mypy.yml

name: mypy

on:
  pull_request:
    paths:
      - '**/*.py'        # Watch for changes in any Python files
      - 'pyproject.toml' # Watch for changes in the pyproject.toml file
  push:
    paths:
      - '**/*.py'        # Watch for changes in any Python files
      - 'pyproject.toml' # Watch for changes in the pyproject.toml file
  workflow_dispatch:

concurrency:
  group: ci-${{github.workflow}}-${{ github.ref }}
  cancel-in-progress: true

permissions:
  contents: read

jobs:
  mypy:
    name: mypy
    runs-on: ubuntu-latest

    steps:
      - name: Harden the runner (Audit all outbound calls)
        uses: step-security/harden-runner@9af89fc71515a100421586dfdb3dc9c984fbf411 # v2.19.4
        with:
          egress-policy: audit

      - name: Checkout
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2

      - name: Install dependencies
        id: install_deps
        continue-on-error: true
        run: |
          WARNINGS=0

          export MYPY_VERSION=$(grep -oP 'mypy==\K[0-9]+(\.[0-9]+)*' pyproject.toml || echo '')
          export TYPES_REQUESTS_VERSION=$(grep -oP 'types-requests==\K[0-9]+(\.[0-9]+)*' pyproject.toml || echo '')

          if [ -z "$MYPY_VERSION" ]; then
            echo "::warning::Could not detect mypy version in pyproject.toml; falling back to latest."
            MYPY_INSTALL="mypy"
            WARNINGS=1
          else
            echo "Will install mypy version $MYPY_VERSION."
            MYPY_INSTALL="mypy==$MYPY_VERSION"
          fi

          if [ -z "$TYPES_REQUESTS_VERSION" ]; then
            echo "::warning::Could not detect types-requests version in pyproject.toml; falling back to latest."
            TYPES_REQUESTS_INSTALL="types-requests"
            WARNINGS=1
          else
            echo "Will install types-requests version $TYPES_REQUESTS_VERSION."
            TYPES_REQUESTS_INSTALL="types-requests==$TYPES_REQUESTS_VERSION"
          fi

          python -m pip install "$MYPY_INSTALL" "$TYPES_REQUESTS_INSTALL"

          echo "warnings=$WARNINGS" >> $GITHUB_OUTPUT
          if [ "$WARNINGS" -eq 1 ]; then
            exit 1
          fi

      - name: Lint the code with mypy
        uses: amilcarlucas/mypy-github-action@fc3d4ef2fe501ec797415a3ed1290e0ae619b5f6 # v2.0.2
        with:
          checkName: 'mypy'   # NOTE: this needs to be the same as the job name
          mypyFlags: ''
          mypyFiles: ''
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}