ci: 👷 update-checks-n-typos

.config/typos.toml

@@ -0,0 +1,8 @@
+[files]
+extend-exclude = [
+  "*.html",
+  "*.css",
+  ".quarto/*",
+  "_site/*",
+  "*.svg"
+]

.github/workflows/build-website.yml

@@ -28,9 +28,6 @@ jobs:
       - name: Check out repository
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
-      - name: Spell check repo
-        uses: crate-ci/typos@bee27e3a4fd1ea2111cf90ab89cd076c870fce14 # v1.48.0
-
       - name: Set up Quarto
         uses: quarto-dev/quarto-actions/setup@8a96df13519ee81fd526f2dfca5962811136661b # v2.2.0
 

.github/workflows/checks.yml

@@ -0,0 +1,97 @@
+name: Checks
+
+on: pull_request
+
+permissions: read-all
+
+jobs:
+  check-template:
+    runs-on: ubuntu-latest
+    steps:
+      # This is a useful security step to check for unexpected outbound calls from the runner,
+      # which could indicate a compromised token or runner.
+      - name: Harden the runner (Audit all outbound calls)
+        uses: step-security/harden-runner@20cf305ff2072d973412fa9b1e3a4f227bda3c76 # v2.14.0
+        with:
+          egress-policy: audit
+
+      - name: Checkout repository
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+
+      - name: Set up uv
+        uses: astral-sh/setup-uv@08807647e7069bb48b6ef5acd8ec9567f424441b # v8.1.0
+        with:
+          enable-cache: true
+
+      - name: Install justfile
+        run: uv tool install rust-just
+
+      # Set this user so that the checks create Git commits.
+      - name: Set bot user
+        run: |
+          git config --global user.name "github-actions[bot]"
+          git config --global user.email "41898282+github-actions[bot]@users.noreply.github.com"
+
+      # TODO: Confirm name of recipe to check template creation.
+      - name: Check template creation
+        run: just test-all
+
+  check-typos:
+    runs-on: ubuntu-latest
+    steps:
+      # This is a useful security step to check for unexpected outbound calls from the runner,
+      # which could indicate a compromised token or runner.
+      - name: Harden the runner (Audit all outbound calls)
+        uses: step-security/harden-runner@20cf305ff2072d973412fa9b1e3a4f227bda3c76 # v2.14.0
+        with:
+          egress-policy: audit
+
+      - name: Checkout repository
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+
+      - name: Spell check repo
+        uses: crate-ci/typos@cf5f1c29a8ac336af8568821ec41919923b05a83 # v1.45.1
+        with:
+          config: .config/typos.toml
+
+  check-website-build:
+    runs-on: ubuntu-latest
+    steps:
+      # This is a useful security step to check for unexpected outbound calls from the runner,
+      # which could indicate a compromised token or runner.
+      - name: Harden the runner (Audit all outbound calls)
+        uses: step-security/harden-runner@20cf305ff2072d973412fa9b1e3a4f227bda3c76 # v2.14.0
+        with:
+          egress-policy: audit
+
+      - name: Checkout repository
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+
+      - name: Set up Quarto
+        uses: quarto-dev/quarto-actions/setup@8a96df13519ee81fd526f2dfca5962811136661b # v2.2.0
+
+      # Check that the website builds, but don't publish it
+      - name: Render Quarto Project
+        uses: quarto-dev/quarto-actions/render@8a96df13519ee81fd526f2dfca5962811136661b # v2.2.0
+
+  # Dependency Review Action
+  #
+  # This Action will scan dependency manifest files that change as part of a Pull Request,
+  # surfacing known-vulnerable versions of the packages declared or updated in the PR.
+  # Once installed, if the workflow run is marked as required,
+  # PRs introducing known-vulnerable packages will be blocked from merging.
+  #
+  # Source repository: https://github.com/actions/dependency-review-action
+  check-dependencies:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Harden the runner (Audit all outbound calls)
+        uses: step-security/harden-runner@20cf305ff2072d973412fa9b1e3a4f227bda3c76 # v2.14.0
+        with:
+          egress-policy: audit
+
+      - name: "Checkout Repository"
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+
+      - name: "Dependency Review"
+        uses: actions/dependency-review-action@3c4e3dcb1aa7874d2c16be7d79418e9b7efd6261 # v4.8.2

