Fix 117 (#118)

* start new dev branch; add audit file

* Release 26.6.1: depend on zlmdb/autobahn 26.6.1, bump submodules, converge Discussions (#117)

Coordinated WAMP 26.6.1 release train.

Dependencies / version:
- zlmdb >= 25.12.2 -> >= 26.6.1; autobahn[all] >= 25.12.2 -> >= 26.6.1.
- Bump version 25.12.2 -> 26.6.1 (pyproject.toml AND src/cfxdb/_version.py).

Shared submodules (match the group):
- .ai   bfb4804 -> 4669dc8
- .cicd 2691c4b -> f77ca2b (GHSA-6658 identifiers.yml hardening + tooling)

GitHub Discussions convergence (coherent with autobahn-python / txaio):
- release-post-comment.yml now resolves the `ci-cd` category BY NAME
  (case-insensitive) and posts for both nightly and stable releases,
  replacing the previous no-op (empty hard-coded category id that skipped).
- Removed the redundant softprops `discussion_category_name: ci-cd` from the
  release steps so a release posts exactly one announcement.
- Resolves #114 (the ci-cd Discussions category exists and is now used).

cfxdb's verified-artifact chain-of-custody (build once -> upload-verified ->
download-verified -> check-release-fileset -> publish) was already coherent
and is unchanged.

Verified locally against the released zlmdb 26.6.1 + autobahn 26.6.1:
cfxdb imports (schema classes extending zlmdb base classes) and
test_usage.py passes (2 passed).

Note: This work was completed with AI assistance (Claude Code).

* Fix ty config for latest ty: rename rule + silence flatbuffers submodule FPs (#117)

The "Run code quality checks" job failed (exit 1) on a fatal ty config error:
the check-typing recipe passed `--ignore non-subscriptable`, but current ty
renamed that rule to `not-subscriptable`, and an unknown rule in `--ignore` is
treated as a fatal config error (`warning[unknown-rule]` -> non-zero exit).

- Rename `non-subscriptable` -> `not-subscriptable`.
- Add `--ignore possibly-missing-submodule`: the remaining 170 diagnostics were
  all this single false positive, from ty not following zlmdb's dynamic
  FlatBuffers runtime re-exports (e.g. `flatbuffers.encode` / `.packer` /
  `.number_types`). This is the same dynamic-import flavor the recipe already
  ignores (`unresolved-import`, `possibly-missing-import`, ...).

ty remains advisory (errors fail, warnings don't) - not warnings-as-errors,
since ty is pre-1.0 and its rules churn (this failure was itself a rename).

Verified locally with latest ty against the 26.6.1 deps: `All checks passed!`
(exit 0, 0 diagnostics).

Note: This work was completed with AI assistance (Claude Code).

Author: oberstet

.ai

@@ -0,0 +1,8 @@
+- [ ] I did **not** use any AI-assistance tools to help create this pull request.
+- [x] I **did** use AI-assistance tools to *help* create this pull request.
+- [x] I have read, understood and followed the projects' [AI Policy](https://github.com/crossbario/autobahn-python/blob/main/AI_POLICY.md) when creating code, documentation etc. for this pull request.
+
+Submitted by: @oberstet
+Date: 2026-06-18
+Related issue(s): #117
+Branch: oberstet:fix_117

.audit/oberstet_fix_117.md

@@ -1,139 +1,112 @@
 name: release-post-comment
 
 on:
-  # Trigger after release workflow completes
+  # Trigger after the release workflow completes
   workflow_run:
     workflows: ["release"]
     types: [completed]
 
