Update GitHub workflows

.github/pull_request_template.md

@@ -1,5 +1,7 @@
 # PR Summary
 
+<!-- One line summary -->
+
 Sci/Tech Reviewer: <!-- SR id, filled by author when ready for review (e.g. @octocat) -->
 Code Reviewer: <!-- CR id, filled by SSD -->
 
@@ -26,18 +28,14 @@ Code Reviewer: <!-- CR id, filled by SSD -->
 
 - [ ] I have performed a self-review of my own code
 - [ ] My code follows the project's style guidelines
-- [ ] Comments have been included that aid undertanding and enhance the
-      readability of the code
+- [ ] Comments have been included that aid understanding and enhance the readability of the code
 - [ ] My changes generate no new warnings
 
 ## Testing
 
-- [ ] If shared files have been modified, I have run the UM and LFRic Apps rose
-      stem suites
-- [ ] If any tests fail (rose-stem or CI) the reason is understood and
-      acceptable (eg. kgo changes)
-- [ ] I have added tests to cover new functionality as appropriate (eg. system
-      tests, unit tests, etc.)
+- [ ] If shared files have been modified, I have run the UM and LFRic Apps rose stem suites
+- [ ] If any tests fail (rose-stem or CI) the reason is understood and acceptable (eg. kgo changes)
+- [ ] I have added tests to cover new functionality as appropriate (eg. system tests, unit tests, etc.)
 
 <!-- Describe other testing performed (if applicable) -->
 
@@ -53,23 +51,17 @@ Code Reviewer: <!-- CR id, filled by SSD -->
 
 ## Performance Impact
 
-- [ ] Performance of the code has been considered and, if applicable, suitable
-      performance measurements have been conducted
+- [ ] Performance of the code has been considered and, if applicable, suitable performance measurements have been conducted
 
 ## AI Assistance and Attribution
 
-- [ ] Some of the content of this change has been produced with the assistance
-      of _Generative AI tool name_ (e.g., Met Office Github Copilot Enterprise,
-      Github Copilot Personal, ChatGPT GPT-4, etc) and I have followed the
-      [Simulation Systems AI policy](https://metoffice.github.io/simulation-systems/FurtherDetails/ai.html)
-      (including attribution labels)
+- [ ] Some of the content of this change has been produced with the assistance of _Generative AI tool name_ (e.g., Met Office Github Copilot Enterprise, Github Copilot Personal, ChatGPT GPT-4, etc) and I have followed the [Simulation Systems AI policy](https://metoffice.github.io/simulation-systems/FurtherDetails/ai.html) (including attribution labels)
 
 <!-- If AI has been used, please provide more details here -->
 
 ## Documentation
 
-- [ ] Where appropriate I have updated documentation related to this change and
-      confirmed that it builds correctly
+- [ ] Where appropriate I have updated documentation related to this change and confirmed that it builds correctly
 
 # Sci/Tech Review
 

.github/workflows/check-cr-approved.yaml

@@ -1,11 +1,19 @@
+# -----------------------------------------------------------------------------
+# (C) Crown copyright Met Office. All rights reserved.
+# The file LICENCE, distributed with this code, contains details of the terms
+# under which the code may be used.
+# -----------------------------------------------------------------------------
+
 name: Check CR approved
 
 on:
-    pull_request_review:
-        types: [submitted, edited, dismissed]
-    workflow_dispatch:
+  pull_request_review:
+    types: [submitted, edited, dismissed]
+  workflow_dispatch:
 
 jobs:
-    check_cr_approved:
-        if: ${{ github.event.pull_request.number }}
-        uses: MetOffice/growss/.github/workflows/check-cr-approved.yaml@main
+  check_cr_approved:
+    permissions:
+      contents: read  # Required to evaluate the event trigger metadata safely
+    if: ${{ github.event.pull_request.number }}
+    uses: MetOffice/growss/.github/workflows/check-cr-approved.yaml@develop

.github/workflows/cla-check.yaml

@@ -1,10 +1,27 @@
+# -----------------------------------------------------------------------------
+# (C) Crown copyright Met Office. All rights reserved.
+# The file LICENCE, distributed with this code, contains details of the terms
+# under which the code may be used.
+# -----------------------------------------------------------------------------
+
+# Check Contributor Licence Agreement
+
 name: Legal
 
 on:
   pull_request_target:
 
