Merge branch 'release/ga-4.7'

Author: sebhmg

.github/dependabot.yml

@@ -7,6 +7,8 @@ version: 2
 updates:
   - package-ecosystem: "github-actions"
     directory: "/"
-    schedule:
-      interval: "monthly"
     target-branch: "develop"
+    schedule:
+      interval: "weekly"
+    cooldown:
+      default-days: 4

.github/workflows/issue_to_jira.yml

@@ -4,10 +4,18 @@ on:
   issues:
     types: [opened]
 
+permissions: {}
+
 jobs:
   call-workflow-create-jira-issue:
-    uses: MiraGeoscience/CI-tools/.github/workflows/reusable-jira-issue_to_jira.yml@main
-    secrets: inherit
+    uses: MiraGeoscience/CI-tools/.github/workflows/reusable-jira-issue_to_jira.yml@v2
+    permissions:
+      contents: read
+      issues: write
     with:
       project-key: 'GEOPY'
       components: '[{"name": "grid-apps"}]'
+    secrets:
+      JIRA_BASE_URL: ${{ secrets.JIRA_BASE_URL }}
+      JIRA_API_TOKEN: ${{ secrets.JIRA_API_TOKEN }}
+      JIRA_USER_EMAIL: ${{ secrets.JIRA_USER_EMAIL }}

.github/workflows/pr_add_jira_summary.yml

@@ -1,10 +1,18 @@
 name: Add JIRA issue summary
 
 on:
-  pull_request_target:
+  pull_request:
     types: [opened]
 
+permissions: {}
+
 jobs:
   call-workflow-add-jira-issue-summary:
-    uses: MiraGeoscience/CI-tools/.github/workflows/reusable-jira-pr_add_jira_summary.yml@main
-    secrets: inherit
+    uses: MiraGeoscience/CI-tools/.github/workflows/reusable-jira-pr_add_jira_summary.yml@v2
+    permissions:
+      contents: read
+      pull-requests: write
+    secrets:
+      JIRA_BASE_URL: ${{ secrets.JIRA_BASE_URL }}
+      JIRA_USER_EMAIL: ${{ secrets.JIRA_USER_EMAIL }}
+      JIRA_API_TOKEN: ${{ secrets.JIRA_API_TOKEN }}

.github/workflows/python_analysis.yml

@@ -17,31 +17,34 @@ on:
       - feature/**
       - hotfix/**
 
+permissions: {}
+
 concurrency:
   group: ${{ github.workflow }}-${{ github.head_ref || github.run_id }}
   cancel-in-progress: true
 
 jobs:
   call-workflow-static-analysis:
     name: Static analysis
-    uses: MiraGeoscience/CI-tools/.github/workflows/reusable-python-static_analysis.yml@main
+    uses: MiraGeoscience/CI-tools/.github/workflows/reusable-python-static_analysis.yml@v2
+    permissions:
+      contents: read
+      pull-requests: read
     with:
       package-manager: 'conda'
       app-name: 'grid_apps'
       python-version: '3.10'
-  call-workflow-pre-commmit:
-    name: Pre-Commit
-    uses: MiraGeoscience/CI-tools/.github/workflows/reusable-pre_commit.yml@main
-    with:
-      app-name: 'grid_apps'
   call-workflow-pytest:
     name: Pytest
-    uses: MiraGeoscience/CI-tools/.github/workflows/reusable-python-pytest.yml@main
+    uses: MiraGeoscience/CI-tools/.github/workflows/reusable-python-pytest.yml@v2
+    permissions:
+      contents: read
+      pull-requests: read
     with:
       package-manager: 'conda'
       python-versions: '["3.10", "3.11", "3.12"]'
-      cache-number: 1
       os: '["ubuntu-latest", "windows-latest"]'
+      cache-number: 1
       codecov-reference-python-version: '3.10'
       codecov-reference-os: '["windows-latest"]'
     secrets:

.github/workflows/python_deploy_dev.yml

@@ -5,32 +5,41 @@ on:
     tags:
       - 'v*' # Push events to every version tag (eg. v1.0.0)
 