   # Manual dispatch for debugging
   workflow_dispatch:
     inputs:
-      discussion_category_id:
-        description: "GitHub Discussions category ID for CI-CD notifications"
+      discussion_category:
+        description: "GitHub Discussions category name to post into (case-insensitive)"
         required: false
         type: string
-        # TODO: Update this with the actual CI-CD category ID for cfxdb repo
-        # You can find this by querying the GitHub GraphQL API or creating a category
-        # and inspecting the browser network tab
-        default: ""
+        default: "ci-cd"
 
 permissions:
-  contents: read        # Required for reading artifacts
-  discussions: write    # Required for posting to discussions
+  contents: read # Required for reading releases
+  discussions: write # Required for posting to discussions
 
 jobs:
   check-release-exists:
     name: Check if release created (Early Exit Pattern)
     runs-on: ubuntu-latest
     outputs:
       should_process: ${{ steps.check.outputs.should_process }}
-      release_exists: ${{ steps.check.outputs.release_exists }}
       release_name: ${{ steps.check.outputs.release_name }}
       release_url: ${{ steps.check.outputs.release_url }}
-      is_tag_release: ${{ steps.check.outputs.is_tag_release }}
+      release_type: ${{ steps.check.outputs.release_type }}
 
     steps:
-      - name: Check if GitHub Release exists for this commit
+      - name: Check if a fresh GitHub Release exists for this commit
         id: check
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
         run: |
-          echo '---------------------------------------------------'
-          echo 'Checking if GitHub Release exists (Early Exit Pattern)'
-          echo '---------------------------------------------------'
+          echo '─────────────────────────────────────────────────'
+          echo '🔍 Checking if a fresh GitHub Release exists (Early Exit Pattern)'
+          echo '─────────────────────────────────────────────────'
 
           COMMIT_SHA="${{ github.event.workflow_run.head_sha || github.sha }}"
           echo "Commit SHA: $COMMIT_SHA"
 
-          # Get all releases (sorted by created date, newest first)
+          # All releases, newest first
           RELEASES_JSON=$(gh api repos/$GITHUB_REPOSITORY/releases --paginate 2>/dev/null || echo "[]")
 
-          # Find most recent release (created within last hour)
           FOUND_RELEASE_NAME=""
           FOUND_RELEASE_URL=""
-          IS_TAG_RELEASE="false"
-
-          # Check for tag-based releases (vX.Y.Z)
-          TAG_RELEASE=$(echo "$RELEASES_JSON" | jq -r ".[] | select(.tag_name | startswith(\"v\")) | .tag_name" | head -1)
-          if [ -n "$TAG_RELEASE" ]; then
-            RELEASE_CREATED=$(echo "$RELEASES_JSON" | jq -r ".[] | select(.tag_name == \"$TAG_RELEASE\") | .created_at")
-            CURRENT_TIME=$(date -u +%s)
-            RELEASE_TIME=$(date -u -d "$RELEASE_CREATED" +%s 2>/dev/null || echo "0")
-            TIME_DIFF=$((CURRENT_TIME - RELEASE_TIME))
-
-            echo "Found tag release: $TAG_RELEASE"
-            echo "Created: $RELEASE_CREATED"
-            echo "Age: ${TIME_DIFF}s"
-
-            if [ $TIME_DIFF -lt 3600 ]; then
-              echo "Tag release created within last hour - proceeding"
-              FOUND_RELEASE_NAME="$TAG_RELEASE"
-              FOUND_RELEASE_URL=$(echo "$RELEASES_JSON" | jq -r ".[] | select(.tag_name == \"$TAG_RELEASE\") | .html_url")
-              IS_TAG_RELEASE="true"
-            else
-              echo "Tag release is too old (${TIME_DIFF}s > 3600s) - skipping"
-            fi
+          RELEASE_TYPE=""
+
+          # Helper: is the named release younger than one hour?
+          is_fresh() {
+            local created current rel_time diff
+            created=$(echo "$RELEASES_JSON" | jq -r ".[] | select(.tag_name == \"$1\") | .created_at")
+            current=$(date -u +%s)
+            rel_time=$(date -u -d "$created" +%s 2>/dev/null || echo "0")
+            diff=$((current - rel_time))
+            echo "   $1 created $created (age ${diff}s)"
+            [ "$diff" -lt 3600 ]
+          }
+
+          # Stable release first: tags like vX.Y.Z
+          STABLE=$(echo "$RELEASES_JSON" | jq -r '.[] | select(.tag_name | startswith("v")) | .tag_name' | head -1)
+          if [ -n "$STABLE" ] && is_fresh "$STABLE"; then
+            FOUND_RELEASE_NAME="$STABLE"
+            RELEASE_TYPE="stable"
           fi
 
