="$HOME/.local/bin:$PATH"
           python3 -m devx.ci.release --dry-run
-      - name: Notify on failure
+      # Implements: REQ-2 (DEVX-176) — no failure-issue step in PR CI;
-        if: failure()
+      # auto-created issues are for deploy-pipeline failures only
-        env:
+      # (post-merge keeps its notification).
-          CI_GITEA_API_TOKEN: ${{ secrets.CI_GITEA_API_TOKEN }}
-        run: |
-          . .venv/bin/activate 2>/dev/null || true
-          export PATH="$HOME/.local/bin:$PATH"
-          python3 -m devx.ci.notify_failure \
-            --repo "${{ github.repository }}" \
-            --run-id "${{ github.run_id }}" \
-            --workflow "ci/validate" \
-            --commit "${{ github.sha }}" \
-            --auto-login
 
   auto-merge:
     # Auto-merge runs after validate passes. It reads the task ID

.gitea/workflows/post-merge.yml

@@ -24,7 +24,9 @@ on:
 
 concurrency:
   group: post-merge-${{ github.ref }}
-  cancel-in-progress: true
+  # Implements: REQ-3 (DEVX-176) — queue instead of killing an in-flight
+  # release/publish; a cancelled release can leave tag-without-publish.
+  cancel-in-progress: false
 
 env:
   PIP_BREAK_SYSTEM_PACKAGES: "1"

CHANGELOG.md

@@ -2,6 +2,12 @@
 
 All notable changes to this project will be documented in this file.
 
+## [0.55.3] - 2026-09-21
+
+### Bug Fixes
+
+- Honor repo bandit config in badge quality check
+
 ## [0.55.2] - 2026-09-19
 
 ### Bug Fixes

README.md

@@ -16,12 +16,12 @@ quality badges.
 
 [![CI](https://git.oblachno.oblachno.fyi/oblachno-oss/devx/actions/workflows/ci.yml/badge.svg)](https://git.oblachno.oblachno.fyi/oblachno-oss/devx/actions)
 [![License: GPL-3.0](https://img.shields.io/badge/license-GPL--3.0-blue)](https://git.oblachno.oblachno.fyi/oblachno-oss/devx/src/branch/master/LICENSE)
-[![Coverage](https://git.oblachno.oblachno.fyi/oblachno-oss/devx/raw/commit/ee346d97986c30678c5a0dc49ce50f95d9731a1c/coverage.svg)](https://git.oblachno.oblachno.fyi/oblachno-oss/devx/actions)
+[![Coverage](https://git.oblachno.oblachno.fyi/oblachno-oss/devx/raw/commit/81d1d94822d877773f6bbdc8bb6b941cf044fb4c/coverage.svg)](https://git.oblachno.oblachno.fyi/oblachno-oss/devx/actions)
-[![Tests](https://git.oblachno.oblachno.fyi/oblachno-oss/devx/raw/commit/ee346d97986c30678c5a0dc49ce50f95d9731a1c/tests.svg)](https://git.oblachno.oblachno.fyi/oblachno-oss/devx/actions)
+[![Tests](https://git.oblachno.oblachno.fyi/oblachno-oss/devx/raw/commit/81d1d94822d877773f6bbdc8bb6b941cf044fb4c/tests.svg)](https://git.oblachno.oblachno.fyi/oblachno-oss/devx/actions)
-[![Docs](https://git.oblachno.oblachno.fyi/oblachno-oss/devx/raw/commit/ee346d97986c30678c5a0dc49ce50f95d9731a1c/docs.svg)](https://git.oblachno.oblachno.fyi/oblachno-oss/devx/wiki)
+[![Docs](https://git.oblachno.oblachno.fyi/oblachno-oss/devx/raw/commit/81d1d94822d877773f6bbdc8bb6b941cf044fb4c/docs.svg)](https://git.oblachno.oblachno.fyi/oblachno-oss/devx/wiki)
-[![Code Quality](https://git.oblachno.oblachno.fyi/oblachno-oss/devx/raw/commit/ee346d97986c30678c5a0dc49ce50f95d9731a1c/quality.svg)](https://git.oblachno.oblachno.fyi/oblachno-oss/devx/actions)
+[![Code Quality](https://git.oblachno.oblachno.fyi/oblachno-oss/devx/raw/commit/81d1d94822d877773f6bbdc8bb6b941cf044fb4c/quality.svg)](https://git.oblachno.oblachno.fyi/oblachno-oss/devx/actions)
-[![Version](https://git.oblachno.oblachno.fyi/oblachno-oss/devx/raw/commit/ee346d97986c30678c5a0dc49ce50f95d9731a1c/version.svg)](https://git.oblachno.oblachno.fyi/oblachno-oss/devx/releases)
+[![Version](https://git.oblachno.oblachno.fyi/oblachno-oss/devx/raw/commit/81d1d94822d877773f6bbdc8bb6b941cf044fb4c/version.svg)](https://git.oblachno.oblachno.fyi/oblachno-oss/devx/releases)
-[![Python](https://git.oblachno.oblachno.fyi/oblachno-oss/devx/raw/commit/ee346d97986c30678c5a0dc49ce50f95d9731a1c/python.svg)](https://www.python.org/downloads/)
+[![Python](https://git.oblachno.oblachno.fyi/oblachno-oss/devx/raw/commit/81d1d94822d877773f6bbdc8bb6b941cf044fb4c/python.svg)](https://www.python.org/downloads/)
 
