ci: 👷 update-checks-n-typos

.typos.toml → .config/typos.toml

@@ -1,14 +1,12 @@
 [files]
 extend-exclude = [
   "*.html",
-  "*.json",
-  "*.log",
-  "*.tex",
   "*.css",
-  "*.svg",
+  "*.json",
   ".quarto/*",
   "_site/*",
   "_book/*",
   "_extensions/*",
+  "*.svg",
   "*.bib",
 ]

.github/workflows/build-website.yml

@@ -28,9 +28,6 @@ jobs:
       - name: Check out repository
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
-      - name: Spell check repo
-        uses: crate-ci/typos@bee27e3a4fd1ea2111cf90ab89cd076c870fce14 # v1.48.0
-
       - name: Set up Quarto
         uses: quarto-dev/quarto-actions/setup@8a96df13519ee81fd526f2dfca5962811136661b # v2.2.0
 

.github/workflows/checks.yml

@@ -0,0 +1,97 @@
+name: Checks
+
+on: pull_request
+
+permissions: read-all
+
+jobs:
+  check-template:
+    runs-on: ubuntu-latest
+    steps:
+      # This is a useful security step to check for unexpected outbound calls from the runner,
+      # which could indicate a compromised token or runner.
+      - name: Harden the runner (Audit all outbound calls)
+        uses: step-security/harden-runner@20cf305ff2072d973412fa9b1e3a4f227bda3c76 # v2.14.0
+        with:
+          egress-policy: audit
+
+      - name: Checkout repository
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+
+      - name: Set up uv
+        uses: astral-sh/setup-uv@08807647e7069bb48b6ef5acd8ec9567f424441b # v8.1.0
+        with:
+          enable-cache: true
+
+      - name: Install justfile
+        run: uv tool install rust-just
+
+      # Set this user so that the checks create Git commits.
+      - name: Set bot user
+        run: |
+          git config --global user.name "github-actions[bot]"
+          git config --global user.email "41898282+github-actions[bot]@users.noreply.github.com"
+
+      # TODO: Confirm name of recipe to check template creation.
+      - name: Check template creation
+        run: just test-all
+
+  check-typos:
+    runs-on: ubuntu-latest
+    steps:
+      # This is a useful security step to check for unexpected outbound calls from the runner,
+      # which could indicate a compromised token or runner.
+      - name: Harden the runner (Audit all outbound calls)
+        uses: step-security/harden-runner@20cf305ff2072d973412fa9b1e3a4f227bda3c76 # v2.14.0
+        with:
+          egress-policy: audit
+
+      - name: Checkout repository
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+
+      - name: Spell check repo
+        uses: crate-ci/typos@cf5f1c29a8ac336af8568821ec41919923b05a83 # v1.45.1
+        with:
+          config: .config/typos.toml
+
+  check-website-build:
+    runs-on: ubuntu-latest
+    steps:
+      # This is a useful security step to check for unexpected outbound calls from the runner,
+      # which could indicate a compromised token or runner.
+      - name: Harden the runner (Audit all outbound calls)
+        uses: step-security/harden-runner@20cf305ff2072d973412fa9b1e3a4f227bda3c76 # v2.14.0
+        with:
+          egress-policy: audit
+
+      - name: Checkout repository
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+
+      - name: Set up Quarto
+        uses: quarto-dev/quarto-actions/setup@8a96df13519ee81fd526f2dfca5962811136661b # v2.2.0
+
+      # Check that the website builds, but don't publish it
+      - name: Render Quarto Project
+        uses: quarto-dev/quarto-actions/render@8a96df13519ee81fd526f2dfca5962811136661b # v2.2.0
+
+  # Dependency Review Action
+  #
+  # This Action will scan dependency manifest files that change as part of a Pull Request,
+  # surfacing known-vulnerable versions of the packages declared or updated in the PR.
+  # Once installed, if the workflow run is marked as required,
+  # PRs introducing known-vulnerable packages will be blocked from merging.
+  #
+  # Source repository: https://github.com/actions/dependency-review-action
+  check-dependencies:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Harden the runner (Audit all outbound calls)
+        uses: step-security/harden-runner@20cf305ff2072d973412fa9b1e3a4f227bda3c76 # v2.14.0
+        with:
+          egress-policy: audit
+
+      - name: "Checkout Repository"
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+
+      - name: "Dependency Review"
+        uses: actions/dependency-review-action@3c4e3dcb1aa7874d2c16be7d79418e9b7efd6261 # v4.8.2

