Carry over enhancements from #2

.cspell.json

@@ -0,0 +1,20 @@
+{
+  "$schema": "https://raw.githubusercontent.com/streetsidesoftware/cspell/main/cspell.schema.json",
+  "version": "0.2",
+  "dictionaryDefinitions": [
+    {
+      "name": "project-words",
+      "path": "./project-words.txt",
+      "addWords": true
+    }
+  ],
+  "dictionaries": ["project-words"],
+  "ignorePaths": [
+    ".vscode",
+    "**/.cspell.json",
+    "**/.git/**",
+    "**/node_modules/**",
+    "**/package-lock.json",
+    "/project-words.txt"
+  ]
+}

.github/workflows/enforce-labels.yml

@@ -5,10 +5,18 @@ on:
   workflow_call:
   pull_request:
     types: [labeled, unlabeled, opened, edited, synchronize]
+
+permissions: read-all
+
 jobs:
   enforce-label:
     name: Enforce label
     runs-on: ubuntu-22.04
+    permissions:
+      contents: read
+      checks: write
+      pull-requests: write
+
     steps:
       - name: Enforce label
         uses: yogevbd/enforce-label-action@a3c219da6b8fa73f6ba62b68ff09c469b3a1c024 # 2.2.2

.github/workflows/workflow-linter.yml

@@ -6,6 +6,12 @@ on:
     paths:
       - .github/workflows/**
 
+permissions: read-all
+
 jobs:
   call-workflow:
     uses: bitwarden/gh-actions/.github/workflows/workflow-linter.yml@a30e9c3d658dc97c4c2e61ec749fdab64b83386c
+    permissions:
+      contents: read
+      checks: write
+      pull-requests: write

.mega-linter.yml

@@ -2,5 +2,3 @@ APPLY_FIXES: all
 DEFAULT_BRANCH: main
 SHOW_ELAPSED_TIME: false
 FILEIO_REPORTER: false
-DISABLE_LINTERS:
-  - SPELL_CSPELL

project-words.txt

@@ -0,0 +1,11 @@
+# Custom dictionary for spellchecking. Before adding a word here, consider whether you can put
+# it in a single (`) or multiline (```) code snippet instead, as they are automatically ignored
+# by the spellchecker. Please keep the list sorted alphabetically.
+
+Bitwarden
+classpath
+fullname
+keyserver
+stefanzweifel
+venv
+yogevbd