From 45c8ef64f211c8a8db0fca91a79f83114940a3a5 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?S=C3=A9bastien=20Hensgen?=
 <24550538+sebhmg@users.noreply.github.com>
Date: Wed, 5 Nov 2025 12:35:14 -0500
Subject: [PATCH 1/6] [DEVOPS-922] automatic versioning for the conda recipe

---
 .gitignore     | 1 +
 pyproject.toml | 1 +
 recipe.yaml    | 3 ++-
 3 files changed, 4 insertions(+), 1 deletion(-)

diff --git a/.gitignore b/.gitignore
index 53545d898d..49462ce3ac 100644
--- a/.gitignore
+++ b/.gitignore
@@ -96,3 +96,4 @@ tutorials/13-joint_inversion/cross_gradient_data/*
 
 # setuptools_scm
 simpeg/version.py
+/_version.txt
diff --git a/pyproject.toml b/pyproject.toml
index c0b8b50bb8..9044004322 100644
--- a/pyproject.toml
+++ b/pyproject.toml
@@ -104,6 +104,7 @@ include = ["simpeg*"]
 
 [tool.setuptools_scm]
 version_file = "simpeg/version.py"
+write_to = "_version.txt"
 local_scheme = "node-and-date"
 
 [tool.coverage.run]
diff --git a/recipe.yaml b/recipe.yaml
index 4c4ff660d9..1a0fc6a53a 100644
--- a/recipe.yaml
+++ b/recipe.yaml
@@ -2,7 +2,8 @@ schema_version: 1
 
 context:
   name: "mira-simpeg"
-  version: "0.23.0.2b1"
+  # Read version from _version.txt file generated by setuptools_scm
+  version: ${{ load_from_file("_version.txt") | default("0.0.0.dev0") }}
   python_min: "3.10"
 
 package:

From 053c1f7352aff6f08a2b347dad9fd6c89492e127 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?S=C3=A9bastien=20Hensgen?=
 <24550538+sebhmg@users.noreply.github.com>
Date: Wed, 5 Nov 2025 14:23:26 -0500
Subject: [PATCH 2/6] enable rattler-build experimental features

---
 .github/workflows/python_deploy_dev.yml | 1 +
 1 file changed, 1 insertion(+)

diff --git a/.github/workflows/python_deploy_dev.yml b/.github/workflows/python_deploy_dev.yml
index 1238f55f2e..afddb544e0 100644
--- a/.github/workflows/python_deploy_dev.yml
+++ b/.github/workflows/python_deploy_dev.yml
@@ -22,6 +22,7 @@ jobs:
       source-repo-names: '["public-noremote-conda-dev"]'
       conda-channels: '["conda-forge"]'
       publish-repo-names: '["public-noremote-conda-dev"]'
+      build-experimental: true
     secrets:
       JFROG_ARTIFACTORY_URL: ${{ secrets.JFROG_ARTIFACTORY_URL }}
       JFROG_ARTIFACTORY_TOKEN: ${{ secrets.JFROG_ARTIFACTORY_TOKEN }}

From f2db7a59d359edd2317a26dde0805b9e714527ee Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?S=C3=A9bastien=20Hensgen?=
 <24550538+sebhmg@users.noreply.github.com>
Date: Wed, 19 Nov 2025 15:30:59 -0500
Subject: [PATCH 3/6] [DEVOPS-922] test _version.py is in conda package

---
 recipe.yaml | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/recipe.yaml b/recipe.yaml
index 1a0fc6a53a..b7b30b038c 100644
--- a/recipe.yaml
+++ b/recipe.yaml
@@ -5,6 +5,7 @@ context:
   # Read version from _version.txt file generated by setuptools_scm
   version: ${{ load_from_file("_version.txt") | default("0.0.0.dev0") }}
   python_min: "3.10"
+  module_name: ${{ name|lower|replace("-", "_") }}
 
 package:
   name: ${{ name|lower }}
@@ -72,6 +73,9 @@ tests:
         - simpeg.utils.drivers
         - simpeg.regularization
         - simpeg.meta
+  - package_contents:
+      files:
+        - site-packages/${{ module_name }}/version.py
 
 about:
   summary: "Mira Geoscience fork of SimPEG: Simulation and Parameter Estimation in Geophysics"

