diff --git a/.github/actions/spelling/advice.md b/.github/actions/spelling/advice.md
index 1004eeaa604..84eb9218e2f 100644
--- a/.github/actions/spelling/advice.md
+++ b/.github/actions/spelling/advice.md
@@ -14,7 +14,9 @@ https://www.regexplanet.com/advanced/perl/) yours before committing to verify it
 
 * well-formed pattern.
 
-  If you can write a [pattern](https://github.com/check-spelling/check-spelling/wiki/Configuration-Examples:-patterns) that would match it,
+  If you can write a [pattern](
+https://github.com/check-spelling/check-spelling/wiki/Configuration-Examples:-patterns
+) that would match it,
   try adding it to the `patterns.txt` file.
 
   Patterns are Perl 5 Regular Expressions - you can [test](
diff --git a/.github/actions/spelling/allow.txt b/.github/actions/spelling/allow.txt
index 6eae5e64145..4d318ff83ef 100644
--- a/.github/actions/spelling/allow.txt
+++ b/.github/actions/spelling/allow.txt
@@ -129,8 +129,8 @@ deserializing
 dest
 devblogs
 differentpath
-DISMAPI
 DIRECTONLY
+DISMAPI
 distro
 dll
 dllexport
@@ -265,8 +265,8 @@ INVALIDSID
 iomanip
 iostream
 IPinning
-IPortable
 ipmo
+IPortable
 ISAPPROVEDFOROUTPUT
 isspace
 istream
@@ -322,6 +322,8 @@ mrm
 msbuild
 msdata
 MSDN
+MSHCTX
+MSHLFLAGS
 msi
 msiexec
 msix
@@ -331,8 +333,6 @@ msixmgr
 msixsdk
 msixsdkx
 msixtest
-MSHCTX
-MSHLFLAGS
 msrc
 Multifile
 Multimatch
@@ -463,6 +463,7 @@ removemanifest
 removepin
 removeportablefile
 repolibtest
+REQS
 requeue
 rescap
 resetpins
@@ -474,7 +475,6 @@ RESTSOURCE
 resw
 resx
 rethrowing
-REQS
 roadmap
 robuffer
 rowcount
@@ -578,7 +578,6 @@ symlink
 symlinks
 symlinktarget
 Sys
-sz
 TARG
 TARGETDIR
 targetentrypoint
@@ -611,7 +610,6 @@ triaged
 trunc
 TRUSTEDPEOPLE
 trx
-tt
 ttl
 typedef
 typename
@@ -674,7 +672,6 @@ versioning
 VERYSILENT
 VFT
 visualstudio
-vm
 VOS
 vso
 wapproj
@@ -728,5 +725,3 @@ XTOKEN
 xunit
 yaml
 yml
-yy
-zh
diff --git a/.github/actions/spelling/candidate.patterns b/.github/actions/spelling/candidate.patterns
index 4b40e728ee3..cad7450c9cc 100644
--- a/.github/actions/spelling/candidate.patterns
+++ b/.github/actions/spelling/candidate.patterns
@@ -2,24 +2,39 @@
 ^.*/\* #no-spell-check-line \*/.*$
 # marker for ignoring a comment to the end of the line
 // #no-spell-check.*$
+# marker to ignore all code on line
+^.*\bno-spell-check(?:-line|)(?:\s.*|)$
+
+# https://cspell.org/configuration/document-settings/
+# cspell inline
+^.*\b[Cc][Ss][Pp][Ee][Ll]{2}:\s*[Dd][Ii][Ss][Aa][Bb][Ll][Ee]-[Ll][Ii][Nn][Ee]\b
 
 # patch hunk comments
 ^\@\@ -\d+(?:,\d+|) \+\d+(?:,\d+|) \@\@ .*
 # git index header
-index [0-9a-z]{7,40}\.\.[0-9a-z]{7,40}
+index (?:[0-9a-z]{7,40},|)[0-9a-z]{7,40}\.\.[0-9a-z]{7,40}
+
+# file permissions
+['"`\s][-bcdLlpsw](?:[-r][-w][-Ssx]){2}[-r][-w][-SsTtx]\+?['"`\s]
+
+# css url wrappings
+\burl\([^)]+\)
 
 # cid urls
 (['"])cid:.*?\g{-1}
 
 # data url in parens
-\(data:[^)]*?(?:[A-Z]{3,}|[A-Z][a-z]{2,}|[a-z]{3,})[^)]*\)
+\(data:(?:[^) ][^)]*?|)(?:[A-Z]{3,}|[A-Z][a-z]{2,}|[a-z]{3,})[^)]*\)
 # data url in quotes
-([`'"])data:.*?(?:[A-Z]{3,}|[A-Z][a-z]{2,}|[a-z]{3,}).*\g{-1}
+([`'"])data:(?:[^ `'"].*?|)(?:[A-Z]{3,}|[A-Z][a-z]{2,}|[a-z]{3,}).*\g{-1}
 # data url
 data:[-a-zA-Z=;:/0-9+]*,\S*
 
+# https/http/file urls
+(?:\b(?:https?|ftp|file)://)[-A-Za-z0-9+&@#/%?=~_|!:,.;]+[-A-Za-z0-9+&@#/%=~_|]
+
 # mailto urls
-mailto:[-a-zA-Z=;:/?%&0-9+@.]{3,}
+mailto:[-a-zA-Z=;:/?%&0-9+@._]{3,}
 
 # magnet urls
 magnet:[?=:\w]+
@@ -35,6 +50,9 @@ magnet:[?=:\w]+
 # asciinema
 \basciinema\.org/a/[0-9a-zA-Z]+
 
+# asciinema v2
+^\[\d+\.\d+, "[io]", ".*"\]$
+
 # apple
 \bdeveloper\.apple\.com/[-\w?=/]+
 # Apple music
@@ -89,7 +107,7 @@ vpc-\w+
 # Google Drive
 \bdrive\.google\.com/(?:file/d/|open)[-0-9a-zA-Z_?=]*
 # Google Groups
-\bgroups\.google\.com/(?:(?:forum/#!|d/)(?:msg|topics?|searchin)|a)/[^/\s"]+/[-a-zA-Z0-9$]+(?:/[-a-zA-Z0-9]+)*
+\bgroups\.google\.com(?:/[a-z]+/(?:#!|)[^/\s"]+)*
 # Google Maps
 \bmaps\.google\.com/maps\?[\w&;=]*
 # Google themes
@@ -117,6 +135,8 @@ themes\.googleusercontent\.com/static/fonts/[^/\s"]+/v\d+/[^.]+.
 (?:\[`?[0-9a-f]+`?\]\(https:/|)/(?:www\.|)github\.com(?:/[^/\s"]+){2,}(?:/[^/\s")]+)(?:[0-9a-f]+(?:[-0-9a-zA-Z/#.]*|)\b|)
 # GitHub SHAs
 \bgithub\.com(?:/[^/\s"]+){2}[@#][0-9a-f]+\b
+# GitHub SHA refs
+\[([0-9a-f]+)\]\(https://(?:www\.|)github.com/[-\w]+/[-\w]+/commit/\g{-1}[0-9a-f]*
 # GitHub wiki
 \bgithub\.com/(?:[^/]+/){2}wiki/(?:(?:[^/]+/|)_history|[^/]+(?:/_compare|)/[0-9a-f.]{40,})\b
 # githubusercontent
@@ -128,9 +148,9 @@ themes\.googleusercontent\.com/static/fonts/[^/\s"]+/v\d+/[^.]+.
 # git.io
 \bgit\.io/[0-9a-zA-Z]+
 # GitHub JSON
-"node_id": "[-a-zA-Z=;:/0-9+]*"
+"node_id": "[-a-zA-Z=;:/0-9+_]*"
 # Contributor
-\[[^\]]+\]\(https://github\.com/[^/\s"]+\)
+\[[^\]]+\]\(https://github\.com/[^/\s"]+/?\)
 # GHSA
 GHSA(?:-[0-9a-z]{4}){3}
 
@@ -143,8 +163,8 @@ GHSA(?:-[0-9a-z]{4}){3}
 # GitLab commits
 \bgitlab\.[^/\s"]*/(?:[^/\s"]+/){2}commits?/[0-9a-f]+\b
 
-# binanace
-accounts.binance.com/[a-z/]*oauth/authorize\?[-0-9a-zA-Z&%]*
+# binance
+accounts\.binance\.com/[a-z/]*oauth/authorize\?[-0-9a-zA-Z&%]*
 
 # bitbucket diff
 \bapi\.bitbucket\.org/\d+\.\d+/repositories/(?:[^/\s"]+/){2}diff(?:stat|)(?:/[^/\s"]+){2}:[0-9a-f]+
@@ -280,9 +300,9 @@ slack://[a-zA-Z0-9?&=]+
 \bdropbox\.com/sh?/[^/\s"]+/[-0-9A-Za-z_.%?=&;]+
 
 # ipfs protocol
-ipfs://[0-9a-z]*
+ipfs://[0-9a-zA-Z]{3,}
 # ipfs url
-/ipfs/[0-9a-z]*
+/ipfs/[0-9a-zA-Z]{3,}
 
 # w3
 \bw3\.org/[-0-9a-zA-Z/#.]+
@@ -359,14 +379,22 @@ ipfs://[0-9a-z]*
 # tinyurl
 \btinyurl\.com/\w+
 
+# codepen
+\bcodepen\.io/[\w/]+
+
+# registry.npmjs.org
+\bregistry\.npmjs\.org/(?:@[^/"']+/|)[^/"']+/-/[-\w@.]+
+
 # getopts
 \bgetopts\s+(?:"[^"]+"|'[^']+')
 
 # ANSI color codes
-(?:\\(?:u00|x)1b|\x1b)\[\d+(?:;\d+|)m
+(?:\\(?:u00|x)1[Bb]|\x1b|\\u\{1[Bb]\})\[\d+(?:;\d+|)m
 
 # URL escaped characters
-\%[0-9A-F][A-F]
+\%[0-9A-F][A-F](?=[A-Za-z])
+# lower URL escaped characters
+\%[0-9a-f][a-f](?=[a-z]{2,})
 # IPv6
 \b(?:[0-9a-fA-F]{0,4}:){3,7}[0-9a-fA-F]{0,4}\b
 # c99 hex digits (not the full format, just one I've seen)
@@ -376,7 +404,7 @@ ipfs://[0-9a-z]*
 # sha
 sha\d+:[0-9]*[a-f]{3,}[0-9a-f]*
 # sha-... -- uses a fancy capture
-(['"]|")[0-9a-f]{40,}\g{-1}
+(\\?['"]|")[0-9a-f]{40,}\g{-1}
 # hex runs
 \b[0-9a-fA-F]{16,}\b
 # hex in url queries
@@ -391,18 +419,21 @@ sha\d+:[0-9]*[a-f]{3,}[0-9a-f]*
 # Well known gpg keys
 .well-known/openpgpkey/[\w./]+
 
+# pki
+-----BEGIN.*-----END
+
 # uuid:
 \b[0-9a-fA-F]{8}-(?:[0-9a-fA-F]{4}-){3}[0-9a-fA-F]{12}\b
 # hex digits including css/html color classes:
-(?:[\\0][xX]|\\u|[uU]\+|#x?|\%23)[0-9_a-fA-FgGrR]*?[a-fA-FgGrR]{2,}[0-9_a-fA-FgGrR]*(?:[uUlL]{0,3}|u\d+)\b
+(?:[\\0][xX]|\\u|[uU]\+|#x?|\%23)[0-9_a-fA-FgGrR]*?[a-fA-FgGrR]{2,}[0-9_a-fA-FgGrR]*(?:[uUlL]{0,3}|[iu]\d+)\b
 # integrity
-integrity="sha\d+-[-a-zA-Z=;:/0-9+]{40,}"
+integrity=(['"])(?:\s*sha\d+-[-a-zA-Z=;:/0-9+]{40,})+\g{-1}
 
 # https://www.gnu.org/software/groff/manual/groff.html
 # man troff content
 \\f[BCIPR]
-# '
-\\\(aq
+# '/"
+\\\([ad]q
 
 # .desktop mime types
 ^MimeTypes?=.*$
@@ -411,46 +442,80 @@ integrity="sha\d+-[-a-zA-Z=;:/0-9+]{40,}"
 # Localized .desktop content
 Name\[[^\]]+\]=.*
 
-# IServiceProvider
-\bI(?=(?:[A-Z][a-z]{2,})+\b)
+# IServiceProvider / isAThing
+\b(?:I|isA)(?=(?:[A-Z][a-z]{2,})+\b)
 
