devx/.gitea/workflows/post-merge.yml

name: Post-merge

# Runs on every push to master. A single workflow with conditional jobs
# replaces separate workflows for release, wiki sync, badges, and
# Vikunja task updates.
#
# Job dependency graph:
#
#   detect-type ──┬── release (skip if release commit)
#                 ├── badges (ALWAYS runs — even on release commits)
#                 ├── configure-repo (independent — skip if release commit)
#                 ├── sync-wiki (needs release — skip if release commit/fails)
#                 └── vikunja (needs release — skip if release commit/fails)
#
# sync-wiki and vikunja depend on release succeeding so that the wiki
# and task tracker are only updated when the code is actually released.
# If release fails, they are skipped to avoid leaving the wiki or
# Vikunja in an inconsistent state with the codebase on master.
#
# The badges job depends on release so it picks up the latest version
# number. It uses `if: always()` with no is-release condition so it
# runs on every push to master, including release commits. This
# ensures badges (tests, coverage, version, etc.) are always current.
#
# When release creates a "release: vX.Y.Z" commit, the release
# commit's post-merge run still updates badges (version badge picks
# up the new version). Other jobs skip. The tag push triggers publish.yml.

on:
  push:
    branches: [master]

jobs:
  detect-type:
    runs-on: docker
    timeout-minutes: 10
    outputs:
      is-release: ${{ steps.check.outputs.is-release }}
    steps:
      - uses: actions/checkout@v4
        with:
          fetch-depth: 1
      - name: Install dependencies
        run: |
          python3 -m pip install --break-system-packages requests python-dotenv click
          python3 -m pip install --break-system-packages -e .
      - name: Check if this is a release commit
        id: check
        env:
          PYTHONPATH: src
        run: python3 -m devx.ci.detect_release_commit

  validate-commit-msg:
    needs: [detect-type]
    if: needs.detect-type.outputs.is-release == 'false'
    runs-on: docker
    timeout-minutes: 5
    steps:
      - uses: actions/checkout@v4
        with:
          fetch-depth: 1
      - name: Install dependencies
        run: |
          python3 -m pip install --break-system-packages click python-dotenv
          python3 -m pip install --break-system-packages -e .
      - name: Validate latest commit message
        env:
          PYTHONPATH: src
        run: |
          git log -1 --format=%B > commit-msg.txt
          python3 -m devx.ci.validate_commit_msg commit-msg.txt --branch master
          rm -f commit-msg.txt

  release:
    needs: [detect-type]
    if: needs.detect-type.outputs.is-release == 'false'
    runs-on: docker
    timeout-minutes: 15
    steps:
      - uses: actions/checkout@v4
        with:
          fetch-depth: 0
          token: ${{ secrets.REPO_TOKEN }}
      - name: Set up environment
        env:
          REPO_TOKEN: ${{ secrets.REPO_TOKEN }}
        run: make setup-release
      - name: Configure git
        run: |
          git config user.name "devx-ci-bot"
          git config user.email "devx-ci-bot@oblachno.fyi"
      - name: Run release
        env:
          PYTHONPATH: src
        run: |
          . .venv/bin/activate
          export PATH="$HOME/.local/bin:$PATH"
          python3 -m devx.ci.release
      - name: Publish release
        env:
          REPO_TOKEN: ${{ secrets.REPO_TOKEN }}
          PYTHONPATH: src
        run: |
          . .venv/bin/activate
          export PATH="$HOME/.local/bin:$PATH"
          TAG=$(git describe --tags --abbrev=0 2>/dev/null || echo "")
          if [ -z "$TAG" ]; then
            echo "No tag found — skipping publish"
            exit 0
          fi
          echo "Publishing release $TAG (idempotent — skips if already published)..."
          python3 -m devx.ci.publish "$TAG" "${{ github.repository }}"
      - name: Notify on failure
        if: failure()
        env:
          REPO_TOKEN: ${{ secrets.REPO_TOKEN }}
          PYTHONPATH: src
        run: |
          . .venv/bin/activate 2>/dev/null || true
          export PATH="$HOME/.local/bin:$PATH"
          python3 -m devx.tools.install_tools --tool tea
          tea login add --name devx --url "${{ github.server_url }}" --token "$REPO_TOKEN" || true
          tea login default devx || true
          python3 -m devx.ci.notify_failure \
            --repo "${{ github.repository }}" \
            --run-id "${{ github.run_id }}" \
            --workflow "post-merge/release" \
            --commit "${{ github.sha }}"

