TLAB-2569 Add mypy static type checking to CI/CD

Added mypy type checking configuration and CI integration:
- Added mypy ^1.11 to dev dependencies
- Configured mypy with lenient settings (python 3.10, namespace packages)
- Added type annotations to fix critical errors in schema_loader, confidence, and backend
- Added CI step to run mypy before tests
- Used type: ignore comments for pySigma framework compatibility issues

Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>

Author: mikep-sumo

.github/workflows/test.yml

@@ -23,6 +23,8 @@ jobs:
           python-version: ${{ matrix.python-version }}
       - name: Install dependencies
         run: poetry install
+      - name: Type check
+        run: poetry run mypy sigma/
       - name: Run tests
         run: poetry run pytest --cov=sigma --cov-report term --cov-report xml:cov.xml -vv
       - name: Store coverage for badge

poetry.lock

@@ -25,6 +25,16 @@ pytest = "^8.0"
 pytest-cov = "^4.0"
 coverage = "^7.0"
 streamlit = "^1.32.0"
+mypy = "^1.11"
+
+[tool.mypy]
+python_version = "3.10"
+warn_return_any = true
+warn_unused_configs = true
+disallow_untyped_defs = false
+ignore_missing_imports = true
+namespace_packages = true
+explicit_package_bases = true
 
 [build-system]
 requires = ["poetry-core>=1.8.1"]

pyproject.toml

@@ -26,14 +26,14 @@ class SumoLogicCSEBackend(TextQueryBackend):
     """
 
     name: ClassVar[str] = "Sumo Logic Cloud SIEM Backend"
-    formats: Dict[str, str] = {
+    formats: Dict[str, str] = {  # type: ignore[misc]
         "default": "Sumo Logic CSIEM Rule JSON format",
         "cse_rule": "CSIEM Rule JSON with full metadata",
     }
-    requires_pipeline: bool = True
+    requires_pipeline: bool = True  # type: ignore[misc]
 
     # Cloud SIEM uses uppercase boolean operators
-    precedence: ClassVar[Tuple[ConditionItem, ConditionItem, ConditionItem]] = (
+    precedence: ClassVar[Tuple[ConditionItem, ConditionItem, ConditionItem]] = (  # type: ignore[assignment]
         ConditionNOT,
         ConditionAND,
         ConditionOR,
@@ -64,7 +64,7 @@ class SumoLogicCSEBackend(TextQueryBackend):
     wildcard_single: ClassVar[str] = "*"
     add_escaped: ClassVar[str] = ""  # Don't add extra escaping
     filter_chars: ClassVar[str] = ""
-    bool_values: ClassVar[Dict[bool, str]] = {
+    bool_values: ClassVar[Dict[bool, str]] = {  # type: ignore[assignment]
         True: "true",
         False: "false",
     }
@@ -79,7 +79,7 @@ class SumoLogicCSEBackend(TextQueryBackend):
     # Must escape / (delimiter), and common regex metacharacters when used as literals
     re_expression: ClassVar[str] = "{field} matches /{regex}/"
     re_escape_char: ClassVar[str] = "\\"
-    re_escape: ClassVar[Tuple[str, ...]] = ("/", ".")
+    re_escape: ClassVar[Tuple[str, ...]] = ("/", ".")  # type: ignore[assignment]
     re_escape_escape_char: bool = True
     re_flag_prefix: bool = False  # CSE doesn't use flag prefixes in regex
     re_flags: Dict[SigmaRegularExpressionFlag, str] = {
@@ -88,7 +88,7 @@ class SumoLogicCSEBackend(TextQueryBackend):
 
     # Numeric comparison operators
     compare_op_expression: ClassVar[str] = "{field} {operator} {value}"
-    compare_operators: ClassVar[Dict[SigmaCompareExpression.CompareOperators, str]] = {
+    compare_operators: ClassVar[Dict[SigmaCompareExpression.CompareOperators, str]] = {  # type: ignore[valid-type]
         SigmaCompareExpression.CompareOperators.LT: "<",
         SigmaCompareExpression.CompareOperators.LTE: "<=",
         SigmaCompareExpression.CompareOperators.GT: ">",
@@ -139,7 +139,7 @@ def __init__(
         **kwargs,
     ):
         super().__init__(processing_pipeline, collect_errors, **kwargs)
-        self.rule_metadata = []
+        self.rule_metadata: List[Dict[str, Any]] = []
         self.min_confidence = min_confidence
         self.schema_path = schema_path
         self.include_confidence_metadata = include_confidence_metadata
@@ -224,7 +224,7 @@ def convert_condition_field_eq_val_num(self, cond, state: ConversionState) -> st
 
         if not isinstance(cond, ConditionFieldEqualsValueExpression):
             # Fallback to parent implementation
-            return super().convert_condition_field_eq_val_num(cond, state)
+            return super().convert_condition_field_eq_val_num(cond, state)  # type: ignore[return-value]
 
         field_name = cond.field
         numeric_value = cond.value.to_plain()
@@ -253,7 +253,7 @@ def convert_condition_as_in_expression(self, cond, state: ConversionState) -> st
         from typing import Union, cast
 
         if not all(isinstance(arg, ConditionFieldEqualsValueExpression) for arg in cond.args):
-            return super().convert_condition_as_in_expression(cond, state)
+            return super().convert_condition_as_in_expression(cond, state)  # type: ignore[return-value]
 
         field_name = cast(ConditionFieldEqualsValueExpression, cond.args[0]).field
 
@@ -1165,7 +1165,7 @@ def _get_entity_selectors(self, logsource: Any) -> List[Dict[str, str]]:
         Returns:
             List of entity selector dictionaries (empty if cannot determine confidently)
         """
-        entity_selectors = []
+        entity_selectors: List[Dict[str, Any]] = []
 
         if not logsource:
             return entity_selectors

sigma/backends/sumologic/sumologic.py

@@ -232,7 +232,7 @@ def compute_data_preservation(
         Data preservation score 0.0-1.0
     """
     score = 1.0
-    warnings = []
+    warnings: list[str] = []
 
     # Check for multi-value collapse
     if sigma_field in MULTI_VALUE_FIELDS:

sigma/pipelines/sumologic/confidence.py

@@ -64,7 +64,7 @@ def __init__(self, fields: Dict[str, FieldSchema]):
         self.fields = fields
 
         # Build reverse indexes for fast lookup
-        self._entity_type_index = {}
+        self._entity_type_index: Dict[str, list] = {}
         self._enrichment_fields = set()
         self._general_purpose_fields = set()
 
@@ -106,7 +106,8 @@ def get_related_fields(self, field_name: str) -> Dict[str, str]:
 
     def get_fields_by_entity_type(self, entity_type: str) -> List[str]:
         """Get all fields associated with an entity type (ip, hostname, etc.)."""
-        return self._entity_type_index.get(entity_type, [])
+        result = self._entity_type_index.get(entity_type, [])
+        return list(result)
 
 
 class SchemaLoader:

sigma/pipelines/sumologic/schema_loader.py

@@ -10,7 +10,7 @@
     ExcludeFieldCondition,
 )
 from sigma.processing.pipeline import ProcessingItem, ProcessingPipeline
-from typing import Dict, Any, Optional
+from typing import Dict, Any, Optional, cast
 from .schema_loader import SchemaIndex, SchemaLoader
 from .confidence import compute_confidence, ConfidenceScore
 
@@ -37,7 +37,7 @@ def __init__(
             logsource_category: Sigma logsource category (e.g., "process_creation")
             schema: CSE schema index for validation (None if schema not loaded)
         """
-        super().__init__(mapping)
+        super().__init__(cast(Dict[str | None, str | list[str]], mapping))
         self.logsource_category = logsource_category
         self.schema = schema