From 262acf083c67b9eddb29e85121d9cbaea3a331b4 Mon Sep 17 00:00:00 2001
From: Marc LeBlanc <7050295+marcleblanc2@users.noreply.github.com>
Date: Fri, 30 Oct 2026 18:29:47 -0600
Subject: [PATCH 1/6] ci: Share one summary-comment script across the PR checks

The four bash checks each carried a copy of the same comment step, and none of them minimized the summary once the findings were fixed, unlike the spell check. dev/post-check-comment.sh now posts, updates, minimizes, and reopens the summary for all of them, and never comments on a PR that had nothing to report.

Also:
- result=found everywhere (links and redirects said broken)
- the clean message comes from the check script's report in every workflow, all saying 'This revision'
- the hostnames job name says (advisory) like the other advisory checks
- GH_TOKEN, PR_NUMBER, BASE_SHA, LINK_BASE, and RUN_URL are job-level env
- the check scripts are checked out from the merge commit, like the workflow file itself. A branch that predates a check has no script for it, so the check crashed and posted a 'could not run' comment on a clean PR (#2118); 27 open PRs predate check-duplicates.mjs
- vercel-ignore-build.sh names the Slack app manifest by its current name

Amp-Thread-ID: https://ampcode.com/threads/T-01a18f4b-0163-7216-a915-372c4b6288cb
Co-authored-by: Amp <amp@ampcode.com>
---
 .github/workflows/check-duplicates.yml | 49 +++++++--------------
 .github/workflows/check-hostnames.yml  | 55 ++++++++---------------
 .github/workflows/check-links.yml      | 59 +++++++++----------------
 .github/workflows/check-redirects.yml  | 60 +++++++++-----------------
 AGENTS.md                              | 12 +++++-
 dev/check-links.mjs                    |  2 +-
 dev/check-redirects.mjs                |  2 +-
 dev/post-check-comment.sh              | 42 ++++++++++++++++++
 dev/vercel-ignore-build.sh             |  3 +-
 9 files changed, 131 insertions(+), 153 deletions(-)
 create mode 100755 dev/post-check-comment.sh

diff --git a/.github/workflows/check-duplicates.yml b/.github/workflows/check-duplicates.yml
index d295a7a28..6006b6514 100644
--- a/.github/workflows/check-duplicates.yml
+++ b/.github/workflows/check-duplicates.yml
@@ -10,6 +10,7 @@ on:
         paths:
             - 'docs/**'
             - 'dev/check-duplicates.mjs'
+            - 'dev/post-check-comment.sh'
             - 'dev/sync-review-comments.sh'
             - '.github/workflows/check-duplicates.yml'
 
@@ -26,6 +27,13 @@ jobs:
     check-duplicates:
         name: Duplicated content introduced by this PR (advisory)
         runs-on: ubuntu-latest
+        env:
+            GH_TOKEN: ${{ github.token }}
+            PR_NUMBER: ${{ github.event.pull_request.number }}
+            BASE_SHA: ${{ github.event.pull_request.base.sha }}
+            # File links in the report open the file on the PR branch
+            LINK_BASE: ${{ github.event.pull_request.head.repo.html_url }}/blob/${{ github.event.pull_request.head.ref }}
+            RUN_URL: ${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}
         steps:
             - name: Check out pull request head
               uses: actions/checkout@v7
@@ -33,9 +41,13 @@ jobs:
                   ref: ${{ github.event.pull_request.head.sha }}
                   fetch-depth: 0
 
+            # The workflow file is read from the merge commit, so run the scripts
+            # from there too: a branch that predates a check has no script for it,
+            # and the merge commit also has this PR's changes to them
+            - name: Check out the check scripts from the merge commit
+              run: git fetch --quiet origin "$GITHUB_SHA" && git checkout --quiet "$GITHUB_SHA" -- dev
+
             - name: Check out merge base
-              env:
-                  BASE_SHA: ${{ github.event.pull_request.base.sha }}
               run: |
                   merge_base=$(git merge-base "$BASE_SHA" HEAD)
                   git worktree add "$RUNNER_TEMP/base" "$merge_base"
@@ -52,9 +64,6 @@ jobs:
 
             - name: Find duplicated passages introduced by this PR
               id: check
-              env:
-                  # File links in the report open the file on the PR branch
-                  LINK_BASE: ${{ github.event.pull_request.head.repo.html_url }}/blob/${{ github.event.pull_request.head.ref }}
               run: |
                   if ! [ -s "$RUNNER_TEMP/base-duplicates.json" ]; then
                       echo "::warning::check-duplicates crashed on the base branch, so this PR was not checked"
@@ -79,33 +88,8 @@ jobs:
               # Fork PRs get a read-only token; the report is still in the job log
               if: github.event.pull_request.head.repo.full_name == github.repository
               env:
-                  GH_TOKEN: ${{ github.token }}
-                  PR_NUMBER: ${{ github.event.pull_request.number }}
                   RESULT: ${{ steps.check.outputs.result }}
-                  RUN_URL: ${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}
-              run: |
-                  marker='<!-- check-duplicates-report -->'
-                  existing_comment=$(gh api "repos/$GITHUB_REPOSITORY/issues/$PR_NUMBER/comments" \
-                      --paginate --jq ".[] | select(.body | startswith(\"$marker\")) | .id" | head -n 1)
-
-                  # Comment when there is something to report, or an earlier report to resolve
-                  case "$RESULT" in
-                      found)
-                          { echo "$marker"; cat "$RUNNER_TEMP/report.md"; } > "$RUNNER_TEMP/comment.md" ;;
-                      crashed)
-                          printf '%s\n### ⚠️ The duplicated content check could not run on this revision\n\nThis is a problem with the check, not with this PR; see the [job log](%s).\n' \
-                              "$marker" "$RUN_URL" > "$RUNNER_TEMP/comment.md" ;;
-                      *)
-                          [ -n "$existing_comment" ] || exit 0
-                          { echo "$marker"; cat "$RUNNER_TEMP/report.md"; } > "$RUNNER_TEMP/comment.md" ;;
-                  esac
-
-                  if [ -n "$existing_comment" ]; then
-                      gh api --method PATCH "repos/$GITHUB_REPOSITORY/issues/comments/$existing_comment" \
-                          --field body=@"$RUNNER_TEMP/comment.md"
-                  else
-                      gh pr comment "$PR_NUMBER" --body-file "$RUNNER_TEMP/comment.md"
-                  fi
+              run: dev/post-check-comment.sh '<!-- check-duplicates-report -->' "$RESULT" "$RUNNER_TEMP/report.md"
 
             - name: Point out the duplicates as review comments
               # One comment per added passage, kept in sync with the findings;
@@ -113,7 +97,4 @@ jobs:
               if: >-
                   github.event.pull_request.head.repo.full_name == github.repository
                   && contains(fromJSON('["clean", "found"]'), steps.check.outputs.result)
-              env:
-                  GH_TOKEN: ${{ github.token }}
-                  PR_NUMBER: ${{ github.event.pull_request.number }}
               run: dev/sync-review-comments.sh '<!-- check-duplicates-finding:' "$RUNNER_TEMP/review.json"
diff --git a/.github/workflows/check-hostnames.yml b/.github/workflows/check-hostnames.yml
index be5de44ca..81cb7f5d2 100644
--- a/.github/workflows/check-hostnames.yml
+++ b/.github/workflows/check-hostnames.yml
@@ -10,6 +10,7 @@ on:
             - 'docs/**'
             - 'dev/check-hostnames.mjs'
             - 'dev/example-hostnames.json'
+            - 'dev/post-check-comment.sh'
             - 'dev/sync-review-comments.sh'
             - '.github/workflows/check-hostnames.yml'
 
@@ -24,8 +25,15 @@ permissions:
 
 jobs:
     check-hostnames:
-        name: Check example hostnames
+        name: Placeholder hostnames introduced by this PR (advisory)
         runs-on: ubuntu-latest
+        env:
+            GH_TOKEN: ${{ github.token }}
+            PR_NUMBER: ${{ github.event.pull_request.number }}
+            BASE_SHA: ${{ github.event.pull_request.base.sha }}
+            # File links in the report open the file on the PR branch
+            LINK_BASE: ${{ github.event.pull_request.head.repo.html_url }}/blob/${{ github.event.pull_request.head.ref }}
+            RUN_URL: ${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}
         steps:
             - name: Check out pull request head
               uses: actions/checkout@v7
@@ -33,15 +41,18 @@ jobs:
                   ref: ${{ github.event.pull_request.head.sha }}
                   fetch-depth: 0
 
+            # The workflow file is read from the merge commit, so run the scripts
+            # from there too: a branch that predates a check has no script for it,
+            # and the merge commit also has this PR's changes to them
+            - name: Check out the check scripts from the merge commit
+              run: git fetch --quiet origin "$GITHUB_SHA" && git checkout --quiet "$GITHUB_SHA" -- dev
+
             - name: Find placeholder hostnames added by this PR
               id: check
-              env:
-                  BASE_SHA: ${{ github.event.pull_request.base.sha }}
-                  # File links in the report open the file on the PR branch
-                  LINK_BASE: ${{ github.event.pull_request.head.repo.html_url }}/blob/${{ github.event.pull_request.head.ref }}
               # The script exits 1 both with findings and when it crashes. It writes
-              # its output in one go at the end, so a crash leaves it empty. The
-              # comment step reports a crash instead of posting the empty report.
+              # its output in one go at the end, so a crash leaves it empty. A crash
+              # does not fail the check, since it says nothing about the PR; the
+              # comment step reports it instead of posting the empty report.
               run: |
                   git diff -U0 "$(git merge-base "$BASE_SHA" HEAD)" HEAD -- docs > "$RUNNER_TEMP/changes.diff"
                   if node dev/check-hostnames.mjs --format markdown \
@@ -61,33 +72,8 @@ jobs:
               # Fork PRs get a read-only token; the report is still in the job log
               if: github.event.pull_request.head.repo.full_name == github.repository
               env:
-                  GH_TOKEN: ${{ github.token }}
-                  PR_NUMBER: ${{ github.event.pull_request.number }}
                   RESULT: ${{ steps.check.outputs.result }}
-                  RUN_URL: ${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}
-              run: |
-                  marker='<!-- check-hostnames-report -->'
-                  existing_comment=$(gh api "repos/$GITHUB_REPOSITORY/issues/$PR_NUMBER/comments" \
-                      --paginate --jq ".[] | select(.body | startswith(\"$marker\")) | .id" | head -n 1)
-
-                  # Comment when there is something to report, or an earlier report to resolve
-                  case "$RESULT" in
-                      found)
-                          { echo "$marker"; cat "$RUNNER_TEMP/report.md"; } > "$RUNNER_TEMP/comment.md" ;;
-                      crashed)
-                          printf '%s\n### ⚠️ The example hostnames check could not run on this revision\n\nThis is a problem with the check, not with this PR; see the [job log](%s).\n' \
-                              "$marker" "$RUN_URL" > "$RUNNER_TEMP/comment.md" ;;
-                      *)
-                          [ -n "$existing_comment" ] || exit 0
-                          { echo "$marker"; cat "$RUNNER_TEMP/report.md"; } > "$RUNNER_TEMP/comment.md" ;;
-                  esac
-
-                  if [ -n "$existing_comment" ]; then
-                      gh api --method PATCH "repos/$GITHUB_REPOSITORY/issues/comments/$existing_comment" \
-                          --field body=@"$RUNNER_TEMP/comment.md"
-                  else
-                      gh pr comment "$PR_NUMBER" --body-file "$RUNNER_TEMP/comment.md"
-                  fi
+              run: dev/post-check-comment.sh '<!-- check-hostnames-report -->' "$RESULT" "$RUNNER_TEMP/report.md"
 
             - name: Suggest fixes as review comments
               # One suggested change per flagged line, kept in sync with the
@@ -95,7 +81,4 @@ jobs:
               if: >-
                   github.event.pull_request.head.repo.full_name == github.repository
                   && contains(fromJSON('["clean", "found"]'), steps.check.outputs.result)
-              env:
-                  GH_TOKEN: ${{ github.token }}
-                  PR_NUMBER: ${{ github.event.pull_request.number }}
               run: dev/sync-review-comments.sh '<!-- check-hostnames-finding:' "$RUNNER_TEMP/review.json"
diff --git a/.github/workflows/check-links.yml b/.github/workflows/check-links.yml
index 51971c412..3634223a5 100644
--- a/.github/workflows/check-links.yml
+++ b/.github/workflows/check-links.yml
@@ -2,7 +2,9 @@ name: Check links
 
 # Reports internal links and #anchors that this PR breaks, compared with the
 # merge base, absolute links to this site, and external links on added lines
-# that 404. Pre-existing broken links on the base branch are ignored.
+# that 404, as a summary comment plus an inline suggested change on each
+# fixable finding. Pre-existing broken links on the base branch are ignored.
+# Fails the PR.
 
 on:
     pull_request:
@@ -20,6 +22,13 @@ jobs:
     check-links:
         name: Broken links introduced by this PR
         runs-on: ubuntu-latest
+        env:
+            GH_TOKEN: ${{ github.token }}
+            PR_NUMBER: ${{ github.event.pull_request.number }}
+            BASE_SHA: ${{ github.event.pull_request.base.sha }}
+            # File links in the report open the file on the PR branch
+            LINK_BASE: ${{ github.event.pull_request.head.repo.html_url }}/blob/${{ github.event.pull_request.head.ref }}
+            RUN_URL: ${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}
         steps:
             - name: Check out pull request head
               uses: actions/checkout@v7
@@ -27,6 +36,12 @@ jobs:
                   ref: ${{ github.event.pull_request.head.sha }}
                   fetch-depth: 0
 
+            # The workflow file is read from the merge commit, so run the scripts
+            # from there too: a branch that predates a check has no script for it,
+            # and the merge commit also has this PR's changes to them
+            - name: Check out the check scripts from the merge commit
+              run: git fetch --quiet origin "$GITHUB_SHA" && git checkout --quiet "$GITHUB_SHA" -- dev
+
             - name: Install github-slugger, the only dependency of dev/check-links.mjs
               # Into a scratch prefix, not the repo: `npm install <pkg>` next to
               # package.json would install every dependency of the site
@@ -36,8 +51,6 @@ jobs:
                   ln -s "$RUNNER_TEMP/deps/node_modules" node_modules
 
             - name: Check out merge base
-              env:
-                  BASE_SHA: ${{ github.event.pull_request.base.sha }}
               run: |
                   merge_base=$(git merge-base "$BASE_SHA" HEAD)
                   git worktree add "$RUNNER_TEMP/base" "$merge_base"
@@ -54,9 +67,6 @@ jobs:
 
             - name: Find broken links introduced by this PR
               id: check
-              env:
-                  # File links in the report open the file on the PR branch
-                  LINK_BASE: ${{ github.event.pull_request.head.repo.html_url }}/blob/${{ github.event.pull_request.head.ref }}
               run: |
                   if ! [ -s "$RUNNER_TEMP/base-links.json" ]; then
                       echo "::warning::check-links crashed on the base branch, so this PR was not checked"
@@ -70,7 +80,7 @@ jobs:
                       --link-base "$LINK_BASE" > "$RUNNER_TEMP/report.md"; then
                       echo "result=clean" >> "$GITHUB_OUTPUT"
                   elif [ -s "$RUNNER_TEMP/report.md" ]; then
-                      echo "result=broken" >> "$GITHUB_OUTPUT"
+                      echo "result=found" >> "$GITHUB_OUTPUT"
                   else
                       echo "::warning::check-links crashed, so this PR was not checked"
                       echo "result=crashed" >> "$GITHUB_OUTPUT"
@@ -81,46 +91,17 @@ jobs:
               # Fork PRs get a read-only token; the report is still in the job log
               if: github.event.pull_request.head.repo.full_name == github.repository
               env:
-                  GH_TOKEN: ${{ github.token }}
-                  PR_NUMBER: ${{ github.event.pull_request.number }}
                   RESULT: ${{ steps.check.outputs.result }}
-                  RUN_URL: ${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}
-              run: |
-                  marker='<!-- check-links-report -->'
-                  existing_comment=$(gh api "repos/$GITHUB_REPOSITORY/issues/$PR_NUMBER/comments" \
-                      --paginate --jq ".[] | select(.body | startswith(\"$marker\")) | .id" | head -n 1)
-
-                  # Comment when there is something to report, or an earlier report to resolve
-                  case "$RESULT" in
-                      broken)
-                          { echo "$marker"; cat "$RUNNER_TEMP/report.md"; } > "$RUNNER_TEMP/comment.md" ;;
-                      crashed)
-                          printf '%s\n### ⚠️ The links check could not run on this revision\n\nThis is a problem with the check, not with this PR; see the [job log](%s).\n' \
-                              "$marker" "$RUN_URL" > "$RUNNER_TEMP/comment.md" ;;
-                      *)
-                          [ -n "$existing_comment" ] || exit 0
-                          printf '%s\n### ✅ This revision introduces no broken links\n' \
-                              "$marker" > "$RUNNER_TEMP/comment.md" ;;
-                  esac
-
-                  if [ -n "$existing_comment" ]; then
-                      gh api --method PATCH "repos/$GITHUB_REPOSITORY/issues/comments/$existing_comment" \
-                          --field body=@"$RUNNER_TEMP/comment.md"
-                  else
-                      gh pr comment "$PR_NUMBER" --body-file "$RUNNER_TEMP/comment.md"
-                  fi
+              run: dev/post-check-comment.sh '<!-- check-links-report -->' "$RESULT" "$RUNNER_TEMP/report.md"
 
             - name: Suggest fixes as review comments
               # One suggested change per finding with a fix, kept in sync with the
               # findings; see dev/sync-review-comments.sh
               if: >-
                   github.event.pull_request.head.repo.full_name == github.repository
-                  && contains(fromJSON('["clean", "broken"]'), steps.check.outputs.result)
-              env:
-                  GH_TOKEN: ${{ github.token }}
-                  PR_NUMBER: ${{ github.event.pull_request.number }}
+                  && contains(fromJSON('["clean", "found"]'), steps.check.outputs.result)
               run: dev/sync-review-comments.sh '<!-- check-links-finding:' "$RUNNER_TEMP/review.json"
 
             - name: Fail when this PR introduces broken links
-              if: steps.check.outputs.result == 'broken'
+              if: steps.check.outputs.result == 'found'
               run: exit 1
diff --git a/.github/workflows/check-redirects.yml b/.github/workflows/check-redirects.yml
index b915e0983..192c2e907 100644
--- a/.github/workflows/check-redirects.yml
+++ b/.github/workflows/check-redirects.yml
@@ -2,8 +2,9 @@ name: Check redirects
 
 # Reports redirects in src/data/redirects.ts that this PR breaks, compared with
 # the merge base: destinations that no longer exist, #fragments whose heading
-# was renamed, and new redirects that shadow an existing page. Pre-existing
-# broken redirects on the base branch are ignored.
+# was renamed, and new redirects that shadow an existing page, as a summary
+# comment plus an inline suggested change on each fixable entry. Pre-existing
+# broken redirects on the base branch are ignored. Fails the PR.
 
 on:
     pull_request:
@@ -21,6 +22,13 @@ jobs:
     check-redirects:
         name: Broken redirects introduced by this PR
         runs-on: ubuntu-latest
+        env:
+            GH_TOKEN: ${{ github.token }}
+            PR_NUMBER: ${{ github.event.pull_request.number }}
+            BASE_SHA: ${{ github.event.pull_request.base.sha }}
+            # Line links in the report open redirects.ts on the PR branch
+            LINK_BASE: ${{ github.event.pull_request.head.repo.html_url }}/blob/${{ github.event.pull_request.head.ref }}
+            RUN_URL: ${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}
         steps:
             - name: Check out pull request head
               uses: actions/checkout@v7
@@ -28,6 +36,12 @@ jobs:
                   ref: ${{ github.event.pull_request.head.sha }}
                   fetch-depth: 0
 
