Skip to content

Commit 81deab3

Browse files
Raj-StepSecurityRaj-StepSecurity
authored
Merge pull request #1 from step-security/release
forked from upstream
2 parents a8ba161 + 4956970 commit 81deab3

23 files changed

+731
-1
lines changed

‎.github/dependabot.yml‎

Lines changed: 10 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,10 @@
1+
# See: https://docs.github.com/code-security/dependabot/dependabot-version-updates/configuration-options-for-the-dependabot.yml-file#about-the-dependabotyml-file
2+
version: 2
3+
4+
updates:
5+
# Configure check for outdated GitHub Actions actions in workflows.
6+
# See: https://docs.github.com/code-security/dependabot/working-with-dependabot/keeping-your-actions-up-to-date-with-dependabot
7+
- package-ecosystem: github-actions
8+
directory: / # Check the repository's workflows under /.github/workflows/
9+
schedule:
10+
interval: daily

‎.github/workflows/actions_release.yml‎

Lines changed: 22 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,22 @@
1+
name: Release GitHub Actions
2+
3+
on:
4+
workflow_dispatch:
5+
inputs:
6+
tag:
7+
description: "Tag for the release"
8+
required: true
9+
10+
permissions:
11+
contents: read
12+
13+
jobs:
14+
release:
15+
permissions:
16+
actions: read
17+
id-token: write
18+
contents: write
19+
20+
uses: step-security/reusable-workflows/.github/workflows/actions_release.yaml@v1
21+
with:
22+
tag: "${{ github.event.inputs.tag }}"

‎.github/workflows/docker_image.yml‎

Lines changed: 44 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,44 @@
1+
name: Publish stable image
2+
3+
on:
4+
workflow_dispatch:
5+
inputs:
6+
release_tag:
7+
description: 'Tag to release (e.g. v1.2.3)'
8+
required: true
9+
type: string
10+
11+
jobs:
12+
publish_image:
13+
name: Publish Docker image to ghcr.io
14+
runs-on: ubuntu-latest
15+
if: startsWith(github.event.inputs.release_tag, 'v')
16+
permissions:
17+
contents: read
18+
packages: write
19+
20+
steps:
21+
- name: Checkout code
22+
uses: actions/checkout@v4
23+
24+
- name: Validate tag format
25+
run: |
26+
TAG=${{ github.event.inputs.release_tag }}
27+
if ! echo "$TAG" | grep -Eq '^v[0-9]+\.[0-9]+\.[0-9]+$'; then
28+
echo "❌ Invalid tag format: $TAG"
29+
exit 1
30+
fi
31+
echo "✅ Valid semver tag: $TAG"
32+
33+
- name: Build Docker image
34+
run: |
35+
IMAGE_NAME=ghcr.io/${{ github.repository }}/stable:${{ github.event.inputs.release_tag }}
36+
docker build -t $IMAGE_NAME .
37+
38+
- name: Log in to GitHub Container Registry
39+
run: echo "${{ secrets.GITHUB_TOKEN }}" | docker login ghcr.io -u ${{ github.actor }} --password-stdin
40+
41+
- name: Push Docker image
42+
run: |
43+
IMAGE_NAME=ghcr.io/${{ github.repository }}/stable:${{ github.event.inputs.release_tag }}
44+
docker push $IMAGE_NAME

