GRM-114: fix: add approval step to auto-merge workflow using REVIEW_GITEA_TOKEN

.gitea/workflows/ci.yml

@@ -250,6 +250,21 @@ jobs:
           CI_GITEA_TOKEN: ${{ secrets.CI_GITEA_TOKEN }}
           CI_GITEA_USERNAME: ${{ vars.CI_GITEA_USERNAME }}
         run: make setup-image EXTRAS=ci
+      - name: Post approval review
+        env:
+          CI_GITEA_TOKEN: ${{ secrets.REVIEW_GITEA_TOKEN }}
+          PR_NUMBER: ${{ github.event.number }}
+          REPOSITORY: ${{ github.repository }}
+          PYTHONPATH: src
+        run: |
+          . .venv/bin/activate
+          python3 -m devx.ci.pr_review \
+            "$PR_NUMBER" \
+            "$REPOSITORY" \
+            --event APPROVE \
+            --checklist-confirmed \
+            --checklist-categories 1,2,3,4,5,6,7,8,9,10,11,12,13 \
+            --body "Auto-approved: all CI checks passed (quality, molecule, pr-review)."
       - name: Squash merge with task ID
         env:
           CI_GITEA_TOKEN: ${{ secrets.CI_GITEA_TOKEN }}

ansible/requirements.yml

@@ -1,7 +1,7 @@
 collections:
   - name: community.general
-    version: ">=13.1.0"
+    version: "==13.1.0"
   - name: ansible.posix
-    version: ">=2.2.0"
+    version: "==2.2.0"
   - name: community.docker
-    version: ">=5.2.1"
+    version: "==5.2.1"

pyproject.toml

@@ -14,9 +14,9 @@ classifiers = [
     "License :: OSI Approved :: GNU General Public License v3 (GPLv3)",
 ]
 dependencies = [
-    "python-dotenv>=1.2.2",
+    "python-dotenv==1.2.2",
-    "click>=8.4.2",
+    "click==8.4.2",
-    "ansible>=14.1.0",
+    "ansible==14.1.0",
 ]
 
 [project.scripts]
@@ -29,32 +29,32 @@ version = {attr = "gitea_runner_manager.__version__"}
 # Minimal deps for CI scripts that only need click/dotenv
 # (detect-changes, discover-runners, pr-review, sync-wiki, badges, etc.)
 ci = [
-    "pytest>=9.1.1",
+    "pytest==9.1.1",
-    "pytest-cov>=7.1.0",
+    "pytest-cov==7.1.0",
-    "build>=1.5.0",
+    "build==1.5.0",
-    "twine>=6.2.0",
+    "twine==6.2.0",
     # Reusable CI/CD and dev tools (auto-merge, pr-review, pre-push checks, etc.)
-    "devx>=0.26.0",
+    "devx==0.26.1",
 ]
 # Lint and type-checking tools (quality job)
 lint = [
-    "ruff>=0.15.20",
+    "ruff==0.15.20",
-    "pyright>=1.1.411",
+    "pyright==1.1.411",
-    "bandit>=1.9.4",
+    "bandit==1.9.4",
-    "pip-audit>=2.10.1",
+    "pip-audit==2.10.1",
-    "pre-commit>=4.6.0",
+    "pre-commit==4.6.0",
-    "ansible-lint>=26.4.0",
+    "ansible-lint==26.4.0",
 ]
 # Molecule testing (molecule-tests job)
 molecule = [
-    "molecule>=26.4.0",
+    "molecule==26.4.0",
-    "molecule-docker>=2.1.0",
+    "molecule-docker==2.1.0",
 ]
 # Full dev environment (local development, includes everything)
 dev = [
     "gitea-runner-manager[ci,lint,molecule]",
     # Reusable CI/CD and dev tools (pre-push hooks, create-task, create-pr)
-    "devx>=0.26.0",
+    "devx==0.26.1",
     # Non-Python dev dependency: checkmake (Makefile linter)
     # Install via: go install github.com/checkmake/checkmake/cmd/checkmake@latest
 ]