Phase 1.3: CI/CD Modernization

.audit/oberstet_modernization-phase-13.md

@@ -0,0 +1,8 @@
+- [ ] I did **not** use any AI-assistance tools to help create this pull request.
+- [x] I **did** use AI-assistance tools to *help* create this pull request.
+- [x] I have read, understood and followed the project's AI_POLICY.md when creating code, documentation etc. for this pull request.
+
+Submitted by: @oberstet
+Date: 2025-12-02
+Related issue(s): #107
+Branch: oberstet:modernization-phase-1.3

.github/workflows/main.yml

@@ -9,19 +9,44 @@ on:
       - master
 
 jobs:
+  identifiers:
+    name: Identifiers
+    # GitHub needs to know where .cicd/workflows/identifiers.yml lives at parse time,
+    # and submodules aren't included in that context! thus the following does NOT work:
+    # uses: ./.cicd/workflows/identifiers.yml
+    # we MUST reference the remote repo directly:
+    uses: wamp-proto/wamp-cicd/.github/workflows/identifiers.yml@main
+    # IMPORTANT: we still need .cicd as a Git submodule in the using repo though!
+    # because e.g. identifiers.yml wants to access scripts/sanitize.sh !
+
   check:
+    name: Code Quality
+    needs: identifiers
     runs-on: ubuntu-24.04
+
+    env:
+      BASE_REPO: ${{ needs.identifiers.outputs.base_repo }}
+      BASE_BRANCH: ${{ needs.identifiers.outputs.base_branch }}
+      PR_NUMBER: ${{ needs.identifiers.outputs.pr_number }}
+      PR_REPO: ${{ needs.identifiers.outputs.pr_repo }}
+      PR_BRANCH: ${{ needs.identifiers.outputs.pr_branch }}
+
     steps:
       - uses: actions/checkout@v4
+        with:
+          submodules: recursive
 
       - name: Install uv
-        uses: astral-sh/setup-uv@v5
+        uses: astral-sh/setup-uv@v6
 
       - name: Set up Python 3.11
         run: uv python install 3.11
 
       - name: Install just
-        uses: extractions/setup-just@v2
+        uses: extractions/setup-just@v3
+
+      - name: Install ty (Astral type checker)
+        run: uv tool install ty
 
       - name: Create venv and install dev dependencies
         run: |
@@ -32,7 +57,17 @@ jobs:
         run: just check cpy311
 
   test:
+    name: Test Suite
+    needs: identifiers
     runs-on: ${{ matrix.os }}
+
+    env:
+      BASE_REPO: ${{ needs.identifiers.outputs.base_repo }}
+      BASE_BRANCH: ${{ needs.identifiers.outputs.base_branch }}
+      PR_NUMBER: ${{ needs.identifiers.outputs.pr_number }}
+      PR_REPO: ${{ needs.identifiers.outputs.pr_repo }}
+      PR_BRANCH: ${{ needs.identifiers.outputs.pr_branch }}
+
     strategy:
       matrix:
         os: [ubuntu-24.04]
@@ -43,12 +78,14 @@ jobs:
 
     steps:
       - uses: actions/checkout@v4
+        with:
+          submodules: recursive
 
       - name: Install uv
-        uses: astral-sh/setup-uv@v5
+        uses: astral-sh/setup-uv@v6
 
       - name: Install just
-        uses: extractions/setup-just@v2
+        uses: extractions/setup-just@v3
 
       - name: Create venv and install dependencies
         run: |
@@ -59,18 +96,30 @@ jobs:
         run: just test ${{ matrix.env }}
 
   docs:
+    name: Documentation
+    needs: identifiers
     runs-on: ubuntu-24.04
+
+    env:
+      BASE_REPO: ${{ needs.identifiers.outputs.base_repo }}
+      BASE_BRANCH: ${{ needs.identifiers.outputs.base_branch }}
+      PR_NUMBER: ${{ needs.identifiers.outputs.pr_number }}
+      PR_REPO: ${{ needs.identifiers.outputs.pr_repo }}
+      PR_BRANCH: ${{ needs.identifiers.outputs.pr_branch }}
+
     steps:
       - uses: actions/checkout@v4
+        with:
+          submodules: recursive
 
