From 836576ce3f7fd5ab502f6cf925e83fe70cb5ac1d Mon Sep 17 00:00:00 2001 From: yaswant <2984440+yaswant@users.noreply.github.com> Date: Fri, 17 Jul 2026 09:03:27 +0100 Subject: [PATCH 1/2] Update GitHub workflows and templates --- .github/pull_request_template.md | 17 +++++--------- .github/workflows/check-cr-approved.yaml | 20 +++++++++++----- .github/workflows/cla-check.yaml | 21 ++++++++++++++++- .github/workflows/lint-fortran.yaml | 10 ++++---- .github/workflows/track-review-project.yaml | 19 +++++++++++---- .../workflows/trigger-project-workflow.yaml | 19 +++++++++++---- .github/zizmor.yml | 23 +++++++++++++++++++ CONTRIBUTORS.md | 11 +++++---- README.md | 2 ++ 9 files changed, 105 insertions(+), 37 deletions(-) create mode 100644 .github/zizmor.yml diff --git a/.github/pull_request_template.md b/.github/pull_request_template.md index 2c11a6c..899ad8f 100644 --- a/.github/pull_request_template.md +++ b/.github/pull_request_template.md @@ -1,5 +1,7 @@ # PR Summary + + Sci/Tech Reviewer: Code Reviewer: @@ -26,8 +28,7 @@ Code Reviewer: - [ ] I have performed a self-review of my own code - [ ] My code follows the project's style guidelines -- [ ] Comments have been included that aid undertanding and enhance the - readability of the code +- [ ] Comments have been included that aid understanding and enhance the readability of the code - [ ] My changes generate no new warnings ## Testing @@ -53,23 +54,17 @@ Code Reviewer: ## Performance Impact -- [ ] Performance of the code has been considered and, if applicable, suitable - performance measurements have been conducted +- [ ] Performance of the code has been considered and, if applicable, suitable performance measurements have been conducted ## AI Assistance and Attribution -- [ ] Some of the content of this change has been produced with the assistance - of _Generative AI tool name_ (e.g., Met Office Github Copilot Enterprise, - Github Copilot Personal, ChatGPT GPT-4, etc) and I have followed the - [Simulation Systems AI policy](https://metoffice.github.io/simulation-systems/FurtherDetails/ai.html) - (including attribution labels) +- [ ] Some of the content of this change has been produced with the assistance of _Generative AI tool name_ (e.g., Met Office Github Copilot Enterprise, Github Copilot Personal, ChatGPT GPT-4, etc) and I have followed the [Simulation Systems AI policy](https://metoffice.github.io/simulation-systems/FurtherDetails/ai.html) (including attribution labels) ## Documentation -- [ ] Where appropriate I have updated documentation related to this change and - confirmed that it builds correctly +- [ ] Where appropriate I have updated documentation related to this change and confirmed that it builds correctly # Sci/Tech Review diff --git a/.github/workflows/check-cr-approved.yaml b/.github/workflows/check-cr-approved.yaml index 9b66712..50b2258 100644 --- a/.github/workflows/check-cr-approved.yaml +++ b/.github/workflows/check-cr-approved.yaml @@ -1,11 +1,19 @@ +# ----------------------------------------------------------------------------- +# (C) Crown copyright Met Office. All rights reserved. +# The file LICENCE, distributed with this code, contains details of the terms +# under which the code may be used. +# ----------------------------------------------------------------------------- + name: Check CR approved on: - pull_request_review: - types: [submitted, edited, dismissed] - workflow_dispatch: + pull_request_review: + types: [submitted, edited, dismissed] + workflow_dispatch: jobs: - check_cr_approved: - if: ${{ github.event.pull_request.number }} - uses: MetOffice/growss/.github/workflows/check-cr-approved.yaml@main + check_cr_approved: + permissions: + contents: read # Required to evaluate the event trigger metadata safely + if: ${{ github.event.pull_request.number }} + uses: MetOffice/growss/.github/workflows/check-cr-approved.yaml@develop diff --git a/.github/workflows/cla-check.yaml b/.github/workflows/cla-check.yaml index 3d28d73..3bb04d6 100644 --- a/.github/workflows/cla-check.yaml +++ b/.github/workflows/cla-check.yaml @@ -1,10 +1,29 @@ +# ----------------------------------------------------------------------------- +# (C) Crown copyright Met Office. All rights reserved. +# The file LICENCE, distributed with this code, contains details of the terms +# under which the code may be used. +# ----------------------------------------------------------------------------- + +# Check Contributor Licence Agreement + name: Legal on: pull_request_target: +concurrency: + # Automatically cancels the workflow run instantly before the + # engine can parse empty jobs and generate notification emails + group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.sha }} + cancel-in-progress: ${{ github.event.pull_request.head.repo.full_name != 'MetOffice/casim' }} + +permissions: {} + jobs: cla: - uses: MetOffice/growss/.github/workflows/cla-check.yaml@main + permissions: + contents: read # Required to evaluate the event trigger metadata safely + pull-requests: write # Required for the downstream engine to post status comments on the PR + uses: MetOffice/growss/.github/workflows/cla-check.yaml@develop with: runner: 'ubuntu-24.04' diff --git a/.github/workflows/lint-fortran.yaml b/.github/workflows/lint-fortran.yaml index b5ae2b5..5600ab3 100644 --- a/.github/workflows/lint-fortran.yaml +++ b/.github/workflows/lint-fortran.yaml @@ -10,7 +10,9 @@ on: pull_request: jobs: - fortitude-lint: - uses: MetOffice/growss/.github/workflows/fortran-lint.yaml@main - with: - runner: "ubuntu-24.04" + fortitude-lint: + permissions: + contents: read # Required to evaluate the event trigger metadata safely + uses: MetOffice/growss/.github/workflows/fortran-lint.yaml@develop + with: + runner: 'ubuntu-24.04' diff --git a/.github/workflows/track-review-project.yaml b/.github/workflows/track-review-project.yaml index 639477c..0a0bc1d 100644 --- a/.github/workflows/track-review-project.yaml +++ b/.github/workflows/track-review-project.yaml @@ -1,3 +1,9 @@ +# ----------------------------------------------------------------------------- +# (C) Crown copyright Met Office. All rights reserved. +# The file LICENCE, distributed with this code, contains details of the terms +# under which the code may be used. +# ----------------------------------------------------------------------------- + name: Track Review Project on: @@ -7,11 +13,14 @@ on: - completed permissions: - actions: read - contents: read - pull-requests: write + contents: read # Required to evaluate the event trigger metadata safely jobs: track_review_project: - uses: MetOffice/growss/.github/workflows/track-review-project.yaml@main - secrets: inherit + permissions: + actions: read # Required to check out code or parse files safely + contents: read # Required to read the upstream triggered workflow run artifact status + pull-requests: write # Required for the downstream engine to add comments or update metadata on the PR + uses: MetOffice/growss/.github/workflows/track-review-project.yaml@develop + secrets: + PROJECT_ACTION_PAT: ${{ secrets.PROJECT_ACTION_PAT }} diff --git a/.github/workflows/trigger-project-workflow.yaml b/.github/workflows/trigger-project-workflow.yaml index ccb7a55..87b1a6d 100644 --- a/.github/workflows/trigger-project-workflow.yaml +++ b/.github/workflows/trigger-project-workflow.yaml @@ -1,3 +1,9 @@ +# ----------------------------------------------------------------------------- +# (C) Crown copyright Met Office. All rights reserved. +# The file LICENCE, distributed with this