-
-
Notifications
You must be signed in to change notification settings - Fork 1.5k
Add help and verbose options to check-typos script #8791
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Closed
TheAshutoshMishra
wants to merge
2
commits into
jenkins-infra:master
from
TheAshutoshMishra:feature/check-typos-help-verbose
+76
−1
Closed
Changes from all commits
Commits
Show all changes
2 commits
Select commit
Hold shift + click to select a range
File filter
Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
There are no files selected for viewing
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -1,18 +1,93 @@ | ||
| #!/usr/bin/env bash | ||
| # | ||
| # Script to check for typos in the Jenkins.io repository using the typos tool. | ||
| # | ||
| # This script supports the following options: | ||
| # --help, -h Display usage information and examples | ||
| # --verbose, -v Enable detailed output during typo checking | ||
| # | ||
| # Without any options, the script runs silently and only displays found typos. | ||
| # | ||
| # Usage examples: | ||
| # ./scripts/check-typos # Basic usage (silent mode) | ||
| # ./scripts/check-typos --help # Show help message | ||
| # ./scripts/check-typos --verbose # Show detailed progress | ||
|
|
||
| set -o errexit | ||
| set -o nounset | ||
| set -o pipefail | ||
|
|
||
| TYPOS_VERSION=v1.40.0 | ||
| VERBOSE=0 # Set to 1 when --verbose flag is used | ||
|
|
||
| # Display help message with usage information and examples | ||
| show_help() { | ||
| cat << EOF | ||
| Usage: ./scripts/check-typos [OPTIONS] | ||
|
|
||
| Check for typos in the repository. | ||
|
|
||
| OPTIONS: | ||
| -h, --help Show this help message | ||
| -v, --verbose Show detailed output | ||
|
|
||
| EXAMPLES: | ||
| ./scripts/check-typos | ||
| ./scripts/check-typos --verbose | ||
|
|
||
| EOF | ||
| } | ||
|
|
||
| # Parse command-line arguments | ||
| # Supports --help/-h to display usage and --verbose/-v for detailed output | ||
| while [[ $# -gt 0 ]]; do | ||
| case $1 in | ||
| -h|--help) | ||
| # Display help message and exit | ||
| show_help | ||
| exit 0 | ||
| ;; | ||
| -v|--verbose) | ||
| # Enable verbose mode for detailed progress messages | ||
| VERBOSE=1 | ||
| shift | ||
| ;; | ||
| *) | ||
| # Handle unknown options gracefully | ||
| echo "Unknown option: $1" | ||
| echo "Use --help for usage information" | ||
| exit 1 | ||
| ;; | ||
| esac | ||
| done | ||
|
|
||
| # Download the typos binary from GitHub releases | ||
| # In verbose mode, shows a progress message during download | ||
| if [[ $VERBOSE -eq 1 ]]; then | ||
| echo "Downloading typos ${TYPOS_VERSION}..." | ||
| fi | ||
|
|
||
| if [[ $OSTYPE == darwin* ]] ; then | ||
| curl --disable --silent --show-error --location "https://github.com/crate-ci/typos/releases/download/${TYPOS_VERSION}/typos-${TYPOS_VERSION}-x86_64-apple-darwin.tar.gz" | tar xzf - ./typos | ||
| else | ||
| curl --disable --silent --show-error --location "https://github.com/crate-ci/typos/releases/download/${TYPOS_VERSION}/typos-${TYPOS_VERSION}-x86_64-unknown-linux-musl.tar.gz" | tar xzf - ./typos | ||
| fi | ||
|
|
||
| # Run typos with the appropriate output format | ||
| # In CI environments, generates a SARIF report for integration with GitHub's code scanning | ||
| # In local development: | ||
| # - Verbose mode: Shows progress and uses detailed output format | ||
| # - Normal mode: Runs silently, only showing typos if found | ||
| if [[ -v CI ]] ; then | ||
| if [[ $VERBOSE -eq 1 ]]; then | ||
| echo "Running in CI mode..." | ||
| fi | ||
| ./typos --format sarif > typos.sarif || true | ||
| else | ||
| ./typos | ||
| if [[ $VERBOSE -eq 1 ]]; then | ||
| echo "Checking for typos..." | ||
| ./typos --format long # Long format shows file paths and context | ||
| else | ||
| ./typos # Brief format for quick checks | ||
| fi | ||
| fi | ||
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
This script downloads and executes a third-party
typosbinary from GitHub releases viacurlandtarwithout any checksum or signature verification, which creates a supply chain risk if the release artifact or download path is compromised. An attacker who can tamper with the fetched tarball (e.g., via compromised tag, CDN, DNS or TLS) could cause arbitrary code execution in developer or CI environments using this script. To mitigate this, fetch the release artifact using a pinned immutable identifier and verify its integrity (for example via published checksums or signatures) before extracting and running the binary, or vendor the tool instead of downloading it at runtime.