name: Spell check

# Gate every PR (and pushes to main) on the `typos` spell checker so prose and
# source typos are caught even when contributors haven't installed the local
# pre-commit hook. Uses the same typos.toml config as the hook, so CI and local
# runs stay in lockstep.
#
# The action is pinned to a tagged release (not `@master`) so the gate is
# reproducible — a new typos dictionary entry can't turn a green PR red without
# a visible version bump here. The weekly scheduled run keeps the gate exercised
# against `main` so dependency drift surfaces on its own cadence, not inside an
# unrelated PR.

on:
  pull_request:
  push:
    branches: [main]
  schedule:
    # Mondays at 06:00 UTC — keep the spell-check gate current against main.
    - cron: "0 6 * * 1"

# Restrict the default GITHUB_TOKEN to read-only; this workflow only needs to
# check out the repo to run the typos spell checker.
permissions:
  contents: read

# Cancel a stale run when a PR gets a new push, matching lint.yml's behavior
# so superseded spell-check runs don't pile up and burn CI minutes.
concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: true

jobs:
  typos:
    name: typos
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0

      - name: Spell check with typos
        uses: crate-ci/typos@bee27e3a4fd1ea2111cf90ab89cd076c870fce14 # v1.48.0
