[sentry-junior]

This is the types-only version of #129447. It turns on strict = true for the whole codebase and empties the mypy weaklist. It keeps today's master runtime behavior. The behavior fixes that were folded into #129447 come back as separate PRs stacked on this branch.

Changes from #129447

• strict = true with warn_return_any = false. The no-any-return errors were most of the work, and fixing them added return cast(...) calls, isinstance/raise TypeError guards, and # justification: comments. Those are gone.
• Where strict types and master behavior conflict, master behavior stays and the types give way: a cast, an Any, or a scoped # type: ignore[...]. Examples:
  • The paginator order_b typo is still there behind # type: ignore[attr-defined]. fix(api): Reverse previous-page ordering for descending paginators #129615 fixes it.
  • Fallbacks like or 0, coercions with str()/int()/bool(), defensive copies that changed in-place mutation, and serializer output are back to master.
• get_mapping, post_mapping and get_sequence in shared_integrations/client/base.py are pure casts. They no longer raise ApiError when a response has an unexpected shape.
• Bounded*Field are bare subclasses again, with # type: ignore[type-arg] on 7 class lines. The [int | None, int | None] subscripts are gone from call sites. These fields type-check as Any, as they do on master.
• These are removed and can come back as separate PRs if we still want them: check_typing_campaign.py with its hook and tests, the weaklist sort tooling, the .github/workflows/pre-commit.yml rewrite, and the inviteStatus nullability change in static/app/types/organization.tsx.
• I tried allow_redefinition = true. Under mypy 2.1 it adds about 150 errors in existing code, so it's off and the variable renames stay.

Rebased on master (e39c07b6). Conflicts were resolved in master's favor, with types added on top. Master code added since the old base needed a few more stub entries in fixtures/stubs-for-mypy (PGAccessExclusive/PGLock, two selenium exceptions, WebDriverWait.until accepting Literal[False]) and annotations on a handful of new tests.

Deliberately left in

• About 95 assert x is not None lines for type narrowing. I haven't checked each one against master behavior.
• UNBOUNDED_DATETIME = cast("datetime", None) in tests/snuba/search/test_backend.py. Widening snuba_search to datetime | None spreads into run_eap_group_search and _prepare_params_for_categories.

Stack (all based on this branch, land after it):

• fix(api): Reverse previous-page ordering for descending paginators #129615: paginator order_by typo (was fix(api): Reverse previous-page ordering for descending paginators #127799)
• fix(msteams): fail on a missing conversation id #129616: msteams missing conversation id (was fix(msteams): fail on a missing conversation id #129427)
• fix(allowed-domains): preserve blank origin values #129617: blank origin values (was fix(allowed-domains): preserve blank origin values #129428)
• fix(releases): default missing health stats and group counts #129618: release serializer defaults (was fix(releases): default missing health stats and group counts #129429)
• fix(jira): require a query for issue search #129619: jira query required (was fix(jira): require a query for issue search #129430)
• fix(releases): validate artifact manifest JSON shape #129620: artifact manifest JSON shape (was fix(releases): validate artifact manifest JSON shape #129432)
• fix(dashboards): validate threshold JSON shape #129621: dashboard threshold validation (was fix(dashboards): validate threshold JSON shape #129434; now accepts decimal maximums)
• fix(artifactbundle): reject non-string debug ids #129622: non-string debug ids (was fix(artifactbundle): reject non-string debug ids #129435)
• fix(sourcemaps): ignore non-string sourcemap headers #129623: non-string sourcemap headers (was fix(sourcemaps): ignore non-string sourcemap headers #129436)
• fix(projects): return an empty list for blank allowed domains #129624: blank allowed domains (was fix(projects): return an empty list for blank allowed domains #129438; no longer splits strings into characters)

#129433 isn't restacked. Master's owned_by_acting_user() already returns Q(pk__in=[]) for anonymous users, so those queries are skipped there.