 # crypt
-"\$2[ayb]\$.{56}"
+(['"])\$2[ayb]\$.{56}\g{-1}
 
 # scrypt / argon
 \$(?:scrypt|argon\d+[di]*)\$\S+
 
+# go.sum
+\bh1:\S+
+
+# scala modules
+("[^"]+"\s*%%?\s*){2,3}"[^"]+"
+
 # Input to GitHub JSON
-content: "[-a-zA-Z=;:/0-9+]*="
+content: (['"])[-a-zA-Z=;:/0-9+]*=\g{-1}
+
+# This does not cover multiline strings, if your repository has them,
+# you'll want to remove the `(?=.*?")` suffix.
+# The `(?=.*?")` suffix should limit the false positives rate
+# printf
+%(?:(?:(?:hh?|ll?|[jzt])?[diuoxn]|l?[cs]|L?[fega]|p)(?=[a-z]{2,})|(?:X|L?[FEGA]|p)(?=[a-zA-Z]{2,}))(?=[_a-zA-Z]+\b)(?!%)(?=.*?['"])
 
-# Python stringprefix / binaryprefix
+# Python string prefix / binary prefix
 # Note that there's a high false positive rate, remove the `?=` and search for the regex to see if the matches seem like reasonable strings
-(?<!')\b(?:B|BR|Br|F|FR|Fr|R|RB|RF|Rb|Rf|U|UR|Ur|b|bR|br|f|fR|fr|r|rB|rF|rb|rf|u|uR|ur)'(?:[A-Z]{3,}|[A-Z][a-z]{2,}|[a-z]{3,})
+(?<!')\b(?:B|BR|Br|F|FR|Fr|R|RB|RF|Rb|Rf|U|UR|Ur|b|bR|br|f|fR|fr|r|rB|rF|rb|rf|u|uR|ur)'(?=[A-Z]{3,}|[A-Z][a-z]{2,}|[a-z]{3,})
 
 # Regular expressions for (P|p)assword
 \([A-Z]\|[a-z]\)[a-z]+
 
 # JavaScript regular expressions
 # javascript test regex
-/.*/[gim]*\.test\(
+/.{3,}/[gim]*\.test\(
 # javascript match regex
-\.match\(/[^/\s"]*/[gim]*\s*
+\.match\(/[^/\s"]{3,}/[gim]*\s*
 # javascript match regex
-\.match\(/\\[b].*?/[gim]*\s*\)(?:;|$)
+\.match\(/\\[b].{3,}?/[gim]*\s*\)(?:;|$)
 # javascript regex
-^\s*/\\[b].*/[gim]*\s*(?:\)(?:;|$)|,$)
+^\s*/\\[b]{3,}*/[gim]*\s*(?:\)(?:;|$)|,$)
 # javascript replace regex
-\.replace\(/[^/\s"]*/[gim]*\s*,
+\.replace\(/[^/\s"]{3,}/[gim]*\s*,
+# assign regex
+= /[^*]*?(?:[a-z]{3,}|[A-Z]{3,}|[A-Z][a-z]{2,}).*/
+# perl regex test
+[!=]~ (?:/.*/|m\{.*?\}|m<.*?>|m([|!/@#,;']).*?\g{-1})
+
+# perl qr regex
+(?<!\$)\bqr(?:\{.*?\}|<.*?>|\(.*?\)|([|!/@#,;']).*?\g{-1})
+
+# perl run
+perl(?:\s+-[a-zA-Z]\w*)+
 
 # Go regular expressions
 regexp?\.MustCompile\(`[^`]*`\)
 
+# regex choice
+\(\?:[^)]+\|[^)]+\)
+
+# proto
+^\s*(\w+)\s\g{-1} =
+
 # sed regular expressions
 sed 's/(?:[^/]*?[a-zA-Z]{3,}[^/]*?/){2}
 
+# node packages
+(["'])\@[^/'" ]+/[^/'" ]+\g{-1}
+
 # go install
 go install(?:\s+[a-z]+\.[-@\w/.]+)+
 
+# jetbrains schema https://youtrack.jetbrains.com/issue/RSRP-489571
+urn:shemas-jetbrains-com
+
 # kubernetes pod status lists
 # https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle/#pod-phase
 \w+(?:-\w+)+\s+\d+/\d+\s+(?:Running|Pending|Succeeded|Failed|Unknown)\s+
@@ -462,19 +527,47 @@ go install(?:\s+[a-z]+\.[-@\w/.]+)+
 -[0-9a-f]{10}-\w{5}\s
 
 # posthog secrets
-posthog\.init\((['"])phc_[^"',]+\g{-1},
+([`'"])phc_[^"',]+\g{-1}
 
 # xcode
 
 # xcodeproject scenes
-(?:Controller|ID|id)="\w{3}-\w{2}-\w{3}"
+(?:Controller|destination|ID|id)="\w{3}-\w{2}-\w{3}"
 
 # xcode api botches
 customObjectInstantitationMethod
 
+# configure flags
+.* \| --\w{2,}.*?(?=\w+\s\w+)
+
 # font awesome classes
 \.fa-[-a-z0-9]+
 
+# bearer auth
+(['"])Bear[e][r] .*?\g{-1}
+
+# basic auth
+(['"])Basic [-a-zA-Z=;:/0-9+]{3,}\g{-1}
+
+# base64 encoded content
+([`'"])[-a-zA-Z=;:/0-9+]+=\g{-1}
+# base64 encoded content in xml/sgml
+>[-a-zA-Z=;:/0-9+]+=</
+# base64 encoded content, possibly wrapped in mime
+(?:^|[\s=;:?])[-a-zA-Z=;:/0-9+]{50,}(?:[\s=;:?]|$)
+
+# encoded-word
+=\?[-a-zA-Z0-9"*%]+\?[BQ]\?[^?]{0,75}\?=
+
+# Time Zones
+\b(?:Africa|Atlantic|America|Antarctica|Asia|Australia|Europe|Indian|Pacific)(?:/\w+)+
+
+# linux kernel info
+^(?:bugs|flags|Features)\s+:.*
+
+# systemd mode
+systemd.*?running in system mode \([-+].*\)$
+
 # Update Lorem based on your content (requires `ge` and `w` from https://github.com/jsoref/spelling; and `review` from https://github.com/check-spelling/check-spelling/wiki/Looking-for-items-locally )
 # grep '^[^#].*lorem' .github/actions/spelling/patterns.txt|perl -pne 's/.*i..\?://;s/\).*//' |tr '|' "\n"|sort -f |xargs -n1 ge|perl -pne 's/^[^:]*://'|sort -u|w|sed -e 's/ .*//'|w|review -
 # Warning, while `(?i)` is very neat and fancy, if you have some binary files that aren't proper unicode, you might run into:
@@ -485,32 +578,60 @@ customObjectInstantitationMethod
 (?:\w|\s|[,.])*\b(?i)(?:amet|consectetur|cursus|dolor|eros|ipsum|lacus|libero|ligula|lorem|magna|neque|nulla|suscipit|tempus)\b(?:\w|\s|[,.])*
 
