feat: enable crate typos on ci

.pre-commit-config.yaml

@@ -3,6 +3,16 @@ default_language_version:
   node: system
 
 repos:
+  - repo: https://github.com/crate-ci/typos
+    rev: 00f422f3b19c57bc6338715ebfe3316d38768461 # v1.50.3
+    hooks:
+      - id: typos
+        # Drop the upstream default `--write-changes` so the hook only
+        # reports failures instead of writing changes.
+        # Keep `--force-exclude` so the excludes in typos.toml still
+        # apply to the paths prek passes in.
+        args: ["--force-exclude"]
+
   - repo: https://github.com/pre-commit/pre-commit-hooks
     rev: 2c9f875913ee60ca25ce70243dc24d5b6415598c # 4.6.0
     hooks:

modules/ROOT/partials/release-notes/release-26.7.adoc

@@ -428,6 +428,7 @@ Tracked in https://github.com/stackabletech/nifi-opa-plugin/issues/30[nifi-opa-p
 
 ===== Open Policy Agent
 
+// typos:ignore-next-line
 * Previously, the User Info Fetcher's outbound HTTP requests (to Microsoft Entra, Keycloak, and the XFSC AAS) had no timeout, so a slow or unresponsive backend could make a request hang indefinitely and stall user-info lookups.
   With this release, every outbound request has a 60-second overall timeout and a 15-second connection timeout.
   Implemented in https://github.com/stackabletech/opa-operator/pull/859[opa-operator#859].

typos.toml

@@ -0,0 +1,45 @@
+# Configuration for typos (https://github.com/crate-ci/typos), run via the prek
+# hook in .pre-commit-config.yaml.
+
+[files]
+# Bare `typos` skips hidden dirs by default, but prek passes explicit paths and
+# so does check them. Turn it off so both agree.
+ignore-hidden = false
+
+extend-exclude = [
+    # Ignore `.git`, which the above `ignore-hidden = false` would otherwise pull in.
+    ".git/",
+    # Vendored fork of antora-ui-default (see ui/UPSTREAM). Kept free of markers
+    # so upstream syncs stay clean.
+    "ui/",
+]
+
+[default]
+# typos has no native suppression directive
+# (https://github.com/crate-ci/typos/issues/316), so these regexes provide one.
+# A marker must sit in a comment: after `#`, `//` or `;` (free text may follow),
+# or inside a closed `<!-- -->`, `/* */` or `{# #}` (free text may precede the
+# closer). An unterminated `typos:ignore-block-start` suppresses nothing.
+#
+# Use one of the following when the word is correct at one place but would still be a typo elsewhere:
+#
+#   # typos:ignore-line        at the end of the line it applies to
+#   # typos:ignore-next-line   on its own line, above the offending line
+#   # typos:ignore-block-start / typos:ignore-block-end   around a block
+extend-ignore-re = [
+    '(?Rm)^.*?(?:(?:^|[^{])(?:#|//|;)[ \t]*typos:ignore-line\b.*|(?:<!--[ \t]*typos:ignore-line\b.*?-->|/\*[ \t]*typos:ignore-line\b.*?\*/|\{#[ \t]*typos:ignore-line\b.*?#\})[ \t]*)$',
+    '(?Rm)^[ \t]*(?:(?:#|//|;)[ \t]*typos:ignore-next-line\b.*|(?:<!--[ \t]*typos:ignore-next-line\b.*?-->|/\*[ \t]*typos:ignore-next-line\b.*?\*/|\{#[ \t]*typos:ignore-next-line\b.*?#\})[ \t]*)\r?\n.*$',
+    '(?ms)(?:(?:^|[^{])(?:#|//|;)[ \t]*typos:ignore-block-start\b|<!--[ \t]*typos:ignore-block-start\b[^\n]*?-->|/\*[ \t]*typos:ignore-block-start\b[^\n]*?\*/|\{#[ \t]*typos:ignore-block-start\b[^\n]*?#\}).*?(?:(?:^|[^{])(?:#|//|;)[ \t]*typos:ignore-block-end\b|<!--[ \t]*typos:ignore-block-end\b[^\n]*?-->|/\*[ \t]*typos:ignore-block-end\b[^\n]*?\*/|\{#[ \t]*typos:ignore-block-end\b[^\n]*?#\})',
+    # Random draw.io etags, in `.drawio` (`etag="..."`) and `.drawio.svg`
+    # (`etag=&quot;...&quot;`) files. Diagram labels stay checked.
+    'etag=(?:"|&quot;)[^"&]*',
+    # Spark's bundled ALS (Alternating Least Squares) example class, in YAML
+    # listing blocks where a marker would render verbatim.
+    'org\.apache\.spark\.examples\.SparkALS',
+]
+
+# Before adding an entry in here, consider an in-place marker instead.
+# Every entry below gets a one-line comment saying what the word is.
+[default.extend-words]
+# Azure Kubernetes Service
+aks = "aks"