release: v0.50.1 [skip ci]

The host's rootless Docker socket is mounted as /var/run/docker.sock
inside CI containers. Its data root is on the host filesystem (not
accessible from inside the container), so _get_docker_free_bytes
returns 0. Previously the code didn't trust this and started a local
dockerd on /dev/shm (too small). Now checks pgrep for dockerd processes
— if none found inside the container, the socket is the host's Docker
and should be trusted.

Generated with [Devin](https://devin.ai)

Co-Authored-By: Devin <158243242+devin-ai-integration[bot]@users.noreply.github.com>

.gitea/workflows/post-merge.yml

@@ -125,12 +125,9 @@ jobs:
           CI_GITEA_API_TOKEN: ${{ secrets.CI_GITEA_API_TOKEN }}
         run: make setup-image EXTRAS=release
       - name: Configure git
-        env:
-          CI_GITEA_API_TOKEN: ${{ secrets.CI_GITEA_API_TOKEN }}
         run: |
           git config user.name "devx-ci-bot"
           git config user.email "devx-ci-bot@oblachno.fyi"
-          git remote set-url origin "https://devx-ci-bot:${CI_GITEA_API_TOKEN}@git.oblachno.oblachno.fyi/oblachno-oss/devx.git"
       # --- release + publish (only if user-facing changes, not a release commit) ---
       - name: Run release
         id: release-tag

AGENTS.md

@@ -98,9 +98,7 @@ src/devx/
 │   ├── record_deployed_tag.py  # Record deployed tag to Gitea repo variable
 │   ├── cancel_superseded_runs.py  # Cancel in-flight CI runs for the same PR branch
 │   ├── check_workflow_artifact_deps.py  # Verify artifact download jobs depend on upload jobs
-│   ├── check_workflow_tofu_init.py  # Verify tofu-state jobs have a tofu-init step
-│   ├── discover_runners.py  # Deprecated wrapper → molecule/discover_runners
-│   └── wait_for_checks.py  # Poll Gitea Actions for job completion (replaces inline shell polling)
+│   └── check_workflow_tofu_init.py  # Verify tofu-state jobs have a tofu-init step
 ├── tools/               # Developer tooling modules (run locally or by CI)
 │   ├── setup.py         # Environment setup (venv, deps, hooks)
 │   ├── install_tools.py # Install actionlint, git-cliff, act_runner, tea, hadolint, vale
@@ -124,19 +122,12 @@ src/devx/
 │   ├── pr_label.py          # Add labels to PRs (idempotent)
 │   ├── pre_push_check.py    # Validate Vikunja task existence before push
 │   ├── check_docker_init.py  # Check Docker Compose services with healthchecks have init: true
-│   ├── check_ansible_set_fact_to_json.py  # Thin wrapper → ansible_checks/set_fact_to_json
+│   ├── check_ansible_set_fact_to_json.py  # Check set_fact tasks don't misuse to_json
 │   ├── check_alert_rules.py  # Validate Prometheus alert rules with promtool
-│   ├── check_ansible_no_log.py  # Thin wrapper → ansible_checks/no_log
-│   ├── check_ansible_patterns.py  # Thin wrapper → ansible_checks/patterns
-│   ├── check_jinja_expr.py  # Thin wrapper → ansible_checks/jinja_expr
-│   ├── check_ansible_no_state_absent_on_db.py  # Thin wrapper → ansible_checks/no_state_absent_on_db
-│   ├── ansible_checks/     # Composable Ansible check subpackage (canonical implementations)
-│   │   ├── _shared.py      # AnsibleFileFinder, AnsibleYAMLParser, ViolationReporter
-│   │   ├── no_log.py       # Check missing no_log on secret-handling tasks
-│   │   ├── patterns.py     # Detect dangerous failure-masking patterns
-│   │   ├── set_fact_to_json.py  # Check set_fact tasks don't misuse to_json
-│   │   ├── no_state_absent_on_db.py  # Prevent state:absent on DB paths
-│   │   └── jinja_expr.py   # Validate Jinja2 expressions in Ansible files
+│   ├── check_ansible_no_log.py  # Check Ansible tasks for missing no_log on secrets
+│   ├── check_ansible_patterns.py  # Detect dangerous failure-masking patterns
+│   ├── check_jinja_expr.py  # Validate Jinja2 expressions in Ansible files
+│   ├── check_ansible_no_state_absent_on_db.py  # Prevent state:absent on DB paths
 │   └── _shared.py           # Shared tool utilities
 ├── opentofu.py          # OpenTofu output helpers (get_tofu_output, get_tofu_vm_ip, get_tofu_vm_field)
 ├── utils/               # Shared utilities (reusable across projects)
@@ -152,9 +143,8 @@ src/devx/
 │   ├── ui.py             # say() — unified click.echo + logging output
 │   └── jinja.py          # Jinja2 environment helpers + Ansible-compatible filters
 └── molecule/            # Optional molecule testing helpers (for Ansible projects)
-    ├── discover_runners.py    # Dynamic Gitea runner discovery (canonical; ci/discover_runners is a deprecated wrapper)
+    ├── discover_runners.py    # Dynamic Gitea runner discovery
     ├── distribute_molecule.py # Distribute molecule scenarios across runners (LPT scheduling, --roles-root for multi-role)
-    ├── molecule_ci_guard.py   # Run molecule with cross-runner fail-fast (--roles-root)
     ├── molecule_all.py        # Run all molecule scenarios locally
     ├── molecule_changed.py    # Detect which Ansible roles changed and output molecule scenarios
     ├── start_docker.py        # Ensure Docker daemon is running for molecule tests

CHANGELOG.md

@@ -2,126 +2,96 @@
 
 All notable changes to this project will be documented in this file.
 
-## [0.50.2] - 2026-08-12
+## [0.50.1] - 2026-08-15
 
 ### Bug Fixes
 
-- Run molecule destroy on test failure to clean up containers
+- Prefer rootless Docker socket over low-space inner DinD daemon
+- Check /run/host-docker.sock for host Docker daemon
+- Use /dev/shm/docker as data-root for inner dockerd
+- Kill existing dockerd before starting /dev/shm/docker daemon
+- Use /dev/shm/docker.sock socket for local dockerd
+- Add --iptables=false to local dockerd
+- Disable bridge and ip6tables for local dockerd
+- Use host Docker when root dir is inaccessible (free=0)
+- Prefer /run/host-docker.sock over inner dockerd
+- Start local dockerd instead of using low-space inner dockerd
+- Use container overlay for local dockerd data root
+- Kill inner dockerd with SIGKILL, use alt socket if alive
+- Kill dockerd by PID when pkill fails, use /dev/shm for alive daemon
+- Trust /var/run/docker.sock with free=0 when no inner dockerd exists
 
-## [0.50.1] - 2026-08-12
+## [0.50.0] - 2026-08-09
 
-### Bug Fixes
+### Features
 
-- Configure git remote with CI token for post-merge push
+- Add 5 standalone lint scripts from infra
 
-## [0.50.0] - 2026-08-12
+## [0.49.0] - 2026-08-09
 
 ### Features
 
 - Sync missing features from v0.49.x line to master
-## [0.49.5] - 2026-08-07
 
-### Performance
-
-- Skip dep resolution in setup-image with --no-deps
-## [0.49.4] - 2026-08-07
+## [0.48.2] - 2026-08-09
 
 ### Bug Fixes
 
-- Add container.credentials for private registry auth
-## [0.49.3] - 2026-08-07
+- Remove dead translation keys and add missing one
+
+## [0.48.1] - 2026-08-08
 
 ### Bug Fixes
 
-- Retry ansible-galaxy collection install on transient timeouts
-## [0.49.2] - 2026-08-07
+- *(setup)* Extract version from filename for mirror installs
 
-### Bug Fixes
-
-- Add fallback URL for tea download
-## [0.49.1] - 2026-08-07
-
-### Bug Fixes
-
-- Add container images to build-images workflow
-## [0.49.0] - 2026-08-07
+## [0.48.0] - 2026-08-08
 
 ### Features
 
-- Add --include-roles and --exclude-roles to distribute_molecule
-## [0.48.0] - 2026-07-22
+- *(setup)* Mirror Ansible collections from Gitea registry with auth
 
-### Features
-
-- Extract reusable components from infra and grm into devx
-
-## [0.49.5] - 2026-08-07
-
-### Performance
-
-- Skip dep resolution in setup-image with --no-deps
-
-## [0.49.4] - 2026-08-07
+## [0.47.10] - 2026-08-05
 
 ### Bug Fixes
 
-- Add container.credentials for private registry auth
+- Unique molecule container names per CI runner
 
-## [0.49.3] - 2026-08-07
+## [0.47.9] - 2026-08-03
 
 ### Bug Fixes
 
-- Retry ansible-galaxy collection install on transient timeouts
+- Unique molecule container names per CI runner
 
-## [0.49.2] - 2026-08-07
+## [0.47.8] - 2026-08-03
 
 ### Bug Fixes
 
-- Add fallback URL for tea download
+- Increase CI_SCALE_FACTOR default from 4 to 6
 
-## [0.49.1] - 2026-08-07
+## [0.47.7] - 2026-08-03
 
 ### Bug Fixes
 
-- Add container images to build-images workflow
+- Scale check_test_speed limits on CI runners
 
-## [0.49.0] - 2026-08-07
+## [0.47.6] - 2026-08-03
 
-### Features
+### Bug Fixes
 
-- Add --include-roles and --exclude-roles to distribute_molecule
-## [0.48.0] - 2026-07-22
+- Configure git auth in setup_image for git+https deps
 
-### Features
+## [0.47.5] - 2026-08-03
 
-- Extract reusable components from infra and grm into devx
+### Bug Fixes
 
-## [0.48.0] - 2026-07-22
+- Push wiki to main branch instead of master
 
-### Features
+## [0.47.4] - 2026-08-03
 
-- Extract reusable components from infra and grm into devx
+### Bug Fixes
 
-## [Unreleased]
-
-### Features
-
-- Extract reusable components from infra and grm into devx:
-  - `devx.utils.ui.say()` — unified click.echo + logging output
-  - `devx.utils.api.APIClient` — base HTTP API client class with retry logic
-  - `devx.utils.jinja` — Jinja2 environment helpers with Ansible-compatible filters
-  - `devx.i18n.configure_i18n()` — configurable `lang_env_var` and `translations_path_env_var`
-  - `devx.ci.cancel_superseded_runs` — cancel in-flight CI runs for the same PR branch
-  - `devx.ci.check_workflow_artifact_deps` — verify artifact download jobs depend on upload jobs
-  - `devx.ci.check_workflow_tofu_init` — verify tofu-state jobs have a tofu-init step
-  - `devx.tools.check_docker_init` — check Docker Compose services with healthchecks have init: true
-  - `devx.tools.check_ansible_set_fact_to_json` — check set_fact tasks don't misuse to_json
-  - `devx.tools.check_alert_rules` — validate Prometheus alert rules with promtool
-- Add `jinja2` and `pyyaml` as core dependencies (previously in `deploy` extras only)
-- Register new CLI commands: `devx ci cancel-superseded-runs`, `devx ci check-workflow-artifact-deps`,
-  `devx ci check-workflow-tofu-init`, `devx tools check-docker-init`,
-  `devx tools check-ansible-set-fact-to-json`, `devx tools check-alert-rules`
-- Add Makefile targets for all new check tools
+- Add User-Agent header to _download in install_tools
 
 ## [0.47.3] - 2026-07-17
 

README.md

@@ -16,12 +16,12 @@ quality badges.
 
 [![CI](https://git.oblachno.oblachno.fyi/oblachno-oss/devx/actions/workflows/ci.yml/badge.svg)](https://git.oblachno.oblachno.fyi/oblachno-oss/devx/actions)
 [![License: GPL-3.0](https://img.shields.io/badge/license-GPL--3.0-blue)](https://git.oblachno.oblachno.fyi/oblachno-oss/devx/src/branch/master/LICENSE)
-[![Coverage](https://git.oblachno.oblachno.fyi/oblachno-oss/devx/raw/commit/86408e58c8e739016a968a190433a49908519c6d/coverage.svg)](https://git.oblachno.oblachno.fyi/oblachno-oss/devx/actions)
-[![Tests](https://git.oblachno.oblachno.fyi/oblachno-oss/devx/raw/commit/86408e58c8e739016a968a190433a49908519c6d/tests.svg)](https://git.oblachno.oblachno.fyi/oblachno-oss/devx/actions)
-[![Docs](https://git.oblachno.oblachno.fyi/oblachno-oss/devx/raw/commit/86408e58c8e739016a968a190433a49908519c6d/docs.svg)](https://git.oblachno.oblachno.fyi/oblachno-oss/devx/wiki)
-[![Code Quality](https://git.oblachno.oblachno.fyi/oblachno-oss/devx/raw/commit/86408e58c8e739016a968a190433a49908519c6d/quality.svg)](https://git.oblachno.oblachno.fyi/oblachno-oss/devx/actions)
-[![Version](https://git.oblachno.oblachno.fyi/oblachno-oss/devx/raw/commit/86408e58c8e739016a968a190433a49908519c6d/version.svg)](https://git.oblachno.oblachno.fyi/oblachno-oss/devx/releases)
-[![Python](https://git.oblachno.oblachno.fyi/oblachno-oss/devx/raw/commit/86408e58c8e739016a968a190433a49908519c6d/python.svg)](https://www.python.org/downloads/)
+[![Coverage](https://git.oblachno.oblachno.fyi/oblachno-oss/devx/raw/commit/a506e1130cab09747bb881e0fe98093e6bcd8110/coverage.svg)](https://git.oblachno.oblachno.fyi/oblachno-oss/devx/actions)
+[![Tests](https://git.oblachno.oblachno.fyi/oblachno-oss/devx/raw/commit/a506e1130cab09747bb881e0fe98093e6bcd8110/tests.svg)](https://git.oblachno.oblachno.fyi/oblachno-oss/devx/actions)
+[![Docs](https://git.oblachno.oblachno.fyi/oblachno-oss/devx/raw/commit/a506e1130cab09747bb881e0fe98093e6bcd8110/docs.svg)](https://git.oblachno.oblachno.fyi/oblachno-oss/devx/wiki)
+[![Code Quality](https://git.oblachno.oblachno.fyi/oblachno-oss/devx/raw/commit/a506e1130cab09747bb881e0fe98093e6bcd8110/quality.svg)](https://git.oblachno.oblachno.fyi/oblachno-oss/devx/actions)
+[![Version](https://git.oblachno.oblachno.fyi/oblachno-oss/devx/raw/commit/a506e1130cab09747bb881e0fe98093e6bcd8110/version.svg)](https://git.oblachno.oblachno.fyi/oblachno-oss/devx/releases)
+[![Python](https://git.oblachno.oblachno.fyi/oblachno-oss/devx/raw/commit/a506e1130cab09747bb881e0fe98093e6bcd8110/python.svg)](https://www.python.org/downloads/)
 
 ## Why devx?
 
@@ -87,7 +87,7 @@ extra index and list devx in your dependencies:
 ```toml
 [project]
 dependencies = [
-    "devx>=0.50.2",
+    "devx>=0.50.1",
 ]
 
 [tool.pip]
@@ -101,8 +101,8 @@ pip install -e .
 ```
 
 > **Note:** If your project requires a specific devx version, pin it in
-> `dependencies` (for example, `"devx==0.50.2"`) or use a version constraint
-> (for example, `"devx>=0.50.2,<0.51"`).
+> `dependencies` (for example, `"devx==0.50.1"`) or use a version constraint
+> (for example, `"devx>=0.50.1,<0.51"`).
 
 ### Optional extras
 

docs/decisions/0002-ansible-check-consolidation-and-wait-for-checks.md

@@ -1,108 +0,0 @@
-# ADR-0002: Ansible Check Tool Consolidation and wait_for_checks Extraction
-
-Date: 2026-08-12
-Status: Accepted
-
-## Context
-
-The devx package had two categories of code duplication and inline
-workflow logic that were hard to test and maintain:
-
-### 1. Ansible Check Tools — Duplicated Boilerplate
-
-Five Ansible check tools (`check_ansible_no_log`,
-`check_ansible_patterns`, `check_ansible_set_fact_to_json`,
-`check_ansible_no_state_absent_on_db`, `check_jinja_expr`) each
-implemented their own file discovery, YAML parsing, task iteration, and
-violation reporting logic. While the check logic differed, the
-supporting infrastructure was copy-pasted across all five modules:
-
-- `find_task_files()` — glob YAML files, skip molecule
-- YAML multi-document parsing with error handling
-- Task iteration (bare lists, play dicts with `tasks`/`pre_tasks`/`post_tasks`/`handlers`, nested `block` tasks)
-- Violation formatting (`path:line — message`)
-
-This made it difficult to add new checks (each new tool repeated the
-boilerplate) and risky to change shared behavior (fixes had to be
-applied to all five modules independently).
-
-### 2. Inline Job Polling in Workflow YAML
-
-The `grm` repository's `ci.yml` workflow contained ~25 lines of inline
-shell + Python polling logic to wait for the `molecule-tests` job to
-complete before the auto-merge step. This logic:
-
-- Was not testable (embedded in workflow YAML)
-- Duplicated the Gitea API client pattern already used elsewhere
-- Had no timeout handling, no error reporting, no retry logic
-- Could not be reused by other repositories
-
-### 3. Duplicate discover_runners Modules
-
-`devx.ci.discover_runners` and `devx.molecule.discover_runners` were
-near-identical modules. The `ci/` version had better error logging
-(warnings on non-200 responses, 403 suppression for instance-level
-queries), while the `molecule/` version silently swallowed errors.
-Both were imported by different workflows, making it unclear which was
-canonical.
-
-## Decision
-
-### 1. Composable `ansible_checks/` Subpackage
-
-Consolidate the five Ansible check tools into a
-`devx.tools.ansible_checks/` subpackage with shared utilities:
-
-- `_shared.py` — `AnsibleFileFinder`, `AnsibleYAMLParser`,
-  `ViolationReporter` classes providing composable helpers
-- `no_log.py`, `patterns.py`, `set_fact_to_json.py`,
-  `no_state_absent_on_db.py`, `jinja_expr.py` — canonical check
-  implementations using the shared utilities
-
-The old modules (`check_ansible_*.py`, `check_jinja_expr.py`) remain as
-**thin backward-compat wrappers** that re-export the canonical
-implementation and preserve the CLI entry point. This avoids breaking
-existing Makefile targets and workflow references.
-
-**Composition over inheritance**: each check module picks the helpers it
-needs. Tools that don't parse YAML (for example line-based scanners) can skip
-`AnsibleYAMLParser` entirely.
-
-### 2. Extracted `wait_for_checks` Module
-
-Extract the inline polling logic into `devx.ci.wait_for_checks`:
-
-- Polls the Gitea API for job completion status
-- Configurable job name prefix, timeout, poll interval
-- Exit codes: 0 (success), 1 (failure), 2 (timeout), 3 (API error)
-- `--require-success/--no-require-success` flag for flexibility
-- 100% test coverage with mocked API responses
-
-This replaces the inline shell polling in `grm` `ci.yml` with a
-reusable, testable Python module.
-
-### 3. Deprecated `ci/discover_runners` Wrapper
-
-Merge the `ci/discover_runners` implementation (with its better error
-logging) into `molecule/discover_runners` as the canonical version.
-Make `ci/discover_runners` a deprecated wrapper that:
-
-- Re-exports all public symbols from `molecule.discover_runners`
-- Emits a `DeprecationWarning` when run as `__main__`
-- Preserves backward compatibility for existing workflow references
-
-New code should import from `devx.molecule.discover_runners` directly.
-
-## Consequences
-
-- **New checks are easier to write**: import `_shared` helpers, implement
-  only the check-specific logic
-- **Shared behavior can be fixed in one place**: file discovery, YAML
-  parsing, violation formatting
-- **Workflow polling is testable**: `wait_for_checks` has 26 unit tests
-  covering success, failure, timeout, and API error scenarios
-- **Backward compatibility preserved**: all existing Makefile targets,
-  workflow references, and test imports continue to work via wrappers
-- **Migration path is gradual**: new code uses the subpackage; old code
-  can migrate at its own pace; wrappers can be removed in a future
-  release once all references are updated

docs/index.md

@@ -12,12 +12,12 @@ project to be reusable across all oblachno-oss repositories.
 
 [![CI](https://git.oblachno.oblachno.fyi/oblachno-oss/devx/actions/workflows/ci.yml/badge.svg)](https://git.oblachno.oblachno.fyi/oblachno-oss/devx/actions)
 [![License: GPL-3.0](https://img.shields.io/badge/license-GPL--3.0-blue)](https://git.oblachno.oblachno.fyi/oblachno-oss/devx/src/branch/master/LICENSE)
-[![Coverage](https://git.oblachno.oblachno.fyi/oblachno-oss/devx/raw/commit/86408e58c8e739016a968a190433a49908519c6d/coverage.svg)](https://git.oblachno.oblachno.fyi/oblachno-oss/devx/actions)
-[![Tests](https://git.oblachno.oblachno.fyi/oblachno-oss/devx/raw/commit/86408e58c8e739016a968a190433a49908519c6d/tests.svg)](https://git.oblachno.oblachno.fyi/oblachno-oss/devx/actions)
-[![Docs](https://git.oblachno.oblachno.fyi/oblachno-oss/devx/raw/commit/86408e58c8e739016a968a190433a49908519c6d/docs.svg)](https://git.oblachno.oblachno.fyi/oblachno-oss/devx/wiki)
-[![Code Quality](https://git.oblachno.oblachno.fyi/oblachno-oss/devx/raw/commit/86408e58c8e739016a968a190433a49908519c6d/quality.svg)](https://git.oblachno.oblachno.fyi/oblachno-oss/devx/actions)
-[![Version](https://git.oblachno.oblachno.fyi/oblachno-oss/devx/raw/commit/86408e58c8e739016a968a190433a49908519c6d/version.svg)](https://git.oblachno.oblachno.fyi/oblachno-oss/devx/releases)
-[![Python](https://git.oblachno.oblachno.fyi/oblachno-oss/devx/raw/commit/86408e58c8e739016a968a190433a49908519c6d/python.svg)](https://www.python.org/downloads/)
+[![Coverage](https://git.oblachno.oblachno.fyi/oblachno-oss/devx/raw/commit/a506e1130cab09747bb881e0fe98093e6bcd8110/coverage.svg)](https://git.oblachno.oblachno.fyi/oblachno-oss/devx/actions)
+[![Tests](https://git.oblachno.oblachno.fyi/oblachno-oss/devx/raw/commit/a506e1130cab09747bb881e0fe98093e6bcd8110/tests.svg)](https://git.oblachno.oblachno.fyi/oblachno-oss/devx/actions)
+[![Docs](https://git.oblachno.oblachno.fyi/oblachno-oss/devx/raw/commit/a506e1130cab09747bb881e0fe98093e6bcd8110/docs.svg)](https://git.oblachno.oblachno.fyi/oblachno-oss/devx/wiki)
+[![Code Quality](https://git.oblachno.oblachno.fyi/oblachno-oss/devx/raw/commit/a506e1130cab09747bb881e0fe98093e6bcd8110/quality.svg)](https://git.oblachno.oblachno.fyi/oblachno-oss/devx/actions)
+[![Version](https://git.oblachno.oblachno.fyi/oblachno-oss/devx/raw/commit/a506e1130cab09747bb881e0fe98093e6bcd8110/version.svg)](https://git.oblachno.oblachno.fyi/oblachno-oss/devx/releases)
+[![Python](https://git.oblachno.oblachno.fyi/oblachno-oss/devx/raw/commit/a506e1130cab09747bb881e0fe98093e6bcd8110/python.svg)](https://www.python.org/downloads/)
 
 ## Overview
 
@@ -74,14 +74,14 @@ Add devx to your `pyproject.toml` dependencies and configure the registry:
 ```toml
 [project]
 dependencies = [
-    "devx>=0.50.2",
+    "devx>=0.50.1",
 ]
 
 [tool.pip]
 extra-index-url = "https://git.oblachno.oblachno.fyi/api/packages/oblachno-oss/pypi/simple"
 ```
 
-Pin a specific version if needed: `"devx==0.50.2"` or `"devx>=0.50.2,<0.51"`.
+Pin a specific version if needed: `"devx==0.50.1"` or `"devx>=0.50.1,<0.51"`.
 
 ### Optional extras
 

docs/mapping.json

@@ -3,7 +3,5 @@
   "user/getting-started.md": "Getting-Started",
   "user/cli-commands.md": "CLI-Commands",
   "tech/architecture.md": "Architecture",
-  "tech/ci-cd-workflow.md": "CI-CD-Workflow",
-  "decisions/0001-test-isolation-pytest-plugin-and-shift-left-quality-gates.md": "ADR-0001-Test-Isolation",
-  "decisions/0002-ansible-check-consolidation-and-wait-for-checks.md": "ADR-0002-Ansible-Check-Consolidation"
+  "tech/ci-cd-workflow.md": "CI-CD-Workflow"
 }

docs/tech/architecture.md

@@ -33,8 +33,7 @@ src/devx/
 │   ├── notify_failure.py    # Create Gitea issues on CI failures
 │   ├── distribute_files.py  # Distribute files across parallel runners
 │   ├── integration_guard.py # Run pytest with cross-runner fail-fast
-│   ├── discover_runners.py  # Deprecated wrapper → molecule/discover_runners
-│   ├── wait_for_checks.py  # Poll Gitea Actions for job completion
+│   ├── discover_runners.py  # Dynamic Gitea runner discovery
 │   ├── check_translations.py  # Translation completeness check
 │   └── doc_coverage.py      # Documentation coverage check
 ├── tools/                   # Developer tooling modules (run locally or by CI)
@@ -49,9 +48,8 @@ src/devx/
 │   └── install_checkmake.py # Install checkmake (Makefile linter)
 └── molecule/                # Optional molecule testing helpers (Ansible projects)
     ├── __init__.py
-    ├── discover_runners.py      # Dynamic Gitea runner discovery (canonical)
+    ├── discover_runners.py      # Dynamic Gitea runner discovery
     ├── distribute_molecule.py   # Distribute scenarios across runners
-    ├── molecule_ci_guard.py     # Run molecule with cross-runner fail-fast
     ├── molecule_all.py          # Run all molecule scenarios locally
     ├── start_docker.py          # Ensure Docker is available for molecule
     └── platforms.py             # Supported molecule platforms
@@ -286,24 +284,13 @@ Click commands from `cli.py` and verifies each has documentation in
 `architecture.md` and CI scripts in `ci-cd-workflow.md`. Supports
 `--fail-on-missing` to enforce 100% coverage.
 
-### `discover_runners.py` (deprecated wrapper)
-
-> **Deprecated:** Use `devx.molecule.discover_runners` instead. This
-> module is a thin wrapper that re-exports the canonical implementation.
+### `discover_runners.py`
 
 Discovers available Gitea Actions runners at three levels: repository,
 organization, and instance (administrator). Falls back to the `MOLECULE_RUNNERS` repo
 variable or `DEFAULT_MAX_RUNNERS` (3). Outputs runner count or a JSON index
 array for use as a dynamic matrix in Gitea Actions.
 
-### `wait_for_checks.py`
-
-Polls the Gitea Actions API for job completion status. Used by auto-merge
-jobs that need to wait for parallel jobs (for example molecule-tests) before
-proceeding. Replaces inline shell polling in workflow YAML with a
-reusable, testable Python module. Exit codes: 0 (success), 1 (job
-failure), 2 (timeout), 3 (API error or no matching jobs).
-
 ### `distribute_files.py`
 
 Distributes files matching a glob pattern across N parallel runners
@@ -312,9 +299,9 @@ Distributes files matching a glob pattern across N parallel runners
 
 ### `integration_guard.py`
 
-Runs pytest with the same cross-runner failure detection mechanism used by
-`molecule_ci_guard`. If any other integration-tests matrix runner reports
-failure, the current pytest subprocess is killed and this runner exits early.
+Runs pytest with cross-runner failure detection. A background thread polls
+the Gitea API. If any other integration-tests matrix runner reports failure,
+the current pytest subprocess is killed and this runner exits early.
 
 ## Developer tools (`devx.tools`)
 
@@ -394,13 +381,6 @@ the supported OS platform matrix. Supports `--roles-root` for multi-role
 repositories, `--list` to list scenarios, and `--list-platforms` to list
 platforms.
 
-### `molecule_ci_guard.py`
-
-Runs molecule tests sequentially while polling the Gitea API for other runner
-failures. If any other molecule matrix runner reports failure, the current
-molecule subprocess is killed and this runner exits early. Supports both
-single-role (4-part) and multi-role (5-part) pair encoding.
-
 ### `molecule_all.py`
 
 Runs all molecule scenarios on all supported OS platforms sequentially.
@@ -408,13 +388,8 @@ Intended for local development; CI uses the parallel matrix instead.
 
 ### `molecule/discover_runners.py`
 
-Discovers available Gitea Actions runners for molecule tests. This is the
-canonical implementation; `devx.ci.discover_runners` is a deprecated wrapper
-that re-exports from this module. Queries runners at repository,
-organization, and instance (administrator) levels, with warnings logged
-to stderr on non-200 responses (except 403 on instance-level, which is
-expected without admin scope). Falls back to `MOLECULE_RUNNERS` env var
-or `DEFAULT_MAX_RUNNERS` (3).
+Discovers available Gitea Actions runners for molecule tests. Same logic as
+`devx.ci.discover_runners` but intended for molecule-specific workflows.
 
 ### `start_docker.py`
 

docs/tech/ci-cd-workflow.md

@@ -478,15 +478,6 @@ python -m devx.molecule.distribute_molecule --list
 python -m devx.molecule.distribute_molecule --list-platforms
 ```
 
-### `molecule_ci_guard.py`
-
-Runs molecule tests sequentially while polling the Gitea API for other runner
-failures. Aborts early if another runner fails the same job.
-
-```bash
-python -m devx.molecule.molecule_ci_guard [--roles-root <dir>] pair1 pair2 ...
-```
-
 ### `validate_commit_msg.py`
 
 Validates commit messages. On feature branches: conventional commits only

docs/user/cli-commands.md

@@ -83,11 +83,6 @@ devx ci detect-release-commit
 
 ### `devx ci discover-runners`
 
-> **Deprecated:** Use `devx molecule discover-runners` instead. This
-> command is a thin wrapper that re-exports the canonical implementation
-> from `devx.molecule.discover_runners`. It will be removed in a future
-> release.
-
 Discover available Gitea Actions runners for dynamic job distribution.
 Queries the Gitea API for registered runners at repository, organization, and
 instance (administrator) levels. Falls back to `MOLECULE_RUNNERS` repo variable or
@@ -320,32 +315,6 @@ devx ci validate-commit-msg commit-msg.txt --branch master
 Options:
 - `--branch <branch>` — override branch detection (for CI use)
 
-### `devx ci wait-for-checks`
-
-Wait for Gitea Actions jobs to complete by polling the API. Used by
-auto-merge jobs that need to wait for parallel jobs (for example molecule-tests)
-before proceeding. Replaces inline shell polling in workflow YAML with
-a reusable, testable Python module.
-
-Exit codes:
-- `0` — all matching jobs completed successfully
-- `1` — one or more matching jobs failed (when `--require-success` is set)
-- `2` — timeout reached before all jobs completed
-- `3` — API error or no matching jobs found
-
-```bash
-devx ci wait-for-checks --job-name molecule-tests --repo oblachno-oss/grm
-devx ci wait-for-checks --job-name molecule-tests --timeout 1200 --poll-interval 10
-devx ci wait-for-checks --job-name molecule-tests --no-require-success
-```
-
-Options:
-- `--job-name <prefix>` — job name prefix to match (required)
-- `--repo <owner/name>` — repository (default: `$GITHUB_REPOSITORY`)
-- `--timeout <seconds>` — max wait time (default: 1200 = 20 min)
-- `--poll-interval <seconds>` — seconds between polls (default: 10)
-- `--require-success / --no-require-success` — exit 1 if a job failed (default: yes)
-
 ### `devx ci cancel-superseded-runs`
 
 Cancel in-flight CI runs for the same PR branch when a new push triggers
@@ -662,29 +631,3 @@ Options:
 - `--list-platforms` — list all platforms, one per line
 - `--roles-root <dir>` — roles root directory for multi-role repos (default:
   `ansible/roles`)
-
-### `devx molecule guard`
-
-Run molecule tests sequentially with CI failure polling. A background thread
-polls the Gitea API. If any other molecule matrix runner reports failure, the
-current molecule subprocess is killed and this runner exits early with code 1.
-
-```bash
-devx molecule guard pair1 pair2 pair3
-devx molecule guard --roles-root ansible/roles pair1 pair2
-```
-
-Each pair is encoded as:
-- **Single-role (4-part):** `scenario|platform_name|platform_image|platform_command`
-- **Multi-role (5-part):** `role|scenario|platform_name|platform_image|platform_command`
-
-Options:
-- `--roles-root <dir>` — roles root directory for multi-role repos
-
-Environment variables:
-- `GITEA_URL` — base URL of the Gitea instance
-- `CI_GITEA_TOKEN` — API token with repo access
-- `RUN_ID` — workflow run ID (`GITHUB_RUN_ID`)
-- `JOB_NAME` — base job name (`GITHUB_JOB`)
-- `MATRIX_INDEX` — current matrix index (runner-index)
-- `GITEA_REPOSITORY` — repository in `owner/repo` format

docs/user/getting-started.md

@@ -48,12 +48,12 @@ Add devx to your `pyproject.toml`:
 ```toml
 [project]
 dependencies = [
-    "devx>=0.50.2",
+    "devx>=0.50.1",
 ]
 
