Add initial mypy configuration

This is an initial setup: By default check only tuf/api/,
and ignore securesystemslib imports.

Change lint working directory to source root: This saves repeating a lot
of {toxinidir} in the command lines.

Signed-off-by: Jussi Kukkonen <[email protected]>

requirements-test.txt

@@ -11,4 +11,5 @@ coverage
 black
 isort
 pylint
+mypy
 bandit

setup.cfg

@@ -6,3 +6,10 @@ ignore =
   requirements-dev.txt
   .travis.yml
   .coveragerc
+
+[mypy]
+warn_unused_configs = True
+files = tuf/api/
+
+[mypy-securesystemslib.*]
+ignore_missing_imports = True

tox.ini

@@ -39,15 +39,18 @@ commands =
     python -m coverage report -m
 
 [testenv:lint]
+changedir = {toxinidir}
 commands =
     # Use different configs for new (tuf/api/*) and legacy code
     # TODO: configure black and isort args in pyproject.toml (see #1161)
-    black --check --diff --line-length 80 {toxinidir}/tuf/api
-    isort --check --diff --line-length 80 --profile black -p tuf {toxinidir}/tuf/api
-    pylint {toxinidir}/tuf/api --rcfile={toxinidir}/tuf/api/pylintrc
+    black --check --diff --line-length 80 tuf/api
+    isort --check --diff --line-length 80 --profile black -p tuf tuf/api
+    pylint tuf/api --rcfile=tuf/api/pylintrc
 
     # NOTE: Contrary to what the pylint docs suggest, ignoring full paths does
     # work, unfortunately each subdirectory has to be ignored explicitly.
-    pylint {toxinidir}/tuf --ignore={toxinidir}/tuf/api,{toxinidir}/tuf/api/serialization
+    pylint tuf --ignore=tuf/api,tuf/api/serialization
 
-    bandit -r {toxinidir}/tuf
+    mypy
+
+    bandit -r tuf