From 9e68345f25382ea739524496ad4919481a81417c Mon Sep 17 00:00:00 2001 From: yaswant <2984440+yaswant@users.noreply.github.com> Date: Fri, 17 Jul 2026 09:12:23 +0100 Subject: [PATCH 1/2] Update GitHub Actions workflow files --- .github/pull_request_template.md | 37 ++++++++----------- .github/workflows/check-cr-approved.yaml | 20 +++++++--- .github/workflows/cla-check.yaml | 21 ++++++++++- .github/workflows/track-review-project.yaml | 19 +++++++--- .../workflows/trigger-project-workflow.yaml | 19 +++++++--- .github/zizmor.yml | 21 +++++++++++ CONTRIBUTORS.md | 4 +- 7 files changed, 100 insertions(+), 41 deletions(-) create mode 100644 .github/zizmor.yml diff --git a/.github/pull_request_template.md b/.github/pull_request_template.md index 4c203b3..c6c0325 100644 --- a/.github/pull_request_template.md +++ b/.github/pull_request_template.md @@ -1,5 +1,7 @@ # PR Summary + + Code Reviewer: @@ -25,23 +27,20 @@ Code Reviewer: - [ ] I have performed a self-review of my own code - [ ] My code follows the project's style guidelines -- [ ] Comments have been included that aid understanding and enhance the - readability of the code +- [ ] Comments have been included that aid understanding and enhance the readability of the code - [ ] My changes generate no new warnings ## Testing -- [ ] I have tested this change locally, using the Moci rose-stem suite. Required for any changes to - * Coupled_Drivers application - * Postprocessing application - * Unittests -- [ ] If any tests fail (rose-stem or CI) the reason is understood and - acceptable (eg. kgo changes) -- [ ] I have added tests to cover new functionality as appropriate (eg. system - tests, unit tests, etc.) - - ### trac.log - +- [ ] I have tested this change locally, using the Moci rose-stem suite. Required for any changes to + - Coupled_Drivers application + - Postprocessing application + - Unittests +- [ ] If any tests fail (rose-stem or CI) the reason is understood and acceptable (eg. kgo changes) +- [ ] I have added tests to cover new functionality as appropriate (eg. system tests, unit tests, etc.) + +### trac.log + @@ -54,23 +53,17 @@ Code Reviewer: ## Performance Impact -- [ ] Performance of the code has been considered and, if applicable, suitable - performance measurements have been conducted +- [ ] Performance of the code has been considered and, if applicable, suitable performance measurements have been conducted ## AI Assistance and Attribution -- [ ] Some of the content of this change has been produced with the assistance - of _Generative AI tool name_ (e.g., Met Office Github Copilot Enterprise, - Github Copilot Personal, ChatGPT GPT-4, etc) and I have followed the - [Simulation Systems AI policy](https://metoffice.github.io/simulation-systems/FurtherDetails/ai.html) - (including attribution labels) +- [ ] Some of the content of this change has been produced with the assistance of _Generative AI tool name_ (e.g., Met Office Github Copilot Enterprise, Github Copilot Personal, ChatGPT GPT-4, etc) and I have followed the [Simulation Systems AI policy](https://metoffice.github.io/simulation-systems/FurtherDetails/ai.html) (including attribution labels) ## Documentation -- [ ] Where appropriate I have updated documentation related to this change and - confirmed that it builds correctly +- [ ] Where appropriate I have updated documentation related to this change and confirmed that it builds correctly # Code Review diff --git a/.github/workflows/check-cr-approved.yaml b/.github/workflows/check-cr-approved.yaml index ee897d0..50b2258 100644 --- a/.github/workflows/check-cr-approved.yaml +++ b/.github/workflows/check-cr-approved.yaml @@ -1,11 +1,19 @@ +# ----------------------------------------------------------------------------- +# (C) Crown copyright Met Office. All rights reserved. +# The file LICENCE, distributed with this code, contains details of the terms +# under which the code may be used. +# ----------------------------------------------------------------------------- + name: Check CR approved on: - pull_request_review: - types: [submitted, edited, dismissed] - workflow_dispatch: + pull_request_review: + types: [submitted, edited, dismissed] + workflow_dispatch: jobs: - check_cr_approved: - if: ${{ github.event.pull_request.number }} - uses: MetOffice/growss/.github/workflows/check-cr-approved.yaml@main + check_cr_approved: + permissions: + contents: read # Required to evaluate the event trigger metadata safely + if: ${{ github.event.pull_request.number }} + uses: MetOffice/growss/.github/workflows/check-cr-approved.yaml@develop diff --git a/.github/workflows/cla-check.yaml b/.github/workflows/cla-check.yaml index 3d28d73..ba2a136 100644 --- a/.github/workflows/cla-check.yaml +++ b/.github/workflows/cla-check.yaml @@ -1,10 +1,29 @@ +# ----------------------------------------------------------------------------- +# (C) Crown copyright Met Office. All rights reserved. +# The file LICENCE, distributed with this code, contains details of the terms +# under which the code may be used. +# ----------------------------------------------------------------------------- + +# Check Contributor Licence Agreement + name: Legal on: pull_request_target: +concurrency: + # Automatically cancels the workflow run instantly before the + # engine can parse empty jobs and generate notification emails + group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.sha }} + cancel-in-progress: ${{ github.event.pull_request.head.repo.full_name != 'MetOffice/moci' }} + +permissions: {} + jobs: cla: - uses: MetOffice/growss/.github/workflows/cla-check.yaml@main + permissions: + contents: read # Required to evaluate the event trigger metadata safely + pull-requests: write # Required for the downstream engine to post status comments on the PR + uses: MetOffice/growss/.github/workflows/cla-check.yaml@develop with: runner: 'ubuntu-24.04' diff --git a/.github/workflows/track-review-project.yaml b/.github/workflows/track-review-project.yaml index 639477c..0a0bc1d 100644 --- a/.github/workflows/track-review-project.yaml +++ b/.github/workflows/track-review-project.yaml @@ -1,3 +1,9 @@ +# ----------------------------------------------------------------------------- +# (C) Crown copyright Met Office. All rights reserved. +# The file LICENCE, distributed with this code, contains details of the terms +# under which the code may be used. +# ----------------------------------------------------------------------------- + name: Track Review Project on: @@ -7,11 +13,14 @@ on: - completed permissions: - actions: read - contents: read - pull-requests: write + contents: read # Required to evaluate the event trigger metadata safely jobs: track_review_project: - uses: MetOffice/growss/.github/workflows/track-review-project.yaml@main - secrets: inherit + permissions: + actions: read # Required to check out code or parse files safely + contents: read # Required to read the upstream triggered workflow run artifact status + pull-requests: write # Required for the downstream engine to add comments or update metadata on the PR + uses: MetOffice/growss/.github/workflows/track-review-project.yaml@develop + secrets: + PROJECT_ACTION_PAT: ${{ secrets.PROJECT_ACTION_PAT }} diff --git a/.github/workflows/trigger-project-workflow.yaml b/.github/workflows/trigger-project-workflow.yaml index ccb7a55..55a5be1 100644 --- a/.github/workflows/trigger-project-workflow.yaml +++ b/.github/workflows/trigger-project-workflow.yaml @@ -1,3 +1,9 @@ +# ----------------------------------------------------------------------------- +# (C) Crown copyright Met Office. All rights reserved. +# The file LICENCE, distributed with this code, contains details of the terms +# under which the code may be used. +# ----------------------------------------------------------------------------- + name: Trigger Review Project on: @@ -7,11 +13,14 @@ on: pull_request_review_comment: permissions: - actions: read - contents: read - pull-requests: write + contents: read # Required to evaluate the event trigger metadata safely jobs: trigger_project_workflow: - uses: MetOffice/growss/.github/workflows/trigger-project-workflow.yaml@main - secrets: inherit + if: github.repository == 'MetOffice/moci' + + permissions: + actions: read # Required to check out code or parse files safely + contents: read # Required to read the upstream triggered workflow run artifact status + pull-requests: write # Required for the downstream engine to add comments or update metadata on the PR + uses: MetOffice/growss/.github/workflows/trigger-project-workflow.yaml@develop diff --git a/.github/zizmor.yml b/.github/zizmor.yml new file mode 100644 index 0000000..ed5ca7e --- /dev/null +++ b/.github/zizmor.yml @@ -0,0 +1,21 @@ +# ------------------------------------------------------------------------------ +# (c) Crown copyright Met Office. All rights reserved. +# The file LICENCE, distributed with this code, contains details of the terms +# under which the code may be used. +# ------------------------------------------------------------------------------ + +# Rules for Zizmor GitHub workflow linter. This file is used to configure which +# rules to ignore for specific workflow files, allowing for exceptions to be +# made where necessary while still enforcing best practices across the codebase. +rules: + unpinned-uses: + ignore: + - "check-cr-approved.yaml" + - "cla-check.yaml" + - "track-review-project.yaml" + - "trigger-project-workflow.yaml" + dangerous-triggers: + ignore: + - "cla-check.yaml" + - "track-review-project.yaml" + - "trigger-project-workflow.yaml" diff --git a/CONTRIBUTORS.md b/CONTRIBUTORS.md index b3bd3ce..97cfa95 100644 --- a/CONTRIBUTORS.md +++ b/CONTRIBUTORS.md @@ -1,7 +1,7 @@ # Contributors | GitHub user | Real Name | Affiliation | Date | -|-----------------|-----------------|-------------|------------| +| --------------- | --------------- | ----------- | ---------- | | james-bruten-mo | James Bruten | Met Office | 2025-12-09 | | Pierre-siddall | Pierre Siddall | Met Office | 2025-01-19 | | ericaneininger | Erica Neininger | Met Office | 2026-02-04 | @@ -10,4 +10,4 @@ | marcstring | Marc Stringer | NCAS | 2026-04-01 | | jonseddon | Jon Seddon | Met Office | 2026-05-11 | | jonnyhtw | Jonny Williams | NCAS | 2026-05-13 | - +| yaswant | Yaswant Pradhan | Met Office | 2026-07-17 | From fca79a7a4ed48d3cdcd4b2f32fd8fc0242c15456 Mon Sep 17 00:00:00 2001 From: yaswant <2984440+yaswant@users.noreply.github.com> Date: Wed, 22 Jul 2026 16:24:11 +0100 Subject: [PATCH 2/2] Update workflow files to pin versions and adjust permissions --- .github/workflows/check-cr-approved.yaml | 3 ++- .github/workflows/cla-check.yaml | 2 +- .github/workflows/track-review-project.yaml | 2 +- .github/workflows/trigger-project-workflow.yaml | 2 +- .github/zizmor.yml | 6 ------ 5 files changed, 5 insertions(+), 10 deletions(-) diff --git a/.github/workflows/check-cr-approved.yaml b/.github/workflows/check-cr-approved.yaml index 50b2258..e4c9a21 100644 --- a/.github/workflows/check-cr-approved.yaml +++ b/.github/workflows/check-cr-approved.yaml @@ -15,5 +15,6 @@ jobs: check_cr_approved: permissions: contents: read # Required to evaluate the event trigger metadata safely + pull-requests: read if: ${{ github.event.pull_request.number }} - uses: MetOffice/growss/.github/workflows/check-cr-approved.yaml@develop + uses: MetOffice/growss/.github/workflows/check-cr-approved.yaml@0f9ffe6a138ae9943053621916a850a075997db8 # v1.0.0 diff --git a/.github/workflows/cla-check.yaml b/.github/workflows/cla-check.yaml index ba2a136..3156c14 100644 --- a/.github/workflows/cla-check.yaml +++ b/.github/workflows/cla-check.yaml @@ -24,6 +24,6 @@ jobs: permissions: contents: read # Required to evaluate the event trigger metadata safely pull-requests: write # Required for the downstream engine to post status comments on the PR - uses: MetOffice/growss/.github/workflows/cla-check.yaml@develop + uses: MetOffice/growss/.github/workflows/cla-check.yaml@0f9ffe6a138ae9943053621916a850a075997db8 # v1.0.0 with: runner: 'ubuntu-24.04' diff --git a/.github/workflows/track-review-project.yaml b/.github/workflows/track-review-project.yaml index 0a0bc1d..1ab6012 100644 --- a/.github/workflows/track-review-project.yaml +++ b/.github/workflows/track-review-project.yaml @@ -21,6 +21,6 @@ jobs: actions: read # Required to check out code or parse files safely contents: read # Required to read the upstream triggered workflow run artifact status pull-requests: write # Required for the downstream engine to add comments or update metadata on the PR - uses: MetOffice/growss/.github/workflows/track-review-project.yaml@develop + uses: MetOffice/growss/.github/workflows/track-review-project.yaml@0f9ffe6a138ae9943053621916a850a075997db8 # v1.0.0 secrets: PROJECT_ACTION_PAT: ${{ secrets.PROJECT_ACTION_PAT }} diff --git a/.github/workflows/trigger-project-workflow.yaml b/.github/workflows/trigger-project-workflow.yaml index 55a5be1..9a3bd08 100644 --- a/.github/workflows/trigger-project-workflow.yaml +++ b/.github/workflows/trigger-project-workflow.yaml @@ -23,4 +23,4 @@ jobs: actions: read # Required to check out code or parse files safely contents: read # Required to read the upstream triggered workflow run artifact status pull-requests: write # Required for the downstream engine to add comments or update metadata on the PR - uses: MetOffice/growss/.github/workflows/trigger-project-workflow.yaml@develop + uses: MetOffice/growss/.github/workflows/trigger-project-workflow.yaml@0f9ffe6a138ae9943053621916a850a075997db8 # v1.0.0 diff --git a/.github/zizmor.yml b/.github/zizmor.yml index ed5ca7e..e66c5e7 100644 --- a/.github/zizmor.yml +++ b/.github/zizmor.yml @@ -8,12 +8,6 @@ # rules to ignore for specific workflow files, allowing for exceptions to be # made where necessary while still enforcing best practices across the codebase. rules: - unpinned-uses: - ignore: - - "check-cr-approved.yaml" - - "cla-check.yaml" - - "track-review-project.yaml" - - "trigger-project-workflow.yaml" dangerous-triggers: ignore: - "cla-check.yaml"