 # Non-English
-[a-zA-Z]*[ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖØÙÚÛÜÝßàáâãäåæçèéêëìíîïðñòóôõöøùúûüýÿĀāŁłŃńŅņŒœŚśŠšŜŝŸŽžź][a-zA-Z]{3}[a-zA-ZÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖØÙÚÛÜÝßàáâãäåæçèéêëìíîïðñòóôõöøùúûüýÿĀāŁłŃńŅņŒœŚśŠšŜŝŸŽžź]*
+[a-zA-Z]*[ÀÁÂÃÄÅÆČÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖØÙÚÛÜÝßàáâãäåæčçèéêëìíîïðñòóôõöøùúûüýÿĀāŁłŃńŅņŒœŚśŠšŜŝŸŽžź][a-zA-Z]{3}[a-zA-ZÀÁÂÃÄÅÆČÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖØÙÚÛÜÝßàáâãäåæčçèéêëìíîïðñòóôõöøùúûüýÿĀāŁłŃńŅņŒœŚśŠšŜŝŸŽžź]*|[a-zA-Z]{3,}[ÀÁÂÃÄÅÆČÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖØÙÚÛÜÝßàáâãäåæčçèéêëìíîïðñòóôõöøùúûüýÿĀāŁłŃńŅņŒœŚśŠšŜŝŸŽžź]|[ÀÁÂÃÄÅÆČÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖØÙÚÛÜÝßàáâãäåæčçèéêëìíîïðñòóôõöøùúûüýÿĀāŁłŃńŅņŒœŚśŠšŜŝŸŽžź][a-zA-Z]{3,}
+
+# highlighted letters
+\[[A-Z]\][a-z]+
 
 # French
 # This corpus only had capital letters, but you probably want lowercase ones as well.
 \b[LN]'+[a-z]{2,}\b
 
-# latex
+# latex (check-spelling <= 0.0.21)
 \\(?:n(?:ew|ormal|osub)|r(?:enew)|t(?:able(?:of|)|he|itle))(?=[a-z]+)
 
+# latex (check-spelling >= 0.0.22)
+\\\w{2,}\{
+
+# eslint
+"varsIgnorePattern": ".+"
+
+# Windows short paths
+[/\\][^/\\]{5,6}~\d{1,2}[/\\]
+
+# in check-spelling@v0.0.22+, printf markers aren't automatically consumed
+# printf markers
+(?<!\\)\\[nrt](?=[a-z]{2,})
+# alternate markers if you run into latex and friends
+(?<!\\)\\[nrt](?=[a-z]{2,})(?=.*['"`])
+
+# apache
+a2(?:en|dis)
+
+# weak e-tag
+W/"[^"]+"
+
 # the negative lookahead here is to allow catching 'templatesz' as a misspelling
 # but to otherwise recognize a Windows path with \templates\foo.template or similar:
 \\(?:necessary|r(?:eport|esolve[dr]?|esult)|t(?:arget|emplates?))(?![a-z])
 # ignore long runs of a single character:
 \b([A-Za-z])\g{-1}{3,}\b
-# Note that the next example is no longer necessary if you are using
-# to match a string starting with a `#`, use a character-class:
-[#]backwards
+
 # version suffix <word>v#
 (?:(?<=[A-Z]{2})V|(?<=[a-z]{2}|[A-Z]{2})v)\d+(?:\b|(?=[a-zA-Z_]))
-# Compiler flags (Scala)
-(?:^|[\t ,>"'`=(])-J-[DPWXY](?=[A-Z]{2,}|[A-Z][a-z]|[a-z]{2,})
-# Compiler flags
-#(?:^|[\t ,"'`=(])-[DPWXYLlf](?=[A-Z]{2,}|[A-Z][a-z]|[a-z]{2,})
+
+# Compiler flags (Unix, Java/Scala)
+# Use if you have things like `-Pdocker` and want to treat them as `docker`
+(?:^|[\t ,>"'`=(])-(?:(?:J-|)[DPWXY]|[Llf])(?=[A-Z]{2,}|[A-Z][a-z]|[a-z]{2,})
+
+# Compiler flags (Windows / PowerShell)
+# This is a subset of the more general compiler flags pattern.
+# It avoids matching `-Path` to prevent it from being treated as `ath`
+(?:^|[\t ,"'`=(])-(?:[DPL](?=[A-Z]{2,})|[WXYlf](?=[A-Z]{2,}|[A-Z][a-z]|[a-z]{2,}))
 
