ci: spellcheck only in dedicated CI steps

.github/workflows/01-make-dist-worker.yml

@@ -40,7 +40,9 @@ jobs:
      #  NUT build/tooling prereqs (save about 3 minutes per run!)
      #  Maybe https://aschmelyun.com/blog/using-docker-run-inside-of-github-actions/
      #  => https://github.com/addnab/docker-run-action can help
-    runs-on: ubuntu-latest
+    # Pinned (not ubuntu-latest) so the toolchain and the "current"
+    # aspell-en only change when we bump this deliberately
+    runs-on: ubuntu-24.04
 
     steps:
     - name: Checkout repository
@@ -88,12 +90,16 @@ jobs:
     # and our own docs/config-prereqs.txt
     # NOTE: Currently installing the MAX prerequisite footprint,
     # which for building just the docs may be a bit of an overkill.
+    # The eatmydata wrapper skips fsync() calls of dpkg (unneeded on a
+    # throw-away runner), and recommended packages are not installed
+    # (we list what we need), to speed up this step.
     - name: NUT CI Prerequisite packages (Ubuntu, GCC)
       run: |
         echo "set man-db/auto-update false" | sudo debconf-communicate
         sudo dpkg-reconfigure man-db
-        sudo apt update
-        sudo apt install \
+        sudo apt-get update
+        sudo apt-get install -y --no-install-recommends eatmydata
+        sudo eatmydata apt-get install -y --no-install-recommends \
             gcc g++ clang \
             ccache time \
             git perl curl \
@@ -104,7 +110,7 @@ jobs:
             libtool-bin \
             python3 gettext python3-pyqt6 pyqt6-dev-tools \
             aspell aspell-en \
-            asciidoc source-highlight python3-pygments dblatex \
+            asciidoc asciidoc-dblatex source-highlight python3-pygments dblatex \
             libgd-dev \
             systemd-dev \
             libsystemd-dev \
@@ -169,6 +175,22 @@ jobs:
         ./autogen.sh && \
         ./configure --enable-warnings --enable-Werror --enable-Wcolor --with-all --with-dev --with-docs --enable-docs-changelog ${{env.compiler}}
 
+    # Documentation spellcheck is run explicitly here (other CI build
+    # scenarios pass --disable-spellcheck so it is not part of every
+    # "make check" in the build matrices). The old aspell-en dictionary
+    # is checked by the parallel "spellcheck-old-aspell-en" job below.
+    # Failures are reported, but do not stop the tarball build; the job
+    # is failed at the end (see "Report spellcheck failures").
+    - name: NUT CI Spellcheck (aspell-en current)
+      id: spellcheck-current
+      continue-on-error: true
+      run: |
+        dpkg -l aspell aspell-en | grep "^ii"
+        make -s -j 8 SPELLCHECK_ERROR_FATAL=yes spellcheck || {
+            echo "::error title=Spellcheck (aspell-en current)::Documentation spellcheck failed with the current aspell-en dictionary, see this step log; update the text or docs/nut.dict"
+            exit 1
+        }
+
     # NOTE: In this scenario we do not build actually NUT in the main
     # checkout directory, at least not explicitly (recipe may generate
     # some files like man pages to fulfill the "dist" requirements;
@@ -195,7 +217,8 @@ jobs:
         CCACHE_COMPRESS=true; export CCACHE_COMPRESS
         ccache --version || true
         ( ${{env.compiler}} ; echo "=== CC: $CC => `command -v $CC` =>" ; $CC --version ; echo "=== CXX: $CXX => `command -v $CXX` =>" ; $CXX --version ) || true
-        make -s -j 8 distcheck
+        # Spelling is gated by the explicit steps above, not here
+        make -s -j 8 SPELLCHECK_ERROR_FATAL=no distcheck
 
     - name: NUT CI Build to verify "dist" tarball build self-reproducibility
       env:
@@ -205,7 +228,8 @@ jobs:
         CCACHE_COMPRESS=true; export CCACHE_COMPRESS
         ccache --version || true
         ( ${{env.compiler}} ; echo "=== CC: $CC => `command -v $CC` =>" ; $CC --version ; echo "=== CXX: $CXX => `command -v $CXX` =>" ; $CXX --version ) || true
-        make -s -j 8 distcheck-completeness
+        # Spelling is gated by the explicit steps above, not here
+        make -s -j 8 SPELLCHECK_ERROR_FATAL=no distcheck-completeness
 
