devx/docs/specs/DEVX-168.md

DEVX-168: Fix create_dependency_pr master-ref parsing

Problem

devx.ci.create_dependency_pr crashes with AttributeError: 'list' object has no attribute 'get' when creating the dependency branch. Gitea's GET /repos/{o}/{r}/git/refs/heads/master returns a JSON array of matching refs, not a single object. Observed in production when sso-bridge v0.4.1's post-merge dep-PR step ran.

Approach

REQ-1: Normalize the ref response — if it is a list, select the entry whose ref field equals refs/heads/master or fall back to the first entry; proceed to extract object.sha as before. An empty or absent SHA still fails closed.

Test Plan

• Unit test: list-shaped response resolves SHA and creates the PR.
• Unit test: empty list fails with the master-SHA error message.

Deploy Plan

devx releases as a version tag; sso-bridge/infra pin bumps pick it up via their normal dep-PR flow.

Rollback Plan

Revert the commit; dep-PR creation stays broken on Gitea (status quo).

Acceptance Criteria

• REQ-1: list-shaped ref response is handled; SHA extraction works; empty list still errors. Covered by unit tests at 100% coverage.