Fix 212 (#222)

* start new dev branch; add audit file

* Use verified artifacts + check-release-fileset in CI/release (#212)

Align txaio with the rest of the WAMP group's release artifact handling:

- main.yml: replace the three `actions/upload-artifact@v4` uses (coverage,
  documentation, build package) with the shared
  `wamp-proto/wamp-cicd/actions/upload-artifact-verified@main` action, which
  adds SHA256 chain-of-custody. These are CI artifacts not consumed by the
  (self-contained) release workflow, so the verified action's name suffix
  breaks no downstream download.

- release.yml: add the shared `check-release-fileset@main` action to the
  production job, after the non-PyPI files are removed and before the PyPI
  publish, validating the exact payload in strict (fail-closed) mode. txaio
  is pure-Python, so the required fileset is the universal `py3-none-any`
  wheel plus the source distribution.

Verified locally: `just build` + `just build-sourcedist` produce exactly
`txaio-26.6.1-py3-none-any.whl` and `txaio-26.6.1.tar.gz` (matching the
targets); both workflow files parse as valid YAML.

Note: This work was completed with AI assistance (Claude Code).

Author: oberstet

.audit/oberstet_fix_212.md

@@ -0,0 +1,8 @@
+- [ ] I did **not** use any AI-assistance tools to help create this pull request.
+- [x] I **did** use AI-assistance tools to *help* create this pull request.
+- [x] I have read, understood and followed the projects' [AI Policy](https://github.com/crossbario/autobahn-python/blob/main/AI_POLICY.md) when creating code, documentation etc. for this pull request.
+
+Submitted by: @oberstet
+Date: 2026-06-18
+Related issue(s): #212
+Branch: oberstet:fix_212

.github/workflows/main.yml

@@ -99,7 +99,7 @@ jobs:
 
       - name: Upload coverage report
         if: always()
-        uses: actions/upload-artifact@v4
+        uses: wamp-proto/wamp-cicd/actions/upload-artifact-verified@main
         with:
           name: coverage-report
           path: docs/_build/html/coverage/
@@ -164,7 +164,7 @@ jobs:
         run: just docs cpy314
 
       - name: Upload documentation artifacts
-        uses: actions/upload-artifact@v4
+        uses: wamp-proto/wamp-cicd/actions/upload-artifact-verified@main
         with:
           name: documentation
           path: docs/_build/html/
@@ -239,7 +239,7 @@ jobs:
           ls -la dist/
 
       - name: Upload build artifacts
-        uses: actions/upload-artifact@v4
+        uses: wamp-proto/wamp-cicd/actions/upload-artifact-verified@main
         with:
           name: package-${{ matrix.python-env }}
           path: dist/

.github/workflows/release.yml

@@ -341,6 +341,17 @@ jobs:
           ls -lh dist/
           echo "======================================================================"
 
+      # Fail-closed validation of the exact PyPI payload. txaio is pure-Python,
+      # so the required fileset is the universal wheel plus the source dist.
+      - name: Validate release fileset (PyPI)
+        uses: wamp-proto/wamp-cicd/actions/check-release-fileset@main
+        with:
+          distdir: dist
+          mode: strict
+          targets: |
+            py3-none-any
+            source
+
       - name: Publish to PyPI
         uses: pypa/gh-action-pypi-publish@release/v1
         with:

docs/changelog.rst

@@ -17,6 +17,7 @@ This document contains a reverse-chronological list of changes to txaio.
 
 **Other**
 
+* Align artifact handling with the rest of the WAMP group: CI now uploads build, coverage and documentation artifacts via the shared ``upload-artifact-verified`` action (SHA256 chain-of-custody), and the release workflow validates the exact PyPI payload — the universal ``py3-none-any`` wheel plus the source distribution — with the shared, fail-closed ``check-release-fileset`` action before publishing (`#212 <https://github.com/crossbario/txaio/issues/212>`_)
 * Remove three permanently-skipped legacy tests that exercised the ``@asyncio.coroutine`` decorator. That decorator was removed in Python 3.11 (txaio's minimum supported version), so the tests could no longer run on any supported interpreter and only emitted skips (`#152 <https://github.com/crossbario/txaio/issues/152>`_)
 * Bumped the shared ``wamp-ai`` and ``wamp-cicd`` Git submodules to match the rest of the WAMP project group (zlmdb / autobahn-python 26.6.1) for the coordinated release. The ``wamp-cicd`` bump picks up the GHSA-6658 shell-injection hardening in the shared ``identifiers.yml`` reusable workflow (untrusted GitHub event fields are now passed via ``env:`` as quoted data with a fail-closed branch-name allowlist) (`#218 <https://github.com/crossbario/txaio/issues/218>`_)
 * Declare the ``ty`` type checker in the ``dev`` extra and run it from the project venv (dropping the separate global ``uv tool install ty`` step), so local and CI resolve the same latest ``ty``. Fixed a newly-reported ``ty`` ``invalid-argument-type`` diagnostic in ``tx.py`` (the Twisted ``ILogObserver`` is provided via ``zope.interface`` ``@provider``, which static checkers cannot follow) with a localized ``cast`` rather than a blanket rule ignore. Excluded the ``.ai`` / ``.cicd`` submodules from ``ruff`` (they carry their own linting/CI) (`#218 <https://github.com/crossbario/txaio/issues/218>`_)