Contribute CI workflows #1

jwallwork23 · 2025-03-31T10:12:45Z

This PR builds on the work done in GISS-GC and provides a CI linting workflows that might be useful. It applies the zizmor static analysis tool to check the GitHub Actions workflow definitions for formatting issues and vulnerabilities.

Changes to the workflows actioned as a result:

Set persist-credentials: false when using the checkout action.
Fixed a vulnerability with the cloud benchmarking workflow.
Fix formatting in stale.yml workflow.

Without the edits to the cloud benchmarking workflow, zizmor reports:

error[template-injection]: code injection via template expansion
  --> /home/joe/software/GCClassic/.github/workflows/cloud-benchmarking-workflow.yml:45:9
   |
45 |         - name: Reset Initial Variables for pull request
   |           ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ this step
46 | /         run: |
47 | |           echo "GITHUB_SHA_SHORT=`echo ${{ github.event.pull_request.head.sha }} | cut -c1-7`" >> $GITHUB_ENV
48 | |           echo "COMMIT_NAME=`echo ${{ github.event.pull_request.head.sha }} | cut -c1-7`" >> $GITHUB_ENV
   | |________________________________________________________________________________________________________^ github.event.pull_request.head.sha may expand into attacker-controllable code
   |
   = note: audit confidence → High

error[template-injection]: code injection via template expansion
  --> /home/joe/software/GCClassic/.github/workflows/cloud-benchmarking-workflow.yml:45:9
   |
45 |         - name: Reset Initial Variables for pull request
   |           ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ this step
46 | /         run: |
47 | |           echo "GITHUB_SHA_SHORT=`echo ${{ github.event.pull_request.head.sha }} | cut -c1-7`" >> $GITHUB_ENV
48 | |           echo "COMMIT_NAME=`echo ${{ github.event.pull_request.head.sha }} | cut -c1-7`" >> $GITHUB_ENV
   | |________________________________________________________________________________________________________^ github.event.pull_request.head.sha may expand into attacker-controllable code
   |
   = note: audit confidence → High

This commit informs the GCClassic superproject about the following commits that were pushed to the GitHub geoschem/geos-chem repository: 4288f0d1d Merge PR #2359 (Set KPP dummy species to large ATOL value) This PR adds structural updates to allow per-species setting of the KPP absolute & relative tolerances. This now allows us to assign a large absolute tolerance (1e25) to KPP dummy species, which excludes them from the error norm computations. This results in a faster simulation at the cost of numerical noise. Signed-off-by: Bob Yantosca <yantosca@seas.harvard.edu>

This commit informs the GCClassic superproject about the following commits that were pushed to the GitHub geoschem/geos-chem repository: e61a51064 Merge GCHP hotfix from PR #2363 on top of PR #2359 This PR implements a hotfix for an issue that had caused GCHP cloud benchmarks to fail. Signed-off-by: Bob Yantosca <yantosca@seas.harvard.edu>

This commit informs the GCClassic superproject about the following commits that were pushed to the GitHub geoschem/geos-chem repository: ef2ea60e7 Merge PR #2315 (Fix bugs in PDER, OCPISOA, and TotalOC) This PR fixes several minor bugs in the complex SOA scheme. Signed-off-by: Bob Yantosca <yantosca@seas.harvard.edu>

This merge brings the GCClassic 14.4.2 release into the GCClassic 14.5.0 development stream. 14.4.2 is a zero-diff update. The CHANGELOG.md has been updated accordingly. Signed-off-by: Bob Yantosca <yantosca@seas.harvard.edu>

This hotfix now updates the submodule hash so that it points to commit 0a172283 in src/GEOS-Chem. This is where the 14.4.2 release has been merged into the the dev/14.5.0 branch. Signed-off-by: Bob Yantosca <yantosca@seas.harvard.edu>

This commit informs the GCClassic superproject about the following commits that were pushed to the GitHub geoschem/geos-chem repository: e29a4c928 Merge PR #2398 (Pass non-zero Ca2, Mg, and K cations to HETP) PR #2398 uncomments setting Ca2+, K+, and Mg+ cation values passed to HETP. Previously these values were zero due to an issue in ISORROPIA. With the update to HETP we can enable these cations. Signed-off-by: Bob Yantosca <yantosca@seas.harvard.edu>

This commit informs the GCClassic superproject about the following commits that were pushed to the GitHub geoschem/geos-chem repository: 0a392d465 Merge PR #2352 (Fixes for ALK4 and R4N2 chemistry from J. Brewer) R4N2 was a common product of alkane, isoprene, and monoterpene oxidation and produced organonitrate SOA but we don’t want ALK4 to produce organonitrate SOA as discusses in #1625. A fix from Jared Brewer is included in this PR. Signed-off-by: Bob Yantosca <yantosca@seas.harvard.edu>

@JFBrewer

This commit informs the GCClassic superproject about the following commits that were pushed to the GitHub geoschem/geos-chem repository: acd335486 PR #2352 post-merge fix: Rebuild fullchem solver files This PR restores the updated KPP solver files for PR #2352 (ALK4 and R4N2 chemistry updates, by @JFBrewer). Signed-off-by: Bob Yantosca <yantosca@seas.harvard.edu>

This merge brings all of the updates from the GEOS-Chem 14.4.3 "no-diff-to-benchmark" release back into the dev/14.5.0 branch. We will test this merge with its own alpha benchmark. Signed-off-by: Bob Yantosca <yantosca@seas.harvard.edu>

This commit informs the GCClassic superproject about the following commits that were pushed to the GitHub geoschem/geos-chem repository: 8f0a16767 PR #2425 post-merge fix: Move 14.4.3 entry to top of CHANGELOG.md This PR moves a CHANGELOG.md entry for 14.4.3 to its proper place. Signed-off-by: Bob Yantosca <yantosca@seas.harvard.edu>

@ktravis213

This commit informs the GCClassic superproject about the following commits that were pushed to the GitHub geoschem/geos-chem repository: 586260f10 PR #2318 post-merge fix: Use less drydep fields for the alldiags test f240c993f PR #2318 post-merge fix: Remove duplicate EmisHCOOH_Total entry 53f9b2e82 PR #2318 post-merge fix: Add missing species to geoschem_config.yml dd7ba9a9c Merge PR #2318 (Chemistry for RCOOH, ANs, PNs) and the geoschem/HEMCO repository: d0d5fca PR #285 post-merge fix: Update CHANGELOG.md 1c6356d Merge PR #285 (Add em. factors for ALK6, C4H6, EBZ, STYR, TMB) 253b0fc Merge HEMCO 3.9.3 back into the 3.10.0 development stream f2b6ae4 Merge PR #284 (Fix inconsistent pressure units in HEMCO standalone) These PRs implement new chemistry (from @ktravis213), emissions (from @kelvinhb), and a bug fix for the HEMCO standalone. Signed-off-by: Bob Yantosca <yantosca@seas.harvard.edu>

@nicholasbalasus

This commit informs the GCClassic superproject about the following commits that were pushed to the GitHub geoschem/geos-chem repository: 3073aff2e Merge PR #2428 (Fix mass non-conservation in VDIFF) c7332ed7a Merge PR #2144 (Restore drydep output in fullchem benchmarks) This PR does the following: 1. Adds the DryDep collection to all fullchem_benchmark runs 2. Implements a mass conservation fix in VDIFF PBL mixing by @nicholasbalasus. See issue #2409 for details/ Signed-off-by: Bob Yantosca <yantosca@seas.harvard.edu>

Signed-off-by: Bob Yantosca <yantosca@seas.harvard.edu>

docs/source/geos-chem-shared-docs - Fixed broken links in supplemental-guides/spack-guide.rst docs/source/getting-started/login-env-files-gnu.rst - Changed label from env-files-gnu10 to env-files-gnu - Added tip box to build software with Spack if necessary docs/source/getting-started/login-env-files-intel.rst - Changed label from _env-files-intel19 to _env-files-intel - Added tip box to build software with Spack if necessary docs/source/getting-started/login-env-compilers.rst docs/source/getting-started/login-env-parallel.rst - Updated references accordingly docs/source/getting-started/login-env.rst - Updated references accordingly - Added tip box to build software with Spack if necessary Signed-off-by: Bob Yantosca <yantosca@seas.harvard.edu>

This commit informs the GCClassic superproject about the following commits pushed to the geos-chem-shared-docs submodule: a68981b Update gcc@10.2.0 -> gcc@12.2.0 in load-libraries-guide.rst This updates the GCC compiler version from 10.2.0 to 12.2.0 in the various documentation pages. Signed-off-by: Bob Yantosca <yantosca@seas.harvard.edu>

This commit informs the GCClassic superproject about the following commits that were pushed to the GitHub geoschem/geos-chem repository: 602b660c1 PR #2436 post-merge update: Fix typo in ExtData.rc.fullchem d34c567a4 Merge PR #2436 (Update GFED4 climatology for 2010-2023) d4c47babf Merge PR #2439 (Update run scripts and env files for Discover) 43d0e9083 Merge PR #2371 (Adding PPN photolysis) This implements photolysis for the PPN species. Also, two other no-diff-to-benchmark updates have been added, namely updating run scripts for NASA discover and updating the GFED4 climatology file. Signed-off-by: Bob Yantosca <yantosca@seas.harvard.edu>

…m#24 This commit informs the GCClassic superproject about the following commits that were pushed to the GitHub geoschem/geos-chem repository: 1951ea96e Declare PPN as photolyzing in the species database 40a078514 Merge PR #2424 (Support for Cloud-J_v8.0.0) 647c9f579 Merge PR #2426 (Store aerosol-specific optics files in new directory) and to the geoschem/Cloud-J repository: 291a161 Update Cloud-J standalone settings to use UV absorption by H2O by default 6a027b1 Merge pull request geoschem#24 from geoschem/feature/cloudj_v8 These PRs move aerosol optics configuration files to a separate folder (out of the CHEM_INPUTS/FAST-JX folder structure) and update Cloud-J to version 8.0.0. Signed-off-by: Bob Yantosca <yantosca@seas.harvard.edu>

docs/requirements.txt - Use jinja 3.1.4 as there is a dependabot security warning for the previous version 3.1.3. CHANGELOG.md - Updated accordingly Signed-off-by: Bob Yantosca <yantosca@seas.harvard.edu>

…er than exact) This commit informs the GCClassic superproject about the following commits that were pushed to the GitHub geoschem/geos-chem repository: 6bf4a36 Merge pull request geoschem#26 from geoschem/feature/define_max_rather_than_exact_num_jvalues This PR fixes an issue where Cloud-J will stop reading entries from FJX_j2j.dat before the "9999" end-of-file marker. Signed-off-by: Bob Yantosca <yantosca@seas.harvard.edu>

@ktravis213

…ANs) This commit informs the GCClassic superproject about the following commits that were pushed to the GitHub geoschem/geos-chem repository: a5fba9c88 Merge PR #2452 (Reorder photo rxns for PNs and ANs) This PR reorders the photo rxns of the PN and AN species added by @ktravis213 in PR #2318, so that they now follow PPN in the FJX_j2j.dat configuration file for Cloud-J. Signed-off-by: Bob Yantosca <yantosca@seas.harvard.edu>

This commit informs the GCClassic superproject about the following commits that were pushed to the GitHub geoschem/geos-chem repository: cd0366015 Merge PR #2457 (Update Is_Photolysis tags in species_database.yml) This PR ensures that photolyzing species (as listed in the KPP fullchem.eqn and FJX_j2j.dat files) have "Is_Photolysis.true" tags in the species_database.yml file. Non-photolyzing species have had these tags removed. Also the JValues collection in the GCHP HISTORY.rc.fullchem file has been updated. Signed-off-by: Bob Yantosca <yantosca@seas.harvard.edu>

This commit informs the GCClassic superproject about the following commits that were pushed to the GitHub geoschem/geos-chem repository: c0aeff427 Merge PR #2462 (Bug fix: ALK6 in HEMCO_Config.rc should be ALK7) 5c31c3470 Merge PR #2430 (Updated Y. Wang soil NOx scheme as an option) and the geos-chem/HEMCO repository c6a9d46 Merge PR #287 (Updated Y. Wang soil NOx scheme as an option) This PR does the following: 1. Implements the U. Iowa soil NOx scheme as an option. This is currently switched off by default. 2. Adds a bug fix in HEMCO configuration files: ALK6 should be called ALK7. Signed-off-by: Bob Yantosca <yantosca@seas.harvard.edu>

Signed-off-by: Melissa Sulprizio <mpayer@seas.harvard.edu>

…salt in aerosol thermodynamics) Signed-off-by: Melissa Sulprizio <mpayer@seas.harvard.edu>

The stale workflows are currently failing with the error: Invalid workflow file: .github/workflows/stale.yml#L26 The workflow is not valid. .github/workflows/stale.yml (Line: 26, Col: 11): A sequence was not expected To fix this, the list of exempt-issues-labels in .github/workflows/stale.yml must be a comma separated list. A single quote is placed around the list to allow for use of colons in label names. Signed-off-by: Melissa Sulprizio <mpayer@seas.harvard.edu>

…ag burning emissions) Signed-off-by: Melissa Sulprizio <mpayer@seas.harvard.edu>

…oir emissions) Signed-off-by: Melissa Sulprizio <mpayer@seas.harvard.edu>

…ub workflow Signed-off-by: Melissa Sulprizio <mpayer@seas.harvard.edu>

docs/source/gcclassic-user-guide/geoschem-config.rst docs/source/gcclassic-user-guide/hemco-config.rst docs/source/gcclassic-user-guide/hemco-diagn.rst docs/source/gcclassic-user-guide/phot-chem.rst docs/source/gcclassic-user-guide/spec-db.rst - Moved to geos-chem-shared-docs/doc docs/source/gcclassic-user-guide/config-overview.rst - Now points to relocated files docs/source/geos-chem-shared-docs - Submodule update to CHANGELOG.md - Updated accordingly

This commit informs the GCClassic superproject about the following commits that were pushed to the GitHub geoschem/geos-chem repository: 60381876d Merge PR #2712 (Only build KPP-Standalone upon request) This PR now asks the user if they wish to build the KPP-Standalone executable at run directory creation time. A reminder will be printed to configure with -DKPPSA=y, and the kpp_standalone_interface.yml file will be copies to the run directory. Signed-off-by: Bob Yantosca <yantosca@seas.harvard.edu>

@yantosca

This merge brings PR geoschem#82 (Do not build KPP-Standalone executable unless specifically requested at compile time, by @yantosca) into the GEOS-Chem "no-diff-to-benchmark" development stream. This PR adds updates to the CMake files so that the KPP-Standalone will only be built if the user configures with -DKPPSA=y. Signed-off-by: Bob Yantosca <yantosca@seas.harvard.edu>

This commit informs the GCClassic superproject about the following commits that were pushed to the geos-chem-shared-docs repository: 02c4c26 Update KPP-Standalone guide for on-request build Signed-off-by: Bob Yantosca <yantosca@seas.harvard.edu>

docs/source/gcclassic-user-guide/rundir-fullchem.rst - Add a numbered list item explaining that the user will be prompted if they wish to build the KPP-Standalone Box Model. Also provide a link to the KPP-Standalone supplemental guide. CHANGELOG.md - Updated accordingly Signed-off-by: Bob Yantosca <yantosca@seas.harvard.edu>

This commit informs the GCClassic superproject about the following commits that were pushed to the GitHub geoschem/geos-chem repository: aeeb8e9 Add link to KPP-Standalone documentation on GCPy ReadTheDocs This PR adds a paragraph to the KPP-Standalone documentation stating that plotting scripts are available on GCPy (with link to documentation). Signed-off-by: Bob Yantosca <yantosca@seas.harvard.edu>

CHANGELOG.md CMakeLists.txt docs/source/conf.py - Updated version numbers to 14.5.2 src/GEOS-Chem - Now points to GEOS-Chem (sci codebase) 14.5.2 release commit Signed-off-by: Bob Yantosca <yantosca@seas.harvard.edu>

We have merged the most recent documentation updates for GEOS-Chem Classic into the release/14.5.2 branch. Signed-off-by: Bob Yantosca <yantosca@seas.harvard.edu>

This is the official release commit of GEOS-Chem Classic aka GCClassic) 14.5.2. Updated version numbers in: - CHANGELOG.md - CMakeLists.txt - docs/source/conf.py Updated GEOS-Chem submodule to version 14.5.2 Updated geos-chem-shared-docs submodule to commit aeeb8e9 Also updated CHANGELOG.md with the latest information. Signed-off-by: Bob Yantosca <yantosca@seas.harvard.edu>

This commit informs the GCClassic superproject about the following commits that were pushed to the GitHub geoschem/geos-chem repository: 37da3740b Merge PR #2713 (Read AEIC2019 every timestep in CESM) This PR updates the HEMCO configuration file used with CESM to read AEIC emissions every model timestep. This avoids introducing small differences when the model runs are broken up in time. Signed-off-by: Bob Yantosca <yantosca@seas.harvard.edu

docs/source/geos-chem-shared-docs - Submodule update to c769e00 docs/source/gcclassic-user-guide/planeflight.rst - Fixed bugs in the rubric section CHANGELOG.md - Updated accordingly

Submodule src/HEMCO 0ae25d2..d7563e7: > Merge pull request #306 from geoschem/bugfix/remove_cesm_core_dependency > Merge pull request #299 from K20shores/ci > Merge PR #304 (Add .zenodo.json; Update jinja2 to 3.1.5) Signed-off-by: Lizzie Lundgren <elundgren@seas.harvard.edu>

This merge brings updates from the "no-diff-to-benchmark" development stream into the release/14.5.3 branch, in anticipation of the GCClassic 14.5.3 release. Signed-off-by: Bob Yantosca <yantosca@seas.harvard.edu>

This merge brings ReadTheDocs documentation updates for GCClassic 14.5.3 (in the docs/dev branch) into the release/14.5.3 branch. Signed-off-by: Bob Yantosca <yantosca@seas.harvard.edu>

Updated version numbers to 14.5.3 in: - CHANGELOG.md - CMakeLists.txt - docs/source/conf.py Updated src/GEOS-Chem submodule to the 14.5.3 release commit Updated src/HEMCO submodule to the 3.10.2 release commit Signed-off-by: Bob Yantosca <yantosca@seas.harvard.edu>

This is the official release commit of GEOS-Chem Classic aka GCClassic) 14.5.3. Updated version numbers in: - CHANGELOG.md - CMakeLists.txt - docs/source/conf.py Updated GEOS-Chem submodule to version 14.5.3 Updated HEMCO submodule to version 3.10.2 Updated geos-chem-shared-docs submodule to commit c769e00 Signed-off-by: Bob Yantosca <yantosca@seas.harvard.edu>

jwallwork23 · 2025-03-31T11:07:48Z

[Closing here as I just opened a PR directly to GCClassic (see #https://github.com/geoschem/pull/86)].

yantosca and others added 30 commits July 3, 2024 15:37

geos-chem-shared-docs update: Update packages.yaml to GCC 12.2.0

750151f

Signed-off-by: Bob Yantosca <yantosca@seas.harvard.edu>

Update jinja2 to 3.1.4 in docs/requirements.txt

25bb833

docs/requirements.txt - Use jinja 3.1.4 as there is a dependabot security warning for the previous version 3.1.3. CHANGELOG.md - Updated accordingly Signed-off-by: Bob Yantosca <yantosca@seas.harvard.edu>

GEOS-Chem submodupdate: Merge PR #2464 (remove zero J-value diagnostics)

af1ced6

Signed-off-by: Melissa Sulprizio <mpayer@seas.harvard.edu>

GEOS-Chem submod update: Merge PR #1467 (Fix dry mass fraction of sea…

6160632

…salt in aerosol thermodynamics) Signed-off-by: Melissa Sulprizio <mpayer@seas.harvard.edu>

