feat: Rollout crate/typos for operators (#760)

* chore: Generated commit to update templated files since the last template run up to stackabletech/operator-templating@0f53eec

Reference-to: stackabletech/operator-templating@0f53eec (feat: Rollout crate/typos for operators)

* chore: Add typos.toml and fix spelling findings

---------

Co-authored-by: Maxi Wittich <maximilian.wittich@stackable.tech>

Author: stackable-bot

.pre-commit-config.yaml

@@ -7,6 +7,19 @@ default_language_version:
   node: system
 
 repos:
+  # The word lists live in a per-repo `typos.toml`, which is not templated.
+  # typos has no layered configuration (https://github.com/crate-ci/typos/issues/193).
+  # A templated config can currently not be extended locally.
+  - repo: https://github.com/crate-ci/typos
+    rev: 00f422f3b19c57bc6338715ebfe3316d38768461  # v1.50.3
+    hooks:
+      - id: typos
+        # Drop the upstream default `--write-changes` so the hook only
+        # reports failures instead of writing changes.
+        # Keep `--force-exclude` so the excludes in typos.toml still
+        # apply to the paths prek passes in.
+        args: ["--force-exclude"]
+
   - repo: https://github.com/pre-commit/pre-commit-hooks
     rev: 3e8a8703264a2f4a69428a0aa4dcb512790b2c8c # 6.0.0
     hooks:

docs/modules/secret-operator/pages/openshift.adoc

@@ -21,6 +21,6 @@ Upgrading to a new version requires you to uninstall the existing version of the
 * SecretClass: tls
 * ServiceAccount: secret-operator-service-account
 * ClusterRole: secret-operator-clusterrole
-* ClusterRoleBinding: secret-opreator-clusterrole-binding
+* ClusterRoleBinding: secret-operator-clusterrole-binding
 
-After these resources have been cleand up, you can install a new version of the operator.
+After these resources have been cleaned up, you can install a new version of the operator.

rust/cert-tools/src/cert_ext.rs

@@ -13,7 +13,7 @@ pub enum Error {
     #[snafu(display("failed to convert certificate serial number to a hexadecimal string"))]
     ConvertSerialToHexString { source: openssl::error::ErrorStack },
 
-    #[snafu(display("failed to retireve certificate digest as SHA256"))]
+    #[snafu(display("failed to retrieve certificate digest as SHA256"))]
     RetrieveDigest { source: openssl::error::ErrorStack },
 }
 

rust/cert-tools/src/cmds/pkcs12.rs

@@ -13,7 +13,7 @@ pub enum Error {
     ))]
     NoCertificateSources,
 
-    #[snafu(display("failed to read certifcate source at {path}", path = path.display()))]
+    #[snafu(display("failed to read certificate source at {path}", path = path.display()))]
     ReadCertificate {
         source: crate::cli::CertInputError,
         path: PathBuf,

rust/cert-tools/src/parsers/pkcs12.rs

@@ -8,7 +8,7 @@ use snafu::{OptionExt, ResultExt, Snafu};
 
 #[derive(Debug, Snafu)]
 pub enum ParseError {
-    #[snafu(display("failed to deseralize PKCS#12 DER encoded file"))]
+    #[snafu(display("failed to deserialize PKCS#12 DER encoded file"))]
     DeserializeFile { source: openssl::error::ErrorStack },
 
     #[snafu(display("failed to parse file as PKCS#12"))]

rust/operator-binary/src/backend/mod.rs

@@ -180,7 +180,7 @@ pub struct TrustSelector {
 #[strum(serialize_all = "kebab-case")]
 #[serde(rename_all = "kebab-case")]
 pub enum ProvisionParts {
-    /// Provision only public (non-senstive) data.
+    /// Provision only public (non-sensitive) data.
     Public,
 
     /// Provision both public and private data.

rust/operator-binary/src/format/well_known.rs

@@ -106,7 +106,7 @@ impl WellKnownSecretData {
 
         // Which file is tried to be parsed first matters. To support the use-case of people bringing
         // their own non-sensitive data via a Secret and consumers only requiring access to
-        // non-sensitve data (for example for CA verification), the non-senstive files are parsed
+        // non-sensitive data (for example for CA verification), the non-sensitive files are parsed
         // first. If the `relaxed` flag is provided, this function tries to parse sensitive files
         // but won't hard-error when they are not found.
 

scripts/generate-olm.py

@@ -46,6 +46,7 @@
 }
 
 # Stackable logo icon (PNG, base64-encoded). Sourced from the 25.11.0 OLM bundle.
+# typos:ignore-block-start
 _STACKABLE_ICON_B64 = (
     "iVBORw0KGgoAAAANSUhEUgAABCQAAAQ3CAYAAAAg1L88AAAACXBIWXMAABcRAAAXEQHKJvM/AAAg"
     "AElEQVR4nOzdT2ycZ4Ln95c09YdqW5SsluWxvSDdA3m7G2iIyCEBFsFaM0DqKt820WW8OSUGAhh7"
@@ -943,6 +944,7 @@
     "EgAAAEB0ggQAAAAQnSABAAAARCdIAAAAANEJEgAAAEB0ggQAAAAQnSABAAAARCdIAAAAANEJEgAA"
     "AEB0ggQAAAAQnSABAAAARCdIAAAAANEJEgAAAEBcSZL8f1HQsc8tcXUVAAAAAElFTkSuQmCC"
 )
+# typos:ignore-block-end
 