From 122bee253ffca312cc12b393d70330dd35d0b63b Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?S=C3=A9bastien=20Hensgen?=
 <24550538+sebhmg@users.noreply.github.com>
Date: Wed, 19 Nov 2025 15:31:39 -0500
Subject: [PATCH 4/6] [DEVOPS-922] do not hard-code module name in recipe tests

---
 recipe.yaml | 51 ++++++++++++++++++++++++++-------------------------
 1 file changed, 26 insertions(+), 25 deletions(-)

diff --git a/recipe.yaml b/recipe.yaml
index b7b30b038c..931ee1a894 100644
--- a/recipe.yaml
+++ b/recipe.yaml
@@ -48,31 +48,32 @@ requirements:
 tests:
   - python:
       imports:
-        - simpeg
-        - simpeg.electromagnetics
-        - simpeg.electromagnetics.analytics
-        - simpeg.electromagnetics.frequency_domain
-        - simpeg.electromagnetics.natural_source
-        - simpeg.electromagnetics.natural_source.utils
-        - simpeg.electromagnetics.static
-        - simpeg.electromagnetics.static.resistivity
-        - simpeg.electromagnetics.static.induced_polarization
-        - simpeg.electromagnetics.static.spectral_induced_polarization
-        - simpeg.electromagnetics.static.utils
-        - simpeg.electromagnetics.time_domain
-        - simpeg.electromagnetics.utils
-        - simpeg.electromagnetics.viscous_remanent_magnetization
-        - simpeg.flow
-        - simpeg.flow.richards
-        - simpeg.potential_fields
-        - simpeg.potential_fields.gravity
-        - simpeg.potential_fields.magnetics
-        - simpeg.seismic
-        - simpeg.seismic.straight_ray_tomography
-        - simpeg.utils
-        - simpeg.utils.drivers
-        - simpeg.regularization
-        - simpeg.meta
+        - ${{ module_name }}
+        - ${{ module_name }}.electromagnetics
+        - ${{ module_name }}.electromagnetics.analytics
+        - ${{ module_name }}.electromagnetics.frequency_domain
+        - ${{ module_name }}.electromagnetics.natural_source
+        - ${{ module_name }}.electromagnetics.natural_source.utils
+        - ${{ module_name }}.electromagnetics.static
+        - ${{ module_name }}.electromagnetics.static.resistivity
+        - ${{ module_name }}.electromagnetics.static.induced_polarization
+        - ${{ module_name }}.electromagnetics.static.spectral_induced_polarization
+        - ${{ module_name }}.electromagnetics.static.utils
+        - ${{ module_name }}.electromagnetics.time_domain
+        - ${{ module_name }}.electromagnetics.utils
+        - ${{ module_name }}.electromagnetics.viscous_remanent_magnetization
+        - ${{ module_name }}.flow
+        - ${{ module_name }}.flow.richards
+        - ${{ module_name }}.potential_fields
+        - ${{ module_name }}.potential_fields.gravity
+        - ${{ module_name }}.potential_fields.magnetics
+        - ${{ module_name }}.seismic
+        - ${{ module_name }}.seismic.straight_ray_tomography
+        - ${{ module_name }}.utils
+        - ${{ module_name }}.utils.drivers
+        - ${{ module_name }}.regularization
+        - ${{ module_name }}.meta
+        - ${{ module_name }}.version
   - package_contents:
       files:
         - site-packages/${{ module_name }}/version.py

