ci: add uv-based main workflow with ty and codecov

Add a composite setup-python-env action (setup-uv + uv sync --frozen)
and a main.yml workflow with a quality job (make check) and an 8-leg
test matrix (ubuntu 3.10-3.13, macos/windows on 3.10+3.13) running
pytest and ty. Coverage goes to codecov via the org-level
CODECOV_TOKEN with informational statuses. ci.yml is replaced by
on-release-main.yml (interim token publish) so the workflow filename
and pypi environment already match the upcoming OIDC trusted
publisher configuration

Author: raederan

.github/actions/setup-python-env/action.yml

@@ -0,0 +1,30 @@
+name: "Setup Python Environment"
+description: "Set up Python and uv, then install the locked dependencies"
+
+inputs:
+  python-version:
+    description: "Python version to use"
+    required: true
+    default: "3.12"
+  uv-version:
+    description: "uv version to use"
+    required: true
+    default: "0.9.9"
+
+runs:
+  using: "composite"
+  steps:
+    - uses: actions/setup-python@v5
+      with:
+        python-version: ${{ inputs.python-version }}
+
+    - name: Install uv
+      uses: astral-sh/setup-uv@v6
+      with:
+        version: ${{ inputs.uv-version }}
+        enable-cache: true
+        cache-suffix: ${{ matrix.python-version }}
+
+    - name: Install Python dependencies
+      run: uv sync --frozen
+      shell: bash

.github/workflows/ci.yml

@@ -0,0 +1,81 @@
+name: Main
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+    types: [opened, synchronize, reopened, ready_for_review]
+  workflow_dispatch:
+
+concurrency:
+  group: >-
+    ${{ github.workflow }}-${{ github.ref_type }}-
+    ${{ github.event.pull_request.number || github.sha }}
+  cancel-in-progress: true
+
+jobs:
+  quality:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Check out
+        uses: actions/checkout@v4
+        with:
+          # deep clone incl. tags so hatch-vcs can derive the version
+          fetch-depth: 0
+
+      - uses: actions/cache@v4
+        with:
+          path: ~/.cache/pre-commit
+          key: pre-commit-${{ hashFiles('.pre-commit-config.yaml') }}
+
+      - name: Set up the environment
+        uses: ./.github/actions/setup-python-env
+
+      - name: Run checks
+        run: make check
+
+  tests-and-type-check:
+    runs-on: ${{ matrix.os }}
+    strategy:
+      matrix:
+        # full python range on ubuntu; boundary versions cross-platform
+        # (preserves the coverage of the previous CI matrix)
+        os: [ubuntu-latest]
+        python-version: ["3.10", "3.11", "3.12", "3.13"]
+        include:
+          - os: macos-latest
+            python-version: "3.10"
+          - os: macos-latest
+            python-version: "3.13"
+          - os: windows-latest
+            python-version: "3.10"
+          - os: windows-latest
+            python-version: "3.13"
+      fail-fast: false
+    defaults:
+      run:
+        shell: bash
+    steps:
+      - name: Check out
+        uses: actions/checkout@v4
+        with:
+          # deep clone incl. tags so hatch-vcs can derive the version
+          fetch-depth: 0
+
+      - name: Set up the environment
+        uses: ./.github/actions/setup-python-env
+        with:
+          python-version: ${{ matrix.python-version }}
+
+      # no `make` on the windows runners, so invoke the tools directly
+      - name: Run tests
+        run: uv run python -m pytest --cov --cov-config=pyproject.toml --cov-report=xml
+
+      - name: Check typing
+        run: uv run ty check
+
+      - name: Upload coverage reports to Codecov
+        uses: codecov/codecov-action@v4
+        if: ${{ matrix.os == 'ubuntu-latest' && matrix.python-version == '3.11' }}
+        env:
+          CODECOV_TOKEN: ${{ secrets.CODECOV_TOKEN }}

.github/workflows/main.yml

@@ -0,0 +1,39 @@
+# Release workflow. Filename and environment name are load-bearing:
+# the PyPI trusted publisher (OIDC) configuration references
+# workflow "on-release-main.yml" and environment "pypi".
+#
+# INTERIM STATE during the repo migration: publishing still uses the
+# PYPI_TOKEN secret via twine. The release phase of the migration
+# replaces it with `uv publish --trusted-publishing always` (OIDC)
+# and adds the docs deployment job.
+
+name: release-main
+
+on:
+  push:
+    tags: ['v[0-9]*']
+  workflow_dispatch:  # Allow manually triggering the workflow
+
+jobs:
+  publish:
+    if: ${{ github.event_name == 'push' && contains(github.ref, 'refs/tags/') }}
+    runs-on: ubuntu-latest
+    environment:
+      name: pypi
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          # deep clone incl. tags so hatch-vcs can derive the version
+          fetch-depth: 0
+      - name: Set up the environment
+        uses: ./.github/actions/setup-python-env
+      - name: Build package distribution files
+        run: uv build
+      - name: Publish Package
+        env:
+          TWINE_REPOSITORY: pypi
+          TWINE_USERNAME: __token__
+          TWINE_PASSWORD: ${{ secrets.PYPI_TOKEN }}
+        run: |
+          uvx twine check dist/*
+          uvx twine upload dist/*

.github/workflows/on-release-main.yml

@@ -0,0 +1,15 @@
+name: validate-codecov-config
+
+on:
+  pull_request:
+    paths: [codecov.yaml]
+  push:
+    branches: [main]
+
+jobs:
+  validate-codecov-config:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - name: Validate codecov configuration
+        run: curl -sSL --fail-with-body --data-binary @codecov.yaml https://codecov.io/validate

.github/workflows/validate-codecov-config.yml

@@ -0,0 +1,14 @@
+# Coverage starts at the legacy baseline (~22 %), so statuses are
+# informational for now: reports and PR comments without failing CI.
+# Tighten targets as coverage grows.
+coverage:
+  range: 20..80
+  round: down
+  precision: 1
+  status:
+    project:
+      default:
+        informational: true
+    patch:
+      default:
+        informational: true