-          # Check for development releases (master-* pattern for cfxdb)
+          # Otherwise nightly: tags like master-YYYYMMDDHHMM
           if [ -z "$FOUND_RELEASE_NAME" ]; then
-            DEV_RELEASE=$(echo "$RELEASES_JSON" | jq -r ".[] | select(.tag_name | startswith(\"master-\") or startswith(\"dev-\")) | .tag_name" | head -1)
-            if [ -n "$DEV_RELEASE" ]; then
-              RELEASE_CREATED=$(echo "$RELEASES_JSON" | jq -r ".[] | select(.tag_name == \"$DEV_RELEASE\") | .created_at")
-              CURRENT_TIME=$(date -u +%s)
-              RELEASE_TIME=$(date -u -d "$RELEASE_CREATED" +%s 2>/dev/null || echo "0")
-              TIME_DIFF=$((CURRENT_TIME - RELEASE_TIME))
-
-              echo "Found development release: $DEV_RELEASE"
-              echo "Created: $RELEASE_CREATED"
-              echo "Age: ${TIME_DIFF}s"
-
-              if [ $TIME_DIFF -lt 3600 ]; then
-                echo "Development release created within last hour - proceeding"
-                FOUND_RELEASE_NAME="$DEV_RELEASE"
-                FOUND_RELEASE_URL=$(echo "$RELEASES_JSON" | jq -r ".[] | select(.tag_name == \"$DEV_RELEASE\") | .html_url")
-                IS_TAG_RELEASE="false"
-              else
-                echo "Development release is too old (${TIME_DIFF}s > 3600s) - skipping"
-              fi
+            NIGHTLY=$(echo "$RELEASES_JSON" | jq -r '.[] | select(.tag_name | startswith("master-")) | .tag_name' | head -1)
+            if [ -n "$NIGHTLY" ] && is_fresh "$NIGHTLY"; then
+              FOUND_RELEASE_NAME="$NIGHTLY"
+              RELEASE_TYPE="nightly"
             fi
           fi
 
           if [ -z "$FOUND_RELEASE_NAME" ]; then
-            echo "GitHub Release not found for commit $COMMIT_SHA"
-            echo "   This is normal! Will post once release workflow creates the release."
-            echo "   (This is an early exit - release.yml probably hasn't created the release yet)"
+            echo "⏳ No fresh GitHub Release found - nothing to announce (early exit)."
             {
               echo "should_process=false"
-              echo "release_exists=false"
               echo "release_name="
               echo "release_url="
-              echo "is_tag_release=false"
+              echo "release_type="
             } >> $GITHUB_OUTPUT
           else
-            echo "GitHub Release found: $FOUND_RELEASE_NAME"
-            echo "   Release URL: $FOUND_RELEASE_URL"
+            FOUND_RELEASE_URL=$(echo "$RELEASES_JSON" | jq -r ".[] | select(.tag_name == \"$FOUND_RELEASE_NAME\") | .html_url")
+            echo "✅ Release found: $FOUND_RELEASE_NAME ($RELEASE_TYPE)"
+            echo "   URL: $FOUND_RELEASE_URL"
             {
               echo "should_process=true"
-              echo "release_exists=true"
               echo "release_name=$FOUND_RELEASE_NAME"
               echo "release_url=$FOUND_RELEASE_URL"
-              echo "is_tag_release=$IS_TAG_RELEASE"
+              echo "release_type=$RELEASE_TYPE"
             } >> $GITHUB_OUTPUT
           fi
 
-          echo '---------------------------------------------------'
+          echo '─────────────────────────────────────────────────'
 
   post-discussion:
-    name: Post to GitHub Discussions
+    name: Post to GitHub Discussions (Nightly & Stable)
     needs: [check-release-exists]
     runs-on: ubuntu-latest
 
-    # Only post for tag-based releases (not development builds)
     if: |
       needs.check-release-exists.outputs.should_process == 'true' &&
-      needs.check-release-exists.outputs.is_tag_release == 'true'
+      (needs.check-release-exists.outputs.release_type == 'nightly' ||
+       needs.check-release-exists.outputs.release_type == 'stable')
 
     env:
       RELEASE_NAME: ${{ needs.check-release-exists.outputs.release_name }}
@@ -146,108 +119,77 @@ jobs:
           submodules: recursive
 
