From aa331d28798602bfb291dbe04762fecb42fa2a4c Mon Sep 17 00:00:00 2001
From: Vecko <36369090+VeckoTheGecko@users.noreply.github.com>
Date: Tue, 2 Jun 2026 16:40:46 +0200
Subject: [PATCH 1/2] CI: Enable mypy

---
 .github/workflows/ci.yml | 50 +++++++++++++++++++---------------------
 pixi.toml                | 11 ++++++++-
 pyproject.toml           | 30 ++++++++++++++++++++++++
 3 files changed, 64 insertions(+), 27 deletions(-)

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 2b82050f0..32e3ef4a4 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -93,29 +93,27 @@ jobs:
       - name: Run zizmor
         uses: zizmorcore/zizmor-action@71321a20a9ded102f6e9ce5718a2fcec2c4f70d8 # v0.5.2
 
-
-#   typechecking:
-#     name: "TypeChecking: pixi run typing"
-#     runs-on: ubuntu-latest
-#     if: false
-#     needs: cache-pixi-lock
-#     steps:
-#       - uses: actions/checkout@v4
-#         with:
-#           fetch-depth: 0
-#       - uses: Parcels-code/pixi-lock/restore@38495788b79a5ff26009aecc15daa9a8310b8832 # v0.1.0
-#         with:
-#           cache-key: ${{ needs.cache-pixi-lock.outputs.cache-key }}
-#       - uses: prefix-dev/setup-pixi@v0.9.4
-#         with:
-#           cache: true
-#           pixi-version: ${{ needs.cache-pixi-lock.outputs.pixi-version }}
-#           cache-write: ${{ github.event_name == 'push' && github.ref_name == 'main' }}
-#       - name: Typechecking
-#         run: pixi run typing --non-interactive --html-report mypy-report
-#       - name: Upload test results
-#         if: ${{ always() }} # Upload even on mypy error
-#         uses: actions/upload-artifact@v4
-#         with:
-#           name: Mypy report
-#           path: mypy-report
+  typechecking:
+    name: "TypeChecking: pixi run typing"
+    runs-on: ubuntu-latest
+    needs: cache-pixi-lock
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+      - uses: Parcels-code/pixi-lock/restore@38495788b79a5ff26009aecc15daa9a8310b8832 # v0.1.0
+        with:
+          cache-key: ${{ needs.cache-pixi-lock.outputs.cache-key }}
+      - uses: prefix-dev/setup-pixi@v0.9.4
+        with:
+          cache: true
+          pixi-version: ${{ needs.cache-pixi-lock.outputs.pixi-version }}
+          cache-write: ${{ github.event_name == 'push' && github.ref_name == 'main' }}
+      - name: Typechecking
+        run: pixi run typing --non-interactive --html-report mypy-report
+      - name: Upload test results
+        if: ${{ always() }} # Upload even on mypy error
+        uses: actions/upload-artifact@v4
+        with:
+          name: Mypy report
+          path: mypy-report
diff --git a/pixi.toml b/pixi.toml
index ba0249687..828c2da37 100644
--- a/pixi.toml
+++ b/pixi.toml
@@ -93,12 +93,21 @@ lint = "pre-commit run --all-files"
 [feature.typing.dependencies]
 mypy = "*"
 lxml = "*"
+pandas-stubs="*"
+types-PyYAML="*"
+scipy-stubs="*"
+types-openpyxl = "*"
+types-psutil = "*"
+types-python-dateutil = "*"
+
+[feature.typing.pypi-dependencies]
+types-xlrd = "*"
 
 [feature.typing.tasks]
 typing = "mypy src/virtualship --install-types"
 
