Update check-spelling/check-spelling action to v0.0.26

[renovate]

This PR contains the following updates:

Package	Type	Update	Change
check-spelling/check-spelling	action	patch	v0.0.23 → v0.0.26

---

Release Notes

check-spelling/check-spelling (check-spelling/check-spelling)

v0.0.26: Release 0.0.26 (Immutable)

Compare Source

⏩ Upgrading

• 🧪 Test first on a branch 🏷️ by changing your workflow tags/references to this release
• See 🐣 Breaking Changes for how to adapt your workflow
• See 🐛 Known Issues for known issues

🐣 Breaking Changes

• The output for truncated items in logs is now wrapped to 15 "words" per line to make GitHub's pattern matchers happy (this shouldn't impact anyone, but if you're parsing logs, you may notice -- you should use the generated artifact instead).
• Commit instructions are now generated using apply.pl (unifying code) -- this may result in different commit suggestions than previous versions.
• Dropped support for custom_task (use task instead)
• Changed stem handling for words like GC'd (previously they didn't work well because GC was smaller than the default minimum word length)
• If you use allowing-select-actions-and-reusable-workflows-to-run, you will need to include:

  check-spelling/checkout-merge@c9cfe4b33a6ceb6c13136887a6fd3a3ed6443f28 # v0.0.8 

  Bear in mind that you'll want to add it as: check-spelling/checkout-merge@c9cfe4b33a6ceb6c13136887a6fd3a3ed6443f28, -- the lack of a trailing comma will result in GitHub rejecting it and will leave you scratching your head (#​104)

✨ New Features

• 🏴 Flag homoglyphs in words
• 🇹 Check images
• ⚙️ config.json for defining configuration using json instead of in workflows. This should make it easier to merge configuration/use unified configuration. It also enables load-config-from
• ⚙️ load-config-from -- GitHub changed the behavior of workflows running via pull_request_target to rely on the default branch for configuration. You can use this setting to allow interpreting specific settings from config.json from the base branch (or the head branch).
• ℹ️ Unused configuration file warning
• ⏭️ Ignore next line
• Duplicate Pattern detection

Fixes

• Permission check for pull requests from forks -- GitHub broke an API at the beginning of April 2026
• Ignore suppress_push_for_open_pull_request when pull requests are disabled
• Git config is no longer edited
• Fix GitHub code scanning detection -- GitHub changed the response previously used to identify its availability
• Waits for hunspell dictionary downloads to resolve before proceeding to check spelling

Improvements

• Switched to using UTF8
• Switched from :...: to unicode emoji
• Improved pattern parsing and handling of broken patterns
• Removed most use of rsync
• Comment task no longer requires a checkout (all information is produced in the spelling task and packaged in the artifact)
• Added allow-hunspell -- for use as allow-hunspell: false to disable hunspell support
• Improved YAML parsing
• Candidate and Forbidden Patterns will now automatically expand if there are only one or two

Messages

• Harmonized messages and error codes

SARIF

• Added additional escapes to make GitHub -> VS Code integration
• Improved error handling
• Enhanced descriptions & advice for messages

Apply

• Improved error handling (including 502)
• Improved handling of nonexistent files
• Favor curl over gh
• Suppress gh update checks
• Improved bug reporting advice

Checkout

• Improved error handling for failed checkouts

Git

• Improved submodule handling

Testing

• Enhanced coverage reporting and collection

Upgrade components

• checkout-merge@​v0.0.8
• gh-program-downloader@​v0.0.5
• actions/checkout@​v6
• actions/upload-artifact@​v7

🐛 Known Issues

Problematic

• Short words ending with 'd may appear as unrecognized words without suggestions, e.g., esc'd

Harmless

You may see:

Removing issue matcher 'check-spelling-perl-matches-null-string-in-regex'. Matcher failed 3 times. Error: The Regex engine has timed out while trying to match a pattern to an input string. This can occur for many reasons, including very large inputs or excessive backtracking caused by nested quantifiers, back-references and other factors.

Annoying

ignored-expect-variant

If you see ignored-expect-variant and it feels like a false positive, you can use:

ignored: ignored-expect-variant

or just add the items to allow.txt

Full Changelog

Full Changelog: check-spelling/check-spelling@v0.0.25...v0.0.26

v0.0.25: Release 0.0.25

Compare Source

⚠️ GitHub 2026-04 breaking changes

• check-spelling refuses to start because a failsafe incorrectly determined that it should fail #​103. The next version of check-spelling will rework this and should be released within the next few days.

⚠️ GitHub 2025-12 breaking changes

pull_request_target configuration is no longer honored by the base branch, it's now taken from the default branch. The next version of check-spelling will rework this.

⏩ Upgrading

• 🧪 Test first on a branch 🏷️ by changing your workflow tags/references to this release
• See 🐣 Breaking Changes for how to adapt your workflow
• See 🐛 Known Issues for known issues

🐣 Breaking Changes

• Code Scanning action requires a Code Scanning Ruleset
  If you use SARIF reporting, then instead of the workflow yielding an ❌ when it fails, it will rely on github-advanced-security 🤖 to report the failure. You will need to adjust your checks for PRs.
  • If you are using use_sarif: ... and are using a ruleset, you'll want to change the value to use_sarif: 1 instead of a complicated rule, because otherwise github-advanced-security will only run sometimes and that will make PRs unmergable.
• Dropping support for on: schedule
• Dropping support for whitelist.txt and advice.txt
• Dropping support for out of tree project files
• Dependent actions are referenced by full sha instead of version -- if you're using Allow specified actions and reusable workflows, you will need to add:
  • check-spelling/checkout-merge@46bad523dcb6368efab50ff2729c00443785abca (if you run on: pull_request/on: pull_request_target and use with:/checkout: true)

✨ New Features

• Check submodules using submodules
• Provide instructions for when only_check_changed_files finds unrecognized words (#​86)
• Support unknown_file_word_limit to limit the number of times a path in a filename is reported when using check_file_names
• Suggest checkout: true for new missing-checkout error case
• Suggest ignoring files that trigger single-line-file

Dictionaries

• Fix fallback-dictionary-not-found handling

Hunspell dictionaries

• Fix support for .dic/.aff dictionaries by installing hunspell as needed (#​79 / #​90)
• Ensure that Spanish works (a consumer is using this, so it should work reliably)

Fixes

• macOS: Consistently use check-spelling dictionary instead of looking at the system dictionary (#​84)
• Fix check_for_newline_at_eof for allow.txt (#​81)
• Improve handling of inputs.ignored events
• Fix inputs.debug handling
• Fix merge instructions order
• Fix pattern for validating expect entries
• Fix noisy-file-list handling
• Fix 504 handling for only_check_changed_files when unshallowing
• Restore comment (#) support for expect files
• Include last character in token-is-substring warning

Improvements

• Line ending detection (#​83)
• RSQM handling
• Dictionary download times by skipping delays for 30x redirects
• Excludes paths generation
• Error handling of various components
• Documentation links
• GitHub error detection patterns for when check-spelling has bugs
• Handling of We'd

Messages

• Improve use of `s
  • Remove them from Line for candidate-pattern
  • Add them with better escaping for more user content
• Treat ignored-expect-variant as a warning

SARIF

• Switch to talking to /code-scanning/analysis directly
• Properly encode # in filenames (#​82)
• Stop trying to publish SARIF for commits from other repositories
• Use note severity for no-files-to-check
• Support defaultConfiguration.level when problem.severity is absent
• Add additional fields
• Only include used rules

Candidate patterns

• Suggest using # to suppress candidates (you can do this for forbidden patterns too, but this version won't suggest that)

Apply

• Improve error handling

Summary Tables

• List all present event classes at the top level
• Support cross repository pull requests

Checkout

• Suppress useless message about default branch
• Add failed checkout diagnostics
• Limit checkout credentials (#​91)

Testing

• Replace jd with Test::More::is_deeply
• Improve test suite and test coverage
• Work to consistently order output

