ci: add quality gates for coverage and type checking

.github/workflows/lint.yaml

@@ -100,6 +100,23 @@ jobs:
           src: './python'
           version-file: python/pyproject.toml
 
+  type-check-python:
+    needs: changes
+    if: needs.changes.outputs.python == 'true'
+    runs-on: ubuntu-latest
+    continue-on-error: true
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Install uv
+        uses: astral-sh/setup-uv@803947b9bd8e9f986429fa0c5a41c367cd732b41 # v7.2.1
+        with:
+          version: latest
+
+      - name: Run ty
+        working-directory: python
+        run: make ty
+
   typos:
     runs-on: ubuntu-latest
     steps:

.github/workflows/python-tests.yaml

@@ -42,6 +42,8 @@ jobs:
         python-version: ["3.11", "3.12", "3.13"]
     steps:
       - uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
 
       - name: Install the latest version of uv
         uses: astral-sh/setup-uv@803947b9bd8e9f986429fa0c5a41c367cd732b41 # v7.2.1
@@ -95,9 +97,21 @@ jobs:
 
       - name: Run pytest
         working-directory: python
+        env:
+          PYTEST_ADDOPTS: "--cov --cov-report=xml"
         run: |
             make test
 
+      - name: Check coverage on changed lines
+        if: github.event_name == 'pull_request'
+        working-directory: python
+        run: |
+            coverage_files=$(find packages -name coverage.xml 2>/dev/null | sort)
+            if [ -z "$coverage_files" ]; then
+              echo "::error::No coverage.xml files found"
+              exit 1
+            fi
+            uv run diff-cover $coverage_files --compare-branch=origin/${{ github.base_ref }} --fail-under=80
 
   # https://github.com/orgs/community/discussions/26822
   pytest:

python/pyproject.toml

@@ -74,6 +74,7 @@ dev = [
     "pre-commit>=3.8.0",
     "esbonio>=0.16.5",
     "ty>=0.0.1a8",
+    "diff-cover>=9.2.0",
 ]
 
 [tool.ruff]
@@ -98,6 +99,7 @@ Pn = "Pn"
 mosquitto = "mosquitto"
 
 [tool.coverage.run]
+branch = true
 omit = ["conftest.py", "test_*.py", "*_test.py", "*_pb2.py", "*_pb2_grpc.py"]
 skip_empty = true