From 87ffe8334296e55a521c2a73bd4dc8134d21a1d6 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?S=C3=A9bastien=20Hensgen?=
 <24550538+sebhmg@users.noreply.github.com>
Date: Wed, 19 Nov 2025 15:53:16 -0500
Subject: [PATCH 5/6] [DEVOPS-922] force module_name to simpeg

while package name is mira-simpeg
---
 recipe.yaml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/recipe.yaml b/recipe.yaml
index 931ee1a894..4e82d4996d 100644
--- a/recipe.yaml
+++ b/recipe.yaml
@@ -5,7 +5,7 @@ context:
   # Read version from _version.txt file generated by setuptools_scm
   version: ${{ load_from_file("_version.txt") | default("0.0.0.dev0") }}
   python_min: "3.10"
-  module_name: ${{ name|lower|replace("-", "_") }}
+  module_name: simpeg
 
 package:
   name: ${{ name|lower }}

From a5892dbadf31c2e18b7ebd09dfb10c395ad8bdd4 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?S=C3=A9bastien=20Hensgen?=
 <24550538+sebhmg@users.noreply.github.com>
Date: Wed, 19 Nov 2025 16:05:31 -0500
Subject: [PATCH 6/6] [DEVOPS-922] configuration for zizmor

---
 .github/dependabot.yml                     | 14 +++++++
 .github/workflows/issue_to_jira.yml        |  9 +++--
 .github/workflows/pr_add_jira_summary.yml  |  9 +++--
 .github/workflows/python_deploy_dev.yml    | 12 +++---
 .github/workflows/python_deploy_prod.yml   | 12 +++---
 .github/workflows/security_scan.yml        | 45 ++++++++++++++++++++++
 .github/workflows/zizmor-security-mira.yml | 28 --------------
 zizmor.yml                                 |  1 +
 8 files changed, 82 insertions(+), 48 deletions(-)
 create mode 100644 .github/dependabot.yml
 create mode 100644 .github/workflows/security_scan.yml
 delete mode 100644 .github/workflows/zizmor-security-mira.yml
 create mode 100644 zizmor.yml

diff --git a/.github/dependabot.yml b/.github/dependabot.yml
new file mode 100644
index 0000000000..e346f3da38
--- /dev/null
+++ b/.github/dependabot.yml
@@ -0,0 +1,14 @@
+# To get started with Dependabot version updates, you'll need to specify which
+# package ecosystems to update and where the package manifests are located.
+# Please see the documentation for all configuration options:
+# https://docs.github.com/github/administering-a-repository/configuration-options-for-dependency-updates
+
+version: 2
+updates:
+  - package-ecosystem: "github-actions"
+    directory: "/"
+    target-branch: "develop"
+    schedule:
+      interval: "weekly"
+    cooldown:
+      default-days: 4
diff --git a/.github/workflows/issue_to_jira.yml b/.github/workflows/issue_to_jira.yml
index 148142b65b..024a1c3416 100644
--- a/.github/workflows/issue_to_jira.yml
+++ b/.github/workflows/issue_to_jira.yml
@@ -4,14 +4,15 @@ on:
   issues:
     types: [opened]
 
-permissions:
-  contents: read
-  issues: write
+permissions: {}
 
 jobs:
   call-workflow-create-jira-issue:
     if: startsWith(github.repository, 'MiraGeoscience/')  # run on the Mira repo only
-    uses: MiraGeoscience/CI-tools/.github/workflows/reusable-jira-issue_to_jira.yml@main
+    uses: MiraGeoscience/CI-tools/.github/workflows/reusable-jira-issue_to_jira.yml@v2
+    permissions:
+      contents: read
+      issues: write
     with:
       project-key: 'GEOPY'
       components: '[{"name": "simpeg"}]'
diff --git a/.github/workflows/pr_add_jira_summary.yml b/.github/workflows/pr_add_jira_summary.yml
index 210bba945a..db5cb2f0c5 100644
--- a/.github/workflows/pr_add_jira_summary.yml
+++ b/.github/workflows/pr_add_jira_summary.yml
@@ -4,14 +4,15 @@ on:
   pull_request_target:  # zizmor: ignore[dangerous-triggers]
     types: [opened]
 
