Fix spelling and grammar issues + add CI detection

.codespellrc

@@ -0,0 +1,7 @@
+# Configuration for codespell (https://github.com/codespell-project/codespell)
+# Shared by the CI workflow and local runs: just run `codespell` from the repo root.
+[codespell]
+skip = ./.git,./build,./third_party,*.svg
+# codespell only flags words from its curated misspelling dictionary, but it is not
+# language-aware. Add identifiers/terms that collide with real words here (comma-separated).
+ignore-words-list = te,pevents

.github/workflows/bindings-sysman-python-checks.yml

@@ -37,7 +37,7 @@ jobs:
 
     steps:
       - name: Checkout code
-        uses: actions/checkout@v4
+        uses: actions/checkout@v5
 
       - name: Set up Python ${{ env.PYTHON_VERSION }}
         uses: actions/setup-python@v5

.github/workflows/bindings-sysman-python-security-scan.yml

@@ -34,7 +34,7 @@ jobs:
 
     steps:
       - name: Checkout code
-        uses: actions/checkout@v4
+        uses: actions/checkout@v5
 
       - name: Set up Python
         uses: actions/setup-python@v5

.github/workflows/bindings-sysman-python-unit-tests-coverage.yml

@@ -38,7 +38,7 @@ jobs:
 
     steps:
       - name: Checkout code
-        uses: actions/checkout@v4
+        uses: actions/checkout@v5
         with:
           fetch-depth: 0  # Full history for better coverage comparison
 

.github/workflows/build-clang.yml

@@ -27,7 +27,7 @@ jobs:
         run: |
           apt-get update
           apt-get install -y clang cmake make git
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v5
       - name: Build Loader (${{ matrix.build_type }}) with Clang on ${{ matrix.container }}
         run: |
           mkdir build

.github/workflows/build-msi-package.yml

@@ -12,7 +12,7 @@ jobs:
     if: github.repository_owner == 'oneapi-src'
     runs-on: [windows-latest]
     steps:
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@v5
       - name: Setup Windows build environment
         uses: ilammy/msvc-dev-cmd@v1
         with:

.github/workflows/build-multi-static.yml

@@ -19,7 +19,7 @@ jobs:
       short-sha: ${{ steps.const.outputs.short-sha }}
       ref-slug: ${{ steps.const.outputs.ref-slug }}
     steps:
-    - uses: actions/checkout@v4
+    - uses: actions/checkout@v5
       with:
         clean: true
         ref: ${{ github.event.pull_request.head.sha }}
@@ -86,7 +86,7 @@ jobs:
         image-name=ghcr.io/${{ github.repository }}/${OS_STRING}
         ccache-dir=${CCACHE_DIR}
         EOF
-    - uses: actions/checkout@v4
+    - uses: actions/checkout@v5
       with:
         clean: true
         fetch-depth: 0

.github/workflows/build-multi.yml

@@ -19,7 +19,7 @@ jobs:
       short-sha: ${{ steps.const.outputs.short-sha }}
       ref-slug: ${{ steps.const.outputs.ref-slug }}
     steps:
-    - uses: actions/checkout@v4
+    - uses: actions/checkout@v5
       with:
         clean: true
         ref: ${{ github.event.pull_request.head.sha }}
@@ -104,7 +104,7 @@ jobs:
         image-name=ghcr.io/${{ github.repository }}/${OS_STRING}
         ccache-dir=${CCACHE_DIR}
         EOF
-    - uses: actions/checkout@v4
+    - uses: actions/checkout@v5
       with:
         clean: true
         fetch-depth: 0

.github/workflows/build-quick-static-n-1.yml

@@ -14,15 +14,15 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       # Use ccache-action for ccache setup and caching
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@v5
         with:
           fetch-depth: 0
           path: pr
       - uses: hendrikmuhs/ccache-action@v1
 
       # Checkout master branch for static loader source
       - name: Checkout master branch for static loader
-        uses: actions/checkout@v3
+        uses: actions/checkout@v5
         with:
           ref: master
           fetch-depth: 0
@@ -73,14 +73,14 @@ jobs:
     runs-on: windows-latest
     steps:
       # Checkout PR branch (dynamic loader source)
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@v5
         with:
           fetch-depth: 0
           path: pr
 
       # Checkout master branch for static loader source
       - name: Checkout master branch for static loader
-        uses: actions/checkout@v3
+        uses: actions/checkout@v5
         with:
           ref: master
           fetch-depth: 0

