codespell.yml

---
# Copyright the Linux Foundation and the OpenSSF Best Practices badge
# contributors
# SPDX-License-Identifier: MIT

name: Codespell

# Limit permissions per OpenSSF Scorecard best practices.
# Since we set "permissions", anything unset has access "none".
permissions:
  contents: read

on:
  push:
    branches: [main]
  pull_request:
    branches: [main]

jobs:
  codespell:
    name: Check for spelling errors
    runs-on: ubuntu-latest

    steps:
      - name: Checkout
        # Pin to commit SHA to prevent supply chain attacks via tag mutation.
        # Verify: curl -s https://api.github.com/repos/actions/checkout/git/ref/tags/v5.0.0
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
      # OSPS-BR-01.02: Validate branch name before use in pipeline
      # This protects against potential future use of branch names in commands
      # GITHUB_REF_NAME is the short ref name (e.g., "main" not "refs/heads/main")
      - name: Validate branch name
        run: script/validate_branch_name "$GITHUB_REF_NAME"
      - name: Codespell
        # Pin to commit SHA to prevent supply chain attacks via tag mutation.
        # Verify: curl -s https://api.github.com/repos/codespell-project/actions-codespell/git/ref/tags/v2
        uses: codespell-project/actions-codespell@8f01853be192eb0f849a5c7d721450e7a467c579 # v2.2
        with:
          ignore_words_file: .codespellignore