Update GA Workflows

.github/pull_request_template.md

@@ -1,5 +1,7 @@
 # PR Summary
 
+<!-- One line summary -->
+
 Code Reviewer: <!-- CR id, filled by SSD -->
 
 <!-- To be completed by the developer -->
@@ -25,17 +27,14 @@ Code Reviewer: <!-- CR id, filled by SSD -->
 
 - [ ] I have performed a self-review of my own code
 - [ ] My code follows the project's style guidelines
-- [ ] Comments have been included that aid undertanding and enhance the
-      readability of the code
+- [ ] Comments have been included that aid understanding and enhance the readability of the code
 - [ ] My changes generate no new warnings
 
 ## Testing
 
 - [ ] I have tested this change locally, using the rose-stem suite
-- [ ] If any tests fail (rose-stem or CI) the reason is understood and
-      acceptable (eg. kgo changes)
-- [ ] I have added tests to cover new functionality as appropriate (eg. system
-      tests, unit tests, etc.)
+- [ ] If any tests fail (rose-stem or CI) the reason is understood and acceptable (eg. kgo changes)
+- [ ] I have added tests to cover new functionality as appropriate (eg. system tests, unit tests, etc.)
 
 <!-- Describe other testing performed (if applicable) -->
 
@@ -52,22 +51,17 @@ Code Reviewer: <!-- CR id, filled by SSD -->
 
 ## Performance Impact
 
-- [ ] Performance of the code has been considered and, if applicable, suitable
-      performance measurements have been conducted
+- [ ] Performance of the code has been considered and, if applicable, suitable performance measurements have been conducted
 
 ## AI Assistance and Attribution
 
-- [ ] Some of the content of this change has been produced with the assistance
-      of _Generative AI tool name_ (e.g., Met Office Github Copilot Enterprise,
-      Github Copilot Personal, ChatGPT GPT-4, etc) and I have followed the
-      [Simulation Systems AI policy](https://metoffice.github.io/simulation-systems/FurtherDetails/ai.html)(including attribution labels)
+- [ ] Some of the content of this change has been produced with the assistance of _Generative AI tool name_ (e.g., Met Office Github Copilot Enterprise, Github Copilot Personal, ChatGPT GPT-4, etc) and I have followed the [Simulation Systems AI policy](https://metoffice.github.io/simulation-systems/FurtherDetails/ai.html)(including attribution labels)
 
 <!-- If AI has been used, please provide more details here -->
 
 ## Documentation
 
-- [ ] Where appropriate I have updated documentation related to this change and
-      confirmed that it builds correctly
+- [ ] Where appropriate I have updated documentation related to this change and confirmed that it builds correctly
 
 # Code Review
 

.github/workflows/check-cr-approved.yaml

@@ -1,11 +1,19 @@
+# -----------------------------------------------------------------------------
+# (C) Crown copyright Met Office. All rights reserved.
+# The file LICENCE, distributed with this code, contains details of the terms
+# under which the code may be used.
+# -----------------------------------------------------------------------------
+
 name: Check CR approved
 
 on:
-    pull_request_review:
-        types: [submitted, edited, dismissed]
-    workflow_dispatch:
+  pull_request_review:
+    types: [submitted, edited, dismissed]
+  workflow_dispatch:
 
 jobs:
-    check_cr_approved:
-        if: ${{ github.event.pull_request.number }}
-        uses: MetOffice/growss/.github/workflows/check-cr-approved.yaml@main
+  check_cr_approved:
+    permissions:
+      contents: read  # Required to evaluate the event trigger metadata safely
+    if: ${{ github.event.pull_request.number }}
+    uses: MetOffice/growss/.github/workflows/check-cr-approved.yaml@develop

.github/workflows/checks.yaml

@@ -11,10 +11,11 @@ on: # yamllint disable-line rule:truthy
   workflow_dispatch:
 
 concurrency:
-  group: ${{ github.ref }}
-  cancel-in-progress: ${{ github.ref != 'refs/heads/main' }}
+  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.sha }}
+  cancel-in-progress: ${{ github.event.pull_request.head.repo.full_name != 'MetOffice/shumlib' }}
 
-permissions: read-all
+permissions:
+  contents: read
 
 jobs:
 
@@ -24,43 +25,29 @@ jobs:
 
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        with:
+          persist-credentials: false
+
       - name: Setup uv
-        uses: astral-sh/setup-uv@v6
+        uses:  astral-sh/setup-uv@11f9893b081a58869d3b5fccaea48c9e9e46f990 # v8.3.2
+        with:
+          enable-cache: false
+
       - name: Install dependencies
         run: uv sync
-      - name: Fortran
+
+      - name: Lint Fortran
         # See: fortitude.toml
         run: |
           uv run fortitude check --respect-gitignore --show-fixes --statistics .
-      - name: C
+
+      - name: Lint C
         # See: CPPLINT.cfg
         if: always()
         run: |
           uv run cpplint --recursive --extensions=c,h \
             --exclude=.git --exclude=.venv .
 
