From a50f5a367e0498009037da49948185a4925360e5 Mon Sep 17 00:00:00 2001 From: yaswant <2984440+yaswant@users.noreply.github.com> Date: Fri, 17 Jul 2026 15:23:05 +0100 Subject: [PATCH 1/3] Enhance workflows and project structure --- .github/pull_request_template.md | 3 +- .github/workflows/cla-check.yaml | 28 ++++++++++++++ .github/workflows/lint.yml | 14 +++++-- .github/workflows/python_unit_tests.yaml | 37 ++++++++++++------- .github/workflows/track-review-project.yaml | 19 +++++++--- .../workflows/trigger-project-workflow.yaml | 19 +++++++--- .github/zizmor.yml | 20 ++++++++++ .gitignore | 1 + CONTRIBUTORS.md | 5 +++ LICENSE => LICENCE | 0 pyproject.toml | 23 ++++++++++++ 11 files changed, 142 insertions(+), 27 deletions(-) create mode 100644 .github/workflows/cla-check.yaml create mode 100644 .github/zizmor.yml create mode 100644 CONTRIBUTORS.md rename LICENSE => LICENCE (100%) create mode 100644 pyproject.toml diff --git a/.github/pull_request_template.md b/.github/pull_request_template.md index 7345962e..b8a9a1bf 100644 --- a/.github/pull_request_template.md +++ b/.github/pull_request_template.md @@ -1,5 +1,7 @@ # PR Summary + + Sci/Tech Reviewer: Code Reviewer: @@ -66,4 +68,3 @@ Code Reviewer: - [ ] Tests are adequate and have passed - [ ] Security considerations have been addressed - [ ] Performance impact is acceptable - diff --git a/.github/workflows/cla-check.yaml b/.github/workflows/cla-check.yaml new file mode 100644 index 00000000..c4e88fa8 --- /dev/null +++ b/.github/workflows/cla-check.yaml @@ -0,0 +1,28 @@ +# ----------------------------------------------------------------------------- +# (C) Crown copyright Met Office. All rights reserved. +# The file LICENCE, distributed with this code, contains details of the terms +# under which the code may be used. +# ----------------------------------------------------------------------------- + +# Check Contributor Licence Agreement + +name: Legal + +on: + pull_request_target: + +concurrency: + # Automatically cancels the workflow run instantly before the + # engine can parse empty jobs and generate notification emails + group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.sha }} + cancel-in-progress: ${{ github.event.pull_request.head.repo.full_name != 'MetOffice/SimSys_Scripts' }} + +permissions: {} + +jobs: + cla: + uses: MetOffice/growss/.github/workflows/cla-check.yaml@develop + permissions: + contents: read # Required to evaluate the event trigger metadata safely + pull-requests: write # Required for the downstream engine to post status comments on the PR + diff --git a/.github/workflows/lint.yml b/.github/workflows/lint.yml index d91c7944..09f0aa1f 100644 --- a/.github/workflows/lint.yml +++ b/.github/workflows/lint.yml @@ -1,4 +1,10 @@ --- +# ----------------------------------------------------------------------------- +# (C) Crown copyright Met Office. All rights reserved. +# The file LICENCE, distributed with this code, contains details of the terms +# under which the code may be used. +# ----------------------------------------------------------------------------- + # Lint/analyse code with Super-Linter. name: Checks @@ -13,7 +19,8 @@ concurrency: group: ${{ github.ref }} cancel-in-progress: ${{ github.ref != 'refs/heads/main' }} -permissions: read-all +permissions: + contents: read jobs: check: @@ -24,7 +31,7 @@ jobs: max-parallel: 4 fail-fast: false matrix: - python-version: ["3.9", "3.12", "3.14"] + python-version: ["3.11", "3.12", "3.14"] permissions: contents: read @@ -32,8 +39,9 @@ jobs: steps: - name: Checkout current - uses: actions/checkout@v4 + uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 with: + persist-credentials: false fetch-depth: 0 - name: Super-Lint diff --git a/.github/workflows/python_unit_tests.yaml b/.github/workflows/python_unit_tests.yaml index e88d90ff..7cfaf118 100644 --- a/.github/workflows/python_unit_tests.yaml +++ b/.github/workflows/python_unit_tests.yaml @@ -1,3 +1,9 @@ +# ----------------------------------------------------------------------------- +# (C) Crown copyright Met Office. All rights reserved. +# The file LICENCE, distributed with this code, contains details of the terms +# under which the code may be used. +# ----------------------------------------------------------------------------- + name: Python Unit Tests on: @@ -9,10 +15,14 @@ on: paths: - '**.py' - '.github/workflows/python_unit_tests.yaml' - branches: [main, 'releases/**'] workflow_dispatch: -permissions: read-all +concurrency: + group: ${{ github.workflow }}-${{ github.head_ref || github.run_id }} + cancel-in-progress: true + +permissions: + contents: read # Required to evaluate the event trigger metadata safely jobs: python_unit_tests: @@ -21,22 +31,23 @@ jobs: timeout-minutes: 5 steps: - - uses: actions/checkout@v5 - - name: Set up Python - uses: actions/setup-python@v5 + - name: Checkout code + uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 + with: + persist-credentials: false + + - name: Set up uv with Python + uses: astral-sh/setup-uv@11f9893b081a58869d3b5fccaea48c9e9e46f990 # v8.3.2 with: python-version: '3.14' + enable-cache: true + - name: Install dependencies - run: | - # We only have 2 external dependencies other than pytest for now, so - # list them here - # If this changes, we may want to switch to a dependencies file of - # some format - python -m pip install --upgrade pip - pip install pytest networkx PyYAML + run: uv sync --extra test + - name: Test with pytest run: | # Setup git for git_bdiff and get_git_sources testing git config --global user.name 'Testing' git config --global user.email 'Testing' - pytest -vv + uv run pytest -vv diff --git a/.github/workflows/track-review-project.yaml b/.github/workflows/track-review-project.yaml index 639477cd..0a0bc1de 100644 --- a/.github/workflows/track-review-project.yaml +++ b/.github/workflows/track-review-project.yaml @@ -1,3 +1,9 @@ +# ----------------------------------------------------------------------------- +# (C) Crown copyright Met Office. All rights reserved. +# The file LICENCE, distributed with this code, contains details of the terms +# under which the code may be used. +# ----------------------------------------------------------------------------- + name: Track Review Project on: @@ -7,11 +13,14 @@ on: - completed permissions: - actions: read - contents: read - pull-requests: write + contents: read # Required to evaluate the event trigger metadata safely jobs: track_review_project: - uses: MetOffice/growss/.github/workflows/track-review-project.yaml@main - secrets: inherit + permissions: + actions: read # Required to check out code or parse files safely + contents: read # Required to read the upstream triggered workflow run artifact status + pull-requests: write # Required for the downstream engine to add comments or update metadata on the PR + uses: MetOffice/growss/.github/workflows/track-review-project.yaml@develop + secrets: + PROJECT_ACTION_PAT: ${{ secrets.PROJECT_ACTION_PAT }} diff --git a/.github/workflows/trigger-project-workflow.yaml b/.github/workflows/trigger-project-workflow.yaml index ccb7a55b..2bea4b27 100644 --- a/.github/workflows/trigger-project-workflow.yaml +++ b/.github/workflows/trigger-project-workflow.yaml @@ -1,3 +1,9 @@ +# ----------------------------------------------------------------------------- +# (C) Crown copyright Met Office. All rights reserved. +# The file LICENCE, distributed with this code, contains details of the terms +# under which the code may be used. +# ----------------------------------------------------------------------------- + name: Trigger Review Project on: @@ -7,11 +13,14 @@ on: pull_request_review_comment: permissions: - actions: read - contents: read - pull-requests: write + contents: read # Required to evaluate the event trigger metadata safely jobs: trigger_project_workflow: - uses: MetOffice/growss/.github/workflows/trigger-project-workflow.yaml@main - secrets: inherit + if: github.repository == 'MetOffice/SimSys_Scripts' + + permissions: + actions: read # Required to check out code or parse files safely + contents: read # Required to read the upstream triggered workflow run artifact status + pull-requests: write # Required for the downstream engine to add comments or update metadata on the PR + uses: MetOffice/growss/.github/workflows/trigger-project-workflow.yaml@develop diff --git a/.github/zizmor.yml b/.github/zizmor.yml new file mode 100644 index 00000000..0494276e --- /dev/null +++ b/.github/zizmor.yml @@ -0,0 +1,20 @@ +# ------------------------------------------------------------------------------ +# (c) Crown copyright Met Office. All rights reserved. +# The file LICENCE, distributed with this code, contains details of the terms +# under which the code may be used. +# ------------------------------------------------------------------------------ + +# Rules for Zizmor GitHub workflow linter. This file is used to configure which +# rules to ignore for specific workflow files, allowing for exceptions to be +# made where necessary while still enforcing best practices across the codebase. +rules: + unpinned-uses: + ignore: + - "cla-check.yaml" + - "track-review-project.yaml" + - "trigger-project-workflow.yaml" + dangerous-triggers: + ignore: + - "cla-check.yaml" + - "track-review-project.yaml" + - "trigger-project-workflow.yaml" diff --git a/.gitignore b/.gitignore index 25fea9d2..207b57e7 100644 --- a/.gitignore +++ b/.gitignore @@ -7,3 +7,4 @@ __pycache__/ *.swp .conda .idea +uv.lock diff --git a/CONTRIBUTORS.md b/CONTRIBUTORS.md new file mode 100644 index 00000000..8913a005 --- /dev/null +++ b/CONTRIBUTORS.md @@ -0,0 +1,5 @@ +# Contributors + +| GitHub user | Real Name | Affiliation | Date | +| ----------- | --------------- | ----------- | ---------- | +| yaswant | Yaswant Pradhan | Met Office | 2026-07-17 | diff --git a/LICENSE b/LICENCE similarity index 100% rename from LICENSE rename to LICENCE diff --git a/pyproject.toml b/pyproject.toml new file mode 100644 index 00000000..827961a9 --- /dev/null +++ b/pyproject.toml @@ -0,0 +1,23 @@ +[project] +name = "simsys_scripts" +version = "2026.07.1" +description = "Development support scripts for Simulation Systems deployment" +readme = "README.md" +license = { file = "LICENCE" } +requires-python = ">=3.12" + +dependencies = [] + +[project.optional-dependencies] +test = [ + "pytest", + "networkx", + "PyYAML" +] + +[project.urls] +repository = "https://github.com/MetOffice/SimSys_Scripts" +discussion = "https://github.com/MetOffice/simulation-systems/discussions/categories/lfric" + +[tool.setuptools] +packages = [] From 1f286e3b8c3c39c67d17213c169599033e5e3d6e Mon Sep 17 00:00:00 2001 From: yaswant <2984440+yaswant@users.noreply.github.com> Date: Fri, 17 Jul 2026 15:25:55 +0100 Subject: [PATCH 2/3] Remove unnecessary newline in CLA check workflow --- .github/workflows/cla-check.yaml | 1 - 1 file changed, 1 deletion(-) diff --git a/.github/workflows/cla-check.yaml b/.github/workflows/cla-check.yaml index c4e88fa8..b3fcdd64 100644 --- a/.github/workflows/cla-check.yaml +++ b/.github/workflows/cla-check.yaml @@ -25,4 +25,3 @@ jobs: permissions: contents: read # Required to evaluate the event trigger metadata safely pull-requests: write # Required for the downstream engine to post status comments on the PR - From f415ca573951f8c377002fe0c54ea2312924c41b Mon Sep 17 00:00:00 2001 From: yaswant <2984440+yaswant@users.noreply.github.com> Date: Wed, 22 Jul 2026 16:10:12 +0100 Subject: [PATCH 3/3] Update workflow references to use specific version tags --- .github/workflows/cla-check.yaml | 2 +- .github/workflows/track-review-project.yaml | 2 +- .github/workflows/trigger-project-workflow.yaml | 2 +- .github/zizmor.yml | 5 ----- 4 files changed, 3 insertions(+), 8 deletions(-) diff --git a/.github/workflows/cla-check.yaml b/.github/workflows/cla-check.yaml index b3fcdd64..dcbbbf99 100644 --- a/.github/workflows/cla-check.yaml +++ b/.github/workflows/cla-check.yaml @@ -21,7 +21,7 @@ permissions: {} jobs: cla: - uses: MetOffice/growss/.github/workflows/cla-check.yaml@develop + uses: MetOffice/growss/.github/workflows/cla-check.yaml@0f9ffe6a138ae9943053621916a850a075997db8 # v1.0.0 permissions: contents: read # Required to evaluate the event trigger metadata safely pull-requests: write # Required for the downstream engine to post status comments on the PR diff --git a/.github/workflows/track-review-project.yaml b/.github/workflows/track-review-project.yaml index 0a0bc1de..1ab60122 100644 --- a/.github/workflows/track-review-project.yaml +++ b/.github/workflows/track-review-project.yaml @@ -21,6 +21,6 @@ jobs: actions: read # Required to check out code or parse files safely contents: read # Required to read the upstream triggered workflow run artifact status pull-requests: write # Required for the downstream engine to add comments or update metadata on the PR - uses: MetOffice/growss/.github/workflows/track-review-project.yaml@develop + uses: MetOffice/growss/.github/workflows/track-review-project.yaml@0f9ffe6a138ae9943053621916a850a075997db8 # v1.0.0 secrets: PROJECT_ACTION_PAT: ${{ secrets.PROJECT_ACTION_PAT }} diff --git a/.github/workflows/trigger-project-workflow.yaml b/.github/workflows/trigger-project-workflow.yaml index 2bea4b27..66d1c936 100644 --- a/.github/workflows/trigger-project-workflow.yaml +++ b/.github/workflows/trigger-project-workflow.yaml @@ -23,4 +23,4 @@ jobs: actions: read # Required to check out code or parse files safely contents: read # Required to read the upstream triggered workflow run artifact status pull-requests: write # Required for the downstream engine to add comments or update metadata on the PR - uses: MetOffice/growss/.github/workflows/trigger-project-workflow.yaml@develop + uses: MetOffice/growss/.github/workflows/trigger-project-workflow.yaml@0f9ffe6a138ae9943053621916a850a075997db8 # v1.0.0 diff --git a/.github/zizmor.yml b/.github/zizmor.yml index 0494276e..e66c5e79 100644 --- a/.github/zizmor.yml +++ b/.github/zizmor.yml @@ -8,11 +8,6 @@ # rules to ignore for specific workflow files, allowing for exceptions to be # made where necessary while still enforcing best practices across the codebase. rules: - unpinned-uses: - ignore: - - "cla-check.yaml" - - "track-review-project.yaml" - - "trigger-project-workflow.yaml" dangerous-triggers: ignore: - "cla-check.yaml"