+            # The workflow file is read from the merge commit, so run the scripts
+            # from there too: a branch that predates a check has no script for it,
+            # and the merge commit also has this PR's changes to them
+            - name: Check out the check scripts from the merge commit
+              run: git fetch --quiet origin "$GITHUB_SHA" && git checkout --quiet "$GITHUB_SHA" -- dev
+
             - name: Install github-slugger, the only dependency of dev/check-redirects.mjs
               # Into a scratch prefix, not the repo: `npm install <pkg>` next to
               # package.json would install every dependency of the site
@@ -37,8 +51,6 @@ jobs:
                   ln -s "$RUNNER_TEMP/deps/node_modules" node_modules
 
             - name: Check out merge base
-              env:
-                  BASE_SHA: ${{ github.event.pull_request.base.sha }}
               run: |
                   merge_base=$(git merge-base "$BASE_SHA" HEAD)
                   git worktree add "$RUNNER_TEMP/base" "$merge_base"
@@ -56,9 +68,6 @@ jobs:
 
             - name: Find redirects broken by this PR
               id: check
-              env:
-                  # Line links in the report open redirects.ts on the PR branch
-                  LINK_BASE: ${{ github.event.pull_request.head.repo.html_url }}/blob/${{ github.event.pull_request.head.ref }}
               run: |
                   if ! [ -s "$RUNNER_TEMP/base-redirects.json" ]; then
                       echo "::warning::check-redirects crashed on the base branch, so this PR was not checked"
@@ -72,7 +81,7 @@ jobs:
                       --link-base "$LINK_BASE" > "$RUNNER_TEMP/report.md"; then
                       echo "result=clean" >> "$GITHUB_OUTPUT"
                   elif [ -s "$RUNNER_TEMP/report.md" ]; then
-                      echo "result=broken" >> "$GITHUB_OUTPUT"
+                      echo "result=found" >> "$GITHUB_OUTPUT"
                   else
                       echo "::warning::check-redirects crashed, so this PR was not checked"
                       echo "result=crashed" >> "$GITHUB_OUTPUT"
@@ -83,46 +92,17 @@ jobs:
               # Fork PRs get a read-only token; the report is still in the job log
               if: github.event.pull_request.head.repo.full_name == github.repository
               env:
-                  GH_TOKEN: ${{ github.token }}
-                  PR_NUMBER: ${{ github.event.pull_request.number }}
                   RESULT: ${{ steps.check.outputs.result }}
-                  RUN_URL: ${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}
-              run: |
-                  marker='<!-- check-redirects-report -->'
-                  existing_comment=$(gh api "repos/$GITHUB_REPOSITORY/issues/$PR_NUMBER/comments" \
-                      --paginate --jq ".[] | select(.body | startswith(\"$marker\")) | .id" | head -n 1)
-
-                  # Comment when there is something to report, or an earlier report to resolve
-                  case "$RESULT" in
-                      broken)
-                          { echo "$marker"; cat "$RUNNER_TEMP/report.md"; } > "$RUNNER_TEMP/comment.md" ;;
-                      crashed)
-                          printf '%s\n### ⚠️ The redirects check could not run on this revision\n\nThis is a problem with the check, not with this PR; see the [job log](%s).\n' \
-                              "$marker" "$RUN_URL" > "$RUNNER_TEMP/comment.md" ;;
-                      *)
-                          [ -n "$existing_comment" ] || exit 0
-                          printf '%s\n### ✅ This revision breaks no redirects\n' \
-                              "$marker" > "$RUNNER_TEMP/comment.md" ;;
-                  esac
-
-                  if [ -n "$existing_comment" ]; then
-                      gh api --method PATCH "repos/$GITHUB_REPOSITORY/issues/comments/$existing_comment" \
-                          --field body=@"$RUNNER_TEMP/comment.md"
-                  else
-                      gh pr comment "$PR_NUMBER" --body-file "$RUNNER_TEMP/comment.md"
-                  fi
+              run: dev/post-check-comment.sh '<!-- check-redirects-report -->' "$RESULT" "$RUNNER_TEMP/report.md"
 
             - name: Suggest fixes as review comments
               # One suggested change per fixable entry this PR added, kept in sync
               # with the findings; see dev/sync-review-comments.sh
               if: >-
                   github.event.pull_request.head.repo.full_name == github.repository
-                  && contains(fromJSON('["clean", "broken"]'), steps.check.outputs.result)
-              env:
-                  GH_TOKEN: ${{ github.token }}
-                  PR_NUMBER: ${{ github.event.pull_request.number }}
+                  && contains(fromJSON('["clean", "found"]'), steps.check.outputs.result)
               run: dev/sync-review-comments.sh '<!-- check-redirects-finding:' "$RUNNER_TEMP/review.json"
 
             - name: Fail when this PR breaks redirects
-              if: steps.check.outputs.result == 'broken'
+              if: steps.check.outputs.result == 'found'
               run: exit 1
diff --git a/AGENTS.md b/AGENTS.md
index 7ab0b55a1..2d6d12b31 100644
--- a/AGENTS.md
+++ b/AGENTS.md
@@ -148,7 +148,17 @@ gh api repos/sourcegraph/docs/pulls/<pr>/comments --paginate \
 
 Fork PRs get no comments; the findings are in the job log
 (`gh run view <run-id> --log`). The checks resolve their own comments on the
-next run.
+next run: the summary is minimized and the inline comments are deleted. A PR
+that never had findings never gets a comment.
+
+The five check workflows share one shape, so keep them in step:
+`dev/check-<name>.mjs` writes a Markdown report and a review JSON for the
+lines a PR adds, exits 1 with findings, and leaves the report empty when it
+crashes; the workflow turns that into `result=clean|found|crashed`,
+`dev/post-check-comment.sh` posts the summary, and
+`dev/sync-review-comments.sh` posts the inline comments. The scripts run from
+the merge commit, like the workflow file itself, so a branch that predates a
+check still gets checked.
 
 ### Vercel build failures
 
diff --git a/dev/check-links.mjs b/dev/check-links.mjs
index 5b879c742..5b45fdb29 100644
--- a/dev/check-links.mjs
+++ b/dev/check-links.mjs
@@ -597,7 +597,7 @@ const ABSOLUTE_LINKS_ADVICE =
 // the PR renamed or removed a link target).
 function formatMarkdown(findings) {
 	if (findings.length === 0) {
-		return '### ✅ This PR introduces no broken links\n';
+		return '### ✅ This revision introduces no broken links\n';
 	}
 	
 	const lines = [`### ❌ This PR introduces ${findings.length} broken link(s)`, ''];
diff --git a/dev/check-redirects.mjs b/dev/check-redirects.mjs
index c923985ad..f123e9f15 100644
--- a/dev/check-redirects.mjs
+++ b/dev/check-redirects.mjs
@@ -342,7 +342,7 @@ function groupByProblem(findings) {
 // Body for a pull request comment
 function formatMarkdown(findings) {
 	if (findings.length === 0) {
-		return '### ✅ This PR breaks no redirects\n';
+		return '### ✅ This revision breaks no redirects\n';
 	}
 
 	// ?plain=1 opens GitHub's code view, where #L<n> anchors work
diff --git a/dev/post-check-comment.sh b/dev/post-check-comment.sh
new file mode 100755
index 000000000..7690bddbf
--- /dev/null
+++ b/dev/post-check-comment.sh
@@ -0,0 +1,42 @@
+#!/usr/bin/env sh
+# Post a check's summary comment on a PR, or update the one it posted earlier,
+# found by the marker on its first line. Findings and crashes post the comment
+# or reopen it; a clean result only resolves an earlier comment, updating it
+# and minimizing it, so a PR that never had findings never gets a comment.
+#
+# Usage: dev/post-check-comment.sh '<!-- check-links-report -->' <clean|found|crashed> report.md
+# The report is the Markdown the check script wrote, used as the comment body
+# for clean and found. Needs GH_TOKEN, GITHUB_REPOSITORY, GITHUB_WORKFLOW,
+# PR_NUMBER, and RUN_URL.
+set -eu
+marker=$1
+result=$2
+report=$3
+issues="repos/$GITHUB_REPOSITORY/issues"
+
+existing=$(gh api "$issues/$PR_NUMBER/comments" --paginate \
+    --jq ".[] | select(.body | startswith(\"$marker\")) | \"\(.id) \(.node_id)\"" | head -n 1)
+
+if [ "$result" = crashed ]; then
+    body=$(printf '%s\n### ⚠️ %s could not run on this revision\n\nThis is a problem with the check, not with this PR; see the [job log](%s).\n' \
+        "$marker" "$GITHUB_WORKFLOW" "$RUN_URL")
+else
+    body=$(printf '%s\n' "$marker"; cat "$report")
+fi
+
+if [ -z "$existing" ]; then
+    [ "$result" != clean ] || exit 0
+    gh api --method POST "$issues/$PR_NUMBER/comments" --raw-field body="$body" --silent
+    exit 0
+fi
+
+gh api --method PATCH "$issues/comments/${existing% *}" --raw-field body="$body" --silent
+
+# Minimizing is GraphQL-only. Both mutations are idempotent
+if [ "$result" = clean ]; then
+    mutation="minimizeComment(input: {subjectId: \$id, classifier: RESOLVED})"
+else
+    mutation="unminimizeComment(input: {subjectId: \$id})"
+fi
+gh api graphql --raw-field id="${existing#* }" \
+    --raw-field query="mutation(\$id: ID!) { $mutation { clientMutationId } }" --silent
diff --git a/dev/vercel-ignore-build.sh b/dev/vercel-ignore-build.sh
index 18d5a7360..03f6f6689 100755
--- a/dev/vercel-ignore-build.sh
+++ b/dev/vercel-ignore-build.sh
@@ -17,9 +17,10 @@ exec git diff --quiet HEAD^ HEAD -- . \
 	':(exclude)dev/check-redirects.mjs' \
 	':(exclude)dev/check-spelling.mjs' \
 	':(exclude)dev/example-hostnames.json' \
+	':(exclude)dev/post-check-comment.sh' \
 	':(exclude)dev/post-spelling-review.mjs' \
-	':(exclude)dev/slack-app-vercel-build-report.json' \
 	':(exclude)dev/sync-review-comments.sh' \
+	':(exclude)dev/vercel-build-log-slack-app-manifest.json' \
 	':(exclude)dev/vercel-build-log.mjs' \
 	':(exclude)dev/vercel-ignore-build.sh' \
 	':(exclude)dev/verify-links-live.mjs' \

From 5a952863dc78be1a6ed6959f3108867f021e1b8c Mon Sep 17 00:00:00 2001
From: Marc LeBlanc <7050295+marcleblanc2@users.noreply.github.com>
Date: Fri, 30 Oct 2026 18:29:55 -0600
Subject: [PATCH 2/6] ci/spellcheck: Report through the same scripts as the
 other checks

check-spelling.mjs takes --diff, --format markdown, --link-base, and --review like the other check scripts, and the workflow posts its summary with dev/post-check-comment.sh and its inline comments with dev/sync-review-comments.sh. That retires dev/post-spelling-review.mjs, which carried its own GitHub client, summary rendering, and review-comment sync.

The comment markers stay cspell-report and cspell-finding, so comments already on open PRs keep being updated. The workflow also gets the concurrency block the other checks have, so two pushes in a row stop racing each other's comments.

Amp-Thread-ID: https://ampcode.com/threads/T-01a18f4b-0163-7216-a915-372c4b6288cb
Co-authored-by: Amp <amp@ampcode.com>
---
 .github/workflows/spellcheck.yml |  80 ++++---
 AGENTS.md                        |   4 +-
 dev/check-spelling.mjs           | 262 ++++++++++++++++++---
 dev/post-spelling-review.mjs     | 388 -------------------------------
 dev/vercel-ignore-build.sh       |   1 -
 5 files changed, 283 insertions(+), 452 deletions(-)
 delete mode 100644 dev/post-spelling-review.mjs

diff --git a/.github/workflows/spellcheck.yml b/.github/workflows/spellcheck.yml
index 328c3f2a8..744b69ba5 100644
--- a/.github/workflows/spellcheck.yml
+++ b/.github/workflows/spellcheck.yml
@@ -1,15 +1,21 @@
 name: Spell check
 
 # Reports spelling errors on lines added by a pull request, as a summary comment
-# plus inline review comments on the flagged lines. Existing spelling errors and
-# errors on unchanged lines are not included. The pull request's title and
-# description are checked too, and reported in the summary comment.
+# plus an inline suggested change on each flagged line. Existing spelling errors
+# and errors on unchanged lines are not included. The pull request's title and
+# description are checked too, and reported in the summary comment. Advisory:
+# never fails the PR.
 
 on:
     pull_request:
         # `edited` fires when the title or description changes
         types: [opened, synchronize, reopened, edited]
 
+# A new push supersedes the run for the previous one
+concurrency:
+    group: ${{ github.workflow }}-${{ github.event.pull_request.number }}
+    cancel-in-progress: true
+
 permissions:
     contents: read
     pull-requests: write
@@ -18,6 +24,13 @@ jobs:
     spellcheck:
         name: CSpell (advisory)
         runs-on: ubuntu-latest
+        env:
+            GH_TOKEN: ${{ github.token }}
+            PR_NUMBER: ${{ github.event.pull_request.number }}
+            BASE_SHA: ${{ github.event.pull_request.base.sha }}
+            # File links in the report open the file on the PR branch
+            LINK_BASE: ${{ github.event.pull_request.head.repo.html_url }}/blob/${{ github.event.pull_request.head.ref }}
+            RUN_URL: ${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}
         steps:
             - name: Check out pull request head
               uses: actions/checkout@v7
@@ -25,6 +38,12 @@ jobs:
                   ref: ${{ github.event.pull_request.head.sha }}
                   fetch-depth: 0
 
+            # The workflow file is read from the merge commit, so run the scripts
+            # from there too: a branch that predates a check has no script for it,
+            # and the merge commit also has this PR's changes to them
+            - name: Check out the check scripts from the merge commit
+              run: git fetch --quiet origin "$GITHUB_SHA" && git checkout --quiet "$GITHUB_SHA" -- dev
+
             # Node 24 is pre-cached on ubuntu-latest, avoiding the download
             # incurred by node-version: latest.
             - name: Set up Node.js
@@ -41,39 +60,40 @@ jobs:
               # Title and description come in through env, never inline in the
               # script, so a crafted pull request cannot inject shell commands
               env:
-                  BASE_SHA: ${{ github.event.pull_request.base.sha }}
                   PR_TITLE: ${{ github.event.pull_request.title }}
                   PR_BODY: ${{ github.event.pull_request.body }}
+              # The script exits 1 both with findings and when it crashes. It writes
+              # its output in one go at the end, so a crash leaves it empty. A crash
+              # does not fail the check, since it says nothing about the PR; the
+              # comment step reports it instead of posting the empty report.
               run: |
-                  base=$(git merge-base "$BASE_SHA" HEAD)
+                  git diff -U0 "$(git merge-base "$BASE_SHA" HEAD)" HEAD > "$RUNNER_TEMP/changes.diff"
                   printf '%s\n\n%s\n' "$PR_TITLE" "$PR_BODY" > "$RUNNER_TEMP/pull-request.md"
-                  # The script exits 1 both with findings and when it crashes at import
-                  # time. It writes its output in one go at the end, so a crash leaves
-                  # it empty. A crash does not fail the check, since it says nothing
-                  # about the PR; the report step says so instead of posting the
-                  # empty report
-                  node dev/check-spelling.mjs --base "$base" \
-                      --pull-request "$RUNNER_TEMP/pull-request.md" --format json \
-                      > "$RUNNER_TEMP/spelling.json" || true
-                  if ! [ -s "$RUNNER_TEMP/spelling.json" ]; then
+                  if node dev/check-spelling.mjs --format markdown \
+                      --diff "$RUNNER_TEMP/changes.diff" \
+                      --pull-request "$RUNNER_TEMP/pull-request.md" \
+                      --review "$RUNNER_TEMP/review.json" \
+                      --link-base "$LINK_BASE" > "$RUNNER_TEMP/report.md"; then
+                      echo "result=clean" >> "$GITHUB_OUTPUT"
+                  elif [ -s "$RUNNER_TEMP/report.md" ]; then
+                      echo "result=found" >> "$GITHUB_OUTPUT"
+                  else
                       echo "::warning::check-spelling crashed, so this PR was not checked"
-                      echo "crashed=true" >> "$GITHUB_OUTPUT"
+                      echo "result=crashed" >> "$GITHUB_OUTPUT"
                   fi
-                  cat "$RUNNER_TEMP/spelling.json"
+                  cat "$RUNNER_TEMP/report.md"
 
-            - name: Report on the pull request
-              # Fork PRs get a read-only token; the findings are still in the job log
+            - name: Comment on the pull request
+              # Fork PRs get a read-only token; the report is still in the job log
               if: github.event.pull_request.head.repo.full_name == github.repository
               env:
-                  GH_TOKEN: ${{ github.token }}
-                  PR_NUMBER: ${{ github.event.pull_request.number }}
-                  HEAD_SHA: ${{ github.event.pull_request.head.sha }}
-                  HEAD_REF: ${{ github.event.pull_request.head.ref }}
-                  RUN_URL: ${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}
-                  CRASHED: ${{ steps.check.outputs.crashed }}
-              run: |
-                  if [ "$CRASHED" = true ]; then
-                      node dev/post-spelling-review.mjs --crashed
-                  else
-                      node dev/post-spelling-review.mjs --findings "$RUNNER_TEMP/spelling.json"
-                  fi
+                  RESULT: ${{ steps.check.outputs.result }}
+              run: dev/post-check-comment.sh '<!-- cspell-report -->' "$RESULT" "$RUNNER_TEMP/report.md"
+
+            - name: Suggest fixes as review comments
+              # One suggested change per flagged line, kept in sync with the
+              # findings; see dev/sync-review-comments.sh
+              if: >-
+                  github.event.pull_request.head.repo.full_name == github.repository
+                  && contains(fromJSON('["clean", "found"]'), steps.check.outputs.result)
+              run: dev/sync-review-comments.sh '<!-- cspell-finding:' "$RUNNER_TEMP/review.json"
diff --git a/AGENTS.md b/AGENTS.md
index 2d6d12b31..4b71219ce 100644
--- a/AGENTS.md
+++ b/AGENTS.md
@@ -57,7 +57,9 @@
   order (the check reports out-of-order entries), or comment `/spell <words>`
   on the PR: `.github/workflows/spellcheck-allow.yml` commits them to the
   branch and runs the check again. CSpell is not a project dependency:
-  `npx cspell@10 --no-progress <file>` to run it locally
+  `npm install --global cspell@10`, then
+  `node dev/check-spelling.mjs --diff <(git diff -U0 origin/main)` runs the
+  check on your branch
 - **Example hostnames**: placeholder hostnames in docs are `*.example.com` 
   (`sourcegraph.example.com` for the reader's instance, 
   `github.example.com` for a code host, 
diff --git a/dev/check-spelling.mjs b/dev/check-spelling.mjs
index 23775737f..71075bca8 100644
--- a/dev/check-spelling.mjs
+++ b/dev/check-spelling.mjs
@@ -3,41 +3,48 @@
 /**
  * Reports CSpell findings on lines added by a Git diff, and dictionary entries
  * added out of alphabetical order. Optionally also checks a pull request's
- * title and description.
+ * title and description. The pull request workflow
+ * (.github/workflows/spellcheck.yml) runs this on the lines a PR adds and
+ * comments the findings; it never fails the PR.
  *
- * Usage: node dev/check-spelling.mjs --base <revision>
- *            [--pull-request <file>] [--format text|json]
+ * Usage: node dev/check-spelling.mjs --diff <file> [options]
+ *   --diff <file>          Unified diff, e.g. from `git diff -U0 origin/main`;
+ *                          only added lines are checked
+ *   --pull-request <file>  `<title>\n\n<description>` of the pull request, as
+ *                          written by the workflow. Its findings carry `field`
+ *                          ("title" or "description") instead of a repository
+ *                          path, so they are reported in the summary only
+ *   --format <name>        Output as text (default), json, or markdown
+ *   --link-base <url>      Markdown output links each finding to <url>/<path>,
+ *                          e.g. https://github.com/sourcegraph/docs/blob/<branch>
+ *   --review <file>        Write a GitHub pull request review (JSON body for
+ *                          POST /repos/{owner}/{repo}/pulls/{n}/reviews) with
+ *                          one comment per finding in a file, up to 25
  *
- * --pull-request names a file holding `<title>\n\n<description>`, as written
- * by .github/workflows/spellcheck.yml. Its findings carry `field` ("title" or
- * "description") instead of a repository path, so they are reported in the
- * summary comment only.
- *
- * The json format feeds dev/post-spelling-review.mjs.
  * Exits 1 when spelling issues are found and 2 for operational errors.
  */
 
