ci: add notify-failure to auto-merge and cleanup jobs, clean up redundant env

- Add notify-failure composite action to ci/auto-merge and
  build-images/cleanup jobs (previously missing — failures in these
  jobs went unnoticed)
- Remove redundant step-level CI_GITEA_API_TOKEN/CI_GITEA_USERNAME
  env vars now that workflow-level env: block provides them
- Remove redundant step-level PYTHONPATH env (already in workflow env)
- Update ADR-0003 adoption scope to reflect notify-failure coverage
- Update ci-cd-workflow.md with explicit job list for notify-failure
- Update CHANGELOG with bug fix and cleanup entries

Generated with [Devin](https://devin.ai)

Co-Authored-By: Devin <158243242+devin-ai-integration[bot]@users.noreply.github.com>

.gitea/workflows/build-images.yml

@@ -51,13 +51,9 @@ jobs:
         with:
           fetch-depth: 1
       - name: Set up environment
-        env:
-          CI_GITEA_API_TOKEN: ${{ secrets.CI_GITEA_API_TOKEN }}
         run: make setup-release
       - name: Check if this is a release commit
         id: check
-        env:
-          PYTHONPATH: src
         run: |
           . .venv/bin/activate
           python3 -m devx.ci.detect_release_commit
@@ -65,9 +61,6 @@ jobs:
         if: >-
           github.event_name == 'workflow_dispatch' ||
           (github.event_name == 'workflow_run' && github.event.workflow_run.conclusion == 'success' && steps.check.outputs.is-release == 'false')
-        env:
-          CI_GITEA_API_TOKEN: ${{ secrets.CI_GITEA_API_TOKEN }}
-          CI_GITEA_USERNAME: ${{ vars.CI_GITEA_USERNAME }}
         run: |
           . .venv/bin/activate
           _TOKEN="$CI_GITEA_API_TOKEN"
@@ -79,10 +72,6 @@ jobs:
         if: >-
           github.event_name == 'workflow_dispatch' ||
           (github.event_name == 'workflow_run' && github.event.workflow_run.conclusion == 'success' && steps.check.outputs.is-release == 'false')
-        env:
-          CI_GITEA_API_TOKEN: ${{ secrets.CI_GITEA_API_TOKEN }}
-          CI_GITEA_USERNAME: ${{ vars.CI_GITEA_USERNAME }}
-          PYTHONPATH: src
         run: |
           . .venv/bin/activate
           export PATH="$HOME/.local/bin:$PATH"
@@ -126,13 +115,8 @@ jobs:
         with:
           fetch-depth: 1
       - name: Set up environment
-        env:
-          CI_GITEA_API_TOKEN: ${{ secrets.CI_GITEA_API_TOKEN }}
         run: make setup-ci
       - name: Clean up old image versions
-        env:
-          CI_GITEA_API_TOKEN: ${{ secrets.CI_GITEA_API_TOKEN }}
-          PYTHONPATH: src
         run: |
           . .venv/bin/activate
           python3 -m devx.tools.clean_images \
@@ -141,3 +125,6 @@ jobs:
             --name oblachno-oss/runner-images/ci-quality \
             --name oblachno-oss/runner-images/ci-full \
             --keep 2
+      - uses: ./.gitea/actions/notify-failure
+        with:
+          workflow: "build-images/cleanup"

.gitea/workflows/ci.yml

@@ -121,7 +121,6 @@ jobs:
       - name: Post approval review
         env:
           REVIEWER_GITEA_API_TOKEN: ${{ secrets.REVIEWER_GITEA_API_TOKEN }}
-          CI_GITEA_API_TOKEN: ${{ secrets.CI_GITEA_API_TOKEN }}
           PR_NUMBER: ${{ github.event.number }}
           REPOSITORY: ${{ github.repository }}
         run: |
@@ -135,7 +134,6 @@ jobs:
             --body "Auto-approved: all CI checks passed (validate job)."
       - name: Squash merge with task ID
         env:
-          CI_GITEA_API_TOKEN: ${{ secrets.CI_GITEA_API_TOKEN }}
           VIKUNJA_TOKEN: ${{ secrets.VIKUNJA_TOKEN }}
           DEVX_VIKUNJA_PROJECT_ID: "8"
           HEAD_REF: ${{ github.head_ref }}
@@ -149,3 +147,6 @@ jobs:
             "$PR_TITLE" \
             "$REPOSITORY" \
             "$PR_NUMBER"
+      - uses: ./.gitea/actions/notify-failure
+        with:
+          workflow: "ci/auto-merge"

.gitea/workflows/post-merge.yml

@@ -111,8 +111,6 @@ jobs:
         with:
           extras: "release"
       - name: Configure git
-        env:
-          CI_GITEA_API_TOKEN: ${{ secrets.CI_GITEA_API_TOKEN }}
         run: |
           git config user.name "devx-ci-bot"
           git config user.email "devx-ci-bot@oblachno.fyi"
@@ -121,16 +119,12 @@ jobs:
       - name: Run release
         id: release-tag
         if: needs.detect-and-configure.outputs.is-release == 'false' && needs.detect-and-configure.outputs.user-facing-changed == 'true'
-        env:
-          CI_GITEA_API_TOKEN: ${{ secrets.CI_GITEA_API_TOKEN }}
         run: |
           . .venv/bin/activate 2>/dev/null || true
           export PATH="$HOME/.local/bin:$PATH"
           python3 -m devx.ci.release
       - name: Build and publish release
         if: steps.release-tag.outputs.tag != ''
-        env:
-          CI_GITEA_API_TOKEN: ${{ secrets.CI_GITEA_API_TOKEN }}
         run: |
           . .venv/bin/activate 2>/dev/null || true
           export PATH="$HOME/.local/bin:$PATH"
@@ -140,8 +134,6 @@ jobs:
       # --- sync-wiki + vikunja (skip on automated/release commits) ---
       - name: Sync documentation to wiki
         if: needs.detect-and-configure.outputs.is-automated == 'false'
-        env:
-          CI_GITEA_API_TOKEN: ${{ secrets.CI_GITEA_API_TOKEN }}
         run: |
           . .venv/bin/activate 2>/dev/null || true
           python3 -m devx.ci.sync_wiki --repo "${{ github.repository }}" --verify
@@ -156,7 +148,6 @@ jobs:
       # --- badges (always run — even on release commits) ---
       - name: Generate and push badges
         env:
-          CI_GITEA_API_TOKEN: ${{ secrets.CI_GITEA_API_TOKEN }}
           PRE_COMMIT_ALLOW_NO_CONFIG: "1"
         run: |
           . .venv/bin/activate 2>/dev/null || true