GRM-125: ci: bump devx to v0.28.0, add pre-merge-check, agent docs

.devin/skills/devx-workflow/SKILL.md

@@ -0,0 +1,38 @@
+# devx-workflow
+
+Quick reference for devx tools when working on this repo.
+
+## PR Workflow (use these, not raw git/tea/MCP)
+
+| Task | Command |
+|------|---------|
+| Create Vikunja task | `make create-task -- --title "..." --description "..."` |
+| Create PR | `make create-pr` |
+| Push + create PR | `make push-with-pr` |
+| Check CI status | `make devx-pr-status` or `make devx-pr-status PR=42 WAIT=1` |
+| Fetch CI failure logs | `make devx-pr-logs` or `make devx-pr-logs PR=42 JOB=quality TAIL=50` |
+| Add ready-to-merge label | `make devx-pr-label` or `make devx-pr-label PR=42` |
+| Post PR review | `make devx-pr-review PR=42 EVENT=APPROVE BODY="..." CHECKLIST=1,2,3,4,5,6,7,8,9,10,11,12,13` |
+| Rebase current branch | `make rebase` |
+| Rebase PR via API | `make pr-rebase` or `make pr-rebase PR=42` |
+
+## Auto-merge Behavior
+
+When the `ready-to-merge` label is added and all CI checks pass:
+1. Auto-merge validates PR title format (`GRM-N: <vikunja task title>`)
+2. If branch is behind master, auto-merge **rebases via Gitea API** automatically
+3. The rebase triggers a new CI run; the next auto-merge attempt merges
+4. No manual rebase needed unless the API rebase fails
+
+## Pre-merge Check
+
+CI runs a `pre-merge-check` job early (after quality + detect-changes)
+that validates branch format, PR title, and Vikunja task match.
+This fails fast before expensive molecule tests run.
+
+## Key Rules
+
+- Never manually merge via API — always use auto-merge with `ready-to-merge` label
+- Branch naming: `GRM-N-short-description` (N = Vikunja task ID)
+- Commit format: conventional commits (`feat:`, `fix:`, `docs:`, etc.)
+- PR title: `GRM-N: <vikunja task title>` (auto-derived by `make create-pr`)

.gitea/workflows/ci.yml

@@ -122,6 +122,37 @@ jobs:
             --head "${{ github.event.pull_request.head.sha || github.sha }}" \
             --github-output
 
+  pre-merge-check:
+    needs: [quality, detect-changes]
+    if: github.event_name == 'pull_request'
+    runs-on: docker
+    container: git.oblachno.oblachno.fyi/oblachno-oss/runner-images/ci-base:latest
+    timeout-minutes: 5
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+      - name: Set up environment
+        run: make setup-image EXTRAS=ci
+      - name: Validate auto-merge preconditions
+        env:
+          CI_GITEA_TOKEN: ${{ secrets.CI_GITEA_TOKEN }}
+          VIKUNJA_TOKEN: ${{ secrets.VIKUNJA_TOKEN }}
+          DEVX_TASK_PREFIX: GRM
+          DEVX_VIKUNJA_PROJECT_ID: 6
+          HEAD_REF: ${{ github.head_ref }}
+          PR_TITLE: ${{ github.event.pull_request.title }}
+          REPOSITORY: ${{ github.repository }}
+          PR_NUMBER: ${{ github.event.number }}
+          PYTHONPATH: ${{ env.PYTHONPATH }}
+        run: |
+          . .venv/bin/activate 2>/dev/null || true
+          python3 -m devx.ci.check_auto_merge_ready \
+            --branch "$HEAD_REF" \
+            --pr-title "$PR_TITLE" \
+            --repo "$REPOSITORY" \
+            --pr-number "$PR_NUMBER"
+
   discover-runners:
     needs: [detect-changes]
     if: needs.detect-changes.outputs.ansible-changed == 'true'
@@ -239,11 +270,12 @@ jobs:
     # from the branch name, validates the PR title, and squash-merges.
     # Uses always() so it evaluates even when molecule-tests is skipped
     # (Gitea Actions skips dependent jobs of skipped jobs by default).
-    needs: [quality, detect-changes, pr-review, molecule-tests, release-dry-run]
+    needs: [quality, detect-changes, pre-merge-check, pr-review, molecule-tests, release-dry-run]
     if: >-
       always() &&
       github.event_name == 'pull_request' &&
       needs.quality.result == 'success' &&
+      needs.pre-merge-check.result == 'success' &&
       needs.pr-review.result == 'success' &&
       (needs.molecule-tests.result == 'success' || needs.molecule-tests.result == 'skipped') &&
       (needs.release-dry-run.result == 'success' || needs.release-dry-run.result == 'skipped')
@@ -277,7 +309,7 @@ jobs:
             --event APPROVE \
             --checklist-confirmed \
             --checklist-categories 1,2,3,4,5,6,7,8,9,10,11,12,13 \
-            --body "Auto-approved: all CI checks passed (quality, molecule, pr-review)."
+            --body "Auto-approved: all CI checks passed (quality, molecule, pr-review, pre-merge-check)."
       - name: Squash merge with task ID
         env:
           CI_GITEA_TOKEN: ${{ secrets.CI_GITEA_TOKEN }}

