Refactor GitHub workflows

.github/CODEOWNERS

@@ -1,2 +1,3 @@
 # GitHub Action workflows
+
 .github/workflows/ @yaswant @t00sa @MatthewHambley

.github/workflows/cla-check.yaml

@@ -1,11 +1,27 @@
+# -----------------------------------------------------------------------------
+# (C) Crown copyright Met Office. All rights reserved.
+# The file LICENCE, distributed with this code, contains details of the terms
+# under which the code may be used.
+# -----------------------------------------------------------------------------
+
+# Check Contributor Licence Agreement
+
 name: Legal
 
 on:
   pull_request_target:
 
+concurrency:
+  # Automatically cancels the workflow run instantly before the
+  # engine can parse empty jobs and generate notification emails
+  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.sha }}
+  cancel-in-progress: ${{ github.event.pull_request.head.repo.full_name != 'MetOffice/fab' }}
+
+permissions: {}
+
 jobs:
   cla:
-    uses: MetOffice/growss/.github/workflows/cla-check.yaml@main
-    with:
-      runner: 'ubuntu-24.04'
-      cla-url: 'https://github.com/MetOffice/Momentum/blob/main/CLA.md'
+    uses: MetOffice/growss/.github/workflows/cla-check.yaml@0f9ffe6a138ae9943053621916a850a075997db8 # v1.0.0
+    permissions:
+      contents: read  # Required to evaluate the event trigger metadata safely
+      pull-requests: write  # Required for the downstream engine to post status comments on the PR

.github/workflows/documentation.yml

@@ -1,3 +1,9 @@
+# ------------------------------------------------------------------------------
+# (c) Crown copyright Met Office. All rights reserved.
+# The file LICENCE, distributed with this code, contains details of the terms
+# under which the code may be used.
+# ------------------------------------------------------------------------------
+
 name: Documentation
 
 permissions:
@@ -7,71 +13,66 @@ on:
   push:
     branches:
       - 'main'
+  pull_request:
+    branches:
+      - 'main'
   workflow_dispatch:
 
 concurrency:
-  group: ${{ github.ref }}
-  cancel-in-progress: ${{ github.ref != 'refs/heads/main' }}
+  group: ${{ github.workflow }}-${{ github.head_ref || github.run_id }}
+  cancel-in-progress: true
 
 jobs:
   sphinx-build:
     name: Build
     runs-on: ubuntu-24.04
 
-    env:
-      cache-name: python-docs-cache
-
     steps:
-    - name: Cache Python packages
-      uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.5
-      with:
-        path: ~/.pip/cache
-        key: ${{ runner.os }}-build-${{ env.cache-name }}-${{ hashFiles('**/pyproject.toml') }}
-
-    - name: Install Python
-      uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
-      with:
-        python-version: '3.14'
-
-    - name: Check out Fab source
-      uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
-      with:
-        persist-credentials: false
+      - name: Check out Fab source
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        with:
+          persist-credentials: false
 
-    - name: Install documentation tools
-      run: pip install .[docs]
+      - name: Set up uv and Python
+        uses: astral-sh/setup-uv@11f9893b081a58869d3b5fccaea48c9e9e46f990 # v8.3.2
+        with:
+          python-version: '3.14'
+          enable-cache: true
 
-    - name: Install LaTeX packages
-      run: |
-        sudo apt-get update -y
-        sudo apt-get install -y \
-          librsvg2-bin \
-          texlive-latex-base \
-          texlive-latex-recommended \
-          texlive-fonts-recommended \
-          texlive-latex-extra \
-          latexmk
+      - name: Install documentation tools
+        run: uv sync --extra docs
 
-    - name: Build HTML documentation
-      working-directory: Documentation
-      run: make clean html
+      - name: Build HTML documentation
+        working-directory: Documentation
+        run: uv run make clean html
 
-    - name: Build PDF documentation
-      working-directory: Documentation
-      run: make latexpdf
+      - name: Install LaTeX packages for PDF generation
+        if: github.event_name != 'pull_request'
+        run: |
+          sudo apt-get update -y
+          sudo apt-get install -y \
+            librsvg2-bin \
+            texlive-latex-base \
+            texlive-latex-recommended \
+            texlive-fonts-recommended \
+            texlive-latex-extra \
+            latexmk
 
-    - name: Copy PDF to HTML build directory
-      working-directory: Documentation
-      run: cp -r build/latex build/html/
+      - name: Generate PDF documentation
+        if: github.event_name != 'pull_request'
+        working-directory: Documentation
+        run: |
+          uv run make latexpdf
+          cp -r build/latex build/html/
 
-    - name: Prepare and upload asset
-      uses: actions/upload-pages-artifact@fc324d3547104276b827a68afc52ff2a11cc49c9 # v5.0.0
-      with:
-        path: Documentation/build/html
+      - name: Prepare and upload asset
+        uses: actions/upload-pages-artifact@fc324d3547104276b827a68afc52ff2a11cc49c9 # v5.0.0
+        with:
+          path: Documentation/build/html
 
   deploy-documentation:
     name: Deploy
-    if: github.repository == 'MetOffice/fab'
+    if: github.repository == 'MetOffice/fab' && github.event_name != 'pull_request' && github.ref == 'refs/heads/main'
     permissions:
       pages: write # Required to write and publish compiled HTML/PDF artifacts
       id-token: write # Required to securely mint the OpenID Connect (OIDC) token

.github/zizmor.yml

@@ -0,0 +1,13 @@
+# ------------------------------------------------------------------------------
+# (c) Crown copyright Met Office. All rights reserved.
+# The file LICENCE, distributed with this code, contains details of the terms
+# under which the code may be used.
+# ------------------------------------------------------------------------------
+
+# Rules for Zizmor GitHub workflow linter. This file is used to configure which
+# rules to ignore for specific workflow files, allowing for exceptions to be
+# made where necessary while still enforcing best practices across the codebase.
+rules:
+  dangerous-triggers:
+    ignore:
+      - "cla-check.yaml"

CONTRIBUTORS.md

@@ -13,6 +13,7 @@ If you are not submitting contributions on behalf of an organisation please use
 | GitHub Username | Real Name       | Affiliation |
 |-----------------|-----------------|-------------|
 | MatthewHambley  | Matthew Hambley | Met Office  |
+| yaswant         | Yaswant Pradhan | Met Office  |
 
 ---
 

pyproject.toml

@@ -8,7 +8,7 @@ description = "Build system for scientific software"
 authors = [
     {name = "Core Capabilities Development Team", email = 'CoreCapabilityDevelopmentTeam@metoffice.gov.uk'}
 ]
-license = {file = 'LICENSE'}
+license = {file = 'LICENCE'}
 dynamic = ['version', 'readme']
 requires-python = '>=3.9, <4'
 dependencies = ['fparser >= 0.2']