GRM-51: ci: add shell safety and workflow_dispatch fix to all workflows

.gitea/workflows/ci.yml

@@ -43,6 +43,7 @@ jobs:
         run: make setup
       - name: Install git-cliff
         run: |
+          set -euo pipefail
           GIT_CLIFF_VERSION="2.13.0"
           URL="https://github.com/orhun/git-cliff/releases/download/v${GIT_CLIFF_VERSION}/git-cliff-${GIT_CLIFF_VERSION}-x86_64-unknown-linux-gnu.tar.gz"
           TMPDIR="$(mktemp -d)"
@@ -53,6 +54,7 @@ jobs:
           echo "$HOME/.local/bin" >> "$GITHUB_PATH"
       - name: Release dry-run validation
         run: |
+          set -euo pipefail
           . .venv/bin/activate
           PYTHONPATH=. python3 scripts/ci/release.py --dry-run || true
 
@@ -69,8 +71,9 @@ jobs:
       - name: Detect changed paths
         id: detect
         run: |
+          set -euo pipefail
           BASE="origin/master"
-          HEAD="${{ github.event.pull_request.head.sha }}"
+          HEAD="${{ github.event.pull_request.head.sha || github.sha }}"
           # Check if any Ansible-related files changed
           ANSIBLE_CHANGED=$(git diff --name-only "$BASE" "$HEAD" -- ansible/ .ansible-lint 2>/dev/null | head -1)
           if [ -n "$ANSIBLE_CHANGED" ]; then
@@ -109,6 +112,7 @@ jobs:
           MOLECULE_RUNNERS: ${{ vars.MOLECULE_RUNNERS }}
           PYTHONPATH: src
         run: |
+          set -euo pipefail
           . .venv/bin/activate
           OUTPUT=$(python3 scripts/ci/discover_runners.py --owner "${{ github.repository_owner }}" --repo "${{ github.event.repository.name }}")
           echo "$OUTPUT"
@@ -132,6 +136,7 @@ jobs:
         run: make setup
       - name: Discover assigned test pairs
         run: |
+          set -euo pipefail
           . .venv/bin/activate
           PAIRS=$(python3 scripts/ci/distribute_molecule.py --runner-index ${{ matrix.runner-index }} --max-runners ${{ needs.discover-runners.outputs.runner-count }})
           echo "Assigned pairs: $PAIRS"
@@ -162,6 +167,7 @@ jobs:
           REPO_TOKEN: ${{ secrets.REPO_TOKEN }}
           PYTHONPATH: src
         run: |
+          set -euo pipefail
           . .venv/bin/activate
           python3 scripts/ci/pr_review.py \
             "${{ github.event.number }}" \

.gitea/workflows/post-merge.yml

@@ -31,6 +31,7 @@ jobs:
       - name: Check if this is a release commit
         id: check
         run: |
+          set -euo pipefail
           MSG=$(git log -1 --pretty=%s)
           echo "Commit message: $MSG"
           if echo "$MSG" | grep -qE '^release: v[0-9]+\.[0-9]+\.[0-9]+'; then
@@ -55,6 +56,7 @@ jobs:
         run: make setup
       - name: Install git-cliff
         run: |
+          set -euo pipefail
           GIT_CLIFF_VERSION="2.13.0"
           URL="https://github.com/orhun/git-cliff/releases/download/v${GIT_CLIFF_VERSION}/git-cliff-${GIT_CLIFF_VERSION}-x86_64-unknown-linux-gnu.tar.gz"
           TMPDIR="$(mktemp -d)"
@@ -66,12 +68,14 @@ jobs:
           "$HOME/.local/bin/git-cliff" --version
       - name: Configure git
         run: |
+          set -euo pipefail
           git config user.name "grm-ci-bot"
           git config user.email "grm-ci-bot@oblachno.fyi"
       - name: Run release
         env:
           PYTHONPATH: .
         run: |
+          set -euo pipefail
           . .venv/bin/activate
           python3 scripts/ci/release.py
 
@@ -91,6 +95,7 @@ jobs:
           REPO_TOKEN: ${{ secrets.REPO_TOKEN }}
           PYTHONPATH: src
         run: |
+          set -euo pipefail
           . .venv/bin/activate
           python3 scripts/ci/sync_wiki.py --repo "${{ github.repository }}" --strict
 
@@ -108,12 +113,19 @@ jobs:
         run: make setup
       - name: Generate badge SVG files
         run: |
+          set -euo pipefail
           . .venv/bin/activate
           python3 scripts/generate_badges.py --output-dir .badges/
+          # Verify badges were generated
+          if [ -z "$(ls -A .badges/ 2>/dev/null)" ]; then
+            echo "::error::No badge SVG files generated"
+            exit 1
+          fi
       - name: Push badges to badges branch
         env:
           PRE_COMMIT_ALLOW_NO_CONFIG: "1"
         run: |
+          set -euo pipefail
           git config user.name "gitea-actions-bot"
           git config user.email "actions@oblachno.fyi"
           git checkout --orphan badges
@@ -139,6 +151,7 @@ jobs:
           VIKUNJA_TOKEN: ${{ secrets.VIKUNJA_TOKEN }}
           PYTHONPATH: src
         run: |
+          set -euo pipefail
           python3 scripts/ci/post_merge.py \
             "$(git log -1 --pretty=%B)" \
             --commit-sha "$(git rev-parse HEAD)"

.gitea/workflows/publish.yml

@@ -15,6 +15,7 @@ jobs:
           fetch-depth: 0
       - name: Install git-cliff
         run: |
+          set -euo pipefail
           GIT_CLIFF_VERSION="2.13.0"
           URL="https://github.com/orhun/git-cliff/releases/download/v${GIT_CLIFF_VERSION}/git-cliff-${GIT_CLIFF_VERSION}-x86_64-unknown-linux-gnu.tar.gz"
           TMPDIR="$(mktemp -d)"
@@ -26,9 +27,11 @@ jobs:
           "$HOME/.local/bin/git-cliff" --version
       - name: Install build tools
         run: |
+          set -euo pipefail
           python3 -m pip install --break-system-packages build twine requests python-dotenv click
       - name: Validate PYPI_TOKEN
         run: |
+          set -euo pipefail
           if [ -z "${{ secrets.PYPI_TOKEN }}" ]; then
             echo "::warning::PYPI_TOKEN is not set — package will be built but not published to PyPI."
           fi
@@ -38,6 +41,7 @@ jobs:
           PYPI_TOKEN: ${{ secrets.PYPI_TOKEN }}
           PYTHONPATH: src
         run: |
+          set -euo pipefail
           python3 scripts/ci/publish.py \
             "${{ github.ref_name }}" \
             "${{ github.repository }}"
@@ -47,6 +51,7 @@ jobs:
           REPO_TOKEN: ${{ secrets.REPO_TOKEN }}
           PYTHONPATH: src
         run: |
+          set -euo pipefail
           python3 scripts/ci/notify_failure.py \
             --repo "${{ github.repository }}" \
             --run-id "${{ github.run_id }}" \