AGENTS.md

@@ -163,6 +163,12 @@ Then add the `ready-to-merge` label. The auto-merge workflow will:
 5. The post-merge workflow marks the Vikunja task as done
 6. The release workflow automatically versions, tags, and publishes (see below)
 
+**If the branch is behind master** (another PR merged first), auto-merge
+automatically rebases the PR's head branch via the Gitea API. This triggers
+a new CI run. The next auto-merge attempt will merge successfully.
+No manual rebase needed. To rebase manually: `make rebase` (local) or
+`make pr-rebase` (server-side via API).
+
 > **IMPORTANT**: Never manually merge PRs via the API. Always use the auto-merge
 > workflow by adding the `ready-to-merge` label. Manual merges bypass the
 > `GRM-N: <conventional>` format enforcement, producing incorrectly named commits.
@@ -171,6 +177,10 @@ Then add the `ready-to-merge` label. The auto-merge workflow will:
 
 ### CI Path Filtering
 
+The CI workflow includes a `pre-merge-check` job (runs after quality +
+detect-changes) that validates branch format, PR title, and Vikunja task
+match. This fails fast before expensive molecule tests run.
+
 The CI workflow includes a `detect-changes` job that checks whether any files
 under `ansible/` or `.ansible-lint` have changed. If no Ansible files are
 changed, molecule tests are skipped — this prevents non-Ansible changes
@@ -267,7 +277,7 @@ via `[tool.devx.classify]` in `pyproject.toml`.
 
 **devx module structure** (installed from git, not in this repo):
 - `devx.ci.*` — CI/CD automation (run by workflows): release, publish, auto_merge, classify_changes, detect_release_commit, push_badges, doc_coverage, sync_wiki, distribute_molecule, molecule_ci_guard, discover_runners, notify_failure, post_merge, pr_review, validate_commit_msg
-- `devx.tools.*` — Dev tools (run locally): check_test_speed, configure_repo, install_checkmake, install_tools, setup, generate_badges
+- `devx.tools.*` — Dev tools (run locally): check_test_speed, configure_repo, install_checkmake, install_tools, setup, generate_badges, create_task, create_pr, pr_status, pr_logs, pr_label, rebase, pr_rebase
 - `devx.molecule.*` — Molecule helpers: molecule_all, platforms, discover_runners, distribute_molecule, molecule_ci_guard
 - `devx.gitea_cli` — Tea CLI wrapper
 - `devx.i18n` — i18n translation system

pyproject.toml

@@ -34,7 +34,7 @@ ci = [
     "build==1.5.0",
     "twine==6.2.0",
     # Reusable CI/CD and dev tools (auto-merge, pr-review, pre-push checks, etc.)
-    "devx==0.27.2",
+    "devx==0.28.0",
 ]
 # Lint and type-checking tools (quality job)
 lint = [
@@ -54,7 +54,7 @@ molecule = [
 dev = [
     "gitea-runner-manager[ci,lint,molecule]",
     # Reusable CI/CD and dev tools (pre-push hooks, create-task, create-pr)
-    "devx==0.27.2",
+    "devx==0.28.0",
     # Non-Python dev dependency: checkmake (Makefile linter)
     # Install via: go install github.com/checkmake/checkmake/cmd/checkmake@latest
 ]