feat(linter): add codespell linter

Add the codespell linter which uses a dictionary of common misspellings and ignores unknown words. Signed-off-by: Roger Luethi <[email protected]>
oxsecurity · ideaship · Sep 29, 2025 · Nov 20, 2025 · d16a1ac913203ce11e879e259f3a31e609d4b957 · cursor
commit d16a1ac913203ce11e879e259f3a31e609d4b957
@@ -84,6 +84,11 @@
     "image": "https://opengraph.githubassets.com/bf0d187aea6f03a804178458080b2be18a5fd1bf8d8cc353ff3150743aae9805/greglook/cljstyle",
     "title": "GitHub - greglook/cljstyle: A tool for formatting Clojure code"
   },
+  "codespell": {
+    "description": "codespell checks code and documentation for common misspellings.",
+    "image": null,
+    "title": "codespell-project/codespell: check code for common misspellings"
+  },
   "coffeelint": {
     "description": "\n          CoffeeLint is a style checker that helps keep\n          CoffeeScript\n          code clean and consistent. CoffeeScript does a great job at\n          insulating programmers from many of\n          JavaScript's bad parts, but it won't help enforce a consistent style\n          across a code base. CoffeeLint can help with that.\n        ",
     "image": null,
@@ -639,4 +644,4 @@
     "image": "https://avatars3.githubusercontent.com/u/5244945?s=400&v=4",
     "title": "adrienverge/yamllint"
   }
-}
+}
@@ -15,6 +15,7 @@
     "clippy": "0.1.91",
     "clj-kondo": "2025.10.23",
     "cljstyle": "0.17.642",
+    "codespell": "2.4.1",
     "coffeelint": "5.2.11",
     "cppcheck": "2.14.2",
     "cpplint": "2.0.2",

@@ -104,6 +104,7 @@
   "spell_proselint",
   "spell_vale",
   "spell_lychee",
+  "spell_codespell",
   "sql_sqlfluff",
   "sql_tsqllint",
   "swift_swiftlint",

@@ -0,0 +1,2 @@
+abandonded Dockefile
+abberivated acadamy
@@ -0,0 +1,2 @@
+abandonded Dockefile
+abberivated acadamy
@@ -0,0 +1,2 @@
+abandoned Dockerfile
+abbreviated academy
@@ -76,6 +76,8 @@
         "citeyear",
         "ckKXNNNXkc",
         "cloneable-readable",
+        "codespell",
+        "codespellrc",
         "crcr",
         "cyclonedx",
         "dKNNXXO",

@@ -25,6 +25,7 @@ DISABLE_ERRORS_LINTERS:
   - REPOSITORY_DEVSKIM
   - REPOSITORY_GRYPE
   - REPOSITORY_SEMGREP
+  - SPELL_CODESPELL
   - SPELL_LYCHEE
   - YAML_YAMLLINT
 PRINT_ALL_FILES: false

@@ -11,6 +11,7 @@ Note: Can be used with `oxsecurity/megalinter@beta` in your GitHub Action mega-l
 - Core
 
 - New linters
+  - Add [codespell](https://github.com/codespell-project/codespell)
 
 - Disabled linters
   - Reactivate [checkov](https://megalinter.io/beta/descriptors/repository_checkov/)

@@ -350,6 +350,8 @@ ARG PIP_SNAKEFMT_VERSION=0.11.2
 ARG NPM_CSPELL_VERSION=9.3.2
 # renovate: datasource=pypi depName=proselint
 ARG PIP_PROSELINT_VERSION=0.14.0
+# renovate: datasource=pypi depName=codespell
+ARG PIP_CODESPELL_VERSION=2.4.1
 # renovate: datasource=pypi depName=sqlfluff
 ARG PIP_SQLFLUFF_VERSION=3.5.0
 # renovate: datasource=nuget depName=TSQLLint
@@ -521,11 +523,12 @@ RUN uv pip install --system --no-cache pip==${PIP_PIP_VERSION} virtualenv==${PIP
     && uv venv --seed --no-project --no-managed-python --no-cache "/venvs/snakemake" && VIRTUAL_ENV="/venvs/snakemake" uv pip install --no-cache snakemake==${PIP_SNAKEMAKE_VERSION} \
     && uv venv --seed --no-project --no-managed-python --no-cache "/venvs/snakefmt" && VIRTUAL_ENV="/venvs/snakefmt" uv pip install --no-cache snakefmt==${PIP_SNAKEFMT_VERSION} \
     && uv venv --seed --no-project --no-managed-python --no-cache "/venvs/proselint" && VIRTUAL_ENV="/venvs/proselint" uv pip install --no-cache proselint==${PIP_PROSELINT_VERSION} \
+    && uv venv --seed --no-project --no-managed-python --no-cache "/venvs/codespell" && VIRTUAL_ENV="/venvs/codespell" uv pip install --no-cache codespell==${PIP_CODESPELL_VERSION} \
     && uv venv --seed --no-project --no-managed-python --no-cache "/venvs/sqlfluff" && VIRTUAL_ENV="/venvs/sqlfluff" uv pip install --no-cache sqlfluff==${PIP_SQLFLUFF_VERSION} \
     && uv venv --seed --no-project --no-managed-python --no-cache "/venvs/yamllint" && VIRTUAL_ENV="/venvs/yamllint" uv pip install --no-cache yamllint==${PIP_YAMLLINT_VERSION}  \
     && find /venvs \( -type f \( -iname \*.pyc -o -iname \*.pyo \) -o -type d -iname __pycache__ \) -delete \
     && rm -rf /root/.cache
-ENV PATH="${PATH}":/venvs/ansible-lint/bin:/venvs/cpplint/bin:/venvs/cfn-lint/bin:/venvs/stylelint/bin:/venvs/djlint/bin:/venvs/pylint/bin:/venvs/black/bin:/venvs/flake8/bin:/venvs/isort/bin:/venvs/bandit/bin:/venvs/mypy/bin:/venvs/ruff/bin:/venvs/ruff-format/bin:/venvs/checkov/bin:/venvs/semgrep/bin:/venvs/robocop/bin:/venvs/rst-lint/bin:/venvs/rstcheck/bin:/venvs/rstfmt/bin:/venvs/snakemake/bin:/venvs/snakefmt/bin:/venvs/proselint/bin:/venvs/sqlfluff/bin:/venvs/yamllint/bin
+ENV PATH="${PATH}":/venvs/ansible-lint/bin:/venvs/cpplint/bin:/venvs/cfn-lint/bin:/venvs/stylelint/bin:/venvs/djlint/bin:/venvs/pylint/bin:/venvs/black/bin:/venvs/flake8/bin:/venvs/isort/bin:/venvs/bandit/bin:/venvs/mypy/bin:/venvs/ruff/bin:/venvs/ruff-format/bin:/venvs/checkov/bin:/venvs/semgrep/bin:/venvs/robocop/bin:/venvs/rst-lint/bin:/venvs/rstcheck/bin:/venvs/rstfmt/bin:/venvs/snakemake/bin:/venvs/snakefmt/bin:/venvs/proselint/bin:/venvs/codespell/bin:/venvs/sqlfluff/bin:/venvs/yamllint/bin
 #PIPVENV__END
 
 ############################
@@ -1131,6 +1134,8 @@ RUN curl -sSfL https://raw.githubusercontent.com/anchore/syft/refs/tags/v${REPOS
 # lychee installation
 # Managed with COPY --link --from=lychee /usr/local/bin/lychee /usr/bin/
 #
+# codespell installation
+#
 # sqlfluff installation
 #
 # tsqllint installation

@@ -112,6 +112,7 @@
 | SPELL_PROSELINT                   | ghcr.io/oxsecurity/megalinter-only-spell_proselint:beta                   |          ![Docker Image Size (tag)](https://img.shields.io/docker/image-size/oxsecurity/megalinter-only-spell_proselint/beta)          |
 | SPELL_VALE                        | ghcr.io/oxsecurity/megalinter-only-spell_vale:beta                        |            ![Docker Image Size (tag)](https://img.shields.io/docker/image-size/oxsecurity/megalinter-only-spell_vale/beta)             |
 | SPELL_LYCHEE                      | ghcr.io/oxsecurity/megalinter-only-spell_lychee:beta                      |           ![Docker Image Size (tag)](https://img.shields.io/docker/image-size/oxsecurity/megalinter-only-spell_lychee/beta)            |
+| SPELL_CODESPELL                   | ghcr.io/oxsecurity/megalinter-only-spell_codespell:beta                   |          ![Docker Image Size (tag)](https://img.shields.io/docker/image-size/oxsecurity/megalinter-only-spell_codespell/beta)          |
 | SQL_SQLFLUFF                      | ghcr.io/oxsecurity/megalinter-only-sql_sqlfluff:beta                      |           ![Docker Image Size (tag)](https://img.shields.io/docker/image-size/oxsecurity/megalinter-only-sql_sqlfluff/beta)            |
 | SQL_TSQLLINT                      | ghcr.io/oxsecurity/megalinter-only-sql_tsqllint:beta                      |           ![Docker Image Size (tag)](https://img.shields.io/docker/image-size/oxsecurity/megalinter-only-sql_tsqllint/beta)            |
 | SWIFT_SWIFTLINT                   | ghcr.io/oxsecurity/megalinter-only-swift_swiftlint:beta                   |          ![Docker Image Size (tag)](https://img.shields.io/docker/image-size/oxsecurity/megalinter-only-swift_swiftlint/beta)          |

