GRM-20: feat: replace inline workflow scripts with tested Python modules

.gitea/workflows/auto-merge.yml

@@ -9,31 +9,15 @@ jobs:
     if: github.event.label.name == 'ready-to-merge'
     runs-on: docker
     steps:
+      - uses: actions/checkout@v4
+      - name: Install dependencies
+        run: python3 -m pip install requests
       - name: Squash merge with task ID
         env:
           GITEA_TOKEN: ${{ secrets.GITEA_TOKEN }}
         run: |
-          BRANCH="${{ github.head_ref }}"
-          TASK_ID=$(echo "$BRANCH" | grep -oE 'GRM-[0-9]+' || echo "")
-          if [ -z "$TASK_ID" ]; then
-            echo "ERROR: No task ID (GRM-N) found in branch name '$BRANCH'"
-            exit 1
-          fi
-
-          PR_TITLE="${{ github.event.pull_request.title }}"
-
-          # Validate PR title follows conventional commits so squash merge message is valid
-          if ! echo "$PR_TITLE" | grep -qE '^(feat|fix|chore|docs|style|refactor|perf|test|ci|build|revert|BREAKING CHANGE)(\(.+\))?: .+'; then
-            echo "ERROR: PR title must follow conventional commit format."
-            echo "  Expected: <type>: <description>"
-            echo "  Got:      $PR_TITLE"
-            exit 1
-          fi
-
-          MERGE_TITLE="${TASK_ID}: ${PR_TITLE}"
-
-          curl -X POST \
-            "https://git.oblachno.oblachno.fyi/api/v1/repos/${{ github.repository }}/pulls/${{ github.event.number }}/merge" \
-            -H "Authorization: token ${GITEA_TOKEN}" \
-            -H "Content-Type: application/json" \
-            -d "{\"Do\": \"squash\", \"MergeTitleField\": \"${MERGE_TITLE}\"}"
+          python3 scripts/auto_merge.py \
+            "${{ github.head_ref }}" \
+            "${{ github.event.pull_request.title }}" \
+            "${{ github.repository }}" \
+            "${{ github.event.number }}"

.gitea/workflows/post-merge.yml

@@ -11,57 +11,12 @@ jobs:
       - uses: actions/checkout@v4
         with:
           fetch-depth: 0
+      - name: Install dependencies
+        run: python3 -m pip install requests
       - name: Update Vikunja task
         env:
           VIKUNJA_TOKEN: ${{ secrets.VIKUNJA_TOKEN }}
         run: |
-          MERGE_MSG=$(git log -1 --pretty=%B)
-          TASK_ID=$(echo "$MERGE_MSG" | grep -oE 'GRM-[0-9]+' | head -1)
-
-          if [ -z "$TASK_ID" ]; then
-            echo "No task ID in commit message, skipping Vikunja update."
-            exit 0
-          fi
-
-          # Resolve GRM-N identifier to Vikunja numeric task ID.
-          # Vikunja's filter API does not support filtering by 'identifier' field,
-          # so we list all tasks and filter client-side by project_id=6 and identifier.
-          VIKUNJA_TASK_ID=$(curl -s \
-            "https://work.oblachno.oblachno.fyi/api/v1/tasks/all?per_page=50" \
-            -H "Authorization: Bearer ${VIKUNJA_TOKEN}" | \
-            python3 -c "
-import sys, json
-tasks = json.load(sys.stdin)
-matches = [t for t in tasks if t.get('project_id') == 6 and t.get('identifier') == '${TASK_ID}']
-print(matches[0]['id'] if matches else '')
-")
-
-          if [ -z "$VIKUNJA_TASK_ID" ]; then
-            echo "ERROR: Could not find Vikunja task for ${TASK_ID} in project 6"
-            exit 1
-          fi
-
-          CONV_MSG=$(echo "$MERGE_MSG" | head -1 | sed -E 's/^GRM-[0-9]+: //')
-          COMMIT_SHA=$(git rev-parse HEAD)
-
-          # Post HTML comment to Vikunja
-          python3 -c "
-import json, os
-html = '<p><strong>${TASK_ID}</strong>: ${CONV_MSG}</p><p>Commit: <code>${COMMIT_SHA}</code></p>'
-print(json.dumps({'content': html}))
-" > /tmp/vikunja_comment.json
-
-          curl -X POST \
-            "https://work.oblachno.oblachno.fyi/api/v1/tasks/${VIKUNJA_TASK_ID}/comments" \
-            -H "Authorization: Bearer ${VIKUNJA_TOKEN}" \
-            -H "Content-Type: application/json" \
-            -d @/tmp/vikunja_comment.json
-
-          # Mark task as done
-          curl -X PUT \
-            "https://work.oblachno.oblachno.fyi/api/v1/tasks/${VIKUNJA_TASK_ID}" \
-            -H "Authorization: Bearer ${VIKUNJA_TOKEN}" \
-            -H "Content-Type: application/json" \
-            -d '{"done": true}'
-
-          echo "Vikunja task ${TASK_ID} (ID ${VIKUNJA_TASK_ID}) updated and marked done."
+          python3 scripts/post_merge.py \
+            "$(git log -1 --pretty=%B)" \
+            --commit-sha "$(git rev-parse HEAD)"

.gitea/workflows/publish.yml

@@ -10,31 +10,14 @@ jobs:
     runs-on: docker
     steps:
       - uses: actions/checkout@v4
+      - name: Install build tools
+        run: |
+          python3 -m pip install build twine requests
       - name: Build and publish release
         env:
           GITEA_TOKEN: ${{ secrets.GITEA_TOKEN }}
           PYPI_TOKEN: ${{ secrets.PYPI_TOKEN }}
         run: |
-          python3 -m venv .venv
-          .venv/bin/pip install build twine
-
-          # Build package
-          .venv/bin/python -m build
-
-          # Publish to PyPI (only if PYPI_TOKEN secret is configured)
-          if [ -n "${PYPI_TOKEN}" ]; then
-            .venv/bin/twine upload dist/* -u __token__ -p "${PYPI_TOKEN}"
-            echo "Published to PyPI."
-          else
-            echo "PYPI_TOKEN not set — skipping PyPI publish."
-          fi
-
-          # Create Gitea release
-          TAG="${{ github.ref_name }}"
-          curl -X POST \
-            "https://git.oblachno.oblachno.fyi/api/v1/repos/${{ github.repository }}/releases" \
-            -H "Authorization: token ${GITEA_TOKEN}" \
-            -H "Content-Type: application/json" \
-            -d "{\"tag_name\": \"${TAG}\", \"name\": \"${TAG}\", \"body\": \"Release ${TAG}\\n\\nSee CHANGELOG.md for details.\", \"draft\": false, \"prerelease\": false}"
-
-          echo "Gitea release ${TAG} created."
+          python3 scripts/publish.py \
+            "${{ github.ref_name }}" \
+            "${{ github.repository }}"