 [project.optional-dependencies]
 dev = [
-    "devx>=0.50.2",
+    "devx>=0.50.1",
 ]
 ```
 

src/devx/__init__.py

@@ -1,3 +1,3 @@
 """devx — reusable development and CI/CD tools for oblachno-oss projects."""
 
-__version__ = "0.50.2"
+__version__ = "0.50.1"

src/devx/ci/discover_runners.py

@@ -1,18 +1,19 @@
 #!/usr/bin/env python3
 """Discover available Gitea Actions runners for dynamic job distribution.
 
-.. deprecated:: Phase 1c
-    Use :mod:`devx.molecule.discover_runners` instead. This module is a
-    thin wrapper that re-exports the canonical implementation from
-    :mod:`devx.molecule.discover_runners` for backward compatibility
-    with existing workflow references and Makefile targets.
+Queries the Gitea API for registered runners at three levels:
+  1. Repository level: GET /repos/{owner}/{repo}/actions/runners
+  2. Organization level: GET /orgs/{org}/actions/runners
+  3. Instance (admin) level: GET /admin/actions/runners
 
-    The canonical implementation lives in
-    :mod:`devx.molecule.discover_runners` because runner discovery is
-    primarily used by the molecule test distribution pipeline. CI
-    workflows that still reference ``python -m devx.ci.discover_runners``
-    will continue to work via this wrapper, but new code should import
-    from :mod:`devx.molecule.discover_runners` directly.
+Falls back to the ``MOLECULE_RUNNERS`` repo variable or environment
+variable, then to ``DEFAULT_MAX_RUNNERS`` (3).
+
+Outputs:
+  - ``--count``: prints the number of available runners
+  - ``--indices``: prints a JSON array [0, 1, ..., N-1] for use as a
+    dynamic matrix in Gitea Actions
+  - (default): prints both as ``count=N`` and ``indices=[0,1,...]``
 
 Usage:
   python3 -m devx.ci.discover_runners --owner oblachno-oss --repo devx
@@ -22,28 +23,172 @@ Usage:
 
 from __future__ import annotations
 
-import sys
-import warnings
+import json
+import os
 
-from devx.molecule.discover_runners import (  # noqa: F401 — re-exported for backward compat
-    DEFAULT_MAX_RUNNERS,
-    generate_indices,
-    get_runner_count,
-    main,
-    query_runners,
+import click
+import requests
+
+from devx.config import GITEA_API_URL, REPO_NAME, REPO_OWNER
+from devx.i18n import _
+from devx.tokens import get_ci_token
+
+DEFAULT_MAX_RUNNERS = 3
+
+
+def query_runners(api_url: str, token: str, owner: str, repo: str) -> int:
+    """Query the Gitea API for registered runners at all levels.
+
+    Returns the total count of active runners.  If the API call fails
+    (e.g., no admin access for instance-level runners), falls back to
+    what we can see.  Fallbacks are logged to stderr for debugging.
+    """
+    headers = {"Authorization": f"token {token}"}
+    total = 0
+
+    # 1. Repository-level runners
+    try:
+        r = requests.get(
+            f"{api_url}/repos/{owner}/{repo}/actions/runners",
+            headers=headers,
+            timeout=10,
+        )
+        if r.status_code == 200:
+            data = r.json()
+            total += data.get("total_count", 0)
+        else:
+            click.echo(_("Warning: repo-level runners query returned HTTP {status}", status=r.status_code), err=True)
+    except (requests.RequestException, ValueError) as e:
+        click.echo(_("Warning: repo-level runners query failed: {error}", error=e), err=True)
+
+    # 2. Organization-level runners
+    try:
+        r = requests.get(
+            f"{api_url}/orgs/{owner}/actions/runners",
+            headers=headers,
+            timeout=10,
+        )
+        if r.status_code == 200:
+            data = r.json()
+            total += data.get("total_count", 0)
+        else:
+            click.echo(_("Warning: org-level runners query returned HTTP {status}", status=r.status_code), err=True)
+    except (requests.RequestException, ValueError) as e:
+        click.echo(_("Warning: org-level runners query failed: {error}", error=e), err=True)
+
+    # 3. Instance-level runners (requires admin scope)
+    try:
+        r = requests.get(
+            f"{api_url}/admin/actions/runners",
+            headers=headers,
+            timeout=10,
+        )
+        if r.status_code == 200:
+            data = r.json()
+            total += data.get("total_count", 0)
+        elif r.status_code != 403:  # 403 is expected without admin scope
+            click.echo(
+                _("Warning: instance-level runners query returned HTTP {status}", status=r.status_code),
+                err=True,
+            )
+    except (requests.RequestException, ValueError) as e:
+        click.echo(_("Warning: instance-level runners query failed: {error}", error=e), err=True)
+
+    return total
+
+
+def get_runner_count(api_url: str, token: str | None, owner: str, repo: str) -> int:
+    """Determine the number of available runners.
+
+    Tries the Gitea API first, then falls back to env vars, then default.
+    """
+    # Try API query if we have a token
+    if token:
+        api_count = query_runners(api_url, token, owner, repo)
+        if api_count > 0:
+            return api_count
+
+    # Fall back to MOLECULE_RUNNERS env var (set by CI from repo variable)
+    env_count = os.environ.get("MOLECULE_RUNNERS")
+    if env_count:
+        try:
+            count = int(env_count)
+            if count > 0:
+                return count
+        except ValueError:
+            pass
+
+    # Fall back to default
+    return DEFAULT_MAX_RUNNERS
+
+
+def generate_indices(count: int) -> list[str]:
+    """Generate a list of runner indices ["1", "2", ..., "N"].
+
+    Uses 1-based string indices because Gitea Actions renders
+    integer 0 and string "0" as empty in ${{ matrix.runner-index }}
+    expressions, causing --runner-index to be passed without a value.
+    The distribute_molecule.py script converts these back to 0-based
+    internally.
+    """
+    return [str(i + 1) for i in range(count)]
+
+
+@click.command()
+@click.option("--owner", default=None, help="Repository owner (for API query).")
+@click.option("--repo", default=None, help="Repository name (for API query).")
+@click.option("--count", "output_count", is_flag=True, help="Output only the count.")
+@click.option("--indices", "output_indices", is_flag=True, help="Output only the JSON indices array.")
+@click.option(
+    "--github-output",
+    "github_output",
+    is_flag=True,
+    default=False,
+    help="Write results to $GITHUB_OUTPUT file (for CI workflow steps).",
 )
+def main(
+    owner: str | None,
+    repo: str | None,
+    output_count: bool,
+    output_indices: bool,
+    github_output: bool,
+) -> None:
+    try:
+        token = get_ci_token()
+    except click.ClickException:
+        token = None
 
-_DEPRECATION_MSG = (
-    "devx.ci.discover_runners is deprecated; use devx.molecule.discover_runners instead. "
-    "This wrapper will be removed in a future release."
-)
+    if owner is None:
+        owner = os.environ.get("DEVX_REPO_OWNER", "") or REPO_OWNER
+    if repo is None:
+        repo = os.environ.get("DEVX_REPO_NAME", "") or REPO_NAME
 
+    count = get_runner_count(GITEA_API_URL, token, owner, repo)
+    indices = generate_indices(count)
 
-def _emit_deprecation_warning() -> None:
-    """Emit a DeprecationWarning when this module is imported for CLI use."""
-    warnings.warn(_DEPRECATION_MSG, DeprecationWarning, stacklevel=2)
+    if github_output:
+        gh_output = os.environ.get("GITHUB_OUTPUT")
+        if not gh_output:
+            raise click.ClickException("GITHUB_OUTPUT environment variable is not set")
+        with open(gh_output, "a", encoding="utf-8") as f:  # noqa: PTH123
+            f.write(f"runner-count={count}\n")
+            f.write(f"runner-indices={json.dumps(indices)}\n")
+        click.echo(_("Runner count: {count}", count=count))
+        click.echo(_("Runner indices: {indices}", indices=indices))
+        return
+
+    if output_count:
+        click.echo(str(count))
+        return
+
+    if output_indices:
+        click.echo(json.dumps(indices))
+        return
+
+    # Default: output both as key=value pairs for CI consumption
+    click.echo(_("count={count}", count=count))
+    click.echo(_("indices={indices}", indices=json.dumps(indices)))
 
 
 if __name__ == "__main__":  # pragma: no cover
-    _emit_deprecation_warning()
-    sys.exit(main())
+    main()

src/devx/ci/doc_coverage.py

@@ -52,7 +52,6 @@ REQUIRED_SCRIPTS = [
     "detect_release_commit.py",
     "push_badges.py",
     "distribute_molecule.py",
-    "molecule_ci_guard.py",
     "validate_commit_msg.py",
 ]
 

src/devx/ci/integration_guard.py

@@ -1,10 +1,9 @@
 #!/usr/bin/env python3
 """Run integration tests with cross-runner failure detection.
 
-Wraps ``pytest`` with the same Gitea API polling mechanism used by
-``molecule_ci_guard``. If any other integration-tests matrix runner
-reports failure, the current pytest subprocess is killed and this runner
-exits early with code 1.
+Wraps ``pytest`` with Gitea API polling. If any other integration-tests
+matrix runner reports failure, the current pytest subprocess is killed
+and this runner exits early with code 1.
 
 Usage::
 
@@ -35,17 +34,62 @@ import threading
 import time
 
 import click
+import requests
 
 from devx.config import REPO_NAME, REPO_OWNER
 from devx.i18n import _
-from devx.molecule.molecule_ci_guard import (
-    poll_for_other_failures,
-)
 from devx.tokens import get_ci_token
 
 POLL_INTERVAL = 10
 
 
+def get_running_jobs(gitea_url: str, owner: str, repo: str, token: str, run_id: int) -> list[dict]:
+    """Return jobs for the given workflow run."""
+    url = f"{gitea_url}/api/v1/repos/{owner}/{repo}/actions/runs/{run_id}/jobs"
+    headers = {"Authorization": f"token {token}"}
+    response = requests.get(url, headers=headers, timeout=30)
+    response.raise_for_status()
+    data = response.json()
+    return data.get("jobs", [])
+
+
+def any_other_runner_failed(jobs: list[dict], current_job_name: str, current_index: int) -> bool:
+    """Return True if any other matrix job has failed."""
+    for job in jobs:
+        name = job.get("name", "")
+        if not name.startswith(current_job_name):
+            continue
+        if name == f"{current_job_name} ({current_index})" or name == current_job_name:
+            continue
+        if job.get("conclusion") == "failure":
+            return True
+    return False
+
+
+def poll_for_other_failures(
+    gitea_url: str,
+    owner: str,
+    repo: str,
+    token: str,
+    run_id: int,
+    job_name: str,
+    current_index: int,
+    stop_event: threading.Event,
+    failed_event: threading.Event,
+) -> None:
+    """Background thread: poll API and signal if another runner fails."""
+    while not stop_event.is_set():
+        try:
+            jobs = get_running_jobs(gitea_url, owner, repo, token, run_id)
+            if any_other_runner_failed(jobs, job_name, current_index):
+                click.echo(_("Another runner failed. Stopping this runner early."))
+                failed_event.set()
+                return
+        except requests.RequestException as exc:
+            click.echo(_("API poll warning: {exc}", exc=exc))
+        stop_event.wait(POLL_INTERVAL)
+
+
 @click.command(context_settings={"ignore_unknown_options": True})
 @click.argument("pytest_args", nargs=-1, type=click.UNPROCESSED, required=True)
 def cli(pytest_args: tuple[str, ...]) -> None:

src/devx/ci/sync_wiki.py

@@ -252,7 +252,7 @@ def commit_and_push(wiki_dir: Path, wiki_url: str, dry_run: bool) -> bool:
 
     # Push
     result = subprocess.run(  # nosec
-        ["git", "push", "--force", wiki_url, "HEAD:master"],
+        ["git", "push", "--force", wiki_url, "HEAD:main"],
         cwd=wiki_dir,
         capture_output=True,
         text=True,

src/devx/ci/wait_for_checks.py

@@ -1,209 +0,0 @@
-#!/usr/bin/env python3
-"""Wait for Gitea Actions jobs to complete.
-
-Polls the Gitea API for job completion status. Used by auto-merge
-jobs that need to wait for molecule-tests or other parallel jobs
-before proceeding.
-
-Exits:
-  0 — all matching jobs completed successfully
-  1 — one or more matching jobs failed
-  2 — timeout reached before all jobs completed
-  3 — API error or job not found
-
-Usage:
-  python3 -m devx.ci.wait_for_checks \\
-    --job-name molecule-tests \\
-    --repo oblachno-oss/grm \\
-    --timeout 1200 \\
-    --poll-interval 10
-"""
-
-from __future__ import annotations
-
-import os
-import sys
-import time
-
-import click
-import requests
-
-from devx.config import GITEA_API_URL
-from devx.i18n import _
-from devx.tokens import get_ci_token
-
-
-def query_job_status(api_url: str, token: str, repo: str, job_name_prefix: str) -> list[dict]:
-    """Query the Gitea API for the status of jobs matching *job_name_prefix*.
-
-    Fetches the most recent pull_request runs (up to 3) and inspects
-    their jobs. Returns a list of ``{"name": str, "status": str,
-    "conclusion": str | None}`` dicts for jobs whose name starts with
-    *job_name_prefix*. On API errors, logs a warning to stderr and
-    returns an empty list — callers treat this as "no information yet"
-    and retry on the next poll.
-    """
-    headers = {"Authorization": f"token {token}"}
-    matches: list[dict] = []
-    try:
-        r = requests.get(
-            f"{api_url}/repos/{repo}/actions/runs",
-            headers=headers,
-            params={"limit": 5, "event": "pull_request"},
-            timeout=10,
-        )
-        if r.status_code != 200:
-            click.echo(
-                _("Warning: actions runs query returned HTTP {status}", status=r.status_code),
-                err=True,
-            )
-            return []
-        runs = r.json()
-        if isinstance(runs, dict):
-            runs = runs.get("runs", [])
-    except (requests.RequestException, ValueError) as e:
-        click.echo(_("Warning: actions runs query failed: {error}", error=e), err=True)
-        return []
-
-    for run in runs[:3]:
-        run_id = run.get("id")
-        if run_id is None:
-            continue
-        try:
-            jr = requests.get(
-                f"{api_url}/repos/{repo}/actions/runs/{run_id}/jobs",
-                headers=headers,
-                timeout=10,
-            )
-            if jr.status_code != 200:
-                click.echo(
-                    _(
-                        "Warning: jobs query for run {run_id} returned HTTP {status}",
-                        run_id=run_id,
-                        status=jr.status_code,
-                    ),
-                    err=True,
-                )
-                continue
-            jobs = jr.json()
-            if isinstance(jobs, dict):
-                jobs = jobs.get("jobs", [])
-        except (requests.RequestException, ValueError) as e:
-            click.echo(
-                _("Warning: jobs query for run {run_id} failed: {error}", run_id=run_id, error=e),
-                err=True,
-            )
-            continue
-        for job in jobs:
-            name = job.get("name", "")
-            if name.startswith(job_name_prefix):
-                matches.append(
-                    {
-                        "name": name,
-                        "status": job.get("status", "unknown"),
-                        "conclusion": job.get("conclusion"),
-                    }
-                )
-    return matches
-
-
-def poll_until_complete(
-    api_url: str,
-    token: str,
-    repo: str,
-    job_name: str,
-    timeout: int,
-    interval: int,
-    require_success: bool = True,
-) -> int:
-    """Poll *query_job_status* until all matching jobs complete or *timeout*.
-
-    Returns:
-      0 — all matching jobs completed successfully (or any completed, when
-          *require_success* is False)
-      1 — at least one matching job completed with a non-success conclusion
-          (only when *require_success* is True)
-      2 — *timeout* reached before all matching jobs completed
-      3 — no matching jobs found at all within *timeout*
-    """
-    deadline = time.monotonic() + timeout
-    found_any = False
-
-    while time.monotonic() < deadline:
-        jobs = query_job_status(api_url, token, repo, job_name)
-        if jobs:
-            found_any = True
-            all_completed = all(j["status"] == "completed" for j in jobs)
-            if all_completed:
-                if require_success and any(j["conclusion"] != "success" for j in jobs):
-                    click.echo(
-                        _("Job(s) completed with non-success conclusion: {jobs}", jobs=jobs),
-                        err=True,
-                    )
-                    return 1
-                click.echo(_("All matching jobs completed successfully: {jobs}", jobs=jobs))
-                return 0
-        # Not all completed (or no jobs yet) — sleep and retry.
-        time.sleep(min(interval, max(0, deadline - time.monotonic())))
-
-    if not found_any:
-        click.echo(_("No matching jobs found for prefix '{prefix}' within timeout.", prefix=job_name), err=True)
-        return 3
-    click.echo(_("Timeout reached waiting for jobs matching '{prefix}'.", prefix=job_name), err=True)
-    return 2
-
-
-@click.command()
-@click.option("--job-name", required=True, help="Job name prefix to match (e.g. 'molecule-tests').")
-@click.option(
-    "--repo",
-    default=None,
-    help="Repository as owner/name (default: $GITHUB_REPOSITORY env var).",
-)
-@click.option("--timeout", type=int, default=1200, help="Max seconds to wait (default: 1200 = 20 min).")
-@click.option("--poll-interval", "interval", type=int, default=10, help="Seconds between polls (default: 10).")
-@click.option(
-    "--require-success/--no-require-success",
-    default=True,
-    help="Exit 1 if a matched job failed (default: yes).",
-)
-def main(job_name: str, repo: str | None, timeout: int, interval: int, require_success: bool) -> None:
-    """Wait for Gitea Actions jobs matching --job-name to complete."""
-    if repo is None:
-        repo = os.environ.get("GITHUB_REPOSITORY", "")
-    if not repo or "/" not in repo:
-        raise click.ClickException(_("--repo is required (or set GITHUB_REPOSITORY=owner/name)"))
-    if timeout <= 0:
-        raise click.ClickException(_("--timeout must be positive"))
-    if interval <= 0:
-        raise click.ClickException(_("--poll-interval must be positive"))
-
-    try:
-        token = get_ci_token()
-    except click.ClickException as e:
-        click.echo(str(e), err=True)
-        sys.exit(3)
-
-    click.echo(
-        _(
-            "Waiting for jobs matching '{prefix}' in {repo} (timeout={timeout}s, interval={interval}s)",
-            prefix=job_name,
-            repo=repo,
-            timeout=timeout,
-            interval=interval,
-        )
-    )
-    code = poll_until_complete(
-        GITEA_API_URL,
-        token,
-        repo,
-        job_name,
-        timeout,
-        interval,
-        require_success=require_success,
-    )
-    sys.exit(code)
-
-
-if __name__ == "__main__":  # pragma: no cover
-    main()

src/devx/cli.py

@@ -158,13 +158,6 @@ def ci_validate_commit_msg(args: tuple[str, ...]) -> None:
     _run_module("devx.ci.validate_commit_msg", list(args))
 
 
-@ci.command("wait-for-checks")
-@click.argument("args", nargs=-1)
-def ci_wait_for_checks(args: tuple[str, ...]) -> None:
-    """Wait for Gitea Actions jobs to complete (polls API)."""
-    _run_module("devx.ci.wait_for_checks", list(args))
-
-
 @ci.command("distribute-files")
 @click.argument("args", nargs=-1)
 def ci_distribute_files(args: tuple[str, ...]) -> None:
@@ -308,13 +301,6 @@ def molecule_discover_runners(args: tuple[str, ...]) -> None:
     _run_module("devx.molecule.discover_runners", list(args))
 
 
-@molecule.command("guard")
-@click.argument("args", nargs=-1)
-def molecule_guard(args: tuple[str, ...]) -> None:
-    """Run molecule tests sequentially with CI failure polling."""
-    _run_module("devx.molecule.molecule_ci_guard", list(args))
-
-
 @molecule.command("all")
 @click.argument("args", nargs=-1)
 def molecule_all(args: tuple[str, ...]) -> None:

src/devx/molecule/discover_runners.py

@@ -30,7 +30,6 @@ import click
 import requests
 
 from devx.config import GITEA_API_URL, REPO_NAME, REPO_OWNER
-from devx.i18n import _
 from devx.tokens import get_ci_token
 
 DEFAULT_MAX_RUNNERS = 3
@@ -41,7 +40,7 @@ def query_runners(api_url: str, token: str, owner: str, repo: str) -> int:
 
     Returns the total count of active runners.  If the API call fails
     (e.g., no admin access for instance-level runners), falls back to
-    what we can see.  Fallbacks are logged to stderr for debugging.
+    what we can see.
     """
     headers = {"Authorization": f"token {token}"}
     total = 0
@@ -56,10 +55,8 @@ def query_runners(api_url: str, token: str, owner: str, repo: str) -> int:
         if r.status_code == 200:
             data = r.json()
             total += data.get("total_count", 0)
-        else:
-            click.echo(_("Warning: repo-level runners query returned HTTP {status}", status=r.status_code), err=True)
-    except (requests.RequestException, ValueError) as e:
-        click.echo(_("Warning: repo-level runners query failed: {error}", error=e), err=True)
+    except (requests.RequestException, ValueError):
+        pass
 
     # 2. Organization-level runners
     try:
@@ -71,10 +68,8 @@ def query_runners(api_url: str, token: str, owner: str, repo: str) -> int:
         if r.status_code == 200:
             data = r.json()
             total += data.get("total_count", 0)
-        else:
-            click.echo(_("Warning: org-level runners query returned HTTP {status}", status=r.status_code), err=True)
-    except (requests.RequestException, ValueError) as e:
-        click.echo(_("Warning: org-level runners query failed: {error}", error=e), err=True)
+    except (requests.RequestException, ValueError):
+        pass
 
     # 3. Instance-level runners (requires admin scope)
     try:
@@ -86,13 +81,8 @@ def query_runners(api_url: str, token: str, owner: str, repo: str) -> int:
         if r.status_code == 200:
             data = r.json()
             total += data.get("total_count", 0)
-        elif r.status_code != 403:  # 403 is expected without admin scope
-            click.echo(
-                _("Warning: instance-level runners query returned HTTP {status}", status=r.status_code),
-                err=True,
-            )
-    except (requests.RequestException, ValueError) as e:
-        click.echo(_("Warning: instance-level runners query failed: {error}", error=e), err=True)
+    except (requests.RequestException, ValueError):
+        pass
 
     return total
 
@@ -173,8 +163,8 @@ def main(
         with open(gh_output, "a", encoding="utf-8") as f:  # noqa: PTH123
             f.write(f"runner-count={count}\n")
             f.write(f"runner-indices={json.dumps(indices)}\n")
-        click.echo(_("Runner count: {count}", count=count))
-        click.echo(_("Runner indices: {indices}", indices=indices))
+        click.echo(f"Runner count: {count}")
+        click.echo(f"Runner indices: {indices}")
         return
 
     if output_count:
@@ -186,8 +176,8 @@ def main(
         return
 
     # Default: output both as key=value pairs for CI consumption
-    click.echo(_("count={count}", count=count))
-    click.echo(_("indices={indices}", indices=json.dumps(indices)))
+    click.echo(f"count={count}")
+    click.echo(f"indices={json.dumps(indices)}")
 
 
 if __name__ == "__main__":  # pragma: no cover

src/devx/molecule/molecule_ci_guard.py

@@ -1,328 +0,0 @@
-#!/usr/bin/env python3
-"""Run molecule tests sequentially while polling Gitea for other runner failures.
-
-Each pair is encoded as one of:
-
-- **Single-role (4-part):** ``scenario|platform_name|platform_image|platform_command``
-- **Multi-role (5-part):** ``role|scenario|platform_name|platform_image|platform_command``
-
-Pairs are executed one at a time (molecule scenarios share temp directories and
-Docker networks, so parallel execution within a single runner is unsafe).
-
-A background thread polls the Gitea API. If any other molecule matrix runner
-reports failure, the current molecule subprocess is killed and this runner
-exits early with code 1.
-
-Usage::
-
-    # Single-role
-    python3 -m devx.molecule.molecule_ci_guard pair1 pair2 ...
-    # Multi-role
-    python3 -m devx.molecule.molecule_ci_guard --roles-root ansible/roles pair1 pair2 ...
-
-Environment variables:
-    GITEA_URL           Base URL of the Gitea instance.
-    CI_GITEA_API_TOKEN  API token with repo access (CI_GITEA_TOKEN accepted for legacy).
-    RUN_ID              Workflow run ID (GITHUB_RUN_ID).
-    JOB_NAME            Base job name (GITHUB_JOB), e.g. "molecule-tests".
-    MATRIX_INDEX        Current matrix index (runner-index).
-    GITEA_REPOSITORY    Repository in "owner/repo" format.
-"""
-
-from __future__ import annotations
-
-import contextlib
-import os
-import signal
-import subprocess  # nosec B404
-import sys
-import threading
-import time
-from pathlib import Path
-
-import click
-import requests
-
-from devx.config import REPO_NAME, REPO_OWNER
-from devx.i18n import _
-from devx.tokens import get_ci_token
-
-POLL_INTERVAL = 10
-
-
-def get_running_jobs(gitea_url: str, owner: str, repo: str, token: str, run_id: int) -> list[dict]:
-    """Return jobs for the given workflow run."""
-    url = f"{gitea_url}/api/v1/repos/{owner}/{repo}/actions/runs/{run_id}/jobs"
-    headers = {"Authorization": f"token {token}"}
-    response = requests.get(url, headers=headers, timeout=30)
-    response.raise_for_status()
-    data = response.json()
-    return data.get("jobs", [])
-
-
-def any_other_runner_failed(jobs: list[dict], current_job_name: str, current_index: int) -> bool:
-    """Return True if any other molecule matrix job has failed."""
-    for job in jobs:
-        name = job.get("name", "")
-        if not name.startswith(current_job_name):
-            continue
-        if name == f"{current_job_name} ({current_index})" or name == current_job_name:
-            continue
-        if job.get("conclusion") == "failure":
-            return True
-    return False
-
-
-def poll_for_other_failures(
-    gitea_url: str,
-    owner: str,
-    repo: str,
-    token: str,
-    run_id: int,
-    job_name: str,
-    current_index: int,
-    stop_event: threading.Event,
-    failed_event: threading.Event,
-) -> None:
-    """Background thread: poll API and signal if another runner fails."""
-    while not stop_event.is_set():
-        try:
-            jobs = get_running_jobs(gitea_url, owner, repo, token, run_id)
-            if any_other_runner_failed(jobs, job_name, current_index):
-                click.echo(_("Another molecule runner failed. Stopping this runner early."))
-                failed_event.set()
-                return
-        except requests.RequestException as exc:
-            click.echo(_("API poll warning: {exc}", exc=exc))
-        stop_event.wait(POLL_INTERVAL)
-
-
-def build_molecule_cmd(scenario: str) -> list[str]:
-    """Build the molecule command for a scenario."""
-    cmd = ["molecule", "test"]
-    if scenario != "default":
-        cmd.extend(["-s", scenario])
-    return cmd
-
-
-def parse_pair(pair: str) -> tuple[str, str, str, str, str]:
-    """Parse a pair string into (role, scenario, platform_name, platform_image, platform_command).
-
-    Supports both 4-part (single-role) and 5-part (multi-role) formats.
-    For 4-part pairs, role is empty (caller uses default role dir).
-    Spaces in the command field are encoded as ``__SPACE__`` to survive
-    shell word-splitting when ``$TEST_PAIRS`` is expanded unquoted.
-    """
-    parts = pair.split("|")
-    if len(parts) == 4:
-        return "", parts[0], parts[1], parts[2], parts[3].replace("__SPACE__", " ")
-    if len(parts) == 5:
-        return parts[0], parts[1], parts[2], parts[3], parts[4].replace("__SPACE__", " ")
-    raise click.ClickException(f"Invalid pair format: {pair!r} (expected 4 or 5 pipe-delimited parts)")
-
-
-def build_env_for_pair(pair: str, base_env: dict[str, str]) -> dict[str, str]:
-    """Build environment for a single molecule pair."""
-    _role, _scenario, platform_name, platform_image, platform_command = parse_pair(pair)
-    env = base_env.copy()
-    env["MOLECULE_PLATFORM_NAME"] = platform_name
-    env["MOLECULE_PLATFORM_IMAGE"] = platform_image
-    if platform_command:
-        env["MOLECULE_PLATFORM_COMMAND"] = platform_command
-    elif "MOLECULE_PLATFORM_COMMAND" in env:
-        del env["MOLECULE_PLATFORM_COMMAND"]
-    env["ANSIBLE_ALLOW_BROKEN_CONDITIONALS"] = "true"
-    # Use a fresh MOLECULE_HOME per pair to avoid stale config cache
-    # from previous CI runs (causes "Instances missing" errors).
-    if "MOLECULE_HOME" not in env:
-        import tempfile
-
-        env["MOLECULE_HOME"] = tempfile.mkdtemp(prefix="molecule-ci-")
-    return env
-
-
-def resolve_role_dir(role: str, roles_root: Path | None, repo_root: Path) -> Path:
-    """Resolve the working directory for a molecule pair.
-
-    For multi-role pairs (role non-empty), uses ``roles_root/role``.
-    For single-role pairs, auto-discovers the first role with a molecule/
-    subdirectory under ``repo_root/ansible/roles/``.
-    """
-    if role:
-        if roles_root is None:
-            roles_root = repo_root / "ansible" / "roles"
-        return roles_root / role
-    roles_dir = repo_root / "ansible" / "roles"
-    if roles_dir.is_dir():
-        role_dirs = sorted(d for d in roles_dir.iterdir() if (d / "molecule").is_dir())
-        if role_dirs:
-            return role_dirs[0]
-    return roles_dir / "role"  # will produce a clear "not found" error
-
-
-@click.command()
-@click.argument("pairs", nargs=-1, required=True)
-@click.option(
-    "--roles-root",
-    type=click.Path(exists=True, file_okay=False, path_type=Path),
-    default=None,
-    help="Root directory for multi-role pairs (e.g. ansible/roles). Required when pairs use 5-part format.",
-)
-def cli(pairs: tuple[str, ...], roles_root: Path | None) -> None:
-    """Run molecule pairs sequentially, stop if another CI runner fails."""
-    gitea_url = os.environ.get("GITEA_URL", "")
-    try:
-        token = get_ci_token()
-    except click.ClickException:
-        token = None
-    run_id = int(os.environ.get("RUN_ID", "0"))
-    job_name = os.environ.get("JOB_NAME", "molecule-tests")
-    current_index = int(os.environ.get("MATRIX_INDEX", "0"))
-    repository = os.environ.get("GITEA_REPOSITORY", "")
-    owner, _sep, repo = repository.partition("/")
-    if not owner or not repo:
-        owner, repo = REPO_OWNER, REPO_NAME
-
-    if not all([gitea_url, token, run_id]):
-        click.echo(_("GITEA_URL/CI_GITEA_TOKEN/RUN_ID not set; running without cross-runner cancellation."))
-
-    # When devx is installed as a pip package, __file__ resolves to the
-    # site-packages directory, not the repo root. Use GITHUB_WORKSPACE
-    # (set by Gitea Actions) or cwd as the repo root.
-    repo_root = Path(os.environ.get("GITHUB_WORKSPACE", os.getcwd())).resolve()
-
-    base_env = os.environ.copy()
-    base_env.setdefault("DOCKER_HOST", f"unix:///run/user/{os.getuid()}/docker.sock")
-    base_env.setdefault("ANSIBLE_INJECT_INVOCATION", "1")
-
-    stop_event = threading.Event()
-    failed_event = threading.Event()
-
-    if gitea_url and token and run_id:
-        poller = threading.Thread(
-            target=poll_for_other_failures,
-            args=(
-                gitea_url,
-                owner,
-                repo,
-                token,
-                run_id,
-                job_name,
-                current_index,
-                stop_event,
-                failed_event,
-            ),
-            daemon=True,
-        )
-        poller.start()
-
-    try:
-        for pair in pairs:
-            if failed_event.is_set():
-                sys.exit(1)
-
-            role, scenario, platform_name, _img, _cmd = parse_pair(pair)
-            click.echo(_("Running: {scenario} on {platform}", scenario=scenario, platform=platform_name))
-
-            cmd = build_molecule_cmd(scenario)
-            env = build_env_for_pair(pair, base_env)
-            cwd = resolve_role_dir(role, roles_root, repo_root)
-
-            process = subprocess.Popen(  # nosec B603
-                cmd,
-                cwd=str(cwd),
-                env=env,
-                preexec_fn=os.setsid,
-            )
-
-            try:
-                while process.poll() is None:
-                    if failed_event.is_set():
-                        with contextlib.suppress(ProcessLookupError):
-                            os.killpg(os.getpgid(process.pid), signal.SIGTERM)
-                        try:
-                            process.wait(timeout=10)
-                        except subprocess.TimeoutExpired:
-                            with contextlib.suppress(ProcessLookupError):
-                                os.killpg(os.getpgid(process.pid), signal.SIGKILL)
-                            process.wait()
-                        # Clean up containers left behind by the killed test.
-                        click.echo(_("Cleaning up: running molecule destroy for {scenario}", scenario=scenario))
-                        destroy_cmd = ["molecule", "destroy"]
-                        if scenario != "default":
-                            destroy_cmd.extend(["-s", scenario])
-                        with contextlib.suppress(subprocess.SubprocessError, OSError):
-                            subprocess.run(  # nosec B603, B607
-                                destroy_cmd,
-                                cwd=str(cwd),
-                                env=env,
-                                check=False,
-                                capture_output=True,
-                                timeout=120,
-                            )
-                        sys.exit(1)
-                    time.sleep(1)
-            except KeyboardInterrupt:
-                with contextlib.suppress(ProcessLookupError):
-                    os.killpg(os.getpgid(process.pid), signal.SIGTERM)
-                process.wait()
-                # Clean up containers left behind by the interrupted test.
-                click.echo(_("Cleaning up: running molecule destroy for {scenario}", scenario=scenario))
-                destroy_cmd = ["molecule", "destroy"]
-                if scenario != "default":
-                    destroy_cmd.extend(["-s", scenario])
-                with contextlib.suppress(subprocess.SubprocessError, OSError):
-                    subprocess.run(  # nosec B603, B607
-                        destroy_cmd,
-                        cwd=str(cwd),
-                        env=env,
-                        check=False,
-                        capture_output=True,
-                        timeout=120,
-                    )
-                sys.exit(1)
-
-            rc = process.returncode
-
-            if rc != 0:
-                click.echo(_("FAILED: {pair} exited with code {code}", pair=pair, code=rc))
-                # Run molecule destroy to clean up containers left behind by the