@@ -163,6 +163,8 @@ ARG PIP_SNAKEFMT_VERSION=0.11.2
 ARG NPM_CSPELL_VERSION=9.3.2
 # renovate: datasource=pypi depName=proselint
 ARG PIP_PROSELINT_VERSION=0.14.0
+# renovate: datasource=pypi depName=codespell
+ARG PIP_CODESPELL_VERSION=2.4.1
 # renovate: datasource=pypi depName=sqlfluff
 ARG PIP_SQLFLUFF_VERSION=3.5.0
 # renovate: datasource=npm depName=@ibm/tekton-lint
@@ -271,11 +273,12 @@ RUN uv pip install --system --no-cache pip==${PIP_PIP_VERSION} virtualenv==${PIP
     && uv venv --seed --no-project --no-managed-python --no-cache "/venvs/snakemake" && VIRTUAL_ENV="/venvs/snakemake" uv pip install --no-cache snakemake==${PIP_SNAKEMAKE_VERSION} \
     && uv venv --seed --no-project --no-managed-python --no-cache "/venvs/snakefmt" && VIRTUAL_ENV="/venvs/snakefmt" uv pip install --no-cache snakefmt==${PIP_SNAKEFMT_VERSION} \
     && uv venv --seed --no-project --no-managed-python --no-cache "/venvs/proselint" && VIRTUAL_ENV="/venvs/proselint" uv pip install --no-cache proselint==${PIP_PROSELINT_VERSION} \
+    && uv venv --seed --no-project --no-managed-python --no-cache "/venvs/codespell" && VIRTUAL_ENV="/venvs/codespell" uv pip install --no-cache codespell==${PIP_CODESPELL_VERSION} \
     && uv venv --seed --no-project --no-managed-python --no-cache "/venvs/sqlfluff" && VIRTUAL_ENV="/venvs/sqlfluff" uv pip install --no-cache sqlfluff==${PIP_SQLFLUFF_VERSION} \
     && uv venv --seed --no-project --no-managed-python --no-cache "/venvs/yamllint" && VIRTUAL_ENV="/venvs/yamllint" uv pip install --no-cache yamllint==${PIP_YAMLLINT_VERSION}  \
     && find /venvs \( -type f \( -iname \*.pyc -o -iname \*.pyo \) -o -type d -iname __pycache__ \) -delete \
     && rm -rf /root/.cache
-ENV PATH="${PATH}":/venvs/ansible-lint/bin:/venvs/cpplint/bin:/venvs/stylelint/bin:/venvs/djlint/bin:/venvs/checkov/bin:/venvs/semgrep/bin:/venvs/snakemake/bin:/venvs/snakefmt/bin:/venvs/proselint/bin:/venvs/sqlfluff/bin:/venvs/yamllint/bin
+ENV PATH="${PATH}":/venvs/ansible-lint/bin:/venvs/cpplint/bin:/venvs/stylelint/bin:/venvs/djlint/bin:/venvs/checkov/bin:/venvs/semgrep/bin:/venvs/snakemake/bin:/venvs/snakefmt/bin:/venvs/proselint/bin:/venvs/codespell/bin:/venvs/sqlfluff/bin:/venvs/yamllint/bin
 #PIPVENV__END
 
 ############################
@@ -490,6 +493,8 @@ RUN curl --retry 5 --retry-delay 5 -sSLO https://github.com/pinterest/ktlint/rel
 # lychee installation
 # Managed with COPY --link --from=lychee /usr/local/bin/lychee /usr/bin/
 #
+# codespell installation
+#
 # sqlfluff installation
 #
 # tekton-lint installation

@@ -55,6 +55,7 @@
         "SPELL_PROSELINT",
         "SPELL_VALE",
         "SPELL_LYCHEE",
+        "SPELL_CODESPELL",
         "SQL_SQLFLUFF",
         "TEKTON_TEKTON_LINT",
         "XML_XMLLINT",
Original file line number	Diff line number	Diff line change
		@@ -0,0 +1,2 @@
		abandonded Dockefile
		abberivated acadamy
Copy link cursor bot Nov 14, 2025 Choose a reason for hiding this comment The reason will be displayed to describe this comment to others. Learn more. Bug: Autofix Test File: Misspellings Remain Unfixed The `spell_fix_1.md` test file contains the same misspellings as `spell_bad_1.md`, but should contain the corrected version. Since `codespell` has `cli_lint_fix_arg_name: --write-changes` defined, autofix tests expect this file to show the corrected output after applying fixes. It should contain "abandoned Dockerfile\nabbreviated academy" to match the corrections in `spell_good_1.md`.