chore: update spelling bot to v0.0.26 and refine GitHub Actions permissions

[radist2s]

No description provided.

[changeset-bot]

⚠️ No Changeset found

Latest commit: 8efb327

Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.

This PR includes no changesets

When changesets are added to this PR, you'll see the packages that this PR includes changesets for and the associated semver types

Click here to learn what changesets are, and how to add one.

Click here if you're a maintainer who wants to add a changeset to this PR

[greptile-apps]

Greptile Summary

This PR updates the check-spelling/check-spelling GitHub Action from v0.0.24 to v0.0.26 across all jobs and tightens workflow-level permissions.

• Adds permissions: {} at the workflow level, ensuring jobs with no explicit permissions block default to no permissions rather than the repository default — a standard least-privilege hardening practice.
• Adds actions: read to comment-push and comment-pr jobs, which is required by v0.0.26 to retrieve workflow run artifacts/outputs.
• Fixes a missing newline at end of file.

Confidence Score: 4/5

Safe to merge — the changes harden permissions and update a dev-tooling action with no impact on production code.

All four jobs already had explicit permissions blocks, so the new top-level permissions: {} cleanly enforces least privilege without accidentally revoking anything. The two new actions: read grants match what the v0.0.26 release requires. The action is referenced by a mutable version tag rather than a pinned commit SHA, which is a minor supply-chain consideration but acceptable for a linting workflow that never touches production secrets beyond the deploy key already scoped to spelling updates.

No files require special attention.

Important Files Changed

Filename	Overview
.github/workflows/spelling.yml	Bumps check-spelling action from v0.0.24 → v0.0.26 across all four jobs, adds a top-level permissions: {} to harden default workflow permissions, adds actions: read to the comment-push and comment-pr jobs, and fixes a missing trailing newline.

Sequence Diagram

sequenceDiagram
    participant GH as GitHub Event
    participant S as spelling (job)
    participant CP as comment-push (job)
    participant CPR as comment-pr (job)
    participant U as update (job)

    GH->>S: push / pull_request_target
    note over S: permissions: contents:read, pull-requests:read, actions:read, security-events:write
    S-->>CP: followup output (if push)
    S-->>CPR: followup output (if pull_request)

    CP->>CP: "check-spelling@v0.0.26"
    note over CP: permissions: actions:read NEW, contents:write

    CPR->>CPR: "check-spelling@v0.0.26"
    note over CPR: permissions: actions:read NEW, contents:read, pull-requests:write

    GH->>U: "issue_comment (@check-spelling-bot apply)"
    note over U: permissions: contents:write, pull-requests:write, actions:read
    U->>U: "check-spelling@v0.0.26 (apply changes via ssh_key)"

Loading

_{Reviews (1): Last reviewed commit: "chore: update spelling bot to v0.0.26 an..." | Re-trigger Greptile}