 # Permissions required by the olm-deployer service account (the bootstrap Deployment).
 # This account applies the ConfigMap manifests (DaemonSet, Deployment, CSIDriver, etc.).

scripts/release_cert-tools.sh

@@ -60,7 +60,7 @@ fi
 git add rust/cert-tools/CHANGELOG.md rust/cert-tools/Cargo.*
 git commit --message "chore(cert-tools): Release $CLEANED_BUMPED_VERSION" --no-verify --gpg-sign
 
-echo "Do you want to proceed with rasing a PR (y/N)?"
+echo "Do you want to proceed with raising a PR (y/N)?"
 read -r RESPONSE
 
 if [[ "$RESPONSE" == "y" || "$RESPONSE" == "Y" ]]; then

typos.toml

@@ -0,0 +1,54 @@
+# Configuration for typos (https://github.com/crate-ci/typos), run via the prek
+# hook in .pre-commit-config.yaml.
+
+[files]
+# Bare `typos` skips hidden dirs by default, but prek passes explicit paths and
+# so does check them. Turn it off so both agree.
+ignore-hidden = false
+
+extend-exclude = [
+    # Ignore `.git`, which the above `ignore-hidden = false` would otherwise pull in.
+    ".git/",
+    # Generated by crate2nix (`make regenerate-nix`). Already skipped by the prek
+    # top-level `exclude`; listed here so a bare `typos` run agrees.
+    "Cargo.nix",
+    # Generated by `make regenerate-charts` from the Rust doc comments, which are
+    # checked at their source. The rest is Kubernetes' own schema documentation.
+    "extra/crds.yaml",
+]
+
+[default]
+# typos has no native suppression directive
+# (https://github.com/crate-ci/typos/issues/316), so these regexes provide one.
+# A marker must sit in a comment: after `#`, `//` or `;` (free text may follow),
+# or inside a closed `<!-- -->`, `/* */` or `{# #}` (free text may precede the
+# closer). An unterminated `typos:ignore-block-start` suppresses nothing.
+#
+# Use one of the following when the word is correct at one place but would still be a typo elsewhere:
+#
+#   # typos:ignore-line        at the end of the line it applies to
+#   # typos:ignore-next-line   on its own line, above the offending line
+#   # typos:ignore-block-start / typos:ignore-block-end   around a block
+extend-ignore-re = [
+    '(?Rm)^.*?(?:(?:^|[^{])(?:#|//|;)[ \t]*typos:ignore-line\b.*|(?:<!--[ \t]*typos:ignore-line\b.*?-->|/\*[ \t]*typos:ignore-line\b.*?\*/|\{#[ \t]*typos:ignore-line\b.*?#\})[ \t]*)$',
+    '(?Rm)^[ \t]*(?:(?:#|//|;)[ \t]*typos:ignore-next-line\b.*|(?:<!--[ \t]*typos:ignore-next-line\b.*?-->|/\*[ \t]*typos:ignore-next-line\b.*?\*/|\{#[ \t]*typos:ignore-next-line\b.*?#\})[ \t]*)\r?\n.*$',
+    '(?ms)(?:(?:^|[^{])(?:#|//|;)[ \t]*typos:ignore-block-start\b|<!--[ \t]*typos:ignore-block-start\b[^\n]*?-->|/\*[ \t]*typos:ignore-block-start\b[^\n]*?\*/|\{#[ \t]*typos:ignore-block-start\b[^\n]*?#\}).*?(?:(?:^|[^{])(?:#|//|;)[ \t]*typos:ignore-block-end\b|<!--[ \t]*typos:ignore-block-end\b[^\n]*?-->|/\*[ \t]*typos:ignore-block-end\b[^\n]*?\*/|\{#[ \t]*typos:ignore-block-end\b[^\n]*?#\})',
+    # Base64 bodies of PEM blocks (test certificates and CAs).
+    '(?s)-----BEGIN [A-Z ]+-----.*?-----END [A-Z ]+-----',
+]
+
+# Before adding an entry in here, consider an in-place marker instead.
+# Every entry below gets a one-line comment saying what the word is.
+[default.extend-words]
+# Azure Kubernetes Service
+aks = "aks"
+# Accepted variant of "unparsable". Used in a cert-manager backend test name.
+unparseable = "unparseable"
+# openssl's `-passin` flag.
+passin = "passin"
+
+[default.extend-identifiers]
+# Short for "type", which is a Rust keyword. Used as a field and binding name.
+tpe = "tpe"
+# Triple-DES EDE (encrypt-decrypt-encrypt) cipher type from the `des` crate.
+TdesEde3 = "TdesEde3"