GRM-56: fix: close CI gaps with workflow dry-run, automated configure_repo, aligned timeouts

.gitea/workflows/ci.yml

@@ -39,6 +39,16 @@ jobs:
           .venv/bin/python -m ensurepip 2>/dev/null || true
           PIPAPI_PYTHON_LOCATION=$PWD/.venv/bin/python \
             pip-audit --desc --skip-editable 2>&1 || true
+      - name: Workflow dry-run validation
+        run: |
+          . .venv/bin/activate
+          export PATH="$HOME/.local/bin:$PATH"
+          # Best-effort: only runs if act_runner is installed
+          if command -v act_runner >/dev/null 2>&1; then
+            make workflow-dryrun
+          else
+            echo "act_runner not found — skipping workflow dry-run (static lint still passed)"
+          fi
 
   release-dry-run:
     needs: [quality, detect-changes]

.gitea/workflows/post-merge.yml

@@ -163,3 +163,18 @@ jobs:
             --run-id "${{ github.run_id }}" \
             --workflow "post-merge/vikunja" \
             --commit "${{ github.sha }}"
+
+  configure-repo:
+    needs: [detect-type]
+    if: needs.detect-type.outputs.is-release == 'false'
+    runs-on: docker
+    timeout-minutes: 10
+    steps:
+      - uses: actions/checkout@v4
+      - name: Install dependencies
+        run: python3 -m pip install --break-system-packages requests python-dotenv click
+      - name: Ensure branch protection and labels
+        env:
+          REPO_TOKEN: ${{ secrets.REPO_TOKEN }}
+          PYTHONPATH: src
+        run: python3 scripts/configure_repo.py