GRM-100: fix: gate auto-merge on release-dry-run and unmask failures

.gitea/workflows/ci.yml

@@ -62,6 +62,8 @@ jobs:
         with:
           fetch-depth: 0
       - name: Set up environment
+        env:
+          REPO_TOKEN: ${{ secrets.REPO_TOKEN }}
         run: make setup-image EXTRAS=ci,lint
       - name: Release dry-run validation
         env:
@@ -71,7 +73,7 @@ jobs:
         run: |
           . .venv/bin/activate
           export PATH="$HOME/.local/bin:$PATH"
-          python3 -m devx.ci.release --dry-run || true
+          python3 -m devx.ci.release --dry-run
 
   detect-changes:
     runs-on: docker
@@ -196,13 +198,14 @@ jobs:
     # from the branch name, validates the PR title, and squash-merges.
     # Uses always() so it evaluates even when molecule-tests is skipped
     # (Gitea Actions skips dependent jobs of skipped jobs by default).
-    needs: [quality, detect-changes, pr-review, molecule-tests]
+    needs: [quality, detect-changes, pr-review, molecule-tests, release-dry-run]
     if: >-
       always() &&
       github.event_name == 'pull_request' &&
       needs.quality.result == 'success' &&
       needs.pr-review.result == 'success' &&
-      (needs.molecule-tests.result == 'success' || needs.molecule-tests.result == 'skipped')
+      (needs.molecule-tests.result == 'success' || needs.molecule-tests.result == 'skipped') &&
+      (needs.release-dry-run.result == 'success' || needs.release-dry-run.result == 'skipped')
     runs-on: docker
     container: git.oblachno.oblachno.fyi/oblachno-oss/runner-images/ci-base:latest
     timeout-minutes: 10