GRM-165: feat: adopt spec-driven CI gates, create_dependency_pr, and pr-review skill

Co-authored-by: emil User <emil.simeonov@tutanota.com>

.gitea/workflows/ci.yml

@@ -110,14 +110,30 @@ jobs:
             --pr-title "$PR_TITLE" \
             --repo "$REPOSITORY" \
             --pr-number "$PR_NUMBER"
-      - name: Run automated PR review
+      - name: Validate spec file
         if: github.event_name == 'pull_request'
+        env:
+          DEVX_TASK_PREFIX: GRM
+          PYTHONPATH: ${{ env.PYTHONPATH }}
+          HEAD_REF: ${{ github.head_ref }}
         run: |
           . .venv/bin/activate 2>/dev/null || true
-          set -euo pipefail
-          python3 -m devx.ci.pr_review \
-            "${{ github.event.number }}" \
-            "${{ github.repository }}"
+          python3 -m devx.ci.validate_spec \
+            --branch "$HEAD_REF" \
+            --github-output
+      - name: Check PR size
+        if: github.event_name == 'pull_request'
+        env:
+          PYTHONPATH: ${{ env.PYTHONPATH }}
+          CI_GITEA_API_TOKEN: ${{ secrets.CI_GITEA_API_TOKEN }}
+        run: |
+          . .venv/bin/activate 2>/dev/null || true
+          python3 -m devx.ci.check_pr_size \
+            --base "origin/master" \
+            --head "${{ github.event.pull_request.head.sha || github.sha }}" \
+            --repo "${{ github.repository }}" \
+            --pr-number "${{ github.event.number }}" \
+            --github-output
       # --- release-dry-run step (conditional) ---
       - name: Release dry-run validation
         if: steps.detect.outputs.user-facing-changed == 'true'
@@ -285,16 +301,17 @@ jobs:
         env:
           REVIEWER_GITEA_API_TOKEN: ${{ secrets.REVIEWER_GITEA_API_TOKEN }}
           PR_NUMBER: ${{ github.event.number }}
-          REPOSITORY: ${{ github.repository }}
+          GITHUB_SERVER_URL: ${{ github.server_url }}
+          GITHUB_REPOSITORY: ${{ github.repository }}
         run: |
           . .venv/bin/activate 2>/dev/null || true
-          python3 -m devx.ci.pr_review \
-            "$PR_NUMBER" \
-            "$REPOSITORY" \
-            --event APPROVE \
-            --checklist-confirmed \
-            --checklist-categories 1,2,3,4,5,6,7,8,9,10,11,12,13 \
-            --body "Auto-approved: all CI checks passed (validate, molecule-tests)."
+          # Post APPROVE review via Gitea API to satisfy branch protection
+          curl -s -X POST \
+            "${GITHUB_SERVER_URL}/api/v1/repos/${GITHUB_REPOSITORY}/pulls/${PR_NUMBER}/reviews" \
+            -H "Authorization: token ${REVIEWER_GITEA_API_TOKEN}" \
+            -H "Content-Type: application/json" \
+            -d '{"event":"APPROVED","body":"Auto-approved: all CI checks passed (validate, molecule-tests)."}' \
+            || echo "::warning::Failed to post approval review (best-effort)."
       - name: Wait for molecule tests to complete
         env:
           CI_GITEA_API_TOKEN: ${{ secrets.CI_GITEA_API_TOKEN }}
@@ -311,11 +328,11 @@ jobs:
           import sys,json
           d=json.load(sys.stdin)
           statuses={s['context']:s['status'] for s in d.get('statuses',[])}
-          # Check if all molecule-tests contexts are terminal (success/failure)
+          # Check if all molecule-tests contexts are terminal (success/failure/skipped)
           mol_contexts=[k for k in statuses if 'molecule-tests' in k]
           if not mol_contexts:
-              print('pending')
-          elif all(statuses[k] in ('success','failure') for k in mol_contexts):
+              print('skipped')
+          elif all(statuses[k] in ('success','failure','skipped') for k in mol_contexts):
               if any(statuses[k]=='failure' for k in mol_contexts):
                   print('failure')
               else:
@@ -324,8 +341,8 @@ jobs:
               print('pending')
           ")
             echo "Molecule tests status: $STATUS (elapsed: ${ELAPSED}s)"
-            if [ "$STATUS" = "success" ]; then
-              echo "All molecule tests passed."
+            if [ "$STATUS" = "success" ] || [ "$STATUS" = "skipped" ]; then
+              echo "All molecule tests passed (or skipped — no ansible changes)."
               break
             elif [ "$STATUS" = "failure" ]; then
               echo "ERROR: Molecule tests failed. Aborting auto-merge."

.gitea/workflows/post-merge.yml

@@ -148,6 +148,26 @@ jobs:
           git fetch --tags
           git checkout "${{ steps.release-tag.outputs.tag }}"
           python3 -m devx.ci.publish "${{ steps.release-tag.outputs.tag }}" "${{ github.repository }}" --auto-login
+      - name: Create infra dependency PR
+        if: steps.release-tag.outputs.tag != ''
+        env:
+          CI_GITEA_API_TOKEN: ${{ secrets.CI_GITEA_API_TOKEN }}
+          VIKUNJA_TOKEN: ${{ secrets.VIKUNJA_TOKEN }}
+          PYTHONPATH: ${{ env.PYTHONPATH }}
+          DEVX_TASK_PREFIX: GRM
+          DEVX_VIKUNJA_PROJECT_ID: 6
+        run: |
+          . .venv/bin/activate 2>/dev/null || true
+          # Extract version from the tag (strip leading 'v')
+          TAG="${{ steps.release-tag.outputs.tag }}"
+          VERSION="${TAG#v}"
+          python3 -m devx.ci.create_dependency_pr \
+            --repo oblachno/infra \
+            --package grm \
+            --new-version "$VERSION" \
+            --source-repo "${{ github.repository }}" \
+            --source-run-id "${{ github.run_id }}" || \
+            echo "::warning::Failed to create infra dependency PR (best-effort)."
       # --- sync-wiki + vikunja (skip on automated/release commits) ---
       - name: Sync documentation to wiki
         if: needs.detect-and-configure.outputs.is-automated == 'false'