-import {execFileSync, spawnSync} from 'child_process';
-import {readFileSync} from 'fs';
+import {spawnSync} from 'child_process';
+import {readFileSync, writeFileSync} from 'fs';
 import path from 'path';
 import {fileURLToPath} from 'url';
 
 const args = process.argv.slice(2);
-const BASE = flagValue('--base');
+const DIFF_FILE = flagValue('--diff');
 const PULL_REQUEST_FILE = flagValue('--pull-request');
 const FORMAT = flagValue('--format') ?? 'text';
+const LINK_BASE = flagValue('--link-base')?.replace(/\/$/, '');
+const REVIEW_FILE = flagValue('--review');
+
+const ALLOW_LIST = 'cspell-allow-list.txt';
+const MAX_INLINE_COMMENTS = 25;
 
 function flagValue(name) {
 	const index = args.indexOf(name);
 	return index === -1 ? undefined : args[index + 1];
 }
 
-function addedLineRanges(base) {
-	const diff = execFileSync(
-		'git',
-		['diff', '--unified=0', '--no-color', '--find-renames', base, '--'],
-		{encoding: 'utf8', maxBuffer: 50 * 1024 * 1024}
-	);
+function addedLineRanges(diff) {
 	const ranges = new Map();
 	let file;
 
@@ -126,7 +133,7 @@ function pullRequestFindings(file) {
 // Entries in the dictionary files must be sorted, so duplicates stand out and
 // merges are clean. Sorted the way CSpell matches: case- and accent-insensitive.
 // Blank lines and comments start a new sorted run, so the lists can be sectioned.
-const DICTIONARY_FILES = ['cspell-allow-list.txt', 'cspell-block-list.txt'];
+const DICTIONARY_FILES = [ALLOW_LIST, 'cspell-block-list.txt'];
 const collator = new Intl.Collator('en', {sensitivity: 'base'});
 
 function unsortedDictionaryEntries(files) {
@@ -172,6 +179,17 @@ function findingsOnAddedLines(ranges, issues) {
 	);
 }
 
+function groupByFile(findings) {
+	const byFile = new Map();
+	for (const finding of findings) {
+		if (!byFile.has(finding.file)) {
+			byFile.set(finding.file, []);
+		}
+		byFile.get(finding.file).push(finding);
+	}
+	return byFile;
+}
+
 function formatText(findings) {
 	if (findings.length === 0) {
 		return 'No issues found.\n';
@@ -187,15 +205,191 @@ function formatText(findings) {
 	return lines.join('\n') + '\n';
 }
 
-async function main() {
-	if (!BASE) {
-		throw new Error('Missing required --base <revision>');
+function linkTo(text, url) {
+	return url ? `[${text}](${url})` : text;
+}
+
+// ?plain=1 opens GitHub's code view, where #L<n> anchors work; the rendered
+// Markdown preview ignores them
+function fileUrl(file) {
+	return LINK_BASE && `${LINK_BASE}/${file}?plain=1`;
+}
+
+// Without ?plain=1, so GitHub's edit button works from it
+const ALLOW_LIST_LINK = linkTo(
+	`\`${ALLOW_LIST}\``,
+	LINK_BASE && `${LINK_BASE}/${ALLOW_LIST}`
+);
+
+// Where the finding is, linked to the source view with the word highlighted
+// when it is in a file
+function locationText({file, line, column, word, field}) {
+	if (field === 'title') {
+		return `column ${column}`;
 	}
-	if (!['text', 'json'].includes(FORMAT)) {
-		throw new Error(`Unknown --format "${FORMAT}"; use text or json`);
+	const location = `line ${line}, column ${column}`;
+	const url = fileUrl(file);
+	return field || !url
+		? location
+		: `[${location}](${url}#L${line}C${column}-L${line}C${column + word.length})`;
+}
+
+// A non-spelling finding's own message, e.g. an unsorted dictionary entry,
+// pointing at its `relatedLine` when it has one
+function messageText({file, message, relatedLine}) {
+	if (!relatedLine) {
+		return `${message}.`;
 	}
+	const url = fileUrl(file);
+	return `${message} on ${linkTo(`line ${relatedLine}`, url && `${url}#L${relatedLine}`)}.`;
+}
+
+// CSpell suggests case-insensitively, so prefer a suggestion whose first
+// letter matches the case of the flagged word.
+function bestSuggestion({word, suggestions}) {
+	const isUpper = letter => letter === letter.toUpperCase();
+	return (
+		suggestions.find(
+			suggestion => isUpper(suggestion[0]) === isUpper(word[0])
+		) ?? suggestions[0]
+	);
+}
+
+// `word` → `suggestion`, or the finding's own message
+function summaryItem(finding) {
+	if (finding.message) {
+		return messageText(finding);
+	}
+	const suggestion = bestSuggestion(finding);
+	return `\`${finding.word}\`${suggestion ? ` → \`${suggestion}\`` : ''}`;
+}
 
-	const ranges = addedLineRanges(BASE);
+// The words not in the dictionary, each once, as a `/spell` command takes them
+function unknownWords(findings) {
+	const words = [];
+	for (const {word, message} of findings) {
+		if (!message && !words.includes(word)) {
+			words.push(word);
+		}
+	}
+	return words;
+}
+
+// Body for a pull request comment
+function formatMarkdown(findings) {
+	if (findings.length === 0) {
+		return '### ✅ This revision introduces no spelling errors\n';
+	}
+	const lines = [
+		`### ⚠️ Spell check found ${findings.length} issue(s) in this PR`,
+		'',
+		'Only findings on lines added by this PR, and in its title and description, are shown.',
+		...(findings.length > MAX_INLINE_COMMENTS
+			? [
+					`Up to ${MAX_INLINE_COMMENTS} of them are also commented inline.`
+				]
+			: []),
+		''
+	];
+	for (const [file, fileFindings] of groupByFile(findings)) {
+		lines.push(fileFindings[0].field ? `**${file}**` : `**\`${file}\`**`);
+		for (const finding of fileFindings) {
+			lines.push(
+				`- ${locationText(finding)}`,
+				`  - ${summaryItem(finding)}`
+			);
+		}
+		lines.push('');
+	}
+	lines.push(
+		`Please correct the spelling, or add words which are correct to ${ALLOW_LIST_LINK}.`,
+		'',
+		`Comment on this PR with \`/spell <list of words>\`, and a bot will push a commit to your branch adding your comment's list of words to ${ALLOW_LIST_LINK} for you.`
+	);
+	const words = unknownWords(findings);
+	if (words.length > 0) {
+		lines.push(
+			'',
+			`To accept all of the words above as correct: \`/spell ${words.join(' ')}\``
+		);
+	}
+	return lines.join('\n') + '\n';
+}
+
+// First line of a review comment, so the workflow can match the comments it
+// posted earlier to the findings still present and delete the rest
+const REVIEW_MARKER = '<!-- cspell-finding:';
+
+// One GitHub suggestion block with an apply button. A four-backtick fence so
+// lines containing ``` cannot break out of the block.
+function suggestionBlock(finding) {
+	const suggestion = bestSuggestion(finding);
+	if (!suggestion) {
+		return [];
+	}
+	const {text, column, word} = finding;
+	const start = column - 1;
+	return [
+		`Did you mean \`${suggestion}\`?`,
+		'',
+		'````suggestion',
+		text.slice(0, start) + suggestion + text.slice(start + word.length),
+		'````',
+		''
+	];
+}
+
+function reviewComment(finding) {
+	const explanation = finding.message
+		? [messageText(finding)]
+		: [
+				`\`${finding.word}\` is not in the dictionary.`,
+				'',
+				...suggestionBlock(finding),
+				`Please correct the spelling, or add words which are correct to ${ALLOW_LIST_LINK}.`,
+				'',
+				`Comment on this PR with \`/spell ${finding.word}\`, and a bot will push a commit to your branch adding it to ${ALLOW_LIST_LINK} for you.`
+			];
+	return {
+		path: finding.file,
+		line: finding.line,
+		side: 'RIGHT',
+		body: [`${REVIEW_MARKER} ${finding.word} -->`, ...explanation].join(
+			'\n'
+		)
+	};
+}
+
+// Body for POST /repos/{owner}/{repo}/pulls/{n}/reviews: one comment per
+// finding in a file; title and description findings have no line to comment
+// on. No review body: a submitted review cannot be deleted, so a body would
+// outlive the comments once the words are fixed.
+function reviewRequest(findings) {
+	const comments = findings
+		.filter(finding => !finding.field)
+		.slice(0, MAX_INLINE_COMMENTS)
+		.map(reviewComment);
+	return {event: 'COMMENT', body: '', comments};
+}
+
+const FORMATTERS = {
+	text: formatText,
+	json: findings => JSON.stringify(findings, null, '\t') + '\n',
+	markdown: formatMarkdown
+};
+
+function main() {
+	if (!DIFF_FILE) {
+		throw new Error('Missing required --diff <file>');
+	}
+	const format = FORMATTERS[FORMAT];
+	if (!format) {
+		throw new Error(
+			`Unknown --format "${FORMAT}"; use text, json, or markdown`
+		);
+	}
+
+	const ranges = addedLineRanges(readFileSync(DIFF_FILE, 'utf8'));
 	const files = [...ranges.keys()];
 	const findings = [
 		...findingsOnAddedLines(ranges, [
@@ -204,15 +398,19 @@ async function main() {
 		]),
 		...(PULL_REQUEST_FILE ? pullRequestFindings(PULL_REQUEST_FILE) : [])
 	];
-	process.stdout.write(
-		FORMAT === 'json'
-			? JSON.stringify(findings, null, '\t') + '\n'
-			: formatText(findings)
-	);
+	if (REVIEW_FILE) {
+		writeFileSync(
+			REVIEW_FILE,
+			JSON.stringify(reviewRequest(findings), null, '\t') + '\n'
+		);
+	}
+	process.stdout.write(format(findings));
 	process.exit(findings.length === 0 ? 0 : 1);
 }
 
-main().catch(error => {
+try {
+	main();
+} catch (error) {
 	console.error(error);
 	process.exit(2);
-});
+}
diff --git a/dev/post-spelling-review.mjs b/dev/post-spelling-review.mjs
deleted file mode 100644
index 109f1e711..000000000
--- a/dev/post-spelling-review.mjs
+++ /dev/null
@@ -1,388 +0,0 @@
-#!/usr/bin/env node
-
-/**
- * Reports CSpell findings on a pull request: one summary comment in the
- * discussion, plus an inline review comment on each flagged line. Findings in
- * the pull request's title or description (those with a `field`) have no line
- * to comment on, so they appear in the summary only. Once the findings are
- * fixed, the summary is minimized as resolved and the inline comments are
- * deleted; the review that carried them has no body, so nothing of it remains
- * visible.
- *
- * Usage: node dev/post-spelling-review.mjs --findings <json-file> [--dry-run]
- *        node dev/post-spelling-review.mjs --crashed [--dry-run]
- *
- * Reads the JSON written by `dev/check-spelling.mjs --format json`. With
- * `--crashed`, the summary says the check could not run and links the job log
- * (RUN_URL) instead; the inline comments are left as they are.
- * Requires GH_TOKEN, GITHUB_REPOSITORY, PR_NUMBER, HEAD_SHA and HEAD_REF.
- */
-
-import {readFileSync} from 'fs';
-
-const args = process.argv.slice(2);
-const FINDINGS_FILE = args[args.indexOf('--findings') + 1];
-const CRASHED = args.includes('--crashed');
-const DRY_RUN = args.includes('--dry-run');
-const MAX_INLINE_COMMENTS = 25;
-
-const API_URL = process.env.GITHUB_API_URL ?? 'https://api.github.com';
-const REPOSITORY = process.env.GITHUB_REPOSITORY;
-const PR_NUMBER = process.env.PR_NUMBER;
-const HEAD_SHA = process.env.HEAD_SHA;
-const HEAD_REF = process.env.HEAD_REF;
-const RUN_URL = process.env.RUN_URL;
-
-// Link to the PR branch, not the commit, so GitHub's edit button works from it
-const ALLOW_LIST_LINK = `[\`cspell-allow-list.txt\`](https://github.com/${REPOSITORY}/blob/${HEAD_REF}/cspell-allow-list.txt)`;
-
-const SUMMARY_MARKER = '<!-- cspell-report -->';
-const INLINE_MARKER = '<!-- cspell-finding:';
-
-async function github(method, route, body) {
-	const response = await fetch(`${API_URL}${route}`, {
-		method,
-		headers: {
-			authorization: `Bearer ${process.env.GH_TOKEN}`,
-			accept: 'application/vnd.github+json',
-			'x-github-api-version': '2022-11-28',
-			...(body && {'content-type': 'application/json'})
-		},
-		body: body && JSON.stringify(body)
-	});
-	if (!response.ok) {
-		throw new Error(
-			`${method} ${route} failed: ${response.status} ${await response.text()}`
-		);
-	}
-	return response.status === 204 ? undefined : response.json();
-}
-
-async function githubList(route) {
-	const items = [];
-	for (let page = 1; ; page++) {
-		const batch = await github('GET', `${route}?per_page=100&page=${page}`);
-		items.push(...batch);
-		if (batch.length < 100) {
-			return items;
-		}
-	}
-}
-
-async function githubWrite(method, route, body) {
-	console.log(`${DRY_RUN ? '[dry-run] ' : ''}${method} ${route}`);
-	if (!DRY_RUN) {
-		await github(method, route, body);
-	}
-}
-
-// Minimizing a comment is GraphQL-only. Both mutations are idempotent.
-async function setCommentMinimized(nodeId, minimized) {
-	const mutation = minimized
-		? 'minimizeComment(input: {subjectId: $id, classifier: RESOLVED}) { clientMutationId }'
-		: 'unminimizeComment(input: {subjectId: $id}) { clientMutationId }';
-	console.log(
-		`${DRY_RUN ? '[dry-run] ' : ''}${minimized ? 'minimize' : 'unminimize'} comment ${nodeId}`
-	);
-	if (DRY_RUN) {
-		return;
-	}
-	const result = await github('POST', '/graphql', {
-		query: `mutation ($id: ID!) { ${mutation} }`,
-		variables: {id: nodeId}
-	});
-	if (result.errors) {
-		throw new Error(`GraphQL failed: ${JSON.stringify(result.errors)}`);
-	}
-}
-
-function groupByFile(findings) {
-	const grouped = new Map();
-	for (const finding of findings) {
-		if (!grouped.has(finding.file)) {
-			grouped.set(finding.file, []);
-		}
-		grouped.get(finding.file).push(finding);
-	}
-	return grouped;
-}
-
-// Source view (?plain=1, so Markdown is not rendered) with the word highlighted
-function sourceLink(finding) {
-	const {file, line, column, word} = finding;
-	const end = column + word.length;
-	return `https://github.com/${REPOSITORY}/blob/${HEAD_REF}/${file}?plain=1#L${line}C${column}-L${line}C${end}`;
-}
-
-// Where the finding is, linked to the source view when it is in a file
-function locationText(finding) {
-	const {line, column, field} = finding;
-	if (field === 'title') {
-		return `column ${column}`;
-	}
-	const location = `line ${line}, column ${column}`;
-	return field ? location : `[${location}](${sourceLink(finding)})`;
-}
-
-// A non-spelling finding's own message, e.g. an unsorted dictionary entry,
-// pointing at its `relatedLine` when it has one
-function messageText(finding) {
-	const {file, message, relatedLine} = finding;
-	if (!relatedLine) return `${message}.`;
-	const url = `https://github.com/${REPOSITORY}/blob/${HEAD_REF}/${file}?plain=1#L${relatedLine}`;
-	return `${message} on [line ${relatedLine}](${url}).`;
-}
-
-// `word` → `suggestion`, or the finding's own message
-function summaryItem(finding) {
-	if (finding.message) {
-		return messageText(finding);
-	}
-	const suggestion = bestSuggestion(finding);
-	return `\`${finding.word}\`${suggestion ? ` → \`${suggestion}\`` : ''}`;
-}
-
-function summaryBody(findings) {
-	const lines = [
-		SUMMARY_MARKER,
-		`### ⚠️ Spell check found ${findings.length} issue(s) in this PR`,
-		'',
-		'Only findings on lines added by this PR, and in its title and description, are shown.',
-		...(findings.length > MAX_INLINE_COMMENTS
-			? [
-					`Up to ${MAX_INLINE_COMMENTS} of them are also commented inline.`
-				]
-			: []),
-		''
-	];
-	for (const [file, fileFindings] of groupByFile(findings)) {
-		lines.push(fileFindings[0].field ? `**${file}**` : `**\`${file}\`**`);
-		for (const finding of fileFindings) {
-			lines.push(
-				`- ${locationText(finding)}`,
-				`  - ${summaryItem(finding)}`
-			);
-		}
-		lines.push('');
-	}
-	lines.push(
-		`Please correct the spelling, or add words which are correct to ${ALLOW_LIST_LINK}.`,
-		'',
-		`Comment on this PR with \`/spell <list of words>\`, and a bot will push a commit to your branch adding your comment's list of words to ${ALLOW_LIST_LINK} for you.`
-	);
-	const words = unknownWords(findings);
-	if (words.length > 0) {
-		lines.push(
-			'',
-			`To accept all of the words above as correct: \`/spell ${words.join(' ')}\``
-		);
-	}
-	return lines.join('\n') + '\n';
-}
-
-// The words not in the dictionary, each once, as a `/spell` command takes them
-function unknownWords(findings) {
-	const words = [];
-	for (const {word, message} of findings) {
-		if (
-			!message &&
-			!words.some(seen => seen.toLowerCase() === word.toLowerCase())
-		) {
-			words.push(word);
-		}
-	}
-	return words;
-}
-
-function crashedBody() {
-	return [
-		SUMMARY_MARKER,
-		'### ⚠️ The spell check could not run on this revision',
-		'',
-		`This is a problem with the check, not with this PR; see the [job log](${RUN_URL}).`,
-		''
-	].join('\n');
-}
-
-const RESOLVED_BODY = `${SUMMARY_MARKER}\n### ✅ This revision introduces no spelling errors\n`;
-
-// Post the summary, or replace the earlier one. A resolved summary is kept,
-// collapsed, so the discussion still shows what was flagged and fixed; it is
-// reopened when there is something to say again.
-async function upsertSummaryComment(body, resolved) {
-	const comments = await githubList(
-		`/repos/${REPOSITORY}/issues/${PR_NUMBER}/comments`
-	);
-	const existing = comments.find(comment =>
-		comment.body.startsWith(SUMMARY_MARKER)
-	);
-
-	if (!existing) {
-		// Nothing to resolve
-		if (!resolved) {
-			await githubWrite(
-				'POST',
-				`/repos/${REPOSITORY}/issues/${PR_NUMBER}/comments`,
-				{body}
-			);
-		}
-		return;
-	}
-
-	await githubWrite(
-		'PATCH',
-		`/repos/${REPOSITORY}/issues/comments/${existing.id}`,
-		{body}
-	);
-	await setCommentMinimized(existing.node_id, resolved);
-}
-
-function findingKey({file, line, word}) {
-	return `${file}:${line}:${word}`;
-}
-
-// Review comments GitHub could not carry to the new revision have line: null,
-// so their key never matches a current finding and they are deleted.
-function existingCommentKey(comment) {
-	const word = comment.body.match(/^<!-- cspell-finding: (.+?) -->/)?.[1];
-	return word && findingKey({file: comment.path, line: comment.line, word});
-}
-
-// CSpell suggests case-insensitively, so prefer a suggestion whose first
-// letter matches the case of the flagged word.
-function bestSuggestion({word, suggestions}) {
-	const isUpper = letter => letter === letter.toUpperCase();
-	return (
-		suggestions.find(
-			suggestion => isUpper(suggestion[0]) === isUpper(word[0])
-		) ?? suggestions[0]
-	);
-}
-
-// One GitHub suggestion block with an apply button. A four-backtick fence so
-// lines containing ``` cannot break out of the block.
-function suggestionBlock(finding) {
-	const suggestion = bestSuggestion(finding);
-	if (!suggestion) {
-		return [];
-	}
-	const {text, column, word} = finding;
-	const start = column - 1;
-	return [
-		`Did you mean \`${suggestion}\`?`,
-		'',
-		'````suggestion',
-		text.slice(0, start) + suggestion + text.slice(start + word.length),
-		'````',
-		''
-	];
-}
-
-function inlineBody(finding) {
-	const explanation = finding.message
-		? [messageText(finding)]
-		: [
-				`\`${finding.word}\` is not in the dictionary.`,
-				'',
-				...suggestionBlock(finding),
-				`Please correct the spelling, or add words which are correct to ${ALLOW_LIST_LINK}.`,
-				'',
-				`Comment on this PR with \`/spell ${finding.word}\`, and a bot will push a commit to your branch adding it to ${ALLOW_LIST_LINK} for you.`
-			];
-	return [`${INLINE_MARKER} ${finding.word} -->`, ...explanation].join('\n');
-}
-
-async function syncInlineComments(findings) {
-	const wanted = new Map(
-		findings
-			.filter(finding => !finding.field)
-			.map(finding => [findingKey(finding), finding])
-	);
-	const comments = await githubList(
-		`/repos/${REPOSITORY}/pulls/${PR_NUMBER}/comments`
-	);
-
-	for (const comment of comments) {
-		const key = existingCommentKey(comment);
-		if (!key) {
-			continue;
-		}
-		if (wanted.has(key)) {
-			const body = inlineBody(wanted.get(key));
-			if (body !== comment.body) {
-				await githubWrite(
-					'PATCH',
-					`/repos/${REPOSITORY}/pulls/comments/${comment.id}`,
-					{body}
-				);
-			}
-			wanted.delete(key);
-		} else {
-			await githubWrite(
-				'DELETE',
-				`/repos/${REPOSITORY}/pulls/comments/${comment.id}`
-			);
-		}
-	}
-
-	const fresh = [...wanted.values()];
-	if (fresh.length === 0) {
-		return;
-	}
-	// No review body: the inline comments say it all, and a submitted review
-	// cannot be deleted, so a body would outlive the comments once fixed.
-	await githubWrite(
-		'POST',
-		`/repos/${REPOSITORY}/pulls/${PR_NUMBER}/reviews`,
-		{
-			commit_id: HEAD_SHA,
-			event: 'COMMENT',
-			body: '',
-			comments: fresh.slice(0, MAX_INLINE_COMMENTS).map(finding => ({
-				path: finding.file,
-				line: finding.line,
-				side: 'RIGHT',
-				body: inlineBody(finding)
-			}))
-		}
-	);
-}
-
-async function main() {
-	for (const name of [
-		'GH_TOKEN',
-		'GITHUB_REPOSITORY',
-		'PR_NUMBER',
-		'HEAD_SHA',
-		'HEAD_REF'
-	]) {
-		if (!process.env[name]) {
-			throw new Error(`Missing required environment variable ${name}`);
-		}
-	}
-	if (CRASHED) {
-		if (!RUN_URL) {
-			throw new Error('Missing required environment variable RUN_URL');
-		}
-		console.log('Reporting that the check crashed');
-		await upsertSummaryComment(crashedBody(), false);
-		return;
-	}
-	if (!FINDINGS_FILE) {
-		throw new Error('Missing required --findings <json-file>');
-	}
-
-	const findings = JSON.parse(readFileSync(FINDINGS_FILE, 'utf8'));
-	console.log(`${findings.length} finding(s) to report`);
-	const resolved = findings.length === 0;
-	await upsertSummaryComment(
-		resolved ? RESOLVED_BODY : summaryBody(findings),
-		resolved
-	);
-	await syncInlineComments(findings);
-}
-
-main().catch(error => {
-	console.error(error);
-	process.exit(2);
-});
diff --git a/dev/vercel-ignore-build.sh b/dev/vercel-ignore-build.sh
index 03f6f6689..4dc8b33a5 100755
--- a/dev/vercel-ignore-build.sh
+++ b/dev/vercel-ignore-build.sh
@@ -18,7 +18,6 @@ exec git diff --quiet HEAD^ HEAD -- . \
 	':(exclude)dev/check-spelling.mjs' \
 	':(exclude)dev/example-hostnames.json' \
 	':(exclude)dev/post-check-comment.sh' \
-	':(exclude)dev/post-spelling-review.mjs' \
 	':(exclude)dev/sync-review-comments.sh' \
 	':(exclude)dev/vercel-build-log-slack-app-manifest.json' \
 	':(exclude)dev/vercel-build-log.mjs' \

From d1809f3fe7900226e0154d1dccba0eae5804ee73 Mon Sep 17 00:00:00 2001
From: Marc LeBlanc <7050295+marcleblanc2@users.noreply.github.com>
Date: Fri, 30 Oct 2026 18:32:45 -0600
Subject: [PATCH 3/6] cspell: Allow shellcheck

Amp-Thread-ID: https://ampcode.com/threads/T-01a18f4b-0163-7216-a915-372c4b6288cb
Co-authored-by: Amp <amp@ampcode.com>
---
 cspell-allow-list.txt | 1 +
 1 file changed, 1 insertion(+)

diff --git a/cspell-allow-list.txt b/cspell-allow-list.txt
index 2177b4e74..de0595cd8 100644
--- a/cspell-allow-list.txt
+++ b/cspell-allow-list.txt
@@ -487,6 +487,7 @@ sgquery
 sgtest
 sgviolet
 Shadcn
+shellcheck
 shellsession
 shiki
 showcerts

From f3abe48440204ebd54b866abaa0f8772cbf4bf13 Mon Sep 17 00:00:00 2001
From: Marc LeBlanc <7050295+marcleblanc2@users.noreply.github.com>
Date: Fri, 30 Oct 2026 19:04:35 -0600
Subject: [PATCH 4/6] ci/spellcheck: Rename the workflow to check-spelling.yml
 like the other checks

Amp-Thread-ID: https://ampcode.com/threads/T-01a18f4b-0163-7216-a915-372c4b6288cb
Co-authored-by: Amp <amp@ampcode.com>
---
 .github/workflows/{spellcheck.yml => check-spelling.yml} | 2 +-
 AGENTS.md                                                | 2 +-
 dev/check-spelling.mjs                                   | 2 +-
 3 files changed, 3 insertions(+), 3 deletions(-)
 rename .github/workflows/{spellcheck.yml => check-spelling.yml} (98%)

diff --git a/.github/workflows/spellcheck.yml b/.github/workflows/check-spelling.yml
similarity index 98%
rename from .github/workflows/spellcheck.yml
rename to .github/workflows/check-spelling.yml
index 744b69ba5..3a0f1f363 100644
--- a/.github/workflows/spellcheck.yml
+++ b/.github/workflows/check-spelling.yml
@@ -22,7 +22,7 @@ permissions:
 
 jobs:
     spellcheck:
-        name: CSpell (advisory)
+        name: Spelling errors introduced by this PR (advisory)
         runs-on: ubuntu-latest
         env:
             GH_TOKEN: ${{ github.token }}
diff --git a/AGENTS.md b/AGENTS.md
index 4b71219ce..cb51a4116 100644
--- a/AGENTS.md
+++ b/AGENTS.md
@@ -49,7 +49,7 @@
 - **Prove changed links resolve on a deploy**:
   `node dev/verify-links-live.mjs --site <vercel-preview-url>` prints a
   Markdown table for the PR description
-- **Spell check**: `.github/workflows/spellcheck.yml` runs
+- **Spell check**: `.github/workflows/check-spelling.yml` runs
   `dev/check-spelling.mjs` on the lines a PR adds plus its title and
   description, and comments the findings (advisory, never fails the PR).
   Add product names and identifiers to `cspell-allow-list.txt` with
diff --git a/dev/check-spelling.mjs b/dev/check-spelling.mjs
index 71075bca8..302adbb06 100644
--- a/dev/check-spelling.mjs
+++ b/dev/check-spelling.mjs
@@ -4,7 +4,7 @@
  * Reports CSpell findings on lines added by a Git diff, and dictionary entries
  * added out of alphabetical order. Optionally also checks a pull request's
  * title and description. The pull request workflow
- * (.github/workflows/spellcheck.yml) runs this on the lines a PR adds and
+ * (.github/workflows/check-spelling.yml) runs this on the lines a PR adds and
  * comments the findings; it never fails the PR.
  *
  * Usage: node dev/check-spelling.mjs --diff <file> [options]

From 9770113430bdde3c09abc222a37d513bbdb15a40 Mon Sep 17 00:00:00 2001
From: Marc LeBlanc <7050295+marcleblanc2@users.noreply.github.com>
Date: Fri, 30 Oct 2026 19:24:24 -0600
Subject: [PATCH 5/6] ci: Run the PR checks through one composite action and
 shared scripts

The five check workflows repeated the same checkout, diff, baseline, run,
and comment steps. .github/actions/pr-check now holds them once, and each
workflow sets only what differs. dev/check-shared.mjs holds the flag,
diff, file listing, baseline, and report code the five check scripts each
carried a copy of, and dev/report-check.sh replaces post-check-comment.sh
and sync-review-comments.sh. github-slugger is installed by the action
instead of by each workflow.

Amp-Thread-ID: https://ampcode.com/threads/T-01a18f4b-0163-7216-a915-372c4b6288cb
Co-authored-by: Amp <amp@ampcode.com>
---
 .github/actions/pr-check/action.yml    | 137 ++++++++++++++++++++++
 .github/workflows/check-duplicates.yml |  79 ++-----------
 .github/workflows/check-hostnames.yml  |  62 ++--------
 .github/workflows/check-links.yml      |  89 ++-------------
 .github/workflows/check-redirects.yml  |  89 ++-------------
 .github/workflows/check-spelling.yml   |  64 ++---------
 AGENTS.md                              |  21 ++--
 dev/check-duplicates.mjs               | 150 ++++++-------------------
 dev/check-hostnames.mjs                | 116 +++----------------
 dev/check-links.mjs                    | 105 ++---------------
 dev/check-redirects.mjs                |  97 ++++------------
 dev/check-shared.mjs                   | 135 ++++++++++++++++++++++
 dev/check-spelling.mjs                 | 111 ++++--------------
 dev/post-check-comment.sh              |  42 -------
 dev/report-check.sh                    |  88 +++++++++++++++
 dev/sync-review-comments.sh            |  40 -------
 dev/vercel-ignore-build.sh             |   4 +-
 17 files changed, 524 insertions(+), 905 deletions(-)
 create mode 100644 .github/actions/pr-check/action.yml
 create mode 100644 dev/check-shared.mjs
 delete mode 100755 dev/post-check-comment.sh
 create mode 100755 dev/report-check.sh
 delete mode 100755 dev/sync-review-comments.sh

diff --git a/.github/actions/pr-check/action.yml b/.github/actions/pr-check/action.yml
new file mode 100644
index 000000000..836192192
--- /dev/null
+++ b/.github/actions/pr-check/action.yml
@@ -0,0 +1,137 @@
+name: PR check
+description: >-
+    Runs one dev/check-<name>.mjs on the lines a pull request adds and reports
+    its findings on the PR: a summary comment plus a review comment on each
+    flagged line (dev/report-check.sh). The job must check out the repository
+    first, with fetch-depth 0; the default ref, the merge commit, is right.
+
+inputs:
+    script:
+        description: The check script, e.g. dev/check-links.mjs
+        required: true
+    name:
+        description: >-
+            Marks the comments the check posts, e.g. check-links; see
+            dev/report-check.sh
+        required: true
+    arguments:
+        description: Flags for every run of the script
+        default: ''
+    head-only-arguments:
+        description: >-
+            Flags for the run on the pull request only, not for recording the
+            baseline on the merge base
+        default: ''
+    diff-paths:
+        description: Paths the diff of the pull request is limited to; all by default
+        default: ''
+    baseline:
+        description: >-
+            Record the script's findings on the merge base too (--format json
+            --root) and pass them as --baseline, so only the findings this PR
+            introduces are reported
+        default: 'false'
+    dependency:
+        description: >-
+            An npm package the script imports, installed at the version in
+            package.json without the rest of the site's dependencies
+        default: ''
+    fail-on-findings:
+        description: Fail the job when the script reports findings; advisory otherwise
+        default: 'false'
+
+outputs:
+    result:
+        description: clean, found, or crashed
+        value: ${{ steps.check.outputs.result }}
+
+runs:
+    using: composite
+    steps:
+        # The workflow and this action are read from the merge commit, so run
+        # the scripts from there too: a branch that predates a check has no
+        # script for it, and the merge commit also has this PR's changes to
+        # them. Everything else is checked as the PR branch has it.
+        - name: Check out the pull request head, with the check scripts from the merge commit
+          shell: bash
+          env:
+              HEAD_SHA: ${{ github.event.pull_request.head.sha }}
+          run: |
+              git checkout --quiet "$HEAD_SHA"
+              git checkout --quiet "$GITHUB_SHA" -- dev
+
+        - name: Install ${{ inputs.dependency }}
+          if: inputs.dependency != ''
+          shell: bash
+          env:
+              DEPENDENCY: ${{ inputs.dependency }}
+          # Into a scratch prefix, not the repo: `npm install <pkg>` next to
+          # package.json would install every dependency of the site
+          run: |
+              npm install --prefix "$RUNNER_TEMP/deps" --no-package-lock --no-audit --no-fund \
+                  "$DEPENDENCY@$(node -p "require('./package.json').dependencies['$DEPENDENCY']")"
+              ln -s "$RUNNER_TEMP/deps/node_modules" node_modules
+
+        # The script exits 1 both with findings and when it crashes. It writes
+        # its output in one go at the end, so a crash leaves it empty. A crash
+        # does not fail the check, since it says nothing about the PR; the
+        # report step says so instead of posting the empty report.
+        - name: Run ${{ inputs.script }} on the lines this PR adds
+          id: check
+          shell: bash
+          env:
+              SCRIPT: ${{ inputs.script }}
+              ARGUMENTS: ${{ inputs.arguments }}
+              HEAD_ONLY_ARGUMENTS: ${{ inputs.head-only-arguments }}
+              DIFF_PATHS: ${{ inputs.diff-paths }}
+              BASELINE: ${{ inputs.baseline }}
+              BASE_SHA: ${{ github.event.pull_request.base.sha }}
+              # File links in the report open the file on the PR branch
+              LINK_BASE: ${{ github.event.pull_request.head.repo.html_url }}/blob/${{ github.event.pull_request.head.ref }}
+          run: |
+              # The arguments are lists, so they are left unquoted on purpose
+              # shellcheck disable=SC2086
+              merge_base=$(git merge-base "$BASE_SHA" HEAD)
+              git diff -U0 "$merge_base" HEAD -- $DIFF_PATHS > "$RUNNER_TEMP/changes.diff"
+
+              baseline_flag=
+              if [ "$BASELINE" = true ]; then
+                  git worktree add --quiet "$RUNNER_TEMP/base" "$merge_base"
+                  node "$SCRIPT" $ARGUMENTS --format json --root "$RUNNER_TEMP/base" > "$RUNNER_TEMP/baseline.json" || true
+                  if ! [ -s "$RUNNER_TEMP/baseline.json" ]; then
+                      echo "::warning::$SCRIPT crashed on the base branch, so this PR was not checked"
+                      echo "result=crashed" >> "$GITHUB_OUTPUT"
+                      exit 0
+                  fi
+                  baseline_flag="--baseline $RUNNER_TEMP/baseline.json"
+              fi
+
+              if node "$SCRIPT" $ARGUMENTS $HEAD_ONLY_ARGUMENTS --format markdown $baseline_flag \
+                  --diff "$RUNNER_TEMP/changes.diff" \
+                  --review "$RUNNER_TEMP/review.json" \
+                  --link-base "$LINK_BASE" > "$RUNNER_TEMP/report.md"; then
+                  echo "result=clean" >> "$GITHUB_OUTPUT"
+              elif [ -s "$RUNNER_TEMP/report.md" ]; then
+                  echo "result=found" >> "$GITHUB_OUTPUT"
+              else
+                  echo "::warning::$SCRIPT crashed, so this PR was not checked"
+                  echo "result=crashed" >> "$GITHUB_OUTPUT"
+              fi
+              cat "$RUNNER_TEMP/report.md"
+
+        - name: Report on the pull request
+          # Fork PRs get a read-only token; the report is still in the job log
+          if: github.event.pull_request.head.repo.full_name == github.repository
+          shell: bash
+          env:
+              GH_TOKEN: ${{ github.token }}
+              PR_NUMBER: ${{ github.event.pull_request.number }}
+              RUN_URL: ${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}
+              NAME: ${{ inputs.name }}
+              RESULT: ${{ steps.check.outputs.result }}
+          run: dev/report-check.sh "$NAME" "$RESULT" "$RUNNER_TEMP/report.md" "$RUNNER_TEMP/review.json"
+
+        - name: Fail when this PR introduces findings
+          if: inputs.fail-on-findings == 'true' && steps.check.outputs.result == 'found'
+          shell: bash
+          run: exit 1
diff --git a/.github/workflows/check-duplicates.yml b/.github/workflows/check-duplicates.yml
index 6006b6514..8fcf36eec 100644
--- a/.github/workflows/check-duplicates.yml
+++ b/.github/workflows/check-duplicates.yml
@@ -10,8 +10,9 @@ on:
         paths:
             - 'docs/**'
             - 'dev/check-duplicates.mjs'
-            - 'dev/post-check-comment.sh'
-            - 'dev/sync-review-comments.sh'
+            - 'dev/check-shared.mjs'
+            - 'dev/report-check.sh'
+            - '.github/actions/pr-check/action.yml'
             - '.github/workflows/check-duplicates.yml'
 
 # A new push supersedes the run for the previous one
@@ -27,74 +28,14 @@ jobs:
     check-duplicates:
         name: Duplicated content introduced by this PR (advisory)
         runs-on: ubuntu-latest
-        env:
-            GH_TOKEN: ${{ github.token }}
-            PR_NUMBER: ${{ github.event.pull_request.number }}
-            BASE_SHA: ${{ github.event.pull_request.base.sha }}
-            # File links in the report open the file on the PR branch
-            LINK_BASE: ${{ github.event.pull_request.head.repo.html_url }}/blob/${{ github.event.pull_request.head.ref }}
-            RUN_URL: ${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}
         steps:
-            - name: Check out pull request head
-              uses: actions/checkout@v7
+            - uses: actions/checkout@v7
               with:
-                  ref: ${{ github.event.pull_request.head.sha }}
                   fetch-depth: 0
 
-            # The workflow file is read from the merge commit, so run the scripts
-            # from there too: a branch that predates a check has no script for it,
-            # and the merge commit also has this PR's changes to them
-            - name: Check out the check scripts from the merge commit
-              run: git fetch --quiet origin "$GITHUB_SHA" && git checkout --quiet "$GITHUB_SHA" -- dev
-
-            - name: Check out merge base
-              run: |
-                  merge_base=$(git merge-base "$BASE_SHA" HEAD)
-                  git worktree add "$RUNNER_TEMP/base" "$merge_base"
-                  git diff -U0 "$merge_base" HEAD -- docs > "$RUNNER_TEMP/changes.diff"
-
-            # The script exits 1 both with findings and when it crashes. It writes
-            # its output in one go at the end, so a crash leaves it empty. A crash
-            # does not fail the check, since it says nothing about the PR; the
-            # comment step reports it instead of posting the empty report.
-            - name: Record duplicated passages already present on the base branch
-              run: |
-                  node dev/check-duplicates.mjs --format json \
-                      --root "$RUNNER_TEMP/base" > "$RUNNER_TEMP/base-duplicates.json" || true
-
-            - name: Find duplicated passages introduced by this PR
-              id: check
-              run: |
-                  if ! [ -s "$RUNNER_TEMP/base-duplicates.json" ]; then
-                      echo "::warning::check-duplicates crashed on the base branch, so this PR was not checked"
-                      echo "result=crashed" >> "$GITHUB_OUTPUT"
-                      exit 0
-                  fi
-                  if node dev/check-duplicates.mjs --format markdown \
-                      --baseline "$RUNNER_TEMP/base-duplicates.json" \
-                      --diff "$RUNNER_TEMP/changes.diff" \
-                      --review "$RUNNER_TEMP/review.json" \
-                      --link-base "$LINK_BASE" > "$RUNNER_TEMP/report.md"; then
-                      echo "result=clean" >> "$GITHUB_OUTPUT"
-                  elif [ -s "$RUNNER_TEMP/report.md" ]; then
-                      echo "result=found" >> "$GITHUB_OUTPUT"
-                  else
-                      echo "::warning::check-duplicates crashed, so this PR was not checked"
-                      echo "result=crashed" >> "$GITHUB_OUTPUT"
-                  fi
-                  cat "$RUNNER_TEMP/report.md"
-
-            - name: Comment on the pull request
-              # Fork PRs get a read-only token; the report is still in the job log
-              if: github.event.pull_request.head.repo.full_name == github.repository
-              env:
-                  RESULT: ${{ steps.check.outputs.result }}
-              run: dev/post-check-comment.sh '<!-- check-duplicates-report -->' "$RESULT" "$RUNNER_TEMP/report.md"
-
-            - name: Point out the duplicates as review comments
-              # One comment per added passage, kept in sync with the findings;
-              # see dev/sync-review-comments.sh
-              if: >-
-                  github.event.pull_request.head.repo.full_name == github.repository
-                  && contains(fromJSON('["clean", "found"]'), steps.check.outputs.result)
-              run: dev/sync-review-comments.sh '<!-- check-duplicates-finding:' "$RUNNER_TEMP/review.json"
+            - uses: ./.github/actions/pr-check
+              with:
+                  script: dev/check-duplicates.mjs
+                  name: check-duplicates
+                  diff-paths: docs
+                  baseline: true
diff --git a/.github/workflows/check-hostnames.yml b/.github/workflows/check-hostnames.yml
index 81cb7f5d2..9a5e932c6 100644
--- a/.github/workflows/check-hostnames.yml
+++ b/.github/workflows/check-hostnames.yml
@@ -9,9 +9,10 @@ on:
         paths:
             - 'docs/**'
             - 'dev/check-hostnames.mjs'
+            - 'dev/check-shared.mjs'
             - 'dev/example-hostnames.json'
-            - 'dev/post-check-comment.sh'
-            - 'dev/sync-review-comments.sh'
+            - 'dev/report-check.sh'
+            - '.github/actions/pr-check/action.yml'
             - '.github/workflows/check-hostnames.yml'
 
 # A new push supersedes the run for the previous one
@@ -27,58 +28,13 @@ jobs:
     check-hostnames:
         name: Placeholder hostnames introduced by this PR (advisory)
         runs-on: ubuntu-latest
-        env:
-            GH_TOKEN: ${{ github.token }}
-            PR_NUMBER: ${{ github.event.pull_request.number }}
-            BASE_SHA: ${{ github.event.pull_request.base.sha }}
-            # File links in the report open the file on the PR branch
-            LINK_BASE: ${{ github.event.pull_request.head.repo.html_url }}/blob/${{ github.event.pull_request.head.ref }}
-            RUN_URL: ${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}
         steps:
-            - name: Check out pull request head
-              uses: actions/checkout@v7
+            - uses: actions/checkout@v7
               with:
-                  ref: ${{ github.event.pull_request.head.sha }}
                   fetch-depth: 0
 
-            # The workflow file is read from the merge commit, so run the scripts
-            # from there too: a branch that predates a check has no script for it,
-            # and the merge commit also has this PR's changes to them
-            - name: Check out the check scripts from the merge commit
-              run: git fetch --quiet origin "$GITHUB_SHA" && git checkout --quiet "$GITHUB_SHA" -- dev
-
-            - name: Find placeholder hostnames added by this PR
-              id: check
-              # The script exits 1 both with findings and when it crashes. It writes
-              # its output in one go at the end, so a crash leaves it empty. A crash
-              # does not fail the check, since it says nothing about the PR; the
-              # comment step reports it instead of posting the empty report.
-              run: |
-                  git diff -U0 "$(git merge-base "$BASE_SHA" HEAD)" HEAD -- docs > "$RUNNER_TEMP/changes.diff"
-                  if node dev/check-hostnames.mjs --format markdown \
-                      --diff "$RUNNER_TEMP/changes.diff" \
-                      --review "$RUNNER_TEMP/review.json" \
-                      --link-base "$LINK_BASE" > "$RUNNER_TEMP/report.md"; then
-                      echo "result=clean" >> "$GITHUB_OUTPUT"
-                  elif [ -s "$RUNNER_TEMP/report.md" ]; then
-                      echo "result=found" >> "$GITHUB_OUTPUT"
-                  else
-                      echo "::warning::check-hostnames crashed, so this PR was not checked"
-                      echo "result=crashed" >> "$GITHUB_OUTPUT"
-                  fi
-                  cat "$RUNNER_TEMP/report.md"
-
-            - name: Comment on the pull request
-              # Fork PRs get a read-only token; the report is still in the job log
-              if: github.event.pull_request.head.repo.full_name == github.repository
-              env:
-                  RESULT: ${{ steps.check.outputs.result }}
-              run: dev/post-check-comment.sh '<!-- check-hostnames-report -->' "$RESULT" "$RUNNER_TEMP/report.md"
-
-            - name: Suggest fixes as review comments
-              # One suggested change per flagged line, kept in sync with the
-              # findings; see dev/sync-review-comments.sh
-              if: >-
-                  github.event.pull_request.head.repo.full_name == github.repository
-                  && contains(fromJSON('["clean", "found"]'), steps.check.outputs.result)
-              run: dev/sync-review-comments.sh '<!-- check-hostnames-finding:' "$RUNNER_TEMP/review.json"
+            - uses: ./.github/actions/pr-check
+              with:
+                  script: dev/check-hostnames.mjs
+                  name: check-hostnames
+                  diff-paths: docs
diff --git a/.github/workflows/check-links.yml b/.github/workflows/check-links.yml
index 3634223a5..2893f29de 100644
--- a/.github/workflows/check-links.yml
+++ b/.github/workflows/check-links.yml
@@ -22,86 +22,17 @@ jobs:
     check-links:
         name: Broken links introduced by this PR
         runs-on: ubuntu-latest
-        env:
-            GH_TOKEN: ${{ github.token }}
-            PR_NUMBER: ${{ github.event.pull_request.number }}
-            BASE_SHA: ${{ github.event.pull_request.base.sha }}
-            # File links in the report open the file on the PR branch
-            LINK_BASE: ${{ github.event.pull_request.head.repo.html_url }}/blob/${{ github.event.pull_request.head.ref }}
-            RUN_URL: ${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}
         steps:
-            - name: Check out pull request head
-              uses: actions/checkout@v7
+            - uses: actions/checkout@v7
               with:
-                  ref: ${{ github.event.pull_request.head.sha }}
                   fetch-depth: 0
 
-            # The workflow file is read from the merge commit, so run the scripts
-            # from there too: a branch that predates a check has no script for it,
-            # and the merge commit also has this PR's changes to them
-            - name: Check out the check scripts from the merge commit
-              run: git fetch --quiet origin "$GITHUB_SHA" && git checkout --quiet "$GITHUB_SHA" -- dev
-
-            - name: Install github-slugger, the only dependency of dev/check-links.mjs
-              # Into a scratch prefix, not the repo: `npm install <pkg>` next to
-              # package.json would install every dependency of the site
-              run: |
-                  npm install --prefix "$RUNNER_TEMP/deps" --no-package-lock --no-audit --no-fund \
-                      "github-slugger@$(node -p 'require("./package.json").dependencies["github-slugger"]')"
-                  ln -s "$RUNNER_TEMP/deps/node_modules" node_modules
-
-            - name: Check out merge base
-              run: |
-                  merge_base=$(git merge-base "$BASE_SHA" HEAD)
-                  git worktree add "$RUNNER_TEMP/base" "$merge_base"
-                  git diff -U0 "$merge_base" HEAD > "$RUNNER_TEMP/changes.diff"
-
-            # The script exits 1 both with findings and when it crashes. It writes
-            # its output in one go at the end, so a crash leaves it empty. A crash
-            # does not fail the check, since it says nothing about the PR; the
-            # comment step reports it instead of posting the empty report.
-            - name: Record broken links already present on the base branch
-              run: |
-                  node dev/check-links.mjs --check-anchors --check-self-links --format json \
-                      --root "$RUNNER_TEMP/base" > "$RUNNER_TEMP/base-links.json" || true
-
-            - name: Find broken links introduced by this PR
-              id: check
-              run: |
-                  if ! [ -s "$RUNNER_TEMP/base-links.json" ]; then
-                      echo "::warning::check-links crashed on the base branch, so this PR was not checked"
-                      echo "result=crashed" >> "$GITHUB_OUTPUT"
-                      exit 0
-                  fi
-                  if node dev/check-links.mjs --check-anchors --check-self-links --check-external --format markdown \
-                      --baseline "$RUNNER_TEMP/base-links.json" \
-                      --diff "$RUNNER_TEMP/changes.diff" \
-                      --review "$RUNNER_TEMP/review.json" \
-                      --link-base "$LINK_BASE" > "$RUNNER_TEMP/report.md"; then
-                      echo "result=clean" >> "$GITHUB_OUTPUT"
-                  elif [ -s "$RUNNER_TEMP/report.md" ]; then
-                      echo "result=found" >> "$GITHUB_OUTPUT"
-                  else
-                      echo "::warning::check-links crashed, so this PR was not checked"
-                      echo "result=crashed" >> "$GITHUB_OUTPUT"
-                  fi
-                  cat "$RUNNER_TEMP/report.md"
-
-            - name: Comment on the pull request
-              # Fork PRs get a read-only token; the report is still in the job log
-              if: github.event.pull_request.head.repo.full_name == github.repository
-              env:
-                  RESULT: ${{ steps.check.outputs.result }}
-              run: dev/post-check-comment.sh '<!-- check-links-report -->' "$RESULT" "$RUNNER_TEMP/report.md"
-
-            - name: Suggest fixes as review comments
-              # One suggested change per finding with a fix, kept in sync with the
-              # findings; see dev/sync-review-comments.sh
-              if: >-
-                  github.event.pull_request.head.repo.full_name == github.repository
-                  && contains(fromJSON('["clean", "found"]'), steps.check.outputs.result)
-              run: dev/sync-review-comments.sh '<!-- check-links-finding:' "$RUNNER_TEMP/review.json"
-
-            - name: Fail when this PR introduces broken links
-              if: steps.check.outputs.result == 'found'
-              run: exit 1
+            - uses: ./.github/actions/pr-check
+              with:
+                  script: dev/check-links.mjs
+                  name: check-links
+                  arguments: --check-anchors --check-self-links
+                  head-only-arguments: --check-external
+                  baseline: true
+                  dependency: github-slugger
+                  fail-on-findings: true
diff --git a/.github/workflows/check-redirects.yml b/.github/workflows/check-redirects.yml
index 192c2e907..a80b75b0b 100644
--- a/.github/workflows/check-redirects.yml
+++ b/.github/workflows/check-redirects.yml
@@ -22,87 +22,16 @@ jobs:
     check-redirects:
         name: Broken redirects introduced by this PR
         runs-on: ubuntu-latest
-        env:
-            GH_TOKEN: ${{ github.token }}
-            PR_NUMBER: ${{ github.event.pull_request.number }}
-            BASE_SHA: ${{ github.event.pull_request.base.sha }}
-            # Line links in the report open redirects.ts on the PR branch
-            LINK_BASE: ${{ github.event.pull_request.head.repo.html_url }}/blob/${{ github.event.pull_request.head.ref }}
-            RUN_URL: ${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}
         steps:
-            - name: Check out pull request head
-              uses: actions/checkout@v7
+            - uses: actions/checkout@v7
               with:
-                  ref: ${{ github.event.pull_request.head.sha }}
                   fetch-depth: 0
 
-            # The workflow file is read from the merge commit, so run the scripts
-            # from there too: a branch that predates a check has no script for it,
-            # and the merge commit also has this PR's changes to them
-            - name: Check out the check scripts from the merge commit
-              run: git fetch --quiet origin "$GITHUB_SHA" && git checkout --quiet "$GITHUB_SHA" -- dev
-
-            - name: Install github-slugger, the only dependency of dev/check-redirects.mjs
-              # Into a scratch prefix, not the repo: `npm install <pkg>` next to
-              # package.json would install every dependency of the site
-              run: |
-                  npm install --prefix "$RUNNER_TEMP/deps" --no-package-lock --no-audit --no-fund \
-                      "github-slugger@$(node -p 'require("./package.json").dependencies["github-slugger"]')"
-                  ln -s "$RUNNER_TEMP/deps/node_modules" node_modules
-
-            - name: Check out merge base
-              run: |
-                  merge_base=$(git merge-base "$BASE_SHA" HEAD)
-                  git worktree add "$RUNNER_TEMP/base" "$merge_base"
-                  git diff -U0 "$merge_base" HEAD -- src/data/redirects.ts > "$RUNNER_TEMP/changes.diff"
-
-            # The script exits 1 both with findings and when it crashes, e.g. because
-            # this PR's copy of it cannot read the base branch's redirects.ts. It
-            # writes its output in one go at the end, so a crash leaves it empty.
-            # A crash does not fail the check, since it says nothing about the PR;
-            # the comment step reports it instead of posting the empty report.
-            - name: Record broken redirects already present on the base branch
-              run: |
-                  node dev/check-redirects.mjs --format json \
-                      --root "$RUNNER_TEMP/base" > "$RUNNER_TEMP/base-redirects.json" || true
-
-            - name: Find redirects broken by this PR
-              id: check
-              run: |
-                  if ! [ -s "$RUNNER_TEMP/base-redirects.json" ]; then
-                      echo "::warning::check-redirects crashed on the base branch, so this PR was not checked"
-                      echo "result=crashed" >> "$GITHUB_OUTPUT"
-                      exit 0
-                  fi
-                  if node dev/check-redirects.mjs --format markdown \
-                      --baseline "$RUNNER_TEMP/base-redirects.json" \
-                      --diff "$RUNNER_TEMP/changes.diff" \
-                      --review "$RUNNER_TEMP/review.json" \
-                      --link-base "$LINK_BASE" > "$RUNNER_TEMP/report.md"; then
-                      echo "result=clean" >> "$GITHUB_OUTPUT"
-                  elif [ -s "$RUNNER_TEMP/report.md" ]; then
-                      echo "result=found" >> "$GITHUB_OUTPUT"
-                  else
-                      echo "::warning::check-redirects crashed, so this PR was not checked"
-                      echo "result=crashed" >> "$GITHUB_OUTPUT"
-                  fi
-                  cat "$RUNNER_TEMP/report.md"
-
-            - name: Comment on the pull request
-              # Fork PRs get a read-only token; the report is still in the job log
-              if: github.event.pull_request.head.repo.full_name == github.repository
-              env:
-                  RESULT: ${{ steps.check.outputs.result }}
-              run: dev/post-check-comment.sh '<!-- check-redirects-report -->' "$RESULT" "$RUNNER_TEMP/report.md"
-
-            - name: Suggest fixes as review comments
-              # One suggested change per fixable entry this PR added, kept in sync
-              # with the findings; see dev/sync-review-comments.sh
-              if: >-
-                  github.event.pull_request.head.repo.full_name == github.repository
-                  && contains(fromJSON('["clean", "found"]'), steps.check.outputs.result)
-              run: dev/sync-review-comments.sh '<!-- check-redirects-finding:' "$RUNNER_TEMP/review.json"
-
-            - name: Fail when this PR breaks redirects
-              if: steps.check.outputs.result == 'found'
-              run: exit 1
+            - uses: ./.github/actions/pr-check
+              with:
+                  script: dev/check-redirects.mjs
+                  name: check-redirects
+                  diff-paths: src/data/redirects.ts
+                  baseline: true
+                  dependency: github-slugger
+                  fail-on-findings: true
diff --git a/.github/workflows/check-spelling.yml b/.github/workflows/check-spelling.yml
index 3a0f1f363..2f626cce6 100644
--- a/.github/workflows/check-spelling.yml
+++ b/.github/workflows/check-spelling.yml
@@ -24,26 +24,11 @@ jobs:
     spellcheck:
         name: Spelling errors introduced by this PR (advisory)
         runs-on: ubuntu-latest
-        env:
-            GH_TOKEN: ${{ github.token }}
-            PR_NUMBER: ${{ github.event.pull_request.number }}
-            BASE_SHA: ${{ github.event.pull_request.base.sha }}
-            # File links in the report open the file on the PR branch
-            LINK_BASE: ${{ github.event.pull_request.head.repo.html_url }}/blob/${{ github.event.pull_request.head.ref }}
-            RUN_URL: ${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}
         steps:
-            - name: Check out pull request head
-              uses: actions/checkout@v7
+            - uses: actions/checkout@v7
               with:
-                  ref: ${{ github.event.pull_request.head.sha }}
                   fetch-depth: 0
 
-            # The workflow file is read from the merge commit, so run the scripts
-            # from there too: a branch that predates a check has no script for it,
-            # and the merge commit also has this PR's changes to them
-            - name: Check out the check scripts from the merge commit
-              run: git fetch --quiet origin "$GITHUB_SHA" && git checkout --quiet "$GITHUB_SHA" -- dev
-
             # Node 24 is pre-cached on ubuntu-latest, avoiding the download
             # incurred by node-version: latest.
             - name: Set up Node.js
@@ -55,45 +40,16 @@ jobs:
             - name: Install CSpell
               run: npm install --global cspell@10
 
-            - name: Find spelling errors introduced by this PR
-              id: check
-              # Title and description come in through env, never inline in the
-              # script, so a crafted pull request cannot inject shell commands
+            - name: Write the pull request title and description to a file
+              # They come in through env, never inline in the script, so a
+              # crafted pull request cannot inject shell commands
               env:
                   PR_TITLE: ${{ github.event.pull_request.title }}
                   PR_BODY: ${{ github.event.pull_request.body }}
-              # The script exits 1 both with findings and when it crashes. It writes
-              # its output in one go at the end, so a crash leaves it empty. A crash
-              # does not fail the check, since it says nothing about the PR; the
-              # comment step reports it instead of posting the empty report.
-              run: |
-                  git diff -U0 "$(git merge-base "$BASE_SHA" HEAD)" HEAD > "$RUNNER_TEMP/changes.diff"
-                  printf '%s\n\n%s\n' "$PR_TITLE" "$PR_BODY" > "$RUNNER_TEMP/pull-request.md"
-                  if node dev/check-spelling.mjs --format markdown \
-                      --diff "$RUNNER_TEMP/changes.diff" \
-                      --pull-request "$RUNNER_TEMP/pull-request.md" \
-                      --review "$RUNNER_TEMP/review.json" \
-                      --link-base "$LINK_BASE" > "$RUNNER_TEMP/report.md"; then
-                      echo "result=clean" >> "$GITHUB_OUTPUT"
-                  elif [ -s "$RUNNER_TEMP/report.md" ]; then
-                      echo "result=found" >> "$GITHUB_OUTPUT"
-                  else
-                      echo "::warning::check-spelling crashed, so this PR was not checked"
-                      echo "result=crashed" >> "$GITHUB_OUTPUT"
-                  fi
-                  cat "$RUNNER_TEMP/report.md"
-
-            - name: Comment on the pull request
-              # Fork PRs get a read-only token; the report is still in the job log
-              if: github.event.pull_request.head.repo.full_name == github.repository
-              env:
-                  RESULT: ${{ steps.check.outputs.result }}
-              run: dev/post-check-comment.sh '<!-- cspell-report -->' "$RESULT" "$RUNNER_TEMP/report.md"
+              run: printf '%s\n\n%s\n' "$PR_TITLE" "$PR_BODY" > "$RUNNER_TEMP/pull-request.md"
 
-            - name: Suggest fixes as review comments
-              # One suggested change per flagged line, kept in sync with the
-              # findings; see dev/sync-review-comments.sh
-              if: >-
-                  github.event.pull_request.head.repo.full_name == github.repository
-                  && contains(fromJSON('["clean", "found"]'), steps.check.outputs.result)
-              run: dev/sync-review-comments.sh '<!-- cspell-finding:' "$RUNNER_TEMP/review.json"
+            - uses: ./.github/actions/pr-check
+              with:
+                  script: dev/check-spelling.mjs
+                  name: cspell
+                  head-only-arguments: --pull-request ${{ runner.temp }}/pull-request.md
diff --git a/AGENTS.md b/AGENTS.md
index cb51a4116..1a43c489a 100644
--- a/AGENTS.md
+++ b/AGENTS.md
@@ -153,14 +153,19 @@ Fork PRs get no comments; the findings are in the job log
 next run: the summary is minimized and the inline comments are deleted. A PR
 that never had findings never gets a comment.
 
-The five check workflows share one shape, so keep them in step:
-`dev/check-<name>.mjs` writes a Markdown report and a review JSON for the
-lines a PR adds, exits 1 with findings, and leaves the report empty when it
-crashes; the workflow turns that into `result=clean|found|crashed`,
-`dev/post-check-comment.sh` posts the summary, and
-`dev/sync-review-comments.sh` posts the inline comments. The scripts run from
-the merge commit, like the workflow file itself, so a branch that predates a
-check still gets checked.
+The five check workflows are one `actions/checkout` step plus
+`.github/actions/pr-check`, which runs `dev/check-<name>.mjs` and comments.
+A check script parses its flags and the diff, lists files, drops baseline
+findings, and formats the report with `dev/check-shared.mjs`; it writes a
+Markdown report and a review JSON for the lines a PR adds, exits 1 with
+findings, and leaves the report empty when it crashes. The action turns that
+into `result=clean|found|crashed` and `dev/report-check.sh` posts the summary
+and the inline comments. The action and scripts run from the merge commit,
+like the workflow file itself, so a branch that predates a check still gets
+checked. Each workflow sets only what differs: the script, the comment
+marker, extra arguments, which paths to diff, whether to compare against a
+baseline of the base branch, an npm dependency to install, and whether
+findings fail the check.
 
 ### Vercel build failures
 
diff --git a/dev/check-duplicates.mjs b/dev/check-duplicates.mjs
index e6d56e714..a91bed8b2 100644
--- a/dev/check-duplicates.mjs
+++ b/dev/check-duplicates.mjs
@@ -41,20 +41,23 @@
 import fs from 'fs';
 import path from 'path';
 import {fileURLToPath} from 'url';
+import {
+	fileUrl,
+	flagValue,
+	linkTo,
+	listDocsFiles,
+	parseDiff,
+	report
+} from './check-shared.mjs';
 
-const args = process.argv.slice(2);
 const ROOT_DIR = path.resolve(
 	flagValue('--root') ??
 		path.dirname(path.dirname(fileURLToPath(import.meta.url)))
 );
-const DOCS_DIR = path.join(ROOT_DIR, 'docs');
 const THRESHOLD = Number(flagValue('--threshold') ?? 0.5);
 const MIN_WORDS = Number(flagValue('--min-words') ?? 20);
-const FORMAT = flagValue('--format') ?? 'text';
 const BASELINE_FILE = flagValue('--baseline');
 const DIFF = parseDiff(flagValue('--diff'));
-const LINK_BASE = flagValue('--link-base')?.replace(/\/$/, '');
-const REVIEW_FILE = flagValue('--review');
 
 // Pages the `🤖 Sync generated docs` PRs overwrite whole (see AGENTS.md); their
 // repetition is the generator's, and is fixed in sourcegraph/sourcegraph
@@ -73,56 +76,15 @@ const SHINGLE_SIZE = 3;
 const MAX_POSTINGS = 50;
 const SNIPPET_LENGTH = 90;
 
-if (REVIEW_FILE && !DIFF) {
+if (flagValue('--review') && !DIFF) {
 	throw new Error('--review needs --diff, to know which lines were added');
 }
 
-function flagValue(name) {
-	const index = args.indexOf(name);
-	return index === -1 ? undefined : args[index + 1];
-}
-
-// Added lines of a unified diff, by path relative to the repository:
-// Map<'docs/foo.mdx', Set<lineNumber>>
-function parseDiff(file) {
-	if (!file) return undefined;
-	const addedLines = new Map();
-	let currentFile;
-	let lineNumber;
-	for (const line of fs.readFileSync(file, 'utf-8').split('\n')) {
-		if (line.startsWith('diff --git ')) {
-			currentFile = undefined;
-		} else if (line.startsWith('+++ ') && !currentFile) {
-			// `+++ /dev/null` is a deleted file, which has no added lines
-			currentFile = line.slice(4).replace(/^b\//, '');
-			if (currentFile === '/dev/null') continue;
-			addedLines.set(currentFile, new Set());
-		} else if (line.startsWith('@@ ')) {
-			lineNumber = Number(line.match(/^@@ -\S+ \+(\d+)/)[1]);
-		} else if (line.startsWith('+') && currentFile) {
-			addedLines.get(currentFile).add(lineNumber++);
-		} else if (line.startsWith(' ')) {
-			lineNumber++;
-		}
-	}
-	return addedLines;
-}
-
-// Sorted relative paths of the .md and .mdx files under docs/ that are
-// written by hand
-function listDocsFiles(dir = DOCS_DIR) {
-	return fs
-		.readdirSync(dir, {withFileTypes: true})
-		.sort((a, b) => a.name.localeCompare(b.name))
-		.flatMap(entry => {
-			const full = path.join(dir, entry.name);
-			if (entry.isDirectory()) return listDocsFiles(full);
-			const file = path.relative(ROOT_DIR, full);
-			return /\.mdx?$/.test(entry.name) &&
-				!GENERATED_PAGES.some(prefix => file.startsWith(prefix))
-				? [file]
-				: [];
-		});
+// The .md and .mdx files under docs/ that are written by hand
+function handWrittenDocsFiles() {
+	return listDocsFiles(ROOT_DIR).filter(
+		file => !GENERATED_PAGES.some(prefix => file.startsWith(prefix))
+	);
 }
 
 // The words of a passage, lowercased, without Markdown, JSX, MDX comments,
@@ -410,19 +372,11 @@ function formatText(pairs) {
 	return lines.join('\n') + '\n';
 }
 
-function linkTo(text, url) {
-	return url ? `[${text}](${url})` : text;
-}
-
-// ?plain=1 opens GitHub's code view, where #L<n> anchors work; the rendered
-// Markdown preview ignores them
 function passageLink(passage) {
 	const {file, line, endLine} = passage;
 	const anchor = endLine > line ? `#L${line}-L${endLine}` : `#L${line}`;
-	return linkTo(
-		`\`${location(passage)}\``,
-		LINK_BASE && `${LINK_BASE}/${file}?plain=1${anchor}`
-	);
+	const url = fileUrl(file);
+	return linkTo(`\`${location(passage)}\``, url && url + anchor);
 }
 
 const CONVENTION =
@@ -526,58 +480,22 @@ function reviewRequest(pairs) {
 	return {event: 'COMMENT', body: '', comments};
 }
 
-const FORMATTERS = {
-	text: formatText,
-	json: pairs =>
-		JSON.stringify(
-			pairs.map(({similarity, a, b}) => ({
-				similarity,
-				a: describe(a),
-				b: describe(b)
-			})),
-			null,
-			'\t'
-		) + '\n',
-	markdown: formatMarkdown
-};
-
-function main() {
-	const format = FORMATTERS[FORMAT];
-	if (!format) {
-		throw new Error(
-			`Unknown --format "${FORMAT}"; use text, json, or markdown`
-		);
-	}
-
-	const passages = listDocsFiles().flatMap(file =>
-		extractPassages(
-			file,
-			fs.readFileSync(path.join(ROOT_DIR, file), 'utf-8')
-		)
-	);
-	let pairs = findDuplicatePairs(passages);
-	if (BASELINE_FILE) {
-		pairs = markPreexisting(pairs, BASELINE_FILE);
-	}
-	// With a diff, a pre-existing pair the change edited is still reported, so
-	// the author hears about the other copy; without one, nothing says which
-	// pre-existing pairs matter, so they are all left out
-	pairs = DIFF
-		? pairs.filter(
-				({a, b}) =>
-					addedLineIn(a) !== undefined || addedLineIn(b) !== undefined
-			)
-		: pairs.filter(pair => !pair.preexisting);
-	if (REVIEW_FILE) {
-		fs.writeFileSync(
-			REVIEW_FILE,
-			JSON.stringify(reviewRequest(pairs), null, '\t') + '\n'
-		);
-	}
-
-	// Not process.exit(): that can truncate stdout when it is a pipe
-	process.stdout.write(format(pairs));
-	process.exitCode = pairs.length === 0 ? 0 : 1;
+const passages = handWrittenDocsFiles().flatMap(file =>
+	extractPassages(file, fs.readFileSync(path.join(ROOT_DIR, file), 'utf-8'))
+);
+let pairs = findDuplicatePairs(passages);
+if (BASELINE_FILE) {
+	pairs = markPreexisting(pairs, BASELINE_FILE);
 }
-
-main();
+// With a diff, a pre-existing pair the change edited is still reported, so
+// the author hears about the other copy; without one, nothing says which
+// pre-existing pairs matter, so they are all left out
+pairs = DIFF
+	? pairs.filter(
+			({a, b}) =>
+				addedLineIn(a) !== undefined || addedLineIn(b) !== undefined
+		)
+	: pairs.filter(pair => !pair.preexisting);
+report(pairs, {text: formatText, markdown: formatMarkdown}, () =>
+	reviewRequest(pairs)
+);
diff --git a/dev/check-hostnames.mjs b/dev/check-hostnames.mjs
index 2f7e8a043..02fa41840 100644
--- a/dev/check-hostnames.mjs
+++ b/dev/check-hostnames.mjs
@@ -38,52 +38,25 @@
 import fs from 'fs';
 import path from 'path';
 import {fileURLToPath} from 'url';
+import {
+	fileUrl,
+	flagValue,
+	groupByFile,
+	linkTo,
+	listDocsFiles,
+	parseDiff,
+	report
+} from './check-shared.mjs';
 
 const ROOT_DIR = path.dirname(path.dirname(fileURLToPath(import.meta.url)));
-const DOCS_DIR = path.join(ROOT_DIR, 'docs');
 const MAPPING_FILE = 'dev/example-hostnames.json';
 
-const args = process.argv.slice(2);
 const DIFF = parseDiff(flagValue('--diff'));
-const FORMAT = flagValue('--format') ?? 'text';
-const LINK_BASE = flagValue('--link-base')?.replace(/\/$/, '');
-const REVIEW_FILE = flagValue('--review');
 
-if (REVIEW_FILE && !DIFF) {
+if (flagValue('--review') && !DIFF) {
 	throw new Error('--review needs --diff, to know which lines were added');
 }
 
-function flagValue(name) {
-	const index = args.indexOf(name);
-	return index === -1 ? undefined : args[index + 1];
-}
-
-// Added lines of a unified diff, by path relative to the repository:
-// Map<'docs/foo.mdx', Set<lineNumber>>
-function parseDiff(file) {
-	if (!file) return undefined;
-	const addedLines = new Map();
-	let currentFile;
-	let lineNumber;
-	for (const line of fs.readFileSync(file, 'utf-8').split('\n')) {
-		if (line.startsWith('diff --git ')) {
-			currentFile = undefined;
-		} else if (line.startsWith('+++ ') && !currentFile) {
-			// `+++ /dev/null` is a deleted file, which has no added lines
-			currentFile = line.slice(4).replace(/^b\//, '');
-			if (currentFile === '/dev/null') continue;
-			addedLines.set(currentFile, new Set());
-		} else if (line.startsWith('@@ ')) {
-			lineNumber = Number(line.match(/^@@ -\S+ \+(\d+)/)[1]);
-		} else if (line.startsWith('+') && currentFile) {
-			addedLines.get(currentFile).add(lineNumber++);
-		} else if (line.startsWith(' ')) {
-			lineNumber++;
-		}
-	}
-	return addedLines;
-}
-
 // In a literal or glob entry, each separator matches any separator. Space is
 // not one: `YOUR-SOURCEGRAPH-INSTANCE` must not match the prose "your
 // Sourcegraph instance"
@@ -175,20 +148,6 @@ function checkLine(file, line, text) {
 	return {findings, fixed: fixed + text.slice(end)};
 }
 
-// Sorted relative paths of the .md and .mdx files under docs/
-function listDocsFiles(dir = DOCS_DIR) {
-	return fs
-		.readdirSync(dir, {withFileTypes: true})
-		.sort((a, b) => a.name.localeCompare(b.name))
-		.flatMap(entry => {
-			const full = path.join(dir, entry.name);
-			if (entry.isDirectory()) return listDocsFiles(full);
-			return /\.mdx?$/.test(entry.name)
-				? [path.relative(ROOT_DIR, full)]
-				: [];
-		});
-}
-
 // Every finding in the checked files, and the fixed text of each flagged line
 // ({file, line} → fixed), for the review
 function findPlaceholders() {
@@ -196,7 +155,7 @@ function findPlaceholders() {
 		? [...DIFF.keys()].filter(
 				file => file.startsWith('docs/') && /\.mdx?$/.test(file)
 			)
-		: listDocsFiles();
+		: listDocsFiles(ROOT_DIR);
 	const findings = [];
 	const fixedLines = new Map();
 	for (const file of files) {
@@ -220,17 +179,6 @@ function findPlaceholders() {
 	return {findings, fixedLines};
 }
 
-function groupByFile(findings) {
-	const byFile = new Map();
-	for (const finding of findings) {
-		if (!byFile.has(finding.file)) {
-			byFile.set(finding.file, []);
-		}
-		byFile.get(finding.file).push(finding);
-	}
-	return byFile;
-}
-
 function formatText(findings) {
 	if (findings.length === 0) {
 		return 'No issues found.\n';
@@ -244,10 +192,6 @@ function formatText(findings) {
 	return lines.join('\n') + '\n';
 }
 
-function linkTo(text, url) {
-	return url ? `[${text}](${url})` : text;
-}
-
 const CONVENTION =
 	'Docs use `*.example.com` hostnames as placeholders (`sourcegraph.example.com` ' +
 	'for the reader’s Sourcegraph instance, `github.example.com` for a code host, ' +
@@ -268,13 +212,11 @@ function formatMarkdown(findings) {
 		''
 	];
 	for (const [file, fileFindings] of groupByFile(findings)) {
-		// ?plain=1 opens GitHub's code view, where #L<n> anchors work; the rendered
-		// Markdown preview ignores them
-		const fileUrl = LINK_BASE && `${LINK_BASE}/${file}?plain=1`;
-		lines.push(linkTo(`**\`${file}\`**`, fileUrl));
+		const url = fileUrl(file);
+		lines.push(linkTo(`**\`${file}\`**`, url));
 		for (const {line, placeholder, recommended} of fileFindings) {
 			lines.push(
-				`- ${linkTo(`line ${line}`, fileUrl && `${fileUrl}#L${line}`)}: ` +
+				`- ${linkTo(`line ${line}`, url && `${url}#L${line}`)}: ` +
 					`\`${placeholder}\` → \`${recommended}\``
 			);
 		}
@@ -326,29 +268,7 @@ function reviewRequest(findings, fixedLines) {
 	return {event: 'COMMENT', body: '', comments};
 }
 
-const FORMATTERS = {
-	text: formatText,
-	json: findings => JSON.stringify(findings, null, '\t') + '\n',
-	markdown: formatMarkdown
-};
-
-function main() {
-	const format = FORMATTERS[FORMAT];
-	if (!format) {
-		throw new Error(
-			`Unknown --format "${FORMAT}"; use text, json, or markdown`
-		);
-	}
-	const {findings, fixedLines} = findPlaceholders();
-	if (REVIEW_FILE) {
-		fs.writeFileSync(
-			REVIEW_FILE,
-			JSON.stringify(reviewRequest(findings, fixedLines), null, '\t') +
-				'\n'
-		);
-	}
-	process.stdout.write(format(findings));
-	process.exit(findings.length === 0 ? 0 : 1);
-}
-
-main();
+const {findings, fixedLines} = findPlaceholders();
+report(findings, {text: formatText, markdown: formatMarkdown}, () =>
+	reviewRequest(findings, fixedLines)
+);
diff --git a/dev/check-links.mjs b/dev/check-links.mjs
index 5b45fdb29..b45e238d2 100644
--- a/dev/check-links.mjs
+++ b/dev/check-links.mjs
@@ -47,6 +47,7 @@ import fs from 'fs';
 import path from 'path';
 import GithubSlugger from 'github-slugger';
 import { fileURLToPath, pathToFileURL } from 'url';
+import { fileUrl, flagValue, groupByFile, linkTo, listFiles, parseDiff, report, withoutBaseline } from './check-shared.mjs';
 
 const __filename = fileURLToPath(import.meta.url);
 const __dirname = path.dirname(__filename);
@@ -58,67 +59,19 @@ const CHECK_SELF_LINKS = args.includes('--check-self-links');
 const ROOT_DIR = path.resolve(flagValue('--root') ?? path.dirname(__dirname));
 const FORMAT = flagValue('--format') ?? 'text';
 const BASELINE_FILE = flagValue('--baseline');
-const LINK_BASE = flagValue('--link-base')?.replace(/\/$/, '');
 const DIFF = parseDiff(flagValue('--diff'));
 const CHECK_EXTERNAL = args.includes('--check-external');
-const REVIEW_FILE = flagValue('--review');
 
 if (CHECK_EXTERNAL && !DIFF) {
 	throw new Error('--check-external needs --diff, to know which lines were added');
 }
 
-// Files and added lines of a unified diff, with paths relative to the repository:
-// { files: Set<'docs/foo.mdx'>, addedLines: Map<'docs/foo.mdx', Set<lineNumber>> }.
-// Works with any amount of context, so `git diff` and `git diff -U0` both do.
-function parseDiff(file) {
-	if (!file) return undefined;
-	const files = new Set();
-	const addedLines = new Map();
-	let currentFile;
-	let lineNumber;
-	for (const line of fs.readFileSync(file, 'utf-8').split('\n')) {
-		if (line.startsWith('diff --git ')) {
-			currentFile = undefined;
-		} else if (line.startsWith('+++ ') && !currentFile) {
-			// `+++ /dev/null` is a deleted file, which has no added lines
-			currentFile = line.slice(4).replace(/^b\//, '');
-			if (currentFile === '/dev/null') continue;
-			files.add(currentFile);
-			addedLines.set(currentFile, new Set());
-		} else if (line.startsWith('@@ ')) {
-			lineNumber = Number(line.match(/^@@ -\S+ \+(\d+)/)[1]);
-		} else if (line.startsWith('+') && currentFile) {
-			addedLines.get(currentFile).add(lineNumber++);
-		} else if (line.startsWith(' ')) {
-			lineNumber++;
-		}
-	}
-	return { files, addedLines };
-}
-
 const DOCS_DIR = path.join(ROOT_DIR, 'docs');
 // Files whose links are checked. Only .mdx files become site routes; see
 // `filePathPattern` in contentlayer.config.ts.
 const SOURCE_EXTENSIONS = ['.md', '.mdx'];
 const ROUTE_EXTENSIONS = ['.mdx'];
 
-function flagValue(name) {
-	const index = args.indexOf(name);
-	return index === -1 ? undefined : args[index + 1];
-}
-
-// Sorted relative paths of every file under dir, optionally limited to some
-// extensions. Sorted so foo.mdx precedes foo/index.mdx; when both exist the
-// site serves the first match (allPosts.find), so the first file owns the route.
-export function listFiles(dir, extensions) {
-	if (!fs.existsSync(dir)) return [];
-	return fs
-		.readdirSync(dir, { recursive: true, withFileTypes: true })
-		.filter(entry => entry.isFile() && (!extensions || extensions.includes(path.extname(entry.name))))
-		.map(entry => path.relative(dir, path.join(entry.parentPath, entry.name)))
-		.sort();
-}
-
 // Regex patterns for extracting links
 const MARKDOWN_LINK_REGEX = /\[([^\]]*)\]\(([^)]+)\)/g;
 const JSX_HREF_REGEX = /href=["']([^"']+)["']/g;
@@ -434,7 +387,7 @@ function validateLink(link, currentFile, maps) {
 }
 
 function isAddedLine(file, line) {
-	return DIFF?.addedLines.get(file)?.has(line) ?? false;
+	return DIFF?.get(file)?.has(line) ?? false;
 }
 
