From c6bfd42a18e7771304f6601598cd2b818e749044 Mon Sep 17 00:00:00 2001 From: yaswant <2984440+yaswant@users.noreply.github.com> Date: Fri, 17 Jul 2026 09:19:24 +0100 Subject: [PATCH 1/2] Update GitHub workflows --- .github/pull_request_template.md | 15 +++++------ .github/workflows/cla-check.yaml | 21 ++++++++++++++- .github/workflows/track-review-project.yaml | 26 +++++++++++++++++++ .../workflows/trigger-project-workflow.yaml | 26 +++++++++++++++++++ .github/zizmor.yml | 23 ++++++++++++++++ CONTRIBUTORS.md | 9 ++++--- 6 files changed, 106 insertions(+), 14 deletions(-) create mode 100644 .github/workflows/track-review-project.yaml create mode 100644 .github/workflows/trigger-project-workflow.yaml create mode 100644 .github/zizmor.yml diff --git a/.github/pull_request_template.md b/.github/pull_request_template.md index ab619bc..2bc8c77 100644 --- a/.github/pull_request_template.md +++ b/.github/pull_request_template.md @@ -1,5 +1,7 @@ # PR Summary + + Code Reviewer: @@ -25,8 +27,7 @@ Code Reviewer: - [ ] I have performed a self-review of my own code - [ ] My code follows the project's style guidelines -- [ ] Comments have been included that aid undertanding and enhance the - readability of the code +- [ ] Comments have been included that aid understanding and enhance the readability of the code - [ ] My changes generate no new warnings ## Testing @@ -41,16 +42,12 @@ _Describe what testing has been done here_ ## Performance Impact -- [ ] Performance of the code has been considered and, if applicable, suitable - performance measurements have been conducted +- [ ] Performance of the code has been considered and, if applicable, suitable performance measurements have been conducted ## AI Assistance and Attribution -- [ ] Some of the content of this change has been produced with the assistance - of _Generative AI tool name_ (e.g., Met Office Github Copilot Enterprise, - Github Copilot Personal, ChatGPT GPT-4, etc) and I have followed the - [Simulation Systems AI policy](https://metoffice.github.io/simulation-systems/FurtherDetails/ai.html) - (including attribution labels) +- [ ] Some of the content of this change has been produced with the assistance of _Generative AI tool name_ (e.g., Met Office Github Copilot Enterprise, + Github Copilot Personal, ChatGPT GPT-4, etc) and I have followed the [Simulation Systems AI policy](https://metoffice.github.io/simulation-systems/FurtherDetails/ai.html) (including attribution labels) diff --git a/.github/workflows/cla-check.yaml b/.github/workflows/cla-check.yaml index 3d28d73..9e8701b 100644 --- a/.github/workflows/cla-check.yaml +++ b/.github/workflows/cla-check.yaml @@ -1,10 +1,29 @@ +# ----------------------------------------------------------------------------- +# (C) Crown copyright Met Office. All rights reserved. +# The file LICENCE, distributed with this code, contains details of the terms +# under which the code may be used. +# ----------------------------------------------------------------------------- + +# Check Contributor Licence Agreement + name: Legal on: pull_request_target: +concurrency: + # Automatically cancels the workflow run instantly before the + # engine can parse empty jobs and generate notification emails + group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.sha }} + cancel-in-progress: ${{ github.event.pull_request.head.repo.full_name != 'MetOffice/monc' }} + +permissions: {} + jobs: cla: - uses: MetOffice/growss/.github/workflows/cla-check.yaml@main + permissions: + contents: read # Required to evaluate the event trigger metadata safely + pull-requests: write # Required for the downstream engine to post status comments on the PR + uses: MetOffice/growss/.github/workflows/cla-check.yaml@develop with: runner: 'ubuntu-24.04' diff --git a/.github/workflows/track-review-project.yaml b/.github/workflows/track-review-project.yaml new file mode 100644 index 0000000..0a0bc1d --- /dev/null +++ b/.github/workflows/track-review-project.yaml @@ -0,0 +1,26 @@ +# ----------------------------------------------------------------------------- +# (C) Crown copyright Met Office. All rights reserved. +# The file LICENCE, distributed with this code, contains details of the terms +# under which the code may be used. +# ----------------------------------------------------------------------------- + +name: Track Review Project + +on: + workflow_run: + workflows: [Trigger Review Project] + types: + - completed + +permissions: + contents: read # Required to evaluate the event trigger metadata safely + +jobs: + track_review_project: + permissions: + actions: read # Required to check out code or parse files safely + contents: read # Required to read the upstream triggered workflow run artifact status + pull-requests: write # Required for the downstream engine to add comments or update metadata on the PR + uses: MetOffice/growss/.github/workflows/track-review-project.yaml@develop + secrets: + PROJECT_ACTION_PAT: ${{ secrets.PROJECT_ACTION_PAT }} diff --git a/.github/workflows/trigger-project-workflow.yaml b/.github/workflows/trigger-project-workflow.yaml new file mode 100644 index 0000000..0631e2b --- /dev/null +++ b/.github/workflows/trigger-project-workflow.yaml @@ -0,0 +1,26 @@ +# ----------------------------------------------------------------------------- +# (C) Crown copyright Met Office. All rights reserved. +# The file LICENCE, distributed with this code, contains details of the terms +# under which the code may be used. +# ----------------------------------------------------------------------------- + +name: Trigger Review Project + +on: + pull_request_target: + types: ["opened", "synchronize", "reopened", "edited", "review_requested", "review_request_removed", "closed"] + pull_request_review: + pull_request_review_comment: + +permissions: + contents: read # Required to evaluate the event trigger metadata safely + +jobs: + trigger_project_workflow: + if: github.repository == 'MetOffice/monc' + + permissions: + actions: read # Required to check out code or parse files safely + contents: read # Required to read the upstream triggered workflow run artifact status + pull-requests: write # Required for the downstream engine to add comments or update metadata on the PR + uses: MetOffice/growss/.github/workflows/trigger-project-workflow.yaml@develop diff --git a/.github/zizmor.yml b/.github/zizmor.yml new file mode 100644 index 0000000..105a31d --- /dev/null +++ b/.github/zizmor.yml @@ -0,0 +1,23 @@ +# ------------------------------------------------------------------------------ +# (c) Crown copyright Met Office. All rights reserved. +# The file LICENCE, distributed with this code, contains details of the terms +# under which the code may be used. +# ------------------------------------------------------------------------------ + +# Rules for Zizmor GitHub workflow linter. This file is used to configure which +# rules to ignore for specific workflow files, allowing for exceptions to be +# made where necessary while still enforcing best practices across the codebase. +rules: + unpinned-uses: + ignore: + - "check-cr-approved.yaml" + - "cla-check.yaml" + - "lint-fortran.yaml" + - "track-review-project.yaml" + - "trigger-project-workflow.yaml" + dangerous-triggers: + ignore: + - "cla-check.yaml" + - "lint-fortran.yaml" + - "track-review-project.yaml" + - "trigger-project-workflow.yaml" diff --git a/CONTRIBUTORS.md b/CONTRIBUTORS.md index ec0042d..caa46c9 100644 --- a/CONTRIBUTORS.md +++ b/CONTRIBUTORS.md @@ -1,6 +1,7 @@ # Contributors -| GitHub user | Real Name | Affiliation | Date | -| ----------- | --------- | ----------- | ---- | -| james-bruten-mo | James Bruten | Met Office | 2025-12-09 | -| trjr | Todd Jones | University of Reading | 2026-05-01 | +| GitHub user | Real Name | Affiliation | Date | +| --------------- | --------------- | --------------------- | ---------- | +| james-bruten-mo | James Bruten | Met Office | 2025-12-09 | +| trjr | Todd Jones | University of Reading | 2026-05-01 | +| yaswant | Yaswant Pradhan | Met Office | 2026-07-17 | From bd5eac115dbf03305cbd8c1f962f339a5b70fa52 Mon Sep 17 00:00:00 2001 From: yaswant <2984440+yaswant@users.noreply.github.com> Date: Wed, 22 Jul 2026 16:22:56 +0100 Subject: [PATCH 2/2] Update workflow references to specific version tags in GitHub actions --- .github/workflows/cla-check.yaml | 4 +--- .github/workflows/track-review-project.yaml | 2 +- .github/workflows/trigger-project-workflow.yaml | 2 +- .github/zizmor.yml | 7 ------- 4 files changed, 3 insertions(+), 12 deletions(-) diff --git a/.github/workflows/cla-check.yaml b/.github/workflows/cla-check.yaml index 9e8701b..8b4069f 100644 --- a/.github/workflows/cla-check.yaml +++ b/.github/workflows/cla-check.yaml @@ -24,6 +24,4 @@ jobs: permissions: contents: read # Required to evaluate the event trigger metadata safely pull-requests: write # Required for the downstream engine to post status comments on the PR - uses: MetOffice/growss/.github/workflows/cla-check.yaml@develop - with: - runner: 'ubuntu-24.04' + uses: MetOffice/growss/.github/workflows/cla-check.yaml@0f9ffe6a138ae9943053621916a850a075997db8 # v1.0.0 diff --git a/.github/workflows/track-review-project.yaml b/.github/workflows/track-review-project.yaml index 0a0bc1d..1ab6012 100644 --- a/.github/workflows/track-review-project.yaml +++ b/.github/workflows/track-review-project.yaml @@ -21,6 +21,6 @@ jobs: actions: read # Required to check out code or parse files safely contents: read # Required to read the upstream triggered workflow run artifact status pull-requests: write # Required for the downstream engine to add comments or update metadata on the PR - uses: MetOffice/growss/.github/workflows/track-review-project.yaml@develop + uses: MetOffice/growss/.github/workflows/track-review-project.yaml@0f9ffe6a138ae9943053621916a850a075997db8 # v1.0.0 secrets: PROJECT_ACTION_PAT: ${{ secrets.PROJECT_ACTION_PAT }} diff --git a/.github/workflows/trigger-project-workflow.yaml b/.github/workflows/trigger-project-workflow.yaml index 0631e2b..0a28dcb 100644 --- a/.github/workflows/trigger-project-workflow.yaml +++ b/.github/workflows/trigger-project-workflow.yaml @@ -23,4 +23,4 @@ jobs: actions: read # Required to check out code or parse files safely contents: read # Required to read the upstream triggered workflow run artifact status pull-requests: write # Required for the downstream engine to add comments or update metadata on the PR - uses: MetOffice/growss/.github/workflows/trigger-project-workflow.yaml@develop + uses: MetOffice/growss/.github/workflows/trigger-project-workflow.yaml@0f9ffe6a138ae9943053621916a850a075997db8 # v1.0.0 diff --git a/.github/zizmor.yml b/.github/zizmor.yml index 105a31d..16ed4d9 100644 --- a/.github/zizmor.yml +++ b/.github/zizmor.yml @@ -8,13 +8,6 @@ # rules to ignore for specific workflow files, allowing for exceptions to be # made where necessary while still enforcing best practices across the codebase. rules: - unpinned-uses: - ignore: - - "check-cr-approved.yaml" - - "cla-check.yaml" - - "lint-fortran.yaml" - - "track-review-project.yaml" - - "trigger-project-workflow.yaml" dangerous-triggers: ignore: - "cla-check.yaml"