Merge remote-tracking branch 'upstream/release/ga-4.7'

Author: sebhmg

.gitattributes

@@ -1,4 +1,6 @@
 *.pt filter=lfs diff=lfs merge=lfs -text
 *.geoh5 filter=lfs diff=lfs merge=lfs -text
 *.h5 filter=lfs diff=lfs merge=lfs -text
+*.zip filter=lfs diff=lfs merge=lfs -text
 *.min.js filter=lfs diff=lfs merge=lfs -text
+*.npy filter=lfs diff=lfs merge=lfs -text

.github/dependabot.yml

@@ -7,6 +7,8 @@ version: 2
 updates:
   - package-ecosystem: "github-actions"
     directory: "/"
-    schedule:
-      interval: "monthly"
     target-branch: "develop"
+    schedule:
+      interval: "weekly"
+    cooldown:
+      default-days: 4

.github/workflows/issue_to_jira.yml

@@ -4,10 +4,18 @@ on:
   issues:
     types: [opened]
 
+permissions: {}
+
 jobs:
   call-workflow-create-jira-issue:
-    uses: MiraGeoscience/CI-tools/.github/workflows/reusable-jira-issue_to_jira.yml@main
-    secrets: inherit
+    uses: MiraGeoscience/CI-tools/.github/workflows/reusable-jira-issue_to_jira.yml@v2
+    permissions:
+      contents: read
+      issues: write
     with:
       project-key: 'GEOPY'
       components: '[{"name": "simpeg"}]'
+    secrets:
+      JIRA_BASE_URL: ${{ secrets.JIRA_BASE_URL }}
+      JIRA_API_TOKEN: ${{ secrets.JIRA_API_TOKEN }}
+      JIRA_USER_EMAIL: ${{ secrets.JIRA_USER_EMAIL }}

.github/workflows/pr_add_jira_summary.yml

@@ -1,10 +1,18 @@
 name: Add JIRA issue summary
 
 on:
-  pull_request_target:
+  pull_request:
     types: [opened]
 
+permissions: {}
+
 jobs:
   call-workflow-add-jira-issue-summary:
-    uses: MiraGeoscience/CI-tools/.github/workflows/reusable-jira-pr_add_jira_summary.yml@main
-    secrets: inherit
+    uses: MiraGeoscience/CI-tools/.github/workflows/reusable-jira-pr_add_jira_summary.yml@v2
+    permissions:
+      contents: read
+      pull-requests: write
+    secrets:
+      JIRA_BASE_URL: ${{ secrets.JIRA_BASE_URL }}
+      JIRA_USER_EMAIL: ${{ secrets.JIRA_USER_EMAIL }}
+      JIRA_API_TOKEN: ${{ secrets.JIRA_API_TOKEN }}

.github/workflows/python_analysis.yml

@@ -17,21 +17,29 @@ on:
       - feature/**
       - hotfix/**
 
+permissions: {}
+
 concurrency:
   group: ${{ github.workflow }}-${{ github.head_ref || github.run_id }}
   cancel-in-progress: true
 
 jobs:
   call-workflow-static-analysis:
     name: Static analysis
-    uses: MiraGeoscience/CI-tools/.github/workflows/reusable-python-static_analysis.yml@main
+    uses: MiraGeoscience/CI-tools/.github/workflows/reusable-python-static_analysis.yml@v2
+    permissions:
+      contents: read
+      pull-requests: read
     with:
       package-manager: 'conda'
       app-name: 'simpeg_drivers'
       python-version: '3.10'
   call-workflow-pytest:
     name: Pytest
-    uses: MiraGeoscience/CI-tools/.github/workflows/reusable-python-pytest.yml@main
+    uses: MiraGeoscience/CI-tools/.github/workflows/reusable-python-pytest.yml@v2
+    permissions:
+      contents: read
+      pull-requests: read
     with:
       package-manager: 'conda'
       python-versions: '["3.10", "3.11", "3.12"]'

.github/workflows/python_deploy_dev.yml

@@ -5,14 +5,18 @@ on:
     tags:
       - 'v*' # Push events to every version tag (eg. v1.0.0)
 
+permissions: {}
+
 concurrency:
   group: ${{ github.workflow }}-${{ github.ref || github.run_id }}
   cancel-in-progress: true
 
 jobs:
   call-workflow-conda-publish:
     name: Publish development conda package on JFrog Artifactory
-    uses: MiraGeoscience/CI-tools/.github/workflows/reusable-python-publish_rattler_package.yml@main
+    uses: MiraGeoscience/CI-tools/.github/workflows/reusable-python-publish_rattler_package.yml@v2
+    permissions:
+      contents: write
     with:
       package-name: 'simpeg-drivers'
       python-version: '3.10'
@@ -24,7 +28,9 @@ jobs:
       JFROG_ARTIFACTORY_TOKEN: ${{ secrets.JFROG_ARTIFACTORY_TOKEN }}
   call-workflow-pypi-publish:
     name: Publish development pypi package (JFrog Artifactory, TestPyPI)
-    uses: MiraGeoscience/CI-tools/.github/workflows/reusable-python-publish_pypi_package.yml@main
+    uses: MiraGeoscience/CI-tools/.github/workflows/reusable-python-publish_pypi_package.yml@v2
+    permissions:
+      contents: write
     with:
       package-manager: 'poetry'
       package-name: 'simpeg-drivers'

