chore: enable mypy with baseline

pyproject.toml

@@ -22,15 +22,28 @@ docker = [
 lint = [
   "molecule>=25.7.0",
   "pre-commit>=4.1",
-  "pre-commit-uv>=4.1.4",
-  "toml>=0.10.2"
+  "pre-commit-uv>=4.1.4"
 ]
 pkg = [
   "build>=0.9",
   "pip>=25.2",
   "pipx>=1.7.1",
   "twine>=4.0.1"
 ]
+type = [
+  "types-docker",
+  "mypy>=1.17.1",
+  "mypy-baseline>=0.7.3",
+  "pytest", # for mypy
+  "toml>=0.10.2",
+  "types-toml>=0.10.8.20240310",
+  "openstacksdk>=4.7.0",
+  "boto3>=1.40.26",
+  "google-auth>=2.40.3",
+  "python-vagrant>=1.0.0",
+  "ansible-core>=2.17.13",
+  "pycryptodome>=3.23.0"
+]
 
 [project]
 # https://peps.python.org/pep-0621/#readme
@@ -122,16 +135,36 @@ changelog = "https://github.com/ansible-community/molecule-plugins/releases"
 [tool.codespell]
 skip = "uv.lock"
 
+[tool.mypy]
+files = "."
+color_output = true
+error_summary = true
+# explicit_package_bases = true
+namespace_packages = false
+exclude = [
+  ".ansible",
+  ".cache",
+  ".tox",
+  ".venv",
+  "node_modules",
+  "build",
+  "dist",
+  "site",
+  "scenarios"
+]
+strict = true
+
 [tool.pytest.ini_options]
 addopts = "-v -rxXs --doctest-modules --durations 10 -p no:pytest_ansible"
 doctest_optionflags = "ALLOW_UNICODE ELLIPSIS"
 junit_suite_name = "molecule_test_suite"
 norecursedirs = ["dist", "doc", "build", ".tox", ".eggs", "src", "test/*/scenarios", "test/*/resources"]
 
 [tool.ruff]
-target-version = "py39"
+target-version = "py310"
 # Same as Black.
 line-length = 88
+unsafe-fixes = true
 lint.ignore = [
   "E501", # we use black
   # we deliberately ignore these:
@@ -195,12 +228,13 @@ uv_sync_flags = ["--upgrade", "--prerelease=allow"]
 uv_sync_locked = false
 
 [tool.tox.env.lint]
-dependency_groups = ["lint"]
+dependency_groups = ["lint", "dev", "type"]
 description = "Run all linters"
 runner = "uv-venv-lock-runner"
-skip_install = false
 commands_pre = []
 commands = [
+  # move inside a pre-commit hook once https://github.com/orsinium-labs/mypy-baseline/pull/30 is released
+  ["bash", "-c", "mypy --no-error-summary --hide-error-context | mypy-baseline filter --hide-stats --allow-unsynced && mypy --no-error-summary --hide-error-context | mypy-baseline sync --sort-baseline"],
   ["pre-commit", "run", "-a"],
   ["bash", "{tox_root}/tools/generate-templates.sh"],
   ["rm", "-rf", "test/roles"]

src/molecule_plugins/docker/driver.py

@@ -242,7 +242,7 @@ def sanity_checks(self):
             import docker  # noqa: PLC0415
 
             docker_client = docker.from_env()
-            docker_client.ping()
+            docker_client.ping()  # type: ignore[no-untyped-call]
         except docker.errors.DockerException:
             msg = (
                 "Unable to contact the Docker daemon. "
@@ -264,7 +264,7 @@ def reset(self):
         for c in client.containers.list(filters={"label": "owner=molecule"}):
             log.info("Stopping docker container %s ...", c.id)
             c.stop(timeout=3)
-        result = client.containers.prune(filters={"label": "owner=molecule"})
+        result = client.containers.prune(filters={"label": "owner=molecule"})  # type: ignore[no-untyped-call]
         for c in result.get("ContainersDeleted") or []:
             log.info("Deleted container %s", c)
         for n in client.networks.list(filters={"label": "owner=molecule"}):

src/molecule_plugins/ec2/driver.py

@@ -32,7 +32,7 @@
     HAS_CRYPTOGRAPHY = False
 
 try:
-    import boto3
+    import boto3  # type: ignore[import-untyped]
 
     HAS_BOTO3 = True
 except ImportError:

src/molecule_plugins/gce/playbooks/files/windows_auth.py

@@ -25,16 +25,16 @@
 # https://developers.google.com/api-client-library/python/start/get_started
 import google.auth
 
-# PyCrypto library: https://pypi.python.org/pypi/pycrypto
+# https://pypi.org/project/pycryptodome/
 from Crypto.Cipher import PKCS1_OAEP
 from Crypto.PublicKey import RSA
 from Crypto.Util.number import long_to_bytes
-from googleapiclient.discovery import build
+from googleapiclient.discovery import build  # type: ignore[import-not-found]
 
 
 def GetCompute():
     """Get a compute object for communicating with the Compute Engine API."""
-    credentials, project = google.auth.default()
+    credentials, project = google.auth.default()  # type: ignore[no-untyped-call]
     compute = build("compute", "v1", credentials=credentials)
     return compute
 

src/molecule_plugins/vagrant/modules/vagrant.py

@@ -30,7 +30,7 @@
 from collections.abc import MutableMapping
 
 import jinja2
-from ansible.module_utils.basic import AnsibleModule
+from ansible.module_utils.basic import AnsibleModule  # type: ignore[import-untyped]
 
 try:
     import vagrant

test/gce/scenarios/linux/files/windows_auth.py

@@ -21,7 +21,7 @@
 import json
 import time
 
-# PyCrypto library: https://pypi.python.org/pypi/pycrypto
+# https://pypi.org/project/pycryptodome/
 from Crypto.Cipher import PKCS1_OAEP
 from Crypto.PublicKey import RSA
 from Crypto.Util.number import long_to_bytes

test/gce/scenarios/windows/files/windows_auth.py

@@ -21,7 +21,7 @@
 import json
 import time
 
-# PyCrypto library: https://pypi.python.org/pypi/pycrypto
+# https://pypi.org/project/pycryptodome/
 from Crypto.Cipher import PKCS1_OAEP
 from Crypto.PublicKey import RSA
 from Crypto.Util.number import long_to_bytes

test/openstack/test_func.py

@@ -6,9 +6,9 @@
 import subprocess
 from pathlib import Path
 
+import openstack
 import pytest
 
-import openstack
 from conftest import change_dir_to
 from molecule import logger
 from molecule.app import get_app

test/vagrant-plugin/functional/test_func.py → test/vagrant_plugin/functional/test_func.py

@@ -38,8 +38,7 @@ def is_vagrant_supported() -> bool:
     """Return True if vagrant is installed and current platform is supported."""
     if not shutil.which("vagrant"):
         return False
-    if not (platform.machine() == "arm64" and platform.system() == "Darwin"):
-        return True
+    return bool(not (platform.machine() == "arm64" and platform.system() == "Darwin"))
 
 
 @pytest.mark.skipif(