bernstein/mypy.gate.ini at main · victorwon2001/bernstein · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
# Gated mypy zone - the mypy counterpart of pyrightconfig.strict.json.
#
# The repo-wide `uv run mypy src` run (settings in pyproject.toml
# [tool.mypy]) is advisory: it carries a large pre-existing backlog because
# mypy never parsed the tree until the PEP 695 abort was fixed. This config
# is the subset that must stay clean. The `mypy strict (lineage substrate)`
# CI job runs it and fails the PR on any new error inside the zone.
#
# `follow_imports = silent` scopes the check to the packages listed in
# `files`: imports are still resolved for type information, but errors in
# modules outside the zone are not reported. That is the mypy equivalent of
# pyright's include/exclude split.
#
# Widen the zone by deleting entries from `exclude` as each module reaches
# strict cleanliness, then by adding packages to `files`.

[mypy]
python_version = 3.12
strict = True
follow_imports = silent
warn_unused_configs = True

# Both checkers guard this zone and they disagree about redundancy: pyright
# strict needs the casts and `type: ignore`s that are already in the code,
# mypy reports the same ones as unnecessary. Deleting them to satisfy mypy
# would break the pyright strict job, so the two codes are off here rather
# than churning the annotations.
disable_error_code = redundant-cast, unused-ignore

files =
    src/bernstein/core/evidence,
    src/bernstein/core/identity,
    src/bernstein/core/lineage,
    src/bernstein/core/persistence,
    # `bernstein pr` composes the PR description and anchors it to the diff
    # it describes. A wrong argument type here does not produce a wrong
    # receipt, it aborts the command: passing `_diff_bytes`' whole
    # `(bytes, error)` tuple to a sha256 helper raised TypeError and failed
    # a publish whose branch had already passed its verification gate. Both
    # type checkers reported that call for as long as it existed, and both
    # repo-wide runs are advisory, so the report went into a log and the
    # command kept dying. The module is strict-clean; gating it makes the
    # next one of these fail the pull request instead of the publish.
    src/bernstein/cli/commands/pr_cmd.py

# Not yet strict-clean. Remove entries as they are cleaned up.
exclude = (?x)(
    ^src/bernstein/core/identity/delegation\.py$
    | ^src/bernstein/core/identity/grants\.py$
    | ^src/bernstein/core/identity/spiffe/workload_api\.py$
    | ^src/bernstein/core/lineage/provenance\.py$
    | ^src/bernstein/core/lineage/tracker_audit\.py$
    | ^src/bernstein/core/persistence/file_health\.py$
    | ^src/bernstein/core/persistence/runtime_state\.py$
    | ^src/bernstein/core/persistence/store\.py$
    | ^src/bernstein/core/persistence/store_redis\.py$
    | ^src/bernstein/core/persistence/workspace\.py$
    )

# Legacy `bernstein.core.*` / `bernstein.cli.*` import paths are served at
# runtime by the `sys.meta_path` finders in src/bernstein/core/__init__.py
# and src/bernstein/cli/__init__.py, not by files on disk.
[mypy-bernstein.*]
ignore_missing_imports = True