-      # - name: Detect changes in doc
-      #   id: doc_changes
-      #   run: |
-      #     if git diff --name-only ${{ github.sha }} ${{ github.event.before }} | grep '^doc/'; then
-      #       echo "doc_changed=true" >> $GITHUB_OUTPUT
-      #     else
-      #       echo "doc_changed=false" >> $GITHUB_OUTPUT
-      #     fi
-      - name: RestructuredText
-        # if: steps.doc_changes.outputs.doc_changed == 'true'
-        working-directory: ./doc
-        run: uv run sphinx-lint .
-      - name: Link Checks
-        # if: steps.doc_changes.outputs.doc_changed == 'true'
-        working-directory: ./doc
-        run: |
-          uv run sphinx-build -q -b linkcheck \
-            -d _build/doctrees . _build/linkcheck || true
-          echo "== Ignored and Redirected links, if any =="
-          jq -c 'select([.status] | inside(["ignored", "redirected"]))' \
-            _build/linkcheck/output.json
-
       - name: Minimize uv cache
         run: uv cache prune --ci

.github/workflows/ci.yaml

@@ -9,7 +9,8 @@ on:  # yamllint disable-line rule:truthy
     types: [opened, synchronize, reopened]
   workflow_dispatch:
 
-permissions: read-all
+permissions:
+  contents: read
 
 jobs:
   build-shumlib:
@@ -18,7 +19,16 @@ jobs:
 
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v6
-      - name: Build and Test
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        with:
+          persist-credentials: false
+
+      - name: Build and Test (make)
         run: |
           make -f ./make/vm-x86-gfortran-gcc.mk check
+
+      - name: Build and Test (CMake)
+        run: |
+          cmake --preset debug-gcc
+          cmake --build --preset debug-gcc --parallel
+          ctest --test-dir build/debug --output-on-failure -V

.github/workflows/cla-check.yaml

@@ -1,10 +1,29 @@
+# -----------------------------------------------------------------------------
+# (C) Crown copyright Met Office. All rights reserved.
+# The file LICENCE, distributed with this code, contains details of the terms
+# under which the code may be used.
+# -----------------------------------------------------------------------------
+
+# Check Contributor Licence Agreement
+
 name: Legal
 
 on:
   pull_request_target:
 
+concurrency:
+  # Automatically cancels the workflow run instantly before the
+  # engine can parse empty jobs and generate notification emails
+  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.sha }}
+  cancel-in-progress: ${{ github.event.pull_request.head.repo.full_name != 'MetOffice/shumlib' }}
+
+permissions: {}
+
 jobs:
   cla:
-    uses: MetOffice/growss/.github/workflows/cla-check.yaml@main
+    permissions:
+      contents: read  # Required to evaluate the event trigger metadata safely
+      pull-requests: write  # Required for the downstream engine to post status comments on the PR
+    uses: MetOffice/growss/.github/workflows/cla-check.yaml@develop
     with:
       runner: 'ubuntu-24.04'

.github/workflows/docs.yaml

@@ -1,68 +1,38 @@
----
+# -----------------------------------------------------------------------------
+# (C) Crown copyright Met Office. All rights reserved.
+# The file LICENCE, distributed with this code, contains details of the terms
+# under which the code may be used.
+# -----------------------------------------------------------------------------
+
+# Build and deploy Sphinx documentation to GitHub Pages
+
 name: Docs
 
-on: # yamllint disable-line rule:truthy
+on:
   push:
-    branches:
-      - main
-      - 'releases/**'
+    branches: [main]
   pull_request:
-    types: [opened, synchronize, reopened]
+    types: [opened, reopened, synchronize]
     paths:
       - 'doc/**'
-      - '.github/workflows/docs.yaml'
+      - '.github/workflows/**'
   workflow_dispatch:
 
-permissions: read-all
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
 
 jobs:
+  docs:
+    uses: MetOffice/growss/.github/workflows/sphinx-docs.yaml@develop
+    with:
+      python-version: "3.12.12"
+      timeout-minutes: 5
+      docs-dir: doc
+      source-dir: doc
+      use-pyproject: true
 
