From 24e18a213aad4fc1bd419ee175414a90f0a5b6c7 Mon Sep 17 00:00:00 2001 From: yaswant <2984440+yaswant@users.noreply.github.com> Date: Fri, 17 Jul 2026 02:39:06 +0100 Subject: [PATCH 1/5] Update GA Workflows --- .github/pull_request_template.md | 22 ++--- .github/workflows/check-cr-approved.yaml | 20 +++-- .github/workflows/checks.yaml | 45 ++++------ .github/workflows/ci.yaml | 8 +- .github/workflows/cla-check.yaml | 21 ++++- .github/workflows/docs.yaml | 82 ++++++------------- .github/workflows/track-review-project.yaml | 19 +++-- .../workflows/trigger-project-workflow.yaml | 19 +++-- .github/zizmor.yml | 24 ++++++ doc/Makefile | 16 ++++ pyproject.toml | 3 +- 11 files changed, 159 insertions(+), 120 deletions(-) create mode 100644 .github/zizmor.yml diff --git a/.github/pull_request_template.md b/.github/pull_request_template.md index d8e2960..352f198 100644 --- a/.github/pull_request_template.md +++ b/.github/pull_request_template.md @@ -1,5 +1,7 @@ # PR Summary + + Code Reviewer: @@ -25,17 +27,14 @@ Code Reviewer: - [ ] I have performed a self-review of my own code - [ ] My code follows the project's style guidelines -- [ ] Comments have been included that aid undertanding and enhance the - readability of the code +- [ ] Comments have been included that aid understanding and enhance the readability of the code - [ ] My changes generate no new warnings ## Testing - [ ] I have tested this change locally, using the rose-stem suite -- [ ] If any tests fail (rose-stem or CI) the reason is understood and - acceptable (eg. kgo changes) -- [ ] I have added tests to cover new functionality as appropriate (eg. system - tests, unit tests, etc.) +- [ ] If any tests fail (rose-stem or CI) the reason is understood and acceptable (eg. kgo changes) +- [ ] I have added tests to cover new functionality as appropriate (eg. system tests, unit tests, etc.) @@ -52,22 +51,17 @@ Code Reviewer: ## Performance Impact -- [ ] Performance of the code has been considered and, if applicable, suitable - performance measurements have been conducted +- [ ] Performance of the code has been considered and, if applicable, suitable performance measurements have been conducted ## AI Assistance and Attribution -- [ ] Some of the content of this change has been produced with the assistance - of _Generative AI tool name_ (e.g., Met Office Github Copilot Enterprise, - Github Copilot Personal, ChatGPT GPT-4, etc) and I have followed the - [Simulation Systems AI policy](https://metoffice.github.io/simulation-systems/FurtherDetails/ai.html)(including attribution labels) +- [ ] Some of the content of this change has been produced with the assistance of _Generative AI tool name_ (e.g., Met Office Github Copilot Enterprise, Github Copilot Personal, ChatGPT GPT-4, etc) and I have followed the [Simulation Systems AI policy](https://metoffice.github.io/simulation-systems/FurtherDetails/ai.html)(including attribution labels) ## Documentation -- [ ] Where appropriate I have updated documentation related to this change and - confirmed that it builds correctly +- [ ] Where appropriate I have updated documentation related to this change and confirmed that it builds correctly # Code Review diff --git a/.github/workflows/check-cr-approved.yaml b/.github/workflows/check-cr-approved.yaml index 9b66712..50b2258 100644 --- a/.github/workflows/check-cr-approved.yaml +++ b/.github/workflows/check-cr-approved.yaml @@ -1,11 +1,19 @@ +# ----------------------------------------------------------------------------- +# (C) Crown copyright Met Office. All rights reserved. +# The file LICENCE, distributed with this code, contains details of the terms +# under which the code may be used. +# ----------------------------------------------------------------------------- + name: Check CR approved on: - pull_request_review: - types: [submitted, edited, dismissed] - workflow_dispatch: + pull_request_review: + types: [submitted, edited, dismissed] + workflow_dispatch: jobs: - check_cr_approved: - if: ${{ github.event.pull_request.number }} - uses: MetOffice/growss/.github/workflows/check-cr-approved.yaml@main + check_cr_approved: + permissions: + contents: read # Required to evaluate the event trigger metadata safely + if: ${{ github.event.pull_request.number }} + uses: MetOffice/growss/.github/workflows/check-cr-approved.yaml@develop diff --git a/.github/workflows/checks.yaml b/.github/workflows/checks.yaml index cebc29e..4c03abe 100644 --- a/.github/workflows/checks.yaml +++ b/.github/workflows/checks.yaml @@ -11,10 +11,11 @@ on: # yamllint disable-line rule:truthy workflow_dispatch: concurrency: - group: ${{ github.ref }} - cancel-in-progress: ${{ github.ref != 'refs/heads/main' }} + group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.sha }} + cancel-in-progress: ${{ github.event.pull_request.head.repo.full_name != 'MetOffice/shumlib' }} -permissions: read-all +permissions: + contents: read jobs: @@ -24,43 +25,29 @@ jobs: steps: - name: Checkout repository - uses: actions/checkout@v4 + uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 + with: + persist-credentials: false + - name: Setup uv - uses: astral-sh/setup-uv@v6 + uses: astral-sh/setup-uv@11f9893b081a58869d3b5fccaea48c9e9e46f990 # v8.3.2 + with: + enable-cache: false + - name: Install dependencies run: uv sync - - name: Fortran + + - name: Lint Fortran # See: fortitude.toml run: | uv run fortitude check --respect-gitignore --show-fixes --statistics . - - name: C + + - name: Lint C # See: CPPLINT.cfg if: always() run: | uv run cpplint --recursive --extensions=c,h \ --exclude=.git --exclude=.venv . - # - name: Detect changes in doc - # id: doc_changes - # run: | - # if git diff --name-only ${{ github.sha }} ${{ github.event.before }} | grep '^doc/'; then - # echo "doc_changed=true" >> $GITHUB_OUTPUT - # else - # echo "doc_changed=false" >> $GITHUB_OUTPUT - # fi - - name: RestructuredText - # if: steps.doc_changes.outputs.doc_changed == 'true' - working-directory: ./doc - run: uv run sphinx-lint . - - name: Link Checks - # if: steps.doc_changes.outputs.doc_changed == 'true' - working-directory: ./doc - run: | - uv run sphinx-build -q -b linkcheck \ - -d _build/doctrees . _build/linkcheck || true - echo "== Ignored and Redirected links, if any ==" - jq -c 'select([.status] | inside(["ignored", "redirected"]))' \ - _build/linkcheck/output.json - - name: Minimize uv cache run: uv cache prune --ci diff --git a/.github/workflows/ci.yaml b/.github/workflows/ci.yaml index b48a629..c8c5eed 100644 --- a/.github/workflows/ci.yaml +++ b/.github/workflows/ci.yaml @@ -9,7 +9,8 @@ on: # yamllint disable-line rule:truthy types: [opened, synchronize, reopened] workflow_dispatch: -permissions: read-all +permissions: + contents: read jobs: build-shumlib: @@ -18,7 +19,10 @@ jobs: steps: - name: Checkout repository - uses: actions/checkout@v6 + uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 + with: + persist-credentials: false + - name: Build and Test run: | make -f ./make/vm-x86-gfortran-gcc.mk check diff --git a/.github/workflows/cla-check.yaml b/.github/workflows/cla-check.yaml index 3d28d73..85dcff9 100644 --- a/.github/workflows/cla-check.yaml +++ b/.github/workflows/cla-check.yaml @@ -1,10 +1,29 @@ +# ----------------------------------------------------------------------------- +# (C) Crown copyright Met Office. All rights reserved. +# The file LICENCE, distributed with this code, contains details of the terms +# under which the code may be used. +# ----------------------------------------------------------------------------- + +# Check Contributor Licence Agreement + name: Legal on: pull_request_target: +concurrency: + # Automatically cancels the workflow run instantly before the + # engine can parse empty jobs and generate notification emails + group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.sha }} + cancel-in-progress: ${{ github.event.pull_request.head.repo.full_name != 'MetOffice/shumlib' }} + +permissions: {} + jobs: cla: - uses: MetOffice/growss/.github/workflows/cla-check.yaml@main + permissions: + contents: read # Required to evaluate the event trigger metadata safely + pull-requests: write # Required for the downstream engine to post status comments on the PR + uses: MetOffice/growss/.github/workflows/cla-check.yaml@develop with: runner: 'ubuntu-24.04' diff --git a/.github/workflows/docs.yaml b/.github/workflows/docs.yaml index 302c347..21ef20e 100644 --- a/.github/workflows/docs.yaml +++ b/.github/workflows/docs.yaml @@ -1,68 +1,38 @@ ---- +# ----------------------------------------------------------------------------- +# (C) Crown copyright Met Office. All rights reserved. +# The file LICENCE, distributed with this code, contains details of the terms +# under which the code may be used. +# ----------------------------------------------------------------------------- + +# Build and deploy Sphinx documentation to GitHub Pages + name: Docs -on: # yamllint disable-line rule:truthy +on: push: - branches: - - main - - 'releases/**' + branches: [main] pull_request: - types: [opened, synchronize, reopened] + types: [opened, reopened, synchronize] paths: - 'doc/**' - - '.github/workflows/docs.yaml' + - '.github/workflows/**' workflow_dispatch: -permissions: read-all +concurrency: + group: ${{ github.workflow }}-${{ github.ref }} + cancel-in-progress: true jobs: + docs: + uses: MetOffice/growss/.github/workflows/sphinx-docs.yaml@develop + with: + python-version: "3.12.12" + timeout-minutes: 5 + docs-dir: doc + source-dir: doc + use-pyproject: true - build-docs: - runs-on: ubuntu-latest - timeout-minutes: 3 - - steps: - - name: Checkout repository - uses: actions/checkout@v4 - - name: Setup uv - uses: astral-sh/setup-uv@v6 - - name: Install dependencies - run: uv sync - - name: Build docs - run: uv run make clean html - working-directory: ./doc - - id: permissions - name: Set permissions - run: | - chmod -c -R +rX "./doc/_build/html/" - - name: Upload artifacts - uses: actions/upload-pages-artifact@v4 - with: - name: github-pages - path: ./doc/_build/html - - name: Minimize uv cache - run: uv cache prune --ci - - # Deploy job - deploy: - if: github.ref == 'refs/heads/main' && github.event_name != 'pull_request' - # Add a dependency to the build job - needs: build-docs - - # Grant GITHUB_TOKEN the permissions required to make a Pages deployment permissions: - pages: write # to deploy to Pages - id-token: write # to verify the deployment originates from an appropriate source - - # Deploy to the github-pages environment - environment: - name: github-pages - url: ${{ steps.deployment.outputs.page_url }} - - # Specify runner + deployment step - runs-on: ubuntu-latest - steps: - - name: Deploy to GitHub Pages - id: deployment - uses: actions/deploy-pages@v4 # or specific "vX.X.X" version tag for this action - + contents: read + pages: write + id-token: write diff --git a/.github/workflows/track-review-project.yaml b/.github/workflows/track-review-project.yaml index 639477c..0a0bc1d 100644 --- a/.github/workflows/track-review-project.yaml +++ b/.github/workflows/track-review-project.yaml @@ -1,3 +1,9 @@ +# ----------------------------------------------------------------------------- +# (C) Crown copyright Met Office. All rights reserved. +# The file LICENCE, distributed with this code, contains details of the terms +# under which the code may be used. +# ----------------------------------------------------------------------------- + name: Track Review Project on: @@ -7,11 +13,14 @@ on: - completed permissions: - actions: read - contents: read - pull-requests: write + contents: read # Required to evaluate the event trigger metadata safely jobs: track_review_project: - uses: MetOffice/growss/.github/workflows/track-review-project.yaml@main - secrets: inherit + permissions: + actions: read # Required to check out code or parse files safely + contents: read # Required to read the upstream triggered workflow run artifact status + pull-requests: write # Required for the downstream engine to add comments or update metadata on the PR + uses: MetOffice/growss/.github/workflows/track-review-project.yaml@develop + secrets: + PROJECT_ACTION_PAT: ${{ secrets.PROJECT_ACTION_PAT }} diff --git a/.github/workflows/trigger-project-workflow.yaml b/.github/workflows/trigger-project-workflow.yaml index ccb7a55..412ac40 100644 --- a/.github/workflows/trigger-project-workflow.yaml +++ b/.github/workflows/trigger-project-workflow.yaml @@ -1,3 +1,9 @@ +# ----------------------------------------------------------------------------- +# (C) Crown copyright Met Office. All rights reserved. +# The file LICENCE, distributed with this code, contains details of the terms +# under which the code may be used. +# ----------------------------------------------------------------------------- + name: Trigger Review Project on: @@ -7,11 +13,14 @@ on: pull_request_review_comment: permissions: - actions: read - contents: read - pull-requests: write + contents: read # Required to evaluate the event trigger metadata safely jobs: trigger_project_workflow: - uses: MetOffice/growss/.github/workflows/trigger-project-workflow.yaml@main - secrets: inherit + if: github.repository == 'MetOffice/shumlib' + + permissions: + actions: read # Required to check out code or parse files safely + contents: read # Required to read the upstream triggered workflow run artifact status + pull-requests: write # Required for the downstream engine to add comments or update metadata on the PR + uses: MetOffice/growss/.github/workflows/trigger-project-workflow.yaml@develop diff --git a/.github/zizmor.yml b/.github/zizmor.yml new file mode 100644 index 0000000..c84d343 --- /dev/null +++ b/.github/zizmor.yml @@ -0,0 +1,24 @@ +# ------------------------------------------------------------------------------ +# (c) Crown copyright Met Office. All rights reserved. +# The file LICENCE, distributed with this code, contains details of the terms +# under which the code may be used. +# ------------------------------------------------------------------------------ + +# Rules for Zizmor GitHub workflow linter. This file is used to configure which +# rules to ignore for specific workflow files, allowing for exceptions to be +# made where necessary while still enforcing best practices across the codebase. +rules: + unpinned-uses: + ignore: + - "check-cr-approved.yaml" + - "cla-check.yaml" + - "docs.yaml" + - "lint-fortran.yaml" + - "sphinx-docs.yaml" + - "track-review-project.yaml" + - "trigger-project-workflow.yaml" + dangerous-triggers: + ignore: + - "cla-check.yaml" + - "track-review-project.yaml" + - "trigger-project-workflow.yaml" diff --git a/doc/Makefile b/doc/Makefile index d4bb2cb..9f33515 100644 --- a/doc/Makefile +++ b/doc/Makefile @@ -8,6 +8,11 @@ SPHINXBUILD ?= sphinx-build SOURCEDIR = . BUILDDIR = _build +# For local deployment to ~/public_html// +REPO := $(notdir $(shell git rev-parse --show-toplevel)) +BRANCH := $(shell git rev-parse --abbrev-ref HEAD) +DEPLOYDIR = $(HOME)/public_html + # Put it first so that "make" without argument is like "make help". help: @$(SPHINXBUILD) -M help "$(SOURCEDIR)" "$(BUILDDIR)" $(SPHINXOPTS) $(O) @@ -18,3 +23,14 @@ help: # "make mode" option. $(O) is meant as a shortcut for $(SPHINXOPTS). %: Makefile @$(SPHINXBUILD) -M $@ "$(SOURCEDIR)" "$(BUILDDIR)" $(SPHINXOPTS) $(O) + +deploy: + @$(SPHINXBUILD) -M html "$(SOURCEDIR)" "$(DEPLOYDIR)/$(REPO)/$(BRANCH)" $(SPHINXOPTS) $(O) + +lint: + sphinx-lint --d "horizontal-tab" --max-line-length 80 "$(SOURCEDIR)" + +.PHONY: clean +clean: + @echo "***** Removing, $(BUILDDIR) directory *****" + @rm -rf $(BUILDDIR) diff --git a/pyproject.toml b/pyproject.toml index 302d7a3..53c15c7 100644 --- a/pyproject.toml +++ b/pyproject.toml @@ -4,8 +4,7 @@ [project] name = "shumlib" -# dynamic = ["version"] -version = "26.1.0" +version = "2026.07.2" description = "Set of libraries used by the Met Office Unified Model (UM)" authors = [ {name = "Met Office", email = "enquiries@metoffice.gov.uk"}, From adf96c1e922498cc3e14d8627258519eb53400db Mon Sep 17 00:00:00 2001 From: yaswant <2984440+yaswant@users.noreply.github.com> Date: Fri, 17 Jul 2026 02:41:30 +0100 Subject: [PATCH 2/5] Update CONTRIBUTORS.md to include author --- CONTRIBUTORS.md | 11 ++++++----- 1 file changed, 6 insertions(+), 5 deletions(-) diff --git a/CONTRIBUTORS.md b/CONTRIBUTORS.md index b47eb66..e4f90b3 100644 --- a/CONTRIBUTORS.md +++ b/CONTRIBUTORS.md @@ -1,7 +1,8 @@ # Contributors -| GitHub user | Real Name | Affiliation | Date | -| ----------- | --------- | ----------- | ---- | -| james-bruten-mo | James Bruten | Met Office | 2025-12-09 | -| t00sa | Sam Clarke-Green | Met Office | 2026-02-10 | -| jennyhickson | Jenny Hickson | Met Office | 2026-03-02 | +| GitHub user | Real Name | Affiliation | Date | +| --------------- | ---------------- | ----------- | ---------- | +| james-bruten-mo | James Bruten | Met Office | 2025-12-09 | +| t00sa | Sam Clarke-Green | Met Office | 2026-02-10 | +| jennyhickson | Jenny Hickson | Met Office | 2026-03-02 | +| yaswant | Yaswant Pradhan | Met Office | 2026-07-17 | From 7b69f65827917206260b0182f87979c7c418781a Mon Sep 17 00:00:00 2001 From: yaswant <2984440+yaswant@users.noreply.github.com> Date: Fri, 17 Jul 2026 02:53:03 +0100 Subject: [PATCH 3/5] Enhance CI workflow by adding separate CMake build and test steps --- .github/workflows/ci.yaml | 8 +++++++- 1 file changed, 7 insertions(+), 1 deletion(-) diff --git a/.github/workflows/ci.yaml b/.github/workflows/ci.yaml index c8c5eed..ba13e27 100644 --- a/.github/workflows/ci.yaml +++ b/.github/workflows/ci.yaml @@ -23,6 +23,12 @@ jobs: with: persist-credentials: false - - name: Build and Test + - name: Build and Test (make) run: | make -f ./make/vm-x86-gfortran-gcc.mk check + + - name: Build and Test (CMake) + run: | + cmake --preset debug-gcc + cmake --build --preset debug-gcc + ctest --test-dir build/debug --output-on-failure -V From 8240b0082eb52ab3b95d0abd20439299094b7abf Mon Sep 17 00:00:00 2001 From: yaswant <2984440+yaswant@users.noreply.github.com> Date: Fri, 17 Jul 2026 03:08:23 +0100 Subject: [PATCH 4/5] Enable parallel build for CMake in CI workflow --- .github/workflows/ci.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/ci.yaml b/.github/workflows/ci.yaml index ba13e27..d56a7b9 100644 --- a/.github/workflows/ci.yaml +++ b/.github/workflows/ci.yaml @@ -30,5 +30,5 @@ jobs: - name: Build and Test (CMake) run: | cmake --preset debug-gcc - cmake --build --preset debug-gcc + cmake --build --preset debug-gcc --parallel ctest --test-dir build/debug --output-on-failure -V From 586d9662dd722aaf21cfe6cbbd7d97a282920a6a Mon Sep 17 00:00:00 2001 From: yaswant <2984440+yaswant@users.noreply.github.com> Date: Wed, 22 Jul 2026 16:15:49 +0100 Subject: [PATCH 5/5] Update GitHub workflows to use specific version tags and adjust permissions --- .github/workflows/check-cr-approved.yaml | 3 ++- .github/workflows/cla-check.yaml | 2 +- .github/workflows/docs.yaml | 2 +- .github/workflows/track-review-project.yaml | 2 +- .github/workflows/trigger-project-workflow.yaml | 2 +- .github/zizmor.yml | 9 --------- 6 files changed, 6 insertions(+), 14 deletions(-) diff --git a/.github/workflows/check-cr-approved.yaml b/.github/workflows/check-cr-approved.yaml index 50b2258..e4c9a21 100644 --- a/.github/workflows/check-cr-approved.yaml +++ b/.github/workflows/check-cr-approved.yaml @@ -15,5 +15,6 @@ jobs: check_cr_approved: permissions: contents: read # Required to evaluate the event trigger metadata safely + pull-requests: read if: ${{ github.event.pull_request.number }} - uses: MetOffice/growss/.github/workflows/check-cr-approved.yaml@develop + uses: MetOffice/growss/.github/workflows/check-cr-approved.yaml@0f9ffe6a138ae9943053621916a850a075997db8 # v1.0.0 diff --git a/.github/workflows/cla-check.yaml b/.github/workflows/cla-check.yaml index 85dcff9..b4bae1d 100644 --- a/.github/workflows/cla-check.yaml +++ b/.github/workflows/cla-check.yaml @@ -24,6 +24,6 @@ jobs: permissions: contents: read # Required to evaluate the event trigger metadata safely pull-requests: write # Required for the downstream engine to post status comments on the PR - uses: MetOffice/growss/.github/workflows/cla-check.yaml@develop + uses: MetOffice/growss/.github/workflows/cla-check.yaml@0f9ffe6a138ae9943053621916a850a075997db8 # v1.0.0 with: runner: 'ubuntu-24.04' diff --git a/.github/workflows/docs.yaml b/.github/workflows/docs.yaml index 21ef20e..b786da7 100644 --- a/.github/workflows/docs.yaml +++ b/.github/workflows/docs.yaml @@ -24,7 +24,7 @@ concurrency: jobs: docs: - uses: MetOffice/growss/.github/workflows/sphinx-docs.yaml@develop + uses: MetOffice/growss/.github/workflows/sphinx-docs.yaml@0f9ffe6a138ae9943053621916a850a075997db8 # v1.0.0 with: python-version: "3.12.12" timeout-minutes: 5 diff --git a/.github/workflows/track-review-project.yaml b/.github/workflows/track-review-project.yaml index 0a0bc1d..1ab6012 100644 --- a/.github/workflows/track-review-project.yaml +++ b/.github/workflows/track-review-project.yaml @@ -21,6 +21,6 @@ jobs: actions: read # Required to check out code or parse files safely contents: read # Required to read the upstream triggered workflow run artifact status pull-requests: write # Required for the downstream engine to add comments or update metadata on the PR - uses: MetOffice/growss/.github/workflows/track-review-project.yaml@develop + uses: MetOffice/growss/.github/workflows/track-review-project.yaml@0f9ffe6a138ae9943053621916a850a075997db8 # v1.0.0 secrets: PROJECT_ACTION_PAT: ${{ secrets.PROJECT_ACTION_PAT }} diff --git a/.github/workflows/trigger-project-workflow.yaml b/.github/workflows/trigger-project-workflow.yaml index 412ac40..f53e0ea 100644 --- a/.github/workflows/trigger-project-workflow.yaml +++ b/.github/workflows/trigger-project-workflow.yaml @@ -23,4 +23,4 @@ jobs: actions: read # Required to check out code or parse files safely contents: read # Required to read the upstream triggered workflow run artifact status pull-requests: write # Required for the downstream engine to add comments or update metadata on the PR - uses: MetOffice/growss/.github/workflows/trigger-project-workflow.yaml@develop + uses: MetOffice/growss/.github/workflows/trigger-project-workflow.yaml@0f9ffe6a138ae9943053621916a850a075997db8 # v1.0.0 diff --git a/.github/zizmor.yml b/.github/zizmor.yml index c84d343..e66c5e7 100644 --- a/.github/zizmor.yml +++ b/.github/zizmor.yml @@ -8,15 +8,6 @@ # rules to ignore for specific workflow files, allowing for exceptions to be # made where necessary while still enforcing best practices across the codebase. rules: - unpinned-uses: - ignore: - - "check-cr-approved.yaml" - - "cla-check.yaml" - - "docs.yaml" - - "lint-fortran.yaml" - - "sphinx-docs.yaml" - - "track-review-project.yaml" - - "trigger-project-workflow.yaml" dangerous-triggers: ignore: - "cla-check.yaml"