 ## Why devx?
 
@@ -87,7 +87,7 @@ extra index and list devx in your dependencies:
 ```toml
 [project]
 dependencies = [
-    "devx>=0.55.2",
+    "devx>=0.55.3",
 ]
 
 [tool.pip]
@@ -101,8 +101,8 @@ pip install -e .
 ```
 
 > **Note:** If your project requires a specific devx version, pin it in
-> `dependencies` (for example, `"devx==0.55.2"`) or use a version constraint
+> `dependencies` (for example, `"devx==0.55.3"`) or use a version constraint
-> (for example, `"devx>=0.55.2,<0.56"`).
+> (for example, `"devx>=0.55.3,<0.56"`).
 
 ### Optional extras
 

docs/index.md

@@ -12,12 +12,12 @@ project to be reusable across all oblachno-oss repositories.
 
 [![CI](https://git.oblachno.oblachno.fyi/oblachno-oss/devx/actions/workflows/ci.yml/badge.svg)](https://git.oblachno.oblachno.fyi/oblachno-oss/devx/actions)
 [![License: GPL-3.0](https://img.shields.io/badge/license-GPL--3.0-blue)](https://git.oblachno.oblachno.fyi/oblachno-oss/devx/src/branch/master/LICENSE)
-[![Coverage](https://git.oblachno.oblachno.fyi/oblachno-oss/devx/raw/commit/ee346d97986c30678c5a0dc49ce50f95d9731a1c/coverage.svg)](https://git.oblachno.oblachno.fyi/oblachno-oss/devx/actions)
+[![Coverage](https://git.oblachno.oblachno.fyi/oblachno-oss/devx/raw/commit/81d1d94822d877773f6bbdc8bb6b941cf044fb4c/coverage.svg)](https://git.oblachno.oblachno.fyi/oblachno-oss/devx/actions)
-[![Tests](https://git.oblachno.oblachno.fyi/oblachno-oss/devx/raw/commit/ee346d97986c30678c5a0dc49ce50f95d9731a1c/tests.svg)](https://git.oblachno.oblachno.fyi/oblachno-oss/devx/actions)
+[![Tests](https://git.oblachno.oblachno.fyi/oblachno-oss/devx/raw/commit/81d1d94822d877773f6bbdc8bb6b941cf044fb4c/tests.svg)](https://git.oblachno.oblachno.fyi/oblachno-oss/devx/actions)
-[![Docs](https://git.oblachno.oblachno.fyi/oblachno-oss/devx/raw/commit/ee346d97986c30678c5a0dc49ce50f95d9731a1c/docs.svg)](https://git.oblachno.oblachno.fyi/oblachno-oss/devx/wiki)
+[![Docs](https://git.oblachno.oblachno.fyi/oblachno-oss/devx/raw/commit/81d1d94822d877773f6bbdc8bb6b941cf044fb4c/docs.svg)](https://git.oblachno.oblachno.fyi/oblachno-oss/devx/wiki)
-[![Code Quality](https://git.oblachno.oblachno.fyi/oblachno-oss/devx/raw/commit/ee346d97986c30678c5a0dc49ce50f95d9731a1c/quality.svg)](https://git.oblachno.oblachno.fyi/oblachno-oss/devx/actions)
+[![Code Quality](https://git.oblachno.oblachno.fyi/oblachno-oss/devx/raw/commit/81d1d94822d877773f6bbdc8bb6b941cf044fb4c/quality.svg)](https://git.oblachno.oblachno.fyi/oblachno-oss/devx/actions)
-[![Version](https://git.oblachno.oblachno.fyi/oblachno-oss/devx/raw/commit/ee346d97986c30678c5a0dc49ce50f95d9731a1c/version.svg)](https://git.oblachno.oblachno.fyi/oblachno-oss/devx/releases)
+[![Version](https://git.oblachno.oblachno.fyi/oblachno-oss/devx/raw/commit/81d1d94822d877773f6bbdc8bb6b941cf044fb4c/version.svg)](https://git.oblachno.oblachno.fyi/oblachno-oss/devx/releases)
-[![Python](https://git.oblachno.oblachno.fyi/oblachno-oss/devx/raw/commit/ee346d97986c30678c5a0dc49ce50f95d9731a1c/python.svg)](https://www.python.org/downloads/)
+[![Python](https://git.oblachno.oblachno.fyi/oblachno-oss/devx/raw/commit/81d1d94822d877773f6bbdc8bb6b941cf044fb4c/python.svg)](https://www.python.org/downloads/)
 