     - name: CCache stats after distcheck
       run: ccache -sv || ccache -s || echo "FAILED to read ccache info, oh well"
@@ -245,3 +269,68 @@ jobs:
       run: |
         echo "### Dist and Docs tarballs" >> "$GITHUB_STEP_SUMMARY"
         echo "[${ARTIFACT_NAME}.zip](${ARTIFACT_URL})" >> "$GITHUB_STEP_SUMMARY"
+
+    - name: Report spellcheck failures
+      if: ${{ !cancelled() && steps.spellcheck-current.outcome == 'failure' }}
+      run: |
+        echo "### Documentation spellcheck failed (aspell-en current)" >> "$GITHUB_STEP_SUMMARY"
+        echo "The tarballs were still built; see the spellcheck step log." >> "$GITHUB_STEP_SUMMARY"
+        exit 1
+
+  # Dictionaries differ from decade to decade, so also check with an old
+  # aspell-en: 7.1, as on CentOS 7 (EPEL), which rejects some spellings
+  # (e.g. British ones) that newer dictionaries accept.
+  # Runs in parallel to the tarball build (not delaying it).
+  # Only the dictionary matters, so the runner's own aspell is pointed at
+  # the aspell-en 7.1 word lists (via ASPELL_CONF), no old distro needed.
+  spellcheck-old-aspell-en:
+    name: "Spellcheck with old aspell-en 7.1 (as on CentOS 7)"
+    # Pinned (not ubuntu-latest) so the toolchain and the "current"
+    # aspell-en only change when we bump this deliberately
+    runs-on: ubuntu-24.04
+
+    # The old dictionary: upstream aspell6-en-7.1-0 word lists (repacked
+    # under another top directory name, same content), fetched from the
+    # Ubuntu archive mirror next to the runners. That is plain HTTP, so
+    # the download is verified against its SHA-256 checksum.
+    env:
+      ASPELL_EN_OLD_URL: http://azure.archive.ubuntu.com/ubuntu/pool/main/a/aspell-en/aspell-en_7.1-0.orig.tar.bz2
+      ASPELL_EN_OLD_SHA256: 03b06fa1d72016bd5d22d36cac427ba8bc0dbf6a5996d16760f023287070f0ee
+      # Top directory in that tarball
+      ASPELL_EN_OLD_DIR: aspell-en-7.1-0
+
+    steps:
+    - name: Checkout repository
+      uses: actions/checkout@v7
+      with:
+        # See notes in the make-dist-tarballs job above
+        fetch-depth: 0
+        fetch-tags: true
+        ref: ${{ inputs.ref }}
+        persist-credentials: false
+
+    - name: NUT CI Prerequisite packages (Ubuntu, aspell)
+      run: |
+        sudo apt-get update
+        sudo apt-get install -y --no-install-recommends eatmydata
+        sudo eatmydata apt-get install -y --no-install-recommends \
+            aspell autoconf automake libtool make gcc g++ pkg-config
+
+    # Its "make" only compiles the word lists with the installed aspell
+    - name: Prepare old aspell-en 7.1 dictionary
+      working-directory: ${{ runner.temp }}
+      run: |
+        curl -fsSL -o aspell-en-old.tar.bz2 "$ASPELL_EN_OLD_URL"
+        echo "$ASPELL_EN_OLD_SHA256  aspell-en-old.tar.bz2" | sha256sum -c
+        tar xjf aspell-en-old.tar.bz2
+        cd "$ASPELL_EN_OLD_DIR" && ./configure && make
+
+    - name: NUT CI Spellcheck (aspell-en 7.1)
+      env:
+        ASPELL_CONF: dict-dir ${{ runner.temp }}/${{ env.ASPELL_EN_OLD_DIR }}
+      run: |
+        aspell --version
+        BUILD_TYPE=default-spellcheck ./ci_build.sh || {
+            echo "::error title=Spellcheck (aspell-en 7.1)::Documentation spellcheck failed with the old aspell-en 7.1 dictionary (as on CentOS 7), see this job log; update the text or docs/nut.dict"
+            exit 1
+        }

.github/workflows/05-codeql.yml

@@ -73,9 +73,9 @@ jobs:
       run: |
         echo "set man-db/auto-update false" | sudo debconf-communicate
         sudo dpkg-reconfigure man-db
-        sudo apt update
-        case x"${{matrix.compiler}}" in x*clang*) sudo apt install clang ;; x*) sudo apt install gcc g++ ;; esac
-        sudo apt install libltdl-dev libtool libtool-bin cppcheck ccache libgd-dev libcppunit-dev libsystemd-dev libssl-dev libnss3-dev augeas-tools libaugeas-dev augeas-lenses libusb-dev libusb-1.0-0-dev libmodbus-dev libsnmp-dev libpowerman0-dev libfreeipmi-dev libipmimonitoring-dev libavahi-common-dev libavahi-core-dev libavahi-client-dev libgpiod-dev libglib2.0-dev libneon27-dev libi2c-dev i2c-tools lm-sensors ccache
+        sudo apt-get update
+        case x"${{matrix.compiler}}" in x*clang*) sudo apt-get install -y clang ;; x*) sudo apt-get install -y gcc g++ ;; esac
+        sudo apt-get install -y libltdl-dev libtool libtool-bin cppcheck ccache libgd-dev libcppunit-dev libsystemd-dev libssl-dev libnss3-dev augeas-tools libaugeas-dev augeas-lenses libusb-dev libusb-1.0-0-dev libmodbus-dev libsnmp-dev libpowerman0-dev libfreeipmi-dev libipmimonitoring-dev libavahi-common-dev libavahi-core-dev libavahi-client-dev libgpiod-dev libglib2.0-dev libneon27-dev libi2c-dev i2c-tools lm-sensors ccache
         date > .timestamp-init
 
