Add code quality checks with cspell, markdownlint, and yamllint (#84)

Copilot · Malcolmnixon · web-flow · commit 12634408a20a · 2025-12-26T19:29:31.000-05:00
* Initial plan

* Add code quality checks with cspell, markdownlint, and yamllint

Co-authored-by: Malcolmnixon &lt;1863707+Malcolmnixon@users.noreply.github.com&gt;

* Fix markdown, YAML, and spelling issues to pass code quality checks

Co-authored-by: Malcolmnixon &lt;1863707+Malcolmnixon@users.noreply.github.com&gt;

* Add pipeline-related words to cspell dictionary

Co-authored-by: Malcolmnixon &lt;1863707+Malcolmnixon@users.noreply.github.com&gt;

---------

Co-authored-by: copilot-swe-agent[bot] &lt;198982749+Copilot@users.noreply.github.com&gt;
Co-authored-by: Malcolmnixon &lt;1863707+Malcolmnixon@users.noreply.github.com&gt;
diff --git a/.cspell.json b/.cspell.json
@@ -0,0 +1,41 @@
+{
+  "version": "0.2",
+  "language": "en",
+  "words": [
+    "SPDX",
+    "SpdxModel",
+    "DemaConsulting",
+    "SBOM",
+    "sbom",
+    "dotnet",
+    "NuGet",
+    "nuget",
+    "spdx",
+    "deserializer",
+    "serializer",
+    "Dema",
+    "workflow",
+    "workflows",
+    "yamllint",
+    "markdownlint",
+    "cspell",
+    "Copilot",
+    "opencover",
+    "OpenCover",
+    "snupkg",
+    "Anson",
+    "ibiqlik",
+    "sonarscanner",
+    "ncipollo",
+    "DEMACONSULTINGNUGETKEY"
+  ],
+  "ignorePaths": [
+    "**/*.spdx.json",
+    "**/bin/**",
+    "**/obj/**",
+    "**/.git/**",
+    "**/node_modules/**",
+    "**/*.nupkg",
+    "**/*.snupkg"
+  ]
+}
diff --git a/.github/ISSUE_TEMPLATE/bug_report.yml b/.github/ISSUE_TEMPLATE/bug_report.yml
@@ -1,3 +1,4 @@
+---
 name: 🐛 Bug Report
 description: Report a bug or issue with SpdxModel
 title: "[Bug]: "
@@ -6,7 +7,8 @@ body:
   - type: markdown
     attributes:
       value: |
-        Thanks for taking the time to fill out this bug report! Please provide as much detail as possible to help us understand and fix the issue.
+        Thanks for taking the time to fill out this bug report! Please provide as much detail as possible to help
+        us understand and fix the issue.
 
   - type: textarea
     id: description
@@ -45,9 +47,9 @@ body:
         2. Call method X with parameters...
         3. See error...
       value: |
-        1. 
-        2. 
-        3. 
+        1.
+        2.
+        3.
     validations:
       required: true
 
diff --git a/.github/ISSUE_TEMPLATE/config.yml b/.github/ISSUE_TEMPLATE/config.yml
@@ -1,3 +1,4 @@
+---
 blank_issues_enabled: false
 contact_links:
   - name: 💬 GitHub Discussions
diff --git a/.github/ISSUE_TEMPLATE/feature_request.yml b/.github/ISSUE_TEMPLATE/feature_request.yml
@@ -1,3 +1,4 @@
+---
 name: ✨ Feature Request
 description: Suggest a new feature or enhancement for SpdxModel
 title: "[Feature]: "
@@ -6,7 +7,8 @@ body:
   - type: markdown
     attributes:
       value: |
-        Thanks for suggesting a new feature! Please provide as much detail as possible to help us understand your request.
+        Thanks for suggesting a new feature! Please provide as much detail as possible to help us understand your
+        request.
 
   - type: textarea
     id: summary
diff --git a/.github/dependabot.yml b/.github/dependabot.yml
@@ -1,3 +1,4 @@
+---
 version: 2
 updates:
   # Enable version updates for NuGet
diff --git a/.github/workflows/build.yaml b/.github/workflows/build.yaml
@@ -16,8 +16,8 @@ on:
 jobs:
   build:
     permissions:
-      contents: read       # To read repository contents
-      pull-requests: write # To write pull requests analysis results and artifacts
+      contents: read        # To read repository contents
+      pull-requests: write  # To write pull requests analysis results and artifacts
 
     runs-on: ${{ inputs.os }}
 
diff --git a/.github/workflows/build_on_push.yaml b/.github/workflows/build_on_push.yaml
@@ -8,11 +8,34 @@ on:
     - cron: '0 17 * * 1'
 
 jobs:
+  code-quality:
+    name: Code Quality
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read  # To read repository contents
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v6
+
+      - name: Check Spelling
+        uses: streetsidesoftware/cspell-action@v8
+
+      - name: Check Markdown
+        uses: DavidAnson/markdownlint-cli2-action@v22
+        with:
+          globs: '**/*.md'
+
+      - name: Check YAML
+        uses: ibiqlik/action-yamllint@v3
+        with:
+          file_or_dir: .
+          config_file: .yamllint.yaml
+
   build-windows:
     name: Build Windows
     permissions:
-      contents: read       # To read repository contents
-      pull-requests: write # To write pull requests analysis results and artifacts
+      contents: read        # To read repository contents
+      pull-requests: write  # To write pull requests analysis results and artifacts
     uses: ./.github/workflows/build.yaml
     with:
       os: windows-latest
@@ -23,8 +46,8 @@ jobs:
   build-linux:
     name: Build Linux
     permissions:
-      contents: read       # To read repository contents
-      pull-requests: write # To write pull requests analysis results and artifacts
+      contents: read        # To read repository contents
+      pull-requests: write  # To write pull requests analysis results and artifacts
     uses: ./.github/workflows/build.yaml
     with:
       os: ubuntu-latest
diff --git a/.github/workflows/release.yaml b/.github/workflows/release.yaml
@@ -22,8 +22,8 @@ jobs:
   build:
     name: Build Linux
     permissions:
-      contents: read       # To read repository contents
-      pull-requests: write # To write pull requests analysis results and artifacts
+      contents: read        # To read repository contents
+      pull-requests: write  # To write pull requests analysis results and artifacts
     uses: ./.github/workflows/build.yaml
     with:
       os: ubuntu-latest
@@ -33,7 +33,7 @@ jobs:
 
   release:
     permissions:
-      contents: write # To create releases
+      contents: write  # To create releases
 
     runs-on: ubuntu-latest
 
diff --git a/.markdownlint.json b/.markdownlint.json
@@ -0,0 +1,8 @@
+{
+  "default": true,
+  "MD003": { "style": "atx" },
+  "MD007": { "indent": 2 },
+  "MD013": { "line_length": 120 },
+  "MD033": false,
+  "MD041": false
+}
diff --git a/.yamllint.yaml b/.yamllint.yaml
@@ -0,0 +1,25 @@
+---
+# yamllint configuration for SpdxModel
+# This configuration defines the rules for YAML file linting
+
+extends: default
+
+rules:
+  # Allow 'on:' in GitHub Actions workflows (not a boolean value)
+  truthy:
+    allowed-values: ['true', 'false', 'on', 'off']
+    check-keys: true
+
+  # Allow longer lines for URLs and complex expressions
+  line-length:
+    max: 120
+    level: error
+
+  # Ensure proper indentation
+  indentation:
+    spaces: 2
+    indent-sequences: true
+
+  # Ensure proper comment formatting
+  comments:
+    min-spaces-from-content: 2
diff --git a/AGENTS.md b/AGENTS.md
@@ -3,20 +3,17 @@
 This file provides specific context and instructions for AI coding agents to
 interact effectively with this C# project.
 
-
 ## Project Overview
 
 SpdxModel is a C# library for serializing and deserializing SPDX SBOMs into an
 in-memory representation suitable for manipulation and analysis.
 
-
 ## Technologies and Dependencies
 
 * **Language**: C# 12
 * **.NET Frameworks**: .NET 8, 9, and 10
 * **Primary Dependencies**: [System.Text.Json]
 
-
 ## Project Structure
 
 The repository is organized as follows:
@@ -27,27 +24,28 @@ The repository is organized as follows:
 * `/test/DemaConsulting.SpdxModel.Tests/`: Contains the library unit tests.
 * `/DemaConsulting.SpdxModel.sln`: The main Visual Studio solution file.
 
-
 ## Development Commands
 
 Use these commands to perform common development tasks:
 
 * **Restore DotNet Tools**:
+
   ```bash
   dotnet tool restore
   ```
 
 * **Build the Project**:
+
   ```bash
   dotnet build
   ```
 
 * **Run All Tests**:
+
   ```bash
   dotnet test
   ```
 
-
 ## Testing Guidelines
 
 * Tests are located under the `/test/DemaConsulting.SpdxModel.Tests/` folder and use the MSTest framework.
@@ -56,37 +54,46 @@ Use these commands to perform common development tasks:
 * The build must pass all tests and static analysis warnings before merging.
 * Tests should be written using the AAA (Arrange, Act, Assert) pattern.
 
-
 ## Code Style and Conventions
 
-* Follow standard C# naming conventions (PascalCase for classes/methods/properties, camelCase for local variables).
-* Nullable reference types are enabled at the project level (`<Nullable>enable</Nullable>` in .csproj files). Do not use file-level `#nullable enable` directives.
+* Follow standard C# naming conventions (PascalCase for classes/methods/properties, camelCase for
+  local variables).
+* Nullable reference types are enabled at the project level (`<Nullable>enable</Nullable>` in .csproj files).
+  Do not use file-level `#nullable enable` directives.
 * Warnings are treated as errors (`<TreatWarningsAsErrors>true</TreatWarningsAsErrors>`).
 * Avoid public fields; prefer properties.
 
-
 ## Code Quality Tools
 
 The project uses several code quality and analysis tools:
 
 * **Code Analyzers**:
-  - `Microsoft.CodeAnalysis.NetAnalyzers`: Provides .NET-specific code analysis including security, performance, and design rules
-  - All warnings are treated as errors (`<TreatWarningsAsErrors>true</TreatWarningsAsErrors>`)
-  - Certain analyzer rules are configured to 'suggestion' or 'none' in `.editorconfig` to align with existing codebase patterns
+  * `Microsoft.CodeAnalysis.NetAnalyzers`: Provides .NET-specific code analysis including security,
+    performance, and design rules
+  * All warnings are treated as errors (`<TreatWarningsAsErrors>true</TreatWarningsAsErrors>`)
+  * Certain analyzer rules are configured to 'suggestion' or 'none' in `.editorconfig` to align with existing
+    codebase patterns
 
 * **Code Coverage**:
-  - `coverlet.collector` is used for collecting code coverage
-  - Coverage reports are generated in OpenCover format
-  - Aim for high test coverage (80%+ for new code)
+  * `coverlet.collector` is used for collecting code coverage
+  * Coverage reports are generated in OpenCover format
+  * Aim for high test coverage (80%+ for new code)
 
 * **Static Analysis**:
-  - SonarCloud integration for continuous code quality monitoring
-  - CodeQL for security analysis
-  - All code changes must pass static analysis checks
+  * SonarCloud integration for continuous code quality monitoring
+  * CodeQL for security analysis
+  * All code changes must pass static analysis checks
+
+* **Linting and Code Quality**:
+  * `cspell` for spell checking (configured in `.cspell.json`)
+  * `markdownlint-cli2` for Markdown file linting (configured in `.markdownlint.json`)
+  * `yamllint` for YAML file linting (configured in `.yamllint.yaml`)
+  * Code quality checks run automatically in CI pipeline
+  * Run locally: `npx cspell lint "**/*.md"`, `npx markdownlint-cli2 "**/*.md"`, `yamllint .`
 
 * **Editor Configuration**:
-  - `.editorconfig` defines consistent code style rules
-  - Ensure your editor respects EditorConfig settings
+  * `.editorconfig` defines consistent code style rules
+  * Ensure your editor respects EditorConfig settings
 
 ## Code Coverage Requirements
 
@@ -105,9 +112,9 @@ The project uses several code quality and analysis tools:
 ## Performance Testing
 
 * While there are currently no formal performance benchmarks, consider performance implications for:
-  - Large SPDX document parsing and serialization
-  - Memory usage when working with many packages or files
-  - Relationship graph traversal operations
+  * Large SPDX document parsing and serialization
+  * Memory usage when working with many packages or files
+  * Relationship graph traversal operations
 * If adding features that may impact performance, consider adding benchmark tests using BenchmarkDotNet
 
 ## Security Guidelines
@@ -122,11 +129,12 @@ The project uses several code quality and analysis tools:
 
 * All changes are validated by GitHub Actions CI
 * CI pipeline includes:
-  - Building on multiple .NET versions (8, 9, 10)
-  - Running all unit tests
-  - Code coverage collection
-  - SonarCloud analysis
-  - SBOM generation
+  * Code quality checks (spell checking, Markdown linting, YAML linting)
+  * Building on multiple .NET versions (8, 9, 10)
+  * Running all unit tests
+  * Code coverage collection
+  * SonarCloud analysis
+  * SBOM generation
 * All CI checks must pass before merging
 
 ## Boundaries and Guardrails
diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md
diff --git a/README.md b/README.md
diff --git a/SECURITY.md b/SECURITY.md
diff --git a/spdx-workflow.yaml b/spdx-workflow.yaml

Original file line number	Diff line number	Diff line change
`@@ -1,3 +1,4 @@`
	`1`	`+---`
`1`	`2`	`blank_issues_enabled: false`
`2`	`3`	`contact_links:`
`3`	`4`	`- name: 💬 GitHub Discussions`
Original file line number	Diff line number	Diff line change
`@@ -1,3 +1,4 @@`
	`1`	`+---`
`1`	`2`	`version: 2`
`2`	`3`	`updates:`
`3`	`4`	`# Enable version updates for NuGet`