Skip to content

Commit ba030d8

Browse files
yantoscayantosca
committed
Merge PR #370 (Add "Lint" GitHub action and fixed security issues)
This merge brings PR #370 (Add "Lint" GitHub actions and fixed security issues in other actions, by @yantosca) into the GCPy development stream. In PR #370 we have done the following: 1. Added the "lint-ci-workflows` GitHub action 2. Fixed various security issues in GitHub actions 3. Updated badges in README.md and docs/source/index.rst to show the results of GitHub actions. Signed-off-by: Bob Yantosca <[email protected]>
2 parents b7212f1 + ca3fabf commit ba030d8

File tree

10 files changed

+166
-56
lines changed

10 files changed

+166
-56
lines changed

‎.github/workflows/build-gcpy-environment-py312.yml

Lines changed: 7 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -18,10 +18,14 @@ jobs:
1818
runs-on: ubuntu-latest
1919
strategy:
2020
matrix:
21-
python-version: ["3.9", "3.10", "3.11", "3.12", "3.13"]
21+
python-version: ["3.9", "3.10", "3.11", "3.12", "3.13", "3.14"]
2222
steps:
2323
- name: Checkout the GCPy repository
2424
uses: actions/checkout@v4
25+
with:
26+
fetch-depth: 0
27+
persist-credentials: false
28+
2529
- name: Create "gcpy_env" environment
2630
uses: mamba-org/setup-micromamba@v1
2731
with:
@@ -31,9 +35,11 @@ jobs:
3135
cache-environment: false
3236
generate-run-shell: true
3337
post-cleanup: 'all'
38+
3439
- name: Test if "import gcpy" works
3540
run: python -c "import gcpy"
3641
shell: micromamba-shell {0}
42+
3743
- name: Test if we can create a plot
3844
run: python -m gcpy.examples.plotting.create_test_plot
3945
shell: micromamba-shell {0}

‎.github/workflows/build-gcpy-environment-py313.yml

Lines changed: 8 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
---
22
#
33
# GitHub action to build the GCPy production environment
4-
# (for Python 3.12) with micromamba
4+
# (for Python 3.13) with micromamba
55
# See: https://github.com/marketplace/actions/setup-micromamba
66
#
77
name: build-gcpy-environment-py313
@@ -18,10 +18,14 @@ jobs:
1818
runs-on: ubuntu-latest
1919
strategy:
2020
matrix:
21-
python-version: ["3.9", "3.10", "3.11", "3.12", "3.13"]
21+
python-version: ["3.9", "3.10", "3.11", "3.12", "3.13", "3.14"]
2222
steps:
2323
- name: Checkout the GCPy repository
2424
uses: actions/checkout@v4
25+
with:
26+
fetch-depth: 0
27+
persist-credentials: false
28+
2529
- name: Create "gcpy_env" environment
2630
uses: mamba-org/setup-micromamba@v1
2731
with:
@@ -31,9 +35,11 @@ jobs:
3135
cache-environment: false
3236
generate-run-shell: true
3337
post-cleanup: 'all'
38+
3439
- name: Test if "import gcpy" works
3540
run: python -c "import gcpy"
3641
shell: micromamba-shell {0}
42+
3743
- name: Test if we can create a plot
3844
run: python -m gcpy.examples.plotting.create_test_plot
3945
shell: micromamba-shell {0}

‎.github/workflows/build-rtd-environment.yml

Lines changed: 6 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -17,10 +17,14 @@ jobs:
1717
runs-on: ubuntu-latest
1818
strategy:
1919
matrix:
20-
python-version: ["3.9", "3.10", "3.11", "3.12", "3.13"]
20+
python-version: ["3.9", "3.10", "3.11", "3.12", "3.13", "3.14"]
2121
steps:
2222
- name: Checkout the GCPy repository
2323
uses: actions/checkout@v4
24+
with:
25+
fetch-depth: 0
26+
persist-credentials: false
27+
2428
- name: Create "rtd_env" environment
2529
uses: mamba-org/setup-micromamba@v1
2630
with:
@@ -30,6 +34,7 @@ jobs:
3034
cache-environment: false
3135
generate-run-shell: true
3236
post-cleanup: 'all'
37+
3338
- name: Get version numbers of packages
3439
run: |
3540
python --version

