ci: convert workflows to use composite actions

Replace inline setup-env, notify-failure, and quality-checks steps in
ci.yml, post-merge.yml, and build-images.yml with composite action
references. Also fix pre-existing make workflow-dryrun failure by
using env context instead of vars/secrets in container.credentials
(act_runner dry-run does not populate vars/secrets contexts).

Generated with [Devin](https://devin.ai)

Co-Authored-By: Devin <158243242+devin-ai-integration[bot]@users.noreply.github.com>

.gitea/workflows/build-images.yml

@@ -29,14 +29,20 @@ concurrency:
   group: build-images
   cancel-in-progress: false
 
+env:
+  PIP_BREAK_SYSTEM_PACKAGES: "1"
+  PYTHONPATH: src
+  CI_GITEA_API_TOKEN: ${{ secrets.CI_GITEA_API_TOKEN }}
+  CI_GITEA_USERNAME: ${{ vars.CI_GITEA_USERNAME }}
+
 jobs:
   build-and-push:
     runs-on: docker
     container:
       image: git.oblachno.oblachno.fyi/oblachno-oss/runner-images/ci-full:latest
       credentials:
-        username: ${{ vars.CI_GITEA_USERNAME }}
-        password: ${{ secrets.CI_GITEA_API_TOKEN }}
+        username: ${{ env.CI_GITEA_USERNAME }}
+        password: ${{ env.CI_GITEA_API_TOKEN }}
     timeout-minutes: 30
     outputs:
       is-release: ${{ steps.check.outputs.is-release }}
@@ -101,20 +107,9 @@ jobs:
             --tag latest \
             --registry git.oblachno.oblachno.fyi \
             --push
-      - name: Notify on failure
-        if: failure()
-        env:
-          CI_GITEA_API_TOKEN: ${{ secrets.CI_GITEA_API_TOKEN }}
-          PYTHONPATH: src
-        run: |
-          . .venv/bin/activate 2>/dev/null || true
-          export PATH="$HOME/.local/bin:$PATH"
-          python3 -m devx.ci.notify_failure \
-            --repo "${{ github.repository }}" \
-            --run-id "${{ github.run_id }}" \
-            --workflow "build-images/build-and-push" \
-            --commit "${{ github.sha }}" \
-            --auto-login
+      - uses: ./.gitea/actions/notify-failure
+        with:
+          workflow: "build-images/build-and-push"
 
   cleanup:
     needs: [build-and-push]
@@ -123,8 +118,8 @@ jobs:
     container:
       image: git.oblachno.oblachno.fyi/oblachno-oss/runner-images/ci-base:latest
       credentials:
-        username: ${{ vars.CI_GITEA_USERNAME }}
-        password: ${{ secrets.CI_GITEA_API_TOKEN }}
+        username: ${{ env.CI_GITEA_USERNAME }}
+        password: ${{ env.CI_GITEA_API_TOKEN }}
     timeout-minutes: 10
     steps:
       - uses: actions/checkout@v4

.gitea/workflows/ci.yml

@@ -21,8 +21,8 @@ jobs:
     container:
       image: git.oblachno.oblachno.fyi/oblachno-oss/runner-images/ci-full:latest
       credentials:
-        username: ${{ vars.CI_GITEA_USERNAME }}
-        password: ${{ secrets.CI_GITEA_API_TOKEN }}
+        username: ${{ env.CI_GITEA_USERNAME }}
+        password: ${{ env.CI_GITEA_API_TOKEN }}
     timeout-minutes: 15
     defaults:
       run:
@@ -33,43 +33,12 @@ jobs:
       - uses: actions/checkout@v4
         with:
           fetch-depth: 0
-      - name: Set up environment
-        env:
-          CI_GITEA_API_TOKEN: ${{ secrets.CI_GITEA_API_TOKEN }}
-        run: make setup-image
-      # --- quality steps ---
-      - name: Lint all
-        run: |
-          . .venv/bin/activate 2>/dev/null || true
-          export PATH="$HOME/.local/bin:$PATH"
-          make lint-all
-      - name: Unit tests with 100% coverage
-        run: |
-          . .venv/bin/activate 2>/dev/null || true
-          make pytest-cov
-      - name: Check unit test speed
-        run: |
-          . .venv/bin/activate 2>/dev/null || true
-          python3 -m devx.tools.check_test_speed --max-seconds 15 --max-single-seconds 0.5
-      - name: Documentation gate (coverage + stale refs + lint + version refs + prose)
-        env:
-          DEVX_DOC_COVERAGE_STRICT: "1"
-          DEVX_VALE_LEVEL: warning
-        run: |
-          . .venv/bin/activate 2>/dev/null || true
-          export PATH="$HOME/.local/bin:$PATH"
-          make devx-docs-check
-      - name: Translation completeness check
-        run: |
-          . .venv/bin/activate 2>/dev/null || true
-          python3 -m devx.ci.check_translations
-      - name: Dependency security scan
-        run: |
-          . .venv/bin/activate 2>/dev/null || true
-          # Install pip in venv if missing (needed by pip-audit)
-          .venv/bin/python -m ensurepip 2>/dev/null || true
-          PIPAPI_PYTHON_LOCATION=$PWD/.venv/bin/python \
-            pip-audit --desc --skip-editable 2>&1 || true
+      - uses: ./.gitea/actions/setup-env
+      - uses: ./.gitea/actions/quality-checks
+        with:
+          package: devx
+          test-speed-max: "15"
+          test-speed-max-single: "0.5"
       - name: Workflow dry-run validation
         run: |
           . .venv/bin/activate 2>/dev/null || true
@@ -121,19 +90,9 @@ jobs:
           . .venv/bin/activate 2>/dev/null || true
           export PATH="$HOME/.local/bin:$PATH"
           python3 -m devx.ci.release --dry-run
-      - name: Notify on failure
-        if: failure()
-        env:
-          CI_GITEA_API_TOKEN: ${{ secrets.CI_GITEA_API_TOKEN }}
-        run: |
-          . .venv/bin/activate 2>/dev/null || true
-          export PATH="$HOME/.local/bin:$PATH"
-          python3 -m devx.ci.notify_failure \
-            --repo "${{ github.repository }}" \
-            --run-id "${{ github.run_id }}" \
-            --workflow "ci/validate" \
-            --commit "${{ github.sha }}" \
-            --auto-login
+      - uses: ./.gitea/actions/notify-failure
+        with:
+          workflow: "ci/validate"
 
