Carry over enhancements from #2

Author: withinfocus

.cspell.json

@@ -0,0 +1,20 @@
+{
+  "$schema": "https://raw.githubusercontent.com/streetsidesoftware/cspell/main/cspell.schema.json",
+  "version": "0.2",
+  "dictionaryDefinitions": [
+    {
+      "name": "project-words",
+      "path": "./project-words.txt",
+      "addWords": true
+    }
+  ],
+  "dictionaries": ["project-words"],
+  "ignorePaths": [
+    ".vscode",
+    "**/.cspell.json",
+    "**/.git/**",
+    "**/node_modules/**",
+    "**/package-lock.json",
+    "/project-words.txt"
+  ]
+}

.github/workflows/enforce-labels.yml

@@ -5,11 +5,18 @@ on:
   workflow_call:
   pull_request:
     types: [labeled, unlabeled, opened, reopened, synchronize]
+
+permissions: read-all
+
 jobs:
   enforce-label:
     if: ${{ contains(github.event.*.labels.*.name, 'hold') || contains(github.event.*.labels.*.name, 'needs-qa') }}
     name: Enforce label
     runs-on: ubuntu-22.04
+    permissions:
+      contents: read
+      checks: write
+      pull-requests: write
 
     steps:
       - name: Check for label

.github/workflows/workflow-linter.yml

@@ -6,6 +6,12 @@ on:
     paths:
       - .github/workflows/**
 
+permissions: read-all
+
 jobs:
   call-workflow:
     uses: bitwarden/gh-actions/.github/workflows/workflow-linter.yml@67ab95d7a466bcefdedf3f93cbc10bcff436edfe
+    permissions:
+      contents: read
+      checks: write
+      pull-requests: write

.mega-linter.yml

@@ -2,5 +2,3 @@ APPLY_FIXES: all
 DEFAULT_BRANCH: main
 SHOW_ELAPSED_TIME: false
 FILEIO_REPORTER: false
-DISABLE_LINTERS:
-  - SPELL_CSPELL

project-words.txt

@@ -0,0 +1,11 @@
+# Custom dictionary for spellchecking. Before adding a word here, consider whether you can put
+# it in a single (`) or multiline (```) code snippet instead, as they are automatically ignored
+# by the spellchecker. Please keep the list sorted alphabetically.
+
+Bitwarden
+classpath
+fullname
+keyserver
+stefanzweifel
+venv
+yogevbd