Enhance workflows and project structure

.github/pull_request_template.md

@@ -1,5 +1,7 @@
 # PR Summary
 
+<!-- One line summary -->
+
 Sci/Tech Reviewer: <!-- SR id, filled by author when ready for review (e.g. @octocat) -->
 Code Reviewer: <!-- CR id, filled by SSD/CCD (e.g. @octocat) -->
 
@@ -66,4 +68,3 @@ Code Reviewer: <!-- CR id, filled by SSD/CCD (e.g. @octocat) -->
 - [ ] Tests are adequate and have passed
 - [ ] Security considerations have been addressed
 - [ ] Performance impact is acceptable
-

.github/workflows/cla-check.yaml

@@ -0,0 +1,27 @@
+# -----------------------------------------------------------------------------
+# (C) Crown copyright Met Office. All rights reserved.
+# The file LICENCE, distributed with this code, contains details of the terms
+# under which the code may be used.
+# -----------------------------------------------------------------------------
+
+# Check Contributor Licence Agreement
+
+name: Legal
+
+on:
+  pull_request_target:
+
+concurrency:
+  # Automatically cancels the workflow run instantly before the
+  # engine can parse empty jobs and generate notification emails
+  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.sha }}
+  cancel-in-progress: ${{ github.event.pull_request.head.repo.full_name != 'MetOffice/SimSys_Scripts' }}
+
+permissions: {}
+
+jobs:
+  cla:
+    uses: MetOffice/growss/.github/workflows/cla-check.yaml@develop
+    permissions:
+      contents: read  # Required to evaluate the event trigger metadata safely
+      pull-requests: write  # Required for the downstream engine to post status comments on the PR

.github/workflows/lint.yml

@@ -1,4 +1,10 @@
 ---
+# -----------------------------------------------------------------------------
+# (C) Crown copyright Met Office. All rights reserved.
+# The file LICENCE, distributed with this code, contains details of the terms
+# under which the code may be used.
+# -----------------------------------------------------------------------------
+
 # Lint/analyse code with Super-Linter.
 name: Checks
 
@@ -13,7 +19,8 @@ concurrency:
   group: ${{ github.ref }}
   cancel-in-progress: ${{ github.ref != 'refs/heads/main' }}
 
-permissions: read-all
+permissions:
+  contents: read
 
 jobs:
   check:
@@ -24,16 +31,17 @@ jobs:
       max-parallel: 4
       fail-fast: false
       matrix:
-        python-version: ["3.9", "3.12", "3.14"]
+        python-version: ["3.11", "3.12", "3.14"]
 
     permissions:
       contents: read
       statuses: write
 
     steps:
       - name: Checkout current
-        uses: actions/checkout@v4
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
         with:
+          persist-credentials: false
           fetch-depth: 0
 
       - name: Super-Lint

.github/workflows/python_unit_tests.yaml

@@ -1,3 +1,9 @@
+# -----------------------------------------------------------------------------
+# (C) Crown copyright Met Office. All rights reserved.
+# The file LICENCE, distributed with this code, contains details of the terms
+# under which the code may be used.
+# -----------------------------------------------------------------------------
+
 name: Python Unit Tests
 
 on:
@@ -9,10 +15,14 @@ on:
     paths:
       - '**.py'
       - '.github/workflows/python_unit_tests.yaml'
-    branches: [main, 'releases/**']
   workflow_dispatch:
 
-permissions: read-all
+concurrency:
+  group: ${{ github.workflow }}-${{ github.head_ref || github.run_id }}
+  cancel-in-progress: true
+
+permissions:
+  contents: read  # Required to evaluate the event trigger metadata safely
 
 jobs:
   python_unit_tests:
@@ -21,22 +31,23 @@ jobs:
     timeout-minutes: 5
 
     steps:
-      - uses: actions/checkout@v5
-      - name: Set up Python
-        uses: actions/setup-python@v5
+      - name: Checkout code
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        with:
+          persist-credentials: false
+
+      - name: Set up uv with Python
+        uses: astral-sh/setup-uv@11f9893b081a58869d3b5fccaea48c9e9e46f990 # v8.3.2
         with:
           python-version: '3.14'
+          enable-cache: true
+
       - name: Install dependencies
-        run: |
-          # We only have 2 external dependencies other than pytest for now, so
-          # list them here
-          # If this changes, we may want to switch to a dependencies file of
-          # some format
-          python -m pip install --upgrade pip
-          pip install pytest networkx PyYAML
+        run: uv sync --extra test
+
       - name: Test with pytest
         run: |
           # Setup git for git_bdiff and get_git_sources testing
           git config --global user.name 'Testing'
           git config --global user.email 'Testing'
-          pytest -vv
+          uv run pytest -vv

