Scenarios 2026

.github/ISSUE_TEMPLATE/bug_report.yaml

@@ -10,6 +10,8 @@ body:
       Thanks for taking the time to fill out this bug report!
       Please do not post usage questions here. Ask them on the [PyPSA Discord server](https://discord.gg/AnuJBk23FU).
 
+      Please write this issue description yourself. Any potentially verbose AI-generated content should be marked.
+
 - type: checkboxes
   id: checks
   attributes:

.github/ISSUE_TEMPLATE/feature_request.md

@@ -10,6 +10,8 @@ assignees: ''
 
 <!-- Please do not post usage questions here. Ask them on the PyPSA Discord server: https://discord.gg/AnuJBk23FU -->
 
+<!-- Please write this issue description yourself. Any potentially verbose AI-generated content should be marked.-->
+
 ## Describe the feature you'd like to see
 
 *Please give a clear and concise description and provide context why the feature would be useful.*

.github/dependabot.yaml

@@ -12,3 +12,8 @@ updates:
     github-actions:
       patterns:
       - '*'
+- package-ecosystem: docker
+  directories:
+  - /**/*
+  schedule:
+    interval: weekly

.github/pull_request_template.md

@@ -1,8 +1,17 @@
 Before asking for a review for this PR make sure to complete the following checklist:
 
-- [ ] Workflow with target rule `ariadne_all` completes without errors
-- [ ] The logic of `export_ariadne_variables` has been adapted to the changes
-- [ ] One or several figures that validate the changes in the PR have been posted as a comment
-- [ ] A brief description of the changes has been added to `Changelog.md`
-- [ ] The latest `main` has been merged into the PR
-- [ ] The config has a new prefix of the format `YYYYMMDDdescriptive_title`
+## Changes proposed in this Pull Request
+
+
+## Checklist
+
+**Required:**
+- [ ] Changes are tested locally and behave as expected.
+- [ ] Code and workflow changes are documented.
+- [ ] A brief description of the changes has been added to `Changelog.md`.
+- [ ] The description is human-written and any AI-generated content is marked.
+
+**If applicable:**
+- [ ] Changes in configuration options are reflected in `scripts/lib/validation`.
+- [ ] For new data sources or versions, [these instructions](https://pypsa-eur.readthedocs.io/en/latest/data_sources.html) have been followed.
+- [ ] New rules are documented in the appropriate `doc/*.md` files.

.github/pypsa-bot.yml

@@ -0,0 +1,30 @@
+tasks:
+  sync-locks:
+    triggers:
+    - "pixi.toml"
+    - "pixi.lock"
+    stage:
+    - "pixi.lock"
+    - "envs/"
+
+  generate-config:
+    triggers:
+    - "scripts/lib/validation/config/**"
+    stage:
+    - "config/"
+    - "doc/"
+    - "*.yaml"
+    - "*.yml"
+
+app:
+  trusted_users:
+  - daniel-rdt
+  runs:
+  - name: "config.validator.yaml"
+    configfile: "config/test/config.validator.yaml"
+    triggers: [main, pr]
+    cache:
+      key: "validator-{YYYY}-{MM}"
+      dirs: ["data"]
+    import_networks:
+    - "results/validation/networks/base_s_50___2050.nc"

.github/workflows/codeql.yaml

@@ -55,7 +55,7 @@ jobs:
         # your codebase is analyzed, see https://docs.github.com/en/code-security/code-scanning/creating-an-advanced-setup-for-code-scanning/codeql-code-scanning-for-compiled-languages
     steps:
     - name: Checkout repository
-      uses: actions/checkout@v6
+      uses: actions/checkout@v7
 
     # Initializes the CodeQL tools for scanning.
     - name: Initialize CodeQL

.github/workflows/push-images.yaml

@@ -6,6 +6,10 @@ on:
     - master
   workflow_dispatch:
 
+# retagging must wait for a previous build to finish pushing
+concurrency:
+  group: push-images
+
 env:
   IMAGE_NAME: pypsa/eur-dev-env
 
@@ -14,13 +18,13 @@ jobs:
     name: dev-env
     runs-on: ubuntu-latest
     steps:
-    - uses: actions/checkout@v6
+    - uses: actions/checkout@v7
       with:
         fetch-depth: 0
 
-    - name: 'Get last commit that changed pixi env'
+    - name: 'Get last commit that changed pixi env or Dockerfile'
       run: |
-        hash_last_changed=$(git log -1 --pretty=format:%H -- pixi.toml pixi.lock)
+        hash_last_changed=$(git log -1 --pretty=format:%H -- pixi.toml pixi.lock docker/dev-env/Dockerfile)
         echo "hash_last_changed=$hash_last_changed" >> $GITHUB_ENV
 