code, contains details of the terms +# under which the code may be used. +# ----------------------------------------------------------------------------- + name: Trigger Review Project on: @@ -7,11 +13,14 @@ on: pull_request_review_comment: permissions: - actions: read - contents: read - pull-requests: write + contents: read # Required to evaluate the event trigger metadata safely jobs: trigger_project_workflow: - uses: MetOffice/growss/.github/workflows/trigger-project-workflow.yaml@main - secrets: inherit + if: github.repository == 'MetOffice/casim' + + permissions: + actions: read # Required to check out code or parse files safely + contents: read # Required to read the upstream triggered workflow run artifact status + pull-requests: write # Required for the downstream engine to add comments or update metadata on the PR + uses: MetOffice/growss/.github/workflows/trigger-project-workflow.yaml@develop diff --git a/.github/zizmor.yml b/.github/zizmor.yml new file mode 100644 index 0000000..105a31d --- /dev/null +++ b/.github/zizmor.yml @@ -0,0 +1,23 @@ +# ------------------------------------------------------------------------------ +# (c) Crown copyright Met Office. All rights reserved. +# The file LICENCE, distributed with this code, contains details of the terms +# under which the code may be used. +# ------------------------------------------------------------------------------ + +# Rules for Zizmor GitHub workflow linter. This file is used to configure which +# rules to ignore for specific workflow files, allowing for exceptions to be +# made where necessary while still enforcing best practices across the codebase. +rules: + unpinned-uses: + ignore: + - "check-cr-approved.yaml" + - "cla-check.yaml" + - "lint-fortran.yaml" + - "track-review-project.yaml" + - "trigger-project-workflow.yaml" + dangerous-triggers: + ignore: + - "cla-check.yaml" + - "lint-fortran.yaml" + - "track-review-project.yaml" + - "trigger-project-workflow.yaml" diff --git a/CONTRIBUTORS.md b/CONTRIBUTORS.md index c1d9657..151a8e9 100644 --- a/CONTRIBUTORS.md +++ b/CONTRIBUTORS.md @@ -1,7 +1,8 @@ # Contributors -| GitHub user | Real Name | Affiliation | Date | -| ----------- | --------- | ----------- | ---- | -| james-bruten-mo | James Bruten | Met Office | 2025-12-09 | -| t00sa | Sam Clarke-Green | Met Office | 2026-03-02 | -| Pierre-siddall| Pierre Siddall | Met Office | 2026-03-11 | +| GitHub user | Real Name | Affiliation | Date | +| --------------- | ---------------- | ----------- | ---------- | +| james-bruten-mo | James Bruten | Met Office | 2025-12-09 | +| t00sa | Sam Clarke-Green | Met Office | 2026-03-02 | +| Pierre-siddall | Pierre Siddall | Met Office | 2026-03-11 | +| yaswant | Yaswant Pradhan | Met Office | 2027-07-17 | diff --git a/README.md b/README.md index d28bf0c..ecb4eff 100644 --- a/README.md +++ b/README.md @@ -1,5 +1,7 @@ # CASIM +[![Checks](https://github.com/MetOffice/casim/actions/workflows/lint-fortran.yaml/badge.svg)](https://github.com/MetOffice/casim/actions/workflows/lint-fortran.yaml) + The Cloud and AeroSol Interacting Microphysics (CASIM), a component of MONC (the Met Office - NERC Cloud Model). From 0bca71522b8c7f07e8de46c03ea6c2ec044af87c Mon Sep 17 00:00:00 2001 From: yaswant <2984440+yaswant@users.noreply.github.com> Date: Wed, 22 Jul 2026 16:18:04 +0100 Subject: [PATCH 2/2] Update GitHub workflows to use specific version references and adjust permissions --- .github/workflows/check-cr-approved.yaml | 3 ++- .github/workflows/cla-check.yaml | 4 +--- .github/workflows/lint-fortran.yaml | 4 +--- .github/workflows/track-review-project.yaml | 2 +- .github/workflows/trigger-project-workflow.yaml | 2 +- .github/zizmor.yml | 7 ------- 6 files changed, 6 insertions(+), 16 deletions(-) diff --git a/.github/workflows/check-cr-approved.yaml b/.github/workflows/check-cr-approved.yaml index 50b2258..e4c9a21 100644 --- a/.github/workflows/check-cr-approved.yaml +++ b/.github/workflows/check-cr-approved.yaml @@ -15,5 +15,6 @@ jobs: check_cr_approved: permissions: contents: read # Required to evaluate the event trigger metadata safely + pull-requests: read if: ${{ github.event.pull_request.number }} - uses: MetOffice/growss/.github/workflows/check-cr-approved.yaml@develop + uses: MetOffice/growss/.github/workflows/check-cr-approved.yaml@0f9ffe6a138ae9943053621916a850a075997db8 # v1.0.0 diff --git a/.github/workflows/cla-check.yaml b/.github/workflows/cla-check.yaml index 3bb04d6..3817748 100644 --- a/.github/workflows/cla-check.yaml +++ b/.github/workflows/cla-check.yaml @@ -24,6 +24,4 @@ jobs: permissions: contents: read # Required to evaluate the event trigger metadata safely pull-requests: write # Required for the downstream engine to post status comments on the PR - uses: MetOffice/growss/.github/workflows/cla-check.yaml@develop - with: - runner: 'ubuntu-24.04' + uses: MetOffice/growss/.github/workflows/cla-check.yaml@0f9ffe6a138ae9943053621916a850a075997db8 # v1.0.0 diff --git a/.github/workflows/lint-fortran.yaml b/.github/workflows/lint-fortran.yaml index 5600ab3..c0a46c4 100644 --- a/.github/workflows/lint-fortran.yaml +++ b/.github/workflows/lint-fortran.yaml @@ -13,6 +13,4 @@ jobs: fortitude-lint: permissions: contents: read # Required to evaluate the event trigger metadata safely - uses: MetOffice/growss/.github/workflows/fortran-lint.yaml@develop - with: - runner: 'ubuntu-24.04' + uses: MetOffice/growss/.github/workflows/fortran-lint.yaml@0f9ffe6a138ae9943053621916a850a075997db8 # v1.0.0 diff --git a/.github/workflows/track-review-project.yaml b/.github/workflows/track-review-project.yaml index 0a0bc1d..1ab6012 100644 --- a/.github/workflows/track-review-project.yaml +++ b/.github/workflows/track-review-project.yaml @@ -21,6 +21,6 @@ jobs: actions: read # Required to check out code or parse files safely contents: read # Required to read the upstream triggered workflow run artifact status pull-requests: write # Required for the downstream engine to add comments or update metadata on the PR - uses: MetOffice/growss/.github/workflows/track-review-project.yaml@develop + uses: MetOffice/growss/.github/workflows/track-review-project.yaml@0f9ffe6a138ae9943053621916a850a075997db8 # v1.0.0 secrets: PROJECT_ACTION_PAT: ${{ secrets.PROJECT_ACTION_PAT }} diff --git a/.github/workflows/trigger-project-workflow.yaml b/.github/workflows/trigger-project-workflow.yaml index 87b1a6d..ab53cc0 100644 --- a/.github/workflows/trigger-project-workflow.yaml +++ b/.github/workflows/trigger-project-workflow.yaml @@ -23,4 +23,4 @@ jobs: actions: read # Required to check out code or parse files safely contents: read # Required to read the upstream triggered workflow run artifact status pull-requests: write # Required for the downstream engine to add comments or update metadata on the PR - uses: MetOffice/growss/.github/workflows/trigger-project-workflow.yaml@develop + uses: MetOffice/growss/.github/workflows/trigger-project-workflow.yaml@0f9ffe6a138ae9943053621916a850a075997db8 # v1.0.0 diff --git a/.github/zizmor.yml b/.github/zizmor.yml index 105a31d..16ed4d9 100644 --- a/.github/zizmor.yml +++ b/.github/zizmor.yml @@ -8,13 +8,6 @@ # rules to ignore for specific workflow files, allowing for exceptions to be # made where necessary while still enforcing best practices across the codebase. rules: - unpinned-uses: - ignore: - - "check-cr-approved.yaml" - - "cla-check.yaml" - - "lint-fortran.yaml" - - "track-review-project.yaml" - - "trigger-project-workflow.yaml" dangerous-triggers: ignore: - "cla-check.yaml"