From a00a55e5415445bff482d45a005ab2684992c7a9 Mon Sep 17 00:00:00 2001 From: nmbro Date: Tue, 13 Oct 2026 12:35:20 +0200 Subject: [PATCH 1/4] ci: spellcheck only in dedicated CI steps Pass --disable-spellcheck to the Jenkins autotools build matrices and to ci_build.sh BUILD_TYPE=default-withdoc* (the only default-* build types that did not disable it yet), so their "make check" no longer runs the docs spellcheck. A failing matrix build is then clearly not about spelling, and the jobs save a little time. Local builds keep the "configure --enable-spellcheck=auto" default. The GitHub Actions dist tarball worker now runs the spellcheck as explicit steps: with the current aspell-en of the runner, and via "docker run" in Ubuntu 14.04 for aspell-en 7.1, the same old dictionary as CentOS 7 (EPEL), which rejects some spellings that newer dictionaries accept. Co-Authored-By: Claude Opus 5.5 Signed-off-by: nmbro --- .github/workflows/01-make-dist-worker.yml | 67 ++++++++++++++++++++++- Jenkinsfile-dynamatrix | 6 +- NEWS.adoc | 7 +++ ci_build.sh | 4 ++ 4 files changed, 79 insertions(+), 5 deletions(-) diff --git a/.github/workflows/01-make-dist-worker.yml b/.github/workflows/01-make-dist-worker.yml index c305f7dd51..19c267a85f 100644 --- a/.github/workflows/01-make-dist-worker.yml +++ b/.github/workflows/01-make-dist-worker.yml @@ -169,6 +169,22 @@ jobs: ./autogen.sh && \ ./configure --enable-warnings --enable-Werror --enable-Wcolor --with-all --with-dev --with-docs --enable-docs-changelog ${{env.compiler}} + # Documentation spellcheck is run explicitly here (other CI build + # scenarios pass --disable-spellcheck so it is not part of every + # "make check" in the build matrices). The old aspell-en dictionary + # is checked by the parallel "spellcheck-old-aspell-en" job below. + # Failures are reported, but do not stop the tarball build; the job + # is failed at the end (see "Report spellcheck failures"). + - name: NUT CI Spellcheck (aspell-en current) + id: spellcheck-current + continue-on-error: true + run: | + dpkg -l aspell aspell-en | grep "^ii" + make -s -j 8 SPELLCHECK_ERROR_FATAL=yes spellcheck || { + echo "::error title=Spellcheck (aspell-en current)::Documentation spellcheck failed with the current aspell-en dictionary, see this step log; update the text or docs/nut.dict" + exit 1 + } + # NOTE: In this scenario we do not build actually NUT in the main # checkout directory, at least not explicitly (recipe may generate # some files like man pages to fulfill the "dist" requirements; @@ -195,7 +211,8 @@ jobs: CCACHE_COMPRESS=true; export CCACHE_COMPRESS ccache --version || true ( ${{env.compiler}} ; echo "=== CC: $CC => `command -v $CC` =>" ; $CC --version ; echo "=== CXX: $CXX => `command -v $CXX` =>" ; $CXX --version ) || true - make -s -j 8 distcheck + # Spelling is gated by the explicit steps above, not here + make -s -j 8 SPELLCHECK_ERROR_FATAL=no distcheck - name: NUT CI Build to verify "dist" tarball build self-reproducibility env: @@ -205,7 +222,8 @@ jobs: CCACHE_COMPRESS=true; export CCACHE_COMPRESS ccache --version || true ( ${{env.compiler}} ; echo "=== CC: $CC => `command -v $CC` =>" ; $CC --version ; echo "=== CXX: $CXX => `command -v $CXX` =>" ; $CXX --version ) || true - make -s -j 8 distcheck-completeness + # Spelling is gated by the explicit steps