-                # failed test. Without this, containers stay running and accumulate
-                # on the runner, consuming disk/memory and degrading CI performance.
-                click.echo(_("Cleaning up: running molecule destroy for {scenario}", scenario=scenario))
-                destroy_cmd = ["molecule", "destroy"]
-                if scenario != "default":
-                    destroy_cmd.extend(["-s", scenario])
-                with contextlib.suppress(subprocess.SubprocessError, OSError):
-                    subprocess.run(  # nosec B603, B607
-                        destroy_cmd,
-                        cwd=str(cwd),
-                        env=env,
-                        check=False,
-                        capture_output=True,
-                        timeout=120,
-                    )
-                sys.exit(rc)
-
-            click.echo(_("PASSED: {pair}", pair=pair))
-
-            # Prune Docker data between scenarios to prevent disk exhaustion
-            # in Docker-in-Docker molecule containers (each scenario pulls
-            # hundreds of MB of images that accumulate across pairs).
-            with contextlib.suppress(subprocess.SubprocessError, OSError):
-                subprocess.run(  # nosec B603, B607
-                    ["docker", "system", "prune", "-af", "--volumes"],
-                    check=False,
-                    capture_output=True,
-                    timeout=60,
-                )
-
-        click.echo(_("All molecule tests passed."))
-    finally:
-        stop_event.set()
-
-    sys.exit(0)
-
-
-if __name__ == "__main__":  # pragma: no cover
-    cli()

src/devx/molecule/start_docker.py

@@ -10,6 +10,12 @@ If the host socket is not available, it tries the rootless socket, then
 starts a local ``dockerd`` with the vfs storage driver (requires
 privileged container).
 
+When the host socket IS available but has limited disk space (e.g. an
+inner DinD daemon writing to a 38 GB container overlay), the script
+prefers a rootless socket that has more available space.  This prevents
+"no space left on device" errors during molecule tests that pull images
+and create containers via the Docker daemon.
+
 Usage::
 
     python3 -m devx.molecule.start_docker [--timeout 30]
@@ -17,8 +23,10 @@ Usage::
 
 from __future__ import annotations
 
+import contextlib
 import glob
 import os
+import shutil
 import subprocess  # nosec B404
 import sys
 import tempfile
@@ -32,6 +40,16 @@ DEFAULT_TIMEOUT = 30
 DOCKER_SOCK = "/var/run/docker.sock"
 # Rootless socket fallback (e.g. /run/user/994/docker.sock)
 ROOTLESS_SOCK = f"/run/user/{os.getuid()}/docker.sock"
+# Host Docker socket mounted by gitea_runner config (see runner config
+# ``options: "-v /run/user/<uid>/docker.sock:/run/host-docker.sock"``).
+# This gives CI containers access to the host's rootless Docker daemon,
+# which has the full host filesystem (e.g. 455 GB) instead of the
+# container's limited overlay (e.g. 38 GB).
+HOST_DOCKER_SOCK = "/run/host-docker.sock"
+# Minimum free bytes for a Docker daemon to be considered usable.
+# Below this, image pulls and container creation will fail with ENOSPC.
+# 20 GB leaves room for molecule-test-base (~500 MB) + a few containers.
+MIN_FREE_BYTES = 20 * 1024**3  # 20 GB
 
 
 def is_docker_ready() -> bool:
@@ -46,6 +64,46 @@ def is_docker_ready() -> bool:
     return result.returncode == 0
 
 
+def _get_docker_free_bytes() -> int:
+    """Get free disk space (bytes) at the Docker daemon's data root.
+
+    Returns 0 if the daemon is not reachable or the data root cannot be
+    determined.
+    """
+    docker_host = os.environ.get("DOCKER_HOST", f"unix://{DOCKER_SOCK}")
+    try:
+        result = subprocess.run(  # nosec B603 B607
+            [
+                "docker",
+                "info",
+                "--format",
+                "{{.DockerRootDir}}",
+            ],
+            capture_output=True,
+            text=True,
+            timeout=10,
+            check=False,
+            env={**os.environ, "DOCKER_HOST": docker_host},
+        )
+        if result.returncode != 0 or not result.stdout.strip():
+            return 0
+        data_root = result.stdout.strip()
+        if not os.path.exists(data_root):
+            return 0
+        return shutil.disk_usage(data_root).free
+    except (FileNotFoundError, subprocess.TimeoutExpired, OSError):
+        return 0
+
+
+def _try_socket(sock_path: str) -> bool:
+    """Set DOCKER_HOST to *sock_path* and check if the daemon is ready.
+
+    Returns ``True`` if the daemon responds, ``False`` otherwise.
+    """
+    os.environ["DOCKER_HOST"] = f"unix://{sock_path}"
+    return is_docker_ready()
+
+
 def _diagnose_socket() -> None:
     """Print diagnostic info about the Docker socket."""
     click.echo(f"DOCKER_HOST = {os.environ.get('DOCKER_HOST', '(not set)')}")
@@ -97,50 +155,177 @@ def _diagnose_socket() -> None:
 def start_docker_daemon(timeout: int = DEFAULT_TIMEOUT) -> bool:
     """Ensure Docker is ready for molecule tests.
 
-    First tries the host socket. If that works, sets ``DOCKER_HOST`` and
-    returns immediately. If not, tries the rootless socket. If neither
-    works, starts a local ``dockerd`` with vfs storage driver (requires
-    privileged container).
+    Tries sockets in this order, preferring ones with enough disk space:
+
+    1. Host rootless socket (``/run/host-docker.sock``) — mounted by the
+       gitea runner config, has access to the host's full filesystem
+       (e.g. 455 GB).  Preferred over the inner dockerd.
+    2. Default socket (``/var/run/docker.sock``) — may be an inner dockerd
+       started by the CI image (v29.5.3) with data root on the container's
+       limited overlay (e.g. 38 GB, often 100 % full).
+    3. Other rootless sockets (``/run/user/*/docker.sock``).
+    4. Local ``dockerd`` with vfs storage driver — last resort.
 
     Returns ``True`` if Docker is ready, ``False`` if it failed to
     start within the timeout.
     """
-    # Point Docker CLI and Python library to the socket explicitly
-    os.environ["DOCKER_HOST"] = f"unix://{DOCKER_SOCK}"
-
     # Diagnose socket state
     click.echo("--- Docker socket diagnostics ---")
     _diagnose_socket()
     click.echo("--- End diagnostics ---")
 
-    # Check if host Docker is already available
-    if is_docker_ready():
-        click.echo(_("Docker daemon already running"))
-        return True
-
-    # Try rootless socket (e.g. /run/user/994/docker.sock)
-    click.echo(f"Trying rootless socket: {ROOTLESS_SOCK}")
-    os.environ["DOCKER_HOST"] = f"unix://{ROOTLESS_SOCK}"
-    if os.path.exists(ROOTLESS_SOCK) and is_docker_ready():
-        click.echo(_("Docker daemon already running"))
-        return True
-
-    # Scan for any rootless sockets at other UIDs
+    # Collect candidate sockets in priority order.
+    # The host's rootless Docker socket (mounted at /run/host-docker.sock
+    # by the gitea runner config) is preferred — it has access to the
+    # host's full filesystem instead of the container's limited overlay.
+    candidates: list[str] = []
+    if os.path.exists(HOST_DOCKER_SOCK):
+        candidates.append(HOST_DOCKER_SOCK)
+    if os.path.exists(DOCKER_SOCK):
+        candidates.append(DOCKER_SOCK)
+    if os.path.exists(ROOTLESS_SOCK):
+        candidates.append(ROOTLESS_SOCK)
     for sock in sorted(glob.glob("/run/user/*/docker.sock")):
-        if sock == ROOTLESS_SOCK:
+        if sock not in candidates:
+            candidates.append(sock)
+
+    # Try each candidate socket — prefer one with enough free space
+    for sock in candidates:
+        click.echo(f"Trying socket: {sock}")
+        if not _try_socket(sock):
             continue
-        click.echo(f"Trying alternative rootless socket: {sock}")
-        os.environ["DOCKER_HOST"] = f"unix://{sock}"
-        if is_docker_ready():
+        free_bytes = _get_docker_free_bytes()
+        free_gb = free_bytes / 1024**3
+        click.echo(f"  Docker daemon ready (free space: {free_gb:.1f} GB)")
+        if free_bytes >= MIN_FREE_BYTES:
             click.echo(_("Docker daemon already running"))
             return True
+        # If free_bytes is 0, the Docker root dir is on the host filesystem
+        # (not accessible from inside the container). This is expected for
+        # the host's rootless Docker — it has the full host disk.
+        # Only trust this for /run/host-docker.sock (known host socket).
+        # For other sockets (e.g. inner dockerd), free_bytes == 0 means
+        # the data root path doesn't exist inside the container — the
+        # inner dockerd may be using the container's full overlay.
+        if free_bytes == 0 and sock == HOST_DOCKER_SOCK:
+            click.echo("Host rootless Docker root dir not accessible from container, using it")
+            return True
+        # If free_bytes is 0 and there are no dockerd processes inside the
+        # container, the socket is the host's Docker (mounted from outside).
+        # The data root is on the host filesystem and has plenty of space.
+        if free_bytes == 0 and sock == DOCKER_SOCK:
+            has_inner_dockerd = False
+            with contextlib.suppress(Exception):
+                pgrep_result = subprocess.run(  # nosec B603 B607
+                    ["pgrep", "-f", "dockerd"],
+                    capture_output=True,
+                    text=True,
+                    timeout=5,
+                )
+                has_inner_dockerd = pgrep_result.returncode == 0
+            if not has_inner_dockerd:
+                click.echo("No inner dockerd found, socket is host Docker (data root on host), using it")
+                return True
+        click.echo(f"  Insufficient space ({free_gb:.1f} GB), trying next...")
 
+    # No socket with sufficient space found.
+    # Don't fall back to the low-space inner dockerd — it will fail
+    # on image pulls.  Instead, kill the inner dockerd, clean up its
+    # data root to free space, and start a new dockerd using the
+    # freed space on the container's overlay.
     click.echo(_("Host Docker not available, starting local dockerd..."))
 
-    # Reset DOCKER_HOST to host socket for local dockerd
-    os.environ["DOCKER_HOST"] = f"unix://{DOCKER_SOCK}"
+    # Kill the inner dockerd (started by the CI image) to free its
+    # data root and socket.  The inner dockerd uses the container's
+    # overlay (38G, often 100% full).  Killing it frees up the
+    # socket and any space used by its containers/volumes.
+    # Use SIGKILL (-9) since the inner dockerd may not respond to SIGTERM.
+    # Try multiple approaches to ensure the inner dockerd is killed.
+    with contextlib.suppress(Exception):
+        result = subprocess.run(  # nosec B603 B607
+            ["pgrep", "-af", "dockerd"],
+            capture_output=True,
+            text=True,
+            timeout=5,
+        )
+        if result.stdout.strip():
+            click.echo(f"  dockerd processes before kill: {result.stdout.strip()}")
+
+    for pattern in ["dockerd", "dockerd-entrypoint.sh", "containerd"]:
+        with contextlib.suppress(Exception):
+            subprocess.run(  # nosec B603 B607
+                ["pkill", "-9", "-f", pattern],
+                check=False,
+                timeout=5,
+            )
+    time.sleep(3)
+
+    # Check if dockerd processes are still alive
+    with contextlib.suppress(Exception):
+        result = subprocess.run(  # nosec B603 B607
+            ["pgrep", "-af", "dockerd"],
+            capture_output=True,
+            text=True,
+            timeout=5,
+        )
+        if result.stdout.strip():
+            click.echo(f"  dockerd processes after kill: {result.stdout.strip()}")
+            # Try killing by PID directly
+            for pid_str in result.stdout.split("\n"):
+                pid = pid_str.split()[0] if pid_str.strip() else ""
+                if pid:
+                    with contextlib.suppress(Exception):
+                        os.kill(int(pid), 9)
+            time.sleep(2)
+
+    # Verify the inner dockerd is actually dead.  If we can still
+    # connect to /var/run/docker.sock, the old daemon is still running
+    # and we need to use a different socket path.
+    old_daemon_alive = False
+    with contextlib.suppress(Exception):
+        result = subprocess.run(  # nosec B603 B607
+            ["docker", "info"],
+            env={**os.environ, "DOCKER_HOST": f"unix://{DOCKER_SOCK}"},
+            capture_output=True,
+            timeout=5,
+        )
+        old_daemon_alive = result.returncode == 0
+
+    if old_daemon_alive:
+        click.echo("  Inner dockerd still alive, using alternate socket")
+        local_sock = "/dev/shm/docker.sock"  # nosec B108
+    else:
+        local_sock = DOCKER_SOCK
+
+    # Clean up the inner dockerd's data root to free space.
+    # The inner dockerd stores images, containers, and volumes here.
+    # Removing them frees up ~2.4GB on the container's overlay.
+    inner_data_root = "/home/grm-ci-runner-*/.local/share/docker"
+    rm_paths = " ".join(f"{inner_data_root}/{d}" for d in ("overlay2", "image", "volumes", "containers"))
+    with contextlib.suppress(Exception):
+        subprocess.run(  # nosec B603 B607
+            ["sh", "-c", f"rm -rf {rm_paths}"],
+            check=False,
+            timeout=30,
+        )
+
+    # Use a fresh data root.  If the inner dockerd is dead, use the
+    # container's overlay (38G, with freed space).  If the inner
+    # dockerd is still alive, use /dev/shm (16G tmpfs) — the overlay
+    # is still full because the inner dockerd's data can't be cleaned.
+    docker_data_root = "/dev/shm/docker" if old_daemon_alive else "/tmp/docker-data"  # nosec B108
+
+    # Remove stale socket if present
+    with contextlib.suppress(OSError):
+        os.unlink(local_sock)
+
+    os.environ["DOCKER_HOST"] = f"unix://{local_sock}"
 
     # Start local dockerd (requires privileged container)
+    # Use /tmp/docker-data as data root on the container's overlay.
+    # The inner dockerd's data root has been cleaned up, freeing ~2.4GB.
+    # vfs storage driver is used since overlay2 may not work inside
+    # a Docker-in-Docker container without --privileged.
     log_file = tempfile.NamedTemporaryFile(  # noqa: SIM115
         mode="w", suffix="dockerd.log", delete=False
     )
@@ -150,8 +335,13 @@ def start_docker_daemon(timeout: int = DEFAULT_TIMEOUT) -> bool:
             "dockerd",
             "--storage-driver",
             "vfs",
+            "--data-root",
+            docker_data_root,
+            "--iptables=false",
+            "--ip6tables=false",
+            "--bridge=none",
             "-H",
-            f"unix://{DOCKER_SOCK}",
+            f"unix://{local_sock}",
         ],
         stdout=log_file,
         stderr=subprocess.STDOUT,

src/devx/tools/ansible_checks/__init__.py

@@ -1,34 +0,0 @@
-"""Ansible check tools — composable validators for Ansible playbooks and roles.
-
-Each check module exports a ``check_*`` function that returns a list of
-violation strings. The shared utilities in :mod:`devx.tools.ansible_checks._shared`
-handle file discovery, YAML parsing, and violation reporting.
-
-The old entry points (``devx.tools.check_ansible_*``, ``devx.tools.check_jinja_expr``)
-remain as thin wrappers for backward compatibility with existing Makefile
-targets and workflow references.
-"""
-
-from devx.tools.ansible_checks._shared import (
-    DEFAULT_ANSIBLE_DIRS,
-    AnsibleFileFinder,
-    AnsibleYAMLParser,
-    ViolationReporter,
-)
-from devx.tools.ansible_checks.jinja_expr import check_jinja_expr
-from devx.tools.ansible_checks.no_log import check_no_log
-from devx.tools.ansible_checks.no_state_absent_on_db import check_no_state_absent_on_db
-from devx.tools.ansible_checks.patterns import check_patterns
-from devx.tools.ansible_checks.set_fact_to_json import check_set_fact_to_json
-
-__all__ = [
-    "DEFAULT_ANSIBLE_DIRS",
-    "AnsibleFileFinder",
-    "AnsibleYAMLParser",
-    "ViolationReporter",
-    "check_jinja_expr",
-    "check_no_log",
-    "check_no_state_absent_on_db",
-    "check_patterns",
-    "check_set_fact_to_json",
-]

src/devx/tools/ansible_checks/_shared.py

@@ -1,178 +0,0 @@
-"""Shared utilities for Ansible check tools.
-
-Provides composable helpers for file discovery, YAML parsing, and
-violation reporting used by the modules in :mod:`devx.tools.ansible_checks`.
-
-Composition over inheritance: each check module picks the helpers it
-needs. Tools that don't parse YAML (e.g. line-based scanners) can skip
-:class:`AnsibleYAMLParser` entirely.
-"""
-
-from __future__ import annotations
-
-import sys
-from collections.abc import Iterator
-from pathlib import Path
-from typing import Final
-
-import click
-import yaml
-
-from devx.i18n import _
-
-#: Default Ansible directories scanned by checks that accept ``--ansible-dir``.
-#: Immutable tuple (not a list) to avoid module-level mutable globals.
-DEFAULT_ANSIBLE_DIRS: Final[tuple[str, ...]] = ("ansible/roles", "ansible/playbooks")
-
-
-class AnsibleFileFinder:
-    """File discovery helpers for Ansible YAML files."""
-
-    @staticmethod
-    def find_task_files(base: Path, skip_molecule: bool = True) -> list[Path]:
-        """Find all YAML files under *base*, recursively.
-
-        If *base* is a single YAML file, returns ``[base]``. If *base* is
-        not a file or directory, returns ``[]``. When *skip_molecule* is
-        True, files with ``molecule`` in their path parts are excluded.
-        """
-        if base.is_file() and base.suffix in (".yml", ".yaml"):
-            return [base]
-        if not base.is_dir():
-            return []
-        files: list[Path] = []
-        for f in sorted(base.rglob("*.yml")) + sorted(base.rglob("*.yaml")):
-            if skip_molecule and "molecule" in f.parts:
-                continue
-            files.append(f)
-        return files
-
-    @staticmethod
-    def find_yaml_files(base: Path, skip_molecule: bool = True) -> list[Path]:
-        """Find YAML files under *base* using ``glob`` (non-recursive rglob).
-
-        Unlike :meth:`find_task_files`, this uses ``base.glob("**/*.yml")``
-        and does not check the suffix when *base* is a single file (any
-        file is accepted). Used by the Jinja expression checker which
-        scans all YAML files including defaults/handlers.
-        """
-        if base.is_file():
-            return [base]
-        files: list[Path] = []
-        for pattern in ("**/*.yml", "**/*.yaml"):
-            files.extend(base.glob(pattern))
-        if skip_molecule:
-            return [f for f in files if "molecule" not in f.parts]
-        return files
-
-    @staticmethod
-    def find_task_and_playbook_files(base: Path, skip_molecule: bool = True) -> list[Path]:
-        """Find task files (``tasks/*.yml``) and playbook files (``playbooks/*.yml``).
-
-        Used by the no_log checker which scans role task files and
-        top-level playbook files. When *skip_molecule* is True, molecule
-        scenario files are excluded.
-        """
-        task_files = list(base.rglob("tasks/*.yml")) + list(base.rglob("tasks/*.yaml"))
-        task_files += list(base.glob("playbooks/*.yml")) + list(base.glob("playbooks/*.yaml"))
-        if skip_molecule:
-            task_files = [f for f in task_files if "molecule" not in f.parts]
-        return sorted(task_files)
-
-
-class AnsibleYAMLParser:
-    """YAML parsing helpers for Ansible files."""
-
-    @staticmethod
-    def parse_file(content: str) -> list[dict]:
-        """Parse multi-document YAML from *content*.
-
-        Returns a list of non-None documents. On ``YAMLError`` or
-        ``OSError``, returns an empty list (the caller skips the file).
-        """
-        try:
-            docs = list(yaml.safe_load_all(content))
-        except (yaml.YAMLError, OSError):
-            return []
-        return [d for d in docs if d]
-
-    @staticmethod
-    def iter_tasks(doc: dict | list) -> Iterator[tuple[dict, int]]:
-        """Yield ``(task_dict, line_number)`` tuples from a YAML document.
-
-        Handles:
-        - Bare task lists (role tasks files): ``[task1, task2, ...]``
-        - Play dicts with ``hosts`` key: iterates ``tasks``,
-          ``pre_tasks``, ``post_tasks``, ``handlers`` sections
-        - Nested ``block`` tasks
-
-        The line number is the 1-based index within the task section
-        (not the file line number — callers use it for display only).
-        """
-        if isinstance(doc, list):
-            for i, item in enumerate(doc):
-                if isinstance(item, dict):
-                    if any(k in item for k in ("tasks", "pre_tasks", "post_tasks", "handlers")):
-                        yield from AnsibleYAMLParser._iter_play_sections(item)
-                    else:
-                        yield item, i + 1
-                        block = item.get("block")
-                        if isinstance(block, list):
-                            for j, bt in enumerate(block):
-                                if isinstance(bt, dict):
-                                    yield bt, i + j + 1
-        elif isinstance(doc, dict):
-            yield from AnsibleYAMLParser._iter_play_sections(doc)
-
-    @staticmethod
-    def _iter_play_sections(doc: dict) -> Iterator[tuple[dict, int]]:
-        """Yield tasks from play sections (tasks, pre_tasks, post_tasks, handlers)."""
-        for section_key in ("tasks", "pre_tasks", "post_tasks", "handlers"):
-            section = doc.get(section_key)
-            if isinstance(section, list):
-                for i, task in enumerate(section):
-                    if isinstance(task, dict):
-                        yield task, i + 1
-                        block = task.get("block")
-                        if isinstance(block, list):
-                            for j, bt in enumerate(block):
-                                if isinstance(bt, dict):
-                                    yield bt, i + j + 1
-
-
-class ViolationReporter:
-    """Standardized violation formatting and reporting."""
-
-    @staticmethod
-    def format_violation(
-        filepath: Path,
-        repo_root: Path,
-        line_num: int | None,
-        message: str,
-    ) -> str:
-        """Format a violation as ``"{relative_path}:{line_num} — message"``.
-
-        Falls back to the full path if *filepath* is not relative to
-        *repo_root*. When *line_num* is None, omits the line number.
-        """
-        try:
-            display_path = filepath.relative_to(repo_root)
-        except ValueError:
-            display_path = filepath
-        if line_num is not None:
-            return f"{display_path}:{line_num} — {message}"
-        return f"{display_path} — {message}"
-
-    @staticmethod
-    def report(violations: list[str], tool_name: str) -> None:
-        """Print violations and exit with the appropriate code.
-
-        Prints ``[{tool_name}] FAIL`` or ``[{tool_name}] OK`` and exits
-        1 if violations are non-empty, 0 otherwise.
-        """
-        if violations:
-            click.echo(_("[{tool}] FAIL: {count} violation(s) found.", tool=tool_name, count=len(violations)))
-            for v in violations:
-                click.echo(f"  - {v}")
-            sys.exit(1)
-        click.echo(_("[{tool}] OK: no violations found.", tool=tool_name))

src/devx/tools/ansible_checks/jinja_expr.py

@@ -1,226 +0,0 @@
-"""Validate Jinja2 expressions in Ansible files by rendering them.
-
-Extracted from :mod:`devx.tools.check_jinja_expr` as part of the
-Ansible check tool consolidation. The old module remains as a thin
-wrapper for backward compatibility.
-"""
-
-from __future__ import annotations
-
-import re
-from pathlib import Path
-
-from jinja2 import Environment
-from jinja2.exceptions import TemplateSyntaxError, UndefinedError
-
-from devx.tools.ansible_checks._shared import AnsibleFileFinder, ViolationReporter
-
-REPO_ROOT = Path.cwd()
-
-MOCK_CONTEXT: dict[str, object] = {
-    "now": lambda fmt=None: (
-        "2026-01-01T00:00:00+00:00"
-        if fmt
-        else type(
-            "Now",
-            (),
-            {
-                "timestamp": lambda self: 1735689600.0,
-                "strftime": lambda self, fmt: "2026-01-01T00:00:00+00:00",
-            },
-        )()
-    ),
-    "ansible_date_time": {
-        "iso8601": "2026-01-01T00:00:00+00:00",
-        "epoch": "1735689600",
-    },
-    "ansible_facts": {
-        "service_mgr": "systemd",
-        "architecture": "x86_64",
-        "distribution_release": "noble",
-        "virtualization_type": "none",
-        "interfaces": ["eth0", "lo"],
-        "hostname": "test-host",
-    },
-    "ansible_host": "10.0.0.1",
-    "env": "staging",
-    "environment": "staging",
-    "customer_id": "test",
-    "zitadel_domain": "zitadel.test",
-    "_env_name": "staging",
-    "_observability_data_root": "/opt",
-    "skip_zitadel_stack": False,
-    "skip_htpasswd": False,
-    "skip_observability_stack": False,
-    "backup_enabled": True,
-    "app_filter": "",
-    "app_domain": "test.example.com",
-    "oidc_client_id": "test-client-id",
-    "oidc_client_secret": "test-secret",  # nosec B105 — mock value for Jinja rendering, not a real secret
-    "s3_backup_bucket": "test-bucket",
-    "s3_endpoint": "https://s3.test",
-    "s3_access_key": "test-key",
-    "s3_secret_key": "test-secret",  # nosec B105 — mock value for Jinja rendering, not a real secret
-}
-
-EXPR_PATTERN = re.compile(r"\{\{(.*?)\}\}", re.DOTALL)
-
-
-def _default_ansible_dirs() -> list[Path]:
-    """Return the default directories to scan for Ansible files."""
-    return [
-        REPO_ROOT / "ansible" / "playbooks",
-        REPO_ROOT / "ansible" / "roles",
-    ]
-
-
-def _find_yaml_files(path: Path) -> list[Path]:
-    """Find Ansible YAML files (tasks, playbooks, handlers) in a path."""
-    return AnsibleFileFinder.find_yaml_files(path, skip_molecule=True)
-
-
-def _extract_expressions(content: str) -> list[str]:
-    """Extract Jinja expressions from file content."""
-    expressions = []
-    for match in EXPR_PATTERN.finditer(content):
-        raw = match.group(1)
-        if "\n" in raw:
-            continue
-        expr = raw.strip()
-        if not expr or expr.startswith("%") or len(expr) <= 1:
-            continue
-        if expr.startswith(".") or "println" in expr:
-            continue
-        if ".State." in expr or ".NetworkSettings." in expr:
-            continue
-        if expr.count("(") != expr.count(")"):
-            continue
-        if expr.count("{") != expr.count("}"):
-            continue
-        if expr.count("[") != expr.count("]"):
-            continue
-        expressions.append(expr)
-    return expressions
-
-
-def _render_expression(expr: str) -> tuple[bool, str]:
-    """Try to render a Jinja expression. Returns (success, error_msg)."""
-    try:
-        env = Environment(autoescape=False, keep_trailing_newline=True)  # nosec B701 — Ansible Jinja, not web-facing  # noqa: S701
-
-        def _strftime(string_format: str, second: float | None = None, utc: bool = False) -> str:
-            if isinstance(string_format, (int, float)) and isinstance(second, str) and "%" in second:
-                raise ValueError(  # noqa: TRY301
-                    "Invalid value for epoch value — strftime filter arguments "
-                    "are reversed. The format string must be the piped value: "
-                    "'%format%' | strftime(epoch), not epoch | strftime('%format%')"
-                )
-            return str(string_format)
-
-        env.filters["strftime"] = _strftime
-        env.filters["b64decode"] = lambda x: x
-        env.filters["b64encode"] = lambda x: x
-        env.filters["regex_replace"] = lambda x, pattern, replacement="": x
-        env.filters["int"] = lambda x, default=0: (
-            int(x) if isinstance(x, (int, float, str)) and str(x).lstrip("-").isdigit() else default
-        )
-        env.filters["bool"] = bool
-        env.filters["basename"] = lambda x: str(x).rsplit("/", 1)[-1]
-        env.filters["dirname"] = lambda x: str(x).rsplit("/", 1)[0] if "/" in str(x) else "."
-        env.filters["combine"] = lambda *args, **kwargs: args[0]
-        env.filters["from_json"] = lambda x: x
-        env.filters["to_json"] = lambda x: x
-        env.filters["ternary"] = lambda x, true_val, false_val=None: true_val if x else false_val
-        env.filters["dict2items"] = lambda x: [
-            {"key": k, "value": v} for k, v in (x.items() if isinstance(x, dict) else [])
-        ]
-        env.filters["map"] = lambda x, attribute=None: x
-        env.filters["default"] = lambda x, default_value="", boolean=False: x if x else default_value
-        env.filters["from_yaml"] = lambda x: x
-        env.filters["difference"] = lambda x, y: x
-        env.filters["join"] = lambda x, sep="": sep.join(str(i) for i in (x if isinstance(x, list) else [x]))
-        env.filters["list"] = lambda x: list(x) if isinstance(x, (list, tuple)) else [x]
-        env.filters["length"] = lambda x: len(x) if hasattr(x, "__len__") else 0
-        env.filters["items"] = lambda x: list(x.items()) if isinstance(x, dict) else []
-        env.filters["first"] = lambda x: x[0] if isinstance(x, (list, str)) and x else x
-        env.filters["last"] = lambda x: x[-1] if isinstance(x, (list, str)) and x else x
-        env.filters["upper"] = lambda x: str(x).upper()
-        env.filters["lower"] = lambda x: str(x).lower()
-        env.filters["replace"] = lambda x, old, new: str(x).replace(old, new)
-        env.filters["split"] = lambda x, sep=None: str(x).split(sep) if sep else str(x).split()
-        env.filters["trim"] = lambda x: str(x).strip()
-        env.filters["sort"] = lambda x: sorted(x) if isinstance(x, list) else x
-        env.filters["unique"] = lambda x: list(set(x)) if isinstance(x, list) else x
-        env.filters["count"] = lambda x: len(x) if hasattr(x, "__len__") else 0
-        env.filters["float"] = lambda x, default=0.0: (
-            float(x) if isinstance(x, (int, float, str)) and str(x).replace(".", "").lstrip("-").isdigit() else default
-        )
-        env.filters["string"] = str
-        env.filters["indent"] = lambda x, width=4: str(x)
-        env.filters["to_nice_json"] = str
-        env.filters["to_nice_yaml"] = str
-        env.filters["from_yaml_all"] = lambda x: x
-        env.filters["groupby"] = lambda x: x
-        env.filters["dictsort"] = lambda x: list(x.items()) if isinstance(x, dict) else []
-        env.filters["max"] = lambda x: max(x) if isinstance(x, list) and x else x
-        env.filters["min"] = lambda x: min(x) if isinstance(x, list) and x else x
-        env.filters["reverse"] = lambda x: list(reversed(x)) if isinstance(x, list) else x
-        env.filters["flatten"] = lambda x: x
-        env.filters["product"] = lambda x: x
-        env.filters["zip"] = lambda x: x
-        env.filters["subelements"] = lambda x: x
-        env.filters["json_query"] = lambda x: x
-        env.filters["type_debug"] = lambda x: type(x).__name__
-        env.globals["lookup"] = lambda *args, **kwargs: ""
-        env.globals["query"] = lambda *args, **kwargs: []
-
-        template = env.from_string("{{ " + expr + " }}")
-        result = template.render(**MOCK_CONTEXT)
-    except TemplateSyntaxError as e:
-        return False, f"Syntax error: {e.message}"
-    except UndefinedError as e:
-        return True, f"Skipped (undefined: {e})"
-    except Exception as e:
-        error_msg = str(e)
-        if "Invalid value for epoch" in error_msg:
-            return False, f"strftime filter argument error: {error_msg}"
-        return True, f"Skipped ({type(e).__name__}: {error_msg})"
-    else:
-        return True, result
-
-
-def _check_file(filepath: Path, repo_root: Path) -> list[str]:
-    """Check all Jinja expressions in a file. Returns list of violations."""
-    violations = []
-    content = filepath.read_text()
-    expressions = _extract_expressions(content)
-    for expr in expressions:
-        success, msg = _render_expression(expr)
-        if not success:
-            display_path = ViolationReporter.format_violation(filepath, repo_root, None, "")
-            display_path = display_path.removesuffix(" — ")
-            violations.append(f"{display_path}: `{{{{ {expr} }}}}` — {msg}")
-    return violations
-
-
-def check_jinja_expr(path: Path | None, ansible_dirs: list[Path] | None = None) -> list[str]:
-    """Validate Jinja2 expressions in Ansible files.
-
-    Args:
-        path: Specific file or directory to check. If None, *ansible_dirs*
-            is used.
-        ansible_dirs: Directories to scan when *path* is None.
-
-    Returns:
-        List of violation messages (empty if all renderable expressions pass).
-    """
-    if path:
-        files = _find_yaml_files(path)
-    else:
-        files: list[Path] = []
-        for d in ansible_dirs or _default_ansible_dirs():
-            files.extend(_find_yaml_files(d))
-    all_violations: list[str] = []
-    for f in files:
-        all_violations.extend(_check_file(f, REPO_ROOT))
-    return all_violations

src/devx/tools/ansible_checks/no_log.py

@@ -1,128 +0,0 @@
-"""Check Ansible tasks for missing no_log on secret-handling tasks.
-
-Extracted from :mod:`devx.tools.check_ansible_no_log` as part of the
-Ansible check tool consolidation. The old module remains as a thin
-wrapper for backward compatibility.
-"""
-
-from __future__ import annotations
-
-import re
-from pathlib import Path
-
-from devx.tools.ansible_checks._shared import AnsibleFileFinder, AnsibleYAMLParser
-
-# Patterns that indicate a task is handling secrets.
-SECRET_PATTERNS = [
-    re.compile(r"\{\{[^}]*_secrets\.", re.IGNORECASE),
-    re.compile(r"\{\{[^}]*password", re.IGNORECASE),
-    re.compile(r"\{\{[^}]*_secret\b", re.IGNORECASE),
-    re.compile(r"\{\{[^}]*api_key", re.IGNORECASE),
-    re.compile(r"\{\{[^}]*(?:vault_token|auth_token|access_token|bot_token)", re.IGNORECASE),
-]
-
-TASK_VALUE_KEYS = {
-    "shell",
-    "command",
-    "ansible.builtin.shell",
-    "ansible.builtin.command",
-    "ansible.builtin.template",
-    "ansible.builtin.copy",
-    "ansible.builtin.debug",
-    "template",
-    "copy",
-    "debug",
-    "cmd",
-    "msg",
-    "content",
-}
-
-NON_VALUE_KEYS = {
-    "name",
-    "when",
-    "loop",
-    "loop_control",
-    "changed_when",
-    "failed_when",
-    "no_log",
-    "register",
-    "tags",
-    "vars",
-    "become",
-    "become_user",
-    "delegate_to",
-    "run_once",
-    "environment",
-    "with_items",
-    "with_dict",
-    "with_list",
-}
-
-
-def _contains_secret(value: object) -> bool:
-    """Recursively check if a value contains secret-like variable references."""
-    if isinstance(value, str):
-        return any(p.search(value) for p in SECRET_PATTERNS)
-    if isinstance(value, dict):
-        return any(_contains_secret(v) for v in value.values())
-    if isinstance(value, list):
-        return any(_contains_secret(item) for item in value)