.github/workflows/build-quick-static.yml

@@ -12,7 +12,7 @@ jobs:
     if: github.repository_owner == 'oneapi-src'
     runs-on: [ubuntu-latest]
     steps:
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@v5
       - uses: hendrikmuhs/ccache-action@v1
       - name: Build Static Loader on Latest Ubuntu
         run: |
@@ -48,7 +48,7 @@ jobs:
     if: github.repository_owner == 'oneapi-src'
     runs-on: [windows-latest]
     steps:
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@v5
       - name: Setup Windows build environment
         uses: ilammy/msvc-dev-cmd@v1
         with:

.github/workflows/build-quick.yml

@@ -31,7 +31,7 @@ jobs:
             apt-get update
             apt-get install -y build-essential cmake git
           fi
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@v5
       - name: Build Loader on ${{ matrix.container }}
         run: |
           mkdir build
@@ -71,7 +71,7 @@ jobs:
     if: github.repository_owner == 'oneapi-src'
     runs-on: [windows-latest]
     steps:
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@v5
       - name: Setup Windows build environment
         uses: ilammy/msvc-dev-cmd@v1
         with:

.github/workflows/check-abi.yml

@@ -16,21 +16,21 @@ jobs:
       run: |
         sudo apt update
         sudo apt install -y elfutils universal-ctags vtable-dumper
-    - uses: actions/checkout@v2
+    - uses: actions/checkout@v5
       with:
         fetch-depth: 0 # Required due to the way Git works, without it this action won't be able to find any or the correct tags
     - uses: actions-ecosystem/action-get-latest-tag@v1
       id: get-latest-tag
       with:
         semver_only: true
     - name: Checkout base
-      uses: actions/checkout@v3
+      uses: actions/checkout@v5
       with:
         ref: ${{ steps.get-latest-tag.outputs.tag }}
         clean: true
         path: base
     - name: Checkout head
-      uses: actions/checkout@v3
+      uses: actions/checkout@v5
       with:
         clean: true
         path: head
@@ -92,13 +92,13 @@ jobs:
         sudo apt update
         sudo apt install -y elfutils universal-ctags vtable-dumper
     - name: Checkout base
-      uses: actions/checkout@v3
+      uses: actions/checkout@v5
       with:
         ref: ${{ github.base_ref }}
         clean: true
         path: base
     - name: Checkout head
-      uses: actions/checkout@v3
+      uses: actions/checkout@v5
       with:
         clean: true
         path: head

.github/workflows/codespell-comment.yml

@@ -0,0 +1,84 @@
+name: Codespell Comment
+
+# Posts the codespell report produced by the "Codespell" workflow back onto the
+# pull request. Because it is triggered by workflow_run it runs in the base
+# repository context with a writable token, so it can comment on fork PRs
+# without ever checking out or executing untrusted PR code.
+#
+# A comment is only created when spelling issues are found; an existing report
+# comment is updated in place (and flipped to "resolved" once issues are fixed).
+#
+# NOTE: workflow_run only triggers from workflow files on the default branch, so
+# this begins working once merged to master.
+
+on:
+  workflow_run:
+    workflows: [Codespell]
+    types: [completed]
+
+permissions:
+  contents: read
+  pull-requests: write
+
+jobs:
+  comment:
+    runs-on: ubuntu-latest
+    if: github.event.workflow_run.event == 'pull_request'
+    steps:
+    - name: Download report
+      uses: actions/download-artifact@v4
+      continue-on-error: true
+      with:
+        name: codespell-report
+        run-id: ${{ github.event.workflow_run.id }}
+        github-token: ${{ secrets.GITHUB_TOKEN }}
+    - name: Post or update PR comment
+      uses: actions/github-script@v7
+      with:
+        script: |
+          const fs = require('fs');
+          const marker = '<!-- codespell-report -->';
+          const { owner, repo } = context.repo;
+
+          if (!fs.existsSync('pr_number.txt')) {
+            core.info('No report artifact found; nothing to comment on.');
+            return;
+          }
+          const issue_number = parseInt(fs.readFileSync('pr_number.txt', 'utf8').trim(), 10);
+          if (!Number.isInteger(issue_number)) {
+            core.info('Invalid PR number; skipping.');
+            return;
+          }
+
+          const findings = fs.existsSync('codespell.txt')
+            ? fs.readFileSync('codespell.txt', 'utf8').trim()
+            : '';
+
+          const comments = await github.paginate(github.rest.issues.listComments, {
+            owner, repo, issue_number, per_page: 100,
+          });
+          const existing = comments.find(c => c.body && c.body.includes(marker));
+
+          let body;
+          if (!findings) {
+            if (!existing) return; // nothing to report and nothing to update
+            body = `${marker}\n:white_check_mark: **codespell** found no spelling issues.`;
+          } else {
+            body = [
+              marker,
+              '### :abc: codespell found possible spelling issues',
+              '',
+              '```',
+              findings,
+              '```',
+              '',
+              'If any are false positives (for example a variable name or acronym), '
+                + 'add them to `ignore-words-list` in `.codespellrc`.',
+            ].join('\n');
+          }
+
+          if (existing) {
+            await github.rest.issues.updateComment({ owner, repo, comment_id: existing.id, body });
+          } else {
+            await github.rest.issues.createComment({ owner, repo, issue_number, body });
+          }