   auto-merge:
     # Auto-merge runs after validate passes. It reads the task ID
@@ -147,8 +106,8 @@ jobs:
     container:
       image: git.oblachno.oblachno.fyi/oblachno-oss/runner-images/ci-base:latest
       credentials:
-        username: ${{ vars.CI_GITEA_USERNAME }}
-        password: ${{ secrets.CI_GITEA_API_TOKEN }}
+        username: ${{ env.CI_GITEA_USERNAME }}
+        password: ${{ env.CI_GITEA_API_TOKEN }}
     timeout-minutes: 10
     defaults:
       run:
@@ -158,10 +117,7 @@ jobs:
         with:
           fetch-depth: 0
           token: ${{ secrets.CI_GITEA_API_TOKEN }}
-      - name: Set up environment
-        env:
-          CI_GITEA_API_TOKEN: ${{ secrets.CI_GITEA_API_TOKEN }}
-        run: make setup-image
+      - uses: ./.gitea/actions/setup-env
       - name: Post approval review
         env:
           REVIEWER_GITEA_API_TOKEN: ${{ secrets.REVIEWER_GITEA_API_TOKEN }}

.gitea/workflows/post-merge.yml

@@ -38,8 +38,8 @@ jobs:
     container:
       image: git.oblachno.oblachno.fyi/oblachno-oss/runner-images/ci-base:latest
       credentials:
-        username: ${{ vars.CI_GITEA_USERNAME }}
-        password: ${{ secrets.CI_GITEA_API_TOKEN }}
+        username: ${{ env.CI_GITEA_USERNAME }}
+        password: ${{ env.CI_GITEA_API_TOKEN }}
     timeout-minutes: 10
     defaults:
       run:
@@ -52,10 +52,7 @@ jobs:
       - uses: actions/checkout@v4
         with:
           fetch-depth: 0
-      - name: Set up environment
-        env:
-          CI_GITEA_API_TOKEN: ${{ secrets.CI_GITEA_API_TOKEN }}
-        run: make setup-image
+      - uses: ./.gitea/actions/setup-env
       - name: Ensure branch protection and labels
         env:
           DEVX_REPO_NAME: devx
@@ -85,19 +82,9 @@ jobs:
             --base "HEAD~1" \
             --head "HEAD" \
             --github-output
-      - name: Notify on failure
-        if: failure()
-        env:
-          CI_GITEA_API_TOKEN: ${{ secrets.CI_GITEA_API_TOKEN }}
-        run: |
-          . .venv/bin/activate 2>/dev/null || true
-          export PATH="$HOME/.local/bin:$PATH"
-          python3 -m devx.ci.notify_failure \
-            --repo "${{ github.repository }}" \
-            --run-id "${{ github.run_id }}" \
-            --workflow "post-merge/detect-and-configure" \
-            --commit "${{ github.sha }}" \
-            --auto-login
+      - uses: ./.gitea/actions/notify-failure
+        with:
+          workflow: "post-merge/detect-and-configure"
 
   release-and-maintain:
     needs: [detect-and-configure]
@@ -106,8 +93,8 @@ jobs:
     container:
       image: git.oblachno.oblachno.fyi/oblachno-oss/runner-images/ci-full:latest
       credentials:
-        username: ${{ vars.CI_GITEA_USERNAME }}
-        password: ${{ secrets.CI_GITEA_API_TOKEN }}
+        username: ${{ env.CI_GITEA_USERNAME }}
+        password: ${{ env.CI_GITEA_API_TOKEN }}
     timeout-minutes: 15
     outputs:
       tag: ${{ steps.release-tag.outputs.tag }}
@@ -120,10 +107,9 @@ jobs:
           fetch-depth: 0
           ref: master
           token: ${{ secrets.CI_GITEA_API_TOKEN }}
-      - name: Set up environment
-        env:
-          CI_GITEA_API_TOKEN: ${{ secrets.CI_GITEA_API_TOKEN }}
-        run: make setup-image EXTRAS=release
+      - uses: ./.gitea/actions/setup-env
+        with:
+          extras: "release"
       - name: Configure git
         env:
           CI_GITEA_API_TOKEN: ${{ secrets.CI_GITEA_API_TOKEN }}
@@ -179,16 +165,6 @@ jobs:
           git fetch origin master
           git reset --hard origin/master
           python3 -m devx.ci.push_badges
-      - name: Notify on failure
-        if: failure()
-        env:
-          CI_GITEA_API_TOKEN: ${{ secrets.CI_GITEA_API_TOKEN }}
-        run: |
-          . .venv/bin/activate 2>/dev/null || true
-          export PATH="$HOME/.local/bin:$PATH"
-          python3 -m devx.ci.notify_failure \
-            --repo "${{ github.repository }}" \
-            --run-id "${{ github.run_id }}" \
-            --workflow "post-merge/release-and-maintain" \
-            --commit "${{ github.sha }}" \
-            --auto-login
+      - uses: ./.gitea/actions/notify-failure
+        with:
+          workflow: "post-merge/release-and-maintain"