Adding typos crate with typos.toml, update and pin other actions

Author: Maleware

.pre-commit-config.yaml

@@ -5,8 +5,18 @@ default_language_version:
 exclude: '(stacks/_templates/minio-.*/rendered-chart\.yaml|\.svg)$'
 
 repos:
+  - repo: https://github.com/crate-ci/typos
+    rev: 00f422f3b19c57bc6338715ebfe3316d38768461 # v1.50.3
+    hooks:
+      - id: typos
+        # Drop the upstream default `--write-changes` so the hook reports and
+        # fails instead of rewriting files.
+        # Keep `--force-exclude` so the
+        # excludes in typos.toml still apply to the paths prek passes in.
+        args: ["--force-exclude"]
+
   - repo: https://github.com/pre-commit/pre-commit-hooks
-    rev: v6.0.0 # 4.6.0
+    rev: 3e8a8703264a2f4a69428a0aa4dcb512790b2c8c # 6.0.0
     hooks:
       - id: trailing-whitespace
       - id: end-of-file-fixer
@@ -16,23 +26,23 @@ repos:
         exclude: '^stacks/argo-cd-git-ops/secrets/sealed-secrets-key\.yaml$'
 
   - repo: https://github.com/adrienverge/yamllint
-    rev: v1.37.1 # 1.35.1
+    rev: cba56bcde1fdd01c1deb3f945e69764c291a6530 # 1.38.0
     hooks:
       - id: yamllint
 
   - repo: https://github.com/igorshubovych/markdownlint-cli
-    rev: v0.46.0 # 0.41.0
+    rev: a4d5d37e66ebcd6b3705204a1d6dbb56dea66338 # 0.49.0
     hooks:
       - id: markdownlint
 
   - repo: https://github.com/koalaman/shellcheck-precommit
-    rev: v0.11.0 # 0.10.0
+    rev: 99470f5e12208ff0fb17ab81c3c494f7620a1d8d # 0.11.0
     hooks:
       - id: shellcheck
         args: ["--severity=info"]
 
   - repo: https://github.com/rhysd/actionlint
-    rev: e7d448ef7507c20fc4c88a95d0c448b848cd6127 # 1.7.8
+    rev: 914e7df21a07ef503a81201c76d2b11c789d3fca # 1.7.12
     hooks:
       - id: actionlint
 

typos.toml

@@ -0,0 +1,58 @@
+# Configuration for typos (https://github.com/crate-ci/typos), run via the prek
+# hook in .pre-commit-config.yaml.
+#
+# Before adding an entry here, consider an in-place marker instead. Use one when
+# the word is correct at this one site and would still be a typo elsewhere:
+#
+#   # spellchecker:disable-line       at the end of the line it applies to
+#   # spellchecker:ignore-next-line   on its own line, above the offending line
+#   # spellchecker:off / :on          around a block
+#
+# Every entry below gets a one-line comment saying what the word is.
+
+[files]
+# Bare `typos` skips hidden dirs by default, but prek passes explicit paths and
+# so does check them. Turn it off so both agree.
+ignore-hidden = false
+
+extend-exclude = [
+    # `.git` itself, which ignore-hidden = false would otherwise pull in.
+    ".git/",
+    # Generated by generate-embeddings-local.py from a crawl of
+    # docs.stackable.tech. Typos in it belong to the documentation repository.
+    "demos/opensearch-rag/embeddings/stackable-docs-embeddings.json",
+    # Base64-encoded demo key material, not prose.
+    "stacks/argo-cd-git-ops/secrets/sealed-secrets-key.yaml",
+]
+
+[default]
+# typos has no native suppression directive
+# (https://github.com/crate-ci/typos/issues/316), so these regexes provide one.
+# They cover `#`, `//`, `<!-- -->`, `;`, `/* */` and Jinja `{# #}` comments,
+# which spans every file type in this repo.
+#
+# Both failure modes are safe:
+#   * unterminated `:off` suppresses nothing rather than swallowing the rest of the file.
+#   * `disable-line` only matches when the marker ends the line.
+extend-ignore-re = [
+    "(?Rm)^.*(#|//|<!--|;|/\\*)\\s*spellchecker:disable-line\\s*(-->|#\\}|\\*/)?\\s*$",
+    "(#|//|<!--|;|/\\*)\\s*spellchecker:ignore-next-line\\s*(-->|#\\}|\\*/)?\\s*\\n.*",
+    "(?s)(#|//|<!--|;|/\\*|\")\\s*spellchecker:off\\s*(-->|#\\}|\\*/|\")?.*?(#|//|<!--|;|/\\*|\")\\s*spellchecker:on\\s*(-->|#\\}|\\*/|\")?",
+    # Random Kafka topic IDs in `kafka-topics.sh --describe` output. They sit
+    # inside AsciiDoc listing blocks, where a marker would render verbatim.
+    "TopicId:\\s*\\S+",
+]
+
+[type.jupyter]
+# Random notebook cell IDs. JSON has no comments, so no marker can go here.
+extend-ignore-re = [
+    "\"id\": \"[0-9a-z]+\"",
+]
+
+[default.extend-words]
+# Azure Kubernetes Service. Appears in docs/modules/demos/pages/argo-cd-git-ops.adoc.
+# A single lowercase entry covers every casing, so no separate `AKS` entry is needed.
+aks = "aks"
+# Apache Druid's ingestion row-stats field name, referenced verbatim in the
+# Druid demo docs.
+unparseable = "unparseable"