.github/workflows/python_deploy_prod.yml

@@ -19,15 +19,19 @@ on:
         type: boolean
         default: true
 
+permissions: {}
+
 concurrency:
   group: ${{ github.workflow }}-${{ github.event.release.tag_name || github.event.inputs.release-tag || github.run_id }}
   cancel-in-progress: true
 
 jobs:
   call-workflow-conda-release:
     name: Publish production Conda package on JFrog Artifactory
-    uses: MiraGeoscience/CI-tools/.github/workflows/reusable-python-release_conda_assets.yml@main
     if: ${{ github.event_name == 'release' || github.event.inputs.publish-conda == 'true' }}
+    uses: MiraGeoscience/CI-tools/.github/workflows/reusable-python-release_conda_assets.yml@v2
+    permissions:
+      contents: write
     with:
       virtual-repo-names: '["public-noremote-conda-prod"]'
       release-tag: ${{ github.event.release.tag_name || github.event.inputs.release-tag }}
@@ -37,7 +41,9 @@ jobs:
   call-workflow-pypi-release:
     name: Publish production PyPI package (JFrog Artifactory, PyPI)
     if: ${{ github.event_name == 'release' || github.event.inputs.publish-pypi == 'true' }}
-    uses: MiraGeoscience/CI-tools/.github/workflows/reusable-python-release_pypi_assets.yml@main
+    uses: MiraGeoscience/CI-tools/.github/workflows/reusable-python-release_pypi_assets.yml@v2
+    permissions:
+      contents: write
     with:
       package-name: 'simpeg-drivers'
       virtual-repo-names: '["public-pypi-prod", "pypi"]'

.github/workflows/security_scan.yml

@@ -0,0 +1,43 @@
+name: Security Scan
+
+on:
+  pull_request:
+    types: [opened, synchronize, reopened, ready_for_review]
+    branches:
+      - develop
+      - main
+      - release/**
+      - feature/**
+      - hotfix/**
+  push:
+    branches:
+      - develop
+      - main
+      - release/**
+      - feature/**
+      - hotfix/**
+
+permissions: {}
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.head_ref || github.run_id }}
+  cancel-in-progress: true
+
+jobs:
+  call-workflow-zizmor-annotate:
+    name: Zizmor analysis (advanced security)
+    if: ${{ github.event_name != 'pull_request' }}
+    permissions:
+      security-events: write
+      contents: read
+      actions: read
+    uses: MiraGeoscience/CI-tools/.github/workflows/reusable-zizmor-advanced-security.yml@v2
+
+  call-workflow-zizmor-advanced-security:
+    name: Zizmor analysis (annotate)
+    if: ${{ github.event_name == 'pull_request' }}
+    permissions:
+      checks: write
+      contents: read
+      actions: read
+    uses: MiraGeoscience/CI-tools/.github/workflows/reusable-zizmor-annotate.yml@v2

.gitignore

@@ -144,3 +144,6 @@ dmypy.json
 
 # tempory generated files
 pyproject-sha.toml
+
+#version ignore
+simpeg_drivers/_version.py

.pre-commit-config.yaml

@@ -11,22 +11,27 @@ ci:
     autoupdate_schedule: monthly
 
 repos:
+# -   repo: https://github.com/python-poetry/poetry  # TODO: re-enable with pixi (does not support source=pypi)
+#     rev: 2.2.1
+#     hooks:
+#     -   id: poetry-check
+#         args: [--no-plugins]
 -   repo: https://github.com/hadialqattan/pycln
-    rev: v2.5.0
+    rev: v2.6.0
     hooks:
     -   id: pycln
         args: [--config=pyproject.toml]
 -   repo: https://github.com/astral-sh/ruff-pre-commit
-    rev: v0.9.9
+    rev: v0.14.4
     hooks:
-    -   id: ruff
+    -   id: ruff-check
         args:
         -   --fix
         -   --exit-non-zero-on-fix
 #        -   --unsafe-fixes
     -   id: ruff-format
 # -  repo: https://github.com/pre-commit/mirrors-mypy  # TODO: fix mypy errors
-#    rev: v1.11.0
+#    rev: v1.18.2
 #    hooks:
 #    -   id: mypy
 #        additional_dependencies: [
@@ -68,7 +73,7 @@ repos:
         exclude: (-lock\.ya?ml|\benvironments/.*\.ya?ml|\.ipynb|^THIRD_PARTY_SOFTWARE\.rst)$
         entry: codespell -I .codespellignore
 -   repo: https://github.com/pre-commit/pre-commit-hooks
-    rev: v5.0.0
+    rev: v6.0.0
     hooks:
     -   id: trailing-whitespace
         exclude: \.mdj$
@@ -77,6 +82,7 @@ repos:
     -   id: check-toml
     -   id: check-yaml
     -   id: check-added-large-files
+        exclude: (\.ipynb)$
     -   id: check-case-conflict
     -   id: check-merge-conflict
     -   id: debug-statements
@@ -86,7 +92,7 @@ repos:
     -   id: mixed-line-ending
         exclude: ^\.idea/.*\.xml$
     -   id: name-tests-test
-        exclude: testing_utils.py
+        exclude: ^tests/utils/
     -   id: pretty-format-json
         args:
             - --autofix
@@ -97,7 +103,7 @@ repos:
         exclude_types: [jupyter]
         exclude: ^docs/(.*/)?images/
 -   repo: https://github.com/rstcheck/rstcheck
-    rev: v6.2.4
+    rev: v6.2.5
     hooks:
     -   id: rstcheck
         exclude: ^THIRD_PARTY_SOFTWARE.rst$