  sync-wiki:
    needs: [detect-type, release]
    if: needs.detect-type.outputs.is-release == 'false'
    runs-on: docker
    timeout-minutes: 10
    steps:
      - uses: actions/checkout@v4
        with:
          fetch-depth: 0
      - name: Set up environment
        run: make setup-ci
      - name: Sync documentation to wiki
        env:
          REPO_TOKEN: ${{ secrets.REPO_TOKEN }}
          PYTHONPATH: src
        run: |
          . .venv/bin/activate
          python3 -m devx.ci.sync_wiki --repo "${{ github.repository }}" --strict
      - name: Notify on failure
        if: failure()
        env:
          REPO_TOKEN: ${{ secrets.REPO_TOKEN }}
          PYTHONPATH: src
        run: |
          export PATH="$HOME/.local/bin:$PATH"
          python3 -m devx.ci.notify_failure \
            --repo "${{ github.repository }}" \
            --run-id "${{ github.run_id }}" \
            --workflow "post-merge/sync-wiki" \
            --commit "${{ github.sha }}"

  badges:
    needs: [detect-type, release]
    if: always()
    runs-on: docker
    timeout-minutes: 10
    steps:
      - uses: actions/checkout@v4
        with:
          fetch-depth: 0
          ref: master
          token: ${{ secrets.REPO_TOKEN }}
      - name: Fetch latest master
        run: |
          git fetch origin master
          git reset --hard origin/master
      - name: Set up environment
        run: make setup-ci
      - name: Generate and push badges
        env:
          PRE_COMMIT_ALLOW_NO_CONFIG: "1"
        run: |
          . .venv/bin/activate
          python3 -m devx.ci.push_badges
      - name: Notify on failure
        if: failure()
        env:
          REPO_TOKEN: ${{ secrets.REPO_TOKEN }}
          PYTHONPATH: src
        run: |
          export PATH="$HOME/.local/bin:$PATH"
          python3 -m devx.ci.notify_failure \
            --repo "${{ github.repository }}" \
            --run-id "${{ github.run_id }}" \
            --workflow "post-merge/badges" \
            --commit "${{ github.sha }}"

  vikunja:
    needs: [detect-type, release]
    if: needs.detect-type.outputs.is-release == 'false'
    runs-on: docker
    timeout-minutes: 10
    steps:
      - uses: actions/checkout@v4
        with:
          fetch-depth: 0
      - name: Install dependencies
        run: |
          python3 -m pip install --break-system-packages requests python-dotenv click
          python3 -m pip install --break-system-packages -e .
      - name: Update Vikunja task
        env:
          VIKUNJA_TOKEN: ${{ secrets.VIKUNJA_TOKEN }}
          DEVX_VIKUNJA_PROJECT_ID: "8"
          PYTHONPATH: src
        run: python3 -m devx.ci.post_merge --git-sha "${{ github.sha }}"
      - name: Notify on failure
        if: failure()
        env:
          REPO_TOKEN: ${{ secrets.REPO_TOKEN }}
          PYTHONPATH: src
        run: |
          export PATH="$HOME/.local/bin:$PATH"
          python3 -m devx.tools.install_tools --tool tea
          tea login add --name devx --url "${{ github.server_url }}" --token "$REPO_TOKEN" || true
          tea login default devx || true
          python3 -m devx.ci.notify_failure \
            --repo "${{ github.repository }}" \
            --run-id "${{ github.run_id }}" \
            --workflow "post-merge/vikunja" \
            --commit "${{ github.sha }}"

  configure-repo:
    needs: [detect-type]
    if: needs.detect-type.outputs.is-release == 'false'
    runs-on: docker
    timeout-minutes: 10
    steps:
      - uses: actions/checkout@v4
      - name: Install dependencies
        run: |
          python3 -m pip install --break-system-packages requests python-dotenv click
          python3 -m pip install --break-system-packages -e .
      - name: Ensure branch protection and labels
        env:
          REPO_TOKEN: ${{ secrets.REPO_TOKEN }}
          PYTHONPATH: src
        run: python3 -m devx.tools.configure_repo --repo devx --owner oblachno-oss
      - name: Notify on failure
        if: failure()
        env:
          REPO_TOKEN: ${{ secrets.REPO_TOKEN }}
          PYTHONPATH: src
        run: |
          export PATH="$HOME/.local/bin:$PATH"
          python3 -m devx.tools.install_tools --tool tea
          tea login add --name devx --url "${{ github.server_url }}" --token "$REPO_TOKEN" || true
          tea login default devx || true
          python3 -m devx.ci.notify_failure \
            --repo "${{ github.repository }}" \
            --run-id "${{ github.run_id }}" \
            --workflow "post-merge/configure-repo" \
            --commit "${{ github.sha }}"