ci: Set up Python-focused testing infra (#742)

This patch integrates running pytest and pre-commit via tox.
It includes changes needed for tracking coverage automatically
for local inspection and reporting it to Codecov.

This is essentially a copy of my typical boilerplate with a
few more advanced hacks for communicating with GHA.

It can be invoked as `tox`, `tox r`, `tox -qq`,
`tox r -e pre-commit -qq -- mypy --all-files`,
`tox -qq -- -vv -s tests/pytest/'tests/pytest/_cli_test.py::test_known_interrupts[ctrl-c]'`
etc.

`tox` itself is installable or runnable ad-hoc via
`pipx` / `uvx` / `uv tool install` or one's favorite distro
package manager. The Python version of where it's installed is
not important. `tox` is not usually installed into regular
manually-managed virtualenvs. Mentioned tools maintain internal
venvs for isolating the apps and the system install would just
live side-by-side with other system stuff.

`tox` creates virtualenvs for its wrapped commands automatically
and keeps track of cache invalidation for them. The commands
wired via `tox` can either be invoked with the default arguments
or with the replacement passed to tox after the `--` separator.

Furthermore, the change introduces the MyPy integration into the
pre-commit configuration and is set up in strict mode.

This patch includes a config file for MyPy and adjusts the existing
Python modules to pass the checks on every other version down
to Python 3.9.

Additionally, a set of basic unit tests is added to reach the bar
of 100% code coverage metric, which is set as expected in the
configs.

Another patch included is making stderr interceptable. Previously,
`sys.stderr` was exposed as a module-scoped var, while the `capsys`
fixture patches the `stderr` attribute on the `sys` module. So such
patching did not influence the `stderr` variable in the `_cli` module
as it remained linked to the non-patched object.
With this change, the ability to inspect printing to stderr is
recovered and is then demonstrated in the enclosed tests.

Configuration note: each underlying tool must have its configuration
in a native file, it supports and *not* passed via CLI arguments in
the pre-commit or tox configs. This is important because those tools
may be invoked by things other than our direct automation, like
editor/IDE plugins or other platforms/tools. In order for other
invocations to work the same, the shared configuration must be the
same. For example, if we were to disable a rule in a pylint call in
pre-commit config, it wouldn't show in CI but would break in people's
editors that just call pylint directly and show errors inline.



### How can we test changes

Install `tox` however you like (could also optionally attempt installing `tox-uv` with it, in the same env) and run `tox`. This will execute `pytest` under your current Python interpreter. You can also try things like `tox p -qq -e py313,py39,pre-commit`, `tox r -qq -e py313,py39,pre-commit`, `tox r -qq -e pre-commit -- mypy-py313 --all-files`, `tox r -qq -e pre-commit -- mypy --all-files`.

Author: webknjaz

.codecov.yml

@@ -0,0 +1,54 @@
+---
+
+codecov:
+  notify:
+    after_n_builds: 21  # Number of test matrix+lint jobs uploading coverage
+    wait_for_ci: false
+
+  require_ci_to_pass: false
+
+  token: >-  # notsecret  # repo-scoped, upload-only, stability in fork PRs
+    7316089b-55fe-4646-b640-78d84b79d109
+
+comment:
+  require_changes: true
+
+coverage:
+  range: 100..100
+  status:
+    patch:
+      default:
+        target: 100%
+      pytest:
+        target: 100%
+        flags:
+        - pytest
+      typing:
+        flags:
+        - MyPy
+    project:
+      default:
+        target: 95%
+      lib:
+        flags:
+        - pytest
+        paths:
+        - src/
+        target: 100%
+      tests:
+        flags:
+        - pytest
+        paths:
+        - tests/
+        target: 100%
+      typing:
+        flags:
+        - MyPy
+        target: 90%
+
+github_checks:
+  # Annotations are deprecated in Codecov because they are misleading.
+  # Ref: https://github.com/codecov/codecov-action/issues/1710
+  annotations: false
+
+...

.coveragerc

@@ -0,0 +1,34 @@
+[html]
+show_contexts = true
+skip_covered = false
+
+[paths]
+_site-packages-to-src-mapping =
+  src
+  */src
+  *\src
+  */lib/pypy*/site-packages
+  */lib/python*/site-packages
+  *\Lib\site-packages
+
+[report]
+skip_covered = true
+skip_empty = true
+show_missing = true
+exclude_also =
+  ^\s*@pytest\.mark\.xfail
+  ^\s*\.\.\.\s*(#.*)?$
+
+[run]
+branch = true
+cover_pylib = false
+# https://coverage.rtfd.io/en/latest/contexts.html#dynamic-contexts
+# dynamic_context = test_function  # conflicts with `pytest-cov` if set here
+parallel = true
+plugins =
+  covdefaults
+relative_files = true
+source =
+  .
+source_pkgs =
+  pre_commit_terraform