       - name: Get release notes from GitHub Release
-        id: release-details
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
         run: |
           echo "==> Fetching release notes for: $RELEASE_NAME"
-          echo "   Release URL: $RELEASE_URL"
-
-          # Get release body via GitHub API
           RELEASE_JSON=$(gh api repos/$GITHUB_REPOSITORY/releases/tags/$RELEASE_NAME 2>/dev/null || echo "{}")
-
           if [ "$RELEASE_JSON" = "{}" ]; then
-            echo "Release not found: $RELEASE_NAME"
-            echo "This should not happen - check-release-exists should have prevented this!"
+            echo "⚠️  Release not found: $RELEASE_NAME (should not happen after the check job)"
             exit 1
           fi
-
-          # Save release body (release notes)
           echo "$RELEASE_JSON" | jq -r '.body' > release-notes.md
-          echo "Release notes retrieved"
+          echo "✅ Release notes retrieved"
 
       - name: Install jinja2-cli for template rendering
-        run: |
-          pip install jinja2-cli
+        run: pip install jinja2-cli
 
       - name: Render discussion post from Jinja2 template
-        id: render
         run: |
-          echo "==> Preparing GitHub Discussion post..."
-          echo "Release name: $RELEASE_NAME"
-
-          # Read release notes (already fetched)
+          echo "==> Rendering GitHub Discussion post for $RELEASE_NAME"
           RELEASE_NOTES=$(cat release-notes.md)
-
-          # Render template using jinja2
           jinja2 .github/templates/discussion-post.md.j2 \
             -D release_name="$RELEASE_NAME" \
             -D release_url="$RELEASE_URL" \
             -D release_notes="$RELEASE_NOTES" \
             -o discussion-post.md
-
-          echo ""
           echo "==> Generated discussion post:"
           cat discussion-post.md
 
       - name: Post to GitHub Discussions
         uses: actions/github-script@v7
         env:
-          # TODO: Set the actual Discussion category ID for cfxdb CI-CD category
-          # This needs to be configured after the category is created in the repo
-          DISCUSSION_CATEGORY_ID: ${{ github.event.inputs.discussion_category_id || '' }}
+          DISCUSSION_CATEGORY: ${{ github.event.inputs.discussion_category || 'ci-cd' }}
         with:
           script: |
             const fs = require('fs');
-            const discussionBody = fs.readFileSync('discussion-post.md', 'utf8');
-
-            const releaseName = '${{ env.RELEASE_NAME }}';
+            const body = fs.readFileSync('discussion-post.md', 'utf8');
+            const releaseName = process.env.RELEASE_NAME;
             const title = `Release ${releaseName}`;
-            const categoryId = process.env.DISCUSSION_CATEGORY_ID;
-
-            if (!categoryId) {
-              console.log('No Discussion category ID configured - skipping discussion post');
-              console.log('To enable discussion posts:');
-              console.log('1. Create a CI-CD category in GitHub Discussions');
-              console.log('2. Get the category ID from the GraphQL API');
-              console.log('3. Set it in the workflow file');
+            const wantCategory = (process.env.DISCUSSION_CATEGORY || 'ci-cd').toLowerCase();
+
+            // Resolve the repository node id and the target discussion category id
+            // by (case-insensitive) name, so we never hard-code a repo-specific
+            // opaque category id and are immune to category-name casing mistakes.
+            const repoInfo = await github.graphql(`
+              query($owner: String!, $repo: String!) {
+                repository(owner: $owner, name: $repo) {
+                  id
+                  discussionCategories(first: 50) { nodes { id name } }
+                }
+              }
+            `, { owner: context.repo.owner, repo: context.repo.repo });
+
+            const categories = repoInfo.repository.discussionCategories.nodes;
+            const category = categories.find(c => c.name.toLowerCase() === wantCategory);
+            if (!category) {
+              const names = categories.map(c => c.name).join(', ');
+              core.setFailed(`Discussion category '${wantCategory}' not found. Available: ${names}`);
               return;
             }
 