above, not here + make -s -j 8 SPELLCHECK_ERROR_FATAL=no distcheck-completeness - name: CCache stats after distcheck run: ccache -sv || ccache -s || echo "FAILED to read ccache info, oh well" @@ -245,3 +263,48 @@ jobs: run: | echo "### Dist and Docs tarballs" >> "$GITHUB_STEP_SUMMARY" echo "[${ARTIFACT_NAME}.zip](${ARTIFACT_URL})" >> "$GITHUB_STEP_SUMMARY" + + - name: Report spellcheck failures + if: ${{ !cancelled() && steps.spellcheck-current.outcome == 'failure' }} + run: | + echo "### Documentation spellcheck failed (aspell-en current)" >> "$GITHUB_STEP_SUMMARY" + echo "The tarballs were still built; see the spellcheck step log." >> "$GITHUB_STEP_SUMMARY" + exit 1 + + # Dictionaries differ from decade to decade, so also check with an old + # aspell-en: Ubuntu Trusty ships aspell-en 7.1, same as CentOS 7 (EPEL), + # which rejects some spellings (e.g. British ones) that newer dictionaries + # accept. Runs in parallel to the tarball build (not delaying it), via + # "docker run" since GitHub's own actions can not run in such old distros. + spellcheck-old-aspell-en: + name: "Spellcheck with old aspell-en 7.1 (Ubuntu 14.04)" + runs-on: ubuntu-latest + + steps: + - name: Checkout repository + uses: actions/checkout@v7 + with: + # See notes in the make-dist-tarballs job above + fetch-depth: 0 + fetch-tags: true + ref: ${{ inputs.ref }} + persist-credentials: false + + - name: NUT CI Spellcheck (aspell-en 7.1, Ubuntu 14.04) + run: | + docker run --rm -v "$PWD:/src:ro" \ + -e DEBIAN_FRONTEND=noninteractive \ + ubuntu:14.04 sh -c ' + set -e + apt-get update -qq + apt-get install -y -qq \ + aspell aspell-en \ + autoconf automake libtool make gcc g++ pkg-config \ + perl python3 git file >/dev/null + dpkg -l aspell aspell-en | grep "^ii" + cp -a /src /build && cd /build + BUILD_TYPE=default-spellcheck ./ci_build.sh + ' || { + echo "::error title=Spellcheck (aspell-en 7.1)::Documentation spellcheck failed with the old aspell-en 7.1 dictionary (as on CentOS 7), see this job log; update the text or docs/nut.dict" + exit 1 + } diff --git a/Jenkinsfile-dynamatrix b/Jenkinsfile-dynamatrix index a8345d285d..7798b87d95 100644 --- a/Jenkinsfile-dynamatrix +++ b/Jenkinsfile-dynamatrix @@ -441,7 +441,7 @@ set | sort -n """ mergeMode: [ 'dynamatrixAxesVirtualLabelsMap': 'replace', 'dynamatrixAxesCommonEnv': 'replace', 'excludeCombos': 'merge' ], dynamatrixAxesCommonEnv: [ - ['CONFIG_OPTS=--with-all=auto --with-docs=auto --with-ssl=auto --enable-Werror --enable-warnings --disable-Wcolor --enable-silent-rules'] + ['CONFIG_OPTS=--with-all=auto --with-docs=auto --with-ssl=auto --enable-Werror --enable-warnings --disable-Wcolor --enable-silent-rules --disable-spellcheck'] ], allowedFailure: [ dynacfgPipeline.axisCombos_WINDOWS, @@ -486,7 +486,7 @@ set | sort -n """ dynamatrixAxesCommonEnv: [ //['LANG=C','LC_ALL=C','TZ=UTC', 'CFLAGS=-Wall\\ -Wextra\\ -Werror', 'CXXFLAGS=-Wall\\ -Wextra\\ -Werror'] ['LANG=C','LC_ALL=C','TZ=UTC', 'CFLAGS=-Wall', 'CXXFLAGS=-Wall', - 'CONFIG_OPTS=--with-all=auto --with-docs=auto --with-ssl=auto --enable-Werror --enable-warnings --disable-Wcolor --enable-silent-rules' + 'CONFIG_OPTS=--with-all=auto --with-docs=auto --with-ssl=auto --enable-Werror --enable-warnings --disable-Wcolor --enable-silent-rules --disable-spellcheck' ] ], allowedFailure: [ @@ -534,7 +534,7 @@ set | sort -n """ // (so splitting into many tokens), or quoted as a single // token DISTCHECK_FLAGS in its stage (split by make later). ['LANG=C','LC_ALL=C','TZ=UTC', - 'CONFIG_OPTS=--with-all=auto --with-docs=auto --with-ssl=auto --enable-Werror --enable-warnings --disable-Wcolor --enable-silent-rules' + 'CONFIG_OPTS=--with-all=auto --with-docs=auto --with-ssl=auto --enable-Werror --enable-warnings --disable-Wcolor --enable-silent-rules --disable-spellcheck' ] ], diff --git a/NEWS.adoc b/NEWS.adoc index 49f57f75a8..96fa0634fa 100644 --- a/NEWS.adoc +++ b/NEWS.adoc @@ -887,6 +887,13 @@ https://github.com/networkupstools/nut/milestone/13 * Further rearrangement of AppVeyor CI builds and security hardening of GitHub Actions used to prepare the dist tarballs and report on progress there. [PRs #3753, #3754, #3756] + * CI build matrix scenarios (Jenkins autotools builds, `ci_build.sh` with + `BUILD_TYPE=default-withdoc*`) now pass `--disable-spellcheck`, so their + `make check` no longer runs (and fails on) the documentation spellcheck. + The GitHub Actions dist tarball worker checks the spelling explicitly, + with both a current and an old (7.1, as on CentOS 7) version of the + `aspell-en` dictionary. Local builds keep the default of + `configure --enable-spellcheck=auto`. [PR #3752] Release notes for NUT 2.8.5 - what's new since 2.8.4 diff --git a/ci_build.sh b/ci_build.sh index 402d157081..7a6e36292e 100755 --- a/ci_build.sh +++ b/ci_build.sh @@ -2050,6 +2050,8 @@ default|default-alldrv|default-alldrv:no-distcheck|default-all-errors|default-al CONFIG_OPTS+=("--with-doc=yes") fi fi + # Spelling is checked by dedicated BUILD_TYPE=default-spellcheck jobs + CONFIG_OPTS+=("--disable-spellcheck") if [ -z "${DO_CLEAN_CHECK-}" ]; then # This is one of recipes where we want to # keep the build products by default ;) @@ -2065,6 +2067,8 @@ default|default-alldrv|default-alldrv:no-distcheck|default-all-errors|default-al else CONFIG_OPTS+=("--with-doc=man") fi + # Spelling is checked by dedicated BUILD_TYPE=default-spellcheck jobs + CONFIG_OPTS+=("--disable-spellcheck") if [ -z "${DO_CLEAN_CHECK-}" ]; then # This is one of recipes where we want to # keep the build products by default ;) From 25e3dbf2af9e9473e399b981ab1014d39aca5d5b Mon Sep 17 00:00:00 2001 From: nmbro Date: Tue, 13 Oct 2026 13:04:08 +0200 Subject: [PATCH 2/4] ci(gha): pin dist worker bases, faster apt Run the dist worker jobs on ubuntu-24.04 instead of ubuntu-latest (which moves to Ubuntu 26 soon), and pin the ubuntu:14.04 image of the old-dictionary spellcheck job by digest, so the toolchain and the aspell-en dictionaries only change when bumped deliberately. The Trusty archive is frozen, so this also makes that apt-get step deterministic. Install the host prerequisites via eatmydata (dpkg fsync() is not needed on a throw-away runner) and without recommended packages, to speed up that step. Co-Authored-By: Claude Opus 5.5 Signed-off-by: nmbro --- .github/workflows/01-make-dist-worker.yml | 23 +++++++++++++++++------ 1 file changed, 17 insertions(+), 6 deletions(-) diff --git a/.github/workflows/01-make-dist-worker.yml b/.github/workflows/01-make-dist-worker.yml index 19c267a85f..1e211d19f3 100644 --- a/.github/workflows/01-make-dist-worker.yml +++ b/.github/workflows/01-make-dist-worker.yml @@ -40,7 +40,9 @@ jobs: # NUT build/tooling prereqs (save about 3 minutes per run!) # Maybe https://aschmelyun.com/blog/using-docker-run-inside-of-github-actions/ # => https://github.com/addnab/docker-run-action can help - runs-on: ubuntu-latest + # Pinned (not ubuntu-latest) so the toolchain and the "current" + # aspell-en only change when we bump this deliberately + runs-on: ubuntu-24.04 steps: - name: Checkout repository @@ -88,12 +90,16 @@ jobs: # and our own docs/config-prereqs.txt # NOTE: Currently installing the MAX prerequisite footprint, # which for building just the docs may be a bit of an overkill. + # The eatmydata wrapper skips fsync() calls of dpkg (unneeded on a + # throw-away runner), and recommended packages are not installed + # (we list what we need), to speed up this step. - name: NUT CI Prerequisite packages (Ubuntu, GCC) run: | echo "set man-db/auto-update false" | sudo debconf-communicate sudo dpkg-reconfigure man-db sudo apt update - sudo apt install \ + sudo apt install --no-install-recommends eatmydata + sudo eatmydata apt install --no-install-recommends \ gcc g++ clang \ ccache time \ git perl curl \ @@ -104,7 +110,7 @@ jobs: libtool-bin \ python3 gettext python3-pyqt6 pyqt6-dev-tools \ aspell aspell-en \ - asciidoc source-highlight python3-pygments dblatex \ + asciidoc asciidoc-dblatex source-highlight python3-pygments dblatex \ libgd-dev \ systemd-dev \ libsystemd-dev \ @@ -276,9 +282,13 @@ jobs: # which rejects some spellings (e.g. British ones) that newer dictionaries # accept. Runs in parallel to the tarball build (not delaying it), via # "docker run" since GitHub's own actions can not run in such old distros. + # The image is pinned by digest (the Trusty archive is frozen, so this + # also makes the apt-get step deterministic). spellcheck-old-aspell-en: name: "Spellcheck with old aspell-en 7.1 (Ubuntu 14.04)" - runs-on: ubuntu-latest + # Pinned (not ubuntu-latest) so the toolchain and the "current" + # aspell-en only change when we bump this deliberately + runs-on: ubuntu-24.04 steps: - name: Checkout repository @@ -294,10 +304,11 @@ jobs: run: | docker run --rm -v "$PWD:/src:ro" \ -e DEBIAN_FRONTEND=noninteractive \ - ubuntu:14.04 sh -c ' + ubuntu:14.04@sha256:64483f3496c1373bfd55348e88694d1c4d0c9b660dee6bfef5e12f43b9933b30 \ + sh -c ' set -e apt-get update -qq - apt-get install -y -qq \ + apt-get install -y -qq --no-install-recommends \ aspell aspell-en \ autoconf automake libtool make gcc g++ pkg-config \ perl python3 git file >/dev/null From 0c4f47d29f97b942cb71839a80895c44c253b304 Mon Sep 17 00:00:00 2001 From: nmbro Date: Tue, 13 Oct 2026 14:46:52 +0200 Subject: [PATCH 3/4] ci(gha): use apt-get, not apt, in workflows The apt front-end is meant for interactive use: it warns that its command line interface is not stable for scripts, and its output and behavior may change between releases. Use apt-get in the prerequisite steps of the dist worker and CodeQL workflows, with an explicit -y (instead of relying on the runner image's APT::Get::Assume-Yes). Co-Authored-By: Claude Opus 5.5 Signed-off-by: nmbro --- .github/workflows/01-make-dist-worker.yml | 6 +++--- .github/workflows/05-codeql.yml | 6 +++--- 2 files changed, 6 insertions(+), 6 deletions(-) diff --git a/.github/workflows/01-make-dist-worker.yml b/.github/workflows/01-make-dist-worker.yml