-    return False
-
-
-def _has_no_log(task: dict) -> bool:
-    """Check if a task has no_log set to a non-False value."""
-    no_log = task.get("no_log", False)
-    return no_log is not False and no_log is not None
-
-
-def _check_task(task: dict, file_path: Path, task_num: int) -> list[str]:
-    """Check a single task for missing no_log on secret values."""
-    violations: list[str] = []
-    if _has_no_log(task):
-        return violations
-    has_secrets = False
-    for key, value in task.items():
-        if key in NON_VALUE_KEYS:
-            continue
-        if _contains_secret(value):
-            has_secrets = True
-            break
-    if has_secrets:
-        task_name = task.get("name", "<unnamed>")
-        violations.append(
-            f"{file_path}:{task_num}: Task '{task_name}' references secrets "
-            f"but has no no_log. Add `no_log: true` or "
-            f'`no_log: "{{{{ not (debug_mode | default(false) | bool) }}}}"` '
-            f"to prevent credential leakage in Ansible output."
-        )
-    return violations
-
-
-def check_no_log(path: Path, ansible_dirs: list[Path] | None = None) -> list[str]:
-    """Check all Ansible task files for missing no_log on secret-handling tasks.
-
-    Args:
-        path: The base directory to scan (or a specific file).
-        ansible_dirs: Unused — kept for API symmetry with other checks.
-            The no_log checker scans *path* directly.
-
-    Returns:
-        List of violation messages (empty if all OK).
-    """
-    all_violations: list[str] = []
-    task_files = AnsibleFileFinder.find_task_and_playbook_files(path)
-    for task_file in task_files:
-        try:
-            content = task_file.read_text(encoding="utf-8")
-        except (OSError, UnicodeDecodeError):
-            continue
-        docs = AnsibleYAMLParser.parse_file(content)
-        for doc in docs:
-            for task, task_num in AnsibleYAMLParser.iter_tasks(doc):
-                all_violations.extend(_check_task(task, task_file, task_num))
-    return all_violations
-
-
-# Backward-compat alias for the old public function name.
-check_directory = check_no_log

src/devx/tools/ansible_checks/no_state_absent_on_db.py

@@ -1,100 +0,0 @@
-"""Check Ansible tasks for ``state: absent`` on database data directories.
-
-Extracted from :mod:`devx.tools.check_ansible_no_state_absent_on_db` as
-part of the Ansible check tool consolidation. The old module remains as
-a thin wrapper for backward compatibility.
-"""
-
-from __future__ import annotations
-
-import re
-from pathlib import Path
-
-from devx.tools.ansible_checks._shared import AnsibleFileFinder, ViolationReporter
-
-REPO_ROOT = Path.cwd()
-
-DB_PATH_PATTERNS = (
-    re.compile(r"postgres/zitadel-db", re.IGNORECASE),
-    re.compile(r"postgres/\w+-db", re.IGNORECASE),
-    re.compile(r"/var/lib/postgresql/data", re.IGNORECASE),
-    re.compile(r"/var/lib/postgresql/data/\w+-db", re.IGNORECASE),
-)
-
-DESTRUCTIVE_PATTERNS = (
-    re.compile(r"state:\s*absent", re.IGNORECASE),
-    re.compile(r"rm\s+-rf.*\bdb\b", re.IGNORECASE),
-)
-
-ALLOWED_CONTEXT_KEYWORDS = (
-    "upgrade-postgres",
-    "PG_VERSION",
-    "pg_version",
-)
-
-ALLOW_MARKER = "lint:allow-state-absent"
-
-
-def _find_task_files(base: Path) -> list[Path]:
-    """Find all YAML task files under a base directory, skipping molecule."""
-    return AnsibleFileFinder.find_task_files(base, skip_molecule=True)
-
-
-def _check_file(filepath: Path, repo_root: Path) -> list[str]:
-    """Check a YAML file for state: absent on DB data directory paths."""
-    try:
-        content = filepath.read_text(encoding="utf-8")
-    except (OSError, UnicodeDecodeError):
-        return []
-    if not any(p.search(content) for p in DB_PATH_PATTERNS):
-        return []
-    display_path = ViolationReporter.format_violation(filepath, repo_root, None, "")
-    display_path = display_path.removesuffix(" — ")
-    violations: list[str] = []
-    lines = content.splitlines()
-    for i, line in enumerate(lines):
-        for db_pattern in DB_PATH_PATTERNS:
-            if not db_pattern.search(line):
-                continue
-            context_start = max(0, i - 5)
-            context_end = min(len(lines), i + 6)
-            context = "\n".join(lines[context_start:context_end])
-            if any(kw in context for kw in ALLOWED_CONTEXT_KEYWORDS):
-                continue
-            if ALLOW_MARKER in context:
-                continue
-            for dp in DESTRUCTIVE_PATTERNS:
-                if dp.search(context):
-                    violations.append(
-                        f"{display_path}:{i + 1} — destructive operation "
-                        f"({dp.pattern!r}) near DB data directory path "
-                        f"({db_pattern.pattern!r}). "
-                        f"Database directories must never be wiped automatically (ADR-0028). "
-                        f"If this is legitimate (e.g. PG upgrade), add "
-                        f"#{ALLOW_MARKER} to the task."
-                    )
-                    break
-    return violations
-
-
-def check_no_state_absent_on_db(path: Path | None, ansible_dirs: list[Path] | None = None) -> list[str]:
-    """Check that no Ansible task uses state: absent on a DB data directory.
-
-    Args:
-        path: Specific file or directory to check. If None, *ansible_dirs*
-            is used.
-        ansible_dirs: Directories to scan when *path* is None.
-
-    Returns:
-        List of violation messages (empty if clean).
-    """
-    if path:
-        files = _find_task_files(path)
-    else:
-        files: list[Path] = []
-        for d in ansible_dirs or []:
-            files.extend(_find_task_files(d))
-    all_violations: list[str] = []
-    for f in files:
-        all_violations.extend(_check_file(f, REPO_ROOT))
-    return all_violations

src/devx/tools/ansible_checks/patterns.py

@@ -1,226 +0,0 @@
-"""Check Ansible tasks for dangerous patterns that mask failures.
-
-Extracted from :mod:`devx.tools.check_ansible_patterns` as part of the
-Ansible check tool consolidation. The old module remains as a thin
-wrapper for backward compatibility.
-"""
-
-from __future__ import annotations
-
-import re
-from pathlib import Path
-
-from devx.tools.ansible_checks._shared import AnsibleFileFinder, AnsibleYAMLParser
-
-REPO_ROOT = Path.cwd()
-
-# Comment marker to explicitly allow a pattern on a specific task
-ALLOW_MARKER = "lint:allow-failure-masking"
-
-# Patterns that mask failures when used in shell/command tasks
-OR_TRUE_PATTERN = re.compile(r"\|\|\s*true\b", re.IGNORECASE)
-REDIRECT_DEVNULL_PATTERN = re.compile(r"2>/dev/null")
-
-# Module keys that accept shell/command strings
-SHELL_MODULE_KEYS = frozenset(
-    {
-        "shell",
-        "command",
-        "ansible.builtin.shell",
-        "ansible.builtin.command",
-        "cmd",
-        "ansible.builtin.raw",
-        "raw",
-    }
-)
-
-# Task keys whose values might contain shell commands
-COMMAND_VALUE_KEYS = frozenset(
-    {
-        "shell",
-        "command",
-        "ansible.builtin.shell",
-        "ansible.builtin.command",
-        "cmd",
-        "raw",
-        "ansible.builtin.raw",
-    }
-)
-
-LEGITIMATE_COMMAND_PREFIXES = (
-    "docker rm",
-    "docker stop",
-    "docker rmi",
-    "docker network rm",
-    "docker volume rm",
-    "pkill",
-    "kill",
-    "journalctl --vacuum",
-    "apt-get clean",
-    "apt-get autoremove",
-    "docker image prune",
-    "docker container prune",
-    "docker volume prune",
-    "docker builder prune",
-    "find / -name",
-    "chmod",
-    "rm -f",
-    "docker network connect",
-    "curl.*api/v2/admin/tsdb/snapshot",
-)
-
-LEGITIMATE_TASK_NAME_KEYWORDS = (
-    "remove",
-    "cleanup",
-    "clean up",
-    "prune",
-    "purge",
-    "disconnect",
-    "stop",
-    "kill",
-    "strip suid",
-    "suid",
-    "vacuum",
-    "ensure.*absent",
-    "may not exist",
-    "if exists",
-    "optional",
-    "best effort",
-    "no-op",
-    "noop",
-    "idempotent",
-    "sync",
-)
-
-CRITICAL_TASK_KEYWORDS = (
-    "password",
-    "secret",
-    "provision",
-    "oidc",
-)
-
-LEGITIMATE_FAILED_WHEN_KEYWORDS = (
-    "stop",
-    "start",
-    "check",
-    "wait",
-    "migrate",
-    "restart",
-    "rebuild",
-    "restore",
-    "remove",
-    "cleanup",
-    "sync",
-    "download",
-    "extract",
-    "verify",
-)
-
-
-def _is_legitimate_or_true(command_str: str, task_name: str) -> bool:
-    """Check if a || true in a command is in a legitimate context."""
-    name_lower = task_name.lower()
-    if any(re.search(kw, name_lower) for kw in LEGITIMATE_TASK_NAME_KEYWORDS):
-        return True
-    cmd_lower = command_str.lower()
-    return any(re.search(prefix, cmd_lower) for prefix in LEGITIMATE_COMMAND_PREFIXES)
-
-
-def _is_legitimate_devnull(command_str: str, task_name: str) -> bool:
-    """Check if a 2>/dev/null in a command is in a legitimate context."""
-    return _is_legitimate_or_true(command_str, task_name)
-
-
-def _check_task(task: dict, filepath: Path, task_num: int, repo_root: Path) -> list[str]:
-    """Check a single task for dangerous failure-masking patterns."""
-    violations: list[str] = []
-    try:
-        display_path = filepath.relative_to(repo_root)
-    except ValueError:
-        display_path = filepath
-    task_name = task.get("name", "<unnamed>")
-    if ALLOW_MARKER in task_name:
-        return violations
-    for key in COMMAND_VALUE_KEYS:
-        value = task.get(key)
-        if value is None:
-            continue
-        value_str = str(value)
-        if OR_TRUE_PATTERN.search(value_str) and not _is_legitimate_or_true(value_str, task_name):
-            violations.append(
-                f"{display_path}:{task_num} — task '{task_name}' uses "
-                f"'|| true' in {key} which may mask real failures. "
-                f"If this is a cleanup/idempotency operation, rename the "
-                f"task to include 'remove'/'cleanup'/'prune' or add "
-                f"#{ALLOW_MARKER} to the task."
-            )
-    failed_when = task.get("failed_when")
-    if failed_when is False:
-        name_lower = task_name.lower()
-        is_legitimate = any(kw in name_lower for kw in LEGITIMATE_FAILED_WHEN_KEYWORDS)
-        if not is_legitimate:
-            for kw in CRITICAL_TASK_KEYWORDS:
-                if kw in name_lower:
-                    violations.append(
-                        f"{display_path}:{task_num} — critical task '{task_name}' "
-                        f"has failed_when: false, which masks failures on "
-                        f"a {kw}-related operation. Remove failed_when: false "
-                        f"or add #{ALLOW_MARKER} if masking is intentional."
-                    )
-                    break
-    return violations
-
-
-def _check_file(filepath: Path, repo_root: Path) -> list[str]:
-    """Check a YAML file for dangerous failure-masking patterns."""
-    try:
-        content = filepath.read_text(encoding="utf-8")
-    except (OSError, UnicodeDecodeError):
-        return []
-    if not (
-        OR_TRUE_PATTERN.search(content) or "failed_when: false" in content or REDIRECT_DEVNULL_PATTERN.search(content)
-    ):
-        return []
-    has_allow_marker = ALLOW_MARKER in content
-    docs = AnsibleYAMLParser.parse_file(content)
-    violations: list[str] = []
-    for doc in docs:
-        for task, task_num in AnsibleYAMLParser.iter_tasks(doc):
-            violations.extend(_check_task(task, filepath, task_num, repo_root))
-    if has_allow_marker:
-        violations = []
-    return violations
-
-
-def _check_tasks(doc: dict, filepath: Path, errors: list[str], repo_root: Path) -> None:
-    """Check top-level tasks and nested task sections in a playbook doc."""
-    for task, task_num in AnsibleYAMLParser._iter_play_sections(doc):
-        errors.extend(_check_task(task, filepath, task_num, repo_root))
-
-
-def _find_task_files(base: Path) -> list[Path]:
-    """Find all YAML task files under a base directory, skipping molecule."""
-    return AnsibleFileFinder.find_task_files(base, skip_molecule=True)
-
-
-def check_patterns(path: Path | None, ansible_dirs: list[Path] | None = None) -> list[str]:
-    """Check Ansible tasks for dangerous failure-masking patterns.
-
-    Args:
-        path: Specific file or directory to check. If None, *ansible_dirs*
-            is used.
-        ansible_dirs: Directories to scan when *path* is None.
-
-    Returns:
-        List of violation messages (empty if clean).
-    """
-    if path:
-        files = _find_task_files(path)
-    else:
-        files: list[Path] = []
-        for d in ansible_dirs or []:
-            files.extend(_find_task_files(d))
-    all_violations: list[str] = []
-    for f in files:
-        all_violations.extend(_check_file(f, REPO_ROOT))
-    return all_violations

src/devx/tools/ansible_checks/set_fact_to_json.py

@@ -1,134 +0,0 @@
-"""Check that Ansible ``set_fact`` tasks don't misuse ``| to_json``.
-
-Extracted from :mod:`devx.tools.check_ansible_set_fact_to_json` as part
-of the Ansible check tool consolidation. The old module remains as a
-thin wrapper for backward compatibility.
-"""
-
-from __future__ import annotations
-
-from pathlib import Path
-
-import yaml
-
-from devx.tools.ansible_checks._shared import AnsibleFileFinder, ViolationReporter
-
-REPO_ROOT = Path.cwd()
-
-TO_JSON_FILTERS = ("| to_json", "| to_nice_json", "|to_json", "|to_nice_json")
-
-
-def _find_task_files(base: Path) -> list[Path]:
-    """Find all YAML task files under a base directory."""
-    return AnsibleFileFinder.find_task_files(base, skip_molecule=False)
-
-
-def _check_file(filepath: Path, repo_root: Path) -> list[str]:
-    """Check a single YAML file for set_fact + to_json misuse."""
-    errors: list[str] = []
-    try:
-        content = filepath.read_text(encoding="utf-8")
-    except (OSError, UnicodeDecodeError):
-        return errors
-    try:
-        docs = list(yaml.safe_load_all(content))
-    except yaml.YAMLError as exc:
-        return [f"{filepath}: cannot parse YAML: {exc}"]
-    for doc in docs:
-        if isinstance(doc, list):
-            for item in doc:
-                if isinstance(item, dict):
-                    if any(k in item for k in ("tasks", "pre_tasks", "post_tasks", "handlers", "roles")):
-                        _check_tasks(item, filepath, errors, repo_root)
-                    else:
-                        _check_task(item, filepath, errors, repo_root)
-                        block = item.get("block")
-                        if isinstance(block, list):
-                            _check_task_list(block, filepath, errors, repo_root)
-        elif isinstance(doc, dict):
-            _check_tasks(doc, filepath, errors, repo_root)
-    return errors
-
-
-def _check_tasks(doc: dict, filepath: Path, errors: list[str], repo_root: Path) -> None:
-    """Check top-level tasks and nested task sections in a playbook doc."""
-    tasks = doc.get("tasks")
-    if isinstance(tasks, list):
-        _check_task_list(tasks, filepath, errors, repo_root)
-    for role_key in ("pre_tasks", "post_tasks", "handlers"):
-        section = doc.get(role_key)
-        if isinstance(section, list):
-            _check_task_list(section, filepath, errors, repo_root)
-    roles = doc.get("roles")
-    if isinstance(roles, list):
-        for role_entry in roles:
-            if isinstance(role_entry, dict):
-                role_tasks = role_entry.get("tasks")
-                if isinstance(role_tasks, list):
-                    _check_task_list(role_tasks, filepath, errors, repo_root)
-
-
-def _check_task_list(tasks: list, filepath: Path, errors: list[str], repo_root: Path) -> None:
-    """Check a list of task definitions for set_fact + to_json."""
-    for task in tasks:
-        if not isinstance(task, dict):
-            continue
-        _check_task(task, filepath, errors, repo_root)
-        block = task.get("block")
-        if isinstance(block, list):
-            _check_task_list(block, filepath, errors, repo_root)
-
-
-def _check_task(task: dict, filepath: Path, errors: list[str], repo_root: Path) -> None:
-    """Check a single task for set_fact + to_json misuse."""
-    has_set_fact = False
-    for key in task:
-        if key in {"set_fact", "ansible.builtin.set_fact"}:
-            has_set_fact = True
-            break
-    if not has_set_fact:
-        return
-    set_fact_body = task.get("set_fact") or task.get("ansible.builtin.set_fact")
-    if not isinstance(set_fact_body, dict):
-        return
-    task_name = task.get("name", "(unnamed)")
-    for fact_name, fact_value in set_fact_body.items():
-        if fact_name in ("cacheable",):
-            continue
-        value_str = str(fact_value)
-        for filter_pattern in TO_JSON_FILTERS:
-            if filter_pattern in value_str:
-                display_path = ViolationReporter.format_violation(filepath, repo_root, None, "")
-                display_path = display_path.removesuffix(" — ")
-                errors.append(
-                    f"{display_path}: task '{task_name}' "
-                    f"sets fact '{fact_name}' with '{filter_pattern.strip()}' "
-                    f"— this converts native Python types to JSON strings. "
-                    f"Remove the filter to preserve the native type, or use "
-                    f"'| from_json' in the consuming task if the string "
-                    f"representation is intentional."
-                )
-                break
-
-
-def check_set_fact_to_json(path: Path | None, ansible_dirs: list[Path] | None = None) -> list[str]:
-    """Check that set_fact tasks don't misuse to_json.
-
-    Args:
-        path: Specific file or directory to check. If None, *ansible_dirs*
-            is used.
-        ansible_dirs: Directories to scan when *path* is None.
-
-    Returns:
-        List of error messages (empty if all OK).
-    """
-    if path:
-        files = _find_task_files(path)
-    else:
-        files: list[Path] = []
-        for d in ansible_dirs or []:
-            files.extend(_find_task_files(d))
-    all_errors: list[str] = []
-    for f in files:
-        all_errors.extend(_check_file(f, REPO_ROOT))
-    return all_errors

src/devx/tools/check_ansible_no_log.py

@@ -1,9 +1,17 @@
 """Check Ansible tasks for missing no_log on secret-handling tasks.
 
-Thin wrapper around :mod:`devx.tools.ansible_checks.no_log` for
-backward compatibility. The check logic lives in the subpackage; this
-module preserves the CLI entry point and re-exports the internal
-helpers so existing tests and imports continue to work.
+ansible-lint's built-in ``no-log-password`` rule only fires when a module
+parameter is literally named ``*password*`` and there's a loop. It does
+NOT catch:
+
+- Shell/command tasks that interpolate ``{{ _secrets.* }}`` or
+  ``{{ *password* }}`` variables
+- Template/copy tasks that render secret values without ``no_log``
+
+This script fills that gap by scanning all Ansible task files for
+variables that look like secrets (``_secrets.*``, ``*password*``,
+``*secret*``, ``*token*``, ``*api_key*``) and verifying that the task
+has ``no_log`` set to a non-False value.
 
 Usage::
 
@@ -16,25 +24,178 @@ Exit code 0 if all secret-handling tasks have no_log, 1 otherwise.
 
 from __future__ import annotations
 
+import re
 import sys
 from pathlib import Path
 
 import click
-
-from devx.tools.ansible_checks.no_log import (
-    NON_VALUE_KEYS,  # noqa: F401
-    SECRET_PATTERNS,  # noqa: F401 — re-exported for backward compat
-    TASK_VALUE_KEYS,  # noqa: F401
-    _check_task,  # noqa: F401
-    _contains_secret,  # noqa: F401
-    _has_no_log,  # noqa: F401
-    check_directory,  # noqa: F401
-    check_no_log,  # noqa: F401
-)
+import yaml
 
 REPO_ROOT = Path.cwd()
 DEFAULT_ANSIBLE_DIR = REPO_ROOT / "ansible"
 
+# Patterns that indicate a task is handling secrets.
+# We only match Jinja-interpolated variables ({{ ... }}) to avoid false
+# positives from field names like "password" in module params or task names.
+SECRET_PATTERNS = [
+    # {{ _secrets.anything }} or {{ _secrets['anything'] }}
+    re.compile(r"\{\{[^}]*_secrets\.", re.IGNORECASE),
+    # {{ anything_password }} but NOT the word "password" in a string literal
+    re.compile(r"\{\{[^}]*password", re.IGNORECASE),
+    # {{ anything_secret }}
+    re.compile(r"\{\{[^}]*_secret\b", re.IGNORECASE),
+    # {{ anything_api_key }}
+    re.compile(r"\{\{[^}]*api_key", re.IGNORECASE),
+    # {{ anything_token }} (but not loop tokens like {{ loop_token }})
+    re.compile(r"\{\{[^}]*(?:vault_token|auth_token|access_token|bot_token)", re.IGNORECASE),
+]
+
+# Task keys whose values might contain secret references
+TASK_VALUE_KEYS = {
+    "shell",
+    "command",
+    "ansible.builtin.shell",
+    "ansible.builtin.command",
+    "ansible.builtin.template",
+    "ansible.builtin.copy",
+    "ansible.builtin.debug",
+    "template",
+    "copy",
+    "debug",
+    "cmd",
+    "msg",
+    "content",
+}
+
+# Keys that are NOT secret-bearing (task metadata, not values)
+NON_VALUE_KEYS = {
+    "name",
+    "when",
+    "loop",
+    "loop_control",
+    "changed_when",
+    "failed_when",
+    "no_log",
+    "register",
+    "tags",
+    "vars",
+    "become",
+    "become_user",
+    "delegate_to",
+    "run_once",
+    "environment",
+    "with_items",
+    "with_dict",
+    "with_list",
+}
+
+
+def _contains_secret(value: object) -> bool:
+    """Recursively check if a value contains secret-like variable references."""
+    if isinstance(value, str):
+        return any(p.search(value) for p in SECRET_PATTERNS)
+    if isinstance(value, dict):
+        return any(_contains_secret(v) for v in value.values())
+    if isinstance(value, list):
+        return any(_contains_secret(item) for item in value)
+    return False
+
+
+def _has_no_log(task: dict) -> bool:
+    """Check if a task has no_log set to a non-False value."""
+    no_log = task.get("no_log", False)
+    # Jinja expressions (e.g. "{{ not debug_mode }}") count as set
+    return no_log is not False and no_log is not None
+
+
+def _check_task(task: dict, file_path: Path, task_num: int) -> list[str]:
+    """Check a single task for missing no_log on secret values.
+
+    Returns a list of violation messages (empty if OK).
+    """
+    violations: list[str] = []
+
+    # Skip tasks that already have no_log
+    if _has_no_log(task):
+        return violations
+
+    # Check all string values in the task for secret references
+    has_secrets = False
+    for key, value in task.items():
+        if key in NON_VALUE_KEYS:
+            continue
+        # Check action module params (shell, command, copy, template, etc.)
+        if _contains_secret(value):
+            has_secrets = True
+            break
+
+    if has_secrets:
+        task_name = task.get("name", "<unnamed>")
+        violations.append(
+            f"{file_path}:{task_num}: Task '{task_name}' references secrets "
+            f"but has no no_log. Add `no_log: true` or "
+            f'`no_log: "{{{{ not (debug_mode | default(false) | bool) }}}}"` '
+            f"to prevent credential leakage in Ansible output."
+        )
+
+    return violations
+
+
+def check_directory(ansible_dir: Path) -> list[str]:
+    """Check all Ansible task files in a directory tree."""
+    all_violations: list[str] = []
+
+    # Find all task files
+    task_files = list(ansible_dir.rglob("tasks/*.yml"))
+    task_files += list(ansible_dir.rglob("tasks/*.yaml"))
+    # Also check playbook files
+    task_files += list(ansible_dir.glob("playbooks/*.yml"))
+
+    for task_file in sorted(task_files):
+        # Skip molecule test files
+        if "molecule" in task_file.parts:
+            continue
+
+        try:
+            with task_file.open() as f:
+                docs = list(yaml.safe_load_all(f))
+        except (yaml.YAMLError, OSError):
+            continue
+
+        for doc in docs:
+            if not doc:
+                continue
+
+            # Task files are bare lists of tasks; playbook files are
+            # lists of plays (each play is a dict with 'hosts' key)
+            if isinstance(doc, list):
+                is_plays = isinstance(doc[0], dict) and "hosts" in doc[0]
+                if not is_plays:
+                    for i, task in enumerate(doc):
+                        if not isinstance(task, dict):
+                            continue
+                        all_violations.extend(_check_task(task, task_file, i + 1))
+                    continue
+                plays = doc
+            elif isinstance(doc, dict):
+                plays = [doc]
+            else:
+                continue
+
+            for play in plays:
+                if not isinstance(play, dict):
+                    continue
+                for task_section in ("tasks", "pre_tasks", "post_tasks", "handlers"):
+                    tasks = play.get(task_section, [])
+                    if not isinstance(tasks, list):
+                        continue
+                    for i, task in enumerate(tasks):
+                        if not isinstance(task, dict):
+                            continue
+                        all_violations.extend(_check_task(task, task_file, i + 1))
+
+    return all_violations
+
 
 @click.command()
 @click.option(
@@ -55,7 +216,7 @@ def main(path: Path | None, ansible_dir: Path | None) -> None:
         click.echo(f"Error: {target} is not a directory", err=True)
         sys.exit(2)
 
-    violations = check_no_log(target)
+    violations = check_directory(target)
 
     if violations:
         click.echo(f"Found {len(violations)} task(s) handling secrets without no_log:\n")

src/devx/tools/check_ansible_no_state_absent_on_db.py

@@ -1,10 +1,18 @@
 """Check Ansible tasks for ``state: absent`` on database data directories.
 
-Thin wrapper around
-:mod:`devx.tools.ansible_checks.no_state_absent_on_db` for backward
-compatibility. The check logic lives in the subpackage; this module
-preserves the CLI entry point and re-exports the internal helpers so
-existing tests and imports continue to work.
+This is a static analysis lint check that runs in CI (``make lint-ci``)
+to prevent the class of bug that caused the 2026-07-22 production outage
+(ADR-0028): a ``state: absent`` on a PostgreSQL data directory path that
+fired on every deploy and wiped the ZITADEL database.
+
+The existing unit test ``scripts/tests/test_no_zitadel_db_wipe.py`` covers
+the same concern as a regression test. This lint check runs earlier in
+the pipeline (before tests) and covers ALL roles and playbooks, not just
+the ZITADEL role.
+
+Allowed contexts (where DB recreation is legitimate):
+- PostgreSQL major version upgrades (``upgrade-postgres``, ``PG_VERSION``)
+- Explicit ``# lint:allow-state-absent`` comment on the task
 
 Usage::
 
@@ -16,27 +24,114 @@ Exit code 0 if no violations found, 1 otherwise.
 
 from __future__ import annotations
 
+import re
 import sys
 from pathlib import Path
 
 import click
 
-from devx.tools.ansible_checks.no_state_absent_on_db import (
-    ALLOW_MARKER,  # noqa: F401 — re-exported for backward compat
-    ALLOWED_CONTEXT_KEYWORDS,  # noqa: F401
-    DB_PATH_PATTERNS,  # noqa: F401
-    DESTRUCTIVE_PATTERNS,  # noqa: F401
-    REPO_ROOT,
-    _check_file,  # noqa: F401
-    _find_task_files,  # noqa: F401
-    check_no_state_absent_on_db,  # noqa: F401
-)
-
+REPO_ROOT = Path.cwd()
 DEFAULT_ANSIBLE_DIRS: list[Path] = [
     REPO_ROOT / "ansible" / "playbooks",
     REPO_ROOT / "ansible" / "roles",
 ]
 
+# Database data directory path patterns.
+# These match the DIRECTORY path, not individual files within it.
+# Removing a stale config file (e.g. postgresql.conf) is safe; removing
+# the entire data directory is not.
+DB_PATH_PATTERNS = (
+    re.compile(r"postgres/zitadel-db", re.IGNORECASE),
+    re.compile(r"postgres/\w+-db", re.IGNORECASE),
+    re.compile(r"/var/lib/postgresql/data", re.IGNORECASE),
+    re.compile(r"/var/lib/postgresql/data/\w+-db", re.IGNORECASE),
+)
+
+# Destructive operations
+DESTRUCTIVE_PATTERNS = (
+    re.compile(r"state:\s*absent", re.IGNORECASE),
+    re.compile(r"rm\s+-rf.*\bdb\b", re.IGNORECASE),
+)
+
+# Allowed contexts where DB recreation is legitimate
+ALLOWED_CONTEXT_KEYWORDS = (
+    "upgrade-postgres",
+    "PG_VERSION",
+    "pg_version",
+)
+
+# Comment marker to explicitly allow state: absent on a specific task
+ALLOW_MARKER = "lint:allow-state-absent"
+
+
+def _find_task_files(base: Path) -> list[Path]:
+    """Find all YAML task files under a base directory, skipping molecule."""
+    if base.is_file() and base.suffix in (".yml", ".yaml"):
+        return [base]
+    if not base.is_dir():
+        return []
+    files: list[Path] = []
+    for f in sorted(base.rglob("*.yml")) + sorted(base.rglob("*.yaml")):
+        if "molecule" in f.parts:
+            continue
+        files.append(f)
+    return files
+
+
+def _check_file(filepath: Path, repo_root: Path) -> list[str]:
+    """Check a YAML file for state: absent on DB data directory paths.
+
+    Returns a list of violation messages (empty if clean).
+    """
+    try:
+        content = filepath.read_text(encoding="utf-8")
+    except (OSError, UnicodeDecodeError):
+        return []
+
+    # Quick check: if no DB path pattern appears anywhere, skip
+    if not any(p.search(content) for p in DB_PATH_PATTERNS):
+        return []
+
+    try:
+        display_path = filepath.relative_to(repo_root)
+    except ValueError:
+        display_path = filepath
+
+    violations: list[str] = []
+    lines = content.splitlines()
+
+    for i, line in enumerate(lines):
+        for db_pattern in DB_PATH_PATTERNS:
+            if not db_pattern.search(line):
+                continue
+
+            # Check surrounding context (±5 lines) for destructive operations
+            context_start = max(0, i - 5)
+            context_end = min(len(lines), i + 6)
+            context = "\n".join(lines[context_start:context_end])
+
+            # Skip if in an allowed context (PG upgrade)
+            if any(kw in context for kw in ALLOWED_CONTEXT_KEYWORDS):
+                continue
+
+            # Skip if the allow marker comment is in the context
+            if ALLOW_MARKER in context:
+                continue
+
+            for dp in DESTRUCTIVE_PATTERNS:
+                if dp.search(context):
+                    violations.append(
+                        f"{display_path}:{i + 1} — destructive operation "
+                        f"({dp.pattern!r}) near DB data directory path "
+                        f"({db_pattern.pattern!r}). "
+                        f"Database directories must never be wiped automatically (ADR-0028). "
+                        f"If this is legitimate (e.g. PG upgrade), add "
+                        f"#{ALLOW_MARKER} to the task."
+                    )
+                    break
+
+    return violations
+
 
 @click.command()
 @click.option(
@@ -55,7 +150,16 @@ DEFAULT_ANSIBLE_DIRS: list[Path] = [
 def main(path: Path | None, ansible_dirs: tuple[Path, ...]) -> None:
     """Check that no Ansible task uses state: absent on a DB data directory."""
     dirs = list(ansible_dirs) if ansible_dirs else DEFAULT_ANSIBLE_DIRS
-    all_violations = check_no_state_absent_on_db(path) if path else check_no_state_absent_on_db(None, dirs)
+    if path:
+        files = _find_task_files(path)
+    else:
+        files: list[Path] = []
+        for d in dirs:
+            files.extend(_find_task_files(d))
+
+    all_violations: list[str] = []
+    for f in files:
+        all_violations.extend(_check_file(f, REPO_ROOT))
 
     if all_violations:
         click.echo("[check-ansible-no-state-absent-on-db] FAIL: destructive operations on DB paths:")

src/devx/tools/check_ansible_patterns.py

@@ -1,9 +1,18 @@
 """Check Ansible tasks for dangerous patterns that mask failures.
 
-Thin wrapper around :mod:`devx.tools.ansible_checks.patterns` for
-backward compatibility. The check logic lives in the subpackage; this
-module preserves the CLI entry point and re-exports the internal
-helpers so existing tests and imports continue to work.
+This check addresses the gap identified in the testing-strategy audit:
+the automated PR review only checks Python files, and ``ansible-lint``
+runs at ``profile: basic`` which does not catch dangerous patterns like:
+
+- ``|| true`` on tasks that are NOT cleanup/idempotency operations
+- ``failed_when: false`` on critical tasks (e.g. DB operations)
+- ``2>/dev/null`` on tasks where stderr contains important diagnostics
+
+Most ``|| true`` and ``2>/dev/null`` instances in the codebase are
+legitimate (container removal, journalctl, apt-get, docker prune, SUID
+removal). This check flags only instances that are NOT in a known-safe
+context. Tasks can also opt out with a ``# lint:allow-failure-masking``
+comment.
 
 Usage::
 
@@ -15,36 +24,284 @@ Exit code 0 if no violations found, 1 otherwise.
 
 from __future__ import annotations
 
+import re
 import sys
 from pathlib import Path
 
 import click
+import yaml
 
-from devx.tools.ansible_checks.patterns import (
-    ALLOW_MARKER,  # noqa: F401 — re-exported for backward compat
-    COMMAND_VALUE_KEYS,  # noqa: F401
-    CRITICAL_TASK_KEYWORDS,  # noqa: F401
-    LEGITIMATE_COMMAND_PREFIXES,  # noqa: F401
-    LEGITIMATE_FAILED_WHEN_KEYWORDS,  # noqa: F401
-    LEGITIMATE_TASK_NAME_KEYWORDS,  # noqa: F401
-    OR_TRUE_PATTERN,  # noqa: F401
-    REDIRECT_DEVNULL_PATTERN,  # noqa: F401
-    REPO_ROOT,
-    SHELL_MODULE_KEYS,  # noqa: F401
-    _check_file,  # noqa: F401
-    _check_task,  # noqa: F401
-    _check_tasks,  # noqa: F401
-    _find_task_files,  # noqa: F401
-    _is_legitimate_devnull,  # noqa: F401
-    _is_legitimate_or_true,  # noqa: F401
-    check_patterns,  # noqa: F401
-)
-
+REPO_ROOT = Path.cwd()
 DEFAULT_ANSIBLE_DIRS: list[Path] = [
     REPO_ROOT / "ansible" / "playbooks",
     REPO_ROOT / "ansible" / "roles",
 ]
 
+# Comment marker to explicitly allow a pattern on a specific task
+ALLOW_MARKER = "lint:allow-failure-masking"
+
+# Patterns that mask failures when used in shell/command tasks
+OR_TRUE_PATTERN = re.compile(r"\|\|\s*true\b", re.IGNORECASE)
+REDIRECT_DEVNULL_PATTERN = re.compile(r"2>/dev/null")
+
+# Module keys that accept shell/command strings
+SHELL_MODULE_KEYS = frozenset(
+    {
+        "shell",
+        "command",
+        "ansible.builtin.shell",
+        "ansible.builtin.command",
+        "cmd",
+        "ansible.builtin.raw",
+        "raw",
+    }
+)
+
+# Task keys whose values might contain shell commands
+COMMAND_VALUE_KEYS = frozenset(
+    {
+        "shell",
+        "command",
+        "ansible.builtin.shell",
+        "ansible.builtin.command",
+        "cmd",
+        "raw",
+        "ansible.builtin.raw",
+    }
+)
+
+# Legitimate contexts where || true or 2>/dev/null are safe.
+# These are command prefixes or task names that indicate cleanup/idempotency.
+LEGITIMATE_COMMAND_PREFIXES = (
+    # Container/process removal (may not exist)
+    "docker rm",
+    "docker stop",
+    "docker rmi",
+    "docker network rm",
+    "docker volume rm",
+    "pkill",
+    "kill",
+    # Cleanup commands that are expected to sometimes fail
+    "journalctl --vacuum",
+    "apt-get clean",
+    "apt-get autoremove",
+    "docker image prune",
+    "docker container prune",
+    "docker volume prune",
+    "docker builder prune",
+    "find / -name",
+    # SUID removal (binaries may not exist)
+    "chmod",
+    "rm -f",
+    # Network connection checks (may fail if not connected)
+    "docker network connect",
+    # Prometheus snapshot API (may fail if no snapshot)
+    "curl.*api/v2/admin/tsdb/snapshot",
+)
+
+LEGITIMATE_TASK_NAME_KEYWORDS = (
+    "remove",
+    "cleanup",
+    "clean up",
+    "prune",
+    "purge",
+    "disconnect",
+    "stop",
+    "kill",
+    "strip suid",
+    "suid",
+    "vacuum",
+    "ensure.*absent",
+    "may not exist",
+    "if exists",
+    "optional",
+    "best effort",
+    "no-op",
+    "noop",
+    "idempotent",
+    "sync",
+)
+
+# Tasks with failed_when: false that are critical and should not mask failures.
+# Only flag operations that SHOULD fail loudly — writing secrets, provisioning
+# users, creating OIDC apps. Do NOT flag stop/start/check/wait/migrate/restore
+# operations where failed_when: false is legitimate (container may not exist,
+# may already be stopped, etc.).
+CRITICAL_TASK_KEYWORDS = (
+    "password",
+    "secret",
+    "provision",
+    "oidc",
+)
+
+# Task name keywords that indicate failed_when: false is legitimate
+LEGITIMATE_FAILED_WHEN_KEYWORDS = (
+    "stop",
+    "start",
+    "check",
+    "wait",
+    "migrate",
+    "restart",
+    "rebuild",
+    "restore",
+    "remove",
+    "cleanup",
+    "sync",
+    "download",
+    "extract",
+    "verify",
+)
+
+
+def _is_legitimate_or_true(command_str: str, task_name: str) -> bool:
+    """Check if a || true in a command is in a legitimate context."""
+    # Check task name for legitimate keywords
+    name_lower = task_name.lower()
+    if any(re.search(kw, name_lower) for kw in LEGITIMATE_TASK_NAME_KEYWORDS):
+        return True
+
+    # Check command prefix for legitimate patterns
+    cmd_lower = command_str.lower()
+    return any(re.search(prefix, cmd_lower) for prefix in LEGITIMATE_COMMAND_PREFIXES)
+
+
+def _is_legitimate_devnull(command_str: str, task_name: str) -> bool:
+    """Check if a 2>/dev/null in a command is in a legitimate context."""
+    # 2>/dev/null is almost always safe — it suppresses stderr noise.
+    # Only flag it if the task is critical (DB, backup, OIDC) AND
+    # there's no || true (which is the more dangerous pattern).
+    return _is_legitimate_or_true(command_str, task_name)
+
+
+def _check_task(task: dict, filepath: Path, task_num: int, repo_root: Path) -> list[str]:
+    """Check a single task for dangerous failure-masking patterns."""
+    violations: list[str] = []
+
+    try:
+        display_path = filepath.relative_to(repo_root)
+    except ValueError:
+        display_path = filepath
+
+    task_name = task.get("name", "<unnamed>")
+
+    # Check for the allow marker in the task name
+    # (YAML comments are not preserved by safe_load, so we check the
+    # task name for the marker as a workaround)
+    if ALLOW_MARKER in task_name:
+        return violations
+
+    # Check for || true in command/shell values
+    for key in COMMAND_VALUE_KEYS:
+        value = task.get(key)
+        if value is None:
+            continue
+        value_str = str(value)
+        if OR_TRUE_PATTERN.search(value_str) and not _is_legitimate_or_true(value_str, task_name):
+            violations.append(
+                f"{display_path}:{task_num} — task '{task_name}' uses "
+                f"'|| true' in {key} which may mask real failures. "
+                f"If this is a cleanup/idempotency operation, rename the "
+                f"task to include 'remove'/'cleanup'/'prune' or add "
+                f"#{ALLOW_MARKER} to the task."
+            )
+
+    # Check for failed_when: false on critical tasks
+    failed_when = task.get("failed_when")
+    if failed_when is False:
+        name_lower = task_name.lower()
+        # Skip if the task name indicates a legitimate failed_when: false context
+        is_legitimate = any(kw in name_lower for kw in LEGITIMATE_FAILED_WHEN_KEYWORDS)
+        if not is_legitimate:
+            for kw in CRITICAL_TASK_KEYWORDS:
+                if kw in name_lower:
+                    violations.append(
+                        f"{display_path}:{task_num} — critical task '{task_name}' "
+                        f"has failed_when: false, which masks failures on "
+                        f"a {kw}-related operation. Remove failed_when: false "
+                        f"or add #{ALLOW_MARKER} if masking is intentional."
+                    )
+                    break
+
+    return violations
+
+
+def _check_file(filepath: Path, repo_root: Path) -> list[str]:
+    """Check a YAML file for dangerous failure-masking patterns."""
+    try:
+        content = filepath.read_text(encoding="utf-8")
+    except (OSError, UnicodeDecodeError):
+        return []
+
+    # Quick check: if no patterns appear, skip
+    if not (
+        OR_TRUE_PATTERN.search(content) or "failed_when: false" in content or REDIRECT_DEVNULL_PATTERN.search(content)
+    ):
+        return []
+
+    # Check for allow markers in comments
+    has_allow_marker = ALLOW_MARKER in content
+
+    try:
+        docs = list(yaml.safe_load_all(content))
+    except yaml.YAMLError:
+        return []
+
+    violations: list[str] = []
+
+    for doc in docs:
+        if not doc:
+            continue
+        if isinstance(doc, list):
+            for i, item in enumerate(doc):
+                if isinstance(item, dict):
+                    if any(k in item for k in ("tasks", "pre_tasks", "post_tasks", "handlers")):
+                        _check_tasks(item, filepath, violations, repo_root)
+                    else:
+                        violations.extend(_check_task(item, filepath, i + 1, repo_root))
+                        block = item.get("block")
+                        if isinstance(block, list):
+                            for j, bt in enumerate(block):
+                                if isinstance(bt, dict):
+                                    violations.extend(_check_task(bt, filepath, i + j + 1, repo_root))
+        elif isinstance(doc, dict):
+            _check_tasks(doc, filepath, violations, repo_root)
+
+    # Filter out violations if the allow marker is present in the file
+    # (coarse-grained opt-out for files with many legitimate uses)
+    if has_allow_marker:
+        violations = []
+
+    return violations
+
+
+def _check_tasks(doc: dict, filepath: Path, errors: list[str], repo_root: Path) -> None:
+    """Check top-level tasks and nested task sections in a playbook doc."""
+    for section_key in ("tasks", "pre_tasks", "post_tasks", "handlers"):
+        section = doc.get(section_key)
+        if isinstance(section, list):
+            for i, task in enumerate(section):
+                if isinstance(task, dict):
+                    errors.extend(_check_task(task, filepath, i + 1, repo_root))
+                    block = task.get("block")
+                    if isinstance(block, list):
+                        for j, bt in enumerate(block):
+                            if isinstance(bt, dict):
+                                errors.extend(_check_task(bt, filepath, i + j + 1, repo_root))
+
+
+def _find_task_files(base: Path) -> list[Path]:
+    """Find all YAML task files under a base directory, skipping molecule."""
+    if base.is_file() and base.suffix in (".yml", ".yaml"):
+        return [base]
+    if not base.is_dir():
+        return []
+    files: list[Path] = []
+    for f in sorted(base.rglob("*.yml")) + sorted(base.rglob("*.yaml")):
+        if "molecule" in f.parts:
+            continue
+        files.append(f)
+    return files
+
 
 @click.command()
 @click.option(
@@ -63,7 +320,16 @@ DEFAULT_ANSIBLE_DIRS: list[Path] = [
 def main(path: Path | None, ansible_dirs: tuple[Path, ...]) -> None:
     """Check Ansible tasks for dangerous failure-masking patterns."""
     dirs = list(ansible_dirs) if ansible_dirs else DEFAULT_ANSIBLE_DIRS
-    all_violations = check_patterns(path) if path else check_patterns(None, dirs)
+    if path:
+        files = _find_task_files(path)
+    else:
+        files: list[Path] = []
+        for d in dirs:
+            files.extend(_find_task_files(d))
+
+    all_violations: list[str] = []
+    for f in files:
+        all_violations.extend(_check_file(f, REPO_ROOT))
 
     if all_violations:
         click.echo("[check-ansible-patterns] FAIL: dangerous failure-masking patterns found:")

src/devx/tools/check_ansible_set_fact_to_json.py

@@ -1,9 +1,19 @@
 """Check that Ansible ``set_fact`` tasks don't misuse ``| to_json``.
 
-Thin wrapper around :mod:`devx.tools.ansible_checks.set_fact_to_json`
-for backward compatibility. The check logic lives in the subpackage;
-this module preserves the CLI entry point and re-exports the internal
-helpers so existing tests and imports continue to work.
+This prevents the class of bug where ``set_fact`` tasks use
+``{{ targets | to_json }}`` to store Python lists, but ``to_json``
+converts native types to JSON strings. Ansible then stored the result
+as a string, so iterating over the fact yielded individual characters
+instead of list items, causing ``object of type 'str' has no attribute
+'ip'`` errors.
+
+The check scans all Ansible task files (playbooks and role tasks) for
+``set_fact`` tasks where any value uses ``| to_json`` or ``| to_nice_json``
+and flags them as potential bugs.
+
+``| to_json`` is legitimate in Jinja2 templates (e.g., rendering JSON
+config files) but almost never correct in ``set_fact`` — the fact should
+store the native Python type so downstream tasks can iterate/index it.
 
 Usage::
 
@@ -19,23 +29,130 @@ import sys
 from pathlib import Path
 
 import click
+import yaml
 
-from devx.tools.ansible_checks.set_fact_to_json import (
-    REPO_ROOT,
-    TO_JSON_FILTERS,  # noqa: F401 — re-exported for backward compat
-    _check_file,  # noqa: F401
-    _check_task,  # noqa: F401
-    _check_task_list,  # noqa: F401
-    _check_tasks,  # noqa: F401
-    _find_task_files,  # noqa: F401
-    check_set_fact_to_json,  # noqa: F401
-)
-
+REPO_ROOT = Path.cwd()
 DEFAULT_ANSIBLE_DIRS: list[Path] = [
     REPO_ROOT / "ansible" / "playbooks",
     REPO_ROOT / "ansible" / "roles",
 ]
 
+TO_JSON_FILTERS = ("| to_json", "| to_nice_json", "|to_json", "|to_nice_json")
+
+
+def _find_task_files(base: Path) -> list[Path]:
+    """Find all YAML task files under a base directory."""
+    if base.is_file() and base.suffix in (".yml", ".yaml"):
+        return [base]
+    if not base.is_dir():
+        return []
+    return sorted(base.rglob("*.yml")) + sorted(base.rglob("*.yaml"))
+
+
+def _check_file(filepath: Path, repo_root: Path) -> list[str]:
+    """Check a single YAML file for set_fact + to_json misuse.
+
+    Returns a list of error messages (empty if all OK).
+    """
+    errors: list[str] = []
+    content = filepath.read_text(encoding="utf-8")
+
+    # Multi-document YAML (--- separators) is common in playbooks
+    try:
+        docs = list(yaml.safe_load_all(content))
+    except yaml.YAMLError as exc:
+        return [f"{filepath}: cannot parse YAML: {exc}"]
+
+    for doc in docs:
+        if isinstance(doc, list):
+            # Could be a playbook (list of plays) or a role tasks file (list of tasks)
+            for item in doc:
+                if isinstance(item, dict):
+                    if any(k in item for k in ("tasks", "pre_tasks", "post_tasks", "handlers", "roles")):
+                        # It's a play
+                        _check_tasks(item, filepath, errors, repo_root)
+                    else:
+                        # It's a bare task (role tasks file)
+                        _check_task(item, filepath, errors, repo_root)
+                        block = item.get("block")
+                        if isinstance(block, list):
+                            _check_task_list(block, filepath, errors, repo_root)
+        elif isinstance(doc, dict):
+            # Role tasks file or single play — _check_tasks handles all task sections
+            _check_tasks(doc, filepath, errors, repo_root)
+
+    return errors
+
+
+def _check_tasks(doc: dict, filepath: Path, errors: list[str], repo_root: Path) -> None:
+    """Check top-level tasks and nested task sections in a playbook doc."""
+    tasks = doc.get("tasks")
+    if isinstance(tasks, list):
+        _check_task_list(tasks, filepath, errors, repo_root)
+    for role_key in ("pre_tasks", "post_tasks", "handlers"):
+        section = doc.get(role_key)
+        if isinstance(section, list):
+            _check_task_list(section, filepath, errors, repo_root)
+    # Check tasks in roles imported via `roles:` key
+    roles = doc.get("roles")
+    if isinstance(roles, list):
+        for role_entry in roles:
+            if isinstance(role_entry, dict):
+                role_tasks = role_entry.get("tasks")
+                if isinstance(role_tasks, list):
+                    _check_task_list(role_tasks, filepath, errors, repo_root)
+
+
+def _check_task_list(tasks: list, filepath: Path, errors: list[str], repo_root: Path) -> None:
+    """Check a list of task definitions for set_fact + to_json."""
+    for task in tasks:
+        if not isinstance(task, dict):
+            continue
+        _check_task(task, filepath, errors, repo_root)
+        # Check nested block tasks
+        block = task.get("block")
+        if isinstance(block, list):
+            _check_task_list(block, filepath, errors, repo_root)
+
+
+def _check_task(task: dict, filepath: Path, errors: list[str], repo_root: Path) -> None:
+    """Check a single task for set_fact + to_json misuse."""
+    # Detect set_fact — could be a module name key or ansible.builtin.set_fact
+    has_set_fact = False
+    for key in task:
+        if key in {"set_fact", "ansible.builtin.set_fact"}:
+            has_set_fact = True
+            break
+
+    if not has_set_fact:
+        return
+
+    set_fact_body = task.get("set_fact") or task.get("ansible.builtin.set_fact")
+    if not isinstance(set_fact_body, dict):
+        return
+
+    task_name = task.get("name", "(unnamed)")
+
+    for fact_name, fact_value in set_fact_body.items():
+        if fact_name in ("cacheable",):
+            continue
+        value_str = str(fact_value)
+        for filter_pattern in TO_JSON_FILTERS:
+            if filter_pattern in value_str:
+                try:
+                    display_path = filepath.relative_to(repo_root)
+                except ValueError:
+                    display_path = filepath
+                errors.append(
+                    f"{display_path}: task '{task_name}' "
+                    f"sets fact '{fact_name}' with '{filter_pattern.strip()}' "
+                    f"— this converts native Python types to JSON strings. "
+                    f"Remove the filter to preserve the native type, or use "
+                    f"'| from_json' in the consuming task if the string "
+                    f"representation is intentional."
+                )
+                break  # One error per fact is enough
+
 
 @click.command()
 @click.option(
@@ -54,7 +171,17 @@ DEFAULT_ANSIBLE_DIRS: list[Path] = [
 def main(path: Path | None, ansible_dirs: tuple[Path, ...]) -> None:
     """Check that set_fact tasks don't misuse to_json."""
     dirs = list(ansible_dirs) if ansible_dirs else DEFAULT_ANSIBLE_DIRS
-    all_errors = check_set_fact_to_json(path) if path else check_set_fact_to_json(None, dirs)
+    if path:
+        files = _find_task_files(path)
+    else:
+        files: list[Path] = []
+        for d in dirs:
+            files.extend(_find_task_files(d))
+
+    all_errors: list[str] = []
+    for f in files:
+        errors = _check_file(f, REPO_ROOT)
+        all_errors.extend(errors)
 
     if all_errors:
         click.echo("[check-ansible-set-fact-to-json] FAIL: set_fact with to_json found:")

src/devx/tools/check_jinja_expr.py

@@ -1,9 +1,15 @@
 """Validate Jinja2 expressions in Ansible files by rendering them.
 
-Thin wrapper around :mod:`devx.tools.ansible_checks.jinja_expr` for
-backward compatibility. The check logic lives in the subpackage; this
-module preserves the CLI entry point and re-exports the internal
-helpers so existing tests and imports continue to work.
+Extracts ``{{ ... }}`` expressions from Ansible YAML files and renders
+each one with Ansible's Jinja2 environment using mock variables. Catches
+errors like reversed filter arguments, undefined filters, and syntax
+errors before pushing to CI.
+
+The check is intentionally lightweight — it doesn't need real Ansible
+facts or variables. It provides common mock values (now(), ansible_*,
+etc.) and renders each expression in isolation. Expressions that fail
+with undefined variables that aren't in the mock set are skipped (not
+all variables can be predicted).
 
 Usage::
 
@@ -15,21 +21,233 @@ Exit code 0 if all renderable expressions pass, 1 if any fail.
 
 from __future__ import annotations
 
+import re
 import sys
 from pathlib import Path
 
 import click
+from jinja2 import Environment
+from jinja2.exceptions import TemplateSyntaxError, UndefinedError
 
-from devx.tools.ansible_checks.jinja_expr import (
-    EXPR_PATTERN,  # noqa: F401 — re-exported for backward compat
-    MOCK_CONTEXT,  # noqa: F401
-    _check_file,  # noqa: F401
-    _default_ansible_dirs,  # noqa: F401
-    _extract_expressions,  # noqa: F401
-    _find_yaml_files,  # noqa: F401
-    _render_expression,  # noqa: F401
-    check_jinja_expr,  # noqa: F401
-)
+REPO_ROOT = Path.cwd()
+
+
+def _default_ansible_dirs() -> list[Path]:
+    """Return the default directories to scan for Ansible files."""
+    return [
+        REPO_ROOT / "ansible" / "playbooks",
+        REPO_ROOT / "ansible" / "roles",
+    ]
+
+
+# Mock context for rendering Jinja expressions.
+MOCK_CONTEXT: dict[str, object] = {
+    "now": lambda fmt=None: (
+        "2026-01-01T00:00:00+00:00"
+        if fmt
+        else type(
+            "Now",
+            (),
+            {
+                "timestamp": lambda self: 1735689600.0,
+                "strftime": lambda self, fmt: "2026-01-01T00:00:00+00:00",
+            },
+        )()
+    ),
+    "ansible_date_time": {
+        "iso8601": "2026-01-01T00:00:00+00:00",
+        "epoch": "1735689600",
+    },
+    "ansible_facts": {
+        "service_mgr": "systemd",
+        "architecture": "x86_64",
+        "distribution_release": "noble",
+        "virtualization_type": "none",
+        "interfaces": ["eth0", "lo"],
+        "hostname": "test-host",
+    },
+    "ansible_host": "10.0.0.1",
+    "env": "staging",
+    "environment": "staging",
+    "customer_id": "test",
+    "zitadel_domain": "zitadel.test",
+    "_env_name": "staging",
+    "_observability_data_root": "/opt",
+    "skip_zitadel_stack": False,
+    "skip_htpasswd": False,
+    "skip_observability_stack": False,
+    "backup_enabled": True,
+    "app_filter": "",
+    "app_domain": "test.example.com",
+    "oidc_client_id": "test-client-id",
+    "oidc_client_secret": "test-secret",  # nosec B105 — mock value for Jinja rendering, not a real secret
+    "s3_backup_bucket": "test-bucket",
+    "s3_endpoint": "https://s3.test",
+    "s3_access_key": "test-key",
+    "s3_secret_key": "test-secret",  # nosec B105 — mock value for Jinja rendering, not a real secret
+}
+
+# Pattern to find {{ ... }} expressions (non-greedy, single-line).
+EXPR_PATTERN = re.compile(r"\{\{(.*?)\}\}", re.DOTALL)
+
+
+def _find_yaml_files(path: Path) -> list[Path]:
+    """Find Ansible YAML files (tasks, playbooks, handlers) in a path."""
+    if path.is_file():
+        return [path]
+    files: list[Path] = []
+    for pattern in ["**/*.yml", "**/*.yaml"]:
+        files.extend(path.glob(pattern))
+    # Exclude molecule scenarios — they have their own variables.
+    return [f for f in files if "molecule" not in f.parts]
+
+
+def _extract_expressions(content: str) -> list[str]:
+    """Extract Jinja expressions from file content.
+
+    Filters out Go template syntax (``{{.Field}}``) used in docker
+    inspect --format strings, and single-character fragments from
+    quoted strings that aren't real Jinja expressions.
+    """
+    expressions = []
+    for match in EXPR_PATTERN.finditer(content):
+        raw = match.group(1)
+        # Skip multi-line expressions (often have YAML formatting artifacts).
+        if "\n" in raw:
+            continue
+        expr = raw.strip()
+        # Skip empty, control flow, and single-char fragments.
+        if not expr or expr.startswith("%") or len(expr) <= 1:
+            continue
+        # Skip Go template syntax (docker inspect --format).
+        if expr.startswith(".") or "println" in expr:
+            continue
+        # Skip expressions containing Go template dot-access patterns.
+        if ".State." in expr or ".NetworkSettings." in expr:
+            continue
+        # Skip expressions with unbalanced parens/brackets/braces —
+        # the regex captured only part of a larger expression where
+        # }} appears inside a dict literal (e.g. default({'k': {}})).
+        if expr.count("(") != expr.count(")"):
+            continue
+        if expr.count("{") != expr.count("}"):
+            continue
+        if expr.count("[") != expr.count("]"):
+            continue
+        expressions.append(expr)
+    return expressions
+
+
+def _render_expression(expr: str) -> tuple[bool, str]:
+    """Try to render a Jinja expression. Returns (success, error_msg)."""
+    try:
+        env = Environment(autoescape=False, keep_trailing_newline=True)  # nosec B701 — Ansible Jinja, not web-facing  # noqa: S701
+
+        # Add common Ansible filters so expressions can render.
+        # strftime: Ansible's signature is strftime(string_format, second, utc)
+        # where string_format is the piped value. If the piped value looks like
+        # a number (epoch) and second looks like a format string, the args are
+        # reversed — this is the exact bug from OBL-INFRA-508.
+        def _strftime(string_format: str, second: float | None = None, utc: bool = False) -> str:
+            if isinstance(string_format, (int, float)) and isinstance(second, str) and "%" in second:
+                raise ValueError(  # noqa: TRY301
+                    "Invalid value for epoch value — strftime filter arguments "
+                    "are reversed. The format string must be the piped value: "
+                    "'%format%' | strftime(epoch), not epoch | strftime('%format%')"
+                )
+            return str(string_format)
+
+        env.filters["strftime"] = _strftime
+        env.filters["b64decode"] = lambda x: x
+        env.filters["b64encode"] = lambda x: x
+        env.filters["regex_replace"] = lambda x, pattern, replacement="": x
+        env.filters["int"] = lambda x, default=0: (
+            int(x) if isinstance(x, (int, float, str)) and str(x).lstrip("-").isdigit() else default
+        )
+        env.filters["bool"] = bool
+        env.filters["basename"] = lambda x: str(x).rsplit("/", 1)[-1]
+        env.filters["dirname"] = lambda x: str(x).rsplit("/", 1)[0] if "/" in str(x) else "."
+        env.filters["combine"] = lambda *args, **kwargs: args[0]
+        env.filters["from_json"] = lambda x: x
+        env.filters["to_json"] = lambda x: x
+        env.filters["ternary"] = lambda x, true_val, false_val=None: true_val if x else false_val
+        env.filters["dict2items"] = lambda x: [
+            {"key": k, "value": v} for k, v in (x.items() if isinstance(x, dict) else [])
+        ]
+        env.filters["map"] = lambda x, attribute=None: x
+        env.filters["default"] = lambda x, default_value="", boolean=False: x if x else default_value
+        env.filters["from_yaml"] = lambda x: x
+        env.filters["difference"] = lambda x, y: x
+        env.filters["join"] = lambda x, sep="": sep.join(str(i) for i in (x if isinstance(x, list) else [x]))
+        env.filters["list"] = lambda x: list(x) if isinstance(x, (list, tuple)) else [x]
+        env.filters["length"] = lambda x: len(x) if hasattr(x, "__len__") else 0
+        env.filters["items"] = lambda x: list(x.items()) if isinstance(x, dict) else []
+        env.filters["first"] = lambda x: x[0] if isinstance(x, (list, str)) and x else x
+        env.filters["last"] = lambda x: x[-1] if isinstance(x, (list, str)) and x else x
+        env.filters["upper"] = lambda x: str(x).upper()
+        env.filters["lower"] = lambda x: str(x).lower()
+        env.filters["replace"] = lambda x, old, new: str(x).replace(old, new)
+        env.filters["split"] = lambda x, sep=None: str(x).split(sep) if sep else str(x).split()
+        env.filters["trim"] = lambda x: str(x).strip()
+        env.filters["sort"] = lambda x: sorted(x) if isinstance(x, list) else x
+        env.filters["unique"] = lambda x: list(set(x)) if isinstance(x, list) else x
+        env.filters["count"] = lambda x: len(x) if hasattr(x, "__len__") else 0
+        env.filters["float"] = lambda x, default=0.0: (
+            float(x) if isinstance(x, (int, float, str)) and str(x).replace(".", "").lstrip("-").isdigit() else default
+        )
+        env.filters["string"] = str
+        env.filters["indent"] = lambda x, width=4: str(x)
+        env.filters["to_nice_json"] = str
+        env.filters["to_nice_yaml"] = str
+        env.filters["from_yaml_all"] = lambda x: x
+        env.filters["groupby"] = lambda x: x
+        env.filters["dictsort"] = lambda x: list(x.items()) if isinstance(x, dict) else []
+        env.filters["max"] = lambda x: max(x) if isinstance(x, list) and x else x
+        env.filters["min"] = lambda x: min(x) if isinstance(x, list) and x else x
+        env.filters["reverse"] = lambda x: list(reversed(x)) if isinstance(x, list) else x
+        env.filters["flatten"] = lambda x: x
+        env.filters["product"] = lambda x: x
+        env.filters["zip"] = lambda x: x
+        env.filters["subelements"] = lambda x: x
+        env.filters["json_query"] = lambda x: x
+        env.filters["type_debug"] = lambda x: type(x).__name__
+        env.globals["lookup"] = lambda *args, **kwargs: ""
+        env.globals["query"] = lambda *args, **kwargs: []
+
+        template = env.from_string("{{ " + expr + " }}")
+        result = template.render(**MOCK_CONTEXT)
+    except TemplateSyntaxError as e:
+        return False, f"Syntax error: {e.message}"
+    except UndefinedError as e:
+        # Undefined variable — skip, we can't mock everything.
+        return True, f"Skipped (undefined: {e})"
+    except Exception as e:
+        # Check if it's a filter argument error.
+        error_msg = str(e)
+        if "Invalid value for epoch" in error_msg:
+            return False, f"strftime filter argument error: {error_msg}"
+        # Other errors might be due to missing mock variables — skip.
+        return True, f"Skipped ({type(e).__name__}: {error_msg})"
+    else:
+        return True, result
+
+
+def _check_file(filepath: Path, repo_root: Path) -> list[str]:
+    """Check all Jinja expressions in a file. Returns list of violations."""
+    violations = []
+    content = filepath.read_text()
+    expressions = _extract_expressions(content)
+
+    for expr in expressions:
+        success, msg = _render_expression(expr)
+        if not success:
+            try:
+                rel_path = filepath.relative_to(repo_root)
+            except ValueError:
+                rel_path = filepath
+            violations.append(f"{rel_path}: `{{{{ {expr} }}}}` — {msg}")
+
+    return violations
 
 
 @click.command()
@@ -49,7 +267,16 @@ from devx.tools.ansible_checks.jinja_expr import (
 def main(path: Path | None, ansible_dirs: tuple[Path, ...]) -> None:
     """Validate Jinja2 expressions in Ansible files."""
     dirs = list(ansible_dirs) if ansible_dirs else _default_ansible_dirs()
-    all_violations = check_jinja_expr(path) if path else check_jinja_expr(None, dirs)
+    if path:
+        files = _find_yaml_files(path)
+    else:
+        files: list[Path] = []
+        for d in dirs:
+            files.extend(_find_yaml_files(d))
+
+    all_violations: list[str] = []
+    for f in files:
+        all_violations.extend(_check_file(f, REPO_ROOT))
 
     if all_violations:
         click.echo("[check-jinja-expr] FAIL: invalid Jinja expressions found:")

src/devx/tools/check_test_speed.py

@@ -11,6 +11,18 @@ Usage:
 The module runs ``make test-unit`` with ``PYTEST_ADDOPTS=--durations=0`` so
 that pytest emits per-test timing lines alongside the summary.  Both the
 total wall-clock time and individual test durations are parsed and validated.
+
+CI runner scaling
+-----------------
+CI runners (Gitea Actions Docker containers) are typically 5-8x slower than
+local development machines due to shared CPU, fewer cores, and container
+overhead.  When the ``CI`` environment variable is set (standard CI
+convention), both the total and per-test limits are multiplied by
+``CI_SCALE_FACTOR`` (default 6) to account for this.  This keeps the local
+budget strict while preventing false failures on slower CI runners.
+
+The scale factor can be overridden via the ``DEVX_CI_SCALE_FACTOR``
+environment variable.
 """
 
 from __future__ import annotations
@@ -27,6 +39,12 @@ DEFAULT_MAX_SECONDS = 10.0
 DEFAULT_MAX_SINGLE_SECONDS = 0.5
 TEST_COMMAND = ["make", "test-unit"]
 
+# CI runners are typically 5-8x slower than local machines (shared CPU,
+# fewer cores, container overhead).  Scale limits up when running on CI
+# so the gate catches real regressions, not infrastructure slowness.
+CI_SCALE_FACTOR = float(os.environ.get("DEVX_CI_SCALE_FACTOR", "6"))
+_IS_CI = bool(os.environ.get("CI") or os.environ.get("GITEA_ACTIONS"))
+
 # Matches pytest summary line: "234 passed in 0.70s"
 _TIMING_RE = re.compile(r"(\d+) passed.* in ([0-9.]+)s")
 
@@ -38,6 +56,13 @@ _TIMING_RE = re.compile(r"(\d+) passed.* in ([0-9.]+)s")
 _DURATION_LINE_RE = re.compile(r"^(\d+\.?\d*)s\s+call\s+(.+)$")
 
 
+def _ci_scale_limit(limit: float) -> float:
+    """Scale a time limit by the CI factor when running on CI."""
+    if _IS_CI:
+        return limit * CI_SCALE_FACTOR
+    return limit
+
+
 def run_tests() -> tuple[str, str]:
     """Execute the unit-test suite and return (stdout, stderr).
 
@@ -123,21 +148,38 @@ def check_per_test_speed(
 
 def main(max_seconds: float, max_single_seconds: float) -> None:
     """Run tests, parse timings, and enforce both budgets."""
+    # Scale limits for CI runners (slower CPU, fewer workers).
+    effective_max = _ci_scale_limit(max_seconds)
+    effective_single = _ci_scale_limit(max_single_seconds)
+
+    if _IS_CI:
+        click.echo(
+            _(
+                "[check-test-speed] CI environment detected — scaling limits by {factor}x "
+                "(total: {orig}s → {eff}s, per-test: {orig_s}s → {eff_s}s)",
+                factor=CI_SCALE_FACTOR,
+                orig=max_seconds,
+                eff=effective_max,
+                orig_s=max_single_seconds,
+                eff_s=effective_single,
+            )
+        )
+
     stdout, stderr = run_tests()
     combined = stdout + "\n" + stderr
     click.echo(combined, err=False)
 
     duration = parse_duration(combined)
-    check_speed(duration, max_seconds)
+    check_speed(duration, effective_max)
 
-    if max_single_seconds > 0:
+    if effective_single > 0:
         per_test = parse_per_test_durations(combined)
-        violations = check_per_test_speed(per_test, max_single_seconds)
+        violations = check_per_test_speed(per_test, effective_single)
         if violations:
             msg = _(
                 "Per-test speed check FAILED: {count} test(s) exceed {limit}s limit.",
                 count=len(violations),
-                limit=max_single_seconds,
+                limit=effective_single,
             )
             click.echo(f"\n{msg}", err=True)
             for v in violations:
@@ -148,8 +190,8 @@ def main(max_seconds: float, max_single_seconds: float) -> None:
         _(
             "Unit tests passed in {duration:.2f}s (under {max}s limit, all tests under {single}s per-test limit).",
             duration=duration,
-            max=max_seconds,
-            single=max_single_seconds,
+            max=effective_max,
+            single=effective_single,
         )
     )
 

src/devx/tools/install_tools.py

@@ -22,37 +22,18 @@ Usage::
 
 from __future__ import annotations
 
-import logging
 import os
 import platform
 import shutil
 import tarfile
 import tempfile
-import time
-import urllib.error
 import urllib.request
 from pathlib import Path
 
 import click
-from tenacity import (
-    Retrying,
-    before_sleep_log,
-    retry_if_exception_type,
-    stop_after_attempt,
-    wait_exponential,
-)
 
 TARGET_DIR = Path.home() / ".local" / "bin"
 
-logger = logging.getLogger(__name__)
-
-# Retry configuration for transient network failures during download.
-# GitHub releases occasionally drops connections ("Remote end closed
-# connection without response"). Retrying with backoff before falling
-# through to the next fallback URL makes the build resilient to
-# momentary network blips.
-MAX_DOWNLOAD_RETRIES = 3
-
 ACTIONLINT_VERSION = "1.7.12"
 
 GIT_CLIFF_VERSION = "2.13.1"
@@ -83,31 +64,14 @@ def _ensure_target_dir() -> Path:
     return TARGET_DIR
 
 
-def _download(url: str, dest: Path, *, _sleep=None) -> None:
-    """Download a file from ``url`` to ``dest`` with retry and 60s timeout.
+def _download(url: str, dest: Path) -> None:
+    """Download a file from ``url`` to ``dest`` with a 60s timeout.
 
-    Retries up to ``MAX_DOWNLOAD_RETRIES`` times on transient network
-    errors (``URLError``, ``OSError`` from connection resets) using
-    exponential backoff. This handles momentary GitHub releases
-    connection drops that were causing CI image builds to fail.
-
-    The ``_sleep`` kwarg is for tests to avoid real sleeping; production
-    code should leave it as ``None`` (uses ``time.sleep``).
+    A User-Agent header is set because some CDNs (e.g. dl.gitea.com)
+    return 403 to requests with Python's default User-Agent.
     """
-    retrying = Retrying(
-        stop=stop_after_attempt(MAX_DOWNLOAD_RETRIES),
-        wait=wait_exponential(multiplier=2, min=2, max=10),
-        retry=retry_if_exception_type((urllib.error.URLError, OSError, ConnectionError)),
-        before_sleep=before_sleep_log(logger, logging.WARNING),
-        sleep=_sleep if _sleep is not None else time.sleep,
-        reraise=True,
-    )
-    retrying(_do_download, url, dest)
-
-
-def _do_download(url: str, dest: Path) -> None:
-    """Single download attempt — called by :func:`_download` retry wrapper."""
-    with urllib.request.urlopen(url, timeout=60) as resp, open(dest, "wb") as f:  # nosec B310
+    req = urllib.request.Request(url, headers={"User-Agent": "devx/install-tools"})
+    with urllib.request.urlopen(req, timeout=60) as resp, open(dest, "wb") as f:  # nosec B310
         shutil.copyfileobj(resp, f)
 
 

src/devx/tools/setup_image.py

@@ -83,6 +83,17 @@ def _install_in_image(
             username,
             token,
         )
+        # Configure git URL rewrite so git+https dependencies can authenticate
+        subprocess.run(  # nosec B603, B607
+            [
+                "git",
+                "config",
+                "--global",
+                f"url.https://{username}:{token}@{gitea_host}/.insteadOf",
+                f"https://{gitea_host}/",
+            ],
+            check=True,
+        )
 
     click.echo(f"[setup-image] Linked {opt_venv}" + (f" with [{extras}]" if extras else "") + ".")
     subprocess.run(cmd, check=True, env=env)  # nosec B603

tests/unit/test_ansible_checks_shared.py

@@ -1,231 +0,0 @@
-"""Unit tests for devx.tools.ansible_checks._shared."""
-
-from pathlib import Path
-
-import pytest
-
-from devx.tools.ansible_checks._shared import (
-    DEFAULT_ANSIBLE_DIRS,
-    AnsibleFileFinder,
-    AnsibleYAMLParser,
-    ViolationReporter,
-)
-
-
-class TestAnsibleFileFinder:
-    def test_find_task_files_single_yaml(self, tmp_path: Path) -> None:
-        f = tmp_path / "test.yml"
-        f.write_text("tasks: []")
-        assert AnsibleFileFinder.find_task_files(f) == [f]
-
-    def test_find_task_files_single_non_yaml(self, tmp_path: Path) -> None:
-        f = tmp_path / "test.txt"
-        f.write_text("hello")
-        assert AnsibleFileFinder.find_task_files(f) == []
-
-    def test_find_task_files_dir(self, tmp_path: Path) -> None:
-        (tmp_path / "a.yml").write_text("tasks: []")
-        (tmp_path / "b.yaml").write_text("tasks: []")
-        (tmp_path / "c.txt").write_text("hello")
-        result = AnsibleFileFinder.find_task_files(tmp_path)
-        assert len(result) == 2
-        assert all(f.suffix in (".yml", ".yaml") for f in result)
-
-    def test_find_task_files_skip_molecule(self, tmp_path: Path) -> None:
-        (tmp_path / "a.yml").write_text("tasks: []")
-        mol = tmp_path / "molecule" / "default"
-        mol.mkdir(parents=True)
-        (mol / "main.yml").write_text("tasks: []")
-        result = AnsibleFileFinder.find_task_files(tmp_path, skip_molecule=True)
-        assert len(result) == 1
-        assert "molecule" not in result[0].parts
-
-    def test_find_task_files_include_molecule(self, tmp_path: Path) -> None:
-        (tmp_path / "a.yml").write_text("tasks: []")
-        mol = tmp_path / "molecule" / "default"
-        mol.mkdir(parents=True)
-        (mol / "main.yml").write_text("tasks: []")
-        result = AnsibleFileFinder.find_task_files(tmp_path, skip_molecule=False)
-        assert len(result) == 2
-
-    def test_find_task_files_nonexistent(self, tmp_path: Path) -> None:
-        assert AnsibleFileFinder.find_task_files(tmp_path / "nonexistent") == []
-
-    def test_find_yaml_files_single_file(self, tmp_path: Path) -> None:
-        f = tmp_path / "test.txt"
-        f.write_text("hello")
-        # find_yaml_files accepts any single file (no suffix check)
-        assert AnsibleFileFinder.find_yaml_files(f) == [f]
-
-    def test_find_yaml_files_dir(self, tmp_path: Path) -> None:
-        (tmp_path / "a.yml").write_text("tasks: []")
-        (tmp_path / "sub").mkdir()
-        (tmp_path / "sub" / "b.yaml").write_text("tasks: []")
-        result = AnsibleFileFinder.find_yaml_files(tmp_path)
-        assert len(result) == 2
-
-    def test_find_yaml_files_skip_molecule(self, tmp_path: Path) -> None:
-        (tmp_path / "a.yml").write_text("tasks: []")
-        mol = tmp_path / "molecule" / "default"
-        mol.mkdir(parents=True)
-        (mol / "main.yml").write_text("tasks: []")
-        result = AnsibleFileFinder.find_yaml_files(tmp_path, skip_molecule=True)
-        assert len(result) == 1
-
-    def test_find_yaml_files_include_molecule(self, tmp_path: Path) -> None:
-        (tmp_path / "a.yml").write_text("tasks: []")
-        mol = tmp_path / "molecule" / "default"
-        mol.mkdir(parents=True)
-        (mol / "main.yml").write_text("tasks: []")
-        result = AnsibleFileFinder.find_yaml_files(tmp_path, skip_molecule=False)
-        assert len(result) == 2
-
-    def test_find_task_and_playbook_files(self, tmp_path: Path) -> None:
-        role = tmp_path / "roles" / "myrole"
-        (role / "tasks").mkdir(parents=True)
-        (role / "tasks" / "main.yml").write_text("tasks: []")
-        pb = tmp_path / "playbooks"
-        pb.mkdir()
-        (pb / "deploy.yml").write_text("tasks: []")
-        (tmp_path / "random.yml").write_text("tasks: []")
-        result = AnsibleFileFinder.find_task_and_playbook_files(tmp_path)
-        # Should find tasks/main.yml and playbooks/deploy.yml, not random.yml
-        names = [f.name for f in result]
-        assert "main.yml" in names
-        assert "deploy.yml" in names
-        assert "random.yml" not in names
-
-    def test_find_task_and_playbook_files_skip_molecule(self, tmp_path: Path) -> None:
-        role = tmp_path / "roles" / "myrole"
-        (role / "tasks").mkdir(parents=True)
-        (role / "tasks" / "main.yml").write_text("tasks: []")
-        mol = role / "molecule" / "default" / "tasks"
-        mol.mkdir(parents=True)
-        (mol / "main.yml").write_text("tasks: []")
-        result = AnsibleFileFinder.find_task_and_playbook_files(tmp_path, skip_molecule=True)
-        assert len(result) == 1
-        assert "molecule" not in result[0].parts
-
-
-class TestAnsibleYAMLParser:
-    def test_parse_file_valid(self) -> None:
-        content = "---\n- name: test\n  shell: echo hi\n"
-        docs = AnsibleYAMLParser.parse_file(content)
-        assert len(docs) == 1
-        assert isinstance(docs[0], list)
-
-    def test_parse_file_multi_doc(self) -> None:
-        content = "---\n- a\n---\n- b\n"
-        docs = AnsibleYAMLParser.parse_file(content)
-        assert len(docs) == 2
-
-    def test_parse_file_empty_docs_filtered(self) -> None:
-        content = "---\n- a\n---\n\n"
-        docs = AnsibleYAMLParser.parse_file(content)
-        assert len(docs) == 1
-
-    def test_parse_file_yaml_error(self) -> None:
-        content = "{{ invalid: ["
-        docs = AnsibleYAMLParser.parse_file(content)
-        assert docs == []
-
-    def test_iter_tasks_bare_list(self) -> None:
-        doc = [{"name": "task1", "shell": "echo hi"}, {"name": "task2", "shell": "echo bye"}]
-        tasks = list(AnsibleYAMLParser.iter_tasks(doc))
-        assert len(tasks) == 2
-        assert tasks[0][0]["name"] == "task1"
-        assert tasks[0][1] == 1
-        assert tasks[1][1] == 2
-
-    def test_iter_tasks_play_dict(self) -> None:
-        doc = {"hosts": "all", "tasks": [{"name": "task1", "shell": "echo hi"}]}
-        tasks = list(AnsibleYAMLParser.iter_tasks(doc))
-        assert len(tasks) == 1
-        assert tasks[0][0]["name"] == "task1"
-
-    def test_iter_tasks_play_with_pre_post_handlers(self) -> None:
-        doc = {
-            "hosts": "all",
-            "pre_tasks": [{"name": "pre", "shell": "echo pre"}],
-            "tasks": [{"name": "main", "shell": "echo main"}],
-            "post_tasks": [{"name": "post", "shell": "echo post"}],
-            "handlers": [{"name": "handler", "shell": "echo handler"}],
-        }
-        tasks = list(AnsibleYAMLParser.iter_tasks(doc))
-        assert len(tasks) == 4
-        names = [t[0]["name"] for t in tasks]
-        # Order: tasks, pre_tasks, post_tasks, handlers (as defined in _iter_play_sections)
-        assert names == ["main", "pre", "post", "handler"]
-
-    def test_iter_tasks_block(self) -> None:
-        doc = [{"name": "outer", "block": [{"name": "inner", "shell": "echo hi"}]}]
-        tasks = list(AnsibleYAMLParser.iter_tasks(doc))
-        # outer is not a play (no task sections) → yielded as bare task
-        # inner is yielded from block
-        assert len(tasks) == 2
-        assert tasks[0][0]["name"] == "outer"
-        assert tasks[1][0]["name"] == "inner"
-
-    def test_iter_tasks_block_in_play_section(self) -> None:
-        """Block tasks within a play's tasks section are yielded."""
-        doc = {
-            "hosts": "all",
-            "tasks": [
-                {"name": "outer", "block": [{"name": "inner", "shell": "echo hi"}]},
-            ],
-        }
-        tasks = list(AnsibleYAMLParser.iter_tasks(doc))
-        assert len(tasks) == 2
-        assert tasks[0][0]["name"] == "outer"
-        assert tasks[1][0]["name"] == "inner"
-
-    def test_iter_tasks_play_list(self) -> None:
-        doc = [{"hosts": "all", "tasks": [{"name": "task1", "shell": "echo hi"}]}]
-        tasks = list(AnsibleYAMLParser.iter_tasks(doc))
-        assert len(tasks) == 1
-        assert tasks[0][0]["name"] == "task1"
-
-    def test_iter_tasks_non_dict_items_skipped(self) -> None:
-        doc = ["string", 42, {"name": "task1", "shell": "echo hi"}]
-        tasks = list(AnsibleYAMLParser.iter_tasks(doc))
-        assert len(tasks) == 1
-
-
-class TestViolationReporter:
-    def test_format_violation_with_line(self, tmp_path: Path) -> None:
-        result = ViolationReporter.format_violation(tmp_path / "foo.yml", tmp_path, 42, "bad")
-        assert result == "foo.yml:42 — bad"
-
-    def test_format_violation_without_line(self, tmp_path: Path) -> None:
-        result = ViolationReporter.format_violation(tmp_path / "foo.yml", tmp_path, None, "bad")
-        assert result == "foo.yml — bad"
-
-    def test_format_violation_not_relative(self, tmp_path: Path) -> None:
-        other = Path("/other/path")
-        result = ViolationReporter.format_violation(other, tmp_path, 1, "bad")
-        assert str(other) in result
-        assert "bad" in result
-
-    def test_report_no_violations(self, capsys: pytest.CaptureFixture[str]) -> None:
-        ViolationReporter.report([], "test-tool")
-        captured = capsys.readouterr()
-        assert "OK" in captured.out
-        assert "test-tool" in captured.out
-
-    def test_report_with_violations(self, capsys: pytest.CaptureFixture[str]) -> None:
-        with pytest.raises(SystemExit) as exc_info:
-            ViolationReporter.report(["v1", "v2"], "test-tool")
-        assert exc_info.value.code == 1
-        captured = capsys.readouterr()
-        assert "FAIL" in captured.out
-        assert "v1" in captured.out
-        assert "v2" in captured.out
-
-
-class TestDefaultAnsibleDirs:
-    def test_is_tuple(self) -> None:
-        assert isinstance(DEFAULT_ANSIBLE_DIRS, tuple)
-
-    def test_contains_expected(self) -> None:
-        assert "ansible/roles" in DEFAULT_ANSIBLE_DIRS
-        assert "ansible/playbooks" in DEFAULT_ANSIBLE_DIRS

tests/unit/test_check_test_speed.py

@@ -10,6 +10,7 @@ from devx.tools.check_test_speed import (
     DEFAULT_MAX_SECONDS,
     DEFAULT_MAX_SINGLE_SECONDS,
     TEST_COMMAND,
+    _ci_scale_limit,
     check_per_test_speed,
     check_speed,
     cli,
@@ -144,7 +145,26 @@ def test_main_module_block() -> None:
         mock_cli.assert_called_once_with([])
 
 
+class TestCiScaleLimit:
+    def test_no_scaling_when_not_ci(self) -> None:
+        with patch("devx.tools.check_test_speed._IS_CI", False):
+            assert _ci_scale_limit(10.0) == 10.0
+            assert _ci_scale_limit(0.5) == 0.5
+
+    def test_scales_when_ci(self) -> None:
+        with patch("devx.tools.check_test_speed._IS_CI", True):
+            with patch("devx.tools.check_test_speed.CI_SCALE_FACTOR", 4.0):
+                assert _ci_scale_limit(10.0) == 40.0
+                assert _ci_scale_limit(0.5) == 2.0
+
+    def test_custom_scale_factor(self) -> None:
+        with patch("devx.tools.check_test_speed._IS_CI", True):
+            with patch("devx.tools.check_test_speed.CI_SCALE_FACTOR", 2.5):
+                assert _ci_scale_limit(10.0) == 25.0
+
+
 class TestMain:
+    @patch("devx.tools.check_test_speed._IS_CI", False)
     @patch("devx.tools.check_test_speed.run_tests")
     @patch("devx.tools.check_test_speed.parse_duration")
     @patch("devx.tools.check_test_speed.check_speed")
@@ -174,6 +194,7 @@ class TestMain:
         mock_parse_per.assert_called_once()
         mock_check_per.assert_called_once_with([], DEFAULT_MAX_SINGLE_SECONDS)
 
+    @patch("devx.tools.check_test_speed._IS_CI", False)
     @patch("devx.tools.check_test_speed.run_tests")
     @patch("devx.tools.check_test_speed.parse_duration")
     def test_slow_total_exits(
@@ -189,6 +210,7 @@ class TestMain:
         assert result.exit_code == 1
         assert "too slow" in result.output.lower()
 
+    @patch("devx.tools.check_test_speed._IS_CI", False)
     @patch("devx.tools.check_test_speed.run_tests")
     @patch("devx.tools.check_test_speed.parse_duration")
     @patch("devx.tools.check_test_speed.check_speed")
@@ -213,6 +235,7 @@ class TestMain:
         assert "Per-test speed check FAILED" in result.output
         assert "test_slow" in result.output
 
+    @patch("devx.tools.check_test_speed._IS_CI", False)
     @patch("devx.tools.check_test_speed.run_tests")
     def test_parse_failure_exits(
         self,
@@ -225,6 +248,7 @@ class TestMain:
         assert result.exit_code == 1
         assert "Could not parse" in result.output
 
+    @patch("devx.tools.check_test_speed._IS_CI", False)
     @patch("devx.tools.check_test_speed.run_tests")
     @patch("devx.tools.check_test_speed.parse_duration")
     @patch("devx.tools.check_test_speed.check_speed")
@@ -248,6 +272,7 @@ class TestMain:
         assert result.exit_code == 0
         mock_check.assert_called_once_with(0.5, 1.5)
 
+    @patch("devx.tools.check_test_speed._IS_CI", False)
     @patch("devx.tools.check_test_speed.run_tests")
     @patch("devx.tools.check_test_speed.parse_duration")
     @patch("devx.tools.check_test_speed.check_speed")
@@ -270,6 +295,7 @@ class TestMain:
         mock_parse_per.assert_not_called()
         mock_check_per.assert_not_called()
 
+    @patch("devx.tools.check_test_speed._IS_CI", False)
     @patch("devx.tools.check_test_speed.run_tests")
     @patch("devx.tools.check_test_speed.parse_duration")
     @patch("devx.tools.check_test_speed.check_speed")
@@ -292,3 +318,32 @@ class TestMain:
         result = runner.invoke(cli, ["--max-single-seconds", "1.0"])
         assert result.exit_code == 0
         mock_check_per.assert_called_once_with([], 1.0)
+
+    @patch("devx.tools.check_test_speed._IS_CI", True)
+    @patch("devx.tools.check_test_speed.CI_SCALE_FACTOR", 4.0)
+    @patch("devx.tools.check_test_speed.run_tests")
+    @patch("devx.tools.check_test_speed.parse_duration")
+    @patch("devx.tools.check_test_speed.check_speed")
+    @patch("devx.tools.check_test_speed.parse_per_test_durations")
+    @patch("devx.tools.check_test_speed.check_per_test_speed")
+    def test_ci_scales_limits(
+        self,
+        mock_check_per: MagicMock,
+        mock_parse_per: MagicMock,
+        mock_check: MagicMock,
+        mock_parse: MagicMock,
+        mock_run: MagicMock,
+    ) -> None:
+        mock_run.return_value = ("out\n", "err\n")
+        mock_parse.return_value = 30.0  # would fail local (10s) but pass CI (40s)
+        mock_parse_per.return_value = []
+        mock_check_per.return_value = []
+
+        runner = CliRunner()
+        result = runner.invoke(cli, [])
+        assert result.exit_code == 0
+        assert "CI environment detected" in result.output
+        assert "scaling limits by 4.0x" in result.output
+        # check_speed called with scaled limit
+        mock_check.assert_called_once_with(30.0, 40.0)
+        mock_check_per.assert_called_once_with([], 2.0)

tests/unit/test_cli.py

@@ -40,7 +40,6 @@ class TestCliGroups:
         result = runner.invoke(cli, ["molecule", "--help"])
         assert result.exit_code == 0
         assert "distribute" in result.output
-        assert "guard" in result.output
         assert "all" in result.output
 
 
@@ -150,13 +149,6 @@ class TestCiCommands:
         assert result.exit_code == 0
         mock_run.assert_called_once_with("devx.ci.validate_commit_msg", ["msg"])
 
-    @patch("devx.cli._run_module")
-    def test_ci_wait_for_checks(self, mock_run: MagicMock) -> None:
-        runner = CliRunner()
-        result = runner.invoke(cli, ["ci", "wait-for-checks", "--", "--job-name", "molecule-tests"])
-        assert result.exit_code == 0
-        mock_run.assert_called_once_with("devx.ci.wait_for_checks", ["--job-name", "molecule-tests"])
-
 
 class TestToolsCommands:
     @patch("devx.cli._run_module")
@@ -238,13 +230,6 @@ class TestMoleculeCommands:
         assert result.exit_code == 0
         mock_run.assert_called_once_with("devx.molecule.discover_runners", [])
 
-    @patch("devx.cli._run_module")
-    def test_molecule_guard(self, mock_run: MagicMock) -> None:
-        runner = CliRunner()
-        result = runner.invoke(cli, ["molecule", "guard"])
-        assert result.exit_code == 0
-        mock_run.assert_called_once_with("devx.molecule.molecule_ci_guard", [])
-
     @patch("devx.cli._run_module")
     def test_molecule_all(self, mock_run: MagicMock) -> None:
         runner = CliRunner()

tests/unit/test_discover_runners.py

@@ -1,9 +1,4 @@
-"""Unit tests for devx.ci.discover_runners (deprecated wrapper).
-
-The wrapper re-exports from devx.molecule.discover_runners; these tests
-verify backward compatibility by importing through the wrapper and
-patching the canonical implementation's requests module.
-"""
+"""Unit tests for scripts/ci/discover_runners.py."""
 
 import json
 from pathlib import Path
@@ -37,7 +32,7 @@ class TestGenerateIndices:
 
 
 class TestQueryRunners:
-    @patch("devx.molecule.discover_runners.requests.get")
+    @patch("devx.ci.discover_runners.requests.get")
     def test_returns_total_from_all_levels(self, mock_get: MagicMock) -> None:
         """Runners from repo, org, and admin levels are summed."""
         responses = [
@@ -49,7 +44,7 @@ class TestQueryRunners:
         result = query_runners("https://api.example.com", "token", "owner", "repo")
         assert result == 6
 
-    @patch("devx.molecule.discover_runners.requests.get")
+    @patch("devx.ci.discover_runners.requests.get")
     def test_skips_non_200(self, mock_get: MagicMock) -> None:
         """Non-200 responses (e.g., 403 for admin) are skipped."""
         responses = [
@@ -61,7 +56,7 @@ class TestQueryRunners:
         result = query_runners("https://api.example.com", "token", "owner", "repo")
         assert result == 3
 
-    @patch("devx.molecule.discover_runners.requests.get")
+    @patch("devx.ci.discover_runners.requests.get")
     def test_handles_request_exception(self, mock_get: MagicMock) -> None:
         """Network errors are caught and don't crash."""
         mock_get.side_effect = [
@@ -72,7 +67,7 @@ class TestQueryRunners:
         result = query_runners("https://api.example.com", "token", "owner", "repo")
         assert result == 3
 
-    @patch("devx.molecule.discover_runners.requests.get")
+    @patch("devx.ci.discover_runners.requests.get")
     def test_all_failures_return_zero(self, mock_get: MagicMock) -> None:
         """When all API calls fail, returns 0."""
         mock_get.side_effect = [
@@ -83,7 +78,7 @@ class TestQueryRunners:
         result = query_runners("https://api.example.com", "token", "owner", "repo")
         assert result == 0
 
-    @patch("devx.molecule.discover_runners.requests.get")
+    @patch("devx.ci.discover_runners.requests.get")
     def test_value_error_on_repo_level(self, mock_get: MagicMock) -> None:
         """JSON parse error on repo level is caught."""
         responses = [
@@ -95,7 +90,7 @@ class TestQueryRunners:
         result = query_runners("https://api.example.com", "token", "owner", "repo")
         assert result == 3
 
-    @patch("devx.molecule.discover_runners.requests.get")
+    @patch("devx.ci.discover_runners.requests.get")
     def test_value_error_on_org_level(self, mock_get: MagicMock) -> None:
         """JSON parse error on org level is caught."""
         responses = [
@@ -107,7 +102,7 @@ class TestQueryRunners:
         result = query_runners("https://api.example.com", "token", "owner", "repo")
         assert result == 3
 
-    @patch("devx.molecule.discover_runners.requests.get")
+    @patch("devx.ci.discover_runners.requests.get")
     def test_value_error_on_admin_level(self, mock_get: MagicMock) -> None:
         """JSON parse error on admin level is caught."""
         responses = [
@@ -119,14 +114,14 @@ class TestQueryRunners:
         result = query_runners("https://api.example.com", "token", "owner", "repo")
         assert result == 3
 
-    @patch("devx.molecule.discover_runners.requests.get")
+    @patch("devx.ci.discover_runners.requests.get")
     def test_request_exception_on_all_levels(self, mock_get: MagicMock) -> None:
         """Network errors on all levels return 0."""
         mock_get.side_effect = __import__("requests").RequestException("network error")
         result = query_runners("https://api.example.com", "token", "owner", "repo")
         assert result == 0
 
-    @patch("devx.molecule.discover_runners.requests.get")
+    @patch("devx.ci.discover_runners.requests.get")
     def test_query_runners_403_no_warning(self, mock_get: MagicMock, capsys: pytest.CaptureFixture[str]) -> None:
         """403 on instance-level runners should not produce a warning (expected without admin scope)."""
         responses = [
@@ -140,7 +135,7 @@ class TestQueryRunners:
         captured = capsys.readouterr()
         assert "instance-level" not in captured.err
 
-    @patch("devx.molecule.discover_runners.requests.get")
+    @patch("devx.ci.discover_runners.requests.get")
     def test_instance_level_non_403_warns(self, mock_get: MagicMock, capsys: pytest.CaptureFixture[str]) -> None:
         """Non-200, non-403 status on instance-level runners should produce a warning."""
         responses = [
@@ -157,37 +152,37 @@ class TestQueryRunners:
 
 
 class TestGetRunnerCount:
-    @patch("devx.molecule.discover_runners.query_runners", return_value=5)
+    @patch("devx.ci.discover_runners.query_runners", return_value=5)
     def test_uses_api_count_when_positive(self, mock_query: MagicMock) -> None:
         result = get_runner_count("https://api.example.com", "token", "owner", "repo")
         assert result == 5
 
-    @patch("devx.molecule.discover_runners.query_runners", return_value=0)
+    @patch("devx.ci.discover_runners.query_runners", return_value=0)
     @patch.dict("os.environ", {"MOLECULE_RUNNERS": "4"})
     def test_falls_back_to_env_var(self, mock_query: MagicMock) -> None:
         result = get_runner_count("https://api.example.com", "token", "owner", "repo")
         assert result == 4
 
-    @patch("devx.molecule.discover_runners.query_runners", return_value=0)
+    @patch("devx.ci.discover_runners.query_runners", return_value=0)
     @patch.dict("os.environ", {"MOLECULE_RUNNERS": "invalid"})
     def test_falls_back_to_default_on_invalid_env(self, mock_query: MagicMock) -> None:
         result = get_runner_count("https://api.example.com", "token", "owner", "repo")
         assert result == DEFAULT_MAX_RUNNERS
 
-    @patch("devx.molecule.discover_runners.query_runners", return_value=0)
+    @patch("devx.ci.discover_runners.query_runners", return_value=0)
     @patch.dict("os.environ", {}, clear=True)
     def test_falls_back_to_default_when_no_env(self, mock_query: MagicMock) -> None:
         result = get_runner_count("https://api.example.com", "token", "owner", "repo")
         assert result == DEFAULT_MAX_RUNNERS
 
-    @patch("devx.molecule.discover_runners.query_runners", return_value=0)
+    @patch("devx.ci.discover_runners.query_runners", return_value=0)
     @patch.dict("os.environ", {"MOLECULE_RUNNERS": "0"})
     def test_env_var_zero_falls_back_to_default(self, mock_query: MagicMock) -> None:
         """MOLECULE_RUNNERS=0 is invalid, falls back to default."""
         result = get_runner_count("https://api.example.com", "token", "owner", "repo")
         assert result == DEFAULT_MAX_RUNNERS
 
-    @patch("devx.molecule.discover_runners.query_runners", return_value=0)
+    @patch("devx.ci.discover_runners.query_runners", return_value=0)
     @patch.dict("os.environ", {}, clear=True)
     def test_no_token_uses_env_var(self, mock_query: MagicMock) -> None:
         """When no token, skips API and uses env/default."""
@@ -197,7 +192,7 @@ class TestGetRunnerCount:
 
 
 class TestMain:
-    @patch("devx.molecule.discover_runners.get_runner_count", return_value=3)
+    @patch("devx.ci.discover_runners.get_runner_count", return_value=3)
     def test_default_output(self, mock_count: MagicMock) -> None:
         runner = CliRunner()
         result = runner.invoke(main, [])
@@ -205,28 +200,28 @@ class TestMain:
         assert "count=3" in result.output
         assert 'indices=["1", "2", "3"]' in result.output
 
-    @patch("devx.molecule.discover_runners.get_runner_count", return_value=5)
+    @patch("devx.ci.discover_runners.get_runner_count", return_value=5)
     def test_count_only(self, mock_count: MagicMock) -> None:
         runner = CliRunner()
         result = runner.invoke(main, ["--count"])
         assert result.exit_code == 0
         assert result.output.strip() == "5"
 
-    @patch("devx.molecule.discover_runners.get_runner_count", return_value=4)
+    @patch("devx.ci.discover_runners.get_runner_count", return_value=4)
     def test_indices_only(self, mock_count: MagicMock) -> None:
         runner = CliRunner()
         result = runner.invoke(main, ["--indices"])
         assert result.exit_code == 0
         assert json.loads(result.output.strip()) == ["1", "2", "3", "4"]
 
-    @patch("devx.molecule.discover_runners.get_runner_count", return_value=1)
+    @patch("devx.ci.discover_runners.get_runner_count", return_value=1)
     def test_single_runner(self, mock_count: MagicMock) -> None:
         runner = CliRunner()
         result = runner.invoke(main, ["--indices"])
         assert result.exit_code == 0
         assert json.loads(result.output.strip()) == ["1"]
 
-    @patch("devx.molecule.discover_runners.get_runner_count", return_value=3)
+    @patch("devx.ci.discover_runners.get_runner_count", return_value=3)
     def test_github_output(self, mock_count: MagicMock, tmp_path: Path, monkeypatch: pytest.MonkeyPatch) -> None:
         gh_file = tmp_path / "output.txt"
         monkeypatch.setenv("GITHUB_OUTPUT", str(gh_file))
@@ -237,14 +232,14 @@ class TestMain:
         assert "runner-count=3" in content
         assert "runner-indices=" in content
 
-    @patch("devx.molecule.discover_runners.get_runner_count", return_value=3)
+    @patch("devx.ci.discover_runners.get_runner_count", return_value=3)
     def test_github_output_no_env(self, mock_count: MagicMock, monkeypatch: pytest.MonkeyPatch) -> None:
         monkeypatch.delenv("GITHUB_OUTPUT", raising=False)
         runner = CliRunner()
         result = runner.invoke(main, ["--github-output"])
         assert result.exit_code != 0
 
-    @patch("devx.molecule.discover_runners.get_runner_count", return_value=2)
+    @patch("devx.ci.discover_runners.get_runner_count", return_value=2)
     def test_explicit_owner_and_repo(self, mock_count: MagicMock) -> None:
         """When --owner and --repo are provided, env vars are not used."""
         runner = CliRunner()
@@ -256,8 +251,8 @@ class TestMain:
         assert "myorg" in args
         assert "myrepo" in args
 
-    @patch("devx.molecule.discover_runners.get_ci_token", side_effect=click.ClickException("no token"))
-    @patch("devx.molecule.discover_runners.get_runner_count", return_value=3)
+    @patch("devx.ci.discover_runners.get_ci_token", side_effect=click.ClickException("no token"))
+    @patch("devx.ci.discover_runners.get_runner_count", return_value=3)
     def test_missing_token_runs_without_api(self, mock_count: MagicMock, mock_token: MagicMock) -> None:
         """When no token is available, runner discovery falls back to env/default."""
         runner = CliRunner()
@@ -266,29 +261,3 @@ class TestMain:
         assert result.output.strip() == "3"
         args, _ = mock_count.call_args
         assert args[1] is None  # token passed as None when missing
-
-
-class TestDeprecationWrapper:
-    def test_re_exports_canonical_symbols(self) -> None:
-        """The wrapper re-exports the canonical implementation's symbols."""
-        from devx.ci import discover_runners as ci_mod
-        from devx.molecule import discover_runners as mol_mod
-
-        assert ci_mod.query_runners is mol_mod.query_runners
-        assert ci_mod.get_runner_count is mol_mod.get_runner_count
-        assert ci_mod.generate_indices is mol_mod.generate_indices
-        assert ci_mod.main is mol_mod.main
-        assert ci_mod.DEFAULT_MAX_RUNNERS is mol_mod.DEFAULT_MAX_RUNNERS
-
-    def test_emit_deprecation_warning(self) -> None:
-        """_emit_deprecation_warning issues a DeprecationWarning."""
-        import warnings
-
-        from devx.ci.discover_runners import _emit_deprecation_warning
-
-        with warnings.catch_warnings(record=True) as caught:
-            warnings.simplefilter("always")
-            _emit_deprecation_warning()
-        assert len(caught) == 1
-        assert issubclass(caught[0].category, DeprecationWarning)
-        assert "deprecated" in str(caught[0].message)

tests/unit/test_install_tools.py

@@ -1,7 +1,7 @@
 from __future__ import annotations
 
 import platform
-import urllib.error
+import urllib.request
 from pathlib import Path
 from unittest.mock import patch
 
@@ -67,69 +67,12 @@ class TestDownload:
         with patch("urllib.request.urlopen", return_value=_FakeResponse()) as mock_urlopen:
             install_tools._download("https://example.com/file", dest)
         mock_urlopen.assert_called_once()
+        call_args = mock_urlopen.call_args
+        req = call_args.args[0]
+        assert isinstance(req, urllib.request.Request)
+        assert req.get_header("User-agent") == "devx/install-tools"
         assert dest.read_bytes() == b"data"
 
-    def test_download_retries_on_transient_error(self, tmp_path: Path) -> None:
-        """Download retries on URLError then succeeds."""
-        dest = tmp_path / "file.bin"
-        call_count = [0]
-
-        class _FakeResponse:
-            def __init__(self) -> None:
-                self._sent = False
-
-            def __enter__(self) -> _FakeResponse:
-                return self
-
-            def __exit__(self, *args: object) -> None:
-                pass
-
-            def read(self, n: int = -1) -> bytes:
-                if self._sent:
-                    return b""
-                self._sent = True
-                return b"data"
-
-        def _flaky_urlopen(url: str, timeout: int = 60):
-            call_count[0] += 1
-            if call_count[0] < 2:
-                raise urllib.error.URLError("Remote end closed connection")
-            return _FakeResponse()
-
-        with patch("urllib.request.urlopen", side_effect=_flaky_urlopen):
-            install_tools._download("https://example.com/file", dest, _sleep=lambda _: None)
-        assert call_count[0] == 2
-        assert dest.read_bytes() == b"data"
-
-    def test_download_fails_after_max_retries(self, tmp_path: Path) -> None:
-        """Download raises after MAX_DOWNLOAD_RETRIES attempts."""
-        dest = tmp_path / "file.bin"
-        call_count = [0]
-
-        def _always_fail(url: str, timeout: int = 60):
-            call_count[0] += 1
-            raise urllib.error.URLError("Remote end closed connection")
-
-        with patch("urllib.request.urlopen", side_effect=_always_fail):
-            with pytest.raises(urllib.error.URLError):
-                install_tools._download("https://example.com/file", dest, _sleep=lambda _: None)
-        assert call_count[0] == install_tools.MAX_DOWNLOAD_RETRIES
-        assert not dest.exists()
-
-    def test_download_no_retry_on_non_transient_error(self, tmp_path: Path) -> None:
-        """Download does not retry on non-network errors (e.g. ValueError)."""
-        dest = tmp_path / "file.bin"
-        call_count = [0]
-
-        def _fail_with_value_error(url: str, timeout: int = 60):
-            call_count[0] += 1
-            raise ValueError("not a network error")
-
-        with patch("urllib.request.urlopen", side_effect=_fail_with_value_error):
-            with pytest.raises(ValueError):
-                install_tools._download("https://example.com/file", dest, _sleep=lambda _: None)
-        assert call_count[0] == 1
-
 
 class TestDownloadBinary:
     def test_download(self, tmp_path: Path) -> None:

tests/unit/test_integration_guard.py

@@ -7,6 +7,7 @@ import subprocess  # nosec B404
 import time
 from unittest.mock import MagicMock, patch
 
+import pytest
 from click.testing import CliRunner
 
 from devx.ci.integration_guard import cli
@@ -111,9 +112,8 @@ class TestCli:
                 clear=True,
             ),
             patch("devx.ci.integration_guard.POLL_INTERVAL", 0.01),
-            patch("devx.molecule.molecule_ci_guard.POLL_INTERVAL", 0.01),
             patch("devx.ci.integration_guard.subprocess.Popen") as mock_popen,
-            patch("devx.molecule.molecule_ci_guard.get_running_jobs", side_effect=get_jobs_side_effect),
+            patch("devx.ci.integration_guard.get_running_jobs", side_effect=get_jobs_side_effect),
             patch("os.killpg") as mock_killpg,
             patch("os.getpgid") as mock_getpgid,
             patch("time.sleep", side_effect=lambda x: real_sleep(0)),
@@ -158,9 +158,8 @@ class TestCli:
                 clear=True,
             ),
             patch("devx.ci.integration_guard.POLL_INTERVAL", 0.01),
-            patch("devx.molecule.molecule_ci_guard.POLL_INTERVAL", 0.01),
             patch("devx.ci.integration_guard.subprocess.Popen") as mock_popen,
-            patch("devx.molecule.molecule_ci_guard.get_running_jobs", side_effect=get_jobs_side_effect),
+            patch("devx.ci.integration_guard.get_running_jobs", side_effect=get_jobs_side_effect),
             patch("os.killpg", side_effect=ProcessLookupError("no such process")),
             patch("os.getpgid") as mock_getpgid,
             patch("time.sleep", side_effect=lambda x: real_sleep(0)),
@@ -203,9 +202,8 @@ class TestCli:
                 clear=True,
             ),
             patch("devx.ci.integration_guard.POLL_INTERVAL", 0.01),
-            patch("devx.molecule.molecule_ci_guard.POLL_INTERVAL", 0.01),
             patch("devx.ci.integration_guard.subprocess.Popen") as mock_popen,
-            patch("devx.molecule.molecule_ci_guard.get_running_jobs", side_effect=get_jobs_side_effect),
+            patch("devx.ci.integration_guard.get_running_jobs", side_effect=get_jobs_side_effect),
             patch("os.killpg") as mock_killpg,
             patch("os.getpgid") as mock_getpgid,
             patch("time.sleep", side_effect=lambda x: real_sleep(0)),
@@ -289,3 +287,125 @@ def test_main_module_block() -> None:
     namespace = dict(ig.__dict__)
     exec(compile(source, ig.__file__, "exec"), namespace)
     assert callable(namespace["cli"])
+
+
+class TestGetRunningJobs:
+    def test_returns_jobs(self) -> None:
+        with patch("devx.ci.integration_guard.requests.get") as mock_get:
+            mock_response = MagicMock()
+            mock_response.json.return_value = {
+                "jobs": [
+                    {"name": "integration-tests (0)", "conclusion": "success"},
+                    {"name": "integration-tests (1)", "conclusion": "failure"},
+                ]
+            }
+            mock_response.raise_for_status.return_value = None
+            mock_get.return_value = mock_response
+
+            from devx.ci.integration_guard import get_running_jobs
+
+            jobs = get_running_jobs("https://gitea.example", "owner", "repo", "token", 123)
+            assert len(jobs) == 2
+            mock_get.assert_called_once()
+
+    def test_raises_on_request_error(self) -> None:
+        import requests
+
+        with patch("devx.ci.integration_guard.requests.get") as mock_get:
+            mock_get.side_effect = requests.RequestException("boom")
+            with pytest.raises(requests.RequestException):
+                from devx.ci.integration_guard import get_running_jobs
+
+                get_running_jobs("https://gitea.example", "owner", "repo", "token", 123)
+
+
+class TestAnyOtherRunnerFailed:
+    def test_detects_other_failure(self) -> None:
+        from devx.ci.integration_guard import any_other_runner_failed
+
+        jobs = [
+            {"name": "integration-tests (0)", "conclusion": "success"},
+            {"name": "integration-tests (1)", "conclusion": "failure"},
+            {"name": "integration-tests (2)", "conclusion": "running"},
+        ]
+        assert any_other_runner_failed(jobs, "integration-tests", 0) is True
+
+    def test_ignores_current_runner(self) -> None:
+        from devx.ci.integration_guard import any_other_runner_failed
+
+        jobs = [
+            {"name": "integration-tests (0)", "conclusion": "failure"},
+            {"name": "integration-tests (1)", "conclusion": "success"},
+        ]
+        assert any_other_runner_failed(jobs, "integration-tests", 0) is False
+
+    def test_ignores_non_matching_jobs(self) -> None:
+        from devx.ci.integration_guard import any_other_runner_failed
+
+        jobs = [
+            {"name": "quality", "conclusion": "failure"},
+            {"name": "integration-tests (1)", "conclusion": "success"},
+        ]
+        assert any_other_runner_failed(jobs, "integration-tests", 0) is False
+
+
+class TestPollForOtherFailures:
+    def test_sets_failed_event_when_other_runner_fails(self) -> None:
+        from devx.ci.integration_guard import poll_for_other_failures
+
+        stop_event = MagicMock()
+        failed_event = MagicMock()
+
+        def side_effect(*args, **kwargs):
+            if stop_event.wait.call_count < 1:
+                return [
+                    {"name": "integration-tests (0)", "conclusion": "success"},
+                    {"name": "integration-tests (1)", "conclusion": "failure"},
+                ]
+            return []
+
+        with patch("devx.ci.integration_guard.get_running_jobs") as mock_get_jobs:
+            mock_get_jobs.side_effect = side_effect
+            stop_event.is_set.side_effect = [False, False]
+            stop_event.wait.return_value = True
+
+            poll_for_other_failures(
+                "https://gitea.example",
+                "owner",
+                "repo",
+                "token",
+                123,
+                "integration-tests",
+                0,
+                stop_event,
+                failed_event,
+            )
+
+            failed_event.set.assert_called_once()
+
+    def test_poll_warns_on_api_error(self) -> None:
+        import requests
+
+        from devx.ci.integration_guard import poll_for_other_failures
+
+        stop_event = MagicMock()
+        failed_event = MagicMock()
+
+        with patch("devx.ci.integration_guard.get_running_jobs") as mock_get_jobs:
+            mock_get_jobs.side_effect = requests.RequestException("boom")
+            stop_event.is_set.side_effect = [False, True]
+            stop_event.wait.return_value = True
+
+            poll_for_other_failures(
+                "https://gitea.example",
+                "owner",
+                "repo",
+                "token",
+                123,
+                "integration-tests",
+                0,
+                stop_event,
+                failed_event,
+            )
+
+            failed_event.set.assert_not_called()

tests/unit/test_molecule_ci_guard.py

@@ -1,581 +0,0 @@
-"""Unit tests for scripts/ci/molecule_ci_guard.py."""
-
-from __future__ import annotations
-
-import os
-import subprocess  # nosec B404
-import time
-from pathlib import Path
-from unittest.mock import MagicMock, patch
-
-import click
-import pytest
-import requests
-
-from devx.molecule.molecule_ci_guard import (
-    any_other_runner_failed,
-    build_env_for_pair,
-    build_molecule_cmd,
-    cli,
-    get_running_jobs,
-    parse_pair,
-    poll_for_other_failures,
-    resolve_role_dir,
-)
-
-
-class TestGetRunningJobs:
-    def test_returns_jobs(self) -> None:
-        with patch("devx.molecule.molecule_ci_guard.requests.get") as mock_get:
-            mock_response = MagicMock()
-            mock_response.json.return_value = {
-                "jobs": [
-                    {"name": "molecule-tests (0)", "conclusion": "success"},
-                    {"name": "molecule-tests (1)", "conclusion": "failure"},
-                ]
-            }
-            mock_response.raise_for_status.return_value = None
-            mock_get.return_value = mock_response
-
-            jobs = get_running_jobs("https://gitea.example", "owner", "repo", "token", 123)
-            assert len(jobs) == 2
-            mock_get.assert_called_once()
-
-    def test_raises_on_request_error(self) -> None:
-        with patch("devx.molecule.molecule_ci_guard.requests.get") as mock_get:
-            mock_get.side_effect = requests.RequestException("boom")
-            with pytest.raises(requests.RequestException):
-                get_running_jobs("https://gitea.example", "owner", "repo", "token", 123)
-
-
-class TestAnyOtherRunnerFailed:
-    def test_detects_other_failure(self) -> None:
-        jobs = [
-            {"name": "molecule-tests (0)", "conclusion": "success"},
-            {"name": "molecule-tests (1)", "conclusion": "failure"},
-            {"name": "molecule-tests (2)", "conclusion": "running"},
-        ]
-        assert any_other_runner_failed(jobs, "molecule-tests", 0) is True
-
-    def test_ignores_current_runner(self) -> None:
-        jobs = [
-            {"name": "molecule-tests (0)", "conclusion": "failure"},
-            {"name": "molecule-tests (1)", "conclusion": "success"},
-        ]
-        assert any_other_runner_failed(jobs, "molecule-tests", 0) is False
-
-    def test_ignores_non_molecule_jobs(self) -> None:
-        jobs = [
-            {"name": "quality", "conclusion": "failure"},
-            {"name": "molecule-tests (1)", "conclusion": "success"},
-        ]
-        assert any_other_runner_failed(jobs, "molecule-tests", 0) is False
-
-
-class TestBuildMoleculeCmd:
-    def test_default_scenario(self) -> None:
-        assert build_molecule_cmd("default") == ["molecule", "test"]
-
-    def test_named_scenario(self) -> None:
-        assert build_molecule_cmd("lifecycle") == ["molecule", "test", "-s", "lifecycle"]
-
-
-class TestBuildEnvForPair:
-    def test_with_command(self) -> None:
-        env = build_env_for_pair("default|ubuntu-2204|img:latest|/lib/systemd/systemd", {})
-        assert env["MOLECULE_PLATFORM_NAME"] == "ubuntu-2204"
-        assert env["MOLECULE_PLATFORM_IMAGE"] == "img:latest"
-        assert env["MOLECULE_PLATFORM_COMMAND"] == "/lib/systemd/systemd"
-        assert env["ANSIBLE_ALLOW_BROKEN_CONDITIONALS"] == "true"
-
-    def test_without_command(self) -> None:
-        env = build_env_for_pair("default|ubuntu-2204|img:latest|", {})
-        assert env["MOLECULE_PLATFORM_NAME"] == "ubuntu-2204"
-        assert "MOLECULE_PLATFORM_COMMAND" not in env
-
-    def test_without_command_removes_existing(self) -> None:
-        env = build_env_for_pair("default|ubuntu-2204|img:latest|", {"MOLECULE_PLATFORM_COMMAND": "old"})
-        assert "MOLECULE_PLATFORM_COMMAND" not in env
-
-    def test_preserves_existing_molecule_home(self) -> None:
-        """When MOLECULE_HOME is already set, it is not overridden."""
-        env = build_env_for_pair("default|ubuntu-2204|img:latest|", {"MOLECULE_HOME": "/custom/home"})
-        assert env["MOLECULE_HOME"] == "/custom/home"
-
-
-class TestPollForOtherFailures:
-    def test_sets_failed_event_when_other_runner_fails(self) -> None:
-        stop_event = MagicMock()
-        failed_event = MagicMock()
-
-        def side_effect(*args, **kwargs):
-            if stop_event.wait.call_count < 1:
-                return [
-                    {"name": "molecule-tests (0)", "conclusion": "success"},
-                    {"name": "molecule-tests (1)", "conclusion": "failure"},
-                ]
-            return []
-
-        with patch("devx.molecule.molecule_ci_guard.get_running_jobs") as mock_get_jobs:
-            mock_get_jobs.side_effect = side_effect
-            stop_event.is_set.side_effect = [False, False]
-            stop_event.wait.return_value = True
-
-            poll_for_other_failures(
-                "https://gitea.example",
-                "owner",
-                "repo",
-                "token",
-                123,
-                "molecule-tests",
-                0,
-                stop_event,
-                failed_event,
-            )
-
-            failed_event.set.assert_called_once()
-
-    def test_poll_warns_on_api_error(self) -> None:
-        stop_event = MagicMock()
-        failed_event = MagicMock()
-
-        with patch("devx.molecule.molecule_ci_guard.get_running_jobs") as mock_get_jobs:
-            mock_get_jobs.side_effect = requests.RequestException("boom")
-            stop_event.is_set.side_effect = [False, True]
-            stop_event.wait.return_value = True
-
-            poll_for_other_failures(
-                "https://gitea.example",
-                "owner",
-                "repo",
-                "token",
-                123,
-                "molecule-tests",
-                0,
-                stop_event,
-                failed_event,
-            )
-
-            failed_event.set.assert_not_called()
-
-
-class TestCli:
-    def test_all_pass(self) -> None:
-        from click.testing import CliRunner
-
-        with (
-            patch("devx.molecule.molecule_ci_guard.subprocess.Popen") as mock_popen,
-            patch("devx.molecule.molecule_ci_guard.subprocess.run"),
-            patch("devx.molecule.molecule_ci_guard.subprocess.run") as mock_run,
-            patch("time.sleep"),
-        ):
-            proc = MagicMock()
-            proc.poll.return_value = 0
-            proc.returncode = 0
-            mock_popen.return_value = proc
-            mock_run.return_value = MagicMock(returncode=0)
-
-            runner = CliRunner()
-            result = runner.invoke(cli, ["default|ubuntu-2204|img:latest|"])
-            assert result.exit_code == 0
-            assert "All molecule tests passed" in result.output
-            # Verify Docker prune was called between scenarios
-            mock_run.assert_called_once_with(
-                ["docker", "system", "prune", "-af", "--volumes"],
-                check=False,
-                capture_output=True,
-                timeout=60,
-            )
-
-    @patch("devx.molecule.molecule_ci_guard.get_ci_token", side_effect=click.ClickException("no token"))
-    def test_missing_token_runs_without_polling(self, mock_token: MagicMock) -> None:
-        """When no token is available, cross-runner polling is skipped."""
-        from click.testing import CliRunner
-
-        with (
-            patch("devx.molecule.molecule_ci_guard.subprocess.Popen") as mock_popen,
-            patch("devx.molecule.molecule_ci_guard.subprocess.run"),
-            patch("devx.molecule.molecule_ci_guard.subprocess.run") as mock_run,
-            patch("devx.molecule.molecule_ci_guard.poll_for_other_failures") as mock_poll,
-            patch("time.sleep"),
-        ):
-            proc = MagicMock()
-            proc.poll.return_value = 0
-            proc.returncode = 0
-            mock_popen.return_value = proc
-            mock_run.return_value = MagicMock(returncode=0)
-
-            runner = CliRunner()
-            result = runner.invoke(cli, ["default|ubuntu-2204|img:latest|"])
-            assert result.exit_code == 0
-            mock_poll.assert_not_called()
-
-    def test_invalid_pair_format_raises(self) -> None:
-        """Pair with fewer than 2 parts should raise."""
-        from click.testing import CliRunner
-
-        with (
-            patch("devx.molecule.molecule_ci_guard.subprocess.Popen"),
-            patch("devx.molecule.molecule_ci_guard.subprocess.run"),
-        ):
-            runner = CliRunner()
-            result = runner.invoke(cli, ["invalid_no_pipe"])
-        assert result.exit_code != 0
-        assert "Invalid pair format" in result.output
-
-    def test_failure_exits_nonzero(self) -> None:
-        from click.testing import CliRunner
-
-        with (
-            patch("devx.molecule.molecule_ci_guard.subprocess.Popen") as mock_popen,
-            patch("devx.molecule.molecule_ci_guard.subprocess.run"),
-            patch("devx.molecule.molecule_ci_guard.subprocess.run"),
-            patch("time.sleep"),
-        ):
-            proc = MagicMock()
-            proc.poll.return_value = 1
-            proc.returncode = 1
-            mock_popen.return_value = proc
-
-            runner = CliRunner()
-            result = runner.invoke(cli, ["default|ubuntu-2204|img:latest|"])
-            assert result.exit_code == 1
-            assert "FAILED" in result.output
-
-    def test_exits_before_starting_when_already_failed(self) -> None:
-        from click.testing import CliRunner
-
-        with (
-            patch.dict(
-                os.environ,
-                {
-                    "GITEA_URL": "https://gitea.example",
-                    "CI_GITEA_TOKEN": "token",
-                    "RUN_ID": "123",
-                    "JOB_NAME": "molecule-tests",
-                    "MATRIX_INDEX": "0",
-                    "GITEA_REPOSITORY": "my-org/my-repo",
-                    "PATH": os.environ.get("PATH", ""),
-                },
-                clear=True,
-            ),
-            patch("devx.molecule.molecule_ci_guard.POLL_INTERVAL", 0.01),
-            patch("devx.molecule.molecule_ci_guard.subprocess.Popen") as mock_popen,
-            patch("devx.molecule.molecule_ci_guard.subprocess.run"),
-            patch("devx.molecule.molecule_ci_guard.subprocess.run"),
-            patch("devx.molecule.molecule_ci_guard.get_running_jobs") as mock_get_jobs,
-            patch("time.sleep"),
-        ):
-            mock_get_jobs.return_value = [
-                {"name": "molecule-tests (0)", "conclusion": "running"},
-                {"name": "molecule-tests (1)", "conclusion": "failure"},
-            ]
-            proc = MagicMock()
-            proc.poll.return_value = 0
-            proc.returncode = 0
-            mock_popen.return_value = proc
-
-            runner = CliRunner()
-            result = runner.invoke(cli, ["default|ubuntu-2204|img:latest|"])
-            assert result.exit_code == 1
-            assert "Another molecule runner failed" in result.output
-
-    def test_keyboard_interrupt_kills_process(self) -> None:
-        from click.testing import CliRunner
-
-        with (
-            patch("devx.molecule.molecule_ci_guard.subprocess.Popen") as mock_popen,
-            patch("devx.molecule.molecule_ci_guard.subprocess.run"),
-            patch("devx.molecule.molecule_ci_guard.subprocess.run"),
-            patch("time.sleep", side_effect=KeyboardInterrupt),
-            patch("os.killpg") as mock_killpg,
-            patch("os.getpgid") as mock_getpgid,
-        ):
-            mock_getpgid.return_value = 123
-            proc = MagicMock()
-            proc.poll.return_value = None
-            proc.wait.return_value = 0
-            mock_popen.return_value = proc
-
-            runner = CliRunner()
-            result = runner.invoke(cli, ["default|ubuntu-2204|img:latest|"])
-            assert result.exit_code == 1
-            mock_killpg.assert_called()
-
-    def test_exits_when_other_runner_fails(self) -> None:
-        from click.testing import CliRunner
-
-        real_sleep = time.sleep
-        call_count = [0]
-
-        def get_jobs_side_effect(*args, **kwargs):
-            call_count[0] += 1
-            if call_count[0] < 2:
-                return [{"name": "molecule-tests (1)", "conclusion": "running"}]
-            return [
-                {"name": "molecule-tests (0)", "conclusion": "running"},
-                {"name": "molecule-tests (1)", "conclusion": "failure"},
-            ]
-
-        with (
-            patch.dict(
-                os.environ,
-                {
-                    "GITEA_URL": "https://gitea.example",
-                    "CI_GITEA_TOKEN": "token",
-                    "RUN_ID": "123",
-                    "JOB_NAME": "molecule-tests",
-                    "MATRIX_INDEX": "0",
-                    "GITEA_REPOSITORY": "my-org/my-repo",
-                    "PATH": os.environ.get("PATH", ""),
-                },
-                clear=True,
-            ),
-            patch("devx.molecule.molecule_ci_guard.POLL_INTERVAL", 0.01),
-            patch("devx.molecule.molecule_ci_guard.subprocess.Popen") as mock_popen,
-            patch("devx.molecule.molecule_ci_guard.subprocess.run"),
-            patch("devx.molecule.molecule_ci_guard.get_running_jobs", side_effect=get_jobs_side_effect),
-            patch("os.killpg") as mock_killpg,
-            patch("os.getpgid") as mock_getpgid,
-            patch("time.sleep", side_effect=lambda x: real_sleep(0)),
-        ):
-            mock_getpgid.return_value = 123
-            proc = MagicMock()
-            proc.poll.return_value = None
-            proc.wait.return_value = 0
-            mock_popen.return_value = proc
-
-            runner = CliRunner()
-            result = runner.invoke(cli, ["default|ubuntu-2204|img:latest|"])
-            assert result.exit_code == 1
-            mock_killpg.assert_called()
-
-    def test_default_owner_repo_fallback(self) -> None:
-        from click.testing import CliRunner
-
-        real_sleep = time.sleep
-
-        with (
-            patch.dict(
-                os.environ,
-                {
-                    "GITEA_URL": "https://gitea.example",
-                    "CI_GITEA_TOKEN": "token",
-                    "RUN_ID": "123",
-                    "JOB_NAME": "molecule-tests",
-                    "MATRIX_INDEX": "0",
-                    "GITEA_REPOSITORY": "invalid",
-                    "PATH": os.environ.get("PATH", ""),
-                },
-                clear=True,
-            ),
-            patch("devx.molecule.molecule_ci_guard.POLL_INTERVAL", 0.01),
-            patch("devx.molecule.molecule_ci_guard.subprocess.Popen") as mock_popen,
-            patch("devx.molecule.molecule_ci_guard.subprocess.run"),
-            patch("devx.molecule.molecule_ci_guard.subprocess.run") as mock_run,
-            patch("devx.molecule.molecule_ci_guard.get_running_jobs") as mock_get_jobs,
-            patch("time.sleep", side_effect=lambda x: real_sleep(0)),
-        ):
-            mock_get_jobs.return_value = [{"name": "molecule-tests (1)", "conclusion": "success"}]
-            proc = MagicMock()
-            proc.poll.return_value = 0
-            proc.returncode = 0
-            mock_popen.return_value = proc
-            mock_run.return_value = MagicMock(returncode=0)
-
-            runner = CliRunner()
-            result = runner.invoke(cli, ["default|ubuntu-2204|img:latest|"])
-            assert result.exit_code == 0
-
-    def test_exits_when_other_runner_fails_with_process_lookup_error(self) -> None:
-        from click.testing import CliRunner
-
-        real_sleep = time.sleep
-        call_count = [0]
-
-        def get_jobs_side_effect(*args, **kwargs):
-            call_count[0] += 1
-            if call_count[0] < 2:
-                return [{"name": "molecule-tests (1)", "conclusion": "running"}]
-            return [
-                {"name": "molecule-tests (0)", "conclusion": "running"},
-                {"name": "molecule-tests (1)", "conclusion": "failure"},
-            ]
-
-        with (
-            patch.dict(
-                os.environ,
-                {
-                    "GITEA_URL": "https://gitea.example",
-                    "CI_GITEA_TOKEN": "token",
-                    "RUN_ID": "123",
-                    "JOB_NAME": "molecule-tests",
-                    "MATRIX_INDEX": "0",
-                    "GITEA_REPOSITORY": "my-org/my-repo",
-                    "PATH": os.environ.get("PATH", ""),
-                },
-                clear=True,
-            ),
-            patch("devx.molecule.molecule_ci_guard.POLL_INTERVAL", 0.01),
-            patch("devx.molecule.molecule_ci_guard.subprocess.Popen") as mock_popen,
-            patch("devx.molecule.molecule_ci_guard.subprocess.run"),
-            patch("devx.molecule.molecule_ci_guard.get_running_jobs", side_effect=get_jobs_side_effect),
-            patch("os.killpg") as mock_killpg,
-            patch("os.getpgid") as mock_getpgid,
-            patch("time.sleep", side_effect=lambda x: real_sleep(0)),
-        ):
-            mock_getpgid.return_value = 123
-            mock_killpg.side_effect = ProcessLookupError("no such process")
-            proc = MagicMock()
-            proc.poll.return_value = None
-            proc.wait.return_value = 0
-            mock_popen.return_value = proc
-
-            runner = CliRunner()
-            result = runner.invoke(cli, ["default|ubuntu-2204|img:latest|"])
-            assert result.exit_code == 1
-
-    def test_exits_when_other_runner_fails_with_timeout(self) -> None:
-        from click.testing import CliRunner
-
-        real_sleep = time.sleep
-        call_count = [0]
-
-        def get_jobs_side_effect(*args, **kwargs):
-            call_count[0] += 1
-            if call_count[0] < 2:
-                return [{"name": "molecule-tests (1)", "conclusion": "running"}]
-            return [
-                {"name": "molecule-tests (0)", "conclusion": "running"},
-                {"name": "molecule-tests (1)", "conclusion": "failure"},
-            ]
-
-        with (
-            patch.dict(
-                os.environ,
-                {
-                    "GITEA_URL": "https://gitea.example",
-                    "CI_GITEA_TOKEN": "token",
-                    "RUN_ID": "123",
-                    "JOB_NAME": "molecule-tests",
-                    "MATRIX_INDEX": "0",
-                    "GITEA_REPOSITORY": "my-org/my-repo",
-                    "PATH": os.environ.get("PATH", ""),
-                },
-                clear=True,
-            ),
-            patch("devx.molecule.molecule_ci_guard.POLL_INTERVAL", 0.01),
-            patch("devx.molecule.molecule_ci_guard.subprocess.Popen") as mock_popen,
-            patch("devx.molecule.molecule_ci_guard.subprocess.run"),
-            patch("devx.molecule.molecule_ci_guard.get_running_jobs", side_effect=get_jobs_side_effect),
-            patch("os.killpg") as mock_killpg,
-            patch("os.getpgid") as mock_getpgid,
-            patch("time.sleep", side_effect=lambda x: real_sleep(0)),
-        ):
-            mock_getpgid.return_value = 123
-            mock_killpg.side_effect = [None, ProcessLookupError("no such process")]
-            proc = MagicMock()
-            proc.poll.return_value = None
-            proc.wait.side_effect = [subprocess.TimeoutExpired("cmd", 10)]
-            mock_popen.return_value = proc
-
-            runner = CliRunner()
-            result = runner.invoke(cli, ["default|ubuntu-2204|img:latest|"])
-            assert result.exit_code == 1
-
-
-def test_main_module_block() -> None:
-    import devx.molecule.molecule_ci_guard as mg
-
-    with open(mg.__file__) as f:
-        source = f.read()
-    source = source.replace('if __name__ == "__main__":\n    cli()\n', "")
-    namespace = dict(mg.__dict__)
-    exec(compile(source, mg.__file__, "exec"), namespace)
-    assert callable(namespace["cli"])
-
-
-class TestParsePair:
-    def test_single_role_4_part(self) -> None:
-        role, scenario, name, image, cmd = parse_pair("default|ubuntu-2204|ubuntu:22.04|")
-        assert role == ""
-        assert scenario == "default"
-        assert name == "ubuntu-2204"
-        assert image == "ubuntu:22.04"
-        assert cmd == ""
-
-    def test_multi_role_5_part(self) -> None:
-        role, scenario, name, image, cmd = parse_pair("gitea-runner|default|ubuntu-2204|ubuntu:22.04|")
-        assert role == "gitea-runner"
-        assert scenario == "default"
-        assert name == "ubuntu-2204"
-        assert image == "ubuntu:22.04"
-        assert cmd == ""
-
-    def test_multi_role_with_command(self) -> None:
-        role, scenario, name, image, cmd = parse_pair(
-            "docker-base|lifecycle|archlinux|archlinux:latest|/usr/lib/systemd/systemd"
-        )
-        assert role == "docker-base"
-        assert scenario == "lifecycle"
-        assert cmd == "/usr/lib/systemd/systemd"
-
-    def test_invalid_pair_raises(self) -> None:
-        with pytest.raises(click.ClickException, match="Invalid pair format"):
-            parse_pair("only|two|parts")
-
-    def test_too_many_parts_raises(self) -> None:
-        with pytest.raises(click.ClickException, match="Invalid pair format"):
-            parse_pair("a|b|c|d|e|f")
-
-
-class TestResolveRoleDir:
-    def test_multi_role_with_roles_root(self, tmp_path: Path) -> None:
-        roles_root = tmp_path / "ansible" / "roles"
-        roles_root.mkdir(parents=True)
-        result = resolve_role_dir("gitea-runner", roles_root, tmp_path)
-        assert result == roles_root / "gitea-runner"
-
-    def test_multi_role_default_roles_root(self, tmp_path: Path) -> None:
-        result = resolve_role_dir("docker-base", None, tmp_path)
-        assert result == tmp_path / "ansible" / "roles" / "docker-base"
-
-    def test_single_role_auto_discovers(self, tmp_path: Path) -> None:
-        """Single-role mode auto-discovers first role with molecule/ dir."""
-        roles_dir = tmp_path / "ansible" / "roles"
-        (roles_dir / "my_role" / "molecule").mkdir(parents=True)
-        result = resolve_role_dir("", None, tmp_path)
-        assert result == roles_dir / "my_role"
-
-    def test_single_role_no_roles_returns_fallback(self, tmp_path: Path) -> None:
-        """When no roles exist, returns a fallback path (will error at runtime)."""
-        result = resolve_role_dir("", None, tmp_path)
-        assert "roles" in str(result)
-
-
-class TestCliMultiRole:
-    def test_multi_role_pair_passes(self, tmp_path: Path) -> None:
-        from click.testing import CliRunner
-
-        roles_root = tmp_path / "ansible" / "roles"
-        (roles_root / "gitea-runner").mkdir(parents=True)
-
-        with (
-            patch("devx.molecule.molecule_ci_guard.subprocess.Popen") as mock_popen,
-            patch("devx.molecule.molecule_ci_guard.subprocess.run"),
-            patch("devx.molecule.molecule_ci_guard.subprocess.run") as mock_run,
-            patch("time.sleep"),
-        ):
-            proc = MagicMock()
-            proc.poll.return_value = 0
-            proc.returncode = 0
-            mock_popen.return_value = proc
-            mock_run.return_value = MagicMock(returncode=0)
-
-            runner = CliRunner()
-            result = runner.invoke(
-                cli,
-                ["--roles-root", str(roles_root), "gitea-runner|default|ubuntu-2204|ubuntu:22.04|"],
-            )
-            assert result.exit_code == 0
-            assert "All molecule tests passed" in result.output

tests/unit/test_start_docker.py

@@ -7,13 +7,32 @@ from click.testing import CliRunner
 
 from devx.molecule.start_docker import (
     DOCKER_SOCK,
+    HOST_DOCKER_SOCK,
+    ROOTLESS_SOCK,
     _diagnose_socket,
+    _get_docker_free_bytes,
+    _try_socket,
     is_docker_ready,
     main,
     start_docker_daemon,
 )
 
 
+def _pgrep_empty() -> MagicMock:
+    """Mock for pgrep returning no dockerd processes."""
+    return MagicMock(stdout="", returncode=1)
+
+
+def _docker_info_alive() -> MagicMock:
+    """Mock for docker info showing daemon alive."""
+    return MagicMock(returncode=0)
+
+
+def _docker_info_dead() -> MagicMock:
+    """Mock for docker info showing daemon dead."""
+    return MagicMock(returncode=1)
+
+
 class TestIsDockerReady:
     @patch("devx.molecule.start_docker.subprocess.run")
     def test_ready(self, mock_run: MagicMock) -> None:
@@ -40,6 +59,42 @@ class TestIsDockerReady:
         assert call_kwargs.kwargs["env"]["DOCKER_HOST"] == rootless
 
 
+class TestGetDockerFreeBytes:
+    @patch("devx.molecule.start_docker.shutil.disk_usage")
+    @patch("devx.molecule.start_docker.os.path.exists", return_value=True)
+    @patch("devx.molecule.start_docker.subprocess.run")
+    def test_returns_free_bytes(self, mock_run: MagicMock, mock_exists: MagicMock, mock_du: MagicMock) -> None:
+        mock_run.return_value = MagicMock(stdout="/var/lib/docker\n", returncode=0, text="")
+        mock_du.return_value = MagicMock(free=50 * 1024**3)
+        with patch.dict("os.environ", {"DOCKER_HOST": f"unix://{DOCKER_SOCK}"}, clear=False):
+            assert _get_docker_free_bytes() == 50 * 1024**3
+
+    @patch("devx.molecule.start_docker.subprocess.run")
+    def test_daemon_not_reachable(self, mock_run: MagicMock) -> None:
+        mock_run.return_value = MagicMock(returncode=1, stdout="", text="")
+        assert _get_docker_free_bytes() == 0
+
+    @patch("devx.molecule.start_docker.os.path.exists", return_value=False)
+    @patch("devx.molecule.start_docker.subprocess.run")
+    def test_data_root_not_accessible(self, mock_run: MagicMock, mock_exists: MagicMock) -> None:
+        mock_run.return_value = MagicMock(stdout="/some/path\n", returncode=0, text="")
+        assert _get_docker_free_bytes() == 0
+
+    @patch("devx.molecule.start_docker.subprocess.run", side_effect=FileNotFoundError)
+    def test_subprocess_not_found(self, mock_run: MagicMock) -> None:
+        assert _get_docker_free_bytes() == 0
+
+
+class TestTrySocket:
+    @patch("devx.molecule.start_docker.is_docker_ready", return_value=True)
+    def test_ready(self, mock_ready: MagicMock) -> None:
+        assert _try_socket("/run/user/999/docker.sock") is True
+
+    @patch("devx.molecule.start_docker.is_docker_ready", return_value=False)
+    def test_not_ready(self, mock_ready: MagicMock) -> None:
+        assert _try_socket("/run/user/999/docker.sock") is False
+
+
 class TestDiagnoseSocket:
     @patch("devx.molecule.start_docker.os.stat")
     @patch("devx.molecule.start_docker.os.path.exists", return_value=True)
@@ -86,81 +141,373 @@ class TestDiagnoseSocket:
         mock_exists.assert_called_with(DOCKER_SOCK)
 
 
+def _exists_map(paths: set[str]) -> MagicMock:
+    """Return a mock os.path.exists that returns True only for *paths*."""
+    return MagicMock(side_effect=lambda p: p in paths)
+
+
 class TestStartDockerDaemon:
     @patch("devx.molecule.start_docker._diagnose_socket")
+    @patch("devx.molecule.start_docker._get_docker_free_bytes", return_value=100 * 1024**3)
     @patch("devx.molecule.start_docker.is_docker_ready", return_value=True)
-    def test_host_socket_available(self, mock_ready: MagicMock, mock_diag: MagicMock) -> None:
-        """Should return immediately if host Docker is available."""
+    @patch("devx.molecule.start_docker.os.path.exists", side_effect=_exists_map({DOCKER_SOCK}))
+    @patch("devx.molecule.start_docker.glob.glob", return_value=[])
+    def test_host_socket_available_with_space(
+        self,
+        mock_glob: MagicMock,
+        mock_exists: MagicMock,
+        mock_ready: MagicMock,
+        mock_free: MagicMock,
+        mock_diag: MagicMock,
+    ) -> None:
+        """Should return immediately if /var/run/docker.sock has enough space."""
         assert start_docker_daemon(timeout=5) is True
-        mock_ready.assert_called_once()
         mock_diag.assert_called_once()
 
     @patch("devx.molecule.start_docker._diagnose_socket")
-    @patch("devx.molecule.start_docker.os.path.exists", return_value=True)
-    @patch("devx.molecule.start_docker.is_docker_ready")
-    def test_rootless_socket_available(
-        self, mock_ready: MagicMock, mock_exists: MagicMock, mock_diag: MagicMock
+    @patch("devx.molecule.start_docker._get_docker_free_bytes", return_value=0)
+    @patch("devx.molecule.start_docker.is_docker_ready", return_value=True)
+    @patch("devx.molecule.start_docker.os.path.exists", side_effect=_exists_map({HOST_DOCKER_SOCK}))
+    @patch("devx.molecule.start_docker.glob.glob", return_value=[])
+    def test_host_rootless_inaccessible_root_uses_host(
+        self,
+        mock_glob: MagicMock,
+        mock_exists: MagicMock,
+        mock_ready: MagicMock,
+        mock_free: MagicMock,
+        mock_diag: MagicMock,
     ) -> None:
-        """Should use rootless socket if host socket fails."""
-        # First check (host) fails, second check (rootless) succeeds
+        """Should use host rootless Docker when root dir is inaccessible (free=0)."""
+        assert start_docker_daemon(timeout=5) is True
+
+    @patch("devx.molecule.start_docker._diagnose_socket")
+    @patch("devx.molecule.start_docker._get_docker_free_bytes", return_value=0)
+    @patch("devx.molecule.start_docker.is_docker_ready", return_value=True)
+    @patch("devx.molecule.start_docker.os.path.exists", side_effect=_exists_map({DOCKER_SOCK}))
+    @patch("devx.molecule.start_docker.glob.glob", return_value=[])
+    @patch("devx.molecule.start_docker.subprocess.run")
+    @patch("devx.molecule.start_docker.subprocess.Popen")
+    @patch("devx.molecule.start_docker.tempfile.NamedTemporaryFile")
+    @patch("devx.molecule.start_docker.time.sleep")
+    def test_inner_dockerd_free_zero_starts_local(
+        self,
+        mock_sleep: MagicMock,
+        mock_ntf: MagicMock,
+        mock_popen: MagicMock,
+        mock_run: MagicMock,
+        mock_glob: MagicMock,
+        mock_exists: MagicMock,
+        mock_ready: MagicMock,
+        mock_free: MagicMock,
+        mock_diag: MagicMock,
+    ) -> None:
+        """Inner dockerd with free=0 (not host socket) should NOT be trusted — start local."""
+        mock_ntf.return_value = MagicMock(name="/tmp/dockerd.log")
+        # is_docker_ready: first check (inner dockerd) True, then local daemon checks
+        mock_ready.side_effect = [True, False, False, False, False, True]
+        # subprocess.run: pgrep(socket check, finds dockerd), pgrep(before kill),
+        # pkill x3, pgrep(after kill), docker info(dead), rm
+        mock_run.side_effect = [
+            MagicMock(returncode=0, stdout="123 /usr/bin/dockerd\n"),  # socket check pgrep
+            _pgrep_empty(),
+            MagicMock(),
+            MagicMock(),
+            MagicMock(),
+            _pgrep_empty(),
+            _docker_info_dead(),
+            MagicMock(),
+        ]
+        assert start_docker_daemon(timeout=5) is True
+        mock_popen.assert_called_once()
+
+    @patch("devx.molecule.start_docker._diagnose_socket")
+    @patch("devx.molecule.start_docker._get_docker_free_bytes", return_value=0)
+    @patch("devx.molecule.start_docker.is_docker_ready", return_value=True)
+    @patch("devx.molecule.start_docker.os.path.exists", side_effect=_exists_map({DOCKER_SOCK}))
+    @patch("devx.molecule.start_docker.glob.glob", return_value=[])
+    @patch("devx.molecule.start_docker.subprocess.run")
+    def test_no_inner_dockerd_trusts_host_socket(
+        self,
+        mock_run: MagicMock,
+        mock_glob: MagicMock,
+        mock_exists: MagicMock,
+        mock_ready: MagicMock,
+        mock_free: MagicMock,
+        mock_diag: MagicMock,
+    ) -> None:
+        """Should trust /var/run/docker.sock with free=0 when no inner dockerd exists."""
+        # pgrep finds no dockerd processes (returncode=1)
+        mock_run.return_value = MagicMock(returncode=1, stdout="")
+        assert start_docker_daemon(timeout=5) is True
+        assert os.environ.get("DOCKER_HOST") == f"unix://{DOCKER_SOCK}"
+
+    @patch("devx.molecule.start_docker._diagnose_socket")
+    @patch("devx.molecule.start_docker._get_docker_free_bytes")
+    @patch("devx.molecule.start_docker.is_docker_ready")
+    @patch("devx.molecule.start_docker.os.path.exists", side_effect=_exists_map({DOCKER_SOCK}))
+    @patch("devx.molecule.start_docker.glob.glob", return_value=[])
+    @patch("devx.molecule.start_docker.subprocess.run")
+    @patch("devx.molecule.start_docker.subprocess.Popen")
+    @patch("devx.molecule.start_docker.tempfile.NamedTemporaryFile")
+    @patch("devx.molecule.start_docker.time.sleep")
+    def test_host_socket_low_space_starts_local(
+        self,
+        mock_sleep: MagicMock,
+        mock_ntf: MagicMock,
+        mock_popen: MagicMock,
+        mock_run: MagicMock,
+        mock_glob: MagicMock,
+        mock_exists: MagicMock,
+        mock_ready: MagicMock,
+        mock_free: MagicMock,
+        mock_diag: MagicMock,
+    ) -> None:
+        """Should start local dockerd if host Docker has low space and no rootless sockets."""
+        mock_ntf.return_value = MagicMock(name="/tmp/dockerd.log")
+        mock_ready.side_effect = [True, False, False, False, False, True]
+        mock_free.return_value = 5 * 1024**3
+        # subprocess.run: pgrep(before), pkill x3, pgrep(after), docker info(dead), rm
+        mock_run.side_effect = [
+            _pgrep_empty(),
+            MagicMock(),
+            MagicMock(),
+            MagicMock(),
+            _pgrep_empty(),
+            _docker_info_dead(),
+            MagicMock(),
+        ]
+        assert start_docker_daemon(timeout=5) is True
+        mock_popen.assert_called_once()
+
+    @patch("devx.molecule.start_docker._diagnose_socket")
+    @patch("devx.molecule.start_docker._get_docker_free_bytes")
+    @patch("devx.molecule.start_docker.is_docker_ready")
+    @patch("devx.molecule.start_docker.os.path.exists", side_effect=_exists_map({DOCKER_SOCK}))
+    @patch("devx.molecule.start_docker.glob.glob", return_value=[])
+    @patch("devx.molecule.start_docker.subprocess.run")
+    @patch("devx.molecule.start_docker.subprocess.Popen")
+    @patch("devx.molecule.start_docker.tempfile.NamedTemporaryFile")
+    @patch("devx.molecule.start_docker.time.sleep")
+    def test_inner_dockerd_alive_uses_alt_sock(
+        self,
+        mock_sleep: MagicMock,
+        mock_ntf: MagicMock,
+        mock_popen: MagicMock,
+        mock_run: MagicMock,
+        mock_glob: MagicMock,
+        mock_exists: MagicMock,
+        mock_ready: MagicMock,
+        mock_free: MagicMock,
+        mock_diag: MagicMock,
+    ) -> None:
+        """Should use /dev/shm/docker.sock if inner dockerd can't be killed."""
+        mock_ntf.return_value = MagicMock(name="/tmp/dockerd.log")
+        mock_ready.side_effect = [True, False, False, False, False, True]
+        mock_free.return_value = 5 * 1024**3
+        # subprocess.run: pgrep(before), pkill x3, pgrep(after), docker info(alive), rm
+        mock_run.side_effect = [
+            _pgrep_empty(),
+            MagicMock(),
+            MagicMock(),
+            MagicMock(),
+            _pgrep_empty(),
+            _docker_info_alive(),
+            MagicMock(),
+        ]
+        assert start_docker_daemon(timeout=5) is True
+        mock_popen.assert_called_once()
+        assert os.environ.get("DOCKER_HOST") == "unix:///dev/shm/docker.sock"
+
+    @patch("devx.molecule.start_docker.os.kill")
+    @patch("devx.molecule.start_docker._diagnose_socket")
+    @patch("devx.molecule.start_docker._get_docker_free_bytes")
+    @patch("devx.molecule.start_docker.is_docker_ready")
+    @patch("devx.molecule.start_docker.os.path.exists", side_effect=_exists_map({DOCKER_SOCK}))
+    @patch("devx.molecule.start_docker.glob.glob", return_value=[])
+    @patch("devx.molecule.start_docker.subprocess.run")
+    @patch("devx.molecule.start_docker.subprocess.Popen")
+    @patch("devx.molecule.start_docker.tempfile.NamedTemporaryFile")
+    @patch("devx.molecule.start_docker.time.sleep")
+    def test_inner_dockerd_killed_by_pid(
+        self,
+        mock_sleep: MagicMock,
+        mock_ntf: MagicMock,
+        mock_popen: MagicMock,
+        mock_run: MagicMock,
+        mock_glob: MagicMock,
+        mock_exists: MagicMock,
+        mock_ready: MagicMock,
+        mock_free: MagicMock,
+        mock_diag: MagicMock,
+        mock_kill: MagicMock,
+    ) -> None:
+        """Should kill dockerd by PID when pkill fails and pgrep finds processes."""
+        mock_ntf.return_value = MagicMock(name="/tmp/dockerd.log")
+        mock_ready.side_effect = [True, False, False, False, False, True]
+        mock_free.return_value = 5 * 1024**3
+        # pgrep(before) empty, pkill x3, pgrep(after) finds PID 12345, docker info(dead), rm
+        mock_run.side_effect = [
+            _pgrep_empty(),
+            MagicMock(),
+            MagicMock(),
+            MagicMock(),
+            MagicMock(stdout="12345 /usr/bin/dockererd\n", returncode=0),
+            _docker_info_dead(),
+            MagicMock(),
+        ]
+        assert start_docker_daemon(timeout=5) is True
+        mock_popen.assert_called_once()
+        mock_kill.assert_called_once_with(12345, 9)
+
+    @patch("devx.molecule.start_docker._diagnose_socket")
+    @patch("devx.molecule.start_docker._get_docker_free_bytes")
+    @patch("devx.molecule.start_docker.is_docker_ready")
+    @patch("devx.molecule.start_docker.os.path.exists", side_effect=_exists_map({DOCKER_SOCK, HOST_DOCKER_SOCK}))
+    @patch("devx.molecule.start_docker.glob.glob", return_value=[])
+    def test_host_rootless_preferred_over_inner_dockerd(
+        self,
+        mock_glob: MagicMock,
+        mock_exists: MagicMock,
+        mock_ready: MagicMock,
+        mock_free: MagicMock,
+        mock_diag: MagicMock,
+    ) -> None:
+        """Should prefer /run/host-docker.sock over /var/run/docker.sock."""
+        # host rootless ready with space, inner dockerd never tried
+        mock_ready.side_effect = [True]
+        mock_free.side_effect = [200 * 1024**3]
+        assert start_docker_daemon(timeout=5) is True
+        # DOCKER_HOST should be set to host socket
+        assert os.environ.get("DOCKER_HOST") == f"unix://{HOST_DOCKER_SOCK}"
+
+    @patch("devx.molecule.start_docker._diagnose_socket")
+    @patch("devx.molecule.start_docker._get_docker_free_bytes", return_value=100 * 1024**3)
+    @patch("devx.molecule.start_docker.is_docker_ready")
+    @patch("devx.molecule.start_docker.os.path.exists", side_effect=_exists_map({DOCKER_SOCK, HOST_DOCKER_SOCK}))
+    @patch("devx.molecule.start_docker.glob.glob", return_value=[])
+    def test_host_rootless_not_ready_falls_to_inner(
+        self,
+        mock_glob: MagicMock,
+        mock_exists: MagicMock,
+        mock_ready: MagicMock,
+        mock_free: MagicMock,
+        mock_diag: MagicMock,
+    ) -> None:
+        """Should fall through to inner dockerd if host rootless socket is not ready."""
         mock_ready.side_effect = [False, True]
-        with patch("devx.molecule.start_docker.glob.glob", return_value=[]):
-            assert start_docker_daemon(timeout=5) is True
+        assert start_docker_daemon(timeout=5) is True
+        assert os.environ.get("DOCKER_HOST") == f"unix://{DOCKER_SOCK}"
 
     @patch("devx.molecule.start_docker._diagnose_socket")
-    @patch("devx.molecule.start_docker.os.path.exists", return_value=True)
-    @patch("devx.molecule.start_docker.is_docker_ready")
-    def test_alt_rootless_socket_found(
-        self, mock_ready: MagicMock, mock_exists: MagicMock, mock_diag: MagicMock
+    @patch("devx.molecule.start_docker._get_docker_free_bytes", return_value=100 * 1024**3)
+    @patch("devx.molecule.start_docker.is_docker_ready", return_value=True)
+    @patch(
+        "devx.molecule.start_docker.os.path.exists",
+        side_effect=_exists_map({DOCKER_SOCK, HOST_DOCKER_SOCK, ROOTLESS_SOCK, "/run/user/999/docker.sock"}),
+    )
+    @patch("devx.molecule.start_docker.glob.glob", return_value=["/run/user/999/docker.sock"])
+    def test_glob_finds_extra_rootless_socket(
+        self,
+        mock_glob: MagicMock,
+        mock_exists: MagicMock,
+        mock_ready: MagicMock,
+        mock_free: MagicMock,
+        mock_diag: MagicMock,
     ) -> None:
-        """Should find rootless socket at a different UID via glob scan."""
-        # Host fails, own rootless fails, alt rootless succeeds
-        mock_ready.side_effect = [False, False, True]
-        alt_sock = "/run/user/999/docker.sock"
-        with patch("devx.molecule.start_docker.glob.glob", return_value=[alt_sock]):
-            assert start_docker_daemon(timeout=5) is True
+        """Should include rootless sockets found via glob scan."""
+        assert start_docker_daemon(timeout=5) is True
 
     @patch("devx.molecule.start_docker._diagnose_socket")
-    @patch("devx.molecule.start_docker.os.path.exists", return_value=True)
+    @patch("devx.molecule.start_docker._get_docker_free_bytes")
     @patch("devx.molecule.start_docker.is_docker_ready")
-    def test_alt_rootless_socket_skips_own(
-        self, mock_ready: MagicMock, mock_exists: MagicMock, mock_diag: MagicMock
+    @patch("devx.molecule.start_docker.os.path.exists", side_effect=_exists_map({DOCKER_SOCK, HOST_DOCKER_SOCK}))
+    @patch("devx.molecule.start_docker.glob.glob", return_value=[])
+    def test_inner_dockerd_fallback_when_host_rootless_low_space(
+        self,
+        mock_glob: MagicMock,
+        mock_exists: MagicMock,
+        mock_ready: MagicMock,
+        mock_free: MagicMock,
+        mock_diag: MagicMock,
     ) -> None:
-        """Should skip the own rootless socket in glob scan (already tried)."""
-        # Host fails, own rootless fails, alt rootless also fails, dockerd fails
-        mock_ready.side_effect = [False, False, False, False, False, False]
-        own_sock = f"/run/user/{os.getuid()}/docker.sock"
-        alt_sock = "/run/user/999/docker.sock"
-        with (
-            patch("devx.molecule.start_docker.glob.glob", return_value=[own_sock, alt_sock]),
-            patch("devx.molecule.start_docker.time.sleep"),
-            patch("devx.molecule.start_docker.subprocess.Popen"),
-            patch("devx.molecule.start_docker.tempfile.NamedTemporaryFile") as mock_ntf,
-            patch("builtins.open", mock_open(read_data="err")),
-        ):
-            mock_ntf.return_value = MagicMock(name="/tmp/dockerd.log")
-            assert start_docker_daemon(timeout=2) is False
+        """Should fall back to inner dockerd if host rootless has low space."""
+        # host rootless ready low space, inner dockerd ready with space
+        mock_ready.side_effect = [True, True]
+        mock_free.side_effect = [5 * 1024**3, 200 * 1024**3]
+        assert start_docker_daemon(timeout=5) is True
+        assert os.environ.get("DOCKER_HOST") == f"unix://{DOCKER_SOCK}"
+
+    @patch("devx.molecule.start_docker._diagnose_socket")
+    @patch("devx.molecule.start_docker._get_docker_free_bytes")
+    @patch("devx.molecule.start_docker.is_docker_ready")
+    @patch("devx.molecule.start_docker.os.path.exists", side_effect=_exists_map({DOCKER_SOCK}))
+    @patch("devx.molecule.start_docker.glob.glob", return_value=[])
+    @patch("devx.molecule.start_docker.subprocess.run")
+    @patch("devx.molecule.start_docker.subprocess.Popen")
+    @patch("devx.molecule.start_docker.tempfile.NamedTemporaryFile")
+    @patch("devx.molecule.start_docker.time.sleep")
+    def test_all_sockets_low_space_starts_local(
+        self,
+        mock_sleep: MagicMock,
+        mock_ntf: MagicMock,
+        mock_popen: MagicMock,
+        mock_run: MagicMock,
+        mock_glob: MagicMock,
+        mock_exists: MagicMock,
+        mock_ready: MagicMock,
+        mock_free: MagicMock,
+        mock_diag: MagicMock,
+    ) -> None:
+        """Should start local dockerd if all sockets have low space."""
+        mock_ntf.return_value = MagicMock(name="/tmp/dockerd.log")
+        mock_ready.side_effect = [True, False, False, False, False, True]
+        mock_free.return_value = 5 * 1024**3
+        # subprocess.run: pgrep(before), pkill x3, pgrep(after), docker info(dead), rm
+        mock_run.side_effect = [
+            _pgrep_empty(),
+            MagicMock(),
+            MagicMock(),
+            MagicMock(),
+            _pgrep_empty(),
+            _docker_info_dead(),
+            MagicMock(),
+        ]
+        assert start_docker_daemon(timeout=5) is True
+        mock_popen.assert_called_once()
 
     @patch("devx.molecule.start_docker.glob.glob", return_value=[])
     @patch("devx.molecule.start_docker._diagnose_socket")
+    @patch("devx.molecule.start_docker._get_docker_free_bytes", return_value=0)
     @patch("devx.molecule.start_docker.os.path.exists", return_value=False)
     @patch("devx.molecule.start_docker.is_docker_ready", return_value=False)
     @patch("devx.molecule.start_docker.time.sleep")
+    @patch("devx.molecule.start_docker.subprocess.run")
     @patch("devx.molecule.start_docker.subprocess.Popen")
     @patch("devx.molecule.start_docker.tempfile.NamedTemporaryFile")
     def test_starts_local_daemon(
         self,
         mock_ntf: MagicMock,
         mock_popen: MagicMock,
+        mock_run: MagicMock,
         mock_sleep: MagicMock,
         mock_ready: MagicMock,
         mock_exists: MagicMock,
+        mock_free: MagicMock,
         mock_diag: MagicMock,
         mock_glob: MagicMock,
     ) -> None:
         mock_ntf.return_value = MagicMock(name="/tmp/dockerd.log")
-        # Host fails, rootless doesn't exist, local daemon starts
+        # No sockets exist, local daemon starts
         mock_ready.side_effect = [False, False, False, False, True]
+        # subprocess.run: pgrep(before), pkill x3, pgrep(after), rm
+        mock_run.side_effect = [
+            _pgrep_empty(),
+            MagicMock(),
+            MagicMock(),
+            MagicMock(),
+            _pgrep_empty(),
+            MagicMock(),
+        ]
         assert start_docker_daemon(timeout=5) is True
         mock_popen.assert_called_once()
         popen_args = mock_popen.call_args.args[0]
@@ -171,18 +518,22 @@ class TestStartDockerDaemon:
 
     @patch("devx.molecule.start_docker.glob.glob", return_value=[])
     @patch("devx.molecule.start_docker._diagnose_socket")
+    @patch("devx.molecule.start_docker._get_docker_free_bytes", return_value=0)
     @patch("devx.molecule.start_docker.os.path.exists", return_value=False)
     @patch("devx.molecule.start_docker.is_docker_ready", return_value=False)
     @patch("devx.molecule.start_docker.time.sleep")
+    @patch("devx.molecule.start_docker.subprocess.run")
     @patch("devx.molecule.start_docker.subprocess.Popen")
     @patch("devx.molecule.start_docker.tempfile.NamedTemporaryFile")
     def test_fails_after_timeout(
         self,
         mock_ntf: MagicMock,
         mock_popen: MagicMock,
+        mock_run: MagicMock,
         mock_sleep: MagicMock,
         mock_ready: MagicMock,
         mock_exists: MagicMock,
+        mock_free: MagicMock,
         mock_diag: MagicMock,
         mock_glob: MagicMock,
     ) -> None:
@@ -190,22 +541,26 @@ class TestStartDockerDaemon:
         with patch("builtins.open", mock_open(read_data="dockerd error log")):
             assert start_docker_daemon(timeout=3) is False
         mock_popen.assert_called_once()
-        assert mock_sleep.call_count == 3
+        assert mock_sleep.call_count == 5  # 1 after pkill + 1 after pgrep + 3 timeout retries
 
     @patch("devx.molecule.start_docker.glob.glob", return_value=[])
     @patch("devx.molecule.start_docker._diagnose_socket")
+    @patch("devx.molecule.start_docker._get_docker_free_bytes", return_value=0)
     @patch("devx.molecule.start_docker.os.path.exists", return_value=False)
     @patch("devx.molecule.start_docker.is_docker_ready", return_value=False)
     @patch("devx.molecule.start_docker.time.sleep")
+    @patch("devx.molecule.start_docker.subprocess.run")
     @patch("devx.molecule.start_docker.subprocess.Popen")
     @patch("devx.molecule.start_docker.tempfile.NamedTemporaryFile")
     def test_fails_log_read_error(
         self,
         mock_ntf: MagicMock,
         mock_popen: MagicMock,
+        mock_run: MagicMock,
         mock_sleep: MagicMock,
         mock_ready: MagicMock,
         mock_exists: MagicMock,
+        mock_free: MagicMock,
         mock_diag: MagicMock,
         mock_glob: MagicMock,
     ) -> None:
@@ -216,35 +571,45 @@ class TestStartDockerDaemon:
 
     @patch("devx.molecule.start_docker.glob.glob", return_value=[])
     @patch("devx.molecule.start_docker._diagnose_socket")
+    @patch("devx.molecule.start_docker._get_docker_free_bytes", return_value=0)
     @patch("devx.molecule.start_docker.os.path.exists", return_value=False)
     @patch("devx.molecule.start_docker.is_docker_ready")
     @patch("devx.molecule.start_docker.time.sleep")
+    @patch("devx.molecule.start_docker.subprocess.run")
     @patch("devx.molecule.start_docker.subprocess.Popen")
     @patch("devx.molecule.start_docker.tempfile.NamedTemporaryFile")
     def test_local_daemon_ready_on_first_check(
         self,
         mock_ntf: MagicMock,
         mock_popen: MagicMock,
+        mock_run: MagicMock,
         mock_sleep: MagicMock,
         mock_ready: MagicMock,
         mock_exists: MagicMock,
+        mock_free: MagicMock,
         mock_diag: MagicMock,
         mock_glob: MagicMock,
     ) -> None:
         mock_ntf.return_value = MagicMock(name="/tmp/dockerd.log")
-        # Host fails, rootless doesn't exist, local ready on first loop check
+        # No sockets exist, local ready on second loop check
         mock_ready.side_effect = [False, False, True]
         assert start_docker_daemon(timeout=5) is True
         assert mock_popen.call_count == 1
-        assert mock_sleep.call_count == 1
+        assert mock_sleep.call_count == 4  # 1 after pkill + 1 after pgrep + 2 loop retries
 
     @patch("devx.molecule.start_docker._diagnose_socket")
+    @patch("devx.molecule.start_docker._get_docker_free_bytes", return_value=100 * 1024**3)
     @patch("devx.molecule.start_docker.os.environ")
     @patch("devx.molecule.start_docker.is_docker_ready", return_value=True)
+    @patch("devx.molecule.start_docker.os.path.exists", side_effect=_exists_map({DOCKER_SOCK}))
+    @patch("devx.molecule.start_docker.glob.glob", return_value=[])
     def test_sets_docker_host(
         self,
+        mock_glob: MagicMock,
+        mock_exists: MagicMock,
         mock_ready: MagicMock,
         mock_environ: MagicMock,
+        mock_free: MagicMock,
         mock_diag: MagicMock,
     ) -> None:
         """DOCKER_HOST must be set so molecule connects to correct socket."""

tests/unit/test_tools_check_ansible_set_fact_to_json.py

@@ -268,18 +268,6 @@ class TestCheckFile:
         errors = _check_file(f, tmp_path)
         assert len(errors) == 2
 
-    def test_check_file_os_error(self, tmp_path: Path, monkeypatch) -> None:
-        """OSError reading a file returns empty errors (not a crash)."""
-        f = tmp_path / "playbook.yml"
-        f.write_text("- name: ok\n  set_fact:\n    x: 1\n")
-
-        def _raise(*args, **kwargs):
-            raise OSError("disk error")
-
-        monkeypatch.setattr(Path, "read_text", _raise)
-        errors = _check_file(f, tmp_path)
-        assert errors == []
-
 
 class TestMain:
     def test_passes_when_clean(self, tmp_path: Path):

tests/unit/test_wait_for_checks.py

@@ -1,272 +0,0 @@
-"""Unit tests for devx.ci.wait_for_checks."""
-
-from unittest.mock import MagicMock, patch
-
-import pytest
-from click.testing import CliRunner
-
-from devx.ci.wait_for_checks import (
-    main,
-    poll_until_complete,
-    query_job_status,
-)
-
-
-def _mock_response(status_code: int = 200, json_data: object | None = None) -> MagicMock:
-    m = MagicMock()
-    m.status_code = status_code
-    if json_data is None:
-        m.json.side_effect = ValueError("no json")
-    else:
-        m.json.return_value = json_data
-    return m
-
-
-class TestQueryJobStatus:
-    @patch("devx.ci.wait_for_checks.requests.get")
-    def test_returns_matching_jobs(self, mock_get: MagicMock) -> None:
-        """Jobs whose name starts with the prefix are returned."""
-        mock_get.side_effect = [
-            _mock_response(200, [{"id": 1}, {"id": 2}]),
-            _mock_response(200, [{"name": "molecule-tests (1)", "status": "completed", "conclusion": "success"}]),
-            _mock_response(200, [{"name": "other-job", "status": "completed", "conclusion": "success"}]),
-        ]
-        result = query_job_status("https://api", "tok", "o/r", "molecule-tests")
-        assert len(result) == 1
-        assert result[0]["name"] == "molecule-tests (1)"
-        assert result[0]["status"] == "completed"
-        assert result[0]["conclusion"] == "success"
-
-    @patch("devx.ci.wait_for_checks.requests.get")
-    def test_no_matching_jobs(self, mock_get: MagicMock) -> None:
-        """When no job names match the prefix, returns empty list."""
-        mock_get.side_effect = [
-            _mock_response(200, [{"id": 1}]),
-            _mock_response(200, [{"name": "other-job", "status": "completed", "conclusion": "success"}]),
-        ]
-        result = query_job_status("https://api", "tok", "o/r", "molecule-tests")
-        assert result == []
-
-    @patch("devx.ci.wait_for_checks.requests.get")
-    def test_api_error_returns_empty(self, mock_get: MagicMock) -> None:
-        """Network errors on the runs endpoint return an empty list."""
-        import requests
-
-        mock_get.side_effect = requests.ConnectionError("down")
-        result = query_job_status("https://api", "tok", "o/r", "molecule-tests")
-        assert result == []
-
-    @patch("devx.ci.wait_for_checks.requests.get")
-    def test_non_200_returns_empty(self, mock_get: MagicMock) -> None:
-        """Non-200 on runs endpoint returns empty list."""
-        mock_get.side_effect = [_mock_response(500, {"message": "err"})]
-        result = query_job_status("https://api", "tok", "o/r", "molecule-tests")
-        assert result == []
-
-    @patch("devx.ci.wait_for_checks.requests.get")
-    def test_jobs_as_dict_with_jobs_key(self, mock_get: MagicMock) -> None:
-        """Jobs endpoint returning {'jobs': [...]} dict is handled."""
-        mock_get.side_effect = [
-            _mock_response(200, [{"id": 1}]),
-            _mock_response(
-                200, {"jobs": [{"name": "molecule-tests (1)", "status": "in_progress", "conclusion": None}]}
-            ),
-        ]
-        result = query_job_status("https://api", "tok", "o/r", "molecule-tests")
-        assert len(result) == 1
-        assert result[0]["status"] == "in_progress"
-
-    @patch("devx.ci.wait_for_checks.requests.get")
-    def test_runs_as_dict_with_runs_key(self, mock_get: MagicMock) -> None:
-        """Runs endpoint returning {'runs': [...]} dict is handled."""
-        mock_get.side_effect = [
-            _mock_response(200, {"runs": [{"id": 1}]}),
-            _mock_response(200, [{"name": "molecule-tests (1)", "status": "completed", "conclusion": "success"}]),
-        ]
-        result = query_job_status("https://api", "tok", "o/r", "molecule-tests")
-        assert len(result) == 1
-
-    @patch("devx.ci.wait_for_checks.requests.get")
-    def test_jobs_endpoint_error_skips_run(self, mock_get: MagicMock) -> None:
-        """A failed jobs query for one run doesn't abort the whole call."""
-        mock_get.side_effect = [
-            _mock_response(200, [{"id": 1}, {"id": 2}]),
-            _mock_response(500, {"message": "err"}),
-            _mock_response(200, [{"name": "molecule-tests (1)", "status": "completed", "conclusion": "success"}]),
-        ]
-        result = query_job_status("https://api", "tok", "o/r", "molecule-tests")
-        assert len(result) == 1
-
-    @patch("devx.ci.wait_for_checks.requests.get")
-    def test_run_without_id_skipped(self, mock_get: MagicMock) -> None:
-        """Runs missing an 'id' field are skipped."""
-        mock_get.side_effect = [
-            _mock_response(200, [{"foo": "bar"}, {"id": 1}]),
-            _mock_response(200, [{"name": "molecule-tests (1)", "status": "completed", "conclusion": "success"}]),
-        ]
-        result = query_job_status("https://api", "tok", "o/r", "molecule-tests")
-        assert len(result) == 1
-
-    @patch("devx.ci.wait_for_checks.requests.get")
-    def test_jobs_query_exception_skips_run(self, mock_get: MagicMock) -> None:
-        """A ConnectionError on the jobs endpoint for one run is skipped."""
-        import requests
-
-        mock_get.side_effect = [
-            _mock_response(200, [{"id": 1}, {"id": 2}]),
-            requests.ConnectionError("down"),
-            _mock_response(200, [{"name": "molecule-tests (1)", "status": "completed", "conclusion": "success"}]),
-        ]
-        result = query_job_status("https://api", "tok", "o/r", "molecule-tests")
-        assert len(result) == 1
-
-    @patch("devx.ci.wait_for_checks.requests.get")
-    def test_jobs_json_value_error_skips_run(self, mock_get: MagicMock) -> None:
-        """A ValueError (bad JSON) on the jobs endpoint is skipped."""
-        mock_get.side_effect = [
-            _mock_response(200, [{"id": 1}]),
-            _mock_response(200),  # json raises ValueError by default
-        ]
-        result = query_job_status("https://api", "tok", "o/r", "molecule-tests")
-        assert result == []
-
-
-class TestPollUntilComplete:
-    @patch("devx.ci.wait_for_checks.time.sleep")
-    @patch("devx.ci.wait_for_checks.time.monotonic")
-    @patch("devx.ci.wait_for_checks.query_job_status")
-    def test_all_jobs_succeed(self, mock_query: MagicMock, mock_mono: MagicMock, mock_sleep: MagicMock) -> None:
-        """All jobs completed with success → returns 0."""
-        mock_query.return_value = [{"name": "molecule-tests (1)", "status": "completed", "conclusion": "success"}]
-        mock_mono.side_effect = [0.0, 0.0]
-        code = poll_until_complete("https://api", "tok", "o/r", "molecule-tests", timeout=100, interval=10)
-        assert code == 0
-
-    @patch("devx.ci.wait_for_checks.time.sleep")
-    @patch("devx.ci.wait_for_checks.time.monotonic")
-    @patch("devx.ci.wait_for_checks.query_job_status")
-    def test_job_fails(self, mock_query: MagicMock, mock_mono: MagicMock, mock_sleep: MagicMock) -> None:
-        """A job with non-success conclusion → returns 1."""
-        mock_query.return_value = [{"name": "molecule-tests (1)", "status": "completed", "conclusion": "failure"}]
-        mock_mono.side_effect = [0.0, 0.0]
-        code = poll_until_complete("https://api", "tok", "o/r", "molecule-tests", timeout=100, interval=10)
-        assert code == 1
-
-    @patch("devx.ci.wait_for_checks.time.sleep")
-    @patch("devx.ci.wait_for_checks.time.monotonic")
-    @patch("devx.ci.wait_for_checks.query_job_status")
-    def test_no_require_success(self, mock_query: MagicMock, mock_mono: MagicMock, mock_sleep: MagicMock) -> None:
-        """With require_success=False, a failed job returns 0."""
-        mock_query.return_value = [{"name": "molecule-tests (1)", "status": "completed", "conclusion": "failure"}]
-        mock_mono.side_effect = [0.0, 0.0]
-        code = poll_until_complete(
-            "https://api", "tok", "o/r", "molecule-tests", timeout=100, interval=10, require_success=False
-        )
-        assert code == 0
-
-    @patch("devx.ci.wait_for_checks.time.sleep")
-    @patch("devx.ci.wait_for_checks.time.monotonic")
-    @patch("devx.ci.wait_for_checks.query_job_status")
-    def test_timeout(self, mock_query: MagicMock, mock_mono: MagicMock, mock_sleep: MagicMock) -> None:
-        """Jobs never complete → returns 2 after timeout."""
-        mock_query.return_value = [{"name": "molecule-tests (1)", "status": "in_progress", "conclusion": None}]
-        # monotonic calls: deadline=0, while-check=0 (enter), sleep-calc=0, while-check=200 (exit)
-        mock_mono.side_effect = [0.0, 0.0, 0.0, 200.0]
-        code = poll_until_complete("https://api", "tok", "o/r", "molecule-tests", timeout=100, interval=10)
-        assert code == 2
-
-    @patch("devx.ci.wait_for_checks.time.sleep")
-    @patch("devx.ci.wait_for_checks.time.monotonic")
-    @patch("devx.ci.wait_for_checks.query_job_status")
-    def test_no_jobs_found_timeout(self, mock_query: MagicMock, mock_mono: MagicMock, mock_sleep: MagicMock) -> None:
-        """No matching jobs at all → returns 3."""
-        mock_query.return_value = []
-        # monotonic calls: deadline=0, while-check=0 (enter), sleep-calc=0, while-check=200 (exit)
-        mock_mono.side_effect = [0.0, 0.0, 0.0, 200.0]
-        code = poll_until_complete("https://api", "tok", "o/r", "molecule-tests", timeout=100, interval=10)
-        assert code == 3
-
-    @patch("devx.ci.wait_for_checks.time.sleep")
-    @patch("devx.ci.wait_for_checks.time.monotonic")
-    @patch("devx.ci.wait_for_checks.query_job_status")
-    def test_in_progress_then_success(self, mock_query: MagicMock, mock_mono: MagicMock, mock_sleep: MagicMock) -> None:
-        """First poll in_progress, second poll success → returns 0."""
-        mock_query.side_effect = [
-            [{"name": "molecule-tests (1)", "status": "in_progress", "conclusion": None}],
-            [{"name": "molecule-tests (1)", "status": "completed", "conclusion": "success"}],
-        ]
-        # monotonic: deadline=0, while=0 (enter), sleep-calc=0, while=5 (enter), success→return
-        mock_mono.side_effect = [0.0, 0.0, 0.0, 5.0]
-        code = poll_until_complete("https://api", "tok", "o/r", "molecule-tests", timeout=100, interval=10)
-        assert code == 0
-
-
-class TestMain:
-    @patch("devx.ci.wait_for_checks.get_ci_token", return_value="tok")
-    @patch("devx.ci.wait_for_checks.poll_until_complete", return_value=0)
-    def test_success_exit_code(self, mock_poll: MagicMock, mock_token: MagicMock) -> None:
-        runner = CliRunner()
-        result = runner.invoke(main, ["--job-name", "molecule-tests", "--repo", "o/r"])
-        assert result.exit_code == 0
-
-    @patch("devx.ci.wait_for_checks.get_ci_token", return_value="tok")
-    @patch("devx.ci.wait_for_checks.poll_until_complete", return_value=1)
-    def test_failure_exit_code(self, mock_poll: MagicMock, mock_token: MagicMock) -> None:
-        runner = CliRunner()
-        result = runner.invoke(main, ["--job-name", "molecule-tests", "--repo", "o/r"])
-        assert result.exit_code == 1
-
-    @patch("devx.ci.wait_for_checks.get_ci_token", return_value="tok")
-    @patch("devx.ci.wait_for_checks.poll_until_complete", return_value=2)
-    def test_timeout_exit_code(self, mock_poll: MagicMock, mock_token: MagicMock) -> None:
-        runner = CliRunner()
-        result = runner.invoke(main, ["--job-name", "molecule-tests", "--repo", "o/r"])
-        assert result.exit_code == 2
-
-    @patch("devx.ci.wait_for_checks.get_ci_token", return_value="tok")
-    @patch("devx.ci.wait_for_checks.poll_until_complete", return_value=3)
-    def test_api_error_exit_code(self, mock_poll: MagicMock, mock_token: MagicMock) -> None:
-        runner = CliRunner()
-        result = runner.invoke(main, ["--job-name", "molecule-tests", "--repo", "o/r"])
-        assert result.exit_code == 3
-
-    def test_missing_job_name(self) -> None:
-        runner = CliRunner()
-        result = runner.invoke(main, ["--repo", "o/r"])
-        assert result.exit_code != 0
-
-    def test_missing_repo(self, monkeypatch: pytest.MonkeyPatch) -> None:
-        monkeypatch.delenv("GITHUB_REPOSITORY", raising=False)
-        runner = CliRunner()
-        result = runner.invoke(main, ["--job-name", "molecule-tests"])
-        assert result.exit_code != 0
-
-    @patch("devx.ci.wait_for_checks.get_ci_token", return_value="tok")
-    @patch("devx.ci.wait_for_checks.poll_until_complete", return_value=0)
-    def test_repo_from_env(self, mock_poll: MagicMock, mock_token: MagicMock, monkeypatch: pytest.MonkeyPatch) -> None:
-        monkeypatch.setenv("GITHUB_REPOSITORY", "oblachno-oss/grm")
-        runner = CliRunner()
-        result = runner.invoke(main, ["--job-name", "molecule-tests"])
-        assert result.exit_code == 0
-        args, kwargs = mock_poll.call_args
-        assert args[2] == "oblachno-oss/grm"
-
-    @patch("devx.ci.wait_for_checks.get_ci_token", return_value="tok")
-    @patch("devx.ci.wait_for_checks.poll_until_complete", return_value=0)
-    def test_invalid_timeout(self, mock_poll: MagicMock, mock_token: MagicMock) -> None:
-        runner = CliRunner()
-        result = runner.invoke(main, ["--job-name", "molecule-tests", "--repo", "o/r", "--timeout", "0"])
-        assert result.exit_code != 0
-
-    @patch("devx.ci.wait_for_checks.get_ci_token", return_value="tok")
-    @patch("devx.ci.wait_for_checks.poll_until_complete", return_value=0)
-    def test_invalid_interval(self, mock_poll: MagicMock, mock_token: MagicMock) -> None:
-        runner = CliRunner()
-        result = runner.invoke(main, ["--job-name", "molecule-tests", "--repo", "o/r", "--poll-interval", "0"])
-        assert result.exit_code != 0
-
-    @patch("devx.ci.wait_for_checks.get_ci_token", side_effect=__import__("click").ClickException("no token"))
-    def test_no_token_exit_3(self, mock_token: MagicMock) -> None:
-        runner = CliRunner()
-        result = runner.invoke(main, ["--job-name", "molecule-tests", "--repo", "o/r"])
-        assert result.exit_code == 3