Check that PRs dont introduce more mypy --strict errors (#3416)

* correct yaml indentation

* compare pr errors

* fix bug, better diag

---------

Co-authored-by: Disconnect3d <dominik.b.czarnota@gmail.com>

.github/workflows/docker.yml

@@ -2,10 +2,10 @@ name: Test Docker
 on:
   pull_request:
     paths:
-      - '**'
-      - '!mkdocs.yml'
-      - '!docs/**'
-      - '!*.md'
+      - "**"
+      - "!mkdocs.yml"
+      - "!docs/**"
+      - "!*.md"
 
 jobs:
   docker_x86-64:

.github/workflows/lint.yml

@@ -2,10 +2,10 @@ name: Lint
 on:
   pull_request:
     paths:
-      - '**'
-      - '!mkdocs.yml'
-      - '!docs/**'
-      - '!*.md'
+      - "**"
+      - "!mkdocs.yml"
+      - "!docs/**"
+      - "!*.md"
 
 jobs:
   lint:
@@ -39,6 +39,7 @@ jobs:
           git diff-index --quiet HEAD -- pwndbg tests
           ./lint.sh
 
+      # The PR must not contain any mypy errors
       - name: Run mypy
         uses: tsuyoshicho/action-mypy@v4
         with:
@@ -50,8 +51,53 @@ jobs:
           level: error
           # Change the current directory to run mypy command.
           # mypy command reads setup.cfg or other settings file in this path.
-        execute_command: uv run --group dev --group lint --group tests --extra gdb --extra lldb mypy
+          execute_command: uv run --group dev --group lint --group tests --all-extras mypy
           install_types: false
           target: pwndbg pwndbginit tests/host
           filter_mode: nofilter
           fail_on_error: true
+
+      # The PR must not contain more mypy --strict errors than the dev branch does
+      - name: Count strict mypy errors in PR branch
+        id: mypy_pr
+        run: |
+          set +e
+          uv run --group dev --group lint --group tests --all-extras mypy --strict pwndbg pwndbginit tests/host > mypy_pr.txt 2>&1
+          echo "exit_code=$?" >> $GITHUB_OUTPUT
+          ERRORS=$(grep -c "error:" mypy_pr.txt || true)
+          echo "count=$ERRORS" >> $GITHUB_OUTPUT
+          echo "PR mypy (--strict) errors: $ERRORS"
+        continue-on-error: true
+
+      - name: Check out dev branch
+        run: |
+          git fetch origin dev
+          git checkout origin/dev
+
+      - name: Count strict mypy errors in dev branch
+        id: mypy_dev
+        run: |
+          set +e
+          uv run --group dev --group lint --group tests --all-extras mypy --strict pwndbg pwndbginit tests/host > mypy_dev.txt 2>&1
+          echo "exit_code=$?" >> $GITHUB_OUTPUT
+          ERRORS=$(grep -c "error:" mypy_dev.txt || true)
+          echo "count=$ERRORS" >> $GITHUB_OUTPUT
+          echo "Dev mypy (--strict) errors: $ERRORS"
+        continue-on-error: true
+
+      - name: Compare mypy error counts
+        run: |
+          PR_ERRORS=${{ steps.mypy_pr.outputs.count }}
+          DEV_ERRORS=${{ steps.mypy_dev.outputs.count }}
+
+          echo "PR errors: $PR_ERRORS"
+          echo "Dev errors: $DEV_ERRORS"
+
+          if [ "$PR_ERRORS" -gt "$DEV_ERRORS" ]; then
+            echo "This PR introduces more \`mypy --strict\` errors than are present on the dev branch."
+            echo "You may run \`uv run mypy --strict file/you/modified\` to diagnose where the issue lies."
+            echo "Ideally, a python type checker (mypy/pyright/ty/pyrefly etc..) should be running in your editor."
+            exit 1
+          else
+            echo "This PR does not introduce any more \`mypy --strict\` errors than there are on the dev branch."
+          fi

.github/workflows/lock.yml

@@ -4,16 +4,16 @@ on:
     branches:
       - dev
     paths:
-      - '**'
-      - '!mkdocs.yml'
-      - '!docs/**'
-      - '!*.md'
+      - "**"
+      - "!mkdocs.yml"
+      - "!docs/**"
+      - "!*.md"
   pull_request:
     paths:
-      - '**'
-      - '!mkdocs.yml'
-      - '!docs/**'
-      - '!*.md'
+      - "**"
+      - "!mkdocs.yml"
+      - "!docs/**"
+      - "!*.md"
 
 jobs:
   check_release_build-gdb:
@@ -39,8 +39,8 @@ jobs:
         uses: cachix/cachix-action@ad2ddac53f961de1989924296a1f236fcfbaa4fc # v15
         with:
           name: pwndbg
-        authToken: '${{ secrets.CACHIX_AUTH_TOKEN }}'
-        signingKey: '${{ secrets.CACHIX_SIGNING_KEY }}'
+          authToken: "${{ secrets.CACHIX_AUTH_TOKEN }}"
+          signingKey: "${{ secrets.CACHIX_SIGNING_KEY }}"
 
       - name: build pwndbg
         run: nix build '.#pwndbg' --accept-flake-config -o result
@@ -74,8 +74,8 @@ jobs:
         uses: cachix/cachix-action@ad2ddac53f961de1989924296a1f236fcfbaa4fc # v15
         with:
           name: pwndbg
-        authToken: '${{ secrets.CACHIX_AUTH_TOKEN }}'
-        signingKey: '${{ secrets.CACHIX_SIGNING_KEY }}'
+          authToken: "${{ secrets.CACHIX_AUTH_TOKEN }}"
+          signingKey: "${{ secrets.CACHIX_SIGNING_KEY }}"
 
       - name: build pwndbg
         run: nix build '.#pwndbg-lldb' --accept-flake-config -o result

.github/workflows/tests.yml

@@ -4,16 +4,16 @@ on:
     branches:
       - dev
     paths:
-      - '**'
-      - '!mkdocs.yml'
-      - '!docs/**'
-      - '!*.md'
+      - "**"
+      - "!mkdocs.yml"
+      - "!docs/**"
+      - "!*.md"
   pull_request:
     paths:
-      - '**'
-      - '!mkdocs.yml'
-      - '!docs/**'
-      - '!*.md'
+      - "**"
+      - "!mkdocs.yml"
+      - "!docs/**"
+      - "!*.md"
 jobs:
   tests-using-nix:
     strategy: