From 0247fc1d589bd7878aabbffcd44e4397c3164f9b Mon Sep 17 00:00:00 2001 From: yaswant <2984440+yaswant@users.noreply.github.com> Date: Fri, 17 Jul 2026 01:49:23 +0100 Subject: [PATCH 1/3] Update GitHub Actions workflows --- .github/workflows/check-cr-approved.yaml | 20 +++++++--- .github/workflows/cla-check.yaml | 21 +++++++++- .github/workflows/track-review-project.yaml | 19 ++++++--- .../workflows/trigger-project-workflow.yaml | 19 ++++++--- .github/workflows/umdp3_fixer.yaml | 18 ++++++--- .github/workflows/user-guide.yaml | 39 ++++++++++++------- .github/zizmor.yml | 23 +++++++++++ doc/pyproject.toml | 6 +++ 8 files changed, 128 insertions(+), 37 deletions(-) create mode 100644 .github/zizmor.yml diff --git a/.github/workflows/check-cr-approved.yaml b/.github/workflows/check-cr-approved.yaml index 9b66712a..50b22580 100644 --- a/.github/workflows/check-cr-approved.yaml +++ b/.github/workflows/check-cr-approved.yaml @@ -1,11 +1,19 @@ +# ----------------------------------------------------------------------------- +# (C) Crown copyright Met Office. All rights reserved. +# The file LICENCE, distributed with this code, contains details of the terms +# under which the code may be used. +# ----------------------------------------------------------------------------- + name: Check CR approved on: - pull_request_review: - types: [submitted, edited, dismissed] - workflow_dispatch: + pull_request_review: + types: [submitted, edited, dismissed] + workflow_dispatch: jobs: - check_cr_approved: - if: ${{ github.event.pull_request.number }} - uses: MetOffice/growss/.github/workflows/check-cr-approved.yaml@main + check_cr_approved: + permissions: + contents: read # Required to evaluate the event trigger metadata safely + if: ${{ github.event.pull_request.number }} + uses: MetOffice/growss/.github/workflows/check-cr-approved.yaml@develop diff --git a/.github/workflows/cla-check.yaml b/.github/workflows/cla-check.yaml index 18878145..23334842 100644 --- a/.github/workflows/cla-check.yaml +++ b/.github/workflows/cla-check.yaml @@ -1,10 +1,29 @@ +# ----------------------------------------------------------------------------- +# (C) Crown copyright Met Office. All rights reserved. +# The file LICENCE, distributed with this code, contains details of the terms +# under which the code may be used. +# ----------------------------------------------------------------------------- + +# Check Contributor Licence Agreement + name: Legal on: pull_request_target: +concurrency: + # Automatically cancels the workflow run instantly before the + # engine can parse empty jobs and generate notification emails + group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.sha }} + cancel-in-progress: ${{ github.event.pull_request.head.repo.full_name != 'MetOffice/jules' }} + +permissions: {} + jobs: cla: - uses: MetOffice/growss/.github/workflows/cla-check.yaml@main + permissions: + contents: read # Required to evaluate the event trigger metadata safely + pull-requests: write # Required for the downstream engine to post status comments on the PR + uses: MetOffice/growss/.github/workflows/cla-check.yaml@develop with: cla-url: 'https://github.com/MetOffice/jules/blob/main/CLA.md' diff --git a/.github/workflows/track-review-project.yaml b/.github/workflows/track-review-project.yaml index 639477cd..0a0bc1de 100644 --- a/.github/workflows/track-review-project.yaml +++ b/.github/workflows/track-review-project.yaml @@ -1,3 +1,9 @@ +# ----------------------------------------------------------------------------- +# (C) Crown copyright Met Office. All rights reserved. +# The file LICENCE, distributed with this code, contains details of the terms +# under which the code may be used. +# ----------------------------------------------------------------------------- + name: Track Review Project on: @@ -7,11 +13,14 @@ on: - completed permissions: - actions: read - contents: read - pull-requests: write + contents: read # Required to evaluate the event trigger metadata safely jobs: track_review_project: - uses: MetOffice/growss/.github/workflows/track-review-project.yaml@main - secrets: inherit + permissions: + actions: read # Required to check out code or parse files safely + contents: read # Required to read the upstream triggered workflow run artifact status + pull-requests: write # Required for the downstream engine to add comments or update metadata on the PR + uses: MetOffice/growss/.github/workflows/track-review-project.yaml@develop + secrets: + PROJECT_ACTION_PAT: ${{ secrets.PROJECT_ACTION_PAT }} diff --git a/.github/workflows/trigger-project-workflow.yaml b/.github/workflows/trigger-project-workflow.yaml index ccb7a55b..968755cb 100644 --- a/.github/workflows/trigger-project-workflow.yaml +++ b/.github/workflows/trigger-project-workflow.yaml @@ -1,3 +1,9 @@ +# ----------------------------------------------------------------------------- +# (C) Crown copyright Met Office. All rights reserved. +# The file LICENCE, distributed with this code, contains details of the terms +# under which the code may be used. +# ----------------------------------------------------------------------------- + name: Trigger Review Project on: @@ -7,11 +13,14 @@ on: pull_request_review_comment: permissions: - actions: read - contents: read - pull-requests: write + contents: read # Required to evaluate the event trigger metadata safely jobs: trigger_project_workflow: - uses: MetOffice/growss/.github/workflows/trigger-project-workflow.yaml@main - secrets: inherit + if: github.repository == 'MetOffice/jules' + + permissions: + actions: read # Required to check out code or parse files safely + contents: read # Required to read the upstream triggered workflow run artifact status + pull-requests: write # Required for the downstream engine to add comments or update metadata on the PR + uses: MetOffice/growss/.github/workflows/trigger-project-workflow.yaml@develop # zizmor: ignore[unpinned-uses] diff --git a/.github/workflows/umdp3_fixer.yaml b/.github/workflows/umdp3_fixer.yaml index 6f265be6..bdb2e795 100644 --- a/.github/workflows/umdp3_fixer.yaml +++ b/.github/workflows/umdp3_fixer.yaml @@ -1,10 +1,18 @@ +# ----------------------------------------------------------------------------- +# (C) Crown copyright Met Office. All rights reserved. +# The file LICENCE, distributed with this code, contains details of the terms +# under which the code may be used. +# ----------------------------------------------------------------------------- + name: umdp3 Fixer on: - pull_request: - types: [opened, synchronize, reopened] - workflow_dispatch: + pull_request: + types: [opened, synchronize, reopened] + workflow_dispatch: jobs: - umdp3_fixer: - uses: MetOffice/growss/.github/workflows/umdp3_fixer.yaml@main + umdp3_fixer: + permissions: + contents: read + uses: MetOffice/growss/.github/workflows/umdp3_fixer.yaml@develop diff --git a/.github/workflows/user-guide.yaml b/.github/workflows/user-guide.yaml index 345965a9..516b87d0 100644 --- a/.github/workflows/user-guide.yaml +++ b/.github/workflows/user-guide.yaml @@ -42,33 +42,42 @@ jobs: steps: - name: Check deployment conditions id: check-deploy + env: + GH_REPOSITORY: ${{ github.repository }} + GH_REF_NAME: ${{ github.ref_name }} + GH_EVENT_NAME: ${{ github.event_name }} run: | - if [[ "${{ github.repository }}" == "MetOffice/jules" && ("${{ github.ref_name }}" == "main" || "${{ github.ref_name }}" == "stable") && ("${{ github.event_name }}" == "push" || "${{ github.event_name }}" == "merge_group" || "${{ github.event_name }}" == "release" || "${{ github.event_name }}" == "workflow_dispatch") ]]; then + if [[ "$GH_REPOSITORY" == "MetOffice/jules" && ("$GH_REF_NAME" == "main" || "$GH_REF_NAME" == "stable") && ("$GH_EVENT_NAME" == "push" || "$GH_EVENT_NAME" == "merge_group" || "$GH_EVENT_NAME" == "release" || "$GH_EVENT_NAME" == "workflow_dispatch") ]]; then echo "should-deploy=true" >> $GITHUB_OUTPUT else echo "should-deploy=false" >> $GITHUB_OUTPUT fi - name: Checkout repository - uses: actions/checkout@v6 + uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 with: path: ${{ env.JULES_PATH }} # Get all refs to build historic versions fetch-depth: 0 + persist-credentials: false - name: Setup uv with Python ${{ env.PYTHON_VRSN }} - uses: astral-sh/setup-uv@v7 + uses: astral-sh/setup-uv@11f9893b081a58869d3b5fccaea48c9e9e46f990 # v8.3.2 with: python-version: ${{ env.PYTHON_VRSN }} - - - name: Cache uv venv - uses: actions/cache@v4 - with: - path: ${{ env.VENV_PATH }} - key: ${{ runner.os }}-uv-${{ env.PYTHON_VRSN }}-${{ hashFiles('doc/pyproject.toml', 'doc/uv.lock') }} - restore-keys: | - ${{ runner.os }}-uv-${{ env.PYTHON_VRSN }}- - ${{ runner.os }}-uv- + enable-cache: false + cache-dependency-glob: | + doc/pyproject.toml + doc/uv.lock + + # - name: Cache uv venv + # uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.5 + # with: + # path: ${{ env.VENV_PATH }} + # key: ${{ runner.os }}-uv-${{ env.PYTHON_VRSN }}-${{ hashFiles('doc/pyproject.toml', 'doc/uv.lock') }} + # restore-keys: | + # ${{ runner.os }}-uv-${{ env.PYTHON_VRSN }}- + # ${{ runner.os }}-uv- - name: Install dependencies working-directory: ${{ env.JULES_PATH }}/doc @@ -119,11 +128,11 @@ jobs: # -- Deploy to GitHub Pages only on push to upstream main - name: Setup GitHub Pages if: steps.check-deploy.outputs.should-deploy == 'true' - uses: actions/configure-pages@v5 + uses: actions/configure-pages@45bfe0192ca1faeb007ade9deae92b16b8254a0d # v6.0.0 - name: Upload artifact to GitHub Pages if: steps.check-deploy.outputs.should-deploy == 'true' - uses: actions/upload-pages-artifact@v4 + uses: actions/upload-pages-artifact@fc324d3547104276b827a68afc52ff2a11cc49c9 # v5.0.0 with: name: github-pages path: ${{ env.OUTPUT_PATH }} @@ -133,4 +142,4 @@ jobs: - name: Deploy to GitHub Pages id: deployment if: steps.check-deploy.outputs.should-deploy == 'true' - uses: actions/deploy-pages@v4 + uses: actions/deploy-pages@cd2ce8fcbc39b97be8ca5fce6e763baed58fa128 # v5.0.0 diff --git a/.github/zizmor.yml b/.github/zizmor.yml new file mode 100644 index 00000000..fa67ee2d --- /dev/null +++ b/.github/zizmor.yml @@ -0,0 +1,23 @@ +# ------------------------------------------------------------------------------ +# (c) Crown copyright Met Office. All rights reserved. +# The file LICENCE, distributed with this code, contains details of the terms +# under which the code may be used. +# ------------------------------------------------------------------------------ + +# Rules for Zizmor GitHub workflow linter. This file is used to configure which +# rules to ignore for specific workflow files, allowing for exceptions to be +# made where necessary while still enforcing best practices across the codebase. +rules: + unpinned-uses: + ignore: + - "check-cr-approved.yaml" + - "cla-check.yaml" + - "sphinx-docs.yaml" + - "track-review-project.yaml" + - "trigger-project-workflow.yaml" + - "umdp3_fixer.yaml" + dangerous-triggers: + ignore: + - "cla-check.yaml" + - "track-review-project.yaml" + - "trigger-project-workflow.yaml" diff --git a/doc/pyproject.toml b/doc/pyproject.toml index 3a2acaff..66d007c5 100644 --- a/doc/pyproject.toml +++ b/doc/pyproject.toml @@ -9,5 +9,11 @@ dependencies = [ "sphinx==8.2.3", "sphinx-lint==1.0.1", ] + +[project.urls] +repository = "https://github.com/MetOffice/jules" +documentation = "https://metoffice.github.io/jules/" +discussion = "https://github.com/MetOffice/simulation-systems/discussions/categories/jules" + [tool.setuptools] packages = [] From 49b533554ee2fbe7b37c8cdb52d00b30d2a46b56 Mon Sep 17 00:00:00 2001 From: yaswant <2984440+yaswant@users.noreply.github.com> Date: Fri, 17 Jul 2026 01:53:56 +0100 Subject: [PATCH 2/3] Update pull request --- .github/pull_request_template.md | 31 +++++++++++-------------------- 1 file changed, 11 insertions(+), 20 deletions(-) diff --git a/.github/pull_request_template.md b/.github/pull_request_template.md index e3f44db6..7427f114 100644 --- a/.github/pull_request_template.md +++ b/.github/pull_request_template.md @@ -1,5 +1,7 @@ # PR Summary + + Sci/Tech Reviewer: Code Reviewer: @@ -26,20 +28,16 @@ Code Reviewer: - [ ] I have performed a self-review of my own code - [ ] My code follows the project's style guidelines -- [ ] Comments have been included that aid undertanding and enhance the - readability of the code +- [ ] Comments have been included that aid understanding and enhance the readability of the code - [ ] My changes generate no new warnings - [ ] If editing `rose-meta/jules-shared` then have you supplied a linked UM and LFRic Apps PR? ## Testing - [ ] I have tested this change locally, using the JULES rose-stem suite -- [ ] If shared files have been modified, I have run the UM and LFRic Apps rose - stem suites -- [ ] If any tests fail (rose-stem or CI) the reason is understood and - acceptable (eg. kgo changes) -- [ ] I have added tests to cover new functionality as appropriate (eg. system - tests, unit tests, etc.) +- [ ] If shared files have been modified, I have run the UM and LFRic Apps rose stem suites +- [ ] If any tests fail (rose-stem or CI) the reason is understood and acceptable (eg. kgo changes) +- [ ] I have added tests to cover new functionality as appropriate (eg. system tests, unit tests, etc.) @@ -55,28 +53,21 @@ Code Reviewer: ## Performance Impact -- [ ] Performance of the code has been considered and, if applicable, suitable - performance measurements have been conducted +- [ ] Performance of the code has been considered and, if applicable, suitable performance measurements have been conducted ## AI Assistance and Attribution -- [ ] Some of the content of this change has been produced with the assistance - of _Generative AI tool name_ (e.g., Met Office Github Copilot Enterprise, - Github Copilot Personal, ChatGPT GPT-4, etc) and I have followed the - [Simulation Systems AI policy](https://metoffice.github.io/simulation-systems/FurtherDetails/ai.html) - (including attribution labels) +- [ ] Some of the content of this change has been produced with the assistance of _Generative AI tool name_ (e.g., Met Office Github Copilot Enterprise, Github Copilot Personal, ChatGPT GPT-4, etc) and I have followed the [Simulation Systems AI policy](https://metoffice.github.io/simulation-systems/FurtherDetails/ai.html) (including attribution labels) ## Documentation -- [ ] Where appropriate I have updated documentation related to this change and - confirmed that it builds correctly +- [ ] Where appropriate I have updated documentation related to this change and confirmed that it builds correctly ## Approvals -Please request all relevant approvals. See the CodeOwners.txt file for section -owners. +Please request all relevant approvals. See the CodeOwners.txt file for section owners. ### Technical @@ -93,7 +84,7 @@ owners. - [ ] Hydrology - [ ] Vegetation - [ ] Veg3 RED Demography -- [ ] Biogechemistry +- [ ] Biogeochemistry - [ ] Biogenic fluxes - [ ] Fire - [ ] Lakes From 26fe6aa00a1e9a4616de7dc5c3fce5c0f0c235c2 Mon Sep 17 00:00:00 2001 From: yaswant <2984440+yaswant@users.noreply.github.com> Date: Wed, 22 Jul 2026 15:52:19 +0100 Subject: [PATCH 3/3] Update GitHub Actions workflows to pin versions and adjust permissions --- .github/workflows/check-cr-approved.yaml | 3 ++- .github/workflows/cla-check.yaml | 2 +- .github/workflows/track-review-project.yaml | 2 +- .github/workflows/trigger-project-workflow.yaml | 2 +- .github/workflows/umdp3_fixer.yaml | 2 +- .github/workflows/user-guide.yaml | 9 --------- .github/zizmor.yml | 8 -------- 7 files changed, 6 insertions(+), 22 deletions(-) diff --git a/.github/workflows/check-cr-approved.yaml b/.github/workflows/check-cr-approved.yaml index 50b22580..11fdb34c 100644 --- a/.github/workflows/check-cr-approved.yaml +++ b/.github/workflows/check-cr-approved.yaml @@ -15,5 +15,6 @@ jobs: check_cr_approved: permissions: contents: read # Required to evaluate the event trigger metadata safely + pull-requests: read # Required to read pull request details if: ${{ github.event.pull_request.number }} - uses: MetOffice/growss/.github/workflows/check-cr-approved.yaml@develop + uses: MetOffice/growss/.github/workflows/check-cr-approved.yaml@0f9ffe6a138ae9943053621916a850a075997db8 # v1.0.0 diff --git a/.github/workflows/cla-check.yaml b/.github/workflows/cla-check.yaml index 23334842..aa7e3118 100644 --- a/.github/workflows/cla-check.yaml +++ b/.github/workflows/cla-check.yaml @@ -24,6 +24,6 @@ jobs: permissions: contents: read # Required to evaluate the event trigger metadata safely pull-requests: write # Required for the downstream engine to post status comments on the PR - uses: MetOffice/growss/.github/workflows/cla-check.yaml@develop + uses: MetOffice/growss/.github/workflows/cla-check.yaml@0f9ffe6a138ae9943053621916a850a075997db8 # v1.0.0 with: cla-url: 'https://github.com/MetOffice/jules/blob/main/CLA.md' diff --git a/.github/workflows/track-review-project.yaml b/.github/workflows/track-review-project.yaml index 0a0bc1de..1ab60122 100644 --- a/.github/workflows/track-review-project.yaml +++ b/.github/workflows/track-review-project.yaml @@ -21,6 +21,6 @@ jobs: actions: read # Required to check out code or parse files safely contents: read # Required to read the upstream triggered workflow run artifact status pull-requests: write # Required for the downstream engine to add comments or update metadata on the PR - uses: MetOffice/growss/.github/workflows/track-review-project.yaml@develop + uses: MetOffice/growss/.github/workflows/track-review-project.yaml@0f9ffe6a138ae9943053621916a850a075997db8 # v1.0.0 secrets: PROJECT_ACTION_PAT: ${{ secrets.PROJECT_ACTION_PAT }} diff --git a/.github/workflows/trigger-project-workflow.yaml b/.github/workflows/trigger-project-workflow.yaml index 968755cb..69e58c93 100644 --- a/.github/workflows/trigger-project-workflow.yaml +++ b/.github/workflows/trigger-project-workflow.yaml @@ -23,4 +23,4 @@ jobs: actions: read # Required to check out code or parse files safely contents: read # Required to read the upstream triggered workflow run artifact status pull-requests: write # Required for the downstream engine to add comments or update metadata on the PR - uses: MetOffice/growss/.github/workflows/trigger-project-workflow.yaml@develop # zizmor: ignore[unpinned-uses] + uses: MetOffice/growss/.github/workflows/trigger-project-workflow.yaml@0f9ffe6a138ae9943053621916a850a075997db8 # v1.0.0 diff --git a/.github/workflows/umdp3_fixer.yaml b/.github/workflows/umdp3_fixer.yaml index bdb2e795..da2938f5 100644 --- a/.github/workflows/umdp3_fixer.yaml +++ b/.github/workflows/umdp3_fixer.yaml @@ -15,4 +15,4 @@ jobs: umdp3_fixer: permissions: contents: read - uses: MetOffice/growss/.github/workflows/umdp3_fixer.yaml@develop + uses: MetOffice/growss/.github/workflows/umdp3_fixer.yaml@0f9ffe6a138ae9943053621916a850a075997db8 # v1.0.0 diff --git a/.github/workflows/user-guide.yaml b/.github/workflows/user-guide.yaml index 516b87d0..4077ef2d 100644 --- a/.github/workflows/user-guide.yaml +++ b/.github/workflows/user-guide.yaml @@ -70,15 +70,6 @@ jobs: doc/pyproject.toml doc/uv.lock - # - name: Cache uv venv - # uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.5 - # with: - # path: ${{ env.VENV_PATH }} - # key: ${{ runner.os }}-uv-${{ env.PYTHON_VRSN }}-${{ hashFiles('doc/pyproject.toml', 'doc/uv.lock') }} - # restore-keys: | - # ${{ runner.os }}-uv-${{ env.PYTHON_VRSN }}- - # ${{ runner.os }}-uv- - - name: Install dependencies working-directory: ${{ env.JULES_PATH }}/doc run: uv sync diff --git a/.github/zizmor.yml b/.github/zizmor.yml index fa67ee2d..e66c5e79 100644 --- a/.github/zizmor.yml +++ b/.github/zizmor.yml @@ -8,14 +8,6 @@ # rules to ignore for specific workflow files, allowing for exceptions to be # made where necessary while still enforcing best practices across the codebase. rules: - unpinned-uses: - ignore: - - "check-cr-approved.yaml" - - "cla-check.yaml" - - "sphinx-docs.yaml" - - "track-review-project.yaml" - - "trigger-project-workflow.yaml" - - "umdp3_fixer.yaml" dangerous-triggers: ignore: - "cla-check.yaml"