+permissions: {}
+
 concurrency:
   group: ${{ github.workflow }}-${{ github.ref || github.run_id }}
   cancel-in-progress: true
 
 jobs:
   call-workflow-conda-publish:
     name: Publish development conda package on JFrog Artifactory
-    uses: MiraGeoscience/CI-tools/.github/workflows/reusable-python-publish_rattler_package.yml@main
+    uses: MiraGeoscience/CI-tools/.github/workflows/reusable-python-publish_rattler_package.yml@v2
+    permissions:
+      id-token: write
+      contents: write
     with:
       package-name: 'grid-apps'
       python-version: '3.10'
       source-repo-names: '["public-noremote-conda-dev"]'
       conda-channels: '["conda-forge"]'
-      publish-repo-names: '["geology-noremote-conda-dev", "geophysics-noremote-conda-dev"]'
+      publish-repo-names: '["public-noremote-conda-dev"]'
     secrets:
       JFROG_ARTIFACTORY_URL: ${{ secrets.JFROG_ARTIFACTORY_URL }}
       JFROG_ARTIFACTORY_TOKEN: ${{ secrets.JFROG_ARTIFACTORY_TOKEN }}
   call-workflow-pypi-publish:
-    name: Publish development pypi package (JFrog Artifactory)
-    uses: MiraGeoscience/CI-tools/.github/workflows/reusable-python-publish_pypi_package.yml@main
+    name: Publish development pypi package (JFrog Artifactory, TestPyPI)
+    uses: MiraGeoscience/CI-tools/.github/workflows/reusable-python-publish_pypi_package.yml@v2
+    permissions:
+      id-token: write
+      contents: write
     with:
       package-manager: 'poetry'
       package-name: 'grid-apps'
       version-tag: ${{ github.ref_name }}
       python-version: '3.10'
-      virtual-repo-names: '["geology-pypi-dev", "geophysics-pypi-dev"]'
+      virtual-repo-names: '["public-pypi-dev", "test-pypi"]'
     secrets:
       JFROG_ARTIFACTORY_URL: ${{ secrets.JFROG_ARTIFACTORY_URL }}
       JFROG_ARTIFACTORY_TOKEN: ${{ secrets.JFROG_ARTIFACTORY_TOKEN }}
+      PYPI_TOKEN: ${{ secrets.TEST_PYPI_TOKEN }}

.github/workflows/python_deploy_prod.yml

@@ -19,6 +19,8 @@ on:
         type: boolean
         default: true
 
+permissions: {}
+
 concurrency:
   group: ${{ github.workflow }}-${{ github.event.release.tag_name || github.event.inputs.release-tag || github.run_id }}
   cancel-in-progress: true
@@ -27,21 +29,28 @@ jobs:
   call-workflow-conda-release:
     name: Publish production Conda package on JFrog Artifactory
     if: ${{ github.event_name == 'release' || github.event.inputs.publish-conda == 'true' }}
-    uses: MiraGeoscience/CI-tools/.github/workflows/reusable-python-release_conda_assets.yml@main
+    uses: MiraGeoscience/CI-tools/.github/workflows/reusable-python-release_conda_assets.yml@v2
+    permissions:
+      id-token: write
+      contents: write
     with:
-      virtual-repo-names: '["geology-noremote-conda-prod", "geophysics-noremote-conda-prod"]'
+      virtual-repo-names: '["public-noremote-conda-prod"]'
       release-tag: ${{ github.event.release.tag_name || github.event.inputs.release-tag }}
     secrets:
       JFROG_ARTIFACTORY_URL: ${{ secrets.JFROG_ARTIFACTORY_URL }}
       JFROG_ARTIFACTORY_TOKEN: ${{ secrets.JFROG_ARTIFACTORY_TOKEN }}
   call-workflow-pypi-release:
-    name: Publish production PyPI package (JFrog Artifactory)
+    name: Publish production PyPI package (JFrog Artifactory, PyPI)
     if: ${{ github.event_name == 'release' || github.event.inputs.publish-pypi == 'true' }}
-    uses: MiraGeoscience/CI-tools/.github/workflows/reusable-python-release_pypi_assets.yml@main
+    uses: MiraGeoscience/CI-tools/.github/workflows/reusable-python-release_pypi_assets.yml@v2
+    permissions:
+      id-token: write
+      contents: write
     with:
       package-name: 'grid-apps'
-      virtual-repo-names: '["geology-pypi-prod", "geophysics-pypi-prod"]'
+      virtual-repo-names: '["public-pypi-prod", "pypi"]'
       release-tag: ${{ github.event.release.tag_name || github.event.inputs.release-tag }}
     secrets:
       JFROG_ARTIFACTORY_URL: ${{ secrets.JFROG_ARTIFACTORY_URL }}
       JFROG_ARTIFACTORY_TOKEN: ${{ secrets.JFROG_ARTIFACTORY_TOKEN }}
+      PYPI_TOKEN: ${{ secrets.PYPI_TOKEN }}

