nixos-render-docs: add a test for running mypy

pulling mypy into the build closure is unfortunately not reasonable, the
closure for mypy is rather large and takes a long time to build. if we
have the type checks hooked into CI we'll get most of the benefit though.

pkgs/tools/nix/nixos-render-docs/default.nix

@@ -2,6 +2,7 @@
 , stdenv
 , python3
 , python3Minimal
+, runCommand
 }:
 
 let
@@ -21,9 +22,23 @@ let
     markdown-it-py = markdown-it-py-no-tests;
     disableTests = true;
   };
+
+  makeDeps = pkgs: small:
+    [ pkgs.frozendict ]
+    ++ (
+      if small
+      then [
+        markdown-it-py-no-tests
+        mdit-py-plugins-no-tests
+      ]
+      else [
+        pkgs.markdown-it-py
+        pkgs.mdit-py-plugins
+      ]
+    );
 in
 
-python.pkgs.buildPythonApplication {
+python.pkgs.buildPythonApplication rec {
   pname = "nixos-render-docs";
   version = "0.0";
   format = "pyproject";
@@ -47,14 +62,21 @@ python.pkgs.buildPythonApplication {
     python.pkgs.pytestCheckHook
   ];
 
-  propagatedBuildInputs = [
-    markdown-it-py-no-tests
-    mdit-py-plugins-no-tests
-    python.pkgs.frozendict
-  ];
+  propagatedBuildInputs = makeDeps python.pkgs true;
 
   pytestFlagsArray = [ "-vvrP" "tests/" ];
 
+  # NOTE this is a CI test rather than a build-time test because we want to keep the
+  # build closures small. mypy has an unreasonably large build closure for docs builds.
+  passthru.tests.typing = runCommand "${pname}-mypy" {
+    nativeBuildInputs = [
+      (python3.withPackages (p: [ p.mypy p.pytest ] ++ makeDeps p false))
+    ];
+  } ''
+    mypy --strict ${src}
+    touch $out
+  '';
+
   meta = with lib; {
     description = "Renderer for NixOS manual and option docs";
     license = licenses.mit;