fix: add tenacity retry to install_tools._download for transient network failures

The build-images CI job failed because GitHub releases dropped
connections ("Remote end closed connection without response") for
actionlint, vale, and hadolint simultaneously. The previous code only
fell through to the next fallback URL — there was no retry on the same
URL for transient connection resets.

Now uses tenacity.Retrying with exponential backoff (2-10s, 3 attempts)
on URLError/OSError/ConnectionError, matching the pattern already used
in devx.utils.network. The _sleep kwarg allows tests to skip real
sleeping.

3 new tests cover: retry-then-success, exhaustion-after-max-retries,
and no-retry-on-non-transient-errors.

Generated with [Devin](https://devin.ai)

Co-Authored-By: Devin <158243242+devin-ai-integration[bot]@users.noreply.github.com>

.gitea/actions/notify-failure/action.yml

@@ -1,47 +0,0 @@
-name: 'Notify on failure'
-description: 'Create a Gitea issue when a CI workflow fails (calls devx.ci.notify_failure)'
-
-# Composite action for the common "Notify on failure" step pattern.
-# Replaces the repeated inline:
-#   - name: Notify on failure
-#     if: failure()
-#     env:
-#       CI_GITEA_API_TOKEN: ${{ secrets.CI_GITEA_API_TOKEN }}
-#     run: |
-#       . .venv/bin/activate 2>/dev/null || true
-#       export PATH="$HOME/.local/bin:$PATH"
-#       python3 -m devx.ci.notify_failure \
-#         --repo "${{ github.repository }}" \
-#         --run-id "${{ github.run_id }}" \
-#         --workflow "ci/validate" \
-#         --commit "${{ github.sha }}" \
-#         --auto-login
-#
-# Gitea 1.27 notes:
-# - `if: failure()` is evaluated in the calling workflow's context and
-#   propagates correctly to composite action steps.
-# - `secrets` are not accessible here; the calling workflow's top-level
-#   `env:` CI_GITEA_API_TOKEN is used via `${{ env.* }}`.
-
-inputs:
-  workflow:
-    description: 'Workflow/job name used in the Gitea issue title (e.g., ci/validate)'
-    required: true
-
-runs:
-  using: 'composite'
-  steps:
-    - name: Notify on failure
-      if: failure()
-      shell: bash
-      env:
-        CI_GITEA_API_TOKEN: ${{ env.CI_GITEA_API_TOKEN }}
-      run: |
-        . .venv/bin/activate 2>/dev/null || true
-        export PATH="$HOME/.local/bin:$PATH"
-        python3 -m devx.ci.notify_failure \
-          --repo "${{ github.repository }}" \
-          --run-id "${{ github.run_id }}" \
-          --workflow "${{ inputs.workflow }}" \
-          --commit "${{ github.sha }}" \
-          --auto-login

.gitea/actions/quality-checks/action.yml

@@ -1,89 +0,0 @@
-name: 'Quality checks'
-description: 'Run lint, unit tests with coverage, test speed, docs, translations, and security scan'
-
-# Composite action for the 6-step quality check sequence used by the
-# devx validate job. Replaces the inline block:
-#   - Lint all
-#   - Unit tests with 100% coverage
-#   - Check unit test speed
-#   - Documentation gate (coverage + stale refs + lint + version refs + prose)
-#   - Translation completeness check
-#   - Dependency security scan
-#
-# Each step activates the venv defensively (`. .venv/bin/activate 2>/dev/null
-# || true`) so the action works whether or not the setup step created a
-# venv at the repo root (pre-built CI images symlink /opt/venv to .venv).
-#
-# Gitea 1.27 notes:
-# - Every `run` step needs explicit `shell:`.
-# - Inputs are string-typed; numeric thresholds are passed through as
-#   strings to `devx.tools.check_test_speed`.
-
-inputs:
-  package:
-    description: 'Package name for doc version checks (e.g., devx, grm). Empty = no DEVX_DOC_VERSIONS_PKG override.'
-    required: false
-    default: ''
-  test-speed-max:
-    description: 'Max total test seconds (passed to check_test_speed --max-seconds)'
-    required: false
-    default: '15'
-  test-speed-max-single:
-    description: 'Max single test seconds (passed to check_test_speed --max-single-seconds)'
-    required: false
-    default: '0.5'
-  translations-file:
-    description: 'Path to translations.json (empty = default location src/devx/translations.json)'
-    required: false
-    default: ''
-
-runs:
-  using: 'composite'
-  steps:
-    - name: Lint all
-      shell: bash
-      run: |
-        . .venv/bin/activate 2>/dev/null || true
-        export PATH="$HOME/.local/bin:$PATH"
-        make lint-all
-    - name: Unit tests with 100% coverage
-      shell: bash
-      run: |
-        . .venv/bin/activate 2>/dev/null || true
-        make pytest-cov
-    - name: Check unit test speed
-      shell: bash
-      run: |
-        . .venv/bin/activate 2>/dev/null || true
-        python3 -m devx.tools.check_test_speed \
-          --max-seconds "${{ inputs.test-speed-max }}" \
-          --max-single-seconds "${{ inputs.test-speed-max-single }}"
-    - name: Documentation gate (coverage + stale refs + lint + version refs + prose)
-      shell: bash
-      env:
-        DEVX_DOC_COVERAGE_STRICT: "1"
-        DEVX_VALE_LEVEL: warning
-      run: |
-        . .venv/bin/activate 2>/dev/null || true
-        export PATH="$HOME/.local/bin:$PATH"
-        if [ -n "${{ inputs.package }}" ]; then
-          export DEVX_DOC_VERSIONS_PKG="${{ inputs.package }}"
-        fi
-        make devx-docs-check
-    - name: Translation completeness check
-      shell: bash
-      run: |
-        . .venv/bin/activate 2>/dev/null || true
-        if [ -n "${{ inputs.translations-file }}" ]; then
-          python3 -m devx.ci.check_translations --translations "${{ inputs.translations-file }}"
-        else
-          python3 -m devx.ci.check_translations
-        fi
-    - name: Dependency security scan
-      shell: bash
-      run: |
-        . .venv/bin/activate 2>/dev/null || true
-        # Install pip in venv if missing (needed by pip-audit)
-        .venv/bin/python -m ensurepip 2>/dev/null || true
-        PIPAPI_PYTHON_LOCATION=$PWD/.venv/bin/python \
-          pip-audit --desc --skip-editable 2>&1 || true