.github/workflows/security_scan.yml

@@ -0,0 +1,43 @@
+name: Security Scan
+
+on:
+  pull_request:
+    types: [opened, synchronize, reopened, ready_for_review]
+    branches:
+      - develop
+      - main
+      - release/**
+      - feature/**
+      - hotfix/**
+  push:
+    branches:
+      - develop
+      - main
+      - release/**
+      - feature/**
+      - hotfix/**
+
+permissions: {}
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.head_ref || github.run_id }}
+  cancel-in-progress: true
+
+jobs:
+  call-workflow-zizmor-annotate:
+    name: Zizmor analysis (advanced security)
+    if: ${{ github.event_name != 'pull_request' }}
+    permissions:
+      security-events: write
+      contents: read
+      actions: read
+    uses: MiraGeoscience/CI-tools/.github/workflows/reusable-zizmor-advanced-security.yml@v2
+
+  call-workflow-zizmor-advanced-security:
+    name: Zizmor analysis (annotate)
+    if: ${{ github.event_name == 'pull_request' }}
+    permissions:
+      checks: write
+      contents: read
+      actions: read
+    uses: MiraGeoscience/CI-tools/.github/workflows/reusable-zizmor-annotate.yml@v2

.gitignore

@@ -144,3 +144,6 @@ dmypy.json
 
 # tempory generated files
 pyproject-sha.toml
+
+#version ignore
+grid_apps/_version.py

.idea/copyright/MiraGeoscience.xml

@@ -11,22 +11,27 @@ ci:
     autoupdate_schedule: monthly
 
 repos:
+# -   repo: https://github.com/python-poetry/poetry  # TODO: re-enable with pixi (does not support source=pypi)
+#     rev: 2.2.1
+#     hooks:
+#     -   id: poetry-check
+#         args: [--no-plugins]
 -   repo: https://github.com/hadialqattan/pycln
-    rev: v2.5.0
+    rev: v2.6.0
     hooks:
     -   id: pycln
         args: [ --config=pyproject.toml ]
 -   repo: https://github.com/astral-sh/ruff-pre-commit
-    rev: v0.9.1
+    rev: v0.14.3
     hooks:
-    -   id: ruff
+    -   id: ruff-check
         args:
         -   --fix
         -   --exit-non-zero-on-fix
 #        -   --unsafe-fixes
     -   id: ruff-format
 -   repo: https://github.com/pre-commit/mirrors-mypy
-    rev: v1.14.1
+    rev: v1.18.2
     hooks:
     -   id: mypy
         additional_dependencies: [
@@ -65,13 +70,13 @@ repos:
         types: [python]
         exclude: ^(devtools|docs|grid_apps-assets)/
 -   repo: https://github.com/codespell-project/codespell
-    rev: v2.3.0
+    rev: v2.4.1
     hooks:
     -   id: codespell
         exclude: (-lock\.ya?ml|\benvironments/.*\.ya?ml|\.ipynb|^THIRD_PARTY_SOFTWARE\.rst)$
         entry: codespell -I .codespellignore
 -   repo: https://github.com/pre-commit/pre-commit-hooks
-    rev: v5.0.0
+    rev: v6.0.0
     hooks:
     -   id: trailing-whitespace
         exclude: \.mdj$
@@ -99,7 +104,7 @@ repos:
         exclude_types: [jupyter]
         exclude: ^docs/(.*/)?images/
 -   repo: https://github.com/rstcheck/rstcheck
-    rev: v6.2.4
+    rev: v6.2.5
     hooks:
     -   id: rstcheck
         exclude: ^THIRD_PARTY_SOFTWARE.rst$