.github/workflows/codespell.yml

@@ -0,0 +1,55 @@
+name: Codespell
+
+# Spell-checks pull requests with codespell. This job runs in the (untrusted)
+# pull_request context, so it only produces results that need no write access:
+#   * inline warning annotations on the changed files, and
+#   * a failed check so the problem is not easy to miss.
+# The PR comment is posted by the companion "Codespell Comment" workflow, which
+# runs from the base repo via workflow_run and therefore has a writable token
+# even for fork PRs. Configuration (skip/ignore lists) lives in .codespellrc.
+
+on:
+  pull_request:
+    branches: [master]
+
+permissions:
+  contents: read
+
+jobs:
+  codespell:
+    runs-on: ubuntu-latest
+    steps:
+    - uses: actions/checkout@v5
+    - uses: actions/setup-python@v5
+      with:
+        python-version: '3.x'
+    - name: Install codespell
+      run: pip install codespell==2.4.3
+    - name: Run codespell
+      run: |
+        codespell > codespell.txt 2>&1 || true
+        cat codespell.txt
+        # Emit an inline warning annotation for each finding.
+        awk -F: 'NF>=3 {
+          f=$1; sub(/^\.\//,"",f);
+          l=$2;
+          msg=$0; sub(/^[^:]*:[^:]*: /,"",msg);
+          printf "::warning file=%s,line=%s::codespell: %s\n", f, l, msg
+        }' codespell.txt
+    - name: Save PR number
+      run: echo "${{ github.event.number }}" > pr_number.txt
+    - name: Upload report
+      # Consumed by the "Codespell Comment" workflow to post the PR comment.
+      uses: actions/upload-artifact@v4
+      with:
+        name: codespell-report
+        path: |
+          codespell.txt
+          pr_number.txt
+        retention-days: 1
+    - name: Fail if spelling issues were found
+      run: |
+        if [ -s codespell.txt ]; then
+          echo "codespell found spelling issues; see the annotations above and the PR comment."
+          exit 1
+        fi

.github/workflows/scorecard.yml

@@ -24,7 +24,7 @@ jobs:
       id-token: write
     steps:
     - name: "Checkout code"
-      uses: actions/checkout@v4
+      uses: actions/checkout@v5
       with:
         persist-credentials: false
     - name: "Run analysis"

.github/workflows/update-spec.yml

@@ -34,20 +34,22 @@ jobs:
         python-version: '3.x'
     - name: Install dependencies
       run: pip install Mako==1.1.0 PyYAML==5.2
-    - uses: actions/checkout@v3
+    - uses: actions/checkout@v5
       with:
         clean: true
         fetch-depth: 0
         fetch-tags: true
-        token: ${{ secrets.TOKEN }}
+        # Fall back to the default token when the push secret is unavailable
+        # (e.g. pull_request runs), otherwise checkout@v5 rejects an empty token.
+        token: ${{ secrets.TOKEN || github.token }}
     - name: Checkout develop branch or create local version
       if: ${{ github.event_name == 'workflow_dispatch' }}
       run: git checkout ${{ inputs.branch }} || git checkout -b ${{ inputs.branch }}
     - name: Reset develop branch to master
       if: ${{ github.event_name == 'workflow_dispatch' }}
       run: git reset --hard origin/master
     - name: Checkout spec repository
-      uses: actions/checkout@v4
+      uses: actions/checkout@v5
       with:
         repository: ${{ github.event_name == 'pull_request' && 'oneapi-src/level-zero-spec' || inputs.repository }}
         clean: true