From 6ef5eea2dee530b44210ac99f2220618afb8c76c Mon Sep 17 00:00:00 2001 From: Thomas Vincent Date: Mon, 12 Oct 2026 21:48:47 -0700 Subject: [PATCH 1/3] ci: lock spelling dependencies and disable checkout credentials Signed-off-by: Thomas Vincent --- .github/codespell-requirements.in | 1 + .github/codespell-requirements.txt | 4 ++++ .github/dependabot.yml | 8 ++++++++ .github/workflows/spelling.yml | 5 ++++- 4 files changed, 17 insertions(+), 1 deletion(-) create mode 100644 .github/codespell-requirements.in create mode 100644 .github/codespell-requirements.txt diff --git a/.github/codespell-requirements.in b/.github/codespell-requirements.in new file mode 100644 index 00000000..1bb55fb1 --- /dev/null +++ b/.github/codespell-requirements.in @@ -0,0 +1 @@ +codespell==2.4.1 diff --git a/.github/codespell-requirements.txt b/.github/codespell-requirements.txt new file mode 100644 index 00000000..9d3a533a --- /dev/null +++ b/.github/codespell-requirements.txt @@ -0,0 +1,4 @@ +codespell==2.4.1 \ + --hash=sha256:299fcdcb09d23e81e35a671bbe746d5ad7e8385972e65dbb833a2eaac33c01e5 \ + --hash=sha256:3dadafa67df7e4a3dbf51e0d7315061b80d265f9552ebd699b3dd6834b47e425 + # via -r .github/codespell-requirements.in diff --git a/.github/dependabot.yml b/.github/dependabot.yml index 7a1f5fae..95ac26a0 100644 --- a/.github/dependabot.yml +++ b/.github/dependabot.yml @@ -10,3 +10,11 @@ updates: github-actions: {patterns: ["*"]} labels: [dependencies, github-actions] commit-message: {prefix: ci, include: scope} + - package-ecosystem: pip + directory: /.github + schedule: {interval: weekly, day: friday} + open-pull-requests-limit: 5 + cooldown: {default-days: 7} + groups: + python-tools: {patterns: ["*"], update-types: [minor, patch]} + commit-message: {prefix: deps, include: scope} diff --git a/.github/workflows/spelling.yml b/.github/workflows/spelling.yml index 334a0238..c5738995 100644 --- a/.github/workflows/spelling.yml +++ b/.github/workflows/spelling.yml @@ -11,13 +11,16 @@ permissions: jobs: codespell: + timeout-minutes: 15 runs-on: ubuntu-latest steps: - name: Checkout uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 + with: + persist-credentials: false - name: Install codespell - run: pip install codespell==2.4.1 + run: python3 -m pip install --require-hashes -r .github/codespell-requirements.txt - name: Run codespell run: codespell --config .codespell.cfg From d2c6b66538acd3ad088bb0ea6dcf5138602f7f69 Mon Sep 17 00:00:00 2001 From: Thomas Vincent Date: Sat, 17 Oct 2026 12:57:38 -0700 Subject: [PATCH 2/3] ci: install spelling dependencies from wheels only Signed-off-by: Thomas Vincent --- .github/workflows/spelling.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/spelling.yml b/.github/workflows/spelling.yml index c5738995..b99f7f81 100644 --- a/.github/workflows/spelling.yml +++ b/.github/workflows/spelling.yml @@ -20,7 +20,7 @@ jobs: persist-credentials: false - name: Install codespell - run: python3 -m pip install --require-hashes -r .github/codespell-requirements.txt + run: python3 -m pip install --only-binary :all: --require-hashes -r .github/codespell-requirements.txt - name: Run codespell run: codespell --config .codespell.cfg From 85e07fd0bfe2d6b9cc57337626328b511b328a3e Mon Sep 17 00:00:00 2001 From: Thomas Vincent Date: Sat, 17 Oct 2026 13:22:39 -0700 Subject: [PATCH 3/3] ci: quote the spelling install command and add target branch Signed-off-by: Thomas Vincent --- .github/dependabot.yml | 1 + .github/workflows/spelling.yml | 4 ++-- 2 files changed, 3 insertions(+), 2 deletions(-) diff --git a/.github/dependabot.yml b/.github/dependabot.yml index 95ac26a0..f719d6b4 100644 --- a/.github/dependabot.yml +++ b/.github/dependabot.yml @@ -12,6 +12,7 @@ updates: commit-message: {prefix: ci, include: scope} - package-ecosystem: pip directory: /.github + target-branch: develop schedule: {interval: weekly, day: friday} open-pull-requests-limit: 5 cooldown: {default-days: 7} diff --git a/.github/workflows/spelling.yml b/.github/workflows/spelling.yml index b99f7f81..62663605 100644 --- a/.github/workflows/spelling.yml +++ b/.github/workflows/spelling.yml @@ -15,12 +15,12 @@ jobs: runs-on: ubuntu-latest steps: - name: Checkout - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 with: persist-credentials: false - name: Install codespell - run: python3 -m pip install --only-binary :all: --require-hashes -r .github/codespell-requirements.txt + run: "python3 -m pip install --only-binary :all: --require-hashes -r .github/codespell-requirements.txt" - name: Run codespell run: codespell --config .codespell.cfg