‎.github/workflows/codeql.yml

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -47,6 +47,9 @@ jobs:
4747
steps:
4848
- name: Checkout repository
4949
uses: actions/checkout@v4
50+
with:
51+
fetch-depth: 0
52+
persist-credentials: false
5053

5154
# Initializes the CodeQL tools for scanning.
5255
- name: Initialize CodeQL

‎.github/workflows/lint-ci-workflows.yml

Lines changed: 77 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,77 @@
1+
# Workflow to run linting checks on source
2+
name: Lint
3+
4+
# Controls when the workflow will run
5+
on:
6+
# Triggers the workflow on pushes to the "main", "dev", or "dev/** branches,
7+
# i.e., PR merges
8+
push:
9+
branches: [ "main", "dev", "dev/**" ]
10+
11+
# Triggers the workflow on pushes to open pull requests with code changes
12+
pull_request:
13+
paths:
14+
- '.github/workflows/*.yml'
15+
16+
# Allows you to run this workflow manually from the Actions tab
17+
# (usually leave it blank)
18+
workflow_dispatch:
19+
20+
# Allow the jobs to read the secret GitHub token
21+
permissions:
22+
contents: read
23+
24+
# Cancel jobs running if new commits are pushed
25+
concurrency:
26+
group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
27+
cancel-in-progress: true
28+
29+
# Workflow run - one or more jobs that can run sequentially or in parallel
30+
jobs:
31+
32+
# This workflow contains a single job called "lint"
33+
lint:
34+
35+
# The type of runner that the job will run on
36+
runs-on: ubuntu-latest
37+
38+
# Don't quit the Action at the first
39+
strategy:
40+
fail-fast: false
41+
42+
# GitHub secret token
43+
env:
44+
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
45+
46+
# Steps represent a sequence of tasks that will be
47+
# executed as part of the job
48+
steps:
49+
50+
# Checks-out your repository under $GITHUB_WORKSPACE,
51+
# so your job can access it
52+
- name: Checkout code
53+
with:
54+
persist-credentials: false
55+
uses: actions/checkout@v4
56+
57+
# Installs Python 3.x
58+
- name: Install Python
59+
uses: actions/setup-python@v5
60+
with:
61+
python-version: '3.x'
62+
63+
# Installs Python packages
64+
- name: Install dependencies
65+
run: |
66+
python -m pip install --upgrade pip
67+
python -m venv ci_venv
68+
. ci_venv/bin/activate
69+
pip install zizmor==0.9.2
70+
71+
# Apply GitHub Actions linter, zizmor
72+
- name: zizmor
73+
if: always()
74+
run: |
75+
cd ${{ github.workspace }}
76+
. ci_venv/bin/activate
77+
zizmor .github/workflows/*.yml

‎.github/workflows/publish-python.yml

Lines changed: 34 additions & 22 deletions
Original file line numberDiff line numberDiff line change
@@ -1,39 +1,51 @@
1-
# This workflow will upload a Python Package using Twine when a release is created
2-
# For more information see: https://docs.github.com/en/actions/automating-builds-and-tests/building-and-testing-python#publishing-to-package-registries
1+
# This workflow will upload a Python Package using Twine when a
2+
# release is created. For more information see:
3+
# https://docs.github.com/en/actions/automating-builds-and-tests/building-and-testing-python#publishing-to-package-registries
34

45
# This workflow uses actions that are not certified by GitHub.
56
# They are provided by a third-party and are governed by
67
# separate terms of service, privacy policy, and support
78
# documentation.
89

9-
name: Upload GCPy to PyPI
10+
name: Publish GCPy to PyPI as geoschem-gcpy
1011

1112
on:
1213
release:
1314
types: [published]
1415

15-
permissions:
16-
contents: read
17-
1816
jobs:
17+
1918
deploy:
2019

20+
permissions:
21+
id-token: write
22+
contents: read
23+
2124
runs-on: ubuntu-latest
2225