     - name: 'Login to GitHub Container Registry'
@@ -43,7 +47,7 @@ jobs:
         fi
 
     - name: 'Add SHA tag to existing image' # when rebuild is not needed
-      if: env.hash_last_changed != github.sha
+      if: env.hash_last_changed != github.sha && github.event_name != 'workflow_dispatch'
       run: |-
         docker pull ghcr.io/${{ env.IMAGE_NAME }}:${{ env.hash_last_changed }}
         docker tag ghcr.io/${{ env.IMAGE_NAME }}:${{ env.hash_last_changed }} ghcr.io/${{ env.IMAGE_NAME }}:${{ github.sha }}

.github/workflows/release.yaml

@@ -16,7 +16,7 @@ jobs:
     outputs:
       prepared: ${{ steps.validate.outputs.prepared }}
     steps:
-    - uses: actions/checkout@v6
+    - uses: actions/checkout@v7
 
     - name: Validate commit message
       id: validate
@@ -46,7 +46,7 @@ jobs:
         app-id: ${{ vars.PYPSA_BOT_ID }}
         private-key: ${{ secrets.PYPSA_BOT_PRIVATE_KEY }}
 
-    - uses: actions/checkout@v6
+    - uses: actions/checkout@v7
       with:
         fetch-depth: 0
 
@@ -56,16 +56,16 @@ jobs:
         echo "Branch found: $branch"
         echo "BRANCH_NAME=$branch" >> $GITHUB_ENV
 
-    - uses: actions/checkout@v6
+    - uses: actions/checkout@v7
       with:
         fetch-depth: 0
         ref: ${{ env.BRANCH_NAME }}
         token: ${{ steps.generate-token.outputs.token }}
 
     - name: Setup Pixi
-      uses: prefix-dev/setup-pixi@v0.9.5
+      uses: prefix-dev/setup-pixi@v0.10.1
       with:
-        pixi-version: v0.59.0
+        pixi-version: v0.68.1
         cache: true
         # Do not cache in branches
         cache-write: ${{ github.event_name == 'push' && github.ref_name == 'main' }}

.github/workflows/security-scan.yaml

@@ -0,0 +1,129 @@
+name: Security scan
+on:
+  push:
+    branches: [master]
+    paths: [pixi.lock]
+  # No path filter, a required check must report on every PR
+  pull_request:
+    branches: [master]
+  schedule:
+  - cron: "0 6 * * *"
+  workflow_dispatch:
+
+jobs:
+  changes:
+    name: Detect pixi.lock changes
+    if: github.event_name == 'pull_request'
+    runs-on: ubuntu-latest
+    outputs:
+      pixi: ${{ steps.diff.outputs.pixi }}
+    steps:
+    - id: diff
+      env:
+        GH_TOKEN: ${{ github.token }}
+      run: |
+        files=$(gh api "repos/${{ github.repository }}/pulls/${{ github.event.pull_request.number }}/files" --paginate --jq '.[].filename')
+        grep -qxF pixi.lock <<< "$files" && pixi=true || pixi=false
+        echo "pixi=$pixi" >> "$GITHUB_OUTPUT"
+
+  scan:
+    name: SBOM and vulnerability scan
+    needs: changes
+    # Skip only when pixi.lock is confirmed unchanged
+    if: ${{ !cancelled() && !(needs.changes.result == 'success' && needs.changes.outputs.pixi == 'false') }}
+    runs-on: ubuntu-latest
+    permissions:
+      security-events: write
+      contents: write   # required by anchore/sbom-action dependency-snapshot upload
+      actions: read     # required by dawidd6/action-download-artifact on fork PRs
+    defaults:
+      run:
+        shell: bash -l {0}
+    steps:
+    - uses: actions/checkout@v7
+    - uses: prefix-dev/setup-pixi@v0.10.1
+      with:
+        pixi-version: v0.68.1
+
+    - name: Generate SBOM
+      uses: anchore/sbom-action@v0.24.0
+      with:
+        path: ".pixi/envs/default"
+        output-file: sbom.spdx.json
+        dependency-snapshot: ${{ github.ref == 'refs/heads/master' }}
+        upload-artifact: false  # uploaded explicitly below, master only
+
+    - name: Vulnerability Scan
+      id: scan
+      uses: anchore/scan-action@v7.4.0
+      env:
+        SBOM: sbom.spdx.json
+      with: &scan_settings
+        sbom: ${{ env.SBOM }}
+        fail-build: false
+        severity-cutoff: high
+        add-cpes-if-none: true
+        by-cve: true
+        output-format: sarif
+
+    # Set uri=pixi.lock for a readable location, and fingerprint each alert by
+    # CVE id so code scanning matches against the master baseline by CVE, not line.
+    - name: Normalize SARIF (pixi.lock location + CVE fingerprint)
+      run: |
+        jq '.runs[].results[] |= (
+              .locations[].physicalLocation.artifactLocation.uri = "pixi.lock"
+              | .partialFingerprints = {"grypeCve/v1": .ruleId}
+            )' "${{ steps.scan.outputs.sarif }}" > normalized.sarif
+        mv normalized.sarif "${{ steps.scan.outputs.sarif }}"
+
+    - name: Upload SARIF
+      if: github.ref == 'refs/heads/master'
+      uses: github/codeql-action/upload-sarif@v4
+      with:
+        sarif_file: ${{ steps.scan.outputs.sarif }}
+        category: pixi-vuln-scan
+
+    # Baseline for the PR CVE diff. PR runs rescan it with their own vuln DB.
+    - name: Upload SBOM as artifact
+      if: github.ref == 'refs/heads/master'
+      uses: actions/upload-artifact@v7
+      with:
+        name: master-sbom
+        path: sbom.spdx.json
+        retention-days: 30
+
+    # All PRs gate on new CVEs vs the master baseline
+    - name: Download master baseline
+      if: github.event_name == 'pull_request'
+      uses: dawidd6/action-download-artifact@v23
+      with:
+        workflow: security-scan.yaml
+        name: master-sbom
+        branch: master
+        if_no_artifact_found: fail
+        path: master-baseline
+
+    - name: Scan master baseline
+      id: baseline
+      if: github.event_name == 'pull_request'
+      uses: anchore/scan-action@v7.4.0
+      env:
+        SBOM: master-baseline/sbom.spdx.json
+      with: *scan_settings
+
+    - name: Fail on new CVEs
+      if: github.event_name == 'pull_request'
+      env:
+        PR_SARIF: ${{ steps.scan.outputs.sarif }}
+        BASE_SARIF: ${{ steps.baseline.outputs.sarif }}
+      run: |
+        [ -s "$BASE_SARIF" ] || { echo "::error::baseline SARIF missing"; exit 2; }
+        [ -s "$PR_SARIF" ]   || { echo "::error::PR SARIF missing"; exit 2; }
+        ids() { jq -r '.runs[].results[] | select(.level == "error") | .ruleId' "$1" | sort -u; }
+        new=$(comm -23 <(ids "$PR_SARIF") <(ids "$BASE_SARIF"))
+        if [ -n "$new" ]; then
+          echo "::error::New high+ CVEs vs master:"
+          printf '%s\n' "$new"
+          exit 1
+        fi
+        echo "No new high+ CVEs vs master."