       - name: Install uv
-        uses: astral-sh/setup-uv@v5
+        uses: astral-sh/setup-uv@v6
 
       - name: Set up Python 3.11
         run: uv python install 3.11
 
       - name: Install just
-        uses: extractions/setup-just@v2
+        uses: extractions/setup-just@v3
 
       - name: Create venv and install dependencies
         run: |

.github/workflows/release.yml

@@ -16,12 +16,8 @@ permissions:
   pull-requests: read  # Required for identifiers workflow
 
 jobs:
-  identifiers:
-    uses: wamp-proto/wamp-cicd/.github/workflows/identifiers.yml@main
-
   check-main-workflow:
     name: Check if main workflow completed successfully
-    needs: [identifiers]
     runs-on: ubuntu-latest
     outputs:
       main_run_id: ${{ steps.check.outputs.main_run_id }}
@@ -74,15 +70,29 @@ jobs:
             core.setOutput('should_proceed', mainComplete ? 'true' : 'false');
             core.setOutput('main_run_id', mainRun?.id || '');
 
+  identifiers:
+    name: Identifiers
+    needs: check-main-workflow
+    if: needs.check-main-workflow.outputs.should_proceed == 'true'
+    # GitHub needs to know where .cicd/workflows/identifiers.yml lives at parse time,
+    # and submodules aren't included in that context! thus the following does NOT work:
+    # uses: ./.cicd/workflows/identifiers.yml
+    # we MUST reference the remote repo directly:
+    uses: wamp-proto/wamp-cicd/.github/workflows/identifiers.yml@main
+    # IMPORTANT: we still need .cicd as a Git submodule in the using repo though!
+    # because e.g. identifiers.yml wants to access scripts/sanitize.sh !
+
   # Development/Nightly GitHub releases (for untagged master builds)
   release-development:
     name: Development/Nightly GitHub Release
-    needs: [identifiers, check-main-workflow]
+    needs: [check-main-workflow, identifiers]
     runs-on: ubuntu-24.04
 
     # Only create releases for development/nightly builds (not stable tags)
     if: |
       needs.check-main-workflow.outputs.should_proceed == 'true' &&
+      (github.event_name == 'workflow_dispatch' ||
+       (github.event_name == 'workflow_run' && github.event.workflow_run.conclusion == 'success')) &&
       (needs.identifiers.outputs.release_type == 'development' || needs.identifiers.outputs.release_type == 'nightly')
 
     env:
@@ -96,13 +106,13 @@ jobs:
           submodules: recursive
 
       - name: Install uv
-        uses: astral-sh/setup-uv@v5
+        uses: astral-sh/setup-uv@v6
 
       - name: Set up Python 3.11
         run: uv python install 3.11
 
       - name: Install just
-        uses: extractions/setup-just@v2
+        uses: extractions/setup-just@v3
 
       - name: Create venv and install build tools
         run: |
@@ -214,12 +224,14 @@ jobs:
   # Production releases (for tagged stable builds) - GitHub + PyPI
   release-production:
     name: Production Release (GitHub + PyPI)
-    needs: [identifiers, check-main-workflow]
+    needs: [check-main-workflow, identifiers]
     runs-on: ubuntu-24.04
 
     # Only publish to PyPI for stable releases (explicit tag check)
     if: |
       needs.check-main-workflow.outputs.should_proceed == 'true' &&
+      (github.event_name == 'workflow_dispatch' ||
+       (github.event_name == 'workflow_run' && github.event.workflow_run.conclusion == 'success')) &&
       needs.identifiers.outputs.release_type == 'stable'
 
     env:
@@ -239,13 +251,13 @@ jobs:
           submodules: recursive
 
       - name: Install uv
-        uses: astral-sh/setup-uv@v5
+        uses: astral-sh/setup-uv@v6
 
       - name: Set up Python 3.11
         run: uv python install 3.11
 
       - name: Install just
-        uses: extractions/setup-just@v2
+        uses: extractions/setup-just@v3
 
       - name: Create venv and install build tools
         run: |

justfile

@@ -149,7 +149,7 @@ clean-test:
     #!/usr/bin/env bash
     set -e
     echo "==> Cleaning test artifacts..."
-    rm -rf .pytest_cache/ .coverage htmlcov/ .tox/
+    rm -rf .pytest_cache/ .coverage htmlcov/ .tox/ .mypy_cache/ .ty/
     echo "--> Test artifacts cleaned."
 