‎.github/workflows/testing.yml‎

Lines changed: 112 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,112 @@
1+
name: Testing
2+
3+
on: [push, pull_request]
4+
5+
jobs:
6+
test:
7+
name: Run tests
8+
runs-on: ubuntu-latest
9+
continue-on-error: ${{ matrix.experimental }}
10+
strategy:
11+
fail-fast: false
12+
matrix:
13+
codespell_pip_version: ['codespell']
14+
experimental: [false]
15+
include:
16+
- codespell_pip_version: 'git+https://github.com/codespell-project/codespell.git'
17+
# Set this to true if git master is breaking the action's tests
18+
experimental: false
19+
20+
steps:
21+
- name: Checkout
22+
uses: actions/checkout@v4
23+
24+
- name: Set up Python
25+
uses: actions/setup-python@v5
26+
with:
27+
python-version: '3.10'
28+
29+
- name: Install codespell via pip using ${{ matrix.codespell_pip_version }}
30+
run: pip install ${{ matrix.codespell_pip_version }}
31+
32+
- name: Check codespell
33+
run: codespell --version
34+
35+
- name: Install Bats
36+
run: |
37+
git clone --quiet https://github.com/bats-core/bats-core.git
38+
cd bats-core
39+
git fetch --tags
40+
# Checkout the latest tag
41+
git checkout --quiet $(git describe --tags `git rev-list --tags --max-count=1`)
42+
sudo ./install.sh "/usr/local" > /dev/null
43+
44+
- name: Run Bats tests
45+
run: bats "./test"
46+
47+
run_action:
48+
name: Test run action
49+
runs-on: ubuntu-latest
50+
steps:
51+
- uses: actions/checkout@v4
52+
- uses: ./
53+
with:
54+
path: test/testdata
55+
only_warn: 1
56+
57+
codespell:
58+
name: Check for spelling errors
59+
runs-on: ubuntu-latest
60+
steps:
61+
- uses: actions/checkout@v4
62+
- uses: ./
63+
with:
64+
check_filenames: true
65+
check_hidden: true
66+
# When using this Action in other repos, the --skip option below can be removed
67+
skip: ./.git,./codespell-problem-matcher/test,./test,./README.md,./.github/workflows/testing.yml,./.pre-commit-config.yaml
68+
# Check our README (and this workflow) ignoring the two intentional typos
69+
- uses: ./
70+
with:
71+
check_filenames: true
72+
check_hidden: true
73+
path: ./README.md,./.github/workflows/testing.yml
74+
ignore_words_list: abandonned,ackward
75+
76+
diagnose_bats:
77+
name: Diagnose bats
78+
needs: test
79+
if: always() && needs.test.result == 'failure'
80+
runs-on: ubuntu-latest
81+
continue-on-error: true
82+
strategy:
83+
fail-fast: false
84+
matrix:
85+
codespell_pip_version: ['codespell']
86+
include:
87+
- codespell_pip_version: 'git+https://github.com/codespell-project/codespell.git'
88+
steps:
89+
- uses: actions/checkout@v4
90+
- name: Set up Python
91+
uses: actions/setup-python@v5
92+
- run: pip3 --quiet --quiet install ${{ matrix.codespell_pip_version }}
93+
- run: |
94+
# Simulate the Dockerfile COPY command
95+
[ -d "${RUNNER_TEMP}/code/" ] || sudo mkdir -p ${RUNNER_TEMP}/code/
96+
[ -f "${RUNNER_TEMP}/code/codespell-matcher.json" ] || sudo cp codespell-problem-matcher/codespell-matcher.json ${RUNNER_TEMP}/code/
97+
#ls -alR ${RUNNER_TEMP}/code/
98+
[ -d "/code/" ] || sudo mkdir -p /code/
99+
[ -f "/code/codespell-matcher.json" ] || sudo cp codespell-problem-matcher/codespell-matcher.json /code/
100+
#ls -alR /code/
101+
# Add a random place BATS tries to put it
102+
[ -d "/github/workflow/" ] || sudo mkdir -p /github/workflow/ && sudo chmod 777 /github/workflow/
103+
#ls -alR /github/workflow/
104+
export INPUT_CHECK_FILENAMES=""
105+
export INPUT_CHECK_HIDDEN=""
106+
export INPUT_EXCLUDE_FILE=""
107+
export INPUT_SKIP=""
108+
export INPUT_IGNORE_WORDS_FILE="./test/ignore-words-file.txt"
109+
export INPUT_IGNORE_WORDS_LIST=""
110+
export INPUT_PATH="./test/testdata"
111+
export INPUT_ONLY_WARN=""
112+
./entrypoint.sh || echo $?

‎.pre-commit-config.yaml‎

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,8 @@
1+
repos:
2+
- repo: https://github.com/codespell-project/codespell
3+
rev: v2.4.0
4+
hooks:
5+
- id: codespell
6+
args: [--ignore-words-list, "abandonned,ackward,bu"]
7+
additional_dependencies:
8+
- tomli

‎Dockerfile‎

Lines changed: 13 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,13 @@
1+
FROM python:3.8-alpine
2+
3+
COPY LICENSE \
4+
README.md \
5+
entrypoint.sh \
6+
codespell-problem-matcher/codespell-matcher.json \
7+
requirements.txt \
8+
/code/
9+
10+
RUN pip install -r /code/requirements.txt
11+
12+
ENTRYPOINT ["/code/entrypoint.sh"]
13+
CMD []

‎LICENSE‎

Lines changed: 22 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,22 @@
1+
The MIT License (MIT)
2+
3+
Copyright (c) 2020 Peter Newman. Based on flake8 code copyright 2019, Patric "TrueBrain" Stout
4+
Copyright (c) 2025 StepSecurity
5+
6+
Permission is hereby granted, free of charge, to any person obtaining a copy
7+
of this software and associated documentation files (the "Software"), to deal
8+
in the Software without restriction, including without limitation the rights
9+
to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
10+
copies of the Software, and to permit persons to whom the Software is
11+
furnished to do so, subject to the following conditions:
12+
13+
The above copyright notice and this permission notice shall be included in
14+
all copies or substantial portions of the Software.
15+
16+
THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
17+
IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
18+
FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
19+
AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
20+
LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
21+
OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
22+
THE SOFTWARE.