+concurrency:
+  # Automatically cancels the workflow run instantly before the
+  # engine can parse empty jobs and generate notification emails
+  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.sha }}
+  cancel-in-progress: ${{ github.event.pull_request.head.repo.full_name != 'MetOffice/socrates' }}
+
+permissions: {}
+
 jobs:
   cla:
-    uses: MetOffice/growss/.github/workflows/cla-check.yaml@main
-    with:
-      runner: 'ubuntu-24.04'
+    uses: MetOffice/growss/.github/workflows/cla-check.yaml@develop
+    permissions:
+      contents: read  # Required to evaluate the event trigger metadata safely
+      pull-requests: write  # Required for the downstream engine to post status comments on the PR

.github/workflows/lint-fortran.yaml

@@ -10,7 +10,9 @@ on:
   pull_request:
 
 jobs:
-   fortitude-lint:
-     uses: MetOffice/growss/.github/workflows/fortran-lint.yaml@main
-     with:
-       runner: "ubuntu-24.04"
+  fortitude-lint:
+    permissions:
+      contents: read  # Required to evaluate the event trigger metadata safely
+    uses: MetOffice/growss/.github/workflows/fortran-lint.yaml@develop
+    with:
+      runner: 'ubuntu-24.04'

.github/workflows/track-review-project.yaml

@@ -1,3 +1,9 @@
+# -----------------------------------------------------------------------------
+# (C) Crown copyright Met Office. All rights reserved.
+# The file LICENCE, distributed with this code, contains details of the terms
+# under which the code may be used.
+# -----------------------------------------------------------------------------
+
 name: Track Review Project
 
 on:
@@ -7,11 +13,14 @@ on:
       - completed
 
 permissions:
-  actions: read
-  contents: read
-  pull-requests: write
+  contents: read  # Required to evaluate the event trigger metadata safely
 
 jobs:
   track_review_project:
-    uses: MetOffice/growss/.github/workflows/track-review-project.yaml@main
-    secrets: inherit
+    permissions:
+      actions: read  # Required to check out code or parse files safely
+      contents: read  # Required to read the upstream triggered workflow run artifact status
+      pull-requests: write  # Required for the downstream engine to add comments or update metadata on the PR
+    uses: MetOffice/growss/.github/workflows/track-review-project.yaml@develop
+    secrets:
+      PROJECT_ACTION_PAT: ${{ secrets.PROJECT_ACTION_PAT }}

.github/workflows/trigger-project-workflow.yaml

@@ -1,3 +1,9 @@
+# -----------------------------------------------------------------------------
+# (C) Crown copyright Met Office. All rights reserved.
+# The file LICENCE, distributed with this code, contains details of the terms
+# under which the code may be used.
+# -----------------------------------------------------------------------------
+
 name: Trigger Review Project
 
 on:
@@ -7,11 +13,14 @@ on:
   pull_request_review_comment:
 
 permissions:
-  actions: read
-  contents: read
-  pull-requests: write
+  contents: read  # Required to evaluate the event trigger metadata safely
 
 jobs:
   trigger_project_workflow:
-    uses: MetOffice/growss/.github/workflows/trigger-project-workflow.yaml@main
-    secrets: inherit
+    if: github.repository == 'MetOffice/socrates'
+
+    permissions:
+      actions: read  # Required to check out code or parse files safely
+      contents: read  # Required to read the upstream triggered workflow run artifact status
+      pull-requests: write  # Required for the downstream engine to add comments or update metadata on the PR
+    uses: MetOffice/growss/.github/workflows/trigger-project-workflow.yaml@develop

.github/zizmor.yml

@@ -0,0 +1,23 @@
+# ------------------------------------------------------------------------------
+# (c) Crown copyright Met Office. All rights reserved.
+# The file LICENCE, distributed with this code, contains details of the terms
+# under which the code may be used.
+# ------------------------------------------------------------------------------
+
+# Rules for Zizmor GitHub workflow linter. This file is used to configure which
+# rules to ignore for specific workflow files, allowing for exceptions to be
+# made where necessary while still enforcing best practices across the codebase.
+rules:
+  unpinned-uses:
+    ignore:
+      - "check-cr-approved.yaml"
+      - "cla-check.yaml"
+      - "lint-fortran.yaml"
+      - "track-review-project.yaml"
+      - "trigger-project-workflow.yaml"
+  dangerous-triggers:
+    ignore:
+      - "cla-check.yaml"
+      - "lint-fortran.yaml"
+      - "track-review-project.yaml"
+      - "trigger-project-workflow.yaml"

CONTRIBUTORS.md

@@ -7,3 +7,4 @@
 | t00sa       | Sam Clarke-Green | Met Office | 2026-03-02 |
 | Pierre-siddall | Pierre Siddall | Met Office | 2026-03-16 |
 | nichollsh | Harrison Nicholls | University of Cambridge | 2026-03-24 |
+| yaswant | Yaswant Pradhan | Met Office | 2026-07-17 |