 // Find every broken link: [{ file, line, url, error, fix? }]
@@ -522,24 +475,6 @@ function findingKey({ file, url, error }) {
 	return `${file}\n${url}\n${error}`;
 }
 
-function withoutBaseline(findings, baselineFile) {
-	const baseline = new Set(
-		JSON.parse(fs.readFileSync(baselineFile, 'utf-8')).map(findingKey)
-	);
-	return findings.filter(finding => !baseline.has(findingKey(finding)));
-}
-
-function groupByFile(findings) {
-	const byFile = new Map();
-	for (const finding of findings) {
-		if (!byFile.has(finding.file)) {
-			byFile.set(finding.file, []);
-		}
-		byFile.get(finding.file).push(finding);
-	}
-	return byFile;
-}
-
 function formatText(findings) {
 	const scope = BASELINE_FILE ? 'new ' : '';
 	if (findings.length === 0) {
@@ -560,22 +495,16 @@ function formatText(findings) {
 	return lines.join('\n') + '\n';
 }
 
-function linkTo(text, url) {
-	return url ? `[${text}](${url})` : text;
-}
-
 // Markdown list of findings grouped by file, one line per fact, linked to the
 // source when --link-base is set
 function markdownFindingList(findings) {
 	const lines = [];
 	for (const [file, fileFindings] of groupByFile(findings)) {
-		// ?plain=1 opens GitHub's code view, where #L<n> anchors work; the rendered
-		// Markdown preview ignores them
-		const fileUrl = LINK_BASE && `${LINK_BASE}/${file}?plain=1`;
-		lines.push(linkTo(`**\`${file}\`**`, fileUrl));
+		const sourceUrl = fileUrl(file);
+		lines.push(linkTo(`**\`${file}\`**`, sourceUrl));
 		for (const { line, url, error, fix } of fileFindings) {
 			lines.push(
-				`- ${linkTo(`line ${line}`, fileUrl && `${fileUrl}#L${line}`)}`,
+				`- ${linkTo(`line ${line}`, sourceUrl && `${sourceUrl}#L${line}`)}`,
 				`  - Link: \`${url}\``,
 				`  - Problem: ${error}`,
 				...(fix ? [`  - Fix: \`${fix}\``] : [])
@@ -608,8 +537,8 @@ function formatMarkdown(findings) {
 	};
 	if (DIFF) {
 		const absolute = findings.filter(finding => isSelfLink(finding.url));
-		const outbound = findings.filter(finding => !isSelfLink(finding.url) && DIFF.files.has(finding.file));
-		const inbound = findings.filter(finding => !isSelfLink(finding.url) && !DIFF.files.has(finding.file));
+		const outbound = findings.filter(finding => !isSelfLink(finding.url) && DIFF.has(finding.file));
+		const inbound = findings.filter(finding => !isSelfLink(finding.url) && !DIFF.has(finding.file));
 		section('Outbound', 'Your PR includes links to pages or anchors that do not exist.', outbound);
 		section('Absolute links', ABSOLUTE_LINKS_ADVICE, absolute);
 		section(
@@ -661,32 +590,16 @@ function reviewRequest(findings) {
 	return { event: 'COMMENT', body: '', comments };
 }
 
-const FORMATTERS = {
-	text: formatText,
-	json: findings => JSON.stringify(findings, null, '\t') + '\n',
-	markdown: formatMarkdown
-};
-
 async function main() {
-	const format = FORMATTERS[FORMAT];
-	if (!format) {
-		throw new Error(`Unknown --format "${FORMAT}"; use text, json, or markdown`);
-	}
-	
 	if (FORMAT === 'text') {
 		console.log('🔍 Checking for dead links in MDX files...\n');
 	}
 
 	let findings = await findBrokenLinks();
 	if (BASELINE_FILE) {
-		findings = withoutBaseline(findings, BASELINE_FILE);
-	}
-
-	if (REVIEW_FILE) {
-		fs.writeFileSync(REVIEW_FILE, JSON.stringify(reviewRequest(findings), null, '\t') + '\n');
+		findings = withoutBaseline(findings, BASELINE_FILE, findingKey);
 	}
-	process.stdout.write(format(findings));
-	process.exit(findings.length === 0 ? 0 : 1);
+	report(findings, { text: formatText, markdown: formatMarkdown }, () => reviewRequest(findings));
 }
 
 // Only run when executed directly; dev/verify-links-live.mjs and dev/check-redirects.mjs
diff --git a/dev/check-redirects.mjs b/dev/check-redirects.mjs
index f123e9f15..c0b640bc5 100644
--- a/dev/check-redirects.mjs
+++ b/dev/check-redirects.mjs
@@ -38,17 +38,22 @@ import fs from 'fs';
 import path from 'path';
 import vm from 'vm';
 import {fileURLToPath} from 'url';
-import {extractHeadings, listFiles, routeFor} from './check-links.mjs';
+import {extractHeadings, routeFor} from './check-links.mjs';
+import {
+	fileUrl,
+	flagValue,
+	linkTo,
+	listFiles,
+	parseDiff,
+	report,
+	withoutBaseline
+} from './check-shared.mjs';
 
 const __dirname = path.dirname(fileURLToPath(import.meta.url));
 
-const args = process.argv.slice(2);
 const ROOT_DIR = path.resolve(flagValue('--root') ?? path.dirname(__dirname));
-const FORMAT = flagValue('--format') ?? 'text';
 const BASELINE_FILE = flagValue('--baseline');
-const LINK_BASE = flagValue('--link-base')?.replace(/\/$/, '');
-const DIFF_FILE = flagValue('--diff');
-const REVIEW_FILE = flagValue('--review');
+const DIFF = parseDiff(flagValue('--diff'));
 
 const REDIRECTS_PATH = 'src/data/redirects.ts';
 const REDIRECTS_FILE = path.join(ROOT_DIR, REDIRECTS_PATH);
@@ -104,11 +109,6 @@ const PROBLEM = {
 	}
 };
 
-function flagValue(name) {
-	const index = args.indexOf(name);
-	return index === -1 ? undefined : args[index + 1];
-}
-
 // Load redirects.ts without a TypeScript toolchain. The file is plain data
 // plus one import, so strip the module syntax and evaluate it.
 // Returns [{ source, destination, line }].
@@ -284,13 +284,6 @@ function findingKey(finding) {
 	return `${finding.source}\u0000${finding.destination}\u0000${finding.problem}`;
 }
 
-function withoutBaseline(findings, baselineFile) {
-	const baseline = new Set(
-		JSON.parse(fs.readFileSync(baselineFile, 'utf-8')).map(findingKey)
-	);
-	return findings.filter(finding => !baseline.has(findingKey(finding)));
-}
-
 // 'remove this entry', or which of source and destination to change to what
 function describeFix({source, destination, fix}) {
 	if (fix.remove) return 'remove this entry';
@@ -322,10 +315,6 @@ function formatText(findings) {
 	return lines.join('\n');
 }
 
-function linkTo(text, url) {
-	return url ? `[${text}](${url})` : text;
-}
-
 // Map of problem heading -> its findings in line order, sections in PROBLEM order
 function groupByProblem(findings) {
 	const groups = new Map(
@@ -345,8 +334,7 @@ function formatMarkdown(findings) {
 		return '### ✅ This revision breaks no redirects\n';
 	}
 
-	// ?plain=1 opens GitHub's code view, where #L<n> anchors work
-	const fileUrl = LINK_BASE && `${LINK_BASE}/${REDIRECTS_PATH}?plain=1`;
+	const url = fileUrl(REDIRECTS_PATH);
 	const lines = [
 		`### ❌ This PR breaks ${findings.length} redirect(s)`,
 		'',
@@ -369,7 +357,7 @@ function formatMarkdown(findings) {
 			'properly to tame the tech debt snowball no one wants to deal with; the ' +
 			'"Check links" PR check comment lists the links this PR broke, if any.',
 		'',
-		linkTo(`**\`${REDIRECTS_PATH}\`**`, fileUrl)
+		linkTo(`**\`${REDIRECTS_PATH}\`**`, url)
 	];
 	// One section per problem with its fix. Each entry is shown as it appears
 	// in the redirects file, so it is easy to find there.
@@ -381,7 +369,7 @@ function formatMarkdown(findings) {
 		for (const finding of entries) {
 			const {source, destination, line, detail, fix} = finding;
 			const where = line
-				? linkTo(`line ${line}`, fileUrl && `${fileUrl}#L${line}`)
+				? linkTo(`line ${line}`, url && `${url}#L${line}`)
 				: 'entry';
 			lines.push(
 				`- ${where}`,
@@ -401,25 +389,6 @@ function formatMarkdown(findings) {
 	return lines.join('\n') + '\n';
 }
 
-// Line numbers `git diff` output added to redirects.ts
-function addedLines(diffFile) {
-	const added = new Set();
-	let inRedirects = false;
-	let lineNumber;
-	for (const line of fs.readFileSync(diffFile, 'utf-8').split('\n')) {
-		if (line.startsWith('+++ ')) {
-			inRedirects = line === `+++ b/${REDIRECTS_PATH}`;
-		} else if (line.startsWith('@@ ')) {
-			lineNumber = Number(line.match(/^@@ -\S+ \+(\d+)/)[1]);
-		} else if (inRedirects && line.startsWith('+')) {
-			added.add(lineNumber++);
-		} else if (inRedirects && line.startsWith(' ')) {
-			lineNumber++;
-		}
-	}
-	return added;
-}
-
 // First line of a review comment, so the workflow can match the comments it
 // posted earlier to the findings still present and delete the rest
 const REVIEW_MARKER = '<!-- check-redirects-finding:';
@@ -469,36 +438,10 @@ function reviewRequest(findings, added) {
 	return {event: 'COMMENT', body: '', comments};
 }
 
-const FORMATTERS = {
-	text: formatText,
-	json: findings => JSON.stringify(findings, null, '\t') + '\n',
-	markdown: formatMarkdown
-};
-
-function main() {
-	const format = FORMATTERS[FORMAT];
-	if (!format) {
-		throw new Error(
-			`Unknown --format "${FORMAT}"; use text, json, or markdown`
-		);
-	}
-
-	let findings = findBrokenRedirects(loadRedirects(), buildHeadingsByRoute());
-	if (BASELINE_FILE) {
-		findings = withoutBaseline(findings, BASELINE_FILE);
-	}
-
-	if (REVIEW_FILE) {
-		const added = DIFF_FILE ? addedLines(DIFF_FILE) : new Set();
-		fs.writeFileSync(
-			REVIEW_FILE,
-			JSON.stringify(reviewRequest(findings, added), null, '\t') + '\n'
-		);
-	}
-
-	// Not process.exit(): that can truncate stdout when it is a pipe
-	process.stdout.write(format(findings));
-	process.exitCode = findings.length === 0 ? 0 : 1;
+let findings = findBrokenRedirects(loadRedirects(), buildHeadingsByRoute());
+if (BASELINE_FILE) {
+	findings = withoutBaseline(findings, BASELINE_FILE, findingKey);
 }
-
-main();
+report(findings, {text: formatText, markdown: formatMarkdown}, () =>
+	reviewRequest(findings, DIFF?.get(REDIRECTS_PATH) ?? new Set())
+);
diff --git a/dev/check-shared.mjs b/dev/check-shared.mjs
new file mode 100644
index 000000000..318fe2fb5
--- /dev/null
+++ b/dev/check-shared.mjs
@@ -0,0 +1,135 @@
+/**
+ * What the dev/check-*.mjs scripts have in common: the flags they all take,
+ * the unified diff of the change under review, the Markdown links in their
+ * reports, and how they write their output. See .github/actions/pr-check.
+ *
+ * Flags read here:
+ *   --format <name>      Output as text (default), json, or markdown
+ *   --link-base <url>    Markdown output links each file path to <url>/<path>,
+ *                        e.g. https://github.com/sourcegraph/docs/blob/<branch>
+ *   --review <file>      Write a GitHub pull request review (JSON body for
+ *                        POST /repos/{owner}/{repo}/pulls/{n}/reviews)
+ */
+
+import fs from 'fs';
+import path from 'path';
+
+const args = process.argv.slice(2);
+
+// The value after a `--flag`, or undefined
+export function flagValue(name) {
+	const index = args.indexOf(name);
+	return index === -1 ? undefined : args[index + 1];
+}
+
+export const LINK_BASE = flagValue('--link-base')?.replace(/\/$/, '');
+
+// Added lines of a unified diff, by path relative to the repository:
+// Map<'docs/foo.mdx', Set<lineNumber>>. Works with any amount of context, so
+// `git diff` and `git diff -U0` both do.
+export function parseDiff(file) {
+	if (!file) return undefined;
+	const addedLines = new Map();
+	let currentFile;
+	let lineNumber;
+	for (const line of fs.readFileSync(file, 'utf-8').split('\n')) {
+		if (line.startsWith('diff --git ')) {
+			currentFile = undefined;
+		} else if (line.startsWith('+++ ') && !currentFile) {
+			// `+++ /dev/null` is a deleted file, which has no added lines
+			currentFile = line.slice(4).replace(/^b\//, '');
+			if (currentFile === '/dev/null') continue;
+			addedLines.set(currentFile, new Set());
+		} else if (line.startsWith('@@ ')) {
+			lineNumber = Number(line.match(/^@@ -\S+ \+(\d+)/)[1]);
+		} else if (line.startsWith('+') && currentFile) {
+			addedLines.get(currentFile).add(lineNumber++);
+		} else if (line.startsWith(' ')) {
+			lineNumber++;
+		}
+	}
+	return addedLines;
+}
+
+// Sorted relative paths of every file under dir, optionally limited to some
+// extensions. Sorted so foo.mdx precedes foo/index.mdx; when both exist the
+// site serves the first match (allPosts.find), so the first file owns the route.
+export function listFiles(dir, extensions) {
+	if (!fs.existsSync(dir)) return [];
+	return fs
+		.readdirSync(dir, {recursive: true, withFileTypes: true})
+		.filter(
+			entry =>
+				entry.isFile() &&
+				(!extensions || extensions.includes(path.extname(entry.name)))
+		)
+		.map(entry =>
+			path.relative(dir, path.join(entry.parentPath, entry.name))
+		)
+		.sort();
+}
+
+// Sorted paths of the .md and .mdx files under docs/, relative to the
+// repository: 'docs/foo.mdx'
+export function listDocsFiles(rootDir) {
+	return listFiles(path.join(rootDir, 'docs'), ['.md', '.mdx']).map(file =>
+		path.join('docs', file)
+	);
+}
+
+// The findings absent from a --baseline file, matched by key
+export function withoutBaseline(findings, baselineFile, findingKey) {
+	const baseline = new Set(
+		JSON.parse(fs.readFileSync(baselineFile, 'utf-8')).map(findingKey)
+	);
+	return findings.filter(finding => !baseline.has(findingKey(finding)));
+}
+
+export function groupByFile(findings) {
+	const byFile = new Map();
+	for (const finding of findings) {
+		if (!byFile.has(finding.file)) {
+			byFile.set(finding.file, []);
+		}
+		byFile.get(finding.file).push(finding);
+	}
+	return byFile;
+}
+
+export function linkTo(text, url) {
+	return url ? `[${text}](${url})` : text;
+}
+
+// Where a file is on GitHub under --link-base, or undefined without it.
+// ?plain=1 opens GitHub's code view, where #L<n> anchors work; the rendered
+// Markdown preview ignores them
+export function fileUrl(file) {
+	return LINK_BASE && `${LINK_BASE}/${file}?plain=1`;
+}
+
+// Writes the review when --review asks for one, prints the findings in the
+// --format asked for, and exits 1 when there are any. `review` builds the
+// request body, only when needed.
+export function report(findings, {text, markdown}, review) {
+	const formatName = flagValue('--format') ?? 'text';
+	const format = {
+		text,
+		json: items => JSON.stringify(items, null, '\t') + '\n',
+		markdown
+	}[formatName];
+	if (!format) {
+		throw new Error(
+			`Unknown --format "${formatName}"; use text, json, or markdown`
+		);
+	}
+	const reviewFile = flagValue('--review');
+	if (reviewFile) {
+		fs.writeFileSync(
+			reviewFile,
+			JSON.stringify(review(), null, '\t') + '\n'
+		);
+	}
+	// Not process.exit(): that can truncate stdout when it is a pipe
+	process.stdout.write(format(findings));
+	process.exitCode = findings.length === 0 ? 0 : 1;
+}
diff --git a/dev/check-spelling.mjs b/dev/check-spelling.mjs
index 302adbb06..8b6b27f9b 100644
--- a/dev/check-spelling.mjs
+++ b/dev/check-spelling.mjs
@@ -25,52 +25,25 @@
  */
 
 import {spawnSync} from 'child_process';
-import {readFileSync, writeFileSync} from 'fs';
+import {readFileSync} from 'fs';
 import path from 'path';
 import {fileURLToPath} from 'url';
-
-const args = process.argv.slice(2);
-const DIFF_FILE = flagValue('--diff');
+import {
+	LINK_BASE,
+	fileUrl,
+	flagValue,
+	groupByFile,
+	linkTo,
+	parseDiff,
+	report
+} from './check-shared.mjs';
+
+const DIFF = parseDiff(flagValue('--diff'));
 const PULL_REQUEST_FILE = flagValue('--pull-request');
-const FORMAT = flagValue('--format') ?? 'text';
-const LINK_BASE = flagValue('--link-base')?.replace(/\/$/, '');
-const REVIEW_FILE = flagValue('--review');
 
 const ALLOW_LIST = 'cspell-allow-list.txt';
 const MAX_INLINE_COMMENTS = 25;
 
-function flagValue(name) {
-	const index = args.indexOf(name);
-	return index === -1 ? undefined : args[index + 1];
-}
-
-function addedLineRanges(diff) {
-	const ranges = new Map();
-	let file;
-
-	for (const line of diff.split('\n')) {
-		const fileMatch = line.match(/^\+\+\+ b\/(.+)$/);
-		if (fileMatch) {
-			file = fileMatch[1];
-			if (!ranges.has(file)) {
-				ranges.set(file, []);
-			}
-			continue;
-		}
-
-		const hunkMatch = line.match(/^@@ -\d+(?:,\d+)? \+(\d+)(?:,(\d+))? @@/);
-		if (file && hunkMatch) {
-			const start = Number(hunkMatch[1]);
-			const count = hunkMatch[2] === undefined ? 1 : Number(hunkMatch[2]);
-			if (count > 0) {
-				ranges.get(file).push([start, start + count - 1]);
-			}
-		}
-	}
-
-	return ranges;
-}
-
 // `input` is checked as a document named `stdin://<file>`, so the repository's
 // cspell.json still applies to text that is not in the repository
 function runCSpell(files, input) {
@@ -171,23 +144,8 @@ function unsortedDictionaryEntries(files) {
 	return findings;
 }
 
-function findingsOnAddedLines(ranges, issues) {
-	return issues.filter(issue =>
-		(ranges.get(issue.file) ?? []).some(
-			([start, end]) => issue.line >= start && issue.line <= end
-		)
-	);
-}
-
-function groupByFile(findings) {
-	const byFile = new Map();
-	for (const finding of findings) {
-		if (!byFile.has(finding.file)) {
-			byFile.set(finding.file, []);
-		}
-		byFile.get(finding.file).push(finding);
-	}
-	return byFile;
+function findingsOnAddedLines(issues) {
+	return issues.filter(issue => DIFF.get(issue.file)?.has(issue.line));
 }
 
 function formatText(findings) {
@@ -205,16 +163,6 @@ function formatText(findings) {
 	return lines.join('\n') + '\n';
 }
 
