ci: cover consumer fixtures in style and strict typing gates (#414)

Fixes #393

Extend formatting, lint, and strict typing checks to the compatibility
consumers and example applications. Discover Python sources so future
consumer directories remain covered.

## Branch maintenance

Refs #426. Targets `main`.

The branch was refreshed without rewriting history to include `main` at
`a576cc279739eae5e4cfc33ffab2a7fb56de24de`. The already-merged
calibration patch is absent from this review diff; the original issue
patch is preserved.

## Current-head validation

At `857e52e8ecc9058edd2a7a820f7b00175f41219a`: uv lock freshness and
baseline, runtime, strict typing, style, and contracts passed locally
with all declared extras. Runtime result: 608 passed, 1 warning, 262
subtests passed in 9.23s.

Hosted checks: 7/7 required checks passed; 0 checks pending; 0
unsuccessful checks at 2026-10-04T14:19:40.760978+00:00. See the PR
Checks tab and #426 for subsequent results.

Author: codeforester

compatibility/consumers/atlas_click/src/atlas_click/cli.py

@@ -2,8 +2,8 @@
 
 from __future__ import annotations
 
-import click
 import base_cli
+import click
 
 
 @click.group(name="atlas-consumer", help="Inventory resources managed by Atlas.")

compatibility/consumers/atlas_click/tests/test_consumer.py

@@ -4,7 +4,6 @@
 from pathlib import Path
 
 import base_cli
-
 from atlas_click.cli import command
 
 

compatibility/consumers/beacon_typer/src/beacon_typer/cli.py

@@ -5,7 +5,6 @@
 import base_cli
 import typer
 
-
 cli = typer.Typer(help="Deploy Beacon services with typed parameters.")
 
 

compatibility/consumers/beacon_typer/tests/test_consumer.py

@@ -4,7 +4,6 @@
 from pathlib import Path
 
 import base_cli
-
 from beacon_typer.cli import command
 
 

compatibility/consumers/cinder_automation/src/cinder_automation/cli.py

@@ -2,9 +2,10 @@
 
 from __future__ import annotations
 
-import click
-import base_cli
+from typing import Any
 
+import base_cli
+import click
 
 app = base_cli.App(
     name="cinder-consumer",
@@ -27,7 +28,7 @@
     default="json",
     show_default=True,
 )
-def reconcile(ctx: base_cli.Context, target: str, output_format: str) -> None:
+def reconcile(ctx: base_cli.Context[Any, Any, Any], target: str, output_format: str) -> None:
     """Publish the result of one idempotent reconciliation step."""
 
     action = "would-reconcile" if ctx.dry_run else "reconciled"

compatibility/consumers/cinder_automation/tests/test_consumer.py

@@ -4,7 +4,6 @@
 from pathlib import Path
 
 import base_cli
-
 from cinder_automation.cli import app
 
 

docs/testing.md

@@ -55,3 +55,22 @@ The full gate writes a machine-readable result to
 `$BASE_CLI_VALIDATION_RESULT` (or `/tmp/base-cli-validation-result.json`). If
 Node.js is unavailable, the result is marked `partial`, the gate exits with
 status `2`, and it cannot be reported as an authoritative pass.
+
+Examples and compatibility consumers use the fully parameterized context type
+when strict mypy checks a callback directly:
+
+```python
+from typing import Any
+import base_cli
+
+def main(ctx: base_cli.Context[Any, Any, Any]) -> None:
+    ...
+```
+
+### Consumer source quality
+
+The style gate runs Ruff over the entire repository with its standard generated-file
+exclusions. The typing gate checks every Git-visible Python source outside `lib/`
+(checked separately), `scripts/` (validation tools), and `tests/` (test harnesses)
+with strict mypy. This includes example and compatibility consumer packages and
+new top-level source directories; untracked sources are included during development.

examples/automation_observability_app/src/automation_observability_app/cli.py

@@ -2,6 +2,8 @@
 
 from __future__ import annotations
 
+from typing import Any
+
 import base_cli
 import click
 
@@ -35,7 +37,7 @@
 )
 @base_cli.option("--api-token", hidden=True, help="Optional secret for a real adapter.")
 def run(
-    ctx: base_cli.Context,
+    ctx: base_cli.Context[Any, Any, Any],
     target: str,
     output_format: str,
     api_token: str | None,

examples/minimal_cli/src/minimal_cli/cli.py

@@ -2,6 +2,8 @@
 
 from __future__ import annotations
 
+from typing import Any
+
 import base_cli
 
 app = base_cli.App(
@@ -13,7 +15,7 @@
 
 @app.command()
 @base_cli.option("--name", required=True, help="Name to greet.")
-def greet(ctx: base_cli.Context, name: str) -> None:
+def greet(ctx: base_cli.Context[Any, Any, Any], name: str) -> None:
     """Print a deterministic greeting."""
 
     ctx.log.info("greeting requested for %s", name)

scripts/validate_consumer_typing.py

@@ -0,0 +1,48 @@
+"""Type-check every example and compatibility consumer at strict settings."""
+
+from __future__ import annotations
+
+import os
+import subprocess
+import sys
+from pathlib import Path
+
+
+def main() -> int:
+    root = Path(__file__).resolve().parents[1]
+    # Git discovery also includes new, untracked source directories. Infrastructure
+    # scripts/tests have separate runtime gates; all product/example code is typed.
+    result = subprocess.run(
+        ["git", "ls-files", "--cached", "--others", "--exclude-standard", "--", "*.py"],
+        cwd=root,
+        check=True,
+        capture_output=True,
+        text=True,
+    )
+    files = sorted(set(result.stdout.splitlines()))
+    excluded = {"lib", "scripts", "tests"}
+    sources = [name for name in files if Path(name).parts[0] not in excluded]
+    if not sources:
+        raise RuntimeError("No consumer Python sources found")
+    print("Consumer typing sources:")
+    print("\n".join(f"- {source}" for source in sources))
+    return subprocess.run(
+        [sys.executable, "-m", "mypy", "--strict", "--explicit-package-bases", *sources],
+        cwd=root,
+        env={
+            **os.environ,
+            "MYPYPATH": os.pathsep.join(
+                str(p)
+                for p in [
+                    root / "lib/python",
+                    *sorted(root.glob("examples/*/src")),
+                    *sorted(root.glob("compatibility/consumers/*/src")),
+                ]
+            ),
+        },
+        check=False,
+    ).returncode
+
+
+if __name__ == "__main__":
+    raise SystemExit(main())