Skip to content
Closed
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
77 changes: 76 additions & 1 deletion scripts/check-typos
Original file line number Diff line number Diff line change
@@ -1,18 +1,93 @@
#!/usr/bin/env bash
#
# Script to check for typos in the Jenkins.io repository using the typos tool.
#
# This script supports the following options:
# --help, -h Display usage information and examples
# --verbose, -v Enable detailed output during typo checking
#
# Without any options, the script runs silently and only displays found typos.
#
# Usage examples:
# ./scripts/check-typos # Basic usage (silent mode)
# ./scripts/check-typos --help # Show help message
# ./scripts/check-typos --verbose # Show detailed progress

set -o errexit
set -o nounset
set -o pipefail

TYPOS_VERSION=v1.40.0
VERBOSE=0 # Set to 1 when --verbose flag is used

# Display help message with usage information and examples
show_help() {
cat << EOF
Usage: ./scripts/check-typos [OPTIONS]

Check for typos in the repository.

OPTIONS:
-h, --help Show this help message
-v, --verbose Show detailed output

EXAMPLES:
./scripts/check-typos
./scripts/check-typos --verbose

EOF
}

# Parse command-line arguments
# Supports --help/-h to display usage and --verbose/-v for detailed output
while [[ $# -gt 0 ]]; do
case $1 in
-h|--help)
# Display help message and exit
show_help
exit 0
;;
-v|--verbose)
# Enable verbose mode for detailed progress messages
VERBOSE=1
shift
;;
*)
# Handle unknown options gracefully
echo "Unknown option: $1"
echo "Use --help for usage information"
exit 1
;;
esac
done

# Download the typos binary from GitHub releases
# In verbose mode, shows a progress message during download
if [[ $VERBOSE -eq 1 ]]; then
echo "Downloading typos ${TYPOS_VERSION}..."
fi

if [[ $OSTYPE == darwin* ]] ; then
curl --disable --silent --show-error --location "https://github.com/crate-ci/typos/releases/download/${TYPOS_VERSION}/typos-${TYPOS_VERSION}-x86_64-apple-darwin.tar.gz" | tar xzf - ./typos
else
curl --disable --silent --show-error --location "https://github.com/crate-ci/typos/releases/download/${TYPOS_VERSION}/typos-${TYPOS_VERSION}-x86_64-unknown-linux-musl.tar.gz" | tar xzf - ./typos
Comment on lines 71 to 73
Copy link

Copilot AI Feb 4, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This script downloads and executes a third-party typos binary from GitHub releases via curl and tar without any checksum or signature verification, which creates a supply chain risk if the release artifact or download path is compromised. An attacker who can tamper with the fetched tarball (e.g., via compromised tag, CDN, DNS or TLS) could cause arbitrary code execution in developer or CI environments using this script. To mitigate this, fetch the release artifact using a pinned immutable identifier and verify its integrity (for example via published checksums or signatures) before extracting and running the binary, or vendor the tool instead of downloading it at runtime.

Copilot uses AI. Check for mistakes.
fi

# Run typos with the appropriate output format
# In CI environments, generates a SARIF report for integration with GitHub's code scanning
# In local development:
# - Verbose mode: Shows progress and uses detailed output format
# - Normal mode: Runs silently, only showing typos if found
if [[ -v CI ]] ; then
if [[ $VERBOSE -eq 1 ]]; then
echo "Running in CI mode..."
fi
./typos --format sarif > typos.sarif || true
else
./typos
if [[ $VERBOSE -eq 1 ]]; then
echo "Checking for typos..."
./typos --format long # Long format shows file paths and context
else
./typos # Brief format for quick checks
fi
fi