.github/workflows/test.yaml

@@ -26,12 +26,12 @@ jobs:
         shell: bash -l {0}
 
     steps:
-    - uses: actions/checkout@v6
+    - uses: actions/checkout@v7
 
     - name: Setup Pixi
-      uses: prefix-dev/setup-pixi@v0.9.5
+      uses: prefix-dev/setup-pixi@v0.10.1
       with:
-        pixi-version: v0.59.0
+        pixi-version: v0.68.1
         cache: true
         cache-write: ${{ github.event_name == 'push' && github.ref_name == 'master' }}
 
@@ -53,7 +53,7 @@ jobs:
         shell: bash -l {0}
 
     steps:
-    - uses: actions/checkout@v6
+    - uses: actions/checkout@v7
 
     - uses: dorny/paths-filter@v4
       id: filter
@@ -86,9 +86,9 @@ jobs:
 
     - name: Setup Pixi
       if: steps.filter.outputs.src == 'true' || github.event_name == 'schedule' || github.event_name == 'workflow_dispatch'
-      uses: prefix-dev/setup-pixi@v0.9.5
+      uses: prefix-dev/setup-pixi@v0.10.1
       with:
-        pixi-version: v0.59.0
+        pixi-version: v0.68.1
         cache: true
         cache-write: ${{ github.event_name == 'push' && github.ref_name == 'master' }}
 
@@ -99,13 +99,13 @@ jobs:
         echo "MONTH=$(date +'%Y%m')" >> $GITHUB_ENV # cutouts
         echo "VERSIONS_HASH=${{ hashFiles('data/versions.csv') }}" >> $GITHUB_ENV
 
-    - uses: actions/cache@v5
+    - uses: actions/cache@v6
       if: steps.filter.outputs.src == 'true' || github.event_name == 'schedule' || github.event_name == 'workflow_dispatch'
       with:
         path: data
         key: data-${{ env.WEEK }}-${{ env.VERSIONS_HASH }}
 
-    - uses: actions/cache@v5
+    - uses: actions/cache@v6
       if: steps.filter.outputs.src == 'true' || github.event_name == 'schedule' || github.event_name == 'workflow_dispatch'
       with:
         path: cutouts
@@ -119,7 +119,7 @@ jobs:
       if: steps.filter.outputs.src == 'true' || github.event_name == 'schedule' || github.event_name == 'workflow_dispatch'
       # check for undefined variables to reuse functions across scripts
       run: |
-        pixi run pylint --disable=all --enable=E0601,E0606 --output-format=parseable scripts/add_* scripts/prepare_* scripts/solve_*
+        pixi run -e dev pylint --disable=all --enable=E0601,E0606 --output-format=parseable scripts/add_* scripts/prepare_* scripts/solve_*
 
     - name: Run snakemake test workflows
       if: steps.filter.outputs.src == 'true' || github.event_name == 'schedule' || github.event_name == 'workflow_dispatch'