 # Clean generated documentation
@@ -239,13 +239,14 @@ install-dev venv="":
     ${VENV_PYTHON} -m pip install -e '.[dev]'
     echo "--> Installed cfxdb[dev] in editable mode"
 
-# Install development tools (ruff, mypy, sphinx, etc.)
+# Install development tools (ruff, sphinx, etc.)
+# Note: ty (Astral type checker) is installed via `uv tool install ty`
 install-tools venv="":
     #!/usr/bin/env bash
     set -e
     VENV_PYTHON=$(just --quiet _get-venv-python {{ venv }})
     echo "==> Installing development tools..."
-    ${VENV_PYTHON} -m pip install ruff mypy pytest sphinx twine build
+    ${VENV_PYTHON} -m pip install ruff pytest sphinx twine build
     echo "--> Installed development tools"
 
 # Install minimal build tools for building wheels
@@ -315,13 +316,38 @@ check-lint venv="":
     ${VENV_PYTHON} -m ruff check src/cfxdb/
     echo "--> Linting passed"
 
-# Run static type checking with mypy
+# Run static type checking with ty (Astral's Rust-based type checker)
+# FIXME: Many type errors need to be fixed. For now, we ignore most rules
+# to get CI passing. Create follow-up issue to address type errors.
 check-typing venv="":
     #!/usr/bin/env bash
     set -e
     VENV_PYTHON=$(just --quiet _get-venv-python {{ venv }})
-    echo "==> Running type checking with mypy..."
-    ${VENV_PYTHON} -m mypy src/cfxdb/ || echo "Warning: Type checking found issues"
+    echo "==> Running type checking with ty..."
+    ty check \
+        --python "${VENV_PYTHON}" \
+        --ignore unresolved-import \
+        --ignore unresolved-attribute \
+        --ignore unresolved-reference \
+        --ignore unresolved-global \
+        --ignore possibly-missing-attribute \
+        --ignore possibly-missing-import \
+        --ignore call-non-callable \
+        --ignore invalid-assignment \
+        --ignore invalid-argument-type \
+        --ignore invalid-return-type \
+        --ignore invalid-method-override \
+        --ignore invalid-type-form \
+        --ignore unsupported-operator \
+        --ignore too-many-positional-arguments \
+        --ignore unknown-argument \
+        --ignore missing-argument \
+        --ignore non-subscriptable \
+        --ignore not-iterable \
+        --ignore no-matching-overload \
+        --ignore conflicting-declarations \
+        --ignore deprecated \
+        src/cfxdb/
 
 # Run all code quality checks
 check venv="": (check-format venv) (check-lint venv) (check-typing venv)
@@ -452,6 +478,9 @@ verify-wheels venv="": (install-tools venv)
     echo ""
     echo "==> Wheel verification complete."
 
+# Alias for verify-wheels (used by release.yml)
+verify-dist venv="": (verify-wheels venv)
+
 # -----------------------------------------------------------------------------
 # -- Documentation
 # -----------------------------------------------------------------------------

pyproject.toml

@@ -72,8 +72,8 @@ dev = [
 
     # Code quality
     "ruff>=0.1.0",  # Fast Python linter and formatter
-    "mypy>=1.0.0",  # Static type checker
-    "types-PyYAML>=6.0.0",  # Type stubs
+    # Note: ty (Astral type checker) is installed via `uv tool install ty`
+    # It's a standalone Rust binary, not a Python package dependency
 
     # Documentation
     "sphinx>=1.7.1",
@@ -124,14 +124,6 @@ ignore = [
     "E402",  # module level import not at top (intentional in test files)
 ]
 
-# MyPy configuration
-[tool.mypy]
-python_version = "3.11"
-warn_return_any = true
-warn_unused_configs = true
-disallow_untyped_defs = false
-ignore_missing_imports = true
-
 # Pytest configuration
 [tool.pytest.ini_options]
 testpaths = ["src/cfxdb/tests"]