-function linkTo(text, url) {
-	return url ? `[${text}](${url})` : text;
-}
-
-// ?plain=1 opens GitHub's code view, where #L<n> anchors work; the rendered
-// Markdown preview ignores them
-function fileUrl(file) {
-	return LINK_BASE && `${LINK_BASE}/${file}?plain=1`;
-}
-
 // Without ?plain=1, so GitHub's edit button works from it
 const ALLOW_LIST_LINK = linkTo(
 	`\`${ALLOW_LIST}\``,
@@ -372,40 +320,21 @@ function reviewRequest(findings) {
 	return {event: 'COMMENT', body: '', comments};
 }
 
-const FORMATTERS = {
-	text: formatText,
-	json: findings => JSON.stringify(findings, null, '\t') + '\n',
-	markdown: formatMarkdown
-};
-
 function main() {
-	if (!DIFF_FILE) {
+	if (!DIFF) {
 		throw new Error('Missing required --diff <file>');
 	}
-	const format = FORMATTERS[FORMAT];
-	if (!format) {
-		throw new Error(
-			`Unknown --format "${FORMAT}"; use text, json, or markdown`
-		);
-	}
-
-	const ranges = addedLineRanges(readFileSync(DIFF_FILE, 'utf8'));
-	const files = [...ranges.keys()];
+	const files = [...DIFF.keys()];
 	const findings = [
-		...findingsOnAddedLines(ranges, [
+		...findingsOnAddedLines([
 			...runCSpell(files),
 			...unsortedDictionaryEntries(files)
 		]),
 		...(PULL_REQUEST_FILE ? pullRequestFindings(PULL_REQUEST_FILE) : [])
 	];
-	if (REVIEW_FILE) {
-		writeFileSync(
-			REVIEW_FILE,
-			JSON.stringify(reviewRequest(findings), null, '\t') + '\n'
-		);
-	}
-	process.stdout.write(format(findings));
-	process.exit(findings.length === 0 ? 0 : 1);
+	report(findings, {text: formatText, markdown: formatMarkdown}, () =>
+		reviewRequest(findings)
+	);
 }
 
 try {
diff --git a/dev/post-check-comment.sh b/dev/post-check-comment.sh
deleted file mode 100755
index 7690bddbf..000000000
--- a/dev/post-check-comment.sh
+++ /dev/null
@@ -1,42 +0,0 @@
-#!/usr/bin/env sh
-# Post a check's summary comment on a PR, or update the one it posted earlier,
-# found by the marker on its first line. Findings and crashes post the comment
-# or reopen it; a clean result only resolves an earlier comment, updating it
-# and minimizing it, so a PR that never had findings never gets a comment.
-#
-# Usage: dev/post-check-comment.sh '<!-- check-links-report -->' <clean|found|crashed> report.md
-# The report is the Markdown the check script wrote, used as the comment body
-# for clean and found. Needs GH_TOKEN, GITHUB_REPOSITORY, GITHUB_WORKFLOW,
-# PR_NUMBER, and RUN_URL.
-set -eu
-marker=$1
-result=$2
-report=$3
-issues="repos/$GITHUB_REPOSITORY/issues"
-
-existing=$(gh api "$issues/$PR_NUMBER/comments" --paginate \
-    --jq ".[] | select(.body | startswith(\"$marker\")) | \"\(.id) \(.node_id)\"" | head -n 1)
-
-if [ "$result" = crashed ]; then
-    body=$(printf '%s\n### ⚠️ %s could not run on this revision\n\nThis is a problem with the check, not with this PR; see the [job log](%s).\n' \
-        "$marker" "$GITHUB_WORKFLOW" "$RUN_URL")
-else
-    body=$(printf '%s\n' "$marker"; cat "$report")
-fi
-
-if [ -z "$existing" ]; then
-    [ "$result" != clean ] || exit 0
-    gh api --method POST "$issues/$PR_NUMBER/comments" --raw-field body="$body" --silent
-    exit 0
-fi
-
-gh api --method PATCH "$issues/comments/${existing% *}" --raw-field body="$body" --silent
-
-# Minimizing is GraphQL-only. Both mutations are idempotent
-if [ "$result" = clean ]; then
-    mutation="minimizeComment(input: {subjectId: \$id, classifier: RESOLVED})"
-else
-    mutation="unminimizeComment(input: {subjectId: \$id})"
-fi
-gh api graphql --raw-field id="${existing#* }" \
-    --raw-field query="mutation(\$id: ID!) { $mutation { clientMutationId } }" --silent
diff --git a/dev/report-check.sh b/dev/report-check.sh
new file mode 100755
index 000000000..c57aa17c1
--- /dev/null
+++ b/dev/report-check.sh
@@ -0,0 +1,88 @@
+#!/usr/bin/env sh
+# Report a check's findings on a PR: a summary comment, plus one review
+# comment per finding in the review JSON. Both are found again on the next
+# run by the marker on their first line, so each run leaves the PR showing
+# the findings of the current revision and nothing else.
+#
+# Usage: dev/report-check.sh <name> <clean|found|crashed> report.md review.json
+#   name    the marker prefix: `check-links` marks the summary
+#           `<!-- check-links-report -->` and each review comment
+#           `<!-- check-links-finding: ... -->`
+#   report  the Markdown the check script wrote, the summary body for clean
+#           and found; crashed gets a message linking the job log instead
+#   review  {comments: [{path, line, start_line?, body}]} from the script's
+#           --review, not read when crashed
+#
+# The summary is posted or reopened for findings and a crash; a clean result
+# only updates and minimizes the summary of an earlier run, so a PR that
+# never had findings never gets a comment. Review comments are posted for the
+# new findings, updated when their text changed, and deleted when their
+# finding is gone or GitHub could not carry them to the new revision (line is
+# null). Needs GH_TOKEN, GITHUB_REPOSITORY, GITHUB_WORKFLOW, PR_NUMBER, and
+# RUN_URL.
+set -eu
+name=$1
+result=$2
+report=$3
+review=$4
+repository="repos/$GITHUB_REPOSITORY"
+
+# Summary comment
+
+marker="<!-- $name-report -->"
+existing=$(gh api "$repository/issues/$PR_NUMBER/comments" --paginate \
+    --jq ".[] | select(.body | startswith(\"$marker\")) | \"\(.id) \(.node_id)\"" | head -n 1)
+
+if [ "$result" = crashed ]; then
+    body=$(printf '%s\n### ⚠️ %s could not run on this revision\n\nThis is a problem with the check, not with this PR; see the [job log](%s).\n' \
+        "$marker" "$GITHUB_WORKFLOW" "$RUN_URL")
+else
+    body=$(printf '%s\n' "$marker"; cat "$report")
+fi
+
+if [ -z "$existing" ]; then
+    [ "$result" = clean ] || gh api --method POST "$repository/issues/$PR_NUMBER/comments" --raw-field body="$body" --silent
+else
+    gh api --method PATCH "$repository/issues/comments/${existing% *}" --raw-field body="$body" --silent
+    # Minimizing is GraphQL-only. Both mutations are idempotent
+    if [ "$result" = clean ]; then
+        mutation="minimizeComment(input: {subjectId: \$id, classifier: RESOLVED})"
+    else
+        mutation="unminimizeComment(input: {subjectId: \$id})"
+    fi
+    gh api graphql --raw-field id="${existing#* }" \
+        --raw-field query="mutation(\$id: ID!) { $mutation { clientMutationId } }" --silent
+fi
+
+[ "$result" != crashed ] || exit 0
+
+# Review comments, matched to the findings by file, line, and marker line
+
+marker="<!-- $name-finding:"
+key='(.path + ":" + (.line | tostring) + ":" + (.body | split("\n")[0]))'
+pulls="$repository/pulls"
+
+posted=$(gh api "$pulls/$PR_NUMBER/comments" --paginate \
+    --jq ".[] | select(.body | startswith(\"$marker\")) | {id, body, key: $key}" | jq -s .)
+
+printf '%s' "$posted" | jq -c --slurpfile review "$review" ".[]
+    | .key as \$key
+    | (\$review[0].comments | map(select($key == \$key)) | first) as \$wanted
+    | if \$wanted == null then {id, method: \"DELETE\"}
+      elif \$wanted.body != .body then {id, method: \"PATCH\", body: \$wanted.body}
+      else empty end" \
+| while read -r change; do
+    comment="$pulls/comments/$(printf '%s' "$change" | jq -r .id)"
+    if [ "$(printf '%s' "$change" | jq -r .method)" = DELETE ]; then
+        gh api --method DELETE "$comment" < /dev/null
+    else
+        printf '%s' "$change" | jq '{body}' | gh api --method PATCH "$comment" --input - > /dev/null
+    fi
+done
+
+fresh=$(jq --argjson posted "$posted" \
+    ".comments |= map(select($key as \$key | \$posted | any(.key == \$key) | not))" "$review")
+if [ "$(printf '%s' "$fresh" | jq '.comments | length')" -gt 0 ]; then
+    printf '%s' "$fresh" | gh api --method POST "$pulls/$PR_NUMBER/reviews" --input - > /dev/null \
+        || echo "::warning::Could not post the suggested fixes; they are in the report above"
+fi
diff --git a/dev/sync-review-comments.sh b/dev/sync-review-comments.sh
deleted file mode 100755
index 6ecd7b806..000000000
--- a/dev/sync-review-comments.sh
+++ /dev/null
@@ -1,40 +0,0 @@
-#!/usr/bin/env sh
-# Make a check's suggested-change review comments on a PR match a review.json
-# ({comments: [{path, line, start_line?, body}]}): post the new ones, update
-# the ones whose text changed, and delete the ones whose finding is gone.
-# GitHub sets line to null on comments it could not carry to the new revision,
-# so those are deleted too. Comments are matched by file, line, and the
-# marker comment on their first line, e.g. "<!-- check-links-finding: <url> -->".
-#
-# Usage: dev/sync-review-comments.sh '<!-- check-links-finding:' review.json
-# Needs GH_TOKEN, GITHUB_REPOSITORY, and PR_NUMBER.
-set -eu
-marker=$1
-review=$2
-key='(.path + ":" + (.line | tostring) + ":" + (.body | split("\n")[0]))'
-pulls="repos/$GITHUB_REPOSITORY/pulls"
-
-posted=$(gh api "$pulls/$PR_NUMBER/comments" --paginate \
-    --jq ".[] | select(.body | startswith(\"$marker\")) | {id, body, key: $key}" | jq -s .)
-
-printf '%s' "$posted" | jq -c --slurpfile review "$review" ".[]
-    | .key as \$key
-    | (\$review[0].comments | map(select($key == \$key)) | first) as \$wanted
-    | if \$wanted == null then {id, method: \"DELETE\"}
-      elif \$wanted.body != .body then {id, method: \"PATCH\", body: \$wanted.body}
-      else empty end" \
-| while read -r change; do
-    comment="$pulls/comments/$(printf '%s' "$change" | jq -r .id)"
-    if [ "$(printf '%s' "$change" | jq -r .method)" = DELETE ]; then
-        gh api --method DELETE "$comment" < /dev/null
-    else
-        printf '%s' "$change" | jq '{body}' | gh api --method PATCH "$comment" --input - > /dev/null
-    fi
-done
-
-fresh=$(jq --argjson posted "$posted" \
-    ".comments |= map(select($key as \$key | \$posted | any(.key == \$key) | not))" "$review")
-if [ "$(printf '%s' "$fresh" | jq '.comments | length')" -gt 0 ]; then
-    printf '%s' "$fresh" | gh api --method POST "$pulls/$PR_NUMBER/reviews" --input - > /dev/null \
-        || echo "::warning::Could not post the suggested fixes; they are in the report above"
-fi
diff --git a/dev/vercel-ignore-build.sh b/dev/vercel-ignore-build.sh
index 4dc8b33a5..75feb3e9b 100755
--- a/dev/vercel-ignore-build.sh
+++ b/dev/vercel-ignore-build.sh
@@ -15,10 +15,10 @@ exec git diff --quiet HEAD^ HEAD -- . \
 	':(exclude)dev/check-duplicates.mjs' \
 	':(exclude)dev/check-hostnames.mjs' \
 	':(exclude)dev/check-redirects.mjs' \
+	':(exclude)dev/check-shared.mjs' \
 	':(exclude)dev/check-spelling.mjs' \
 	':(exclude)dev/example-hostnames.json' \
-	':(exclude)dev/post-check-comment.sh' \
-	':(exclude)dev/sync-review-comments.sh' \
+	':(exclude)dev/report-check.sh' \
 	':(exclude)dev/vercel-build-log-slack-app-manifest.json' \
 	':(exclude)dev/vercel-build-log.mjs' \
 	':(exclude)dev/vercel-ignore-build.sh' \

From 962d05d63a187ea754b93aa9b6edc206ff695e47 Mon Sep 17 00:00:00 2001
From: Marc LeBlanc <7050295+marcleblanc2@users.noreply.github.com>
Date: Fri, 30 Oct 2026 19:43:24 -0600
Subject: [PATCH 6/6] ci: Name the spelling check's comments check-spelling
 like the other checks, and check-report.sh like the other check scripts

The summary and inline comment markers were cspell-report and
cspell-finding; every other check uses its workflow name. Open PRs keep
their old cspell-report comment; delete those once this lands.

Amp-Thread-ID: https://ampcode.com/threads/T-01a18f4b-0163-7216-a915-372c4b6288cb
Co-authored-by: Amp <amp@ampcode.com>
---
 .github/actions/pr-check/action.yml      | 6 +++---
 .github/workflows/check-duplicates.yml   | 2 +-
 .github/workflows/check-hostnames.yml    | 2 +-
 .github/workflows/check-spelling.yml     | 2 +-
 AGENTS.md                                | 2 +-
 dev/{report-check.sh => check-report.sh} | 2 +-
 dev/check-spelling.mjs                   | 2 +-
 dev/vercel-ignore-build.sh               | 2 +-
 8 files changed, 10 insertions(+), 10 deletions(-)
 rename dev/{report-check.sh => check-report.sh} (98%)

diff --git a/.github/actions/pr-check/action.yml b/.github/actions/pr-check/action.yml
index 836192192..28dc95e1e 100644
--- a/.github/actions/pr-check/action.yml
+++ b/.github/actions/pr-check/action.yml
@@ -2,7 +2,7 @@ name: PR check
 description: >-
     Runs one dev/check-<name>.mjs on the lines a pull request adds and reports
     its findings on the PR: a summary comment plus a review comment on each
-    flagged line (dev/report-check.sh). The job must check out the repository
+    flagged line (dev/check-report.sh). The job must check out the repository
     first, with fetch-depth 0; the default ref, the merge commit, is right.
 
 inputs:
@@ -12,7 +12,7 @@ inputs:
     name:
         description: >-
             Marks the comments the check posts, e.g. check-links; see
-            dev/report-check.sh
+            dev/check-report.sh
         required: true
     arguments:
         description: Flags for every run of the script
@@ -129,7 +129,7 @@ runs:
               RUN_URL: ${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}
               NAME: ${{ inputs.name }}
               RESULT: ${{ steps.check.outputs.result }}
-          run: dev/report-check.sh "$NAME" "$RESULT" "$RUNNER_TEMP/report.md" "$RUNNER_TEMP/review.json"
+          run: dev/check-report.sh "$NAME" "$RESULT" "$RUNNER_TEMP/report.md" "$RUNNER_TEMP/review.json"
 
         - name: Fail when this PR introduces findings
           if: inputs.fail-on-findings == 'true' && steps.check.outputs.result == 'found'
diff --git a/.github/workflows/check-duplicates.yml b/.github/workflows/check-duplicates.yml
index 8fcf36eec..e65340d51 100644
--- a/.github/workflows/check-duplicates.yml
+++ b/.github/workflows/check-duplicates.yml
@@ -11,7 +11,7 @@ on:
             - 'docs/**'
             - 'dev/check-duplicates.mjs'
             - 'dev/check-shared.mjs'
-            - 'dev/report-check.sh'
+            - 'dev/check-report.sh'
             - '.github/actions/pr-check/action.yml'
             - '.github/workflows/check-duplicates.yml'
 
diff --git a/.github/workflows/check-hostnames.yml b/.github/workflows/check-hostnames.yml
index 9a5e932c6..3d31e6b76 100644
--- a/.github/workflows/check-hostnames.yml
+++ b/.github/workflows/check-hostnames.yml
@@ -11,7 +11,7 @@ on:
             - 'dev/check-hostnames.mjs'
             - 'dev/check-shared.mjs'
             - 'dev/example-hostnames.json'
-            - 'dev/report-check.sh'
+            - 'dev/check-report.sh'
             - '.github/actions/pr-check/action.yml'
             - '.github/workflows/check-hostnames.yml'
 
diff --git a/.github/workflows/check-spelling.yml b/.github/workflows/check-spelling.yml
index 2f626cce6..d7fe5485e 100644
--- a/.github/workflows/check-spelling.yml
+++ b/.github/workflows/check-spelling.yml
@@ -51,5 +51,5 @@ jobs:
             - uses: ./.github/actions/pr-check
               with:
                   script: dev/check-spelling.mjs
-                  name: cspell
+                  name: check-spelling
                   head-only-arguments: --pull-request ${{ runner.temp }}/pull-request.md
diff --git a/AGENTS.md b/AGENTS.md
index 1a43c489a..53f4fc1dc 100644
--- a/AGENTS.md
+++ b/AGENTS.md
@@ -159,7 +159,7 @@ A check script parses its flags and the diff, lists files, drops baseline
 findings, and formats the report with `dev/check-shared.mjs`; it writes a
 Markdown report and a review JSON for the lines a PR adds, exits 1 with
 findings, and leaves the report empty when it crashes. The action turns that
-into `result=clean|found|crashed` and `dev/report-check.sh` posts the summary
+into `result=clean|found|crashed` and `dev/check-report.sh` posts the summary
 and the inline comments. The action and scripts run from the merge commit,
 like the workflow file itself, so a branch that predates a check still gets
 checked. Each workflow sets only what differs: the script, the comment
diff --git a/dev/report-check.sh b/dev/check-report.sh
similarity index 98%
rename from dev/report-check.sh
rename to dev/check-report.sh
index c57aa17c1..a802cb8d6 100755
--- a/dev/report-check.sh
+++ b/dev/check-report.sh
@@ -4,7 +4,7 @@
 # run by the marker on their first line, so each run leaves the PR showing
 # the findings of the current revision and nothing else.
 #
-# Usage: dev/report-check.sh <name> <clean|found|crashed> report.md review.json
+# Usage: dev/check-report.sh <name> <clean|found|crashed> report.md review.json
 #   name    the marker prefix: `check-links` marks the summary
 #           `<!-- check-links-report -->` and each review comment
 #           `<!-- check-links-finding: ... -->`
diff --git a/dev/check-spelling.mjs b/dev/check-spelling.mjs
index 8b6b27f9b..7ddf0f68f 100644
--- a/dev/check-spelling.mjs
+++ b/dev/check-spelling.mjs
@@ -266,7 +266,7 @@ function formatMarkdown(findings) {
 
 // First line of a review comment, so the workflow can match the comments it
 // posted earlier to the findings still present and delete the rest
-const REVIEW_MARKER = '<!-- cspell-finding:';
+const REVIEW_MARKER = '<!-- check-spelling-finding:';
 
 // One GitHub suggestion block with an apply button. A four-backtick fence so
 // lines containing ``` cannot break out of the block.
diff --git a/dev/vercel-ignore-build.sh b/dev/vercel-ignore-build.sh
index 75feb3e9b..f906b041f 100755
--- a/dev/vercel-ignore-build.sh
+++ b/dev/vercel-ignore-build.sh
@@ -15,10 +15,10 @@ exec git diff --quiet HEAD^ HEAD -- . \
 	':(exclude)dev/check-duplicates.mjs' \
 	':(exclude)dev/check-hostnames.mjs' \
 	':(exclude)dev/check-redirects.mjs' \
+	':(exclude)dev/check-report.sh' \
 	':(exclude)dev/check-shared.mjs' \
 	':(exclude)dev/check-spelling.mjs' \
 	':(exclude)dev/example-hostnames.json' \
-	':(exclude)dev/report-check.sh' \
 	':(exclude)dev/vercel-build-log-slack-app-manifest.json' \
 	':(exclude)dev/vercel-build-log.mjs' \
 	':(exclude)dev/vercel-ignore-build.sh' \