GRM-51: refactor: convert shell scripts and inline workflow scripts to Python

.gitea/workflows/publish.yml

@@ -13,35 +13,17 @@ jobs:
       - uses: actions/checkout@v4
         with:
           fetch-depth: 0
-      - name: Install git-cliff
-        run: |
-          set -euo pipefail
-          GIT_CLIFF_VERSION="2.13.0"
-          URL="https://github.com/orhun/git-cliff/releases/download/v${GIT_CLIFF_VERSION}/git-cliff-${GIT_CLIFF_VERSION}-x86_64-unknown-linux-gnu.tar.gz"
-          TMPDIR="$(mktemp -d)"
-          curl -sL "$URL" | tar xz -C "$TMPDIR"
-          mkdir -p "$HOME/.local/bin"
-          mv "$TMPDIR/git-cliff-${GIT_CLIFF_VERSION}/git-cliff" "$HOME/.local/bin/git-cliff"
-          chmod +x "$HOME/.local/bin/git-cliff"
-          echo "$HOME/.local/bin" >> "$GITHUB_PATH"
-          "$HOME/.local/bin/git-cliff" --version
+      - name: Install CI tools
+        run: python3 scripts/install_tools.py --tool git-cliff
       - name: Install build tools
-        run: |
-          set -euo pipefail
-          python3 -m pip install --break-system-packages build twine requests python-dotenv click
-      - name: Validate PYPI_TOKEN
-        run: |
-          set -euo pipefail
-          if [ -z "${{ secrets.PYPI_TOKEN }}" ]; then
-            echo "::warning::PYPI_TOKEN is not set — package will be built but not published to PyPI."
-          fi
+        run: python3 -m pip install --break-system-packages build twine requests python-dotenv click
       - name: Build and publish release
         env:
           REPO_TOKEN: ${{ secrets.REPO_TOKEN }}
           PYPI_TOKEN: ${{ secrets.PYPI_TOKEN }}
           PYTHONPATH: src
         run: |
-          set -euo pipefail
+          export PATH="$HOME/.local/bin:$PATH"
           python3 scripts/ci/publish.py \
             "${{ github.ref_name }}" \
             "${{ github.repository }}"
@@ -51,7 +33,6 @@ jobs:
           REPO_TOKEN: ${{ secrets.REPO_TOKEN }}
           PYTHONPATH: src
         run: |
-          set -euo pipefail
           python3 scripts/ci/notify_failure.py \
             --repo "${{ github.repository }}" \
             --run-id "${{ github.run_id }}" \