‎README.md‎

Lines changed: 137 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1 +1,137 @@
1-
# actions-codespell
1+
# Codespell with GitHub Actions -- including annotations for Pull Requests
2+
3+
This GitHub Actions runs codespell over your code.
4+
Any warnings or errors will be annotated in the Pull Request.
5+
6+
## Usage
7+
8+
```yml
9+
uses: step-security/actions-codespell@v2
10+
```
11+
12+
### Parameter: check_filenames
13+
14+
If set, check file names for spelling mistakes as well.
15+
16+
This parameter is optional; by default `codespell` will only check the file contents.
17+
18+
```yml
19+
uses: step-security/actions-codespell@v2
20+
with:
21+
check_filenames: true
22+
```
23+
24+
### Parameter: check_hidden
25+
26+
If set, check hidden files (those starting with ".") for spelling mistakes as well.
27+
28+
This parameter is optional; by default `codespell` will not check hidden files.
29+
30+
```yml
31+
uses: step-security/actions-codespell@v2
32+
with:
33+
check_hidden: true
34+
```
35+
36+
### Parameter: exclude_file
37+
38+
File with lines that should not be checked for spelling mistakes.
39+
40+
This parameter is optional; by default `codespell` will check all lines.
41+
42+
```yml
43+
uses: step-security/actions-codespell@v2
44+
with:
45+
exclude_file: src/foo
46+
```
47+
48+
### Parameter: skip
49+
50+
Comma-separated list of files to skip (it accepts globs as well).
51+
52+
This parameter is optional; by default `codespell` won't skip any files.
53+
54+
```yml
55+
uses: step-security/actions-codespell@v2
56+
with:
57+
skip: foo,bar
58+
```
59+
60+
### Parameter: builtin
61+
62+
Comma-separated list of builtin dictionaries to use.
63+
64+
This parameter is optional; by default `codespell` will use its default selection of built in dictionaries.
65+
66+
```yml
67+
uses: step-security/actions-codespell@v2
68+
with:
69+
builtin: clear,rare
70+
```
71+
72+
### Parameter: ignore_words_file
73+
74+
File that contains words which will be ignored by `codespell`. File must contain one word per line.
75+
Words are case sensitive based on how they are written in the dictionary file.
76+
77+
This parameter is optional; by default `codespell` will check all words for typos.
78+
79+
```yml
80+
uses: step-security/actions-codespell@v2
81+
with:
82+
ignore_words_file: .codespellignore
83+
```
84+
85+
### Parameter: ignore_words_list
86+
87+
Comma-separated list of words which will be ignored by `codespell`.
88+
Words are case sensitive based on how they are written in the dictionary file.
89+
90+
This parameter is optional; by default `codespell` will check all words for typos.
91+
92+
```yml
93+
uses: step-security/actions-codespell@v2
94+
with:
95+
ignore_words_list: abandonned,ackward
96+
```
97+
98+
### Parameter: uri_ignore_words_list
99+
100+
Comma-separated list of words which will be ignored by `codespell` in URIs and emails only.
101+
Words are case sensitive based on how they are written in the dictionary file.
102+
If set to "*", all misspelling in URIs and emails will be ignored.
103+
104+
This parameter is optional; by default `codespell` will check all URIs and emails for typos.
105+
106+
```yml
107+
uses: step-security/actions-codespell@v2
108+
with:
109+
uri_ignore_words_list: abandonned
110+
```
111+
112+
### Parameter: path
113+
114+
Indicates the path to run `codespell` in.
115+
This can be useful if your project has code you don't want to spell check for some reason.
116+
117+
This parameter is optional; by default `codespell` will run on your whole repository.
118+
119+
```yml
120+
uses: step-security/actions-codespell@v2
121+
with:
122+
path: src
123+
```
124+
125+
### Parameter: only_warn
126+
127+
Only warn about problems.
128+
All errors and warnings are annotated in Pull Requests, but it will act like everything was fine anyway.
129+
(In other words, the exit code is always 0.)
130+
131+
This parameter is optional; setting this to any value will enable it.
132+
133+
```yml
134+
uses: step-security/actions-codespell@v2
135+
with:
136+
only_warn: 1
137+
```

‎SECURITY.md‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,5 @@
1+
# Security Policy
2+
3+
## Reporting a Vulnerability
4+
5+
Please report security vulnerabilities to [email protected]

0 commit comments

Comments
 (0)