No getsentry change needed. getsentry's backend typing flagged 7 errors against an earlier push of this branch. Each one was a Sentry signature this PR had made narrower than master's contract, so they're fixed here, not in getsentry:

• BaseApiClient.request/get/get_cached/post/put/patch/delete/head_cached return Any again, as on master. The get_mapping/get_sequence helpers keep their typed returns.
• OAuth2Provider.get_oauth_client_id() returns Any. getsentry overrides it with an option typed str | int.
• AbstractFile.getfile() returns Any. getsentry's uploader treats it as a BufferedIOBase.
• BidirectionalMapping is generic in its values (BidirectionalMapping[KT, VT]), so lookups infer str instead of object.
• BitField subclasses BigIntegerField[Any, Any], so subscription.flags.<name> resolves the way it does on master.

The BitField fix also restores two master behaviors the earlier push had changed: plain string flags are added to labels again, and _arg_flags holds the normalized flag list again, which is what deconstruct() writes into migrations.

getsentry/getsentry#22868 is no longer needed for this PR.

Verification

• mypy (full repo, strict): Success: no issues found in 8527 source files, on this branch and on this branch with all 10 stacked PRs applied.
• ruff check / ruff format --check on the changed Python files, plus ruff --select F821,F401 across src and tests.
• getsentry master's mypy run against this branch reports the same 9 errors it reports against Sentry master: 6 are local-checkout gaps (scripts.* and devlocal modules missing in my sandbox) and 3 are already in getsentry/jobs/migrate_legacy_seer.py. None come from this PR.
• I did not run pytest locally because there's no Postgres or Redis in my sandbox. CI is the test signal.

Supersedes #129447 (fork branch, so I couldn't push to it).

via @joshuarli.

--

View Session [Sentry]

[github-actions]

decision-model-linter

api

src/sentry/core/endpoints/project_details.py

• warn readsRequestBodyOutsideSerializer = TRUE (0.84): Request body values should be read from a serializer's validated_data. This file reads a value directly from request.data or request.POST.

src/sentry/integrations/gitlab/webhooks.py

• warn readsWebhookPayloadOutsideSerializer = TRUE (0.72): Third-party webhook payloads should be validated with a serializer or typed schema before their fields are read. This file reads fields directly from the incoming payload.

src/sentry/integrations/msteams/webhook.py

• warn readsWebhookPayloadOutsideSerializer = TRUE (0.80): Third-party webhook payloads should be validated with a serializer or typed schema before their fields are read. This file reads fields directly from the incoming payload.

src/sentry/integrations/slack/requests/event.py

• warn readsWebhookPayloadOutsideSerializer = TRUE (0.84): Third-party webhook payloads should be validated with a serializer or typed schema before their fields are read. This file reads fields directly from the incoming payload.

src/sentry/releases/endpoints/project_release_files.py

• warn readsRequestBodyOutsideSerializer = TRUE (0.85): Request body values should be read from a serializer's validated_data. This file reads a value directly from request.data or request.POST.

audit

src/sentry/web/frontend/setup_wizard.py

• warn issuesOrRevokesTokenWithoutRecord = TRUE (0.78): Token changes should be logged with create_audit_entry for org tokens or capture_security_activity for personal tokens. This file creates, revokes, or rescopes a token, but neither call was found in it. Ignore this if a function the file calls already logs the change.

_{decision-model-linter: 3423 calls on 1214 files, 7,322,057 input tokens, $0.31, model typesafe/jev-1.13-20260917}

[cursor]

This PR is too large for Bugbot to review. It changes 24,218 lines and 3,674,192 characters. Split the change into smaller pull requests to get a review.

[sentry-warden]

Empty stats download writes None into HttpResponse

_generate_csv returns None for empty projects; cast(str, ...) is a no-op at runtime, so response.write(None) raises AttributeError. Return an empty string instead of None when there are no projects.

Evidence

• massage_sessions_result_summary returns projects={} when Snuba totals are empty (e.g. future/empty range; covered by test_future_request).
• On download, line 174 does cast(str, self._generate_csv(projects)); cast does not convert None.
• _generate_csv returns None when not len(projects) (lines 212-213).
• response.write(csv_content) then calls .encode on None and raises AttributeError.

_{Identified by Warden · sentry-backend-bugs · BKS-KKR}