2326
steps:
24-
- uses: actions/checkout@v4
25-
- name: Set up Python
26-
uses: actions/setup-python@v5
27-
with:
28-
python-version: '3.x'
29-
- name: Install dependencies
30-
run: |
31-
python -m pip install --upgrade pip
32-
pip install build
33-
- name: Build package
34-
run: python -m build
35-
- name: Publish package
36-
uses: pypa/gh-action-pypi-publish@27b31702a0e7fc50959f5ad993c78deac1bdfc29
37-
with:
38-
user: __token__
39-
password: ${{ secrets.PYPI_KEY }}
27+
28+
- name: Checkout GCPy code
29+
uses: actions/checkout@v4
30+
with:
31+
persist-credentials: false
32+
33+
- name: Set up Python
34+
uses: actions/setup-python@v5
35+
with:
36+
python-version: '3.x'
37+
38+
- name: Install dependencies
39+
run: |
40+
python -m pip install --upgrade pip
41+
pip install build
42+
43+
- name: Build GCPy
44+
run: python -m build
45+
46+
# NOTE: We have defined https://github.com/geoschem/gcpy
47+
# as a Trusted Publisher for geoschem-gcpy at PyPI.org
48+
- name: Publish geoschem-gcpy
49+
uses: pypa/gh-action-pypi-publish@release/v1
50+
with:
51+
skip-existing: true

‎CHANGELOG.md

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -8,13 +8,18 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
88
### Added
99
- Added `gcpy/profile/vtune_plot_hotspots.py` to plot a bargraph of hotspots from Intel VTune reports
1010
- Added ReadTheDocs documentation for plotting hotspots from Intel VTune reports
11+
- Added "Lint" GitHub Action to check other actions for security issues
12+
- Added `gcpy_environment_py314.ym1` to specify the GCPy environment packages with Python 3.14
13+
- Added GitHub action `build-gcpy-environment-py314.yml` to test building the GCPy environment with Python 3.14
1114

1215
### Changed
1316
- Modified criteria for terminating read of log files in `benchmark_scrape_gcclassic_timers.py` to avoid being spoofed by output that is attached by Intel VTune
1417
- Moved `gprofng_text_to_data_units` to function `text_to_data_units` in `gcpy/plot/core.py` so that it can be used by `gprofng_functions` and `vtune_plot_hotspots`
18+
- Updated GitHub badges in `README.md` and `docs/source/index.rst`
1519

1620
### Fixed
1721
- Fix grid area calculation scripts of `grid_area` in `gcpy/gcpy/cstools.py`
22+
- Fixed various security issues in GitHub Actions workflows
1823

1924
## [1.6.2] - 2025-06-12
2025
### Added

‎README.md

Lines changed: 12 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -1,18 +1,20 @@
11
# GCPy: Python toolkit for GEOS-Chem
22

