Phase 1.3: CI/CD Modernization (#108)

* create new feature branch; add audit file

* chore(ci): migrate from mypy to ty for type checking (#107)

Phase 1.3: CI/CD Modernization - Replace mypy with Astral's Rust-based
ty type checker for better PyPy compatibility and faster execution.

Changes:
- Add identifiers job using wamp-cicd reusable workflow
- Update setup-uv from v5 to v6, setup-just from v2 to v3
- Add submodules: recursive to all checkout steps
- Add ty installation step to main.yml workflow
- Update justfile check-typing recipe to use ty instead of mypy
- Remove mypy from install-tools and pyproject.toml dev dependencies
- Remove [tool.mypy] section from pyproject.toml
- Add .mypy_cache/ and .ty/ cleanup to clean-test recipe
- Add py.typed marker file for PEP 561 compliance
- Add comprehensive --ignore flags to suppress existing type errors

* fix(ci): use correct wamp-cicd repo path (#107)

Fix identifiers job to reference wamp-proto/wamp-cicd (public repo)
instead of crossbario/wamp-cicd (doesn't exist).

* fix(ci): add verify-dist alias for release.yml (#107)

Add verify-dist recipe as an alias for verify-wheels to match
the recipe name expected by release.yml workflow.

* chore(ci): update release.yml action versions (#107)

Update setup-uv from v5 to v6 and setup-just from v2 to v3
for consistency with main.yml.

* fix(ci): skip release.yml on PR branches (#107)

Add condition to only run release workflow when triggered by
main workflow on master branch, not on PR branches. This prevents
release.yml from failing on PRs where the code changes haven't
been merged to master yet.

* ci: align release.yml with autobahn-python model

- Remove head_branch == 'master' workaround from identifiers job
- Reorder jobs: check-main-workflow first, then identifiers
- Add proper if condition on identifiers based on should_proceed
- Add github.event_name checks to release job conditions
- Update needs order to [check-main-workflow, identifiers]
- Add explanatory comments for identifiers workflow usage

This aligns cfxdb with the standard workflow model used by
autobahn-python, zlmdb, txaio, and crossbar. The workflow_run
trigger inherently prevents PR-triggered releases since PRs
don't trigger workflow_run events for security reasons.

Note: This work was completed with AI assistance (Claude Code).

Author: oberstet

.audit/oberstet_modernization-phase-13.md

@@ -0,0 +1,8 @@
+- [ ] I did **not** use any AI-assistance tools to help create this pull request.
+- [x] I **did** use AI-assistance tools to *help* create this pull request.
+- [x] I have read, understood and followed the project's AI_POLICY.md when creating code, documentation etc. for this pull request.
+
+Submitted by: @oberstet
+Date: 2025-12-02
+Related issue(s): #107
+Branch: oberstet:modernization-phase-1.3

.github/workflows/main.yml

@@ -9,19 +9,44 @@ on:
       - master
 
 jobs:
+  identifiers:
+    name: Identifiers
+    # GitHub needs to know where .cicd/workflows/identifiers.yml lives at parse time,
+    # and submodules aren't included in that context! thus the following does NOT work:
+    # uses: ./.cicd/workflows/identifiers.yml
+    # we MUST reference the remote repo directly:
+    uses: wamp-proto/wamp-cicd/.github/workflows/identifiers.yml@main
+    # IMPORTANT: we still need .cicd as a Git submodule in the using repo though!
+    # because e.g. identifiers.yml wants to access scripts/sanitize.sh !
+
   check:
+    name: Code Quality
+    needs: identifiers
     runs-on: ubuntu-24.04
+
+    env:
+      BASE_REPO: ${{ needs.identifiers.outputs.base_repo }}
+      BASE_BRANCH: ${{ needs.identifiers.outputs.base_branch }}
+      PR_NUMBER: ${{ needs.identifiers.outputs.pr_number }}
+      PR_REPO: ${{ needs.identifiers.outputs.pr_repo }}
+      PR_BRANCH: ${{ needs.identifiers.outputs.pr_branch }}
+
     steps:
       - uses: actions/checkout@v4
+        with:
+          submodules: recursive
 
       - name: Install uv
-        uses: astral-sh/setup-uv@v5
+        uses: astral-sh/setup-uv@v6
 
       - name: Set up Python 3.11
         run: uv python install 3.11
 
       - name: Install just
-        uses: extractions/setup-just@v2
+        uses: extractions/setup-just@v3
+
+      - name: Install ty (Astral type checker)
+        run: uv tool install ty
 
       - name: Create venv and install dev dependencies
         run: |
@@ -32,7 +57,17 @@ jobs:
         run: just check cpy311
 
   test:
+    name: Test Suite
+    needs: identifiers
     runs-on: ${{ matrix.os }}
+
+    env:
+      BASE_REPO: ${{ needs.identifiers.outputs.base_repo }}
+      BASE_BRANCH: ${{ needs.identifiers.outputs.base_branch }}
+      PR_NUMBER: ${{ needs.identifiers.outputs.pr_number }}
+      PR_REPO: ${{ needs.identifiers.outputs.pr_repo }}
+      PR_BRANCH: ${{ needs.identifiers.outputs.pr_branch }}
+
     strategy:
       matrix:
         os: [ubuntu-24.04]
@@ -43,12 +78,14 @@ jobs:
 
     steps:
       - uses: actions/checkout@v4
+        with:
+          submodules: recursive
 
       - name: Install uv
-        uses: astral-sh/setup-uv@v5
+        uses: astral-sh/setup-uv@v6
 
       - name: Install just
-        uses: extractions/setup-just@v2
+        uses: extractions/setup-just@v3
 
       - name: Create venv and install dependencies
         run: |
@@ -59,18 +96,30 @@ jobs:
         run: just test ${{ matrix.env }}
 
   docs:
+    name: Documentation
+    needs: identifiers
     runs-on: ubuntu-24.04
+
+    env:
+      BASE_REPO: ${{ needs.identifiers.outputs.base_repo }}
+      BASE_BRANCH: ${{ needs.identifiers.outputs.base_branch }}
+      PR_NUMBER: ${{ needs.identifiers.outputs.pr_number }}
+      PR_REPO: ${{ needs.identifiers.outputs.pr_repo }}
+      PR_BRANCH: ${{ needs.identifiers.outputs.pr_branch }}
+
     steps:
       - uses: actions/checkout@v4
+        with:
+          submodules: recursive
 
       - name: Install uv
-        uses: astral-sh/setup-uv@v5
+        uses: astral-sh/setup-uv@v6
 
       - name: Set up Python 3.11
         run: uv python install 3.11
 
       - name: Install just
-        uses: extractions/setup-just@v2
+        uses: extractions/setup-just@v3
 
       - name: Create venv and install dependencies
         run: |

.github/workflows/release.yml

@@ -16,12 +16,8 @@ permissions:
   pull-requests: read  # Required for identifiers workflow
 
 jobs:
-  identifiers:
-    uses: wamp-proto/wamp-cicd/.github/workflows/identifiers.yml@main
-
   check-main-workflow:
     name: Check if main workflow completed successfully
-    needs: [identifiers]
     runs-on: ubuntu-latest
     outputs:
       main_run_id: ${{ steps.check.outputs.main_run_id }}
@@ -74,15 +70,29 @@ jobs:
             core.setOutput('should_proceed', mainComplete ? 'true' : 'false');
             core.setOutput('main_run_id', mainRun?.id || '');
 
+  identifiers:
+    name: Identifiers
+    needs: check-main-workflow
+    if: needs.check-main-workflow.outputs.should_proceed == 'true'
+    # GitHub needs to know where .cicd/workflows/identifiers.yml lives at parse time,
+    # and submodules aren't included in that context! thus the following does NOT work:
+    # uses: ./.cicd/workflows/identifiers.yml
+    # we MUST reference the remote repo directly:
+    uses: wamp-proto/wamp-cicd/.github/workflows/identifiers.yml@main
+    # IMPORTANT: we still need .cicd as a Git submodule in the using repo though!
+    # because e.g. identifiers.yml wants to access scripts/sanitize.sh !
+
   # Development/Nightly GitHub releases (for untagged master builds)
   release-development:
     name: Development/Nightly GitHub Release
-    needs: [identifiers, check-main-workflow]
+    needs: [check-main-workflow, identifiers]
     runs-on: ubuntu-24.04
 
     # Only create releases for development/nightly builds (not stable tags)
     if: |
       needs.check-main-workflow.outputs.should_proceed == 'true' &&
+      (github.event_name == 'workflow_dispatch' ||
+       (github.event_name == 'workflow_run' && github.event.workflow_run.conclusion == 'success')) &&
       (needs.identifiers.outputs.release_type == 'development' || needs.identifiers.outputs.release_type == 'nightly')
 
     env:
@@ -96,13 +106,13 @@ jobs:
           submodules: recursive
 
       - name: Install uv
-        uses: astral-sh/setup-uv@v5
+        uses: astral-sh/setup-uv@v6
 
       - name: Set up Python 3.11
         run: uv python install 3.11
 
       - name: Install just
-        uses: extractions/setup-just@v2
+        uses: extractions/setup-just@v3
 
       - name: Create venv and install build tools
         run: |
@@ -214,12 +224,14 @@ jobs:
   # Production releases (for tagged stable builds) - GitHub + PyPI
   release-production:
     name: Production Release (GitHub + PyPI)
-    needs: [identifiers, check-main-workflow]
+    needs: [check-main-workflow, identifiers]
     runs-on: ubuntu-24.04
 