.github/workflows/track-review-project.yaml

@@ -1,3 +1,9 @@
+# -----------------------------------------------------------------------------
+# (C) Crown copyright Met Office. All rights reserved.
+# The file LICENCE, distributed with this code, contains details of the terms
+# under which the code may be used.
+# -----------------------------------------------------------------------------
+
 name: Track Review Project
 
 on:
@@ -7,11 +13,14 @@ on:
       - completed
 
 permissions:
-  actions: read
-  contents: read
-  pull-requests: write
+  contents: read  # Required to evaluate the event trigger metadata safely
 
 jobs:
   track_review_project:
-    uses: MetOffice/growss/.github/workflows/track-review-project.yaml@main
-    secrets: inherit
+    permissions:
+      actions: read  # Required to check out code or parse files safely
+      contents: read  # Required to read the upstream triggered workflow run artifact status
+      pull-requests: write  # Required for the downstream engine to add comments or update metadata on the PR
+    uses: MetOffice/growss/.github/workflows/track-review-project.yaml@develop
+    secrets:
+      PROJECT_ACTION_PAT: ${{ secrets.PROJECT_ACTION_PAT }}

.github/workflows/trigger-project-workflow.yaml

@@ -1,3 +1,9 @@
+# -----------------------------------------------------------------------------
+# (C) Crown copyright Met Office. All rights reserved.
+# The file LICENCE, distributed with this code, contains details of the terms
+# under which the code may be used.
+# -----------------------------------------------------------------------------
+
 name: Trigger Review Project
 
 on:
@@ -7,11 +13,14 @@ on:
   pull_request_review_comment:
 
 permissions:
-  actions: read
-  contents: read
-  pull-requests: write
+  contents: read  # Required to evaluate the event trigger metadata safely
 
 jobs:
   trigger_project_workflow:
-    uses: MetOffice/growss/.github/workflows/trigger-project-workflow.yaml@main
-    secrets: inherit
+    if: github.repository == 'MetOffice/SimSys_Scripts'
+
+    permissions:
+      actions: read  # Required to check out code or parse files safely
+      contents: read  # Required to read the upstream triggered workflow run artifact status
+      pull-requests: write  # Required for the downstream engine to add comments or update metadata on the PR
+    uses: MetOffice/growss/.github/workflows/trigger-project-workflow.yaml@develop

.github/zizmor.yml

@@ -0,0 +1,20 @@
+# ------------------------------------------------------------------------------
+# (c) Crown copyright Met Office. All rights reserved.
+# The file LICENCE, distributed with this code, contains details of the terms
+# under which the code may be used.
+# ------------------------------------------------------------------------------
+
+# Rules for Zizmor GitHub workflow linter. This file is used to configure which
+# rules to ignore for specific workflow files, allowing for exceptions to be
+# made where necessary while still enforcing best practices across the codebase.
+rules:
+  unpinned-uses:
+    ignore:
+      - "cla-check.yaml"
+      - "track-review-project.yaml"
+      - "trigger-project-workflow.yaml"
+  dangerous-triggers:
+    ignore:
+      - "cla-check.yaml"
+      - "track-review-project.yaml"
+      - "trigger-project-workflow.yaml"

.gitignore

@@ -7,3 +7,4 @@ __pycache__/
 *.swp
 .conda
 .idea
+uv.lock

CONTRIBUTORS.md

@@ -0,0 +1,5 @@
+# Contributors
+
+| GitHub user | Real Name       | Affiliation | Date       |
+| ----------- | --------------- | ----------- | ---------- |
+| yaswant     | Yaswant Pradhan | Met Office  | 2026-07-17 |

pyproject.toml

@@ -0,0 +1,23 @@
+[project]
+name = "simsys_scripts"
+version = "2026.07.1"
+description = "Development support scripts for Simulation Systems deployment"
+readme = "README.md"
+license = { file = "LICENCE" }
+requires-python = ">=3.12"
+
+dependencies = []
+
+[project.optional-dependencies]
+test = [
+    "pytest",
+    "networkx",
+    "PyYAML"
+]
+
+[project.urls]
+repository = "https://github.com/MetOffice/SimSys_Scripts"
+discussion = "https://github.com/MetOffice/simulation-systems/discussions/categories/lfric"
+
+[tool.setuptools]
+packages = []