.gitea/actions/setup-env/action.yml

@@ -1,37 +0,0 @@
-name: 'Set up environment'
-description: 'Set up CI environment with venv and PATH (calls make setup-image)'
-
-# Composite action for the common "Set up environment" step pattern.
-# Replaces the repeated inline:
-#   - name: Set up environment
-#     env:
-#       CI_GITEA_API_TOKEN: ${{ secrets.CI_GITEA_API_TOKEN }}
-#     run: make setup-image
-#
-# Gitea 1.27 notes:
-# - Every `run` step needs explicit `shell:`.
-# - Composite actions cannot access `secrets` directly; they read from
-#   the `env:` context which the calling workflow must populate.
-# - The calling workflow's top-level `env:` block (CI_GITEA_API_TOKEN,
-#   CI_GITEA_USERNAME) is visible here via `${{ env.* }}`.
-
-inputs:
-  extras:
-    description: 'Extra pip install groups passed to make setup-image (e.g., ci,lint,release)'
-    required: false
-    default: ''
-
-runs:
-  using: 'composite'
-  steps:
-    - name: Set up environment
-      shell: bash
-      env:
-        CI_GITEA_API_TOKEN: ${{ env.CI_GITEA_API_TOKEN }}
-        CI_GITEA_USERNAME: ${{ env.CI_GITEA_USERNAME }}
-      run: |
-        if [ -n "${{ inputs.extras }}" ]; then
-          make setup-image EXTRAS="${{ inputs.extras }}"
-        else
-          make setup-image
-        fi

.gitea/workflows/build-images.yml

@@ -29,20 +29,14 @@ concurrency:
   group: build-images
   cancel-in-progress: false
 
-env:
-  PIP_BREAK_SYSTEM_PACKAGES: "1"
-  PYTHONPATH: src
-  CI_GITEA_API_TOKEN: ${{ secrets.CI_GITEA_API_TOKEN }}
-  CI_GITEA_USERNAME: ${{ vars.CI_GITEA_USERNAME }}
-
 jobs:
   build-and-push:
     runs-on: docker
     container:
       image: git.oblachno.oblachno.fyi/oblachno-oss/runner-images/ci-full:latest
       credentials:
-        username: ${{ env.CI_GITEA_USERNAME }}
+        username: ${{ vars.CI_GITEA_USERNAME }}
-        password: ${{ env.CI_GITEA_API_TOKEN }}
+        password: ${{ secrets.CI_GITEA_API_TOKEN }}
     timeout-minutes: 30
     outputs:
       is-release: ${{ steps.check.outputs.is-release }}
@@ -51,9 +45,13 @@ jobs:
         with:
           fetch-depth: 1
       - name: Set up environment
+        env:
+          CI_GITEA_API_TOKEN: ${{ secrets.CI_GITEA_API_TOKEN }}
         run: make setup-release
       - name: Check if this is a release commit
         id: check
+        env:
+          PYTHONPATH: src
         run: |
           . .venv/bin/activate
           python3 -m devx.ci.detect_release_commit
@@ -61,6 +59,9 @@ jobs:
         if: >-
           github.event_name == 'workflow_dispatch' ||
           (github.event_name == 'workflow_run' && github.event.workflow_run.conclusion == 'success' && steps.check.outputs.is-release == 'false')
+        env:
+          CI_GITEA_API_TOKEN: ${{ secrets.CI_GITEA_API_TOKEN }}
+          CI_GITEA_USERNAME: ${{ vars.CI_GITEA_USERNAME }}
         run: |
           . .venv/bin/activate
           _TOKEN="$CI_GITEA_API_TOKEN"
@@ -72,6 +73,10 @@ jobs:
         if: >-
           github.event_name == 'workflow_dispatch' ||
           (github.event_name == 'workflow_run' && github.event.workflow_run.conclusion == 'success' && steps.check.outputs.is-release == 'false')
+        env:
+          CI_GITEA_API_TOKEN: ${{ secrets.CI_GITEA_API_TOKEN }}
+          CI_GITEA_USERNAME: ${{ vars.CI_GITEA_USERNAME }}
+          PYTHONPATH: src
         run: |
           . .venv/bin/activate
           export PATH="$HOME/.local/bin:$PATH"
@@ -96,9 +101,20 @@ jobs:
             --tag latest \
             --registry git.oblachno.oblachno.fyi \
             --push
-      - uses: ./.gitea/actions/notify-failure
+      - name: Notify on failure
-        with:
+        if: failure()
-          workflow: "build-images/build-and-push"
+        env:
+          CI_GITEA_API_TOKEN: ${{ secrets.CI_GITEA_API_TOKEN }}
+          PYTHONPATH: src
+        run: |
+          . .venv/bin/activate 2>/dev/null || true
+          export PATH="$HOME/.local/bin:$PATH"
+          python3 -m devx.ci.notify_failure \
+            --repo "${{ github.repository }}" \
+            --run-id "${{ github.run_id }}" \
+            --workflow "build-images/build-and-push" \
+            --commit "${{ github.sha }}" \
+            --auto-login
 
   cleanup:
     needs: [build-and-push]
@@ -107,16 +123,21 @@ jobs:
     container:
       image: git.oblachno.oblachno.fyi/oblachno-oss/runner-images/ci-base:latest
       credentials:
-        username: ${{ env.CI_GITEA_USERNAME }}
+        username: ${{ vars.CI_GITEA_USERNAME }}
-        password: ${{ env.CI_GITEA_API_TOKEN }}
+        password: ${{ secrets.CI_GITEA_API_TOKEN }}
     timeout-minutes: 10
     steps:
       - uses: actions/checkout@v4
         with:
           fetch-depth: 1
       - name: Set up environment
+        env:
+          CI_GITEA_API_TOKEN: ${{ secrets.CI_GITEA_API_TOKEN }}
         run: make setup-ci
       - name: Clean up old image versions
+        env:
+          CI_GITEA_API_TOKEN: ${{ secrets.CI_GITEA_API_TOKEN }}
+          PYTHONPATH: src
         run: |
           . .venv/bin/activate
           python3 -m devx.tools.clean_images \
@@ -125,6 +146,3 @@ jobs:
             --name oblachno-oss/runner-images/ci-quality \
             --name oblachno-oss/runner-images/ci-full \
             --keep 2
-      - uses: ./.gitea/actions/notify-failure
-        with:
-          workflow: "build-images/cleanup"