-permissions:
-  contents: read
-  pull-requests: write
+permissions: {}
 
 jobs:
   call-workflow-add-jira-issue-summary:
     if: startsWith(github.repository, 'MiraGeoscience/')  # run if PR targets the Mira repo only
-    uses: MiraGeoscience/CI-tools/.github/workflows/reusable-jira-pr_add_jira_summary.yml@main
+    uses: MiraGeoscience/CI-tools/.github/workflows/reusable-jira-pr_add_jira_summary.yml@v2
+    permissions:
+      contents: read
+      pull-requests: write
     secrets:
       JIRA_BASE_URL: ${{ secrets.JIRA_BASE_URL }}
       JIRA_USER_EMAIL: ${{ secrets.JIRA_USER_EMAIL }}
diff --git a/.github/workflows/python_deploy_dev.yml b/.github/workflows/python_deploy_dev.yml
index afddb544e0..d42d67f424 100644
--- a/.github/workflows/python_deploy_dev.yml
+++ b/.github/workflows/python_deploy_dev.yml
@@ -5,6 +5,8 @@ on:
     tags:
       - 'v*' # Push events to every version tag (eg. v1.0.0)
 
+permissions: {}
+
 concurrency:
   group: ${{ github.workflow }}-${{ github.ref || github.run_id }}
   cancel-in-progress: true
@@ -12,10 +14,9 @@ concurrency:
 jobs:
   call-workflow-conda-publish:
     name: Publish development conda package on JFrog Artifactory
-    uses: MiraGeoscience/CI-tools/.github/workflows/reusable-python-publish_rattler_package.yml@main
+    uses: MiraGeoscience/CI-tools/.github/workflows/reusable-python-publish_rattler_package.yml@v2
     permissions:
-      contents: write  # to create draft release and attach artifacts
-      actions: read
+      contents: write
     with:
       package-name: 'mira-simpeg'
       python-version: '3.10'
@@ -28,10 +29,9 @@ jobs:
       JFROG_ARTIFACTORY_TOKEN: ${{ secrets.JFROG_ARTIFACTORY_TOKEN }}
   call-workflow-pypi-publish:
     name: Publish development pypi package (JFrog Artifactory, TestPyPI)
-    uses: MiraGeoscience/CI-tools/.github/workflows/reusable-python-publish_pypi_package.yml@main
+    uses: MiraGeoscience/CI-tools/.github/workflows/reusable-python-publish_pypi_package.yml@v2
     permissions:
-      contents: write  # to create draft release and attach artifacts
-      actions: read
+      contents: write
     with:
       package-manager: 'setuptools'
       package-name: 'mira-simpeg'
diff --git a/.github/workflows/python_deploy_prod.yml b/.github/workflows/python_deploy_prod.yml
index ea8201f46f..407e3ef03c 100644
--- a/.github/workflows/python_deploy_prod.yml
+++ b/.github/workflows/python_deploy_prod.yml
@@ -19,6 +19,8 @@ on:
         type: boolean
         default: true
 
