GRM-54: Integrate tea Gitea CLI for API interactions (#68)

AGENTS.md

@@ -19,7 +19,8 @@ make workflow-check # workflow-lint + workflow-dryrun
 `make setup` automatically installs all development tools:
 - **Python deps** via `scripts/setup.py` (pip install -e .[dev], ansible-galaxy, pre-commit hooks)
 - **checkmake** via `scripts/install_checkmake.py` (Makefile linter)
-- **actionlint, git-cliff, act_runner** via `scripts/install_tools.py` (CI/CD tools to ~/.local/bin)
+- **actionlint, git-cliff, act_runner, tea** via `scripts/install_tools.py` (CI/CD tools to ~/.local/bin)
+- **tea CLI login** via `scripts/setup.py` (configures `tea login` from `.env` `REPO_TOKEN`)
 
 ## Workflow Verification (Before Push)
 
@@ -243,7 +244,7 @@ types from accidentally skipping releases.
 - Any new file type not in the allowlist
 
 **Script directory structure:**
-- `scripts/` — Dev tools (run locally by developers): `check_test_speed.py`, `configure_repo.py`, `install_checkmake.py`, `install_tools.py`, `setup.py`, `molecule_all.py`, `generate_badges.py`
+- `scripts/` — Dev tools (run locally by developers): `check_test_speed.py`, `configure_repo.py`, `install_checkmake.py`, `install_tools.py`, `setup.py`, `molecule_all.py`, `generate_badges.py`, `gitea_cli.py`
 - `scripts/ci/` — CI/CD automation (run by workflows): `release.py`, `publish.py`, `auto_merge.py`, `classify_changes.py`, `detect_release_commit.py`, `push_badges.py`, `doc_coverage.py`, `sync_wiki.py`, `distribute_molecule.py`, `molecule_ci_guard.py`, `discover_runners.py`, `notify_failure.py`, `post_merge.py`, `pr_review.py`, `review_pr.py`, `validate_commit_msg.py`, `platforms.py`
 
 **CI behavior based on classification:**
@@ -276,6 +277,31 @@ The codebase enforces strict separation between the GRM tool and CI/dev scripts:
 1. **`src/gitea_runner_manager/` NEVER imports from `scripts/`** — the tool is self-contained
 2. **Scripts MAY import from `gitea_runner_manager`** — one-way dependency (scripts use the tool's API clients, config, i18n)
 3. **Cross-script imports** (scripts importing from other scripts) are allowed within `scripts/ci/` but must be documented
+4. **`scripts/gitea_cli.py`** is a shared wrapper around the `tea` CLI — CI scripts import from it for Gitea API operations (issues, labels, PRs, releases, reviews)
+
+### tea CLI Integration
+
+The `tea` Gitea CLI tool is used for Gitea API interactions in CI scripts. It is installed by `scripts/install_tools.py` and configured by `scripts/setup.py` (login profile from `.env` `REPO_TOKEN`).
+
+**`scripts/gitea_cli.py`** — Python wrapper around `tea` CLI with JSON output parsing:
+- `TeaCLI.create_issue()` — Create issues with labels
+- `TeaCLI.list_labels()` / `TeaCLI.create_label()` / `TeaCLI.add_label()` — Label management
+- `TeaCLI.create_pr()` / `TeaCLI.merge_pr()` / `TeaCLI.review_pr()` — Pull request operations
+- `TeaCLI.create_release()` / `TeaCLI.list_releases()` — Release management
+- `TeaCLI.list_branches()` — Branch listing
+
+**Scripts using tea (via `gitea_cli.py`):**
+- `scripts/ci/review_pr.py` — Posts PR reviews via `tea pulls review`
+- `scripts/ci/publish.py` — Creates Gitea releases via `tea releases create`
+- `scripts/ci/notify_failure.py` — Creates issues via `tea issues create` (falls back to `GiteaClient` if tea not installed)
+- `scripts/configure_repo.py` — Creates labels via `tea labels create` (falls back to `GiteaClient` if tea fails; branch protection still uses `GiteaClient` since tea only supports basic protect/unprotect)
+
+**Operations still using `GiteaClient` (not supported by tea):**
+- Wiki page management (`sync_wiki.py`)
+- Commit status checks (`auto_merge.py`)
+- Runner discovery (`discover_runners.py`)
+- Branch protection with detailed config (`configure_repo.py`)
+- PR file/commit listing (`pr_review.py`)
 
 ### PYTHONPATH Configuration
 
@@ -283,7 +309,8 @@ Scripts have different import requirements. Workflows must set `PYTHONPATH` acco
 
 | PYTHONPATH | When to use | Example scripts |
 |------------|-------------|-----------------|
-| `src` | Script imports from `gitea_runner_manager` | `auto_merge.py`, `pr_review.py`, `notify_failure.py`, `sync_wiki.py`, `post_merge.py`, `publish.py`, `classify_changes.py`, `discover_runners.py`, `doc_coverage.py` |
+| `src` | Script imports from `gitea_runner_manager` | `auto_merge.py`, `pr_review.py`, `sync_wiki.py`, `post_merge.py`, `classify_changes.py`, `discover_runners.py`, `doc_coverage.py` |
+| `.:src` | Script imports from both `gitea_runner_manager` and `scripts.gitea_cli` | `review_pr.py`, `publish.py`, `notify_failure.py`, `configure_repo.py` |
 | `.` | Script imports from other `scripts.ci.*` modules | `release.py` (imports `classify_changes.has_user_facing_changes`) |
 | (none) | Script has no GRM or cross-script imports | `detect_release_commit.py`, `distribute_molecule.py`, `molecule_ci_guard.py`, `push_badges.py`, `validate_commit_msg.py` |