 [environments]
-default = { features = ["test", "notebooks", "typing", "pre-commit", "analysis"] }
+default = { features = ["test", "notebooks", "typing", "pre-commit", "analysis"] }
 test-latest = { features = ["test"], solve-group = "test" }
 test-py310 = { features = ["test", "py310"] }
 test-py311 = { features = ["test", "py311"] }
diff --git a/pyproject.toml b/pyproject.toml
index 7f9a2108a..2595779a6 100644
--- a/pyproject.toml
+++ b/pyproject.toml
@@ -117,3 +117,33 @@ ignore = [
     # TODO: Remove later
     "D100", "D103"
 ]
+
+
+[tool.mypy]
+files = ['src']
+disable_error_code = "import-untyped"
+check_untyped_defs = true
+show_error_context = true
+warn_redundant_casts = true
+warn_unused_configs = true
+warn_unused_ignores = true
+
+exclude = [
+  # Temporarily exclude files. As we improve typechecking across the codebase, remove these
+  "src/virtualship/cli/_plan.py",
+  "src/virtualship/cli/_run.py",
+  "src/virtualship/cli/commands.py",
+  "src/virtualship/cli/validator_utils.py",
+  "src/virtualship/expedition/simulate_schedule.py",
+  "src/virtualship/instruments/adcp.py",
+  "src/virtualship/instruments/argo_float.py",
+  "src/virtualship/instruments/base.py",
+  "src/virtualship/instruments/ctd.py",
+  "src/virtualship/instruments/drifter.py",
+  "src/virtualship/instruments/ship_underwater_st.py",
+  "src/virtualship/instruments/xbt.py",
+  "src/virtualship/make_realistic/problems/simulator.py",
+  "src/virtualship/models/checkpoint.py",
+  "src/virtualship/models/expedition.py",
+  "src/virtualship/utils.py",
+]

From 84e072510f606f4dfb6f4792ab4f34372ae26cc3 Mon Sep 17 00:00:00 2001
From: Vecko <36369090+VeckoTheGecko@users.noreply.github.com>
Date: Tue, 2 Jun 2026 17:10:49 +0200
Subject: [PATCH 2/2] Run Zizmor

 zizmor .github --gh-token $(gh auth token) --fix=unsafe-only
---
 .github/workflows/cd.yml | 2 +-
 .github/workflows/ci.yml | 7 ++++---
 2 files changed, 5 insertions(+), 4 deletions(-)

diff --git a/.github/workflows/cd.yml b/.github/workflows/cd.yml
index 0b5dd555b..d5ff1dd64 100644
--- a/.github/workflows/cd.yml
+++ b/.github/workflows/cd.yml
@@ -34,7 +34,7 @@ jobs:
           fetch-depth: 0
           persist-credentials: false
 
-      - uses: hynek/build-and-inspect-python-package@fe0a0fb1925ca263d076ca4f2c13e93a6e92a33e # v2
+      - uses: hynek/build-and-inspect-python-package@fe0a0fb1925ca263d076ca4f2c13e93a6e92a33e # v2.17.0
 
   publish:
     needs: [dist]
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 32e3ef4a4..1f8f1402d 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -98,13 +98,14 @@ jobs:
     runs-on: ubuntu-latest
     needs: cache-pixi-lock
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
         with:
           fetch-depth: 0
+          persist-credentials: false
       - uses: Parcels-code/pixi-lock/restore@38495788b79a5ff26009aecc15daa9a8310b8832 # v0.1.0
         with:
           cache-key: ${{ needs.cache-pixi-lock.outputs.cache-key }}
-      - uses: prefix-dev/setup-pixi@v0.9.4
+      - uses: prefix-dev/setup-pixi@a0af7a228712d6121d37aba47adf55c1332c9c2e # v0.9.4
         with:
           cache: true
           pixi-version: ${{ needs.cache-pixi-lock.outputs.pixi-version }}
@@ -113,7 +114,7 @@ jobs:
         run: pixi run typing --non-interactive --html-report mypy-report
       - name: Upload test results
         if: ${{ always() }} # Upload even on mypy error
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
         with:
           name: Mypy report
           path: mypy-report