.pre-commit-config.yaml

@@ -10,30 +10,26 @@ repos:
     hooks:
       - id: gitleaks
 
-  - repo: https://github.com/pre-commit/pre-commit-hooks
-    rev: v6.0.0
-    hooks:
-      - id: trailing-whitespace
-      - id: end-of-file-fixer
-      - id: mixed-line-ending
-        args: [ --fix=lf ]
-      - id: check-merge-conflict
-        args: [ --assume-in-merge ]
-
-  - repo: https://github.com/commitizen-tools/commitizen
-    rev: v4.17.0
-    hooks:
-      - id: commitizen
-
   # Use the mirror since the main `typos` repo has tags for different
   # sub-packages, which confuses pre-commit when it tries to find the latest
   # version
   - repo: https://github.com/adhtruong/mirrors-typos
-    rev: v1.48.0
+    rev: v1.45.1
     hooks:
       - id: typos
+        args: [--config, .config/typos.toml, --force-exclude]
+
+  - repo: https://github.com/jolars/panache-pre-commit
+    rev: v2.51.0
+    hooks:
+      - id: panache-format
 
-  - repo: https://github.com/rvben/rumdl-pre-commit
-    rev: v0.2.49
+  - repo: https://github.com/pre-commit/pre-commit-hooks
+    rev: v6.0.0
     hooks:
-      - id: rumdl-fmt # Auto-format
+      - id: trailing-whitespace
+      - id: end-of-file-fixer
+      - id: mixed-line-ending
+        args: [--fix=lf]
+      - id: check-merge-conflict
+        args: [--assume-in-merge]

.vscode/settings.json

@@ -26,6 +26,7 @@
     "*.qmd.jinja": "jinja-md"
   },
   "files.insertFinalNewline": true,
+  "typos.config": ".config/typos.toml",
   "conventionalCommits.emojiFormat": "emoji",
   "conventionalCommits.promptScopes": false
 }

404.qmd

@@ -2,5 +2,5 @@
 title: "The page you are looking for does not exist"
 ---
 
-This page does not exist, go back to the [homepage](/index.qmd) or check
-the URL for typos.
+This page does not exist, go back to the [homepage](/index.qmd) or check the URL
+for typos.

CHANGELOG.md

@@ -1,25 +1,23 @@
 # Changelog
 
-Since we follow
-[Conventional Commits](https://decisions.seedcase-project.org/why-conventional-commits/)
-we're able to automatically create formal "releases" of the workshop
-based on our commit messages. Releases in the context of workshops are
-simply snapshots in time of the workshop content. The releases are
-published to Zenodo for easier discovery, archival, and citation
-purposes. We use
+Since we follow [Conventional
+Commits](https://decisions.seedcase-project.org/why-conventional-commits/) we're
+able to automatically create formal "releases" of the workshop based on our
+commit messages. Releases in the context of workshops are simply snapshots in
+time of the workshop content. The releases are published to Zenodo for easier
+discovery, archival, and citation purposes. We use
 [Commitizen](https://decisions.seedcase-project.org/why-semantic-release-with-commitizen/)
-to automatically create these releases using
-[SemVer](https://semverdoc.org) as the version numbering scheme.
+to automatically create these releases using [SemVer](https://semverdoc.org) as
+the version numbering scheme.
 
-Because releases are created based on commit messages, a new release can
-be created quite often---sometimes several times in a day. This also
-means that any individual release will not have many changes within it.
-Below is a list of the releases we've made so far, along with what was
-changed within each release.
+Because releases are created based on commit messages, a new release can be
+created quite often---sometimes several times in a day. This also means that any
+individual release will not have many changes within it. Below is a list of the
+releases we've made so far, along with what was changed within each release.
 
-If you attended a workshop or used the workshop material as some point
-in time, you can always refer to this changelog page to find out what
-has been changed since you last used it.
+If you attended a workshop or used the workshop material as some point in time,
+you can always refer to this changelog page to find out what has been changed
+since you last used it.
 
 ## 0.11.0 (2026-06-04)
 
@@ -101,10 +99,8 @@ has been changed since you last used it.
 
 - :sparkles: add badges to landing page
 - :sparkles: standardize table widths of schedule
-- :see_no_evil: some `.vdoc.*` type files are created by Quarto, ignore
-  them
-- :sparkles: include hidden contributor list sections in README and
-  index
+- :see_no_evil: some `.vdoc.*` type files are created by Quarto, ignore them
+- :sparkles: include hidden contributor list sections in README and index
 
 ### Fix
 
@@ -119,8 +115,7 @@ has been changed since you last used it.
 - :hammer: rename `style` to `format-r` in justfile
 - :pencil2: use quotes around values in `_quarto.yml`
 - :recycle: include `@sec-` links to chapters along with a link
-- :technologist: simplify pull request template after Markdown formatter
-  added
+- :technologist: simplify pull request template after Markdown formatter added
 - :wrench: indent by 2 in Markdown files in `.editorconfig`
 - :recycle: install uv directly, rather than first pipx
 - :arrow_up: update pre-commit hook versions
@@ -182,8 +177,7 @@ has been changed since you last used it.
 
 ### Refactor
 
-- :recycle: output `get-contributors.sh` as text, send to file in
-  justfile
+- :recycle: output `get-contributors.sh` as text, send to file in justfile
 
 ## 0.4.12 (2025-09-03)
 
@@ -260,8 +254,8 @@ has been changed since you last used it.
 ### Refactor
 
 - :memo: simplify some text of the README
-- :recycle: replace ending of `_contributors.yml` with newline for
-  pre-commit styling
+- :recycle: replace ending of `_contributors.yml` with newline for pre-commit
+  styling
 - :hammer: exclude justfile when listing TODOs
 - :hammer: use `quarto update` to match recipe name
 - :arrow_up: update pre-commit hook versions
@@ -368,12 +362,10 @@ has been changed since you last used it.
 - :recycle: switch to using bash in `check-commits` justfile
 - :memo: fix link to instructor guide
 - :fire: don't need the update from template workflow
-- :recycle: switch to using `github_user` and `github_repo` for project
-  naming
+- :recycle: switch to using `github_user` and `github_repo` for project naming
 - :recycle: use lowercase for workshop type naming
 - :recycle: set Zenodo upload type to `lesson`
-- :recycle: moved version information for installing into
-  `_metadata.yml`
+- :recycle: moved version information for installing into `_metadata.yml`
 - :recycle: match syllabus structure to that done in GitHub Intro
 - :fire: session isn't always an R workshop, don't need code chunk
 
@@ -405,9 +397,7 @@ has been changed since you last used it.
 - :truck: converted includes into own pages in template
 - :recycle: remove social time from schedule
 - :recycle: include a starting URL for Quarto website in Netlify
-- :construction_worker: merge template website build workflow into one
-  file
+- :construction_worker: merge template website build workflow into one file
 - :recycle: expand on template's CONTRIBUTING doc
 - :truck: move code of conduct out of includes as own page
-- :recycle: use only one `.cz.toml`, but use internal 'if' statements
-  inside
+- :recycle: use only one `.cz.toml`, but use internal 'if' statements inside

CODE_OF_CONDUCT.md

@@ -1,28 +1,25 @@
 # Contributor Code of Conduct
 
-As contributors and maintainers of this project, we pledge to respect
-all people who contribute through reporting issues, posting suggestions,
-updating any material, submitting pull requests, and other activities.
+As contributors and maintainers of this project, we pledge to respect all people
+who contribute through reporting issues, posting suggestions, updating any
+material, submitting pull requests, and other activities.
 
-We are committed to making participation in this project a
-harassment-free experience for everyone, regardless of level of
-experience, gender, gender identity and expression, sexual orientation,
-disability, personal appearance, body size, race, ethnicity, age, or
-religion.
+We are committed to making participation in this project a harassment-free
+experience for everyone, regardless of level of experience, gender, gender
+identity and expression, sexual orientation, disability, personal appearance,
+body size, race, ethnicity, age, or religion.
 
-Examples of unacceptable behavior by participants include the use of
-sexual language or imagery, derogatory comments or personal attacks,
-trolling, public or private harassment, insults, or other unprofessional
-conduct.
+Examples of unacceptable behavior by participants include the use of sexual
+language or imagery, derogatory comments or personal attacks, trolling, public
+or private harassment, insults, or other unprofessional conduct.
 
-Project maintainers have the right and responsibility to remove, edit,
-or reject comments, commits, code, wiki edits, issues, and other
-contributions that are not aligned to this Code of Conduct. Project
-maintainers who do not follow the Code of Conduct may be removed from
-the project team.
+Project maintainers have the right and responsibility to remove, edit, or reject
+comments, commits, code, wiki edits, issues, and other contributions that are
+not aligned to this Code of Conduct. Project maintainers who do not follow the
+Code of Conduct may be removed from the project team.
 
-Instances of abusive, harassing, or otherwise unacceptable behavior may
-be reported by opening an issue or contacting one or more of the project
+Instances of abusive, harassing, or otherwise unacceptable behavior may be
+reported by opening an issue or contacting one or more of the project
 maintainers.
 
 This Code of Conduct is adapted from the Contributor Covenant