 ## Overview
 
@@ -74,14 +74,14 @@ Add devx to your `pyproject.toml` dependencies and configure the registry:
 ```toml
 [project]
 dependencies = [
-    "devx>=0.55.2",
+    "devx>=0.55.3",
 ]
 
 [tool.pip]
 extra-index-url = "https://git.oblachno.oblachno.fyi/api/packages/oblachno-oss/pypi/simple"
 ```
 
-Pin a specific version if needed: `"devx==0.55.2"` or `"devx>=0.55.2,<0.56"`.
+Pin a specific version if needed: `"devx==0.55.3"` or `"devx>=0.55.3,<0.56"`.
 
 ### Optional extras
 

docs/specs/DEVX-175.md

@@ -0,0 +1,40 @@
+# DEVX-175: Badge generation must honor repo bandit configuration
+
+## Problem
+
+`collect_quality()` in `generate_badges.py` runs `bandit -r src/` with no
+config file. Repos that declare a `[tool.bandit]` section in
+`pyproject.toml` (skip lists aligned with infrastructure patterns — for
+example sso-bridge skips B404/B603/B501) lint clean via `make lint-all`, but the
+quality badge still reports `bandit: FAIL` — a false-FAIL badge that
+contradicts the actual lint gate.
+
+## Approach
+
+REQ-1: When `pyproject.toml` exists in the target repo and contains a
+`[tool.bandit]` section, pass `-c pyproject.toml` to the bandit invocation
+in `collect_quality()`.
+
+REQ-2: Repos without `[tool.bandit]` keep the current invocation unchanged.
+
+## Test Plan
+
+- Unit test: repo fixture with `[tool.bandit]` → command includes
+  `-c pyproject.toml`; without the section → plain invocation.
+- Manual: `python -m devx.tools.generate_badges` in sso-bridge reports
+  `bandit: pass`.
+
+## Deploy Plan
+
+devx release → repos pick it up on next devx pin bump; no infra changes.
+
+## Rollback Plan
+
+Revert the commit; badges revert to unconfigured bandit runs.
+
+## Acceptance Criteria
+
+- [x] REQ-1 implemented with `# Implements: REQ-1` comment
+- [x] REQ-2 preserved (no config → unchanged command)
+- [x] Unit tests cover both branches
+- [x] `make lint-all` + `make pytest-cov` pass in devx

