ci: type-check every supported platform, and fix what that surfaced

[itzzdev09]

Follow-up to the review discussion on #1297, where a reviewer pointed out that platform-specific branches were not being type-checked. They were right about the gap, though not about the cause — so here is the real fix.

The gap

I assumed CI ran mypy on Linux. It doesn't run mypy at all — build-release.yml only builds release artifacts on tags. Type checking happens through make type-check and the pre-commit hook, both of which use whichever platform the contributor is on.

Two consequences:

1. Nothing gates a merge on type checking.
2. sys.platform == "win32" branches are never checked by anyone, because almost no one develops on Windows — while a contributor who does sees six errors nobody else has.

Measured on main, same interpreter, same source:

--platform	errors
linux	0
darwin	0
win32	6

The six: fcntl.flock / LOCK_EX / LOCK_UN (×4) in config/codex.py, and os.getuid / os.getgid (×2) in runtime/session_manager.py.

The change

A Type check workflow running mypy under --platform linux, darwin, and win32 on pull requests and pushes to main.

All three jobs run on ubuntu-latest. --platform is what selects which branches mypy resolves, so three runner OSes would cost three times as much and each would still check whatever platform it happened to be. Actions are SHA-pinned with version comments and persist-credentials: false, matching build-release.yml.

Making --platform win32 pass, which needed the two platform-specific spots to resolve under every target:

• codex.py called fcntl.flock directly. It is now resolved once behind a sys.platform != "win32" guard with a no-op fallback. Runtime behaviour is unchanged: the ImportError branch it previously relied on could only ever fire on Windows, which the guard now expresses explicitly rather than discovering at import time.
• session_manager.py called os.getuid / os.getgid. The existing Linux check is now wrapped in a platform guard so the attributes resolve, keeping the indirection through a local variable that the original comment explains.

# type: ignore[attr-defined] was not available here — warn_unused_ignores = true would then flag it as unused on the platforms where the attribute does exist. The guard form works because mypy exempts platform-guarded blocks from warn_unreachable, which I verified before writing it.

make type-check now runs the same three platforms as CI, so local and CI agree.

Result

--platform	before	after
linux	0	0
darwin	0	0
win32	6	0

ruff and ruff format clean on both touched files. tests/test_codex_auth.py, test_codex_streaming.py, test_local_sources.py, and test_runner_teardown.py all pass.

Bearing on #1297

#1297 sets platform = "linux" in [tool.mypy]. That was a workaround for exactly these six errors, and the reviewer was right to push back on it. This PR removes the need for it, so I've dropped that line from #1297 — the two no longer overlap and can merge in either order.

Scope

Deliberately narrow: type checking only. Adding test and lint jobs is #1260, which is a larger conversation about what should gate a merge, and I'd rather not fold it into this.

🤖 Generated with Claude Code

[greptile-apps]

Confidence Score: 4/5

The implementation appears safe to merge, with the non-blocking caveat that CI still does not enforce pyright as required by the repository’s full local type-check contract.

Findings

1.  Pyright Is Not Gated ▶

Fix with agent prompt

### Issue 1
.github/workflows/typecheck.yml:42-43
This workflow runs only mypy, but the repository defines `make type-check` as running both mypy and pyright, and `make check-all` requires that full target. No other pull-request workflow or pre-commit hook runs pyright, so a pyright-only error can pass CI even though the documented local check fails. Please add a pyright step or run the full type-check target after the platform-specific mypy jobs.

---

For each issue above, determine whether it is valid and should be fixed. If so, fix it directly.

Summary

• Runs three mypy platform targets on an Ubuntu runner.
• Resolves POSIX file-lock operations behind an explicit platform boundary.
• Guards Linux host UID/GID collection from Windows type resolution.
• The CI workflow does not yet enforce the pyright portion of the repository’s local type-check contract.

_{Reviews (1) · Last reviewed commit: "ci: type-check every supported platform,..."}

[greptile-apps]

Pyright Is Not Gated

This workflow runs only mypy, but the repository defines make type-check as running both mypy and pyright, and make check-all requires that full target. No other pull-request workflow or pre-commit hook runs pyright, so a pyright-only error can pass CI even though the documented local check fails. Please add a pyright step or run the full type-check target after the platform-specific mypy jobs.

Prompt To Fix With AI

This is a comment left during a code review.
Path: .github/workflows/typecheck.yml
Line: 42-43

Comment:
**Pyright Is Not Gated**

This workflow runs only mypy, but the repository defines `make type-check` as running both mypy and pyright, and `make check-all` requires that full target. No other pull-request workflow or pre-commit hook runs pyright, so a pyright-only error can pass CI even though the documented local check fails. Please add a pyright step or run the full type-check target after the platform-specific mypy jobs.

---

For each issue above, determine whether it is valid and should be fixed. If so, fix it directly.