index 1e211d19f3..6596bc2282 100644 --- a/.github/workflows/01-make-dist-worker.yml +++ b/.github/workflows/01-make-dist-worker.yml @@ -97,9 +97,9 @@ jobs: run: | echo "set man-db/auto-update false" | sudo debconf-communicate sudo dpkg-reconfigure man-db - sudo apt update - sudo apt install --no-install-recommends eatmydata - sudo eatmydata apt install --no-install-recommends \ + sudo apt-get update + sudo apt-get install -y --no-install-recommends eatmydata + sudo eatmydata apt-get install -y --no-install-recommends \ gcc g++ clang \ ccache time \ git perl curl \ diff --git a/.github/workflows/05-codeql.yml b/.github/workflows/05-codeql.yml index 46231d1c79..8dcf087486 100644 --- a/.github/workflows/05-codeql.yml +++ b/.github/workflows/05-codeql.yml @@ -73,9 +73,9 @@ jobs: run: | echo "set man-db/auto-update false" | sudo debconf-communicate sudo dpkg-reconfigure man-db - sudo apt update - case x"${{matrix.compiler}}" in x*clang*) sudo apt install clang ;; x*) sudo apt install gcc g++ ;; esac - sudo apt install libltdl-dev libtool libtool-bin cppcheck ccache libgd-dev libcppunit-dev libsystemd-dev libssl-dev libnss3-dev augeas-tools libaugeas-dev augeas-lenses libusb-dev libusb-1.0-0-dev libmodbus-dev libsnmp-dev libpowerman0-dev libfreeipmi-dev libipmimonitoring-dev libavahi-common-dev libavahi-core-dev libavahi-client-dev libgpiod-dev libglib2.0-dev libneon27-dev libi2c-dev i2c-tools lm-sensors ccache + sudo apt-get update + case x"${{matrix.compiler}}" in x*clang*) sudo apt-get install -y clang ;; x*) sudo apt-get install -y gcc g++ ;; esac + sudo apt-get install -y libltdl-dev libtool libtool-bin cppcheck ccache libgd-dev libcppunit-dev libsystemd-dev libssl-dev libnss3-dev augeas-tools libaugeas-dev augeas-lenses libusb-dev libusb-1.0-0-dev libmodbus-dev libsnmp-dev libpowerman0-dev libfreeipmi-dev libipmimonitoring-dev libavahi-common-dev libavahi-core-dev libavahi-client-dev libgpiod-dev libglib2.0-dev libneon27-dev libi2c-dev i2c-tools lm-sensors ccache date > .timestamp-init - name: Prepare ccache From bc23c315e098358649cbd57c2903afd8932600f0 Mon Sep 17 00:00:00 2001 From: nmbro Date: Wed, 14 Oct 2026 01:03:37 +0200 Subject: [PATCH 4/4] ci(gha): old aspell-en without a Trusty container Only the dictionary differs, so point the runner's own aspell at the aspell-en 7.1 word lists via ASPELL_CONF="dict-dir ...", instead of running the spellcheck in an ubuntu:14.04 container. The upstream 7.1 tarball comes from the Azure Ubuntu archive mirror (plain HTTP, so it is pinned by sha256); its "make" just compiles the word lists with the installed aspell. Checked against CentOS 7 (aspell 0.60.6.1, aspell-en 7.1 from EPEL): with an empty docs/nut.dict, both flag the same 11545 (file, word) pairs across all 282 checked files. Co-Authored-By: Claude Opus 5.5 Signed-off-by: nmbro --- .github/workflows/01-make-dist-worker.yml | 59 ++++++++++++++--------- 1 file changed, 37 insertions(+), 22 deletions(-) diff --git a/.github/workflows/01-make-dist-worker.yml b/.github/workflows/01-make-dist-worker.yml index 6596bc2282..49ad6640f6 100644 --- a/.github/workflows/01-make-dist-worker.yml +++ b/.github/workflows/01-make-dist-worker.yml @@ -278,18 +278,27 @@ jobs: exit 1 # Dictionaries differ from decade to decade, so also check with an old - # aspell-en: Ubuntu Trusty ships aspell-en 7.1, same as CentOS 7 (EPEL), - # which rejects some spellings (e.g. British ones) that newer dictionaries - # accept. Runs in parallel to the tarball build (not delaying it), via - # "docker run" since GitHub's own actions can not run in such old distros. - # The image is pinned by digest (the Trusty archive is frozen, so this - # also makes the apt-get step deterministic). + # aspell-en: 7.1, as on CentOS 7 (EPEL), which rejects some spellings + # (e.g. British ones) that newer dictionaries accept. + # Runs in parallel to the tarball build (not delaying it). + # Only the dictionary matters, so the runner's own aspell is pointed at + # the aspell-en 7.1 word lists (via ASPELL_CONF), no old distro needed. spellcheck-old-aspell-en: - name: "Spellcheck with old aspell-en 7.1 (Ubuntu 14.04)" + name: "Spellcheck with old aspell-en 7.1 (as on CentOS 7)" # Pinned (not ubuntu-latest) so the toolchain and the "current" # aspell-en only change when we bump this deliberately runs-on: ubuntu-24.04 + # The old dictionary: upstream aspell6-en-7.1-0 word lists (repacked + # under another top directory name, same content), fetched from the + # Ubuntu archive mirror next to the runners. That is plain HTTP, so + # the download is verified against its SHA-256 checksum. + env: + ASPELL_EN_OLD_URL: http://azure.archive.ubuntu.com/ubuntu/pool/main/a/aspell-en/aspell-en_7.1-0.orig.tar.bz2 + ASPELL_EN_OLD_SHA256: 03b06fa1d72016bd5d22d36cac427ba8bc0dbf6a5996d16760f023287070f0ee + # Top directory in that tarball + ASPELL_EN_OLD_DIR: aspell-en-7.1-0 + steps: - name: Checkout repository uses: actions/checkout@v7 @@ -300,22 +309,28 @@ jobs: ref: ${{ inputs.ref }} persist-credentials: false - - name: NUT CI Spellcheck (aspell-en 7.1, Ubuntu 14.04) + - name: NUT CI Prerequisite packages (Ubuntu, aspell) + run: | + sudo apt-get update + sudo apt-get install -y --no-install-recommends eatmydata + sudo eatmydata apt-get install -y --no-install-recommends \ + aspell autoconf automake libtool make gcc g++ pkg-config + + # Its "make" only compiles the word lists with the installed aspell + - name: Prepare old aspell-en 7.1 dictionary + working-directory: ${{ runner.temp }} + run: | + curl -fsSL -o aspell-en-old.tar.bz2 "$ASPELL_EN_OLD_URL" + echo "$ASPELL_EN_OLD_SHA256 aspell-en-old.tar.bz2" | sha256sum -c + tar xjf aspell-en-old.tar.bz2 + cd "$ASPELL_EN_OLD_DIR" && ./configure && make + + - name: NUT CI Spellcheck (aspell-en 7.1) + env: + ASPELL_CONF: dict-dir ${{ runner.temp }}/${{ env.ASPELL_EN_OLD_DIR }} run: | - docker run --rm -v "$PWD:/src:ro" \ - -e DEBIAN_FRONTEND=noninteractive \ - ubuntu:14.04@sha256:64483f3496c1373bfd55348e88694d1c4d0c9b660dee6bfef5e12f43b9933b30 \ - sh -c ' - set -e - apt-get update -qq - apt-get install -y -qq --no-install-recommends \ - aspell aspell-en \ - autoconf automake libtool make gcc g++ pkg-config \ - perl python3 git file >/dev/null - dpkg -l aspell aspell-en | grep "^ii" - cp -a /src /build && cd /build - BUILD_TYPE=default-spellcheck ./ci_build.sh - ' || { + aspell --version + BUILD_TYPE=default-spellcheck ./ci_build.sh || { echo "::error title=Spellcheck (aspell-en 7.1)::Documentation spellcheck failed with the old aspell-en 7.1 dictionary (as on CentOS 7), see this job log; update the text or docs/nut.dict" exit 1 }