     - name: Prepare ccache

Jenkinsfile-dynamatrix

@@ -441,7 +441,7 @@ set | sort -n """
 
                 mergeMode: [ 'dynamatrixAxesVirtualLabelsMap': 'replace', 'dynamatrixAxesCommonEnv': 'replace', 'excludeCombos': 'merge' ],
                 dynamatrixAxesCommonEnv: [
-                    ['CONFIG_OPTS=--with-all=auto --with-docs=auto --with-ssl=auto --enable-Werror --enable-warnings --disable-Wcolor --enable-silent-rules']
+                    ['CONFIG_OPTS=--with-all=auto --with-docs=auto --with-ssl=auto --enable-Werror --enable-warnings --disable-Wcolor --enable-silent-rules --disable-spellcheck']
                     ],
                 allowedFailure: [
                     dynacfgPipeline.axisCombos_WINDOWS,
@@ -486,7 +486,7 @@ set | sort -n """
                 dynamatrixAxesCommonEnv: [
                     //['LANG=C','LC_ALL=C','TZ=UTC', 'CFLAGS=-Wall\\ -Wextra\\ -Werror', 'CXXFLAGS=-Wall\\ -Wextra\\ -Werror']
                     ['LANG=C','LC_ALL=C','TZ=UTC', 'CFLAGS=-Wall', 'CXXFLAGS=-Wall',
-                     'CONFIG_OPTS=--with-all=auto --with-docs=auto --with-ssl=auto --enable-Werror --enable-warnings --disable-Wcolor --enable-silent-rules'
+                     'CONFIG_OPTS=--with-all=auto --with-docs=auto --with-ssl=auto --enable-Werror --enable-warnings --disable-Wcolor --enable-silent-rules --disable-spellcheck'
                     ]
                     ],
                 allowedFailure: [
@@ -534,7 +534,7 @@ set | sort -n """
                     // (so splitting into many tokens), or quoted as a single
                     // token DISTCHECK_FLAGS in its stage (split by make later).
                     ['LANG=C','LC_ALL=C','TZ=UTC',
-                     'CONFIG_OPTS=--with-all=auto --with-docs=auto --with-ssl=auto --enable-Werror --enable-warnings --disable-Wcolor --enable-silent-rules'
+                     'CONFIG_OPTS=--with-all=auto --with-docs=auto --with-ssl=auto --enable-Werror --enable-warnings --disable-Wcolor --enable-silent-rules --disable-spellcheck'
                     ]
                     ],
 

NEWS.adoc

@@ -887,6 +887,13 @@ https://github.com/networkupstools/nut/milestone/13
     * Further rearrangement of AppVeyor CI builds and security hardening of
       GitHub Actions used to prepare the dist tarballs and report on progress
       there. [PRs #3753, #3754, #3756]
+    * CI build matrix scenarios (Jenkins autotools builds, `ci_build.sh` with
+      `BUILD_TYPE=default-withdoc*`) now pass `--disable-spellcheck`, so their
+      `make check` no longer runs (and fails on) the documentation spellcheck.
+      The GitHub Actions dist tarball worker checks the spelling explicitly,
+      with both a current and an old (7.1, as on CentOS 7) version of the
+      `aspell-en` dictionary. Local builds keep the default of
+      `configure --enable-spellcheck=auto`. [PR #3752]
 
 
 Release notes for NUT 2.8.5 - what's new since 2.8.4

ci_build.sh

@@ -2050,6 +2050,8 @@ default|default-alldrv|default-alldrv:no-distcheck|default-all-errors|default-al
                     CONFIG_OPTS+=("--with-doc=yes")
                 fi
             fi
+            # Spelling is checked by dedicated BUILD_TYPE=default-spellcheck jobs
+            CONFIG_OPTS+=("--disable-spellcheck")
             if [ -z "${DO_CLEAN_CHECK-}" ]; then
                 # This is one of recipes where we want to
                 # keep the build products by default ;)
@@ -2065,6 +2067,8 @@ default|default-alldrv|default-alldrv:no-distcheck|default-all-errors|default-al
             else
                 CONFIG_OPTS+=("--with-doc=man")
             fi
+            # Spelling is checked by dedicated BUILD_TYPE=default-spellcheck jobs
+            CONFIG_OPTS+=("--disable-spellcheck")
             if [ -z "${DO_CLEAN_CHECK-}" ]; then
                 # This is one of recipes where we want to
                 # keep the build products by default ;)