GEOS-Chem submod update: Merge PR #2477 (Fix for double counting CH4 …

bb056b3

…ag burning emissions) Signed-off-by: Melissa Sulprizio <mpayer@seas.harvard.edu>

GEOS-Chem submodule update: Merge PR #2473 (seasonality of CH4 reserv…

dfd1f6f

…oir emissions) Signed-off-by: Melissa Sulprizio <mpayer@seas.harvard.edu>

GEOS-Chem and HEMCO submodule updates: Add fixes for stale issue Gith…

347686f

…ub workflow Signed-off-by: Melissa Sulprizio <mpayer@seas.harvard.edu>

MergePR geoschem#67 containing a fix for the stale issue Github workflow

67d1e8a

yantosca and others added 16 commits February 6, 2025 11:03

Merge branch 'dev/no-diff-to-benchmark' into release/14.5.2

a972934

Change version numbers to 14.5.2 and update geos-chem hash

ba5b7be

CHANGELOG.md CMakeLists.txt docs/source/conf.py - Updated version numbers to 14.5.2 src/GEOS-Chem - Now points to GEOS-Chem (sci codebase) 14.5.2 release commit Signed-off-by: Bob Yantosca <yantosca@seas.harvard.edu>

Merge ReadTheDocs updates into the release/14.5.2 branch

df405dc

We have merged the most recent documentation updates for GEOS-Chem Classic into the release/14.5.2 branch. Signed-off-by: Bob Yantosca <yantosca@seas.harvard.edu>

RTD updates: AWS-CLI + bug fix in planeflight doc

5025a5b

docs/source/geos-chem-shared-docs - Submodule update to c769e00 docs/source/gcclassic-user-guide/planeflight.rst - Fixed bugs in the rubric section CHANGELOG.md - Updated accordingly

Merge branch 'dev/no-diff-to-benchmark' into release/14.5.3

e589efc

This merge brings updates from the "no-diff-to-benchmark" development stream into the release/14.5.3 branch, in anticipation of the GCClassic 14.5.3 release. Signed-off-by: Bob Yantosca <yantosca@seas.harvard.edu>

Merge branch 'docs/dev' into release/14.5.3

2ebd178

This merge brings ReadTheDocs documentation updates for GCClassic 14.5.3 (in the docs/dev branch) into the release/14.5.3 branch. Signed-off-by: Bob Yantosca <yantosca@seas.harvard.edu>

jwallwork23 added the enhancement New feature or request label Mar 31, 2025

jwallwork23 self-assigned this Mar 31, 2025

jwallwork23 mentioned this pull request Mar 31, 2025

Contribute CI linting workflow geoschem/GCClassic#86

Merged

jwallwork23 force-pushed the ci-workflows branch from 033b3ef to ccf3c3d Compare March 31, 2025 10:31

jwallwork23 requested a review from ltmurray March 31, 2025 10:33

jwallwork23 force-pushed the ci-workflows branch from ccf3c3d to 92bfa32 Compare March 31, 2025 10:47

jwallwork23 added 4 commits March 31, 2025 12:03

Add linting workflow

6228f49

Persist credentials when checking out

66076f3

Fix vulnerability in cloud benchmarking workflow

36353ed

Fix formatting of stale workflow

56416f6

jwallwork23 force-pushed the ci-workflows branch from 92bfa32 to 56416f6 Compare March 31, 2025 11:03

jwallwork23 closed this Mar 31, 2025

jwallwork23 mentioned this pull request Mar 31, 2025

Fix potential vulnerability in CI workflow #2

Open

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

Contribute CI workflows #1

Contribute CI workflows #1

Uh oh!

jwallwork23 commented Mar 31, 2025 •

edited

Loading

Uh oh!

jwallwork23 commented Mar 31, 2025

Uh oh!

Uh oh!

Contribute CI workflows #1

Contribute CI workflows #1

Uh oh!

Conversation

jwallwork23 commented Mar 31, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

jwallwork23 commented Mar 31, 2025

Uh oh!

Uh oh!

jwallwork23 commented Mar 31, 2025 •

edited

Loading