Merge branch 'main' of github.com:ESMValGroup/ESMValCore into add-xcube-support

Author: bouweandela

.circleci/config.yml

@@ -77,6 +77,7 @@ commands:
           key: install-<< parameters.extra >>-{{ .Branch }}-{{ checksum "cache_key.txt" }}
       - run:
           name: Install dependencies
+          no_output_timeout: 30m
           command: |
             # Add additional requirements for running all tests
             echo "

.github/dependabot.yml

@@ -12,3 +12,9 @@ updates:
     directory: "/"
     schedule:
       interval: "weekly"
+    cooldown:
+      default-days: 7
+    labels:
+      - dependencies
+      - github_actions
+      - automatedPR

.github/instructions/*.instructions.md

@@ -0,0 +1 @@
+doc/contributing.rst

.github/workflows/build-and-deploy-on-pypi.yml

@@ -1,6 +1,8 @@
 # Workflow from https://packaging.python.org/en/latest/guides/publishing-package-distribution-releases-using-github-actions-ci-cd-workflows/
 name: Build and publish Python 🐍 distribution 📦 to PyPI
 
+permissions: {}
+
 on:
   release:
     types: [published]
@@ -16,12 +18,12 @@ jobs:
     runs-on: ubuntu-latest
 
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         with:
           fetch-depth: 0
           persist-credentials: false
       - name: Set up Python
-        uses: actions/setup-python@v6
+        uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
         with:
           python-version: "3.x"
       - name: Install pypa/build
@@ -33,7 +35,7 @@ jobs:
       - name: Build a binary wheel and a source tarball
         run: python3 -m build
       - name: Store the distribution packages
-        uses: actions/upload-artifact@v6
+        uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6.0.0
         with:
           name: python-package-distributions
           path: dist/
@@ -53,9 +55,9 @@ jobs:
 
     steps:
       - name: Download all the dists
-        uses: actions/download-artifact@v7
+        uses: actions/download-artifact@37930b1c2abaa49bbe596cd826c3c89aef350131 # v7.0.0
         with:
           name: python-package-distributions
           path: dist/
       - name: Publish distribution 📦 to PyPI
-        uses: pypa/gh-action-pypi-publish@v1.13.0
+        uses: pypa/gh-action-pypi-publish@ed0c53931b1dc9bd32cbe73a98c7f6766f8a527e # v1.13.0

.github/workflows/citation_file_validator.yml

@@ -3,22 +3,26 @@
 
 name: CFF File Validator
 
+permissions: {}
+
 on:
   push:
     paths:
       - CITATION.cff
   schedule:
-    - cron: '0 0 1 * *'
+    - cron: "0 0 1 * *"
 
 jobs:
   validate:
     name: "validate"
     runs-on: ubuntu-latest
-    if: github.repository == 'ESMValGroup/ESMValCore'  # avoid GAs in forks
+    if: github.repository == 'ESMValGroup/ESMValCore' # avoid GAs in forks
     steps:
       - name: Check out a copy of the repository
-        uses: actions/checkout@v6
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        with:
+          persist-credentials: false
       - name: Check whether the citation metadata from CITATION.cff is valid
-        uses: citation-file-format/cffconvert-github-action@2.0.0
+        uses: citation-file-format/cffconvert-github-action@4cf11baa70a673bfdf9dad0acc7ee33b3f4b6084 # 2.0.0
         with:
           args: "--validate"

.github/workflows/create-condalock-file.yml

@@ -1,5 +1,7 @@
 name: Conda lock file creation
 
+permissions: {}
+
 on:
   # Trigger on push on main or other branch for testing
   # NOTE that push: main will create the file very often
@@ -8,7 +10,7 @@ on:
   #   branches:
   #     - main
   schedule:
-    - cron: '0 4 */10 * *'
+    - cron: "0 4 */10 * *"
 
 # Required shell entrypoint to have properly configured bash shell
 defaults:
@@ -18,13 +20,17 @@ defaults:
 jobs:
   create-verify-lock-file:
     name: Create and verify conda lock file for latest Python
-    runs-on: 'ubuntu-latest'
-    if: github.repository == 'ESMValGroup/ESMValCore'  # avoid GAs in forks
+    permissions:
+      contents: write
+      pull-requests: write
+    runs-on: "ubuntu-latest"
+    if: github.repository == 'ESMValGroup/ESMValCore' # avoid GAs in forks
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         with:
           fetch-depth: 0
-      - uses: conda-incubator/setup-miniconda@v3
+          persist-credentials: false
+      - uses: conda-incubator/setup-miniconda@fc2d68f6413eb2d87b895e92f8584b5b94a10167 # v3.3.0
         with:
           auto-update-conda: true
           activate-environment: esmvaltool-fromlock
@@ -72,15 +78,15 @@ jobs:
       # Automated PR
       # see https://github.com/marketplace/actions/create-pull-request
       - name: Create Automated PR if conda lock file has changed
-        uses: peter-evans/create-pull-request@v8
+        uses: peter-evans/create-pull-request@c0f553fe549906ede9cf27b5156039d195d2ece0 # v8.1.0
         with:
           token: ${{ secrets.GITHUB_TOKEN }}
           commit-message: Updating Linux condalock file
           author: ${{ github.actor }} <${{ github.actor }}@users.noreply.github.com>
           signoff: false
           branch: condalock-update
           delete-branch: true
-          title: '[Condalock] Update Linux condalock file'
+          title: "[Condalock] Update Linux condalock file"
           body: |
             Update condalock file
             Automatic Pull Request.

.github/workflows/install-from-conda.yml

@@ -13,6 +13,8 @@
 
 name: Install from conda-forge
 
+permissions: {}
+
 # runs on a push on main and at the end of every day
 on:
   # triggering on push without branch name will run tests every time
@@ -27,7 +29,7 @@ on:
   #   branches:
   #     - main
   schedule:
-    - cron: '0 4 * * *'
+    - cron: "0 4 * * *"
 
 # Required shell entrypoint to have properly configured bash shell
 defaults:
@@ -37,7 +39,7 @@ defaults:
 jobs:
   linux:
     runs-on: "ubuntu-latest"
-    if: github.repository == 'ESMValGroup/ESMValCore'  # avoid GAs in forks
+    if: github.repository == 'ESMValGroup/ESMValCore' # avoid GAs in forks
     strategy:
       matrix:
         python-version: ["3.12", "3.13", "3.14"]
@@ -46,7 +48,7 @@ jobs:
       fail-fast: false
     name: Linux Python ${{ matrix.python-version }}
     steps:
-      - uses: conda-incubator/setup-miniconda@v3
+      - uses: conda-incubator/setup-miniconda@fc2d68f6413eb2d87b895e92f8584b5b94a10167 # v3.3.0
         with:
           python-version: ${{ matrix.python-version }}
           miniforge-version: "latest"
@@ -65,23 +67,23 @@ jobs:
           esmvaltool --help
           esmvaltool version 2>&1 | tee conda_install_linux_artifacts_python_${{ matrix.python-version }}/version.txt
       - name: Upload artifacts
-        if: ${{ always() }}  # upload artifacts even if fail
-        uses: actions/upload-artifact@v6
+        if: ${{ always() }} # upload artifacts even if fail
+        uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6.0.0
         with:
           name: Conda_Install_Linux_python_${{ matrix.python-version }}
           path: conda_install_linux_artifacts_python_${{ matrix.python-version }}
 
   osx:
     runs-on: "macos-latest"
-    if: github.repository == 'ESMValGroup/ESMValCore'  # avoid GAs in forks
+    if: github.repository == 'ESMValGroup/ESMValCore' # avoid GAs in forks
     strategy:
       matrix:
         python-version: ["3.12", "3.13", "3.14"]
-        architecture: ["x64"]  # need to force Intel, arm64 builds have issues
+        architecture: ["x64"] # need to force Intel, arm64 builds have issues
       fail-fast: false
     name: OSX Python ${{ matrix.python-version }}
     steps:
-      - uses: conda-incubator/setup-miniconda@v3
+      - uses: conda-incubator/setup-miniconda@fc2d68f6413eb2d87b895e92f8584b5b94a10167 # v3.3.0
         with:
           architecture: ${{ matrix.architecture }}
           python-version: ${{ matrix.python-version }}
@@ -101,8 +103,8 @@ jobs:
           esmvaltool --help
           esmvaltool version 2>&1 | tee conda_install_osx_artifacts_python_${{ matrix.python-version }}/version.txt
       - name: Upload artifacts
-        if: ${{ always() }}  # upload artifacts even if fail
-        uses: actions/upload-artifact@v6
+        if: ${{ always() }} # upload artifacts even if fail
+        uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6.0.0
         with:
           name: Conda_Install_OSX_python_${{ matrix.python-version }}
           path: conda_install_osx_artifacts_python_${{ matrix.python-version }}

.github/workflows/install-from-condalock-file.yml

@@ -7,6 +7,9 @@
 # note that pip and conda are NOT installed.
 
 name: Conda-lock Install
+
+permissions: {}
+
 on:
   push:
     branches:
@@ -17,7 +20,7 @@ on:
   #  branches:
   #  - main
   schedule:
-    - cron: '0 0 * * *'
+    - cron: "0 0 * * *"
 
 # Required shell entrypoint to have properly configured bash shell
 defaults:
@@ -27,17 +30,18 @@ defaults:
 jobs:
   linux:
     runs-on: "ubuntu-latest"
-    if: github.repository == 'ESMValGroup/ESMValCore'  # avoid GAs in forks
+    if: github.repository == 'ESMValGroup/ESMValCore' # avoid GAs in forks
     strategy:
       matrix:
         python-version: ["3.12", "3.13", "3.14"]
       fail-fast: false
     name: Linux Python ${{ matrix.python-version }}
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         with:
           fetch-depth: 0
-      - uses: conda-incubator/setup-miniconda@v3
+          persist-credentials: false
+      - uses: conda-incubator/setup-miniconda@fc2d68f6413eb2d87b895e92f8584b5b94a10167 # v3.3.0
         with:
           activate-environment: esmvaltool-fromlock
           python-version: ${{ matrix.python-version }}
@@ -55,8 +59,8 @@ jobs:
       - run: esmvaltool version 2>&1 | tee source_install_linux_artifacts_python_${{ matrix.python-version }}/version.txt
       - run: pytest -n 2 -m "not installation"
       - name: Upload artifacts
-        if: ${{ always() }}  # upload artifacts even if fail
-        uses: actions/upload-artifact@v6
+        if: ${{ always() }} # upload artifacts even if fail
+        uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6.0.0
         with:
           name: Source_Install_Linux_python_${{ matrix.python-version }}
           path: source_install_linux_artifacts_python_${{ matrix.python-version }}

.github/workflows/install-from-pypi.yml

@@ -13,6 +13,8 @@
 
 name: Install from PyPi
 
+permissions: {}
+
 # runs on a push on main and at the end of every day
 on:
   # triggering on push without branch name will run tests every time
@@ -27,7 +29,7 @@ on:
   #  branches:
   #  - main
   schedule:
-    - cron: '0 0 * * *'
+    - cron: "0 0 * * *"
 
 # Required shell entrypoint to have properly configured bash shell
 defaults:
@@ -37,7 +39,7 @@ defaults:
 jobs:
   linux:
     runs-on: "ubuntu-latest"
-    if: github.repository == 'ESMValGroup/ESMValCore'  # avoid GAs in forks
+    if: github.repository == 'ESMValGroup/ESMValCore' # avoid GAs in forks
     strategy:
       matrix:
         python-version: ["3.12", "3.13", "3.14"]
@@ -46,8 +48,10 @@ jobs:
       fail-fast: false
     name: Linux Python ${{ matrix.python-version }}
     steps:
-      - uses: actions/checkout@v6
-      - uses: conda-incubator/setup-miniconda@v3
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        with:
+          persist-credentials: false
+      - uses: conda-incubator/setup-miniconda@fc2d68f6413eb2d87b895e92f8584b5b94a10167 # v3.3.0
         with:
           activate-environment: esmvalcore
           environment-file: environment.yml
@@ -68,24 +72,26 @@ jobs:
           esmvaltool --help
           esmvaltool version 2>&1 | tee pip_install_linux_artifacts_python_${{ matrix.python-version }}/version.txt
       - name: Upload artifacts
-        if: ${{ always() }}  # upload artifacts even if fail
-        uses: actions/upload-artifact@v6
+        if: ${{ always() }} # upload artifacts even if fail
+        uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6.0.0
         with:
           name: PIP_Install_Linux_python_${{ matrix.python-version }}
           path: pip_install_linux_artifacts_python_${{ matrix.python-version }}
 
   osx:
     runs-on: "macos-latest"
-    if: github.repository == 'ESMValGroup/ESMValCore'  # avoid GAs in forks
+    if: github.repository == 'ESMValGroup/ESMValCore' # avoid GAs in forks
     strategy:
       matrix:
         python-version: ["3.12", "3.13", "3.14"]
-        architecture: ["x64"]  # need to force Intel, arm64 builds have issues
+        architecture: ["x64"] # need to force Intel, arm64 builds have issues
       fail-fast: false
     name: OSX Python ${{ matrix.python-version }}
     steps:
-      - uses: actions/checkout@v6
-      - uses: conda-incubator/setup-miniconda@v3
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        with:
+          persist-credentials: false
+      - uses: conda-incubator/setup-miniconda@fc2d68f6413eb2d87b895e92f8584b5b94a10167 # v3.3.0
         with:
           architecture: ${{ matrix.architecture }}
           activate-environment: esmvalcore
@@ -106,8 +112,8 @@ jobs:
           esmvaltool --help
           esmvaltool version 2>&1 | tee pip_install_osx_artifacts_python_${{ matrix.python-version }}/version.txt
       - name: Upload artifacts
-        if: ${{ always() }}  # upload artifacts even if fail
-        uses: actions/upload-artifact@v6
+        if: ${{ always() }} # upload artifacts even if fail
+        uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6.0.0
         with:
           name: PIP_Install_OSX_python_${{ matrix.python-version }}
           path: pip_install_osx_artifacts_python_${{ matrix.python-version }}