Add mypy type checking to CI (#226)

.github/workflows/main.yml

@@ -50,6 +50,9 @@ jobs:
 #      - name: Validate code format
 #        run: make check
 
+      - name: Check types
+        run: make mypy
+
       - name: Run tests
         run: make test
         env:

Makefile

@@ -131,6 +131,10 @@ webtest:
 	@echo "-> Run web tests"
 	${ACTIVATE} ${PYTHON_EXE} -m pytest -vvs -m "webtest"
 
+mypy:
+	@echo "-> Run mypy type checking"
+	@${ACTIVATE} mypy
+
 bump:
 	@echo "-> Bump the version"
 	bin/bumpver update --no-fetch --patch
@@ -148,4 +152,4 @@ docker-images:
 	@mkdir -p dist/
 	@docker save postgres vulnerablecode_vulnerablecode nginx | gzip > dist/vulnerablecode-images-`git describe --tags`.tar.gz
 
-.PHONY: virtualenv conf dev envfile install check valid isort clean migrate postgres sqlite run test bump docs docker-images
+.PHONY: virtualenv conf dev envfile install check valid isort clean migrate postgres sqlite run test mypy bump docs docker-images

mypy.ini

@@ -0,0 +1,70 @@
+[mypy]
+ignore_missing_imports = True
+follow_imports = silent
+explicit_package_bases = True
+namespace_packages = True
+
+check_untyped_defs = True
+
+warn_unused_configs = True
+warn_redundant_casts = True
+warn_unused_ignores = True
+
+strict_equality = True
+warn_return_any = True
+
+files =
+    # fetch and parse vulnerability data from upstream sources
+    vulnerabilities/importers/debian_oval.py,
+    vulnerabilities/importers/epss.py,
+    vulnerabilities/importers/project_kb_msr2019.py,
+    vulnerabilities/importers/redhat.py,
+    vulnerabilities/importers/suse_scores.py,
+    vulnerabilities/importers/ubuntu_usn.py,
+    vulnerabilities/importers/xen.py,
+
+    # shared logic that transforms advisory data after import
+    vulnerabilities/pipes/apache_kafka.py,
+    vulnerabilities/pipes/export.py,
+    vulnerabilities/pipes/extractcode_utils.py,
+    vulnerabilities/pipes/federatedcode.py,
+
+    # CLI entry points for imports, improvers, and scheduling
+    vulnerabilities/management/commands/create_api_user.py,
+    vulnerabilities/management/commands/import.py,
+    vulnerabilities/management/commands/improve.py,
+    vulnerabilities/management/commands/run_scheduler.py,
+
+    # how vulnerabilities are scored, related, and scheduled
+    vulnerabilities/risk.py,
+    vulnerabilities/references.py,
+    vulnerabilities/schedules.py,
+    vulnerabilities/pipelines/v2_importers/collect_fix_commits.py,
+
+    # API pagination and rate limiting
+    vulnerabilities/pagination.py,
+    vulnerabilities/throttling.py,
+
+    # supporting utilities
+    vulnerabilities/rpm_utils.py,
+    vulnerabilities/weight_config.py,
+
+    # fully clean directories: request middleware and template tags
+    vulnerabilities/middleware,
+    vulnerabilities/templatetags,
+
+    # Django project configuration
+    vulnerablecode/__init__.py,
+    vulnerablecode/context_processors.py,
+    vulnerablecode/urls.py,
+    vulnerablecode/wsgi.py,
+
+    # shared library for deterministic advisory IDs
+    aboutcode,
+
+    # bundled CLI tool for cross-checking vulnerability sources
+    vulntotal/__init__.py,
+    vulntotal/vulntotal_utils.py,
+    vulntotal/ecosystem,
+    vulntotal/datasources/safetydb.py,
+    vulntotal/tests,

requirements-dev.txt

@@ -80,6 +80,7 @@ MarkupSafe==3.0.3
 matplotlib-inline==0.2.1
 mdurl==0.1.2
 more-itertools==10.8.0
+mypy==2.1.0
 mypy_extensions==1.1.0
 nh3==0.3.4
 packageurl-python==0.17.6

setup.cfg

@@ -127,6 +127,8 @@ dev =
     # Tests
     pytest==7.1.1
     pytest-django==4.5.2
+    # Type checking
+    mypy==2.1.0
 
 	# misc
     ipython==8.10.0