 # Compiler flags (linker)
 ,-B
+
 # curl arguments
 \b(?:\\n|)curl(?:\s+-[a-zA-Z]{1,2}\b)*(?:\s+-[a-zA-Z]{3,})(?:\s+-[a-zA-Z]+)*
 # set arguments
diff --git a/.github/actions/spelling/excludes.txt b/.github/actions/spelling/excludes.txt
index ea76096b0f5..df7d27d1c4a 100644
--- a/.github/actions/spelling/excludes.txt
+++ b/.github/actions/spelling/excludes.txt
@@ -4,28 +4,39 @@
 (?:^|/)3rdparty/
 (?:^|/)go\.sum$
 (?:^|/)package(?:-lock|)\.json$
+(?:^|/)Pipfile$
+(?:^|/)pyproject.toml
+(?:^|/)requirements(?:-dev|-doc|-test|)\.txt$
 (?:^|/)vendor/
 /shared\.manifest$
 \.a$
 \.ai$
+\.all-contributorsrc$
 \.avi$
 \.bmp$
 \.bz2$
 \.cer$
 \.class$
+\.coveragerc$
+\.crl$
 \.crt$
+\.csr$
 \.dll$
 \.docx?$
 \.drawio$
 \.DS_Store$
 \.eot$
+\.eps$
 \.exe$
 \.gif$
+\.git-blame-ignore-revs$
 \.gitattributes$
+\.gitkeep$
 \.graffle$
 \.gz$
 \.icns$
 \.ico$
+\.ipynb$
 \.jar$
 \.jks$
 \.jpe?g$
@@ -34,6 +45,7 @@
 \.lock$
 \.map$
 \.min\..
+\.mo$
 \.mod$
 \.mp[34]$
 \.msix$
@@ -41,15 +53,24 @@
 \.o$
 \.ocf$
 \.otf$
+\.p12$
+\.parquet$
 \.pdf$
 \.pem$
+\.pfx$
 \.png$
 \.psd$
 \.pyc$
+\.pylintrc$
+\.qm$
 \.s$
 \.sln$
+\.sig$
+\.so$
 \.svgz?$
+\.sys$
 \.tar$
+\.tgz$
 \.tiff?$
 \.ttf$
 \.vcxitems$
@@ -62,32 +83,13 @@
 \.webp$
 \.winmd$
 \.woff2?$
+\.xcf$
 \.xlsx?$
+\.xpm$
+\.xz$
 \.zip$
 ^\.github/actions/spelling/
 ^\.github/policies/
 ^\.github/workflows/spelling\d*\.yml$
-^\Qsrc/PureLib/pure/AUTHORS\E$
-^cgmanifest\.json$
 ^Localization/
 ^NOTICE
-^src/AppInstallerCLICore/Commands/ExperimentalCommand\.cpp$
-^src/AppInstallerCLIE2ETests/TestData/AppInstallerTestMsiInstaller.msi$
-^src/AppInstallerCLITests/TestData/InputARPData.txt$
-^src/AppInstallerCLITests/TestData/InputNames.txt$
-^src/AppInstallerCLITests/TestData/InputPublishers.txt$
-^src/AppInstallerCLITests/TestData/NormalizationInitialIds.txt$
-^src/AppInstallerCommonCore/external/do.h$
-^src/catch2/
-^src/cpprestsdk/
-^src/JsonCppLib/
-^src/PowerShell/ExternalModules
-^src/PureLib/
-^src/UndockedRegFreeWinRT/
-^src/Valijson/
-^src/Xlang/
-^src/YamlCppLib/
-# Because it doesn't handle argument -Words well
-^tools/CorrelationTestbed/.*\.ps1$
-^tools/COMTrace/ComTrace.wprp$
-ignore$
diff --git a/.github/actions/spelling/expect.txt b/.github/actions/spelling/expect.txt
index 8206c8bae54..e69de29bb2d 100644
--- a/.github/actions/spelling/expect.txt
+++ b/.github/actions/spelling/expect.txt
@@ -1,565 +0,0 @@
-abcd
-ABORTIFHUNG
-accepteula
-adjacents
-adml
-admx
-AFAIK
-agg
-aicli
-AICLIC
-allusers
-alreadyinstalled
-AMap
-amrutha
-ansistring
-APARTMENTTHREADED
-apfn
-apicontract
-apiset
-appinstallertest
-applic
-appname
-appshutdown
-APPTERMINATION
-argumentlist
-ARMNT
-arp
-arphelper
-ASAN
-ASequence
-ashpatil
-Ashwini
-ASwitch
-ASYNCRTIMP
-Atest
-ATL
-attr
-AType
-AUrl
-Authenticode
-azurefd
-azurewebsites
-bcp
-BEFACEF
-bfd
-BFirst
-bght
-BITMAPINFOHEADER
-bitmask
-bkup
-blargle
-blockedbypolicy
-blogs
-bluetooth
-bomgar
-BOMs
-boop
-boundparms
-bpp
-Browsable
-BSODs
-BUILDOUTDIR
-buildtransitive
-BUILTINS
-cancelledbyuser
-casemap
-casemappings
-cch
-CDEF
-centralus
-certmgr
-certs
-cgi
-cinq
-CLASSNOTREG
-CLIE
-CLOSEAPP
-cloudapp
-cls
-clsctx
-clsid
-CODEOWNERS
-COINIT
-COMGLB
-commandline
-Configx
-contactsupport
-contentfiles
-contoso
-contractversion
-corecrt
-count'th
-countof
-countryregion
-CPIL
-cplusplus
-createmanifestmetadata
-cswinrt
-ctc
-currentuser
-cxfsgwfxarb
-DACL
-datetimeoffset
-Dbg
-debian
-dedupe
-deigh
-deleteifnotneeded
-DENYWR
-desktopappinstaller
-devhome
-dic
-diskfull
-dismapi
-dllimport
-DMPAs
-dnld
-Dobbeleer
-dsc
-DUPLICATEALIAS
-dustojnikhummer
-dvinns
-ecfr
-ecfrbrowse
-ECustom
-EFGH
-EFile
-efileresource
-endregion
-ENDSESSION
-EPester
-epth
-EQU
-errcode
-errmsg
-ERRORONEXIT
-ESource
-ESRB
-ests
-etest
-etl
-execustom
-EXEHASH
-experimentalfeatures
-fabricbot
-fdw
-FECAFEB
-fedorapeople
-fileinuse
-Filtercriteria
-Finalizers
-fintimes
-Fixfor
-flargle
-flexera
-FOF
-foldc
-foldcase
-FOLDERID
-FORPARSING
-FULLMUTEX
-FULLWIDTH
-fundraiser
-fuzzer
-fzanollo
-gcpi
-GESMBH
-GHS
-gity
-goku
-Google
-GRPICONDIR
-GRPICONDIRENTRY
-guiddef
-Hackathon
-hashtable
-helplib
-helplibrary
-hhx
-highcontrast
-HINSTANCE
-hkey
-hlocal
-hmodule
-Howto
-hre
-hresults
-hrow
-hwg
-hwnd
-IARP
-IAttachment
-ICONDIR
-ICONDIRENTRY
-ICONIMAGE
-idl
-idx
-IEnum
-IFACEMETHODIMP
-IHelp
-iid
-IISOn
-ilemode
-inet
