ci: stand up a type-check task with Pyright

pyproject.toml

@@ -29,3 +29,33 @@ target-version = "py37"
 
 [tool.ruff.isort]
 known-first-party = ["taskgraph"]
+
+[tool.pyright]
+include = ["src"]
+exclude = [  # TODO fix errors in these files
+    "src/taskgraph/decision.py",
+    "src/taskgraph/docker.py",
+    "src/taskgraph/files_changed.py",
+    "src/taskgraph/generator.py",
+    "src/taskgraph/graph.py",
+    "src/taskgraph/main.py",
+    "src/taskgraph/morph.py",
+    "src/taskgraph/parameters.py",
+    "src/taskgraph/taskgraph.py",
+    "src/taskgraph/actions/cancel.py",
+    "src/taskgraph/actions/cancel_all.py",
+    "src/taskgraph/actions/rebuild_cached_tasks.py",
+    "src/taskgraph/actions/util.py",
+    "src/taskgraph/optimize/base.py",
+    "src/taskgraph/run-task/robustcheckout.py",
+    "src/taskgraph/transforms/fetch.py",
+    "src/taskgraph/transforms/task.py",
+    "src/taskgraph/transforms/job/run_task.py",
+    "src/taskgraph/util/cached_tasks.py",
+    "src/taskgraph/util/decision.py",
+    "src/taskgraph/util/python_path.py",
+    "src/taskgraph/util/schema.py",
+    "src/taskgraph/util/taskcluster.py",
+    "src/taskgraph/util/vcs.py",
+    "src/taskgraph/util/workertypes.py",
+]

requirements/dev.txt

@@ -14,17 +14,9 @@ identify==2.5.24 \
     --hash=sha256:0aac67d5b4812498056d28a9a512a483f5085cc28640b02b258a59dac34301d4 \
     --hash=sha256:986dbfb38b1140e763e413e6feb44cd731faf72d1909543178aa79b0e258265d
     # via pre-commit
-nodeenv==1.8.0 \
-    --hash=sha256:d51e0c37e64fbf47d017feac3145cdbb58836d7eee8c6f6d3b6880c5456227d2 \
-    --hash=sha256:df865724bb3c3adc86b3876fa209771517b0cfe596beff01a92700e0e8be4cec
-    # via pre-commit
 pre-commit==2.21.0 \
     --hash=sha256:31ef31af7e474a8d8995027fefdfcf509b5c913ff31f2015b4ec4beb26a6f658 \
     --hash=sha256:e2f91727039fc39a92f58a588a25b87f936de6567eed4f0e673e0507edc75bad
     # via -r requirements/dev.in
 
 # The following packages are considered to be unsafe in a requirements file:
-setuptools==67.8.0 \
-    --hash=sha256:5df61bf30bb10c6f756eb19e7c9f3b473051f48db77fddbe06ff2ca307df9a6f \
-    --hash=sha256:62642358adc77ffa87233bc4d2354c4b2682d214048f500964dbe760ccedf102
-    # via nodeenv

requirements/test.in

@@ -1,6 +1,7 @@
 -r base.in
 coverage
 mock
+pyright
 pytest
 pytest-mock
 responses

requirements/test.txt

@@ -1,4 +1,4 @@
-# SHA1:0cbb82cbf14365738df0c1100a54f7ee5e312452
+# SHA1:e6344ef3b0b270eae651e48034a25b9d9e8faa4a
 #
 # This file is autogenerated by pip-compile-multi
 # To update, run:
@@ -98,6 +98,10 @@ mock==5.0.2 \
     --hash=sha256:06f18d7d65b44428202b145a9a36e99c2ee00d1eb992df0caf881d4664377891 \
     --hash=sha256:0e0bc5ba78b8db3667ad636d964eb963dc97a59f04c6f6214c5f0e4a8f726c56
     # via -r requirements/test.in
+nodeenv==1.8.0 \
+    --hash=sha256:d51e0c37e64fbf47d017feac3145cdbb58836d7eee8c6f6d3b6880c5456227d2 \
+    --hash=sha256:df865724bb3c3adc86b3876fa209771517b0cfe596beff01a92700e0e8be4cec
+    # via pyright
 packaging==23.1 \
     --hash=sha256:994793af429502c4ea2ebf6bf664629d07c1a9fe974af92966e4b8d2df7edc61 \
     --hash=sha256:a392980d2b6cffa644431898be54b0045151319d1e7ec34f0cfed48767dd334f
@@ -121,6 +125,10 @@ pyproject-api==1.5.1 \
     --hash=sha256:435f46547a9ff22cf4208ee274fca3e2869aeb062a4834adfc99a4dd64af3cf9 \
     --hash=sha256:4698a3777c2e0f6b624f8a4599131e2a25376d90fe8d146d7ac74c67c6f97c43
     # via tox
+pyright==1.1.337 \
+    --hash=sha256:81d81f839d1750385390c4c4a7b84b062ece2f9a078f87055d4d2a5914ef2a08 \
+    --hash=sha256:8cbd4ef71797258f816a8393a758c9c91213479f472082d0e3a735ef7ab5f65a
+    # via -r requirements/test.in
 pytest==7.3.1 \
     --hash=sha256:3799fa815351fea3a5e96ac7e503a96fa51cc9942c3753cda7651b93c1cfa362 \
     --hash=sha256:434afafd78b1d78ed0addf160ad2b77a30d35d4bdf8af234fe621919d9ed15e3
@@ -154,3 +162,9 @@ virtualenv==20.23.0 \
     --hash=sha256:6abec7670e5802a528357fdc75b26b9f57d5d92f29c5462ba0fbe45feacc685e \
     --hash=sha256:a85caa554ced0c0afbd0d638e7e2d7b5f92d23478d05d17a76daeac8f279f924
     # via tox
+
+# The following packages are considered to be unsafe in a requirements file:
+setuptools==68.0.0 \
+    --hash=sha256:11e52c67415a381d10d6b462ced9cfb97066179f0e871399e006c4ab101fc85f \
+    --hash=sha256:baf1fdb41c6da4cd2eae722e135500da913332ab3f2f5c7d33af9b492acb5235
+    # via nodeenv

taskcluster/ci/tests/kind.yml

@@ -52,3 +52,12 @@ tasks:
                 pip install --user --no-deps . &&
                 pyenv local 3.11 3.10 3.9 3.8 3.7 &&
                 tox --parallel
+    type-check:
+        description: "Run type checking against src with Pyright"
+        treeherder:
+            symbol: type-check
+        run:
+            command: >-
+                pip install --user -r requirements/test.txt --require-hashes &&
+                pip install --user --no-deps . &&
+                pyright