Phase 1.3: CI/CD Modernization (#205)

* create new feature branch; add audit file

* refactor: migrate from mypy to ty (Astral type checker)

Replace mypy with ty for static type checking. ty is Astral's
extremely fast Rust-based type checker that:
- Installs as a standalone binary (no Python package deps)
- Eliminates PyPy build failures caused by mypy's librt dependency
- Is 10-100x faster than mypy
- Integrates well with the Astral toolchain (uv, ruff)

Changes:
- pyproject.toml: Remove mypy from dev deps, add [tool.ty] section
- justfile: Update check-typing to use `ty check` instead of mypy
- justfile: Update distclean to remove .ty/ instead of .mypy_cache/

Some ty rules are ignored due to txaio's dynamic framework switching:
- unresolved-attribute: dynamic module attributes (using_twisted, etc)
- possibly-missing-attribute: sys._getframe() returns FrameType | None
- call-non-callable: callback type inference edge cases
- deprecated: abc.abstractproperty usage (to be fixed later)

* ci: enable ty type checking in GitHub Actions

- Add step to install ty via `uv tool install ty`
- Add ty version to toolchain verification output
- Enable type checking step (was commented out for mypy)

* ci: enable tests and coverage in GitHub Actions

Add test execution and coverage reporting to quality-checks job:
- Run tests via `just test cpy314`
- Run coverage report via `just check-coverage cpy314`

* ci: align workflows with wamp-cicd patterns

- Add identifiers job using wamp-cicd reusable workflow
- Add permissions block (contents: read, pull-requests: read)
- Add submodules: recursive to all checkout steps
- Add environment variables from identifiers outputs to all jobs
- Add coverage report artifact upload step
- Update build-package to depend on identifiers job

This aligns txaio workflows with autobahn-python patterns for
consistent CI/CD across the WAMP project group.

* ci: fix publish-github-releases to skip on PRs

- Add if condition to only run on push/workflow_dispatch events
- Add permissions block with contents: write for release creation
- Prevents failures when release.yml runs on PR events

* ci: align release.yml with autobahn-python model

- Replace direct push/pr triggers with workflow_run trigger
- Add check-main-workflow job to verify main workflow completed
- Use wamp-proto/wamp-cicd identifiers.yml for release type detection
- Separate release-development (dev/nightly) and release-production jobs
- Gate releases by identifiers.outputs.release_type
- Production releases now trigger on 'stable' release_type from tags
- Development releases trigger on 'development' or 'nightly' types
- Use softprops/action-gh-release@v2 for GitHub releases
- Use PyPI trusted publishing (OIDC) for production releases
- Build docs with cpy314, package with cpy311
- Add checksums and documentation archive to releases

This aligns txaio with the standard workflow model used by
autobahn-python, zlmdb, and crossbar - eliminating the risk of
accidental releases from PR builds.

Note: This work was completed with AI assistance (Claude Code).

Author: oberstet

.audit/oberstet_modernization-phase-13.md

@@ -0,0 +1,8 @@
+- [ ] I did **not** use any AI-assistance tools to help create this pull request.
+- [x] I **did** use AI-assistance tools to *help* create this pull request.
+- [x] I have read, understood and followed the project's AI_POLICY.md when creating code, documentation etc. for this pull request.
+
+Submitted by: @oberstet
+Date: 2025-12-02
+Related issue(s): #204
+Branch: oberstet:modernization-phase-1.3

.github/workflows/main.yml

@@ -7,17 +7,40 @@ on:
     branches: [master]
   workflow_dispatch:
 
+permissions:
+  contents: read
+  pull-requests: read
+
 env:
   UV_CACHE_DIR: ${{ github.workspace }}/.uv-cache
 
 jobs:
+  identifiers:
+    # GitHub needs to know where .cicd/workflows/identifiers.yml lives at parse time,
+    # and submodules aren't included in that context! thus the following does NOT work:
+    # uses: ./.cicd/workflows/identifiers.yml
+    # we MUST reference the remote repo directly:
+    uses: wamp-proto/wamp-cicd/.github/workflows/identifiers.yml@main
+    # IMPORTANT: we still need .cicd as a Git submodule in the using repo though!
+    # because e.g. identifiers.yml wants to access scripts/sanitize.sh !
+
   quality-checks:
     name: Code Quality Checks
+    needs: identifiers
     runs-on: ubuntu-24.04
 
+    env:
+      BASE_REPO: ${{ needs.identifiers.outputs.base_repo }}
+      BASE_BRANCH: ${{ needs.identifiers.outputs.base_branch }}
+      PR_NUMBER: ${{ needs.identifiers.outputs.pr_number }}
+      PR_REPO: ${{ needs.identifiers.outputs.pr_repo }}
+      PR_BRANCH: ${{ needs.identifiers.outputs.pr_branch }}
+
     steps:
       - name: Checkout code
         uses: actions/checkout@v4
+        with:
+          submodules: recursive
 
       - name: Install Just
         env:
@@ -37,10 +60,14 @@ jobs:
                -LsSf https://astral.sh/uv/install.sh | sh
           echo "$HOME/.cargo/bin" >> $GITHUB_PATH
 
+      - name: Install ty (Astral type checker)
+        run: uv tool install ty
+
       - name: Verify toolchain installation
         run: |
           just --version
           uv --version
+          ty --version
 
       - name: Setup uv cache
         uses: actions/cache@v4
@@ -59,19 +86,40 @@ jobs:
       - name: Lint code using Ruff
         run: just check-format cpy314
 
-      # - name: Run static type checking with mypy
-      #   run: just check-typing cpy314
+      - name: Run static type checking with ty
+        run: just check-typing cpy314
+
+      - name: Run tests
+        run: just test cpy314
+
+      - name: Run tests with coverage report
+        run: just check-coverage cpy314
 
-      # - name: Run tests and generate an HTML coverage report
-      #   run: just check-coverage cpy314
+      - name: Upload coverage report
+        if: always()
+        uses: actions/upload-artifact@v4
+        with:
+          name: coverage-report
+          path: docs/_build/html/coverage/
+          retention-days: 14
 
   documentation:
     name: Documentation Build
+    needs: identifiers
     runs-on: ubuntu-24.04
 
+    env:
+      BASE_REPO: ${{ needs.identifiers.outputs.base_repo }}
+      BASE_BRANCH: ${{ needs.identifiers.outputs.base_branch }}
+      PR_NUMBER: ${{ needs.identifiers.outputs.pr_number }}
+      PR_REPO: ${{ needs.identifiers.outputs.pr_repo }}
+      PR_BRANCH: ${{ needs.identifiers.outputs.pr_branch }}
+
     steps:
       - name: Checkout code
         uses: actions/checkout@v4
+        with:
+          submodules: recursive
 
       - name: Install Just
         env:
@@ -123,7 +171,14 @@ jobs:
   build-package:
     name: Package Build
     runs-on: ubuntu-24.04
-    needs: [quality-checks]
+    needs: [identifiers, quality-checks]
+
+    env:
+      BASE_REPO: ${{ needs.identifiers.outputs.base_repo }}
+      BASE_BRANCH: ${{ needs.identifiers.outputs.base_branch }}
+      PR_NUMBER: ${{ needs.identifiers.outputs.pr_number }}
+      PR_REPO: ${{ needs.identifiers.outputs.pr_repo }}
+      PR_BRANCH: ${{ needs.identifiers.outputs.pr_branch }}
 
     strategy:
       matrix:
@@ -132,6 +187,8 @@ jobs:
     steps:
       - name: Checkout code
         uses: actions/checkout@v4
+        with:
+          submodules: recursive
 
       - name: Install Just
         env: