ci: move codespell job into its own workflow

Split the spellchecking job from the build-related jobs to make
debugging easier.

4 files changed, 44 insertions, 22 deletions

diff --git a/.github/workflows/build-extra.yml b/.github/workflows/build-extra.yml
index 0f7ddb466..3fc71a299 100644
--- a/.github/workflows/build-extra.yml
+++ b/.github/workflows/build-extra.yml
@@ -13,6 +13,7 @@ on:
       - .github/pull_request_template.md
       - .github/workflows/build.yml
       - .github/workflows/codeql-analysis.yml
+      - .github/workflows/codespell.yml
       - .github/workflows/profile-checks.yml
       - .gitignore
       - .gitlab-ci.yml
@@ -35,6 +36,7 @@ on:
       - .github/pull_request_template.md
       - .github/workflows/build.yml
       - .github/workflows/codeql-analysis.yml
+      - .github/workflows/codespell.yml
       - .github/workflows/profile-checks.yml
       - .gitignore
       - .gitlab-ci.yml
@@ -163,25 +165,3 @@ jobs:
     - run: cppcheck --version
     - name: cppcheck
       run: cppcheck -q --force --error-exitcode=1 --enable=warning,performance .
-  codespell:
-    runs-on: ubuntu-22.04
-    steps:
-    - name: Harden Runner
-      uses: step-security/harden-runner@8ca2b8b2ece13480cda6dacd3511b49857a23c09
-      with:
-        egress-policy: block
-        allowed-endpoints: >
-          archive.ubuntu.com:80
-          azure.archive.ubuntu.com:80
-          github.com:443
-          packages.microsoft.com:443
-          ppa.launchpadcontent.net:443
-          security.ubuntu.com:80
-    - uses: actions/checkout@c85c95e3d7251135ab7dc9ce3241c5835cc595a9
-    - name: update package information
-      run: sudo apt-get update -qy
-    - name: install dependencies
-      run: sudo apt-get install -qy codespell
-    - run: codespell --version
-    - name: codespell
-      run: make codespell
diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
index cb2c15759..489ed4335 100644
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@@ -9,6 +9,7 @@ on:
       - .github/pull_request_template.md
       - .github/workflows/build-extra.yml
       - .github/workflows/codeql-analysis.yml
+      - .github/workflows/codespell.yml
       - .github/workflows/profile-checks.yml
       - .gitignore
       - .gitlab-ci.yml
@@ -26,6 +27,7 @@ on:
       - .github/pull_request_template.md
       - .github/workflows/build-extra.yml
       - .github/workflows/codeql-analysis.yml
+      - .github/workflows/codespell.yml
       - .github/workflows/profile-checks.yml
       - .gitignore
       - .gitlab-ci.yml
diff --git a/.github/workflows/codeql-analysis.yml b/.github/workflows/codeql-analysis.yml
index 0f9c0f740..bbd4e47d5 100644
--- a/.github/workflows/codeql-analysis.yml
+++ b/.github/workflows/codeql-analysis.yml
@@ -18,6 +18,7 @@ on:
       - .github/pull_request_template.md
       - .github/workflows/build-extra.yml
       - .github/workflows/build.yml
+      - .github/workflows/codespell.yml
       - .github/workflows/profile-checks.yml
       - .gitignore
       - .gitlab-ci.yml
@@ -40,6 +41,7 @@ on:
       - .github/pull_request_template.md
       - .github/workflows/build-extra.yml
       - .github/workflows/build.yml
+      - .github/workflows/codespell.yml
       - .github/workflows/profile-checks.yml
       - .gitignore
       - .gitlab-ci.yml
diff --git a/.github/workflows/codespell.yml b/.github/workflows/codespell.yml
new file mode 100644
index 000000000..aab0674ec
--- /dev/null
+++ b/.github/workflows/codespell.yml
@@ -0,0 +1,38 @@
+name: Codespell
+
+on:
+  push:
+    paths:
+      - 'src/**'
+      - 'test/**'
+  pull_request:
+    paths:
+      - 'src/**'
+      - 'test/**'
+
+permissions:  # added using https://github.com/step-security/secure-workflows
+  contents: read
+
+jobs:
+  codespell:
+    runs-on: ubuntu-22.04
+    steps:
+    - name: Harden Runner
+      uses: step-security/harden-runner@8ca2b8b2ece13480cda6dacd3511b49857a23c09
+      with:
+        egress-policy: block
+        allowed-endpoints: >
+          archive.ubuntu.com:80
+          azure.archive.ubuntu.com:80
+          github.com:443
+          packages.microsoft.com:443
+          ppa.launchpadcontent.net:443
+          security.ubuntu.com:80
+    - uses: actions/checkout@c85c95e3d7251135ab7dc9ce3241c5835cc595a9
+    - name: update package information
+      run: sudo apt-get update -qy
+    - name: install dependencies
+      run: sudo apt-get install -qy codespell
+    - run: codespell --version
+    - name: codespell
+      run: make codespell