From e0d9edb31f3898adf3d04cbf3c494b9cc2d59b10 Mon Sep 17 00:00:00 2001 From: yaswant <2984440+yaswant@users.noreply.github.com> Date: Fri, 17 Jul 2026 10:29:42 +0100 Subject: [PATCH 1/2] Update GitHub workflows --- .github/workflows/checks.yaml | 11 +++++-- .github/workflows/cla-check.yaml | 32 +++++++++++-------- .github/workflows/track-review-project.yaml | 26 +++++++++++++++ .../workflows/trigger-project-workflow.yaml | 26 +++++++++++++++ .github/zizmor.yml | 20 ++++++++++++ 5 files changed, 99 insertions(+), 16 deletions(-) create mode 100644 .github/workflows/track-review-project.yaml create mode 100644 .github/workflows/trigger-project-workflow.yaml create mode 100644 .github/zizmor.yml diff --git a/.github/workflows/checks.yaml b/.github/workflows/checks.yaml index ae8901d..1d94b58 100644 --- a/.github/workflows/checks.yaml +++ b/.github/workflows/checks.yaml @@ -18,6 +18,9 @@ concurrency: group: ${{ github.workflow }}-${{ github.ref }} cancel-in-progress: true +permissions: + contents: read # for actions/checkout + jobs: checks: runs-on: "ubuntu-24.04" @@ -27,16 +30,18 @@ jobs: VENV_PATH: '.venv' steps: - - uses: actions/checkout@v6 + - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 + with: + persist-credentials: false - name: Setup uv - uses: astral-sh/setup-uv@v7 + uses: astral-sh/setup-uv@11f9893b081a58869d3b5fccaea48c9e9e46f990 # v8.3.2 with: python-version: ${{ env.UV_PYTHON }} enable-cache: true - name: Cache uv venv - uses: actions/cache@v4 + uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.5 with: path: ${{ env.VENV_PATH }} key: ${{ runner.os }}-${{ hashFiles('uv.lock') }} diff --git a/.github/workflows/cla-check.yaml b/.github/workflows/cla-check.yaml index 177ea87..60ea6d4 100644 --- a/.github/workflows/cla-check.yaml +++ b/.github/workflows/cla-check.yaml @@ -1,21 +1,27 @@ -# ------------------------------------------------------------------------------ -# (c) Crown copyright Met Office. All rights reserved. -# The file LICENCE, distributed with this code, contains details of the terms -# under which the code may be used. -# ------------------------------------------------------------------------------ -# Check Contributor License Agreement -# This check is excluded files in source/rose_picker/rose/ directory as these -# are third-party code and not covered by the Momentum-CA. +# ----------------------------------------------------------------------------- +# (C) Crown copyright Met Office. All rights reserved. +# The file LICENCE, distributed with this code, contains details of the terms +# under which the code may be used. +# ----------------------------------------------------------------------------- + +# Check Contributor Licence Agreement name: Legal on: pull_request_target: - paths-ignore: - - "source/rose_picker/rose/**" + +concurrency: + # Automatically cancels the workflow run instantly before the + # engine can parse empty jobs and generate notification emails + group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.sha }} + cancel-in-progress: ${{ github.event.pull_request.head.repo.full_name != 'MetOffice/rose_picker' }} + +permissions: {} jobs: cla: - uses: MetOffice/growss/.github/workflows/cla-check.yaml@main - with: - runner: "ubuntu-24.04" + permissions: + contents: read # Required to evaluate the event trigger metadata safely + pull-requests: write # Required for the downstream engine to post status comments on the PR + uses: MetOffice/growss/.github/workflows/cla-check.yaml@develop diff --git a/.github/workflows/track-review-project.yaml b/.github/workflows/track-review-project.yaml new file mode 100644 index 0000000..0a0bc1d --- /dev/null +++ b/.github/workflows/track-review-project.yaml @@ -0,0 +1,26 @@ +# ----------------------------------------------------------------------------- +# (C) Crown copyright Met Office. All rights reserved. +# The file LICENCE, distributed with this code, contains details of the terms +# under which the code may be used. +# ----------------------------------------------------------------------------- + +name: Track Review Project + +on: + workflow_run: + workflows: [Trigger Review Project] + types: + - completed + +permissions: + contents: read # Required to evaluate the event trigger metadata safely + +jobs: + track_review_project: + permissions: + actions: read # Required to check out code or parse files safely + contents: read # Required to read the upstream triggered workflow run artifact status + pull-requests: write # Required for the downstream engine to add comments or update metadata on the PR + uses: MetOffice/growss/.github/workflows/track-review-project.yaml@develop + secrets: + PROJECT_ACTION_PAT: ${{ secrets.PROJECT_ACTION_PAT }} diff --git a/.github/workflows/trigger-project-workflow.yaml b/.github/workflows/trigger-project-workflow.yaml new file mode 100644 index 0000000..5716298 --- /dev/null +++ b/.github/workflows/trigger-project-workflow.yaml @@ -0,0 +1,26 @@ +# ----------------------------------------------------------------------------- +# (C) Crown