Update develop

.github/dependabot.yml

@@ -0,0 +1,14 @@
+# To get started with Dependabot version updates, you'll need to specify which
+# package ecosystems to update and where the package manifests are located.
+# Please see the documentation for all configuration options:
+# https://docs.github.com/github/administering-a-repository/configuration-options-for-dependency-updates
+
+version: 2
+updates:
+  - package-ecosystem: "github-actions"
+    directory: "/"
+    target-branch: "develop"
+    schedule:
+      interval: "weekly"
+    cooldown:
+      default-days: 4

.github/workflows/issue_to_jira.yml

@@ -4,14 +4,15 @@ on:
   issues:
     types: [opened]
 
-permissions:
-  contents: read
-  issues: write
+permissions: {}
 
 jobs:
   call-workflow-create-jira-issue:
     if: startsWith(github.repository, 'MiraGeoscience/')  # run on the Mira repo only
-    uses: MiraGeoscience/CI-tools/.github/workflows/reusable-jira-issue_to_jira.yml@main
+    uses: MiraGeoscience/CI-tools/.github/workflows/reusable-jira-issue_to_jira.yml@v2
+    permissions:
+      contents: read
+      issues: write
     with:
       project-key: 'GEOPY'
       components: '[{"name": "simpeg"}]'

.github/workflows/pr_add_jira_summary.yml

@@ -4,14 +4,15 @@ on:
   pull_request_target:  # zizmor: ignore[dangerous-triggers]
     types: [opened]
 
-permissions:
-  contents: read
-  pull-requests: write
+permissions: {}
 
 jobs:
   call-workflow-add-jira-issue-summary:
     if: startsWith(github.repository, 'MiraGeoscience/')  # run if PR targets the Mira repo only
-    uses: MiraGeoscience/CI-tools/.github/workflows/reusable-jira-pr_add_jira_summary.yml@main
+    uses: MiraGeoscience/CI-tools/.github/workflows/reusable-jira-pr_add_jira_summary.yml@v2
+    permissions:
+      contents: read
+      pull-requests: write
     secrets:
       JIRA_BASE_URL: ${{ secrets.JIRA_BASE_URL }}
       JIRA_USER_EMAIL: ${{ secrets.JIRA_USER_EMAIL }}

.github/workflows/python_deploy_dev.yml

@@ -5,32 +5,33 @@ on:
     tags:
       - 'v*' # Push events to every version tag (eg. v1.0.0)
 
+permissions: {}
+
 concurrency:
   group: ${{ github.workflow }}-${{ github.ref || github.run_id }}
   cancel-in-progress: true
 
 jobs:
   call-workflow-conda-publish:
     name: Publish development conda package on JFrog Artifactory
-    uses: MiraGeoscience/CI-tools/.github/workflows/reusable-python-publish_rattler_package.yml@main
+    uses: MiraGeoscience/CI-tools/.github/workflows/reusable-python-publish_rattler_package.yml@v2
     permissions:
-      contents: write  # to create draft release and attach artifacts
-      actions: read
+      contents: write
     with:
       package-name: 'mira-simpeg'
       python-version: '3.10'
       source-repo-names: '["public-noremote-conda-dev"]'
       conda-channels: '["conda-forge"]'
       publish-repo-names: '["public-noremote-conda-dev"]'
+      build-experimental: true
     secrets:
       JFROG_ARTIFACTORY_URL: ${{ secrets.JFROG_ARTIFACTORY_URL }}
       JFROG_ARTIFACTORY_TOKEN: ${{ secrets.JFROG_ARTIFACTORY_TOKEN }}
   call-workflow-pypi-publish:
     name: Publish development pypi package (JFrog Artifactory, TestPyPI)
-    uses: MiraGeoscience/CI-tools/.github/workflows/reusable-python-publish_pypi_package.yml@main
+    uses: MiraGeoscience/CI-tools/.github/workflows/reusable-python-publish_pypi_package.yml@v2
     permissions:
-      contents: write  # to create draft release and attach artifacts
-      actions: read
+      contents: write
     with:
       package-manager: 'setuptools'
       package-name: 'mira-simpeg'

.github/workflows/python_deploy_prod.yml

@@ -19,6 +19,8 @@ on:
         type: boolean
         default: true
 
+permissions: {}
+
 concurrency:
   group: ${{ github.workflow }}-${{ github.event.release.tag_name || github.event.inputs.release-tag || github.run_id }}
   cancel-in-progress: true
@@ -27,10 +29,9 @@ jobs:
   call-workflow-conda-release:
     name: Publish production Conda package on JFrog Artifactory
     if: ${{ github.event_name == 'release' || github.event.inputs.publish-conda == 'true' }}
-    uses: MiraGeoscience/CI-tools/.github/workflows/reusable-python-release_conda_assets.yml@main
+    uses: MiraGeoscience/CI-tools/.github/workflows/reusable-python-release_conda_assets.yml@v2
     permissions:
-      contents: write  # seems required to find the draft release
-      actions: read
+      contents: write
     with:
       virtual-repo-names: '["public-noremote-conda-prod"]'
       release-tag: ${{ github.event.release.tag_name || github.event.inputs.release-tag }}
@@ -40,10 +41,9 @@ jobs:
   call-workflow-pypi-release:
     name: Publish production PyPI package (JFrog Artifactory, PyPI)
     if: ${{ github.event_name == 'release' || github.event.inputs.publish-pypi == 'true' }}
-    uses: MiraGeoscience/CI-tools/.github/workflows/reusable-python-release_pypi_assets.yml@main
+    uses: MiraGeoscience/CI-tools/.github/workflows/reusable-python-release_pypi_assets.yml@v2
     permissions:
-      contents: write  # seems required to find the draft release
-      actions: read
+      contents: write
     with:
       package-name: 'mira-simpeg'
       virtual-repo-names: '["public-pypi-prod", "pypi"]'

.github/workflows/security_scan.yml

@@ -0,0 +1,45 @@
+name: Security Scan
+
+on:
+  pull_request:
+    types: [opened, synchronize, reopened, ready_for_review]
+    branches:
+      - develop
+      - main
+      - release/**
+      - feature/**
+      - hotfix/**
+  push:
+    branches:
+      - develop
+      - main
+      - release/**
+      - feature/**
+      - hotