spelling2.yml

# spelling.yml is blocked per https://github.com/check-spelling/check-spelling/security/advisories/GHSA-g86g-chm8-7r2p
name: Spell checking

# Comment management is handled through a secondary job, for details see:
# https://github.com/check-spelling/check-spelling/wiki/Feature%3A-Restricted-Permissions
#
# `jobs.comment-push` runs when a push is made to a repository and the `jobs.spelling` job needs to make a comment
#   (in odd cases, it might actually run just to collapse a comment, but that's fairly rare)
#   it needs `contents: write` in order to add a comment.
#
# `jobs.comment-pr` runs when a pull_request is made to a repository and the `jobs.spelling` job needs to make a comment
#   or collapse a comment (in the case where it had previously made a comment and now no longer needs to show a comment)
#   it needs `pull-requests: write` in order to manipulate those comments.

# Updating pull request branches is managed via comment handling.
# For details, see: https://github.com/check-spelling/check-spelling/wiki/Feature:-Update-expect-list
#
# These elements work together to make it happen:
#
# `on.issue_comment`
#   This event listens to comments by users asking to update the metadata.
#
# `jobs.update`
#   This job runs in response to an issue_comment and will push a new commit
#   to update the spelling metadata.
#
# `with.experimental_apply_changes_via_bot`
#   Tells the action to support and generate messages that enable it
#   to make a commit to update the spelling metadata.
#
# `with.ssh_key`
#   In order to trigger workflows when the commit is made, you can provide a
#   secret (typically, a write-enabled github deploy key).
#
#   For background, see: https://github.com/check-spelling/check-spelling/wiki/Feature:-Update-with-deploy-key

# SARIF reporting
#
# Access to SARIF reports is generally restricted (by GitHub) to members of the repository.
#
# Requires enabling `security-events: write`
# and configuring the action with `use_sarif: 1`
#
#   For information on the feature, see: https://github.com/check-spelling/check-spelling/wiki/Feature:-SARIF-output

# Minimal workflow structure:
#
# on:
#   push:
#     ...
#   pull_request_target:
#     ...
# jobs:
#   # you only want the spelling job, all others should be omitted
#   spelling:
#     # remove `security-events: write` and `use_sarif: 1`
#     # remove `experimental_apply_changes_via_bot: 1`
#     ... otherwise, adjust the `with:` as you wish

on:
  push:
    branches:
      - "**"
    tags-ignore:
      - "**"
  pull_request_target:
    branches:
      - "**"
    types:
      - "opened"
      - "reopened"
      - "synchronize"
  issue_comment:
    types:
      - "created"

permissions: {}

# Note on the archived action: check-spelling/check-spelling was archived 2026-06-16
# and is pinned at v0.0.26 (cfb6f7e). The action's runtime security poll (secpoll)
# no longer returns any advisory for v0.0.26, so the action runs normally with no
# workaround -- exactly like upstream microsoft/PowerToys, which is pinned to the
# same SHA. We previously set `INPUT_IGNORE_SECURITY_ADVISORY: Sorry` to suppress a
# transient 'Sorry' advisory, but that advisory was retracted; with no advisory
# present, setting that env makes secpoll fatally fail ("ignore_security_advisory
# was set to 'Sorry' but there is no security advisory for version 0.0.26", exit
# 200), so it has been removed. If a real advisory is ever (re)published, either
# remove the checker or pin a maintained fork.

jobs:
  spelling:
    name: Check Spelling
    permissions:
      contents: read
      pull-requests: read
      actions: read
      security-events: write
    outputs:
      followup: ${{ steps.spelling.outputs.followup }}
    runs-on: ubuntu-latest
    # Fork customization: only run the spelling gate on upstream microsoft/terminal.
    # On forks (e.g. yeelam-gordon/agentic-terminal) this job produces noise from upstream
    # source content because the auto-update bot flow that maintains expect.txt only runs
    # on the upstream repo. See PR #14 for context.
    if: ${{ github.repository_owner == 'microsoft' && ((contains(github.event_name, 'pull_request') && github.event.pull_request.state == 'open') || github.event_name == 'push') }}
    concurrency:
      group: spelling-${{ github.event.pull_request.number || github.ref }}
      # note: If you use only_check_changed_files, you do not want cancel-in-progress
      cancel-in-progress: true
    steps:
      - name: check-spelling
        id: spelling
        uses: check-spelling/check-spelling@cfb6f7e75bbfc89c71eaa30366d0c166f1bd9c8c # v0.0.26
        with:
          suppress_push_for_open_pull_request: ${{ github.actor != 'dependabot[bot]' && 1 }}
          checkout: true
          check_file_names: 1
          spell_check_this: microsoft/terminal@main
          post_comment: 0
          use_magic_file: 1
          report-timing: 1
          warnings: bad-regex,binary-file,deprecated-feature,ignored-expect-variant,large-file,limited-references,no-newline-at-eof,noisy-file,non-alpha-in-dictionary,token-is-substring,unexpected-line-ending,whitespace-in-dictionary,minified-file,unsupported-configuration,no-files-to-check,unclosed-block-ignore-begin,unclosed-block-ignore-end
          experimental_apply_changes_via_bot: ${{ github.repository_owner != 'microsoft' && 1 }}
          use_sarif: 1
          allow-hunspell: false
          load-config-from: |
            {
              "pr-base-keys": [
                ""
              ],
              "pr-trusted-keys": [
                "check_extra_dictionaries",
                "dictionary_source_prefixes",
                "extra_dictionaries",
                ""
              ],
              "": []
            }

  comment-push:
    name: Report (Push)
    # If your workflow isn't running on push, you can remove this job
    runs-on: ubuntu-slim
    needs: spelling
    permissions:
      actions: read
      contents: write
    if: (success() || failure()) && needs.spelling.outputs.followup && github.event_name == 'push'
    steps:
      - name: comment
        uses: check-spelling/check-spelling@cfb6f7e75bbfc89c71eaa30366d0c166f1bd9c8c # v0.0.26
        with:
          spell_check_this: microsoft/terminal@main
          task: ${{ needs.spelling.outputs.followup }}

  comment-pr:
    name: Report (PR)
    # If you workflow isn't running on pull_request*, you can remove this job
    runs-on: ubuntu-slim
    needs: spelling
    permissions:
      actions: read
      pull-requests: write
    if: (success() || failure()) && needs.spelling.outputs.followup && contains(github.event_name, 'pull_request')
    steps:
      - name: comment
        uses: check-spelling/check-spelling@cfb6f7e75bbfc89c71eaa30366d0c166f1bd9c8c # v0.0.26
        with:
          spell_check_this: microsoft/terminal@main
          task: ${{ needs.spelling.outputs.followup }}
          experimental_apply_changes_via_bot: ${{ github.repository_owner != 'microsoft' && 1 }}

  update:
    name: Update PR
    permissions:
      contents: write
      pull-requests: write
      actions: read
    runs-on: ubuntu-slim
    if: ${{
      github.repository_owner != 'microsoft' &&
      github.event_name == 'issue_comment' &&
      github.event.issue.pull_request &&
      contains(github.event.comment.body, '@check-spelling-bot') &&
      contains(github.event.comment.body, 'apply') &&
      contains(github.event.comment.body, 'https://')
      }}
    concurrency:
      group: spelling-update-${{ github.event.issue.number }}
      cancel-in-progress: false
    steps:
      - name: apply spelling updates
        uses: check-spelling/check-spelling@cfb6f7e75bbfc89c71eaa30366d0c166f1bd9c8c # v0.0.26
        with:
          experimental_apply_changes_via_bot: ${{ github.repository_owner != 'microsoft' && 1 }}
          checkout: true
          ssh_key: "${{ secrets.CHECK_SPELLING }}"