     # Only publish to PyPI for stable releases (explicit tag check)
     if: |
       needs.check-main-workflow.outputs.should_proceed == 'true' &&
+      (github.event_name == 'workflow_dispatch' ||
+       (github.event_name == 'workflow_run' && github.event.workflow_run.conclusion == 'success')) &&
       needs.identifiers.outputs.release_type == 'stable'
 
     env:
@@ -239,13 +251,13 @@ jobs:
           submodules: recursive
 
       - name: Install uv
-        uses: astral-sh/setup-uv@v5
+        uses: astral-sh/setup-uv@v6
 
       - name: Set up Python 3.11
         run: uv python install 3.11
 
       - name: Install just
-        uses: extractions/setup-just@v2
+        uses: extractions/setup-just@v3
 
       - name: Create venv and install build tools
         run: |

justfile

@@ -149,7 +149,7 @@ clean-test:
     #!/usr/bin/env bash
     set -e
     echo "==> Cleaning test artifacts..."
-    rm -rf .pytest_cache/ .coverage htmlcov/ .tox/
+    rm -rf .pytest_cache/ .coverage htmlcov/ .tox/ .mypy_cache/ .ty/
     echo "--> Test artifacts cleaned."
 
 # Clean generated documentation
@@ -239,13 +239,14 @@ install-dev venv="":
     ${VENV_PYTHON} -m pip install -e '.[dev]'
     echo "--> Installed cfxdb[dev] in editable mode"
 
-# Install development tools (ruff, mypy, sphinx, etc.)
+# Install development tools (ruff, sphinx, etc.)
+# Note: ty (Astral type checker) is installed via `uv tool install ty`
 install-tools venv="":
     #!/usr/bin/env bash
     set -e
     VENV_PYTHON=$(just --quiet _get-venv-python {{ venv }})
     echo "==> Installing development tools..."
-    ${VENV_PYTHON} -m pip install ruff mypy pytest sphinx twine build
+    ${VENV_PYTHON} -m pip install ruff pytest sphinx twine build
     echo "--> Installed development tools"
 
 # Install minimal build tools for building wheels
@@ -315,13 +316,38 @@ check-lint venv="":
     ${VENV_PYTHON} -m ruff check src/cfxdb/
     echo "--> Linting passed"
 
-# Run static type checking with mypy
+# Run static type checking with ty (Astral's Rust-based type checker)
+# FIXME: Many type errors need to be fixed. For now, we ignore most rules
+# to get CI passing. Create follow-up issue to address type errors.
 check-typing venv="":
     #!/usr/bin/env bash
     set -e
     VENV_PYTHON=$(just --quiet _get-venv-python {{ venv }})
-    echo "==> Running type checking with mypy..."
-    ${VENV_PYTHON} -m mypy src/cfxdb/ || echo "Warning: Type checking found issues"
+    echo "==> Running type checking with ty..."
+    ty check \
+        --python "${VENV_PYTHON}" \
+        --ignore unresolved-import \
+        --ignore unresolved-attribute \
+        --ignore unresolved-reference \
+        --ignore unresolved-global \
+        --ignore possibly-missing-attribute \
+        --ignore possibly-missing-import \
+        --ignore call-non-callable \
+        --ignore invalid-assignment \
+        --ignore invalid-argument-type \
+        --ignore invalid-return-type \
+        --ignore invalid-method-override \
+        --ignore invalid-type-form \
+        --ignore unsupported-operator \
+        --ignore too-many-positional-arguments \
+        --ignore unknown-argument \
+        --ignore missing-argument \
+        --ignore non-subscriptable \
+        --ignore not-iterable \
+        --ignore no-matching-overload \
+        --ignore conflicting-declarations \
+        --ignore deprecated \
+        src/cfxdb/
 
 # Run all code quality checks
 check venv="": (check-format venv) (check-lint venv) (check-typing venv)
@@ -452,6 +478,9 @@ verify-wheels venv="": (install-tools venv)
     echo ""
     echo "==> Wheel verification complete."
 
+# Alias for verify-wheels (used by release.yml)
+verify-dist venv="": (verify-wheels venv)
+
 # -----------------------------------------------------------------------------
 # -- Documentation
 # -----------------------------------------------------------------------------

pyproject.toml

@@ -72,8 +72,8 @@ dev = [
 
     # Code quality
     "ruff>=0.1.0",  # Fast Python linter and formatter
-    "mypy>=1.0.0",  # Static type checker
-    "types-PyYAML>=6.0.0",  # Type stubs
+    # Note: ty (Astral type checker) is installed via `uv tool install ty`
+    # It's a standalone Rust binary, not a Python package dependency
 
     # Documentation
     "sphinx>=1.7.1",
@@ -124,14 +124,6 @@ ignore = [
     "E402",  # module level import not at top (intentional in test files)
 ]
 
-# MyPy configuration
-[tool.mypy]
-python_version = "3.11"
-warn_return_any = true
-warn_unused_configs = true
-disallow_untyped_defs = false
-ignore_missing_imports = true
-
 # Pytest configuration
 [tool.pytest.ini_options]
 testpaths = ["src/cfxdb/tests"]