.pre-commit-config.yaml

@@ -10,30 +10,26 @@ repos:
     hooks:
       - id: gitleaks
 
-  - repo: https://github.com/pre-commit/pre-commit-hooks
-    rev: v6.0.0
-    hooks:
-      - id: trailing-whitespace
-      - id: end-of-file-fixer
-      - id: mixed-line-ending
-        args: [ --fix=lf ]
-      - id: check-merge-conflict
-        args: [ --assume-in-merge ]
-
-  - repo: https://github.com/commitizen-tools/commitizen
-    rev: v4.17.1
-    hooks:
-      - id: commitizen
-
   # Use the mirror since the main `typos` repo has tags for different
   # sub-packages, which confuses pre-commit when it tries to find the latest
   # version
   - repo: https://github.com/adhtruong/mirrors-typos
-    rev: v1.49.0
+    rev: v1.45.1
     hooks:
       - id: typos
+        args: [--config, .config/typos.toml, --force-exclude]
+
+  - repo: https://github.com/jolars/panache-pre-commit
+    rev: v2.51.0
+    hooks:
+      - id: panache-format
 
-  - repo: https://github.com/rvben/rumdl-pre-commit
-    rev: v0.2.55
+  - repo: https://github.com/pre-commit/pre-commit-hooks
+    rev: v6.0.0
     hooks:
-      - id: rumdl-fmt # Auto-format
+      - id: trailing-whitespace
+      - id: end-of-file-fixer
+      - id: mixed-line-ending
+        args: [--fix=lf]
+      - id: check-merge-conflict
+        args: [--assume-in-merge]

.vscode/settings.json

@@ -26,6 +26,7 @@
     "*.qmd.jinja": "jinja-md"
   },
   "files.insertFinalNewline": true,
+  "typos.config": ".config/typos.toml",
   "conventionalCommits.emojiFormat": "emoji",
   "conventionalCommits.promptScopes": false
 }

404.qmd

@@ -2,5 +2,5 @@
 title: "The page you are looking for does not exist"
 ---
 
-This page does not exist, go back to the [homepage](/index.qmd) or check
-the URL for typos.
+This page does not exist, go back to the [homepage](/index.qmd) or check the URL
+for typos.

CHANGELOG.md

@@ -1 +0,0 @@
-<!-- Will be overwritten by git-cliff. -->

CODE_OF_CONDUCT.md

@@ -1,28 +1,25 @@
 # Contributor Code of Conduct
 
-As contributors and maintainers of this project, we pledge to respect
-all people who contribute through reporting issues, posting suggestions,
-updating any material, submitting pull requests, and other activities.
+As contributors and maintainers of this project, we pledge to respect all people
+who contribute through reporting issues, posting suggestions, updating any
+material, submitting pull requests, and other activities.
 
-We are committed to making participation in this project a
-harassment-free experience for everyone, regardless of level of
-experience, gender, gender identity and expression, sexual orientation,
-disability, personal appearance, body size, race, ethnicity, age, or
-religion.
+We are committed to making participation in this project a harassment-free
+experience for everyone, regardless of level of experience, gender, gender
+identity and expression, sexual orientation, disability, personal appearance,
+body size, race, ethnicity, age, or religion.
 
-Examples of unacceptable behavior by participants include the use of
-sexual language or imagery, derogatory comments or personal attacks,
-trolling, public or private harassment, insults, or other unprofessional
-conduct.
+Examples of unacceptable behavior by participants include the use of sexual
+language or imagery, derogatory comments or personal attacks, trolling, public
+or private harassment, insults, or other unprofessional conduct.
 
-Project maintainers have the right and responsibility to remove, edit,
-or reject comments, commits, code, wiki edits, issues, and other
-contributions that are not aligned to this Code of Conduct. Project
-maintainers who do not follow the Code of Conduct may be removed from
-the project team.
+Project maintainers have the right and responsibility to remove, edit, or reject
+comments, commits, code, wiki edits, issues, and other contributions that are
+not aligned to this Code of Conduct. Project maintainers who do not follow the
+Code of Conduct may be removed from the project team.
 
-Instances of abusive, harassing, or otherwise unacceptable behavior may
-be reported by opening an issue or contacting one or more of the project
+Instances of abusive, harassing, or otherwise unacceptable behavior may be
+reported by opening an issue or contacting one or more of the project
 maintainers.
 
 This Code of Conduct is adapted from the Contributor Covenant