33
<p>
4-
<a href="https://github.com/geoschem/gcpy/releases"><img src="https://img.shields.io/github/v/release/geoschem/gcpy?label=Latest%20Stable%20Release"></a>
5-
<a href="https://anaconda.org/conda-forge/geoschem-gcpy"> <img src="https://anaconda.org/conda-forge/geoschem-gcpy/badges/version.svg" /> </a>
6-
<a href="https://img.shields.io/pypi/v/geoschem-gcpy"><img alt="PyPI - Version" src="https://img.shields.io/pypi/v/geoschem-gcpy"></a>
7-
<a href="https://github.com/geoschem/gcpy/releases/"><img src="https://img.shields.io/github/release-date/geoschem/gcpy"></a>
4+
<a href="https://github.com/geoschem/gcpy/releases"><img src="https://img.shields.io/github/v/release/geoschem/gcpy?label=Latest%20Stable%20Release" alt="Latest release" /></a>
5+
<a href="https://anaconda.org/conda-forge/geoschem-gcpy"> <img src="https://anaconda.org/conda-forge/geoschem-gcpy/badges/version.svg" alt="Anaconda version" /> </a>
6+
<a href="https://img.shields.io/pypi/v/geoschem-gcpy"><img src="https://img.shields.io/pypi/v/geoschem-gcpy" alt="PyPI version" /></a>
7+
<a href="https://github.com/geoschem/gcpy/releases/"><img src="https://img.shields.io/github/release-date/geoschem/gcpy" alt="Release date" /></a>
8+
<a href="https://anaconda.org/conda-forge/geoschem-gcpy"> <img src="https://anaconda.org/conda-forge/geoschem-gcpy/badges/platforms.svg" alt="Platforms" /> </a>
89
<br />
9-
<a href="https://anaconda.org/conda-forge/geoschem-gcpy"> <img src="https://anaconda.org/conda-forge/geoschem-gcpy/badges/platforms.svg" /> </a>
10-
<a href="https://doi.org/10.5281/zenodo.3689589"><img src="https://zenodo.org/badge/DOI/10.5281/zenodo.3689589.svg" alt="DOI"></a>
11-
<a href="https://github.com/geoschem/gcpy/blob/main/LICENSE.txt"><img src="https://img.shields.io/badge/License-MIT-blue.svg"></a>
10+
<a href="https://doi.org/10.5281/zenodo.3689589"><img src="https://zenodo.org/badge/DOI/10.5281/zenodo.3689589.svg" alt="DOI" /></a>
11+
<a href="https://github.com/geoschem/gcpy/blob/main/LICENSE.txt"><img src="https://img.shields.io/badge/License-MIT-blue.svg" alt="License" /></a>
12+
<a href="https://gcpy.readthedocs.io/en/latest/"><img src="https://img.shields.io/readthedocs/gcpy?label=ReadTheDocs" alt="ReadTheDocs" /></a>
13+
<a href="https://github.com/geoschem/gcpy/actions/workflows/build-gcpy-environment-py312.yml"><img src="https://github.com/geoschem/gcpy/actions/workflows/build-gcpy-environment-py312.yml/badge.svg" alt="build-gcpy-environment-py312" /></a>
1214
<br />
13-
<a href="https://gcpy.readthedocs.io/en/latest/"><img src="https://img.shields.io/readthedocs/gcpy?label=ReadTheDocs"></a>
14-
<a href="https://github.com/geoschem/gcpy/actions/workflows/build-gcpy-environment.yml"><img src="https://github.com/geoschem/gcpy/actions/workflows/build-gcpy-environment.yml/badge.svg"></a>
15-
<a href="https://anaconda.org/conda-forge/geoschem-gcpy"> <img src="https://anaconda.org/conda-forge/geoschem-gcpy/badges/downloads.svg" /> </a>
15+
<a href="https://github.com/geoschem/gcpy/actions/workflows/build-gcpy-environment-py313.yml"><img src="https://github.com/geoschem/gcpy/actions/workflows/build-gcpy-environment-py313.yml/badge.svg" alt="build-gcpy-environment-py313" /></a>
16+
<a href="https://github.com/geoschem/gcpy/actions/workflows/build-rtd-environment.yml"><img src="https://github.com/geoschem/gcpy/actions/workflows/build-rtd-environment.yml/badge.svg" alt="build-rtd-environment /></a>
17+
<a href="https://anaconda.org/conda-forge/geoschem-gcpy"><img src="https://anaconda.org/conda-forge/geoschem-gcpy/badges/downloads.svg" alt="Downloads" /> </a>
1618
</p>
1719

1820
**GCPy** is a Python-based toolkit containing useful functions for working specifically with the GEOS-Chem model of atmospheric chemistry and composition.

‎docs/environment_files/gcpy_environment_py313.yml

Lines changed: 0 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -6,14 +6,6 @@
66
# for GCPy, use this command:
77
#
88
# $ mamba env create -n gcpy_env --file=/path/to/gcpy/environment.yml
9-
#
10-
# NOTE: This combination of packages may produce a warning
11-
#
12-
# VersionWarning: ESMF installation version 8.8.0, ESMPy version 8.8.0b0
13-
#
14-
# that you can disable by adding this to your ~/.bashrc
15-
#
16-
# export PYTHONWARNINGS="ignore"
179
# =====================================================================
1810
name: gcpy_env
1911
channels:

‎docs/source/index.rst

Lines changed: 14 additions & 12 deletions
Original file line numberDiff line numberDiff line change
@@ -5,18 +5,20 @@ GCPy: The GEOS-Chem Python toolkit
55
.. raw:: html
66