docs/specs/DEVX-176.md

@@ -0,0 +1,43 @@
+# DEVX-176: CI hygiene — docs fast-path, failure-notify scoping, post-merge cancel
+
+## Problem
+
+devx CI has the same inefficiencies fixed in infra (OBL-INFRA-613/615/616):
+docs-only PRs run the full quality suite (~10 min), CI failures auto-create
+issues (noise — the user decided issues are for deploy failures only), and
+post-merge `cancel-in-progress: true` can kill a release mid-publish.
+
+## Approach
+
+REQ-1: Docs-only PRs skip heavy validate steps (lint-all, unit tests,
+test-speed, translation check, security scan, workflow dry-run). Docs gate,
+spec validation, PR size, and auto-merge preconditions still run.
+Restricted to pull_request events.
+
+REQ-2: Remove the failure-issue step from `ci.yml` validate job.
+Post-merge keeps failure notification (release/publish failures are
+deploy-pipeline events).
+
+REQ-3: post-merge `cancel-in-progress: false` — a new push queues instead
+of killing an in-flight release/publish.
+
+## Test Plan
+
+- `make workflow-lint` passes.
+- Docs-only PR: quality steps skipped, docs gate + spec + size + merge run.
+- Non-docs PR: unchanged behavior.
+
+## Deploy Plan
+
+Workflow-only change; takes effect on merge. No release needed.
+
+## Rollback Plan
+
+Revert the commit.
+
+## Acceptance Criteria
+
+- [x] REQ-1 implemented — early docs-only step + step-level `if` gates
+- [x] REQ-2 implemented — notify step removed from ci.yml only
+- [x] REQ-3 implemented — post-merge concurrency flipped
+- [x] `make workflow-lint` passes

docs/user/getting-started.md

@@ -48,12 +48,12 @@ Add devx to your `pyproject.toml`:
 ```toml
 [project]
 dependencies = [
-    "devx>=0.55.2",
+    "devx>=0.55.3",
 ]
 
 [project.optional-dependencies]
 dev = [
-    "devx>=0.55.2",
+    "devx>=0.55.3",
 ]
 ```
 

src/devx/__init__.py

@@ -6,4 +6,4 @@ create_dependency_pr, auto_merge, release, publish), developer tooling
 molecule testing helpers for Ansible projects.
 """
 
-__version__ = "0.55.2"
+__version__ = "0.55.3"

src/devx/tools/generate_badges.py

@@ -346,11 +346,18 @@ def collect_quality(repo_root: Path) -> dict[str, str | int]:
     results: list[bool] = []
     tool_names: list[str] = []
 
+    # Implements: REQ-1 (DEVX-175) — honor the repo's [tool.bandit] config so
+    # the badge matches the project's actual lint gate (skip lists etc.).
+    bandit_cmd = [sys.executable, "-m", "bandit", "-r", "src/"]
+    pyproject = repo_root / "pyproject.toml"
+    if pyproject.exists() and "[tool.bandit]" in pyproject.read_text():
+        bandit_cmd += ["-c", "pyproject.toml"]
+
     for cmd, name in [
         ([sys.executable, "-m", "ruff", "check", "src/", "tests/"], "ruff check"),
         ([sys.executable, "-m", "ruff", "format", "--check", "src/", "tests/"], "ruff format"),
         ([sys.executable, "-m", "pyright"], "pyright"),
-        ([sys.executable, "-m", "bandit", "-r", "src/"], "bandit"),
+        (bandit_cmd, "bandit"),
     ]:
         rc, _stdout, stderr = run_command(cmd, cwd=repo_root)
         if rc == 0:

tests/unit/test_generate_badges.py

@@ -365,6 +365,23 @@ class TestCollectQuality:
         badge = collect_quality(tmp_path)
         assert badge["message"] == "A"
 
+    @patch("devx.tools.generate_badges.run_command")
+    def test_bandit_uses_repo_config_when_present(self, mock_run: MagicMock, tmp_path: Path) -> None:  # type: ignore[no-untyped-def]
+        (tmp_path / "pyproject.toml").write_text("[tool.bandit]\nskips = ['B501']\n")
+        mock_run.return_value = (0, "", "")
+        collect_quality(tmp_path)
+        bandit_call = [c for c in mock_run.call_args_list if "bandit" in c.args[0]][0]
+        assert "-c" in bandit_call.args[0]
+        assert "pyproject.toml" in bandit_call.args[0]
+
+    @patch("devx.tools.generate_badges.run_command")
+    def test_bandit_plain_invocation_without_repo_config(self, mock_run: MagicMock, tmp_path: Path) -> None:  # type: ignore[no-untyped-def]
+        (tmp_path / "pyproject.toml").write_text("[project]\nname = 'x'\n")
+        mock_run.return_value = (0, "", "")
+        collect_quality(tmp_path)
+        bandit_call = [c for c in mock_run.call_args_list if "bandit" in c.args[0]][0]
+        assert "-c" not in bandit_call.args[0]
+
 
 class TestGenerateBadges:
     @patch("devx.tools.generate_badges.collect_quality")