.gitea/workflows/ci.yml

@@ -21,8 +21,8 @@ jobs:
     container:
       image: git.oblachno.oblachno.fyi/oblachno-oss/runner-images/ci-full:latest
       credentials:
-        username: ${{ env.CI_GITEA_USERNAME }}
+        username: ${{ vars.CI_GITEA_USERNAME }}
-        password: ${{ env.CI_GITEA_API_TOKEN }}
+        password: ${{ secrets.CI_GITEA_API_TOKEN }}
     timeout-minutes: 15
     defaults:
       run:
@@ -33,12 +33,43 @@ jobs:
       - uses: actions/checkout@v4
         with:
           fetch-depth: 0
-      - uses: ./.gitea/actions/setup-env
+      - name: Set up environment
-      - uses: ./.gitea/actions/quality-checks
+        env:
-        with:
+          CI_GITEA_API_TOKEN: ${{ secrets.CI_GITEA_API_TOKEN }}
-          package: devx
+        run: make setup-image
-          test-speed-max: "15"
+      # --- quality steps ---
-          test-speed-max-single: "0.5"
+      - name: Lint all
+        run: |
+          . .venv/bin/activate 2>/dev/null || true
+          export PATH="$HOME/.local/bin:$PATH"
+          make lint-all
+      - name: Unit tests with 100% coverage
+        run: |
+          . .venv/bin/activate 2>/dev/null || true
+          make pytest-cov
+      - name: Check unit test speed
+        run: |
+          . .venv/bin/activate 2>/dev/null || true
+          python3 -m devx.tools.check_test_speed --max-seconds 15 --max-single-seconds 0.5
+      - name: Documentation gate (coverage + stale refs + lint + version refs + prose)
+        env:
+          DEVX_DOC_COVERAGE_STRICT: "1"
+          DEVX_VALE_LEVEL: warning
+        run: |
+          . .venv/bin/activate 2>/dev/null || true
+          export PATH="$HOME/.local/bin:$PATH"
+          make devx-docs-check
+      - name: Translation completeness check
+        run: |
+          . .venv/bin/activate 2>/dev/null || true
+          python3 -m devx.ci.check_translations
+      - name: Dependency security scan
+        run: |
+          . .venv/bin/activate 2>/dev/null || true
+          # Install pip in venv if missing (needed by pip-audit)
+          .venv/bin/python -m ensurepip 2>/dev/null || true
+          PIPAPI_PYTHON_LOCATION=$PWD/.venv/bin/python \
+            pip-audit --desc --skip-editable 2>&1 || true
       - name: Workflow dry-run validation
         run: |
           . .venv/bin/activate 2>/dev/null || true
@@ -90,9 +121,19 @@ jobs:
           . .venv/bin/activate 2>/dev/null || true
           export PATH="$HOME/.local/bin:$PATH"
           python3 -m devx.ci.release --dry-run
-      - uses: ./.gitea/actions/notify-failure
+      - name: Notify on failure
-        with:
+        if: failure()
-          workflow: "ci/validate"
+        env:
+          CI_GITEA_API_TOKEN: ${{ secrets.CI_GITEA_API_TOKEN }}
+        run: |
+          . .venv/bin/activate 2>/dev/null || true
+          export PATH="$HOME/.local/bin:$PATH"
+          python3 -m devx.ci.notify_failure \
+            --repo "${{ github.repository }}" \
+            --run-id "${{ github.run_id }}" \
+            --workflow "ci/validate" \
+            --commit "${{ github.sha }}" \
+            --auto-login
 
   auto-merge:
     # Auto-merge runs after validate passes. It reads the task ID
@@ -106,8 +147,8 @@ jobs:
     container:
       image: git.oblachno.oblachno.fyi/oblachno-oss/runner-images/ci-base:latest
       credentials:
-        username: ${{ env.CI_GITEA_USERNAME }}
+        username: ${{ vars.CI_GITEA_USERNAME }}
-        password: ${{ env.CI_GITEA_API_TOKEN }}
+        password: ${{ secrets.CI_GITEA_API_TOKEN }}
     timeout-minutes: 10
     defaults:
       run:
@@ -117,10 +158,14 @@ jobs:
         with:
           fetch-depth: 0
           token: ${{ secrets.CI_GITEA_API_TOKEN }}
-      - uses: ./.gitea/actions/setup-env
+      - name: Set up environment
+        env:
+          CI_GITEA_API_TOKEN: ${{ secrets.CI_GITEA_API_TOKEN }}
+        run: make setup-image
       - name: Post approval review
         env:
           REVIEWER_GITEA_API_TOKEN: ${{ secrets.REVIEWER_GITEA_API_TOKEN }}
+          CI_GITEA_API_TOKEN: ${{ secrets.CI_GITEA_API_TOKEN }}
           PR_NUMBER: ${{ github.event.number }}
           REPOSITORY: ${{ github.repository }}
         run: |
@@ -134,6 +179,7 @@ jobs:
             --body "Auto-approved: all CI checks passed (validate job)."
       - name: Squash merge with task ID
         env:
+          CI_GITEA_API_TOKEN: ${{ secrets.CI_GITEA_API_TOKEN }}
           VIKUNJA_TOKEN: ${{ secrets.VIKUNJA_TOKEN }}
           DEVX_VIKUNJA_PROJECT_ID: "8"
           HEAD_REF: ${{ github.head_ref }}
@@ -147,6 +193,3 @@ jobs:
             "$PR_TITLE" \
             "$REPOSITORY" \
             "$PR_NUMBER"
-      - uses: ./.gitea/actions/notify-failure
-        with:
-          workflow: "ci/auto-merge"

.gitea/workflows/post-merge.yml

@@ -38,8 +38,8 @@ jobs:
     container:
       image: git.oblachno.oblachno.fyi/oblachno-oss/runner-images/ci-base:latest
       credentials:
-        username: ${{ env.CI_GITEA_USERNAME }}
+        username: ${{ vars.CI_GITEA_USERNAME }}
-        password: ${{ env.CI_GITEA_API_TOKEN }}
+        password: ${{ secrets.CI_GITEA_API_TOKEN }}
     timeout-minutes: 10
     defaults:
       run:
@@ -52,7 +52,10 @@ jobs:
       - uses: actions/checkout@v4
         with:
           fetch-depth: 0
-      - uses: ./.gitea/actions/setup-env
+      - name: Set up environment
+        env:
+          CI_GITEA_API_TOKEN: ${{ secrets.CI_GITEA_API_TOKEN }}
+        run: make setup-image
       - name: Ensure branch protection and labels
         env:
           DEVX_REPO_NAME: devx
@@ -82,9 +85,19 @@ jobs:
             --base "HEAD~1" \
             --head "HEAD" \
             --github-output
-      - uses: ./.gitea/actions/notify-failure
+      - name: Notify on failure
-        with:
+        if: failure()
-          workflow: "post-merge/detect-and-configure"
+        env:
+          CI_GITEA_API_TOKEN: ${{ secrets.CI_GITEA_API_TOKEN }}
+        run: |
+          . .venv/bin/activate 2>/dev/null || true
+          export PATH="$HOME/.local/bin:$PATH"
+          python3 -m devx.ci.notify_failure \
+            --repo "${{ github.repository }}" \
+            --run-id "${{ github.run_id }}" \
+            --workflow "post-merge/detect-and-configure" \
+            --commit "${{ github.sha }}" \
+            --auto-login
 
   release-and-maintain:
     needs: [detect-and-configure]
@@ -93,8 +106,8 @@ jobs:
     container:
       image: git.oblachno.oblachno.fyi/oblachno-oss/runner-images/ci-full:latest
       credentials:
-        username: ${{ env.CI_GITEA_USERNAME }}
+        username: ${{ vars.CI_GITEA_USERNAME }}
-        password: ${{ env.CI_GITEA_API_TOKEN }}
+        password: ${{ secrets.CI_GITEA_API_TOKEN }}
     timeout-minutes: 15
     outputs:
       tag: ${{ steps.release-tag.outputs.tag }}
@@ -107,10 +120,13 @@ jobs:
           fetch-depth: 0
           ref: master
           token: ${{ secrets.CI_GITEA_API_TOKEN }}
-      - uses: ./.gitea/actions/setup-env
+      - name: Set up environment
-        with:
+        env:
-          extras: "release"
+          CI_GITEA_API_TOKEN: ${{ secrets.CI_GITEA_API_TOKEN }}
+        run: make setup-image EXTRAS=release
       - name: Configure git
+        env:
+          CI_GITEA_API_TOKEN: ${{ secrets.CI_GITEA_API_TOKEN }}
         run: |
           git config user.name "devx-ci-bot"
           git config user.email "devx-ci-bot@oblachno.fyi"
@@ -119,12 +135,16 @@ jobs:
       - name: Run release
         id: release-tag
         if: needs.detect-and-configure.outputs.is-release == 'false' && needs.detect-and-configure.outputs.user-facing-changed == 'true'
+        env:
+          CI_GITEA_API_TOKEN: ${{ secrets.CI_GITEA_API_TOKEN }}
         run: |
           . .venv/bin/activate 2>/dev/null || true
           export PATH="$HOME/.local/bin:$PATH"
           python3 -m devx.ci.release
       - name: Build and publish release
         if: steps.release-tag.outputs.tag != ''
+        env:
+          CI_GITEA_API_TOKEN: ${{ secrets.CI_GITEA_API_TOKEN }}
         run: |
           . .venv/bin/activate 2>/dev/null || true
           export PATH="$HOME/.local/bin:$PATH"
@@ -134,6 +154,8 @@ jobs:
       # --- sync-wiki + vikunja (skip on automated/release commits) ---
       - name: Sync documentation to wiki
         if: needs.detect-and-configure.outputs.is-automated == 'false'
+        env:
+          CI_GITEA_API_TOKEN: ${{ secrets.CI_GITEA_API_TOKEN }}
         run: |
           . .venv/bin/activate 2>/dev/null || true
           python3 -m devx.ci.sync_wiki --repo "${{ github.repository }}" --verify
@@ -148,6 +170,7 @@ jobs:
       # --- badges (always run — even on release commits) ---
       - name: Generate and push badges
         env:
+          CI_GITEA_API_TOKEN: ${{ secrets.CI_GITEA_API_TOKEN }}
           PRE_COMMIT_ALLOW_NO_CONFIG: "1"
         run: |
           . .venv/bin/activate 2>/dev/null || true
@@ -156,6 +179,16 @@ jobs:
           git fetch origin master
           git reset --hard origin/master
           python3 -m devx.ci.push_badges
-      - uses: ./.gitea/actions/notify-failure
+      - name: Notify on failure
-        with:
+        if: failure()
-          workflow: "post-merge/release-and-maintain"
+        env:
+          CI_GITEA_API_TOKEN: ${{ secrets.CI_GITEA_API_TOKEN }}
+        run: |
+          . .venv/bin/activate 2>/dev/null || true
+          export PATH="$HOME/.local/bin:$PATH"
+          python3 -m devx.ci.notify_failure \
+            --repo "${{ github.repository }}" \
+            --run-id "${{ github.run_id }}" \
+            --workflow "post-merge/release-and-maintain" \
+            --commit "${{ github.sha }}" \
+            --auto-login

AGENTS.md

@@ -58,74 +58,6 @@ The pre-commit hook runs actionlint automatically when workflow files change.
 The CI `validate` job runs `make setup-image` then `make lint-all`.
 CI also runs a best-effort `make workflow-dryrun` step (skipped if act_runner is not installed in the CI Docker image).
 
-## Composite Actions (`.gitea/actions/`)
-
-Reusable Gitea composite actions eliminate repeated multi-step sequences
-across workflows. Each action lives in its own directory under
-`.gitea/actions/<name>/action.yml` and is referenced via
-`uses: ./.gitea/actions/<name>`.
-
-### Available Composite Actions
-
-| Action | Purpose | Inputs |
-|--------|---------|--------|
-| `setup-env` | Run `make setup-image` (with optional `EXTRAS=`) | `extras` (default: `""`) |
-| `notify-failure` | Create a Gitea issue on job failure via `devx.ci.notify_failure` | `workflow` (required) |
-| `quality-checks` | 6-step quality sequence: lint, tests, speed, docs, translations, security | `package`, `test-speed-max`, `test-speed-max-single`, `translations-file` |
-
-### Gitea 1.27 Constraints
-
-- Every `run` step in a composite action MUST have explicit `shell:`.
-- Composite actions CANNOT access `secrets` directly. They read from
-  the calling workflow's `env:` context (for example, `${{ env.CI_GITEA_API_TOKEN }}`).
-  The calling workflow's top-level `env:` block must define the required
-  env vars.
-- `if: failure()` in a composite action step is evaluated in the
-  calling workflow's job-status context.
-
-### Usage Pattern
-
-```yaml
-jobs:
-  validate:
-    env:
-      CI_GITEA_API_TOKEN: ${{ secrets.CI_GITEA_API_TOKEN }}
-      CI_GITEA_USERNAME: ${{ vars.CI_GITEA_USERNAME }}
-    steps:
-      - uses: actions/checkout@v4
-      - uses: ./.gitea/actions/setup-env
-      - uses: ./.gitea/actions/quality-checks
-        with:
-          package: devx
-      - uses: ./.gitea/actions/notify-failure
-        with:
-          workflow: "ci/validate"
-```
-
-### Same-Repo Copies (No Cross-Repo References)
-
-Each repo (`devx`, `grm`, `infra`) gets its own copy of the composite
-actions under its `.gitea/actions/` directory. There is no
-`uses: oblachno-oss/devx/.gitea/actions/...@vX.Y.Z` reference. This
-avoids a single-point-of-failure where a bad devx master commit would
-break all repos' CI simultaneously. See ADR-0003 for the full
-rationale.
-
-### When NOT to Use Composite Actions
-
-- **`make setup-release` / `make setup-ci`**: the `setup-env` action
-  only wraps `make setup-image`. Workflows that use other setup targets
-  (for example, `build-images.yml` uses `make setup-release`) keep the inline
-  setup step.
-- **Deploy-specific setup**: infra deploy workflows have additional
-  steps (`install-collections`, `setup-vault`, `setup_ssh_key`) that
-  are NOT part of the common setup. The `setup-env` action only
-  replaces the `make setup-image` step; deploy-specific steps stay
-  inline.
-- **Custom notification**: `security-scan.yml` uses a Mattermost
-  webhook, not `devx.ci.notify_failure`. The `notify-failure` action
-  does not apply.
-
 ## Architecture
 
 devx is a reusable Python package providing development and CI/CD tools for oblachno-oss projects.

CHANGELOG.md

@@ -2,25 +2,6 @@
 
 All notable changes to this project will be documented in this file.
 
-## [Unreleased]
-
-### Ci
-
-- Add composite actions (setup-env, notify-failure, quality-checks) in `.gitea/actions/`
-- Convert ci.yml, post-merge.yml, build-images.yml to use composite actions
-- Add notify-failure to ci/auto-merge and build-images/cleanup jobs (previously missing)
-- Fix `make workflow-dryrun` failure: use `env` context instead of
-  `vars`/`secrets` in `container.credentials` (act_runner dry-run
-  does not populate vars/secrets)
-- Remove redundant step-level `CI_GITEA_API_TOKEN`/`CI_GITEA_USERNAME`
-  env vars (now in workflow-level `env:` block)
-
-## [0.50.4] - 2026-08-12
-
-### Bug Fixes
-
-- Add tenacity retry to install_tools._download for transient network failures
-
 ## [0.50.3] - 2026-08-12
 
 ### Refactor

README.md

@@ -16,12 +16,12 @@ quality badges.
 
 [![CI](https://git.oblachno.oblachno.fyi/oblachno-oss/devx/actions/workflows/ci.yml/badge.svg)](https://git.oblachno.oblachno.fyi/oblachno-oss/devx/actions)
 [![License: GPL-3.0](https://img.shields.io/badge/license-GPL--3.0-blue)](https://git.oblachno.oblachno.fyi/oblachno-oss/devx/src/branch/master/LICENSE)
-[![Coverage](https://git.oblachno.oblachno.fyi/oblachno-oss/devx/raw/commit/43d0589aeee6d706356f79deef37662c9291b981/coverage.svg)](https://git.oblachno.oblachno.fyi/oblachno-oss/devx/actions)
+[![Coverage](https://git.oblachno.oblachno.fyi/oblachno-oss/devx/raw/commit/1b620bc1ac52cad884e501093d4fba5d3968ce67/coverage.svg)](https://git.oblachno.oblachno.fyi/oblachno-oss/devx/actions)
-[![Tests](https://git.oblachno.oblachno.fyi/oblachno-oss/devx/raw/commit/43d0589aeee6d706356f79deef37662c9291b981/tests.svg)](https://git.oblachno.oblachno.fyi/oblachno-oss/devx/actions)
+[![Tests](https://git.oblachno.oblachno.fyi/oblachno-oss/devx/raw/commit/1b620bc1ac52cad884e501093d4fba5d3968ce67/tests.svg)](https://git.oblachno.oblachno.fyi/oblachno-oss/devx/actions)
-[![Docs](https://git.oblachno.oblachno.fyi/oblachno-oss/devx/raw/commit/43d0589aeee6d706356f79deef37662c9291b981/docs.svg)](https://git.oblachno.oblachno.fyi/oblachno-oss/devx/wiki)
+[![Docs](https://git.oblachno.oblachno.fyi/oblachno-oss/devx/raw/commit/1b620bc1ac52cad884e501093d4fba5d3968ce67/docs.svg)](https://git.oblachno.oblachno.fyi/oblachno-oss/devx/wiki)
-[![Code Quality](https://git.oblachno.oblachno.fyi/oblachno-oss/devx/raw/commit/43d0589aeee6d706356f79deef37662c9291b981/quality.svg)](https://git.oblachno.oblachno.fyi/oblachno-oss/devx/actions)
+[![Code Quality](https://git.oblachno.oblachno.fyi/oblachno-oss/devx/raw/commit/1b620bc1ac52cad884e501093d4fba5d3968ce67/quality.svg)](https://git.oblachno.oblachno.fyi/oblachno-oss/devx/actions)
-[![Version](https://git.oblachno.oblachno.fyi/oblachno-oss/devx/raw/commit/43d0589aeee6d706356f79deef37662c9291b981/version.svg)](https://git.oblachno.oblachno.fyi/oblachno-oss/devx/releases)
+[![Version](https://git.oblachno.oblachno.fyi/oblachno-oss/devx/raw/commit/1b620bc1ac52cad884e501093d4fba5d3968ce67/version.svg)](https://git.oblachno.oblachno.fyi/oblachno-oss/devx/releases)
-[![Python](https://git.oblachno.oblachno.fyi/oblachno-oss/devx/raw/commit/43d0589aeee6d706356f79deef37662c9291b981/python.svg)](https://www.python.org/downloads/)
+[![Python](https://git.oblachno.oblachno.fyi/oblachno-oss/devx/raw/commit/1b620bc1ac52cad884e501093d4fba5d3968ce67/python.svg)](https://www.python.org/downloads/)
 
 ## Why devx?
 
@@ -87,7 +87,7 @@ extra index and list devx in your dependencies:
 ```toml
 [project]
 dependencies = [
-    "devx>=0.50.4",
+    "devx>=0.50.3",
 ]
 
 [tool.pip]
@@ -101,8 +101,8 @@ pip install -e .
 ```
 
 > **Note:** If your project requires a specific devx version, pin it in
-> `dependencies` (for example, `"devx==0.50.4"`) or use a version constraint
+> `dependencies` (for example, `"devx==0.50.3"`) or use a version constraint
-> (for example, `"devx>=0.50.4,<0.51"`).
+> (for example, `"devx>=0.50.3,<0.51"`).
 
 ### Optional extras
 
@@ -445,17 +445,6 @@ src/devx/
 └── molecule/            # Optional molecule testing helpers (for Ansible projects)
 ```
 
-### Composite Actions (`.gitea/actions/`)
-
-Reusable Gitea composite actions for CI workflow steps:
-
-- `setup-env` — runs `make setup-image` (with optional `EXTRAS=`)
-- `notify-failure` — creates a Gitea issue on job failure
-- `quality-checks` — 6-step quality gate (lint, tests, speed, docs, translations, security)
-
-Each consumer repo gets its own copy (no cross-repo references). See
-ADR-0003 for the design rationale.
-
 ### Design principles
 
 - **Self-contained package** — `src/devx/` never imports from scripts outside the package

docs/decisions/0003-composite-actions.md

@@ -1,155 +0,0 @@
-# ADR-0003: Composite Actions for CI Workflow Reuse
-
-Date: 2026-08-12
-Status: Accepted
-
-## Context
-
-The devx repository's Gitea Actions workflows (`.gitea/workflows/ci.yml`,
-`post-merge.yml`, `build-images.yml`) repeated multi-step
-sequences across jobs:
-
-1. **Set up environment** — `make setup-image` (optionally with `EXTRAS=`).
-   Appeared verbatim in 4 jobs across `ci.yml` and `post-merge.yml`, each
-   with the same `CI_GITEA_API_TOKEN` env wiring.
-
-2. **Notify on failure** — `python3 -m devx.ci.notify_failure ... --auto-login`
-   with venv activation, PATH export, and 5 fixed CLI args. Appeared in
-   4 jobs (`ci/validate`, `post-merge/detect-and-configure`,
-   `post-merge/release-and-maintain`, `build-images/build-and-push`),
-   each differing only in the `--workflow` string.
-
-3. **Quality checks** — a 6-step sequence (lint-all, pytest-cov,
-   check-test-speed, devx-docs-check, check-translations, pip-audit)
-   with venv activation boilerplate on every step. Appeared once in
-   `ci.yml` validate job, but the same sequence is needed by `grm` and
-   `infra` (Phase 2b/2c of the cross-repo refactoring plan).
-
-This duplication had the following costs:
-
-- **Drift risk**: a fix to notify-failure (for example, new flag,
-  different env var) had to be applied to 4 places; missing one caused
-  inconsistent failure notifications.
-- **Workflow YAML noise**: the 6-step quality block obscured the
-  validate job's actual structure (detect-changes, pr-review,
-  release-dry-run).
-- **Cross-repo reuse blocked**: `grm` and `infra` could not adopt the
-  same quality-checks sequence without copy-pasting the inline steps,
-  which would amplify the drift problem across 3 repos.
-- **Gitea 1.27 constraints**: every `run` step needs explicit `shell:`;
-  composite actions cannot access `secrets` directly (only `env:`).
-  These constraints had to be re-discovered and re-applied per step.
-
-## Decision
-
-Introduce three Gitea composite actions in `.gitea/actions/`:
-
-### 1. `setup-env/action.yml`
-
-Wraps the `make setup-image` call. Single input `extras` (default empty)
-forwarded to `make setup-image EXTRAS=`. Reads `CI_GITEA_API_TOKEN` and
-`CI_GITEA_USERNAME` from the calling workflow's `env:` context.
-
-### 2. `notify-failure/action.yml`
-
-Wraps the `devx.ci.notify_failure` invocation. Single required input
-`workflow` (the workflow/job name for the Gitea issue title). Step is
-gated by `if: failure()` so it only runs on job failure. Reads
-`CI_GITEA_API_TOKEN` from the calling workflow's `env:` context.
-
-### 3. `quality-checks/action.yml`
-
-Wraps the 6-step quality sequence. Inputs:
-
-- `package` (default empty) — sets `DEVX_DOC_VERSIONS_PKG` for doc
-  version checks (for example, `devx`, `grm`).
-- `test-speed-max` (default `15`) — total test seconds threshold.
-- `test-speed-max-single` (default `0.5`) — per-test seconds threshold.
-- `translations-file` (default empty) — path to `translations.json`
-  for repos whose translations live outside `src/devx/`.
-
-Each step activates the venv defensively
-(`. .venv/bin/activate 2>/dev/null || true`) so the action works with
-both pre-built CI images (which symlink `/opt/venv` to `.venv`) and
-fresh `make setup-image` runs.
-
-### Adoption Scope
-
-- **`ci.yml` validate job**: `setup-env` + `quality-checks` +
-  `notify-failure`.
-- **`ci.yml` auto-merge job**: `setup-env` + `notify-failure` (no
-  quality checks — auto-merge only runs after validate passes).
-- **`post-merge.yml` detect-and-configure**: `setup-env` +
-  `notify-failure`.
-- **`post-merge.yml` release-and-maintain**: `setup-env` (with
-  `extras: "release"`) + `notify-failure`.
-- **`build-images.yml` build-and-push**: `notify-failure` only. The
-  setup steps use `make setup-release` (not `make setup-image`), so
-  `setup-env` does not apply.
-- **`build-images.yml` cleanup**: `notify-failure` only. The setup
-  step uses `make setup-ci` (not `make setup-image`).
-
-### Same-Repo Copies (No Cross-Repo References)
-
-Each consumer repo (`devx`, `grm`, `infra`) gets its own copy of the
-composite actions under its `.gitea/actions/` directory. There is no
-`uses: oblachno-oss/devx/.gitea/actions/...@vX.Y.Z` reference.
-
-This avoids a single-point-of-failure where a bad `devx` master commit
-would break all three repos' CI simultaneously. The cost is three
-copies of ~30 lines of YAML each, updated manually when a composite
-action changes. Given the stability of these patterns (the inline
-versions were unchanged for months), this cost is acceptable.
-
-## Consequences
-
-### Positive
-
-- **Workflow YAML is shorter and clearer**: the validate job's
-  quality block collapses from 32 lines to 5 lines. The intent
-  (`uses: ./.gitea/actions/quality-checks`) is more legible than
-  6 individually wrapped steps.
-- **Drift eliminated**: a change to notify-failure (new flag, different
-  env var) is applied in one file. All 4 calling sites pick it up.
-- **Cross-repo reuse enabled**: Phase 2b (`grm`) and Phase 2c (`infra`)
-  copy the same `action.yml` files and adopt the same `uses:` pattern.
-  The quality-checks sequence is now portable.
-- **Gitea 1.27 constraints centralized**: the `shell: bash` and
-  `env:` (not `secrets`) patterns are encoded once per action, not
-  re-derived per step.
-- **No release triggered**: changes to `.gitea/**` are classified as
-  workflow-only by `devx.ci.classify_changes`. Phase 2a does not
-  produce a new devx version. `grm`/`infra` bump to the Phase 1
-  release (v0.50.4), not a Phase 2a version.
-
-### Negative
-
-- **Three copies of each action**: when a composite action changes,
-  the change must be applied to `devx`, `grm`, and `infra`
-  independently. This is intentional (see Same-Repo Copies preceding)
-  but is a maintenance cost.
-- **Composite action debugging is harder**: Gitea's log output for
-  composite action steps is nested under the action name. Finding the
-  failing step requires reading one more level of indentation.
-- **`env:` propagation is implicit**: the calling workflow's top-level
-  `env:` block must define `CI_GITEA_API_TOKEN` for the composite
-  action to read it. A workflow that omits this will see an empty
-  token at runtime, not at lint time. actionlint does not catch this.
-- **`quality-checks` is devx-shaped**: the `package` and
-  `translations-file` inputs exist because consumer repos (for example,
-  `grm`) have translations files outside the default
-  `src/devx/translations.json` location and need doc version checks
-  targeting their own package name.
-  A repo with a different translations path or package layout would need
-  a new input or a different action. This is acceptable for the current
-  3-repo scope.
-
-### Neutral
-
-- **`if: failure()` is preserved**: the `notify-failure` composite
-  action's step has `if: failure()`, which is evaluated in the
-  calling workflow's job-status context. This is the standard Gitea
-  Actions pattern for post-failure notification.
-- **Venv activation is defensive**: `. .venv/bin/activate 2>/dev/null
-  || true` does not fail if the venv is missing (pre-built image path)
-  or already active. This matches the inline pattern's behavior.

docs/index.md

@@ -12,12 +12,12 @@ project to be reusable across all oblachno-oss repositories.
 
 [![CI](https://git.oblachno.oblachno.fyi/oblachno-oss/devx/actions/workflows/ci.yml/badge.svg)](https://git.oblachno.oblachno.fyi/oblachno-oss/devx/actions)
 [![License: GPL-3.0](https://img.shields.io/badge/license-GPL--3.0-blue)](https://git.oblachno.oblachno.fyi/oblachno-oss/devx/src/branch/master/LICENSE)
-[![Coverage](https://git.oblachno.oblachno.fyi/oblachno-oss/devx/raw/commit/43d0589aeee6d706356f79deef37662c9291b981/coverage.svg)](https://git.oblachno.oblachno.fyi/oblachno-oss/devx/actions)
+[![Coverage](https://git.oblachno.oblachno.fyi/oblachno-oss/devx/raw/commit/1b620bc1ac52cad884e501093d4fba5d3968ce67/coverage.svg)](https://git.oblachno.oblachno.fyi/oblachno-oss/devx/actions)
-[![Tests](https://git.oblachno.oblachno.fyi/oblachno-oss/devx/raw/commit/43d0589aeee6d706356f79deef37662c9291b981/tests.svg)](https://git.oblachno.oblachno.fyi/oblachno-oss/devx/actions)
+[![Tests](https://git.oblachno.oblachno.fyi/oblachno-oss/devx/raw/commit/1b620bc1ac52cad884e501093d4fba5d3968ce67/tests.svg)](https://git.oblachno.oblachno.fyi/oblachno-oss/devx/actions)
-[![Docs](https://git.oblachno.oblachno.fyi/oblachno-oss/devx/raw/commit/43d0589aeee6d706356f79deef37662c9291b981/docs.svg)](https://git.oblachno.oblachno.fyi/oblachno-oss/devx/wiki)
+[![Docs](https://git.oblachno.oblachno.fyi/oblachno-oss/devx/raw/commit/1b620bc1ac52cad884e501093d4fba5d3968ce67/docs.svg)](https://git.oblachno.oblachno.fyi/oblachno-oss/devx/wiki)
-[![Code Quality](https://git.oblachno.oblachno.fyi/oblachno-oss/devx/raw/commit/43d0589aeee6d706356f79deef37662c9291b981/quality.svg)](https://git.oblachno.oblachno.fyi/oblachno-oss/devx/actions)
+[![Code Quality](https://git.oblachno.oblachno.fyi/oblachno-oss/devx/raw/commit/1b620bc1ac52cad884e501093d4fba5d3968ce67/quality.svg)](https://git.oblachno.oblachno.fyi/oblachno-oss/devx/actions)
-[![Version](https://git.oblachno.oblachno.fyi/oblachno-oss/devx/raw/commit/43d0589aeee6d706356f79deef37662c9291b981/version.svg)](https://git.oblachno.oblachno.fyi/oblachno-oss/devx/releases)
+[![Version](https://git.oblachno.oblachno.fyi/oblachno-oss/devx/raw/commit/1b620bc1ac52cad884e501093d4fba5d3968ce67/version.svg)](https://git.oblachno.oblachno.fyi/oblachno-oss/devx/releases)
-[![Python](https://git.oblachno.oblachno.fyi/oblachno-oss/devx/raw/commit/43d0589aeee6d706356f79deef37662c9291b981/python.svg)](https://www.python.org/downloads/)
+[![Python](https://git.oblachno.oblachno.fyi/oblachno-oss/devx/raw/commit/1b620bc1ac52cad884e501093d4fba5d3968ce67/python.svg)](https://www.python.org/downloads/)
 
 ## Overview
 
@@ -74,14 +74,14 @@ Add devx to your `pyproject.toml` dependencies and configure the registry:
 ```toml
 [project]
 dependencies = [
-    "devx>=0.50.4",
+    "devx>=0.50.3",
 ]
 
 [tool.pip]
 extra-index-url = "https://git.oblachno.oblachno.fyi/api/packages/oblachno-oss/pypi/simple"
 ```
 
-Pin a specific version if needed: `"devx==0.50.4"` or `"devx>=0.50.4,<0.51"`.
+Pin a specific version if needed: `"devx==0.50.3"` or `"devx>=0.50.3,<0.51"`.
 
 ### Optional extras
 

docs/tech/architecture.md

@@ -453,24 +453,6 @@ v2 failures. Supports loading custom platforms from a JSON file.
 - **Secrets via environment** — secrets are passed via environment variables,
   never on the command line.
 
-## Composite Actions (`.gitea/actions/`)
-
-Reusable Gitea composite actions eliminate repeated multi-step sequences
-across workflows. Each action lives in `.gitea/actions/<name>/action.yml`
-and is referenced via `uses: ./.gitea/actions/<name>`.
-
-| Action | Purpose |
-|--------|---------|
-| `setup-env` | Run `make setup-image` (with optional `EXTRAS=`) |
-| `notify-failure` | Create a Gitea issue on job failure via `devx.ci.notify_failure` |
-| `quality-checks` | 6-step quality sequence: lint, tests, speed, docs, translations, security |
-
-Each consumer repo (`devx`, `grm`, `infra`) gets its own copy — there are
-no cross-repo composite action references. This avoids a single-point-of-failure
-where a bad devx master commit would break all repos' CI simultaneously.
-
-See ADR-0003 for the full design rationale and Gitea 1.27 constraints.
-
 ## Import rules
 
 1. **`src/devx/` is self-contained** — the package never imports from outside `src/`

docs/tech/ci-cd-workflow.md

@@ -38,33 +38,22 @@ The single validation job. Consolidates the former `quality`,
 `detect-changes`, `release-dry-run`, `pr-review`, and `pre-merge-check`
 jobs into one job to save checkout+setup overhead. Runs on every PR.
 
-**Setup and quality steps** (composite actions)
+**Quality steps**
 
-The validate job uses three composite actions from `.gitea/actions/`:
+The main quality gate:
 
-1. **`setup-env`** — runs `make setup-image` to link the pre-built venv
+1. **Lint all** — ruff check, ruff format check, pyright, bandit, actionlint
-   and install the project (no-deps mode)
+   (via `make lint-all`)
-2. **`quality-checks`** — runs the 6-step quality gate:
+2. **Unit tests with 100% coverage** — `make pytest-cov`
-   - **Lint all** — ruff check, ruff format check, pyright, bandit,
+3. **Check unit test speed** — `python -m devx.tools.check_test_speed
-     actionlint (via `make lint-all`)
+   --max-seconds 4 --max-single-seconds 0.5`
-   - **Unit tests with 100% coverage** — `make pytest-cov`
+4. **Documentation coverage check** — `python -m devx.ci.doc_coverage
-   - **Check unit test speed** — `python -m devx.tools.check_test_speed
+   --fail-on-missing`
-     --max-seconds 15 --max-single-seconds 0.5`
+5. **Translation completeness check** — `python -m devx.ci.check_translations`
-   - **Documentation gate** — `make devx-docs-check` (coverage + stale
+6. **Dependency security scan** — `pip-audit --desc --skip-editable`
-     refs + lint + version refs + prose)
+   (best-effort, non-blocking)
-   - **Translation completeness check** — `python -m devx.ci.check_translations`
+7. **Workflow dry-run validation** — `make workflow-dryrun` via act_runner
-   - **Dependency security scan** — `pip-audit --desc --skip-editable`
+   (best-effort, skipped if act_runner is not installed)
-     (best-effort, non-blocking)
-3. **`notify-failure`** — creates a Gitea issue if any step fails
-
-The quality-checks action accepts inputs (`package`, `test-speed-max`,
-`test-speed-max-single`, `translations-file`) for cross-repo reuse.
-See ADR-0003 for the composite action design rationale.
-
-**Workflow dry-run validation** (inline step, not part of composite action)
-
-`make workflow-dryrun` via act_runner (best-effort, skipped if
-act_runner is not installed).
 
 **`detect-changes` step**
 
@@ -585,14 +574,8 @@ picks up the new version number). This prevents infinite loops.
 
 ## Failure handling
 
-Every job in the CI, post-merge, and build-images workflows uses the
+Every job in the CI and post-merge workflows has a `notify_failure` step
-`notify-failure` composite action (`.gitea/actions/notify-failure`),
+that runs `if: failure()`. This creates a Gitea issue with the workflow name,
-which runs `if: failure()`. This creates a Gitea issue with the workflow
+run ID, and commit SHA, ensuring failures that would otherwise go unnoticed
-name, run ID, and commit SHA, ensuring failures that would otherwise go
+in the Actions tab are surfaced as issues. The issue is created via the tea
-unnoticed in the Actions tab are surfaced as issues. The issue is created
+CLI with a `bug` label if available.
-via the tea CLI with a `bug` label if available.
-
-Jobs with `notify-failure`:
-- `ci/validate`, `ci/auto-merge`
-- `post-merge/detect-and-configure`, `post-merge/release-and-maintain`
-- `build-images/build-and-push`, `build-images/cleanup`

docs/user/getting-started.md

@@ -48,12 +48,12 @@ Add devx to your `pyproject.toml`:
 ```toml
 [project]
 dependencies = [
-    "devx>=0.50.4",
+    "devx>=0.50.3",
 ]
 
 [project.optional-dependencies]
 dev = [
-    "devx>=0.50.4",
+    "devx>=0.50.3",
 ]
 ```
 

src/devx/__init__.py

@@ -1,3 +1,3 @@
 """devx — reusable development and CI/CD tools for oblachno-oss projects."""
 
-__version__ = "0.50.4"
+__version__ = "0.50.3"