Upgrade components

• checkout-merge@​v0.0.7
• gh-program-downloader@​v0.0.4

🐛 Known Issues

• If you use Allow specified actions and reusable workflows, if you run on: pull_request/on: pull_requesrt_target and use with:/checkout: true, you will need to allow check-spelling/checkout-merge@46bad523dcb6368efab50ff2729c00443785abca otherwise you will probably encounter:

  Error: Missing download info for check-spelling/checkout-merge@46bad523dcb6368efab50ff2729c00443785abca
  

• act as of v0.2.77 is not supported with checkout: true (there's a PR to act to fix this)
• check-spelling sometimes (e.g., for slow-file-list) won't correctly suggest disabling check_file_names:, instead, it will suggest excluding a file in /tmp/check-spelling/GITHUB_OWNER/REPOSITORY_NAME/paths-of-checked-files.txt (likely escaped)

Full Changelog

Full Changelog: check-spelling/check-spelling@v0.0.24...v0.0.25

v0.0.24: Release 0.0.24

Compare Source

⚠️ GitHub 2026-04 breaking changes

• check-spelling refuses to start because a failsafe incorrectly determined that it should fail #​103. The v0.0.26 of check-spelling will rework this and should be released within the next few days.

⏩ Upgrading

• 🏷️ Test first on a branch by changing your workflow tags/references to this release. See 🐣 Breaking Changes for how to adapt your workflow.
• 🐛 See Known Issues for known issues

✨ Highlights

• SARIF reporting should work for push events and workflows that use checkout: true
• If you use a second job for commenting and the most recent comment was collapsed in response to a previous commit and the latest commit doesn't trigger a new comment, a new job will be not be dispatched
• Files with Mac OS classic line endings (\r) should be properly handled (previously they'd erroneously trigger a minified-file warning)

🐛 Known issues

Check the list of regressions with target milestone v0.0.25 for more information about issues that should be fixed soon.

• Hunspell dictionary (any extra dictionary that ends in .dic) support is broken #​79
• expect files are corrupted when using ignore-pattern #​80
• expect files with lines with comments (#) trigger errors -- note that automatic sorting moves the # lines to the top making them fairly useless so using comments isn't really recommended anyway.
• SARIF reporting will not report file names if the path to the file includes # #​82
• Files with Windows line endings may not be properly detected if there's a line ending at bytes 4096/4097 of the file resulting in character offset reporting being shifted by +1 character #​83
• Running the check-spelling action on Windows runners doesn't work
  • This appears to be an incompatibility involving StrawberryPerl, cpanm, and ExtUtils::Manifest
  • Note that running check-spelling on a GitHub hosted runner other than ubuntu-* doesn't really
    make sense as the Windows and macOS runners are much more expensive per minute and check-spelling
    itself doesn't need any facilities from the OS -- it should be checking the spelling of files
    as they are present in commits.
  • While the check-spelling action won't work on Windows, apply.pl and the output check-spelling produces are expected to work on Windows.

Full Changelog

---

Configuration

📅 Schedule: (in timezone Europe/London)

• Branch creation
  • "after 7am and before 11am every weekday"
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[github-actions]

@check-spelling-bot Report

🔴 Please review

See the 📂 files view, the 📜action log, or 📝 job summary for details.

Unrecognized words (4)

optimisation
prioritisation
roadmap
webpage

To accept these unrecognized words as correct, you could run the following commands

... in a clone of the git@github.com:hmcts/hmcts.github.io.git repository
on the renovate/check-spelling-check-spelling-0.x branch (ℹ️ how do I use this?):

curl -s -S -L 'https://raw.githubusercontent.com/check-spelling/check-spelling/v0.0.24/apply.pl' |
perl - 'https://github.com/hmcts/hmcts.github.io/actions/runs/11631456446/attempts/1'

---

🖊️ Please consider adding a word to the allow list if it is flagged as a spelling error but is genuinely used within the project.
🤔 Think we might see a flagged mistake in another PR in the future? Please consider adding it as an expected pattern.