-  build-docs:
-    runs-on: ubuntu-latest
-    timeout-minutes: 3
-
-    steps:
-      - name: Checkout repository
-        uses: actions/checkout@v4
-      - name: Setup uv
-        uses: astral-sh/setup-uv@v6
-      - name: Install dependencies
-        run: uv sync
-      - name: Build docs
-        run: uv run make clean html
-        working-directory: ./doc
-      - id: permissions
-        name: Set permissions
-        run: |
-          chmod -c -R +rX "./doc/_build/html/"
-      - name: Upload artifacts
-        uses: actions/upload-pages-artifact@v4
-        with:
-          name: github-pages
-          path: ./doc/_build/html
-      - name: Minimize uv cache
-        run: uv cache prune --ci
-
-  # Deploy job
-  deploy:
-    if: github.ref == 'refs/heads/main' && github.event_name != 'pull_request'
-    # Add a dependency to the build job
-    needs: build-docs
-
-    # Grant GITHUB_TOKEN the permissions required to make a Pages deployment
     permissions:
-      pages: write      # to deploy to Pages
-      id-token: write   # to verify the deployment originates from an appropriate source
-
-    # Deploy to the github-pages environment
-    environment:
-      name: github-pages
-      url: ${{ steps.deployment.outputs.page_url }}
-
-    # Specify runner + deployment step
-    runs-on: ubuntu-latest
-    steps:
-      - name: Deploy to GitHub Pages
-        id: deployment
-        uses: actions/deploy-pages@v4 # or specific "vX.X.X" version tag for this action
-
+      contents: read
+      pages: write
+      id-token: write

.github/workflows/track-review-project.yaml

@@ -1,3 +1,9 @@
+# -----------------------------------------------------------------------------
+# (C) Crown copyright Met Office. All rights reserved.
+# The file LICENCE, distributed with this code, contains details of the terms
+# under which the code may be used.
+# -----------------------------------------------------------------------------
+
 name: Track Review Project
 
 on:
@@ -7,11 +13,14 @@ on:
       - completed
 
 permissions:
-  actions: read
-  contents: read
-  pull-requests: write
+  contents: read  # Required to evaluate the event trigger metadata safely
 
 jobs:
   track_review_project:
-    uses: MetOffice/growss/.github/workflows/track-review-project.yaml@main
-    secrets: inherit
+    permissions:
+      actions: read  # Required to check out code or parse files safely
+      contents: read  # Required to read the upstream triggered workflow run artifact status
+      pull-requests: write  # Required for the downstream engine to add comments or update metadata on the PR
+    uses: MetOffice/growss/.github/workflows/track-review-project.yaml@develop
+    secrets:
+      PROJECT_ACTION_PAT: ${{ secrets.PROJECT_ACTION_PAT }}

.github/workflows/trigger-project-workflow.yaml

@@ -1,3 +1,9 @@
+# -----------------------------------------------------------------------------
+# (C) Crown copyright Met Office. All rights reserved.
+# The file LICENCE, distributed with this code, contains details of the terms
+# under which the code may be used.
+# -----------------------------------------------------------------------------
+
 name: Trigger Review Project
 
 on:
@@ -7,11 +13,14 @@ on:
   pull_request_review_comment:
 
 permissions:
-  actions: read
-  contents: read
-  pull-requests: write
+  contents: read  # Required to evaluate the event trigger metadata safely
 
 jobs:
   trigger_project_workflow:
-    uses: MetOffice/growss/.github/workflows/trigger-project-workflow.yaml@main
-    secrets: inherit
+    if: github.repository == 'MetOffice/shumlib'
+
+    permissions:
+      actions: read  # Required to check out code or parse files safely
+      contents: read  # Required to read the upstream triggered workflow run artifact status
+      pull-requests: write  # Required for the downstream engine to add comments or update metadata on the PR
+    uses: MetOffice/growss/.github/workflows/trigger-project-workflow.yaml@develop

.github/zizmor.yml

@@ -0,0 +1,24 @@
+# ------------------------------------------------------------------------------
+# (c) Crown copyright Met Office. All rights reserved.
+# The file LICENCE, distributed with this code, contains details of the terms
+# under which the code may be used.
+# ------------------------------------------------------------------------------
+
+# Rules for Zizmor GitHub workflow linter. This file is used to configure which
+# rules to ignore for specific workflow files, allowing for exceptions to be
+# made where necessary while still enforcing best practices across the codebase.
+rules:
+  unpinned-uses:
+    ignore:
+      - "check-cr-approved.yaml"
+      - "cla-check.yaml"
+      - "docs.yaml"
+      - "lint-fortran.yaml"
+      - "sphinx-docs.yaml"
+      - "track-review-project.yaml"
+      - "trigger-project-workflow.yaml"
+  dangerous-triggers:
+    ignore:
+      - "cla-check.yaml"
+      - "track-review-project.yaml"
+      - "trigger-project-workflow.yaml"