DEVX-1: fix: allow release bot to push to protected master

.gitea/workflows/post-merge.yml

@@ -221,6 +221,7 @@ jobs:
       - name: Ensure branch protection and labels
         env:
           REPO_TOKEN: ${{ secrets.REPO_TOKEN }}
+          DEVX_PUSH_WHITELIST: "emil"
           PYTHONPATH: src
         run: python3 -m devx.tools.configure_repo --repo devx --owner oblachno-oss
       - name: Notify on failure

src/devx/tools/configure_repo.py

@@ -38,12 +38,17 @@ def _default_branch_protection_config() -> dict[str, Any]:
     The ``status_check_contexts`` are read from the ``DEVX_STATUS_CHECKS``
     environment variable (comma-separated) or default to just the quality
     check context.
+
+    The ``push_whitelist_usernames`` is read from ``DEVX_PUSH_WHITELIST``
+    (comma-separated) to allow the release bot to push directly to master.
     """
+    push_whitelist = os.environ.get("DEVX_PUSH_WHITELIST", "")
+    whitelist = [u.strip() for u in push_whitelist.split(",") if u.strip()]
     return {
         "branch_name": "master",
         "enable_push": True,
         "enable_push_whitelist": True,
-        "push_whitelist_usernames": [],
+        "push_whitelist_usernames": whitelist,
         "enable_status_check": True,
         "status_check_contexts": _default_status_checks(),
         "required_approvals": 0,

tests/unit/test_configure_repo.py

@@ -45,6 +45,16 @@ class TestDefaultConfigs:
             config = _default_branch_protection_config()
             assert config["status_check_contexts"] == ["check1", "check2", "check3"]
 
+    def test_push_whitelist_from_env(self) -> None:
+        with patch.dict("os.environ", {"DEVX_PUSH_WHITELIST": "emil, alice"}):
+            config = _default_branch_protection_config()
+            assert config["push_whitelist_usernames"] == ["emil", "alice"]
+
+    def test_push_whitelist_empty_by_default(self) -> None:
+        with patch.dict("os.environ", {}, clear=True):
+            config = _default_branch_protection_config()
+            assert config["push_whitelist_usernames"] == []
+
 
 class TestConfigureRepo:
     @patch.dict("os.environ", {"REPO_TOKEN": "tok"}, clear=True)