-inproc
-installinprogress
-INSTALLPROPERTY
-installshield
-instream
-insufficientmemory
-Intelli
-INTRESOURCE
-invalidparameter
-IPackage
-isable
-IServer
-ishelp
-ISQ
-ISVs
-itr
-IWin
-JArray
-JDictionary
-jdk
-jfearn
-JObject
-jpalardy
-JREs
-jrsoftware
-jsoncpp
-JToken
-JValue
-Kaido
-KNOWNFOLDERID
-ktf
-ldcase
-learnxinyminutes
-libsolv
-libyaml
-Linq
-liv
-liwpx
-localizationpriority
-localsource
-LOWORD
-LPARAM
-LPBYTE
-LPCWSTR
-lpdw
-LPDWORD
-lpfn
-LPGRPICONDIR
-LPGRPICONDIRENTRY
-LPICONDIR
-LPICONDIRENTRY
-LPICONIMAGE
-lpitemidlist
-LPSTR
-lpsz
-LPW
-LPWCH
-LPWSTR
-LRESULT
-LSTATUS
-LTDA
-luffy
-Luffytaro
-maclachlan
-malware
-mapdatafolding
-mapview
-Maxed
-maxvalue
-maybenull
-MBH
-mdmp
-MDs
-megamorf
-meme
-midl
-minexample
-minidump
-minschema
-missingdependency
-mkgmtime
-MMmmbbbb
-mof
-monicka
-MPNS
-msdownload
-msft
-msftrubengu
-MSIHASH
-MSIXHASH
-msstore
-Mta
-Mugiwara
-Multideclaration
-mycustom
-myinstalldir
-mylog
-mysilent
-mysilentwithprogress
-nameof
-nativehandle
-NBLGGH
-NESTEDINSTALLER
-netfx
-netlify
-NETSDK
-Newtonsoft
-NNS
-NOAGGREGATION
-NOCLOSE
-NOCRLF
-NOEXPAND
-NOLINKINFO
-nonetwork
-NONFOLDERS
-nonterminated
-NOREMOVE
-normer
-NOSEARCH
-NOSEPARATOR
-notalostreference
-NOTAPROPERTY
-notmatch
-NOTRACK
-NOUPDATE
-npmjs
-nsis
-nuffing
-objbase
-objidl
-ofile
-ools
-oop
-OPTOUT
-osfhandle
-Outptr
-OVERLAPPEDWINDOW
-packageinuse
-packageinusebyapplication
-PACL
-PARAMETERMAP
-paramref
-pathparts
-Patil
-pcb
-PCCERT
-PCs
-pcwsz
-PDWORD
-PEGI
-PFM
-pfn
-pfxpath
-Pherson
-pidl
-pidlist
-pkgmgr
-pkindex
-pkix
-pme
-PMS
-positionals
-powershellgallery
-powertoys
-pri
-processthreads
-productcode
-PRODUCTICON
-proxystub
-pscustomobject
-pseudocode
-PSHOST
-psobject
-ptstr
-publickey
-pvk
-pvm
-pwabuilder
-PWAs
-PWSTR
-QUERYENDSESSION
-qword
-rebootinitiated
-rebootrequiredforinstall
-rebootrequiredtofinish
-redirector
-Redist
-REFIID
-REGDB
-regexes
-REGSAM
-relativefilepath
-remoting
-reparse
-restsource
-RGBQUAD
-rgex
-rgp
-rgpsz
-riid
-roblox
-ronomon
-rosoft
-rowids
-roy
-RRF
-rrr
-RTTI
-runspace
-runtimeclass
-ryfu
-rzkzqaqjwj
-SARL
-schematab
-sddl
-SECUREFILEPATH
-secureobject
-securestring
-seof
-servercert
-servercertificate
-setmetadatabymanifestid
-SETTINGCHANGE
-SETTINGMAPPING
-SHCONTF
-SHGDN
-SHOWNORMAL
-sid
-Sideload
-SIGNATUREHASH
-Sku
-SLAPI
-SMTO
-sortof
-sourceforge
-SOURCESDIRECTORY
-sourceversion
-spamming
-SPAPI
-Srinivasan
-SRL
-srs
-standalone
-startswith
-STARTUPINFOW
-STDMETHODCALLTYPE
-STRRET
-stylecop
-subdir
-subkey
-superstring
-suppy
-swervy
-SYD
-SYG
-Syncy
-sysrefcomp
-systemnotsupported
-Tagit
-taskhostw
-TCpp
-tcs
-TEMPDIRECTORY
-Templating
-temppath
-testdata
-testexampleinstaller
-thiscouldbeapc
-threehundred
-timespan
-timezone
-Tlg
-tombstoned
-TOperation
-TOptions
-TProgress
-transitioning
-TResult
-TReturn
-trimstart
-TState
-TStatus
-TType
-typeparam
-UCase
-ucasemap
-UChars
-ucnv
-uec
-UNAVAIL
-uninitialize
-unins
-uninstallation
-uninstaller
-uninstallprevious
-uninstalls
-Unk
-unknwn
-Unknwnbase
-unparsable
-unvirtualized
-UParse
-upgradable
-upgradecode
-URLZONE
-userfilesetting
-userprofile
-UWP
-VALUENAMECASE
-vclib
-VERSI
-VERSIE
-vns
-vsconfig
-vstest
-wcex
-webpages
-Webserver
-websites
-WERSJA
-wesome
-wfopen
-wfsopen
-wgetenv
-Whatif
-winapifamily
-windir
-windowsdeveloper
-winerror
-wingetconfigroot
-wingetcreate
-wingetdev
-wingetutil
-winreg
-winrtact
-winstring
-withstarts
-Wnd
-WNDCLASSEX
-WPARAM
-wpr
-wprp
-wputenv
-wsl
-wsv
-wto
-wwinmain
-WZDNCRFJ
-xcopy
-XFile
-XManifest
-XMUGIWARAMODULE
-XPLATSTR
-XRESOURCEZORO
-xsi
-yamato
-yamlcreateps
-yao
-Zanollo
-ZIPHASH
-zoro
diff --git a/.github/actions/spelling/line_forbidden.patterns b/.github/actions/spelling/line_forbidden.patterns
index 9050d6614c7..09bb47ce620 100644
--- a/.github/actions/spelling/line_forbidden.patterns
+++ b/.github/actions/spelling/line_forbidden.patterns
@@ -1,4 +1,6 @@
-# reject `m_data` as there's a certain OS which has evil defines that break things if it's used elsewhere
+# reject `m_data` as VxWorks defined it and that breaks things if it's used elsewhere
+# see [fprime](https://github.com/nasa/fprime/commit/d589f0a25c59ea9a800d851ea84c2f5df02fb529)
+# and [Qt](https://github.com/qtproject/qt-solutions/blame/fb7bc42bfcc578ff3fa3b9ca21a41e96eb37c1c7/qtscriptclassic/src/qscriptbuffer_p.h#L46)
 # \bm_data\b
 