77
<p>
8-
<a href="https://github.com/geoschem/gcpy/releases"><img src="https://img.shields.io/github/v/release/geoschem/gcpy?label=Latest%20Stable%20Release"></a>
9-
<a href="https://anaconda.org/conda-forge/geoschem-gcpy"> <img src="https://anaconda.org/conda-forge/geoschem-gcpy/badges/version.svg" /> </a>
10-
<a href="https://img.shields.io/pypi/v/geoschem-gcpy"><img alt="PyPI - Version" src="https://img.shields.io/pypi/v/geoschem-gcpy"></a>
11-
<a href="https://github.com/geoschem/gcpy/releases/"><img src="https://img.shields.io/github/release-date/geoschem/gcpy"></a>
12-
<br />
13-
<a href="https://anaconda.org/conda-forge/geoschem-gcpy"> <img src="https://anaconda.org/conda-forge/geoschem-gcpy/badges/platforms.svg" /> </a>
14-
<a href="https://doi.org/10.5281/zenodo.3689589"><img src="https://zenodo.org/badge/DOI/10.5281/zenodo.3689589.svg" alt="DOI"></a>
15-
<a href="https://github.com/geoschem/gcpy/blob/main/LICENSE.txt"><img src="https://img.shields.io/badge/License-MIT-blue.svg"></a>
16-
<br />
17-
<a href="https://gcpy.readthedocs.io/en/latest/"><img src="https://img.shields.io/readthedocs/gcpy?label=ReadTheDocs"></a>
18-
<a href="https://github.com/geoschem/gcpy/actions/workflows/build-gcpy-environment.yml"><img src="https://github.com/geoschem/gcpy/actions/workflows/build-gcpy-environment.yml/badge.svg"></a>
19-
<a href="https://anaconda.org/conda-forge/geoschem-gcpy"> <img src="https://anaconda.org/conda-forge/geoschem-gcpy/badges/downloads.svg" /> </a>
8+
<a href="https://github.com/geoschem/gcpy/releases"><img src="https://img.shields.io/github/v/release/geoschem/gcpy?label=Latest%20Stable%20Release" alt="Latest release" /></a>
9+
<a href="https://anaconda.org/conda-forge/geoschem-gcpy"> <img src="https://anaconda.org/conda-forge/geoschem-gcpy/badges/version.svg" alt="Anaconda version" /> </a>
10+
<a href="https://img.shields.io/pypi/v/geoschem-gcpy"><img src="https://img.shields.io/pypi/v/geoschem-gcpy" alt="PyPI version" /></a>
11+
<a href="https://github.com/geoschem/gcpy/releases/"><img src="https://img.shields.io/github/release-date/geoschem/gcpy" alt="Release date" /></a>
12+
<a href="https://anaconda.org/conda-forge/geoschem-gcpy"> <img src="https://anaconda.org/conda-forge/geoschem-gcpy/badges/platforms.svg" alt="Platforms" /> </a>
13+
<br />
14+
<a href="https://doi.org/10.5281/zenodo.3689589"><img src="https://zenodo.org/badge/DOI/10.5281/zenodo.3689589.svg" alt="DOI" /></a>
15+
<a href="https://github.com/geoschem/gcpy/blob/main/LICENSE.txt"><img src="https://img.shields.io/badge/License-MIT-blue.svg" alt="License" /></a>
16+
<a href="https://gcpy.readthedocs.io/en/latest/"><img src="https://img.shields.io/readthedocs/gcpy?label=ReadTheDocs" alt="ReadTheDocs" /></a>
17+
<a href="https://github.com/geoschem/gcpy/actions/workflows/build-gcpy-environment-py312.yml"><img src="https://github.com/geoschem/gcpy/actions/workflows/build-gcpy-environment-py312.yml/badge.svg" alt="build-gcpy-environment-py312" /></a>
18+
<br />
19+
<a href="https://github.com/geoschem/gcpy/actions/workflows/build-gcpy-environment-py313.yml"><img src="https://github.com/geoschem/gcpy/actions/workflows/build-gcpy-environment-py313.yml/badge.svg" alt="build-gcpy-environment-py313" /></a>
20+
<a href="https://github.com/geoschem/gcpy/actions/workflows/build-rtd-environment.yml"><img src="https://github.com/geoschem/gcpy/actions/workflows/build-rtd-environment.yml/badge.svg" alt="build-rtd-environment /></a>
21+
<a href="https://anaconda.org/conda-forge/geoschem-gcpy"><img src="https://anaconda.org/conda-forge/geoschem-gcpy/badges/downloads.svg" alt="Downloads" /> </a>
2022
</p>
2123
2224
Welcome to the GCPy ReadTheDocs documentation! This site provides documentation

0 commit comments

Comments
 (0)