Update GitHub Actions workflows

[Yaswant Pradhan (yaswant)]

PR Summary

Align repository actions with MetOffice/growss#80

Code Reviewer: James Bruten (@james-bruten-mo)

• linked Enhance reusable workflows growss#80

Code Quality Checklist

(Some checks are automatically carried out via the CI pipeline)

• I have performed a self-review of my own code
• My code follows the project's style guidelines
• Comments have been included that aid undertanding and enhance the
  readability of the code
• My changes generate no new warnings
• If editing rose-meta/jules-shared then have you supplied a linked UM and LFRic Apps PR?

Testing

• I have tested this change locally, using the JULES rose-stem suite
• If shared files have been modified, I have run the UM and LFRic Apps rose
  stem suites
• If any tests fail (rose-stem or CI) the reason is understood and
  acceptable (eg. kgo changes)
• I have added tests to cover new functionality as appropriate (eg. system
  tests, unit tests, etc.)

trac.log

Security Considerations

• I have reviewed my changes for potential security issues
• Sensitive data is properly handled (if applicable)
• Authentication and authorisation are properly implemented (if applicable)

Performance Impact

• Performance of the code has been considered and, if applicable, suitable
  performance measurements have been conducted

AI Assistance and Attribution

• Some of the content of this change has been produced with the assistance
  of Generative AI tool name (e.g., Met Office Github Copilot Enterprise,
  Github Copilot Personal, ChatGPT GPT-4, etc) and I have followed the
  Simulation Systems AI policy
  (including attribution labels)

Documentation

• Where appropriate I have updated documentation related to this change and
  confirmed that it builds correctly

Approvals

Please request all relevant approvals. See the CodeOwners.txt file for section
owners.

Technical

• JULES Code Owner
• OpenMP
• River Routing
• Rose Stem
• Rose Metadata
• Upgrade Macros

Scientific

• Surface
• Hydrology
• Vegetation
• Veg3 RED Demography
• Biogechemistry
• Biogenic fluxes
• Fire
• Lakes
• Evaluation
• Imogen

Sci/Tech Review

• I understand this area of code and the changes being added
• The proposed changes correspond to the pull request description
• Documentation is sufficient (do documentation papers need updating)
• Sufficient testing has been completed

Please alert the code reviewer via a tag when you have approved the SR

Code Review

• All dependencies have been resolved
• Related Issues have been properly linked and addressed
• CLA compliance has been confirmed
• Code quality standards have been met
• Tests are adequate and have passed
• Documentation is complete and accurate
• Security considerations have been addressed
• Performance impact is acceptable

[Copilot]

Pull request overview

Updates this repository’s GitHub Actions configuration to align with MetOffice/growss#80, focusing on workflow hardening and consistency across shared/reusable workflows.

Changes:

• Add Zizmor configuration and update multiple workflows (permissions/concurrency/guards) to match the shared approach in growss.
• Pin several third-party actions in the user-guide workflow and adjust how deployment conditions are evaluated.
• Improve metadata/docs hygiene (Sphinx doc project URLs; PR template wording/formatting tweaks).

Reviewed changes

Copilot reviewed 9 out of 9 changed files in this pull request and generated 7 comments.

Show a summary per file

File	Description
doc/pyproject.toml	Adds project.urls metadata for repository/docs/discussions.
.github/zizmor.yml	Introduces Zizmor linter rule configuration and per-workflow ignore lists.
.github/workflows/user-guide.yaml	Pins key actions by SHA; tweaks deploy-condition logic and checkout configuration.
.github/workflows/umdp3_fixer.yaml	Adds header/permissions and switches reusable workflow ref to @develop.
.github/workflows/trigger-project-workflow.yaml	Adds header, narrows top-level permissions, adds repo guard, switches reusable workflow ref to @develop.
.github/workflows/track-review-project.yaml	Adds header/permissions, passes PAT secret explicitly, switches reusable workflow ref to @develop.
.github/workflows/cla-check.yaml	Adds header/concurrency hardening and switches reusable workflow ref to @develop.
.github/workflows/check-cr-approved.yaml	Adds header/permissions and switches reusable workflow ref to @develop.
.github/pull_request_template.md	Adds an “One-line summary” placeholder and fixes/normalizes checklist wording.

Comments suppressed due to low confidence (1)

.github/workflows/check-cr-approved.yaml:20

• This job references an external reusable workflow using the mutable ref @develop. Pinning uses: to an immutable commit SHA (or signed/release tag) is recommended to avoid unreviewed changes being pulled in at runtime.

    permissions:
      contents: read  # Required to evaluate the event trigger metadata safely
    if: ${{ github.event.pull_request.number }}
    uses: MetOffice/growss/.github/workflows/check-cr-approved.yaml@develop

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.