 # If you have a framework that uses `it()` for testing and `fit()` for debugging a specific test,
@@ -6,40 +8,84 @@
 # to use this:
 #\bfit\(
 
+# s.b. anymore
+\bany more[,.]
+
+# s.b. cannot
+\b[Cc]an not\b
+
 # s.b. GitHub
-\bGithub\b
+(?<![&*.]|// |\btype )\bGithub\b(?![{)])
 
 # s.b. GitLab
-\bGitlab\b
+(?<![&*.]|// |\btype )\bGitlab\b(?![{)])
 
 # s.b. JavaScript
 \bJavascript\b
 
+# s.b. macOS or Mac OS X or ...
+\bMacOS\b
+
 # s.b. Microsoft
 \bMicroSoft\b
 
+# s.b. OAuth
+(?:^|[^-/*$])[ '"]oAuth(?: [a-z]|\d+ |[^ a-zA-Z0-9:;_.()])
+
+# s.b. TypeScript
+\bTypescript\b
+
 # s.b. another
 \ban[- ]other\b
 
+# s.b. case-(in)sensitive
+\bcase (?:in|)sensitive\b
+
+# s.b. deprecation warning
+\b[Dd]epreciation [Ww]arnings?\b
+
 # s.b. greater than
 \bgreater then\b
 
+# s.b. in front of
+\bin from of\b
+
 # s.b. into
-#\sin to\s
+# when not phrasal and when `in order to` would be wrong:
+# https://thewritepractice.com/into-vs-in-to/
+#\sin to\s(?!if\b)
+
+# s.b. is obsolete
+\bis obsolescent\b
+
+# s.b. it's or its
+\bits['’]
 
 # s.b. opt-in
-#\sopt in\s
+#(?<!\sfor)\sopt in\s
 
 # s.b. less than
 \bless then\b
 
+# s.b. one of
+\bon of\b
+
 # s.b. otherwise
 \bother[- ]wise\b
 
+# s.b. or (more|less)
+\bore (?:more|less)\b
+
+# s.b. rather than
+\brather then\b
+
 # s.b. nonexistent
 \bnon existing\b
 \b[Nn]o[nt][- ]existent\b
 
+# s.b. brief / details/ param / return / retval
+(?:^\s*|(?:\*|//|/*)\s+`)[\\@](?:breif|(?:detail|detials)|(?:params(?!\.)|prama?)|ret(?:uns?)|retvl)\b
+
 # s.b. preexisting
 [Pp]re[- ]existing
 
@@ -49,14 +95,37 @@
 # s.b. preemptively
 [Pp]re[- ]emptively
 
+# s.b. recently changed or recent changes
+[Rr]ecent changed
+
 # s.b. reentrancy
 [Rr]e[- ]entrancy
 
 # s.b. reentrant
 [Rr]e[- ]entrant
 
-# s.b. workaround(s)
-#\bwork[- ]arounds?\b
+# s.b. understand
+\bunder stand\b
+
+# s.b. workarounds
+#\bwork[- ]arounds\b
+
+# s.b. workaround
+(?:(?:[Aa]|[Tt]he|ugly)\swork[- ]around\b|\swork[- ]around\s+for)
+
+# s.b. (coarse|fine)-grained
+\b(?:coarse|fine) grained\b
+
+# s.b. neither/nor -- or reword
+\bnot\b[^.?!"/(]+\bnor\b
+
+# probably a double negative
+# s.b. neither/nor (plus rewording the beginning)
+\bnot\b[^.?!"/]*\bneither\b[^.?!"/(]*\bnor\b
 
-# Reject duplicate words
+# In English, it is generally wrong to have the same word twice in a row without punctuation.
+# Duplicated words are generally mistakes.
+# There are a few exceptions where it is acceptable (e.g. "that that").
+# If the highlighted doubled word pair is in a code snippet, you can write a pattern to mask it.
+# If the highlighted doubled word pair is in prose, have someone read the English before you dismiss this error.
 \s([A-Z]{3,}|[A-Z][a-z]{2,}|[a-z]{3,})\s\g{-1}\s
diff --git a/.github/actions/spelling/patterns.txt b/.github/actions/spelling/patterns.txt
index 3e52a5c371e..0debfbc58df 100644
--- a/.github/actions/spelling/patterns.txt
+++ b/.github/actions/spelling/patterns.txt
@@ -141,16 +141,18 @@ ReplaceWhileCopying\(L.*\)
 
 # acceptable duplicates
 # ls directory listings
-[-bcdlpsw](?:[-r][-w][-sx]){3}\s+\d+\s+(\S+)\s+\g{-1}\s+\d+\s+
-# C types
-\s(Architecture|long|LONG) \g{-1}\s
 
+[-bcdlpsw](?:[-r][-w][-SsTtx]){3}[\.+*]?\s+\d+\s+\S+\s+\S+\s+\d+\s+
+# mount
+\bmount\s+-t\s+(\w+)\s+\g{-1}\b
 # C types and repeated CSS values
-\s(center|div|inherit|long|LONG|none|normal|solid|thin|transparent|very)(?: \g{-1})+\s
+\s(Architecture|auto|center|div|inherit|long|LONG|none|normal|solid|thin|transparent|very)(?: \g{-1})+\s
+# C struct
+\bstruct\s+(\w+)\s+\g{-1}\b
 # go templates
-\s(\w+)\s+\g{-1}\s+\`(?:graphql|json|yaml):
-# javadoc / .net
-(?:[\\@](?:groupname|param)|(?:public|private)(?:\s+static|\s+readonly)*)\s+(\w+)\s+\g{-1}\s
+\s(\w+)\s+\g{-1}\s+\`(?:graphql|inject|json|yaml):
+# doxygen / javadoc / .net
+(?:[\\@](?:brief|groupname|t?param|return|retval)|(?:public|private|\[Parameter(?:\(.+\)|)\])(?:\s+static|\s+override|\s+readonly)*)(?:\s+\{\w+\}|)\s+(\w+)\s+\g{-1}\s
 
 # Commit message -- Signed-off-by and friends
 ^\s*(?:(?:Based-on-patch|Co-authored|Helped|Mentored|Reported|Reviewed|Signed-off)-by|Thanks-to): (?:[^<]*<[^>]*>|[^<]*)\s*$
diff --git a/.github/actions/spelling/reject.txt b/.github/actions/spelling/reject.txt
index b5a6d36809f..e5e4c3eef82 100644
--- a/.github/actions/spelling/reject.txt
+++ b/.github/actions/spelling/reject.txt
@@ -1,4 +1,5 @@
 ^attache$
+^bellow$
 benefitting
 occurences?
 ^dependan.*
diff --git a/.github/workflows/spelling3.yml b/.github/workflows/spelling3.yml
index 1841e2437c9..fc7f2de5d21 100644
--- a/.github/workflows/spelling3.yml
+++ b/.github/workflows/spelling3.yml
@@ -36,6 +36,29 @@ name: Check Spelling
 #
 #   For background, see: https://github.com/check-spelling/check-spelling/wiki/Feature:-Update-with-deploy-key
 
+# Sarif reporting
+#
+# Access to Sarif reports is generally restricted (by GitHub) to members of the repository.
+#
+# Requires enabling `security-events: write`
+# and configuring the action with `use_sarif: 1`
+#
+#   For information on the feature, see: https://github.com/check-spelling/check-spelling/wiki/Feature:-Sarif-output
+
+# Minimal workflow structure:
+#
+# on:
+#   push:
+#     ...
+#   pull_request_target:
+#     ...
+# jobs:
+#   # you only want the spelling job, all others should be omitted
+#   spelling:
+#     # remove `security-events: write` and `use_sarif: 1`
+#     # remove `experimental_apply_changes_via_bot: 1`
+#     ... otherwise adjust the `with:` as you wish
+
 on:
   push:
     branches:
@@ -45,12 +68,13 @@ on:
   pull_request_target:
     branches:
     - "**"
-    tags-ignore:
-    - "**"
     types:
     - 'opened'
     - 'reopened'
     - 'synchronize'
+  issue_comment:
+    types:
+    - 'created'
 
 jobs:
   spelling:
@@ -59,10 +83,11 @@ jobs:
       contents: read
       pull-requests: read
       actions: read
+      security-events: write
     outputs:
       followup: ${{ steps.spelling.outputs.followup }}
     runs-on: ubuntu-latest
-    if: "contains(github.event_name, 'pull_request') || github.event_name == 'push'"
+    if: ${{ contains(github.event_name, 'pull_request') || github.event_name == 'push' }}
     concurrency:
       group: spelling-${{ github.event.pull_request.number || github.ref }}
       # note: If you use only_check_changed_files, you do not want cancel-in-progress
@@ -70,26 +95,20 @@ jobs:
     steps:
     - name: check-spelling
       id: spelling
-      uses: check-spelling/check-spelling@v0.0.21
+      uses: check-spelling/check-spelling@v0.0.22
       with:
-        suppress_push_for_open_pull_request: 1
+        suppress_push_for_open_pull_request: ${{ github.actor != 'dependabot[bot]' && 1 }}
         checkout: true
         check_file_names: 1
-        spell_check_this: check-spelling/spell-check-this@prerelease
+        spell_check_this: microsoft/winget-cli@master
         post_comment: 0
         use_magic_file: 1
-        extra_dictionary_limit: 10
+        warnings: bad-regex,binary-file,deprecated-feature,ignored-expect-variant,large-file,limited-references,no-newline-at-eof,noisy-file,non-alpha-in-dictionary,token-is-substring,unexpected-line-ending,whitespace-in-dictionary,minified-file,unsupported-configuration,no-files-to-check
+        experimental_apply_changes_via_bot: ${{ github.repository_owner != 'microsoft' && 1 }}
+        use_sarif: ${{ (!github.event.pull_request || (github.event.pull_request.head.repo.full_name == github.repository)) && 1 }}
+        extra_dictionary_limit: 20
         extra_dictionaries:
-          cspell:software-terms/src/software-terms.txt
-          cspell:cpp/src/stdlib-c.txt
-          cspell:node/node.txt
-          cspell:mnemonics/src/mnemonics.txt
-          cspell:cpp/src/stdlib-cpp.txt
-          cspell:html/html.txt
-          cspell:fullstack/fullstack.txt
-          cspell:filetypes/filetypes.txt
-          cspell:cpp/src/stdlib-cmath.txt
-          cspell:aws/aws.txt
+          cspell:software-terms/dict/softwareTerms.txt
 
   comment-push:
     name: Report (Push)
@@ -101,10 +120,10 @@ jobs:
     if: (success() || failure()) && needs.spelling.outputs.followup && github.event_name == 'push'
     steps:
     - name: comment
-      uses: check-spelling/check-spelling@v0.0.21
+      uses: check-spelling/check-spelling@v0.0.22
       with:
         checkout: true
-        spell_check_this: check-spelling/spell-check-this@prerelease
+        spell_check_this: microsoft/winget-cli@master
         task: ${{ needs.spelling.outputs.followup }}
 
   comment-pr:
@@ -113,12 +132,38 @@ jobs:
     runs-on: ubuntu-latest
     needs: spelling
     permissions:
+      contents: read
       pull-requests: write
     if: (success() || failure()) && needs.spelling.outputs.followup && contains(github.event_name, 'pull_request')
     steps:
     - name: comment
-      uses: check-spelling/check-spelling@v0.0.21
+      uses: check-spelling/check-spelling@v0.0.22
       with:
         checkout: true
-        spell_check_this: check-spelling/spell-check-this@prerelease
+        spell_check_this: microsoft/winget-cli@main
         task: ${{ needs.spelling.outputs.followup }}
+        experimental_apply_changes_via_bot: experimental_apply_changes_via_bot: ${{ github.repository_owner != 'microsoft' && 1 }}
+
+  update:
+    name: Update PR
+    permissions:
+      contents: write
+      pull-requests: write
+      actions: read
+    runs-on: ubuntu-latest
+    if: ${{
+        github.repository_owner != 'microsoft' &&
+        github.event_name == 'issue_comment' &&
+        github.event.issue.pull_request &&
+        contains(github.event.comment.body, '@check-spelling-bot apply')
+      }}
+    concurrency:
+      group: spelling-update-${{ github.event.issue.number }}
+      cancel-in-progress: false
+    steps:
+    - name: apply spelling updates
+      uses: check-spelling/check-spelling@v0.0.22
+      with:
+        experimental_apply_changes_via_bot: 1
+        checkout: true
+        ssh_key: "${{ secrets.CHECK_SPELLING }}"