build.sh stubtest does not run. It aborts before checking anything:

$ python -m mypy.stubtest --mypy-config-file mypy-stubtest.ini pygit2._pygit2
error: not checking stubs due to mypy build errors:
pygit2/_libgit2/ffi.pyi:93: error: Explicit "Any" is not allowed  [explicit-any]
... 24 more, in pygit2/_libgit2/ffi.pyi and pygit2/options.py

disallow_any_explicit = True is set globally in mypy-stubtest.ini, so it applies to every module the build pulls in, not only to the stub under test. That was harmless until pygit2/_libgit2/ffi.pyi landed in 58d12711 (2025-07-26): the cffi binding stub is Any-typed by nature, and it is imported from _pygit2.pyi. Nothing in CI runs build.sh stubtest - lint.yml runs build.sh mypy and tests.yml runs build.sh test - so it has been dead since then.

Scoping the setting fixes it, and the stub turns out to be clean:

$ python -m mypy.stubtest --mypy-config-file mypy-stubtest.ini pygit2._pygit2
Success: no issues found in 1 module

The check still bites where it is meant to. Appending broken_probe: Any to _pygit2.pyi gives pygit2/_pygit2.pyi:890: error: Explicit "Any" is not allowed [explicit-any], which is how I confirmed the narrower scope is not just silencing the rule. _pygit2.pyi uses no explicit Any today, so nothing in it is newly permitted.

Two things I did not do. follow_imports = skip for pygit2.* also silences the errors, but it makes the Literal[...] parameters in the stub resolve to Any and mypy then rejects nine of them, so it is the wrong lever. And I did not add stubtest to CI: it needs the extension built and that is a workflow decision rather than a config fix - happy to send it if you want it.

mypy 2.3.1 (requirements-typing.txt pins no version, so this is what a contributor gets today).

Assisted-by: Claude Opus 5 (Claude Code), per CONTRIBUTING.md; the commit carries the trailer.