diff --git a/.github/pull_request_template.md b/.github/pull_request_template.md index e3f44db6..7427f114 100644 --- a/.github/pull_request_template.md +++ b/.github/pull_request_template.md @@ -1,5 +1,7 @@ # PR Summary + + Sci/Tech Reviewer: Code Reviewer: @@ -26,20 +28,16 @@ Code Reviewer: - [ ] I have performed a self-review of my own code - [ ] My code follows the project's style guidelines -- [ ] Comments have been included that aid undertanding and enhance the - readability of the code +- [ ] Comments have been included that aid understanding and enhance the readability of the code - [ ] My changes generate no new warnings - [ ] If editing `rose-meta/jules-shared` then have you supplied a linked UM and LFRic Apps PR? ## Testing - [ ] I have tested this change locally, using the JULES rose-stem suite -- [ ] If shared files have been modified, I have run the UM and LFRic Apps rose - stem suites -- [ ] If any tests fail (rose-stem or CI) the reason is understood and - acceptable (eg. kgo changes) -- [ ] I have added tests to cover new functionality as appropriate (eg. system - tests, unit tests, etc.) +- [ ] If shared files have been modified, I have run the UM and LFRic Apps rose stem suites +- [ ] If any tests fail (rose-stem or CI) the reason is understood and acceptable (eg. kgo changes) +- [ ] I have added tests to cover new functionality as appropriate (eg. system tests, unit tests, etc.) @@ -55,28 +53,21 @@ Code Reviewer: ## Performance Impact -- [ ] Performance of the code has been considered and, if applicable, suitable - performance measurements have been conducted +- [ ] Performance of the code has been considered and, if applicable, suitable performance measurements have been conducted ## AI Assistance and Attribution -- [ ] Some of the content of this change has been produced with the assistance - of _Generative AI tool name_ (e.g., Met Office Github Copilot Enterprise, - Github Copilot Personal, ChatGPT GPT-4, etc) and I have followed the - [Simulation Systems AI policy](https://metoffice.github.io/simulation-systems/FurtherDetails/ai.html) - (including attribution labels) +- [ ] Some of the content of this change has been produced with the assistance of _Generative AI tool name_ (e.g., Met Office Github Copilot Enterprise, Github Copilot Personal, ChatGPT GPT-4, etc) and I have followed the [Simulation Systems AI policy](https://metoffice.github.io/simulation-systems/FurtherDetails/ai.html) (including attribution labels) ## Documentation -- [ ] Where appropriate I have updated documentation related to this change and - confirmed that it builds correctly +- [ ] Where appropriate I have updated documentation related to this change and confirmed that it builds correctly ## Approvals -Please request all relevant approvals. See the CodeOwners.txt file for section -owners. +Please request all relevant approvals. See the CodeOwners.txt file for section owners. ### Technical @@ -93,7 +84,7 @@ owners. - [ ] Hydrology - [ ] Vegetation - [ ] Veg3 RED Demography -- [ ] Biogechemistry +- [ ] Biogeochemistry - [ ] Biogenic fluxes - [ ] Fire - [ ] Lakes diff --git a/.github/workflows/check-cr-approved.yaml b/.github/workflows/check-cr-approved.yaml index 9b66712a..11fdb34c 100644 --- a/.github/workflows/check-cr-approved.yaml +++ b/.github/workflows/check-cr-approved.yaml @@ -1,11 +1,20 @@ +# ----------------------------------------------------------------------------- +# (C) Crown copyright Met Office. All rights reserved. +# The file LICENCE, distributed with this code, contains details of the terms +# under which the code may be used. +# ----------------------------------------------------------------------------- + name: Check CR approved on: - pull_request_review: - types: [submitted, edited, dismissed] - workflow_dispatch: + pull_request_review: + types: [submitted, edited, dismissed] + workflow_dispatch: jobs: - check_cr_approved: - if: ${{ github.event.pull_request.number }} - uses: MetOffice/growss/.github/workflows/check-cr-approved.yaml@main + check_cr_approved: + permissions: + contents: read # Required to evaluate the event trigger metadata safely + pull-requests: read # Required to read pull request details + if: ${{ github.event.pull_request.number }} + uses: MetOffice/growss/.github/workflows/check-cr-approved.yaml@0f9ffe6a138ae9943053621916a850a075997db8 # v1.0.0 diff --git a/.github/workflows/cla-check.yaml b/.github/workflows/cla-check.yaml index 18878145..aa7e3118 100644 --- a/.github/workflows/cla-check.yaml +++ b/.github/workflows/cla-check.yaml @@ -1,10 +1,29 @@ +# ----------------------------------------------------------------------------- +# (C) Crown copyright Met Office. All rights reserved. +# The file LICENCE, distributed with this code, contains details of the terms +# under which the code may be used. +# ----------------------------------------------------------------------------- + +# Check Contributor Licence Agreement + name: Legal on: pull_request_target: +concurrency: + # Automatically cancels the workflow run instantly before the + # engine can parse empty jobs and generate notification emails + group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.sha }} + cancel-in-progress: ${{ github.event.pull_request.head.repo.full_name != 'MetOffice/jules' }} + +permissions: {} + jobs: cla: - uses: MetOffice/growss/.github/workflows/cla-check.yaml@main + permissions: + contents: read # Required to evaluate the event trigger metadata safely + pull-requests: write # Required for the downstream engine to post status comments on the PR + uses: MetOffice/growss/.github/workflows/cla-check.yaml@0f9ffe6a138ae9943053621916a850a075997db8 # v1.0.0 with: cla-url: 'https://github.com/MetOffice/jules/blob/main/CLA.md' diff --git a/.github/workflows/track-review-project.yaml b/.github/workflows/track-review-project.yaml index 639477cd..1ab60122 100644 --- a/.github/workflows/track-review-project.yaml +++ b/.github/workflows/track-review-project.yaml @@ -1,3 +1,9 @@ +# ----------------------------------------------------------------------------- +# (C) Crown copyright Met Office. All rights reserved. +# The file LICENCE, distributed with this code, contains details of the terms +# under which the code may be used. +# ----------------------------------------------------------------------------- + name: Track Review Project on: @@ -7,11 +13,14 @@ on: - completed permissions: - actions: read - contents: read - pull-requests: write + contents: read # Required to evaluate the event trigger metadata safely jobs: track_review_project: - uses: MetOffice/growss/.github/workflows/track-review-project.yaml@main - secrets: inherit + permissions: + actions: read # Required to check out code or parse files safely + contents: read # Required to read the upstream triggered workflow run artifact status + pull-requests: write # Required for the downstream engine to add comments or update metadata on the PR + uses: MetOffice/growss/.github/workflows/track-review-project.yaml@0f9ffe6a138ae9943053621916a850a075997db8 # v1.0.0 + secrets: + PROJECT_ACTION_PAT: ${{ secrets.PROJECT_ACTION_PAT }} diff --git a/.github/workflows/trigger-project-workflow.yaml b/.github/workflows/trigger-project-workflow.yaml index ccb7a55b..69e58c93 100644 --- a/.github/workflows/trigger-project-workflow.yaml +++ b/.github/workflows/trigger-project-workflow.yaml @@ -1,3 +1,9 @@ +# ----------------------------------------------------------------------------- +# (C) Crown copyright Met Office. All rights reserved. +# The file LICENCE, distributed with this code, contains details of the terms +# under which the code may be used. +# ----------------------------------------------------------------------------- + name: Trigger Review Project on: @@ -7,11 +13,14 @@ on: pull_request_review_comment: permissions: - actions: read - contents: read - pull-requests: write + contents: read # Required to evaluate the event trigger metadata safely jobs: trigger_project_workflow: - uses: MetOffice/growss/.github/workflows/trigger-project-workflow.yaml@main - secrets: inherit + if: github.repository == 'MetOffice/jules' + + permissions: + actions: read # Required to check out code or parse files safely + contents: read # Required to read the upstream triggered workflow run artifact status + pull-requests: write # Required for the downstream engine to add comments or update metadata on the PR + uses: MetOffice/growss/.github/workflows/trigger-project-workflow.yaml@0f9ffe6a138ae9943053621916a850a075997db8 # v1.0.0 diff --git a/.github/workflows/umdp3_fixer.yaml b/.github/workflows/umdp3_fixer.yaml index 6f265be6..da2938f5 100644 --- a/.github/workflows/umdp3_fixer.yaml +++ b/.github/workflows/umdp3_fixer.yaml @@ -1,10 +1,18 @@ +# ----------------------------------------------------------------------------- +# (C) Crown copyright Met Office. All rights reserved. +# The file LICENCE, distributed with this code, contains details of the terms +# under which the code may be used. +# ----------------------------------------------------------------------------- + name: umdp3 Fixer on: - pull_request: - types: [opened, synchronize, reopened] - workflow_dispatch: + pull_request: + types: [opened, synchronize, reopened] + workflow_dispatch: jobs: - umdp3_fixer: - uses: MetOffice/growss/.github/workflows/umdp3_fixer.yaml@main + umdp3_fixer: + permissions: + contents: read + uses: MetOffice/growss/.github/workflows/umdp3_fixer.yaml@0f9ffe6a138ae9943053621916a850a075997db8 # v1.0.0 diff --git a/.github/workflows/user-guide.yaml b/.github/workflows/user-guide.yaml index 345965a9..4077ef2d 100644 --- a/.github/workflows/user-guide.yaml +++ b/.github/workflows/user-guide.yaml @@ -42,33 +42,33 @@ jobs: steps: - name: Check deployment conditions id: check-deploy + env: + GH_REPOSITORY: ${{ github.repository }} + GH_REF_NAME: ${{ github.ref_name }} + GH_EVENT_NAME: ${{ github.event_name }} run: | - if [[ "${{ github.repository }}" == "MetOffice/jules" && ("${{ github.ref_name }}" == "main" || "${{ github.ref_name }}" == "stable") && ("${{ github.event_name }}" == "push" || "${{ github.event_name }}" == "merge_group" || "${{ github.event_name }}" == "release" || "${{ github.event_name }}" == "workflow_dispatch") ]]; then + if [[ "$GH_REPOSITORY" == "MetOffice/jules" && ("$GH_REF_NAME" == "main" || "$GH_REF_NAME" == "stable") && ("$GH_EVENT_NAME" == "push" || "$GH_EVENT_NAME" == "merge_group" || "$GH_EVENT_NAME" == "release" || "$GH_EVENT_NAME" == "workflow_dispatch") ]]; then echo "should-deploy=true" >> $GITHUB_OUTPUT else echo "should-deploy=false" >> $GITHUB_OUTPUT fi - name: Checkout repository - uses: actions/checkout@v6 + uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 with: path: ${{ env.JULES_PATH }} # Get all refs to build historic versions fetch-depth: 0 + persist-credentials: false - name: Setup uv with Python ${{ env.PYTHON_VRSN }} - uses: astral-sh/setup-uv@v7 + uses: astral-sh/setup-uv@11f9893b081a58869d3b5fccaea48c9e9e46f990 # v8.3.2 with: python-version: ${{ env.PYTHON_VRSN }} - - - name: Cache uv venv - uses: actions/cache@v4 - with: - path: ${{ env.VENV_PATH }} - key: ${{ runner.os }}-uv-${{ env.PYTHON_VRSN }}-${{ hashFiles('doc/pyproject.toml', 'doc/uv.lock') }} - restore-keys: | - ${{ runner.os }}-uv-${{ env.PYTHON_VRSN }}- - ${{ runner.os }}-uv- + enable-cache: false + cache-dependency-glob: | + doc/pyproject.toml + doc/uv.lock - name: Install dependencies working-directory: ${{ env.JULES_PATH }}/doc @@ -119,11 +119,11 @@ jobs: # -- Deploy to GitHub Pages only on push to upstream main - name: Setup GitHub Pages if: steps.check-deploy.outputs.should-deploy == 'true' - uses: actions/configure-pages@v5 + uses: actions/configure-pages@45bfe0192ca1faeb007ade9deae92b16b8254a0d # v6.0.0 - name: Upload artifact to GitHub Pages if: steps.check-deploy.outputs.should-deploy == 'true' - uses: actions/upload-pages-artifact@v4 + uses: actions/upload-pages-artifact@fc324d3547104276b827a68afc52ff2a11cc49c9 # v5.0.0 with: name: github-pages path: ${{ env.OUTPUT_PATH }} @@ -133,4 +133,4 @@ jobs: - name: Deploy to GitHub Pages id: deployment if: steps.check-deploy.outputs.should-deploy == 'true' - uses: actions/deploy-pages@v4 + uses: actions/deploy-pages@cd2ce8fcbc39b97be8ca5fce6e763baed58fa128 # v5.0.0 diff --git a/.github/zizmor.yml b/.github/zizmor.yml new file mode 100644 index 00000000..e66c5e79 --- /dev/null +++ b/.github/zizmor.yml @@ -0,0 +1,15 @@ +# ------------------------------------------------------------------------------ +# (c) Crown copyright Met Office. All rights reserved. +# The file LICENCE, distributed with this code, contains details of the terms +# under which the code may be used. +# ------------------------------------------------------------------------------ + +# Rules for Zizmor GitHub workflow linter. This file is used to configure which +# rules to ignore for specific workflow files, allowing for exceptions to be +# made where necessary while still enforcing best practices across the codebase. +rules: + dangerous-triggers: + ignore: + - "cla-check.yaml" + - "track-review-project.yaml" + - "trigger-project-workflow.yaml" diff --git a/doc/pyproject.toml b/doc/pyproject.toml index 3a2acaff..66d007c5 100644 --- a/doc/pyproject.toml +++ b/doc/pyproject.toml @@ -9,5 +9,11 @@ dependencies = [ "sphinx==8.2.3", "sphinx-lint==1.0.1", ] + +[project.urls] +repository = "https://github.com/MetOffice/jules" +documentation = "https://metoffice.github.io/jules/" +discussion = "https://github.com/MetOffice/simulation-systems/discussions/categories/jules" + [tool.setuptools] packages = []