ci: add typos spell checker

.github/workflows/typos.yaml

@@ -0,0 +1,24 @@
+name: Typos
+
+# Spell checks every file in the repo with typos (config in .typos.toml). Complements the misspell
+# linter in golangci-lint, which only sees Go files.
+
+on:
+  push:
+    branches: [ 'main' ]
+  pull_request:
+    types: ['opened', 'synchronize']
+
+permissions:
+  contents: read
+
+concurrency:
+  group: 'typos-${{ github.head_ref || github.ref }}'
+  cancel-in-progress: true
+
+jobs:
+  typos:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - run: make typos

.typos.toml

@@ -0,0 +1,31 @@
+# Configuration for typos (https://github.com/crate-ci/typos), run by `make typos` and
+# .github/workflows/typos.yaml. It checks every file type (Go, markdown, YAML, shell, makefile),
+# splitting identifiers so misspelled function and variable names are caught too - misspell in
+# golangci-lint only sees Go files and enforces UK spelling in comments; typos stays on the default
+# locale because en-gb flags US spellings baked into identifiers, headers, and the licence text.
+
+[files]
+ignore-hidden = false # the default skips dotfiles, which would leave .github/ workflows unchecked
+extend-exclude = [
+  ".git/",
+  ".claude/",
+  ".idea/",
+  ".tools/bin/",  # gitignored built tools
+  ".tools/venv/", # gitignored python venv
+  "**/vendor/",   # third-party code
+  "**/go.sum",    # hashes
+  "lib/diff/diffmatchpatch/", # forked third-party code (sergi/go-diff), exempted in .golangci.yml too
+]
+
+[default]
+extend-ignore-re = [
+  # go.mod pseudo-versions (vX.Y.Z-yyyymmddhhmmss-hash, vX.Y.Z-0.yyyymmddhhmmss-hash, vX.Y.Z-pre.0.yyyymmddhhmmss-hash)
+  # end in a commit hash typos tries to read
+  'v\d+\.\d+\.\d+-(\S+\.)?\d{14}-[0-9a-f]{12}',
+]
+
+[default.extend-words]
+# words typos would otherwise "correct" - keep this list short and explain each entry
+decorder = "decorder" # golangci linter name
+importas = "importas" # golangci linter name
+intoto = "intoto"     # in-toto attestation files published by goreleaser

.yamllint.yml

@@ -4,6 +4,7 @@ extends: default
 ignore:
   - vendor/
   - dist/
+  - .tools/venv/ # gitignored python venv, yamllint's own bundled configs live in here
 
 rules:
   comments:

CHANGELOG.md

@@ -62,9 +62,9 @@
 - add support for `return '` blocks ([#39](https://github.com/katbyte/terrafmt/issues/39))
 - use terraform-exec to manage the terraform executable ([#36](https://github.com/katbyte/terrafmt/issues/36))
 - returns actionable error codes ([#33](https://github.com/katbyte/terrafmt/issues/33))
-- suppot addtional go format verbs ([#31](https://github.com/katbyte/terrafmt/issues/31))
+- support additional go format verbs ([#31](https://github.com/katbyte/terrafmt/issues/31))
 - add option to mask go format versd with `-blocks` option ([#29](https://github.com/katbyte/terrafmt/issues/29))
-- the `blocks` command can now return blocks null-seperated ([#25](https://github.com/katbyte/terrafmt/issues/25))
+- the `blocks` command can now return blocks null-separated ([#25](https://github.com/katbyte/terrafmt/issues/25))
 - JSON output format for `blocks` command ([#23](https://github.com/katbyte/terrafmt/issues/23))
 - tolerate whitespace at the beginning of the first line ([#12](https://github.com/katbyte/terrafmt/issues/12))
 - include the terraform version in the output of `version` ([#8](https://github.com/katbyte/terrafmt/issues/8))

makefile

@@ -13,11 +13,13 @@ GOFUMPT=$(TOOLS_BIN)/gofumpt
 GOLANGCI_LINT=$(TOOLS_BIN)/golangci-lint
 
 # non-Go tools also live in .tools/bin at pinned versions, but the pins are here (dependabot
-# cannot bump them): shellcheck is a static haskell binary downloaded from its github release,
-# yamllint is python installed into a repo-local venv. both rebuild when this makefile changes.
+# cannot bump them): shellcheck and typos are static binaries downloaded from their github releases,
+# yamllint is python installed into a repo-local venv. all rebuild when this makefile changes.
 SHELLCHECK_VERSION=v0.11.0
+TYPOS_VERSION=v1.50.1
 YAMLLINT_VERSION=1.38.0
 SHELLCHECK=$(TOOLS_BIN)/shellcheck
+TYPOS=$(TOOLS_BIN)/typos
 YAMLLINT=$(TOOLS_BIN)/yamllint
 
 # golangci-lint with the azproviderlint module plugin compiled in (.tools/.custom-gcl.yml);
@@ -42,6 +44,14 @@ $(SHELLCHECK): makefile
 		curl -sSfL "https://github.com/koalaman/shellcheck/releases/download/$(SHELLCHECK_VERSION)/shellcheck-$(SHELLCHECK_VERSION).$$os.$$arch.tar.xz" \
 		| tar -xJ -O shellcheck-$(SHELLCHECK_VERSION)/shellcheck > $@ && chmod +x $@
 
+$(TYPOS): makefile
+	@echo "==> downloading typos $(TYPOS_VERSION)..."
+	@mkdir -p $(TOOLS_BIN)
+	@case "$$(uname)" in Darwin) target=apple-darwin;; *) target=unknown-linux-musl;; esac; \
+		arch=$$(uname -m); [ "$$arch" = "arm64" ] && arch=aarch64; \
+		curl -sSfL "https://github.com/crate-ci/typos/releases/download/$(TYPOS_VERSION)/typos-$(TYPOS_VERSION)-$$arch-$$target.tar.gz" \
+		| tar -xz -O ./typos > $@ && chmod +x $@
+
 $(YAMLLINT): makefile
 	@command -v python3 >/dev/null || (echo "python3 is required to install yamllint (macOS: xcode CLT; Debian/Ubuntu: apt install python3-venv)" && exit 1)
 	@echo "==> installing yamllint $(YAMLLINT_VERSION) into .tools/venv..."
@@ -64,7 +74,7 @@ install: ## Install terrafmt into GOPATH/bin with version info from git
 	@echo "==> installing..."
 	go install -ldflags "-X github.com/katbyte/terrafmt/lib/version.GitCommit=${GIT_COMMIT} -X github.com/katbyte/terrafmt/lib/version.Version=${GIT_VERSION}" .
 
-tools: $(ACTIONLINT) $(GOFUMPT) $(GOLANGCI_LINT) $(GOLANGCI_LINT_MODULES) $(SHELLCHECK) $(YAMLLINT) ## Install all pinned dev tools into .tools/bin
+tools: $(ACTIONLINT) $(GOFUMPT) $(GOLANGCI_LINT) $(GOLANGCI_LINT_MODULES) $(SHELLCHECK) $(TYPOS) $(YAMLLINT) ## Install all pinned dev tools into .tools/bin
 
 ##@ Formatting
 fmt: $(GOFUMPT) $(GOLANGCI_LINT) ## Fix Go formatting (gofmt, gofumpt, goimports)
@@ -100,6 +110,14 @@ shellcheck: $(SHELLCHECK) ## Check shell scripts with shellcheck
 	@echo "==> Checking shell scripts with shellcheck..."
 	@$(SHELLCHECK) scripts/*.sh
 
+typos: $(TYPOS) ## Check all files for spelling mistakes with typos (config in .typos.toml)
+	@echo "==> Checking for typos..."
+	@$(TYPOS)
+
+typos-fix: $(TYPOS) ## Fix spelling mistakes found by typos
+	@echo "==> Fixing typos..."
+	@$(TYPOS) --write-changes
+
 depscheck: ## Check that go.mod/go.sum and vendor/ are in sync
 	@echo "==> Checking source code with go mod tidy..."
 	@go mod tidy
@@ -127,6 +145,6 @@ check-against-providers: ## Check formatting against real provider repos (golden
 	@echo "==> Checking against real provider repos (golden vs main + idempotency)..."
 	./scripts/check-against-providers.sh
 
-check-all: build test lint actionlint yamllint shellcheck depscheck ## Run build + test + all linters + depscheck
+check-all: build test lint actionlint yamllint shellcheck typos depscheck ## Run build + test + all linters + depscheck
 
-.PHONY: default all help fmt goimports build lint lint-fix actionlint yamllint shellcheck depscheck check-against-providers check-all install tools test
+.PHONY: default all help fmt goimports build lint lint-fix actionlint yamllint shellcheck typos typos-fix depscheck check-against-providers check-all install tools test