GRM-95: refactor: consolidate publish.yml into post-merge.yml

.gitea/workflows/post-merge.yml

@@ -1,13 +1,13 @@
 name: Post-merge
 
 # Runs on every push to master. A single workflow with conditional jobs
-# replaces the previous 4 separate workflows (release.yml, post-merge.yml,
+# for release, publish, wiki sync, badges, and Vikunja task updates.
-# sync-wiki.yml, and the badges job from ci.yml).
 #
 # Job dependency graph:
 #
 #   detect-type ──┬── validate-commit-msg (skip if release commit)
 #                 ├── release (skip if release commit)
+#                 │   └── publish (needs release — builds & publishes to PyPI)
 #                 ├── badges (ALWAYS runs — even on release commits)
 #                 ├── configure-repo (independent — skip if release commit)
 #                 ├── sync-wiki (skip if release commit — runs for ALL merges)
@@ -21,9 +21,10 @@ name: Post-merge
 # runs on every push to master, including release commits. This ensures
 # badges (tests, coverage, version, etc.) are always current.
 #
-# When release.py creates a "release: vX.Y.Z" commit, the release
+# When release creates a "release: vX.Y.Z" commit and tag, the publish
-# commit's post-merge run still updates badges (version badge picks
+# job (which depends on release) builds and publishes the package to the
-# up the new version). Other jobs skip. The tag push triggers publish.yml.
+# Gitea PyPI registry. The release commit's post-merge run still updates
+# badges (version badge picks up the new version). Other jobs skip.
 
 on:
   push:
@@ -79,6 +80,8 @@ jobs:
     if: needs.detect-type.outputs.is-release == 'false'
     runs-on: docker
     timeout-minutes: 15
+    outputs:
+      tag: ${{ steps.release-tag.outputs.tag }}
     steps:
       - uses: actions/checkout@v4
         with:
@@ -93,6 +96,7 @@ jobs:
           git config user.name "grm-ci-bot"
           git config user.email "grm-ci-bot@oblachno.fyi"
       - name: Run release
+        id: release-tag
         env:
           PYTHONPATH: src
           DEVX_VERSION_FILE: src/gitea_runner_manager/__init__.py
@@ -102,6 +106,13 @@ jobs:
           . .venv/bin/activate
           export PATH="$HOME/.local/bin:$PATH"
           python3 -m devx.ci.release
+      - name: Extract tag (fallback if GITHUB_OUTPUT not set)
+        if: steps.release-tag.outputs.tag == ''
+        run: |
+          tag=$(git describe --tags --abbrev=0 2>/dev/null || true)
+          if [ -n "$tag" ]; then
+            echo "tag=$tag" >> "$GITHUB_OUTPUT"
+          fi
       - name: Notify on failure
         if: failure()
         env:
@@ -116,6 +127,43 @@ jobs:
             --workflow "post-merge/release" \
             --commit "${{ github.sha }}"
 
+  publish:
+    needs: [release]
+    if: needs.release.outputs.tag != ''
+    runs-on: docker
+    timeout-minutes: 10
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+      - name: Set up environment
+        env:
+          REPO_TOKEN: ${{ secrets.REPO_TOKEN }}
+        run: make setup-release
+      - name: Build and publish release
+        env:
+          REPO_TOKEN: ${{ secrets.REPO_TOKEN }}
+          PYTHONPATH: src
+        run: |
+          . .venv/bin/activate
+          export PATH="$HOME/.local/bin:$PATH"
+          python3 -m devx.ci.publish \
+            "${{ needs.release.outputs.tag }}" \
+            "${{ github.repository }}"
+      - name: Notify on failure
+        if: failure()
+        env:
+          REPO_TOKEN: ${{ secrets.REPO_TOKEN }}
+          PYTHONPATH: src
+        run: |
+          . .venv/bin/activate 2>/dev/null || true
+          export PATH="$HOME/.local/bin:$PATH"
+          python3 -m devx.ci.notify_failure --auto-login \
+            --repo "${{ github.repository }}" \
+            --run-id "${{ github.run_id }}" \
+            --workflow "post-merge/publish" \
+            --commit "${{ github.sha }}"
+
   sync-wiki:
     needs: [detect-type]
     if: needs.detect-type.outputs.is-release == 'false'

.gitea/workflows/publish.yml

@@ -1,48 +0,0 @@
-name: Publish Release
-
-on:
-  push:
-    tags:
-      - 'v*'
-  workflow_dispatch:
-    inputs:
-      tag:
-        description: 'Tag to publish (e.g. v0.7.0)'
-        required: true
-        type: string
-
-jobs:
-  publish:
-    runs-on: docker
-    timeout-minutes: 10
-    steps:
-      - uses: actions/checkout@v4
-        with:
-          fetch-depth: 0
-      - name: Set up environment
-        env:
-          REPO_TOKEN: ${{ secrets.REPO_TOKEN }}
-        run: make setup-release
-      - name: Build and publish release
-        env:
-          REPO_TOKEN: ${{ secrets.REPO_TOKEN }}
-          PYTHONPATH: src
-        run: |
-          . .venv/bin/activate
-          export PATH="$HOME/.local/bin:$PATH"
-          python3 -m devx.ci.publish \
-            "${{ github.event.inputs.tag || github.ref_name }}" \
-            "${{ github.repository }}"
-      - name: Notify on failure
-        if: failure()
-        env:
-          REPO_TOKEN: ${{ secrets.REPO_TOKEN }}
-          PYTHONPATH: src
-        run: |
-          . .venv/bin/activate 2>/dev/null || true
-          export PATH="$HOME/.local/bin:$PATH"
-          python3 -m devx.ci.notify_failure --auto-login \
-            --repo "${{ github.repository }}" \
-            --run-id "${{ github.run_id }}" \
-            --workflow "publish" \
-            --commit "${{ github.sha }}"

AGENTS.md

@@ -234,8 +234,9 @@ Vikunja task updates:
    non-release commits (not just when release succeeds), so infrastructure-only
    changes still update the task tracker.
 
-The tag push triggers the **publish workflow** (`.gitea/workflows/publish.yml`)
+6. **publish** — Runs after release succeeds (needs: release). Builds and
-which builds and publishes the package to PyPI.
+   publishes the package to the Gitea PyPI registry. Gets the tag from the
+   release job's `tag` output.
 
 ### Smart CI: User-Facing vs Workflow-Only Changes
 
@@ -356,11 +357,11 @@ platform matrix. Both `devx.molecule.distribute_molecule` (CI) and
 `devx.molecule.molecule_all` (dev tool) import `PLATFORMS` from it — this
 avoids dev tools importing directly from CI modules.
 
-2. **Publish workflow** (`.gitea/workflows/publish.yml`):
+2. **Publish job** (in `post-merge.yml`, needs: release):
-   - Triggers on tag push (`v*`)
+   - Runs after the release job creates a tag
-   - Validates `PYPI_TOKEN` is set (warns if missing)
+   - Gets the tag from `needs.release.outputs.tag`
    - Builds the Python package
-   - Optionally publishes to PyPI (if `PYPI_TOKEN` is set)
+   - Publishes to the Gitea PyPI registry
    - Creates a Gitea release with git-cliff-generated release notes
    - On failure, creates a Gitea issue via `devx.ci.notify_failure`