[WIP] Fix mypy type-check errors for PR #3

[Copilot]

• Understand the 5 mypy issues from CI
• Add types-PyYAML to dev dependencies in pyproject.toml
• Fix limits.py: replace dynamic replace(limits, **updates) with explicit replace() calls
• Fix normalize.py: narrow bytes type before calling .decode()
• Fix classify.py: correct return type annotation for _run_rule_classification_thread and run_rule_classification to dict[str, int | str]
• Fix ingest.py: guard cursor.lastrowid against None with RuntimeError
• Run mypy locally — Success: no issues found in 23 source files
• Run pytest — 140 passed (1 pre-existing failure due to missing fixture, unrelated to changes)

Original prompt

Fix the failing mypy check for PR #3 in uscient/mboxer by addressing the current type-check errors on the PR head. The failing CI job is the Type Check (mypy) job from workflow .github/workflows/ci.yml on PR #3 (https://github.com/uscient/mboxer/pull/3).

Repository: uscient/mboxer
Base branch: master

Observed mypy failures from CI:

• src/mboxer/config.py:6: missing type stubs for yaml (types-PyYAML suggested)
• src/mboxer/limits.py:94: replace(limits, **updates) uses dynamically-typed kwargs that mypy rejects
• src/mboxer/normalize.py:59 and :61: .decode() called on a union value from get_payload(decode=True) without narrowing to bytes
• src/mboxer/classify.py:294 and :387: function return type is annotated as dict[str, int] but returns {..., "level": "thread"}
• src/mboxer/ingest.py:342 and :347: cursor.lastrowid is treated as int | None and passed to functions expecting int

Please make code changes to fix these typing issues with minimal, clean changes. Preferred guidance:

1. Add the appropriate PyYAML type stubs to the project’s development/test dependency configuration so pip install -e ".[dev]" in CI installs them.
2. In limits.py, replace the dynamic updates/replace(limits, **updates) pattern with a mypy-friendly approach using explicit replace(...) calls or another type-safe pattern.
3. In normalize.py, narrow the payload returned by part.get_payload(decode=True) before calling .decode().
4. In classify.py, correct the return typing for _run_rule_classification_thread so it matches the actual returned shape, ideally with a precise typed structure if reasonable.
5. In ingest.py, explicitly guard or assert that msg_db_id is not None before passing it where an int is required.

Requirements:

• Create a pull request with the fixes.
• Keep changes narrowly scoped to resolving the mypy failures.
• If there is a project config file for dependencies or mypy configuration (for example pyproject.toml, requirements-dev.txt, etc.), update the correct file rather than hardcoding around the issue.
• Include a concise PR title and description explaining that this fixes the mypy/type-check failures blocking CI for PR ci: add GitHub Actions workflows #3.

The following is the prior conversation context from the user's chat exploration (may be truncated):

User: @uscient/mboxer/pull/3

Assistant: This PR adds GitHub Actions CI/release automation, but it’s not merge-ready yet because it’s still marked as a draft and mergeability is currently blocked. It also includes a few small unrelated lint-cleanup changes in Python source files beyond the new workflow files.

Field	Summary
PR	#3 — ci: add GitHub Actions workflows
URL	#3
Author	Copilot
State	Open
Draft	Yes
Mergeable	true, but mergeable state is blocked
Base / Head	master ← copilot/create-github-actions-workflows
Description	Adds 4 workflows: CI, schema validation, release-to-PyPI, dependency review; includes post-merge note to wire required checks into branch protection
Commits	7
Files changed	8
Lines changed	+125 / -6
Reviews	No reviews returned
PR comments	0
Review comments	0
Requested reviewers	xormania
CI checks	I couldn’t get a valid check-run listing from the API call I used, so I can’t confirm current pass/fail status from tooling alone
Risk	Medium — mostly workflow-only, but includes unrelated code edits and changes release/branch-protection behavior

In a nutshell

The PR primarily sets up repository automation with four new workflows under .github/workflows/:

• ci.yml for ruff, mypy, and pytest on PRs/pushes to master
• schema.yml for SQLite schema validation
• release.yml for PyPI publishing on version tags via OIDC
• dependency-review.yml for PR dependency scanning

It also contains a small follow-up fix in CI to generate synthetic fixtures before running tests, plus a handful of unrelated source cleanups to satisfy linting.

Notable changes

• New workflow files
  • .github/workflows/ci.yml
  • .github/workflows/schema.yml
  • .github/workflows/release.yml
  • .github/workflows/dependency-review.yml
• Non-workflow code changes
  • src/mboxer/cli.py
  • src/mboxer/db/schema.py
  • src/mboxer/ingest.py
  • src/mboxer/security/policy.py

Commit story

The commit history suggests the PR evolved after initial generation:

1. initial planning commits
2. workflow addition commit
3. lint-fix commits
4. merge of a separate PR (#4) that resolved ruff issues
5. a final commit to generate synthetic test fixtures before pytest in CI

That means the final PR is a bit broader than the original “add four workflow files exactly as specified” goal.

Merge-readiness assessment

Not ready yet, mainly because:

• it is still draft
• GitHub reports mergeable state as **blocke...

This pull request was created from Copilot chat.