ci: add notify-failure to auto-merge and cleanup jobs, clean up redundant env

- Add notify-failure composite action to ci/auto-merge and
  build-images/cleanup jobs (previously missing — failures in these
  jobs went unnoticed)
- Remove redundant step-level CI_GITEA_API_TOKEN/CI_GITEA_USERNAME
  env vars now that workflow-level env: block provides them
- Remove redundant step-level PYTHONPATH env (already in workflow env)
- Update ADR-0003 adoption scope to reflect notify-failure coverage
- Update ci-cd-workflow.md with explicit job list for notify-failure
- Update CHANGELOG with bug fix and cleanup entries

Generated with [Devin](https://devin.ai)

Co-Authored-By: Devin <158243242+devin-ai-integration[bot]@users.noreply.github.com>

.gitea/workflows/build-images.yml

@@ -51,13 +51,9 @@ jobs:
         with:
           fetch-depth: 1
       - name: Set up environment
-        env:
-          CI_GITEA_API_TOKEN: ${{ secrets.CI_GITEA_API_TOKEN }}
         run: make setup-release
       - name: Check if this is a release commit
         id: check
-        env:
-          PYTHONPATH: src
         run: |
           . .venv/bin/activate
           python3 -m devx.ci.detect_release_commit
@@ -65,9 +61,6 @@ jobs:
         if: >-
           github.event_name == 'workflow_dispatch' ||
           (github.event_name == 'workflow_run' && github.event.workflow_run.conclusion == 'success' && steps.check.outputs.is-release == 'false')
-        env:
-          CI_GITEA_API_TOKEN: ${{ secrets.CI_GITEA_API_TOKEN }}
-          CI_GITEA_USERNAME: ${{ vars.CI_GITEA_USERNAME }}
         run: |
           . .venv/bin/activate
           _TOKEN="$CI_GITEA_API_TOKEN"
@@ -79,10 +72,6 @@ jobs:
         if: >-
           github.event_name == 'workflow_dispatch' ||
           (github.event_name == 'workflow_run' && github.event.workflow_run.conclusion == 'success' && steps.check.outputs.is-release == 'false')
-        env:
-          CI_GITEA_API_TOKEN: ${{ secrets.CI_GITEA_API_TOKEN }}
-          CI_GITEA_USERNAME: ${{ vars.CI_GITEA_USERNAME }}
-          PYTHONPATH: src
         run: |
           . .venv/bin/activate
           export PATH="$HOME/.local/bin:$PATH"
@@ -126,13 +115,8 @@ jobs:
         with:
           fetch-depth: 1
       - name: Set up environment
-        env:
-          CI_GITEA_API_TOKEN: ${{ secrets.CI_GITEA_API_TOKEN }}
         run: make setup-ci
       - name: Clean up old image versions
-        env:
-          CI_GITEA_API_TOKEN: ${{ secrets.CI_GITEA_API_TOKEN }}
-          PYTHONPATH: src
         run: |
           . .venv/bin/activate
           python3 -m devx.tools.clean_images \
@@ -141,3 +125,6 @@ jobs:
             --name oblachno-oss/runner-images/ci-quality \
             --name oblachno-oss/runner-images/ci-full \
             --keep 2
+      - uses: ./.gitea/actions/notify-failure
+        with:
+          workflow: "build-images/cleanup"

.gitea/workflows/ci.yml

@@ -121,7 +121,6 @@ jobs:
       - name: Post approval review
         env:
           REVIEWER_GITEA_API_TOKEN: ${{ secrets.REVIEWER_GITEA_API_TOKEN }}
-          CI_GITEA_API_TOKEN: ${{ secrets.CI_GITEA_API_TOKEN }}
           PR_NUMBER: ${{ github.event.number }}
           REPOSITORY: ${{ github.repository }}
         run: |
@@ -135,7 +134,6 @@ jobs:
             --body "Auto-approved: all CI checks passed (validate job)."
       - name: Squash merge with task ID
         env:
-          CI_GITEA_API_TOKEN: ${{ secrets.CI_GITEA_API_TOKEN }}
           VIKUNJA_TOKEN: ${{ secrets.VIKUNJA_TOKEN }}
           DEVX_VIKUNJA_PROJECT_ID: "8"
           HEAD_REF: ${{ github.head_ref }}
@@ -149,3 +147,6 @@ jobs:
             "$PR_TITLE" \
             "$REPOSITORY" \
             "$PR_NUMBER"
+      - uses: ./.gitea/actions/notify-failure
+        with:
+          workflow: "ci/auto-merge"

.gitea/workflows/post-merge.yml

@@ -111,8 +111,6 @@ jobs:
         with:
           extras: "release"
       - name: Configure git
-        env:
-          CI_GITEA_API_TOKEN: ${{ secrets.CI_GITEA_API_TOKEN }}
         run: |
           git config user.name "devx-ci-bot"
           git config user.email "devx-ci-bot@oblachno.fyi"
@@ -121,16 +119,12 @@ jobs:
       - name: Run release
         id: release-tag
         if: needs.detect-and-configure.outputs.is-release == 'false' && needs.detect-and-configure.outputs.user-facing-changed == 'true'
-        env:
-          CI_GITEA_API_TOKEN: ${{ secrets.CI_GITEA_API_TOKEN }}
         run: |
           . .venv/bin/activate 2>/dev/null || true
           export PATH="$HOME/.local/bin:$PATH"
           python3 -m devx.ci.release
       - name: Build and publish release
         if: steps.release-tag.outputs.tag != ''
-        env:
-          CI_GITEA_API_TOKEN: ${{ secrets.CI_GITEA_API_TOKEN }}
         run: |
           . .venv/bin/activate 2>/dev/null || true
           export PATH="$HOME/.local/bin:$PATH"
@@ -140,8 +134,6 @@ jobs:
       # --- sync-wiki + vikunja (skip on automated/release commits) ---
       - name: Sync documentation to wiki
         if: needs.detect-and-configure.outputs.is-automated == 'false'
-        env:
-          CI_GITEA_API_TOKEN: ${{ secrets.CI_GITEA_API_TOKEN }}
         run: |
           . .venv/bin/activate 2>/dev/null || true
           python3 -m devx.ci.sync_wiki --repo "${{ github.repository }}" --verify
@@ -156,7 +148,6 @@ jobs:
       # --- badges (always run — even on release commits) ---
       - name: Generate and push badges
         env:
-          CI_GITEA_API_TOKEN: ${{ secrets.CI_GITEA_API_TOKEN }}
           PRE_COMMIT_ALLOW_NO_CONFIG: "1"
         run: |
           . .venv/bin/activate 2>/dev/null || true

CHANGELOG.md

@@ -8,6 +8,12 @@ All notable changes to this project will be documented in this file.
 
 - Add composite actions (setup-env, notify-failure, quality-checks) in `.gitea/actions/`
 - Convert ci.yml, post-merge.yml, build-images.yml to use composite actions
+- Add notify-failure to ci/auto-merge and build-images/cleanup jobs (previously missing)
+- Fix `make workflow-dryrun` failure: use `env` context instead of
+  `vars`/`secrets` in `container.credentials` (act_runner dry-run
+  does not populate vars/secrets)
+- Remove redundant step-level `CI_GITEA_API_TOKEN`/`CI_GITEA_USERNAME`
+  env vars (now in workflow-level `env:` block)
 
 ## [0.50.4] - 2026-08-12
 

docs/decisions/0003-composite-actions.md

@@ -77,17 +77,17 @@ fresh `make setup-image` runs.
 
 - **`ci.yml` validate job**: `setup-env` + `quality-checks` +
   `notify-failure`.
-- **`ci.yml` auto-merge job**: `setup-env` only (no quality checks,
-  no notify-failure — auto-merge failure is surfaced by the validate
-  job's notify-failure).
+- **`ci.yml` auto-merge job**: `setup-env` + `notify-failure` (no
+  quality checks — auto-merge only runs after validate passes).
 - **`post-merge.yml` detect-and-configure**: `setup-env` +
   `notify-failure`.
 - **`post-merge.yml` release-and-maintain**: `setup-env` (with
   `extras: "release"`) + `notify-failure`.
 - **`build-images.yml` build-and-push**: `notify-failure` only. The
-  setup steps use `make setup-release` and `make setup-ci` (not
-  `make setup-image`), so `setup-env` does not apply. The cleanup job
-  has no notify-failure step (it only runs on build-and-push success).
+  setup steps use `make setup-release` (not `make setup-image`), so
+  `setup-env` does not apply.
+- **`build-images.yml` cleanup**: `notify-failure` only. The setup
+  step uses `make setup-ci` (not `make setup-image`).
 
 ### Same-Repo Copies (No Cross-Repo References)
 

docs/tech/ci-cd-workflow.md

@@ -591,3 +591,8 @@ which runs `if: failure()`. This creates a Gitea issue with the workflow
 name, run ID, and commit SHA, ensuring failures that would otherwise go
 unnoticed in the Actions tab are surfaced as issues. The issue is created
 via the tea CLI with a `bug` label if available.
+
+Jobs with `notify-failure`:
+- `ci/validate`, `ci/auto-merge`
+- `post-merge/detect-and-configure`, `post-merge/release-and-maintain`
+- `build-images/build-and-push`, `build-images/cleanup`