-            console.log(`Creating discussion: ${title}`);
-            console.log(`Category ID: ${categoryId}`);
-
-            // Create discussion using GraphQL API
-            const mutation = `
+            console.log(`Creating discussion '${title}' in category '${category.name}'`);
+            const result = await github.graphql(`
               mutation($repositoryId: ID!, $categoryId: ID!, $title: String!, $body: String!) {
                 createDiscussion(input: {
                   repositoryId: $repositoryId
                   categoryId: $categoryId
                   title: $title
                   body: $body
-                }) {
-                  discussion {
-                    url
-                  }
-                }
+                }) { discussion { url } }
               }
-            `;
-
-            // Get repository ID
-            const { data: repo } = await github.rest.repos.get({
-              owner: context.repo.owner,
-              repo: context.repo.repo
-            });
-            const repositoryId = repo.node_id;
-
-            // Create the discussion
-            const result = await github.graphql(mutation, {
-              repositoryId: repositoryId,
-              categoryId: categoryId,
-              title: title,
-              body: discussionBody
-            });
-
-            const discussionUrl = result.createDiscussion.discussion.url;
-            console.log(`Discussion created: ${discussionUrl}`);
-            core.setOutput('discussion_url', discussionUrl);
+            `, { repositoryId: repoInfo.repository.id, categoryId: category.id, title, body });
+
+            const url = result.createDiscussion.discussion.url;
+            console.log(`✅ Discussion created: ${url}`);
+            core.setOutput('discussion_url', url);

.cicd

@@ -179,7 +179,6 @@ jobs:
           files: ${{ github.workspace }}/dist/*
           draft: false
           prerelease: true
-          discussion_category_name: ci-cd
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
 
@@ -287,7 +286,6 @@ jobs:
           files: ${{ github.workspace }}/dist/*
           draft: false
           prerelease: false
-          discussion_category_name: ci-cd
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
 

.github/workflows/release-post-comment.yml

@@ -13,6 +13,18 @@ Unreleased
 
 *No unreleased changes yet.*
 
+26.6.1 (2026-06-18)
+-------------------
+
+**Dependencies**
+
+* Require ``zlmdb >= 26.6.1`` and ``autobahn[all] >= 26.6.1`` for the coordinated WAMP 26.6.1 release (`#117 <https://github.com/crossbario/cfxdb/issues/117>`_)
+
+**Build & CI/CD**
+
+* Bump the shared ``wamp-ai`` (→ ``4669dc8``) and ``wamp-cicd`` (→ ``f77ca2b``) Git submodules to match the rest of the WAMP project group; the ``wamp-cicd`` bump carries the GHSA-6658 shell-injection hardening in the shared ``identifiers.yml`` reusable workflow (`#117 <https://github.com/crossbario/cfxdb/issues/117>`_)
+* Converge the GitHub Discussions release announcement onto a single mechanism, matching autobahn-python / txaio: the ``release-post-comment.yml`` workflow now resolves the ``ci-cd`` Discussions category **by name** (case-insensitive) and posts for both nightly and stable releases, and the redundant ``softprops`` ``discussion_category_name`` was removed from the release steps so a release posts exactly one announcement (`#117 <https://github.com/crossbario/cfxdb/issues/117>`_, resolves `#114 <https://github.com/crossbario/cfxdb/issues/114>`_)
+
 25.12.2 (2025-12-15)
 --------------------
 

.github/workflows/release.yml

@@ -389,6 +389,7 @@ check-typing venv="":
         --ignore unresolved-global \
         --ignore possibly-missing-attribute \
         --ignore possibly-missing-import \
+        --ignore possibly-missing-submodule \
         --ignore call-non-callable \
         --ignore invalid-assignment \
         --ignore invalid-argument-type \
@@ -399,7 +400,7 @@ check-typing venv="":
         --ignore too-many-positional-arguments \
         --ignore unknown-argument \
         --ignore missing-argument \
-        --ignore non-subscriptable \
+        --ignore not-subscriptable \
         --ignore not-iterable \
         --ignore no-matching-overload \
         --ignore conflicting-declarations \