copyright Met Office. All rights reserved. +# The file LICENCE, distributed with this code, contains details of the terms +# under which the code may be used. +# ----------------------------------------------------------------------------- + +name: Trigger Review Project + +on: + pull_request_target: + types: ["opened", "synchronize", "reopened", "edited", "review_requested", "review_request_removed", "closed"] + pull_request_review: + pull_request_review_comment: + +permissions: + contents: read # Required to evaluate the event trigger metadata safely + +jobs: + trigger_project_workflow: + if: github.repository == 'MetOffice/rose_picker' + + permissions: + actions: read # Required to check out code or parse files safely + contents: read # Required to read the upstream triggered workflow run artifact status + pull-requests: write # Required for the downstream engine to add comments or update metadata on the PR + uses: MetOffice/growss/.github/workflows/trigger-project-workflow.yaml@develop diff --git a/.github/zizmor.yml b/.github/zizmor.yml new file mode 100644 index 0000000..0494276 --- /dev/null +++ b/.github/zizmor.yml @@ -0,0 +1,20 @@ +# ------------------------------------------------------------------------------ +# (c) Crown copyright Met Office. All rights reserved. +# The file LICENCE, distributed with this code, contains details of the terms +# under which the code may be used. +# ------------------------------------------------------------------------------ + +# Rules for Zizmor GitHub workflow linter. This file is used to configure which +# rules to ignore for specific workflow files, allowing for exceptions to be +# made where necessary while still enforcing best practices across the codebase. +rules: + unpinned-uses: + ignore: + - "cla-check.yaml" + - "track-review-project.yaml" + - "trigger-project-workflow.yaml" + dangerous-triggers: + ignore: + - "cla-check.yaml" + - "track-review-project.yaml" + - "trigger-project-workflow.yaml" From 8b3cbd5baa391ea69e8590d8e758b8e444c6f5ba Mon Sep 17 00:00:00 2001 From: yaswant <2984440+yaswant@users.noreply.github.com> Date: Wed, 22 Jul 2026 16:21:51 +0100 Subject: [PATCH 2/2] Update workflow references to specific commit hashes --- .github/workflows/cla-check.yaml | 2 +- .github/workflows/track-review-project.yaml | 2 +- .github/workflows/trigger-project-workflow.yaml | 2 +- .github/zizmor.yml | 5 ----- 4 files changed, 3 insertions(+), 8 deletions(-) diff --git a/.github/workflows/cla-check.yaml b/.github/workflows/cla-check.yaml index 60ea6d4..97cb293 100644 --- a/.github/workflows/cla-check.yaml +++ b/.github/workflows/cla-check.yaml @@ -24,4 +24,4 @@ jobs: permissions: contents: read # Required to evaluate the event trigger metadata safely pull-requests: write # Required for the downstream engine to post status comments on the PR - uses: MetOffice/growss/.github/workflows/cla-check.yaml@develop + uses: MetOffice/growss/.github/workflows/cla-check.yaml@0f9ffe6a138ae9943053621916a850a075997db8 # v1.0.0 diff --git a/.github/workflows/track-review-project.yaml b/.github/workflows/track-review-project.yaml index 0a0bc1d..1ab6012 100644 --- a/.github/workflows/track-review-project.yaml +++ b/.github/workflows/track-review-project.yaml @@ -21,6 +21,6 @@ jobs: actions: read # Required to check out code or parse files safely contents: read # Required to read the upstream triggered workflow run artifact status pull-requests: write # Required for the downstream engine to add comments or update metadata on the PR - uses: MetOffice/growss/.github/workflows/track-review-project.yaml@develop + uses: MetOffice/growss/.github/workflows/track-review-project.yaml@0f9ffe6a138ae9943053621916a850a075997db8 # v1.0.0 secrets: PROJECT_ACTION_PAT: ${{ secrets.PROJECT_ACTION_PAT }} diff --git a/.github/workflows/trigger-project-workflow.yaml b/.github/workflows/trigger-project-workflow.yaml index 5716298..aa8f7c6 100644 --- a/.github/workflows/trigger-project-workflow.yaml +++ b/.github/workflows/trigger-project-workflow.yaml @@ -23,4 +23,4 @@ jobs: actions: read # Required to check out code or parse files safely contents: read # Required to read the upstream triggered workflow run artifact status pull-requests: write # Required for the downstream engine to add comments or update metadata on the PR - uses: MetOffice/growss/.github/workflows/trigger-project-workflow.yaml@develop + uses: MetOffice/growss/.github/workflows/trigger-project-workflow.yaml@0f9ffe6a138ae9943053621916a850a075997db8 # v1.0.0 diff --git a/.github/zizmor.yml b/.github/zizmor.yml index 0494276..e66c5e7 100644 --- a/.github/zizmor.yml +++ b/.github/zizmor.yml @@ -8,11 +8,6 @@ # rules to ignore for specific workflow files, allowing for exceptions to be # made where necessary while still enforcing best practices across the codebase. rules: - unpinned-uses: - ignore: - - "cla-check.yaml" - - "track-review-project.yaml" - - "trigger-project-workflow.yaml" dangerous-triggers: ignore: - "cla-check.yaml"