+permissions: {}
+
 concurrency:
   group: ${{ github.workflow }}-${{ github.event.release.tag_name || github.event.inputs.release-tag || github.run_id }}
   cancel-in-progress: true
@@ -27,10 +29,9 @@ jobs:
   call-workflow-conda-release:
     name: Publish production Conda package on JFrog Artifactory
     if: ${{ github.event_name == 'release' || github.event.inputs.publish-conda == 'true' }}
-    uses: MiraGeoscience/CI-tools/.github/workflows/reusable-python-release_conda_assets.yml@main
+    uses: MiraGeoscience/CI-tools/.github/workflows/reusable-python-release_conda_assets.yml@v2
     permissions:
-      contents: write  # seems required to find the draft release
-      actions: read
+      contents: write
     with:
       virtual-repo-names: '["public-noremote-conda-prod"]'
       release-tag: ${{ github.event.release.tag_name || github.event.inputs.release-tag }}
@@ -40,10 +41,9 @@ jobs:
   call-workflow-pypi-release:
     name: Publish production PyPI package (JFrog Artifactory, PyPI)
     if: ${{ github.event_name == 'release' || github.event.inputs.publish-pypi == 'true' }}
-    uses: MiraGeoscience/CI-tools/.github/workflows/reusable-python-release_pypi_assets.yml@main
+    uses: MiraGeoscience/CI-tools/.github/workflows/reusable-python-release_pypi_assets.yml@v2
     permissions:
-      contents: write  # seems required to find the draft release
-      actions: read
+      contents: write
     with:
       package-name: 'mira-simpeg'
       virtual-repo-names: '["public-pypi-prod", "pypi"]'
diff --git a/.github/workflows/security_scan.yml b/.github/workflows/security_scan.yml
new file mode 100644
index 0000000000..3a1b2861d8
--- /dev/null
+++ b/.github/workflows/security_scan.yml
@@ -0,0 +1,45 @@
+name: Security Scan
+
+on:
+  pull_request:
+    types: [opened, synchronize, reopened, ready_for_review]
+    branches:
+      - develop
+      - main
+      - release/**
+      - feature/**
+      - hotfix/**
+  push:
+    branches:
+      - develop
+      - main
+      - release/**
+      - feature/**
+      - hotfix/**
+
+permissions: {}
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.head_ref || github.run_id }}
+  cancel-in-progress: true
+
+jobs:
+  call-workflow-zizmor-annotate:
+    name: Zizmor analysis (advanced security)
+    # run on the Mira repo only (upstream SimPEG repo has its own workflow for Zizmor)
+    if: ${{ github.event_name != 'pull_request' && startsWith(github.repository, 'MiraGeoscience/') }}
+    permissions:
+      security-events: write
+      contents: read
+      actions: read
+    uses: MiraGeoscience/CI-tools/.github/workflows/reusable-zizmor-advanced-security.yml@v2
+
+  call-workflow-zizmor-advanced-security:
+    name: Zizmor analysis (annotate)
+    # run on the Mira repo only (upstream SimPEG repo has its own workflow for Zizmor)
+    if: ${{ github.event_name == 'pull_request'  && startsWith(github.repository, 'MiraGeoscience/') }}
+    permissions:
+      checks: write
+      contents: read
+      actions: read
+    uses: MiraGeoscience/CI-tools/.github/workflows/reusable-zizmor-annotate.yml@v2
diff --git a/.github/workflows/zizmor-security-mira.yml b/.github/workflows/zizmor-security-mira.yml
deleted file mode 100644
index 5f44473b27..0000000000
--- a/.github/workflows/zizmor-security-mira.yml
+++ /dev/null
@@ -1,28 +0,0 @@
-name: Zizmor analysis
-
-on:
-  pull_request:
-    types: [opened, synchronize, reopened, ready_for_review]
-    branches:
-      - develop
-      - main
-      - release/**
-      - feature/**
-      - hotfix/**
-  push:
-    branches:
-      - main
-      - develop
-      - feature/**
-      - hotfix/**
-      - release/**
-
-jobs:
-  call-workflow-zizmor:
-    name: Zizmor analysis
-    # run on the Mira repo only (upstream SimPEG repo has its own workflow for Zizmor)
-    if: startsWith(github.repository, 'MiraGeoscience/')
-    permissions:
-      contents: read
-      actions: read
-    uses: MiraGeoscience/CI-tools/.github/workflows/reusable-zizmor-security.yml@main
diff --git a/zizmor.yml b/zizmor.yml
new file mode 100644
index 0000000000..01c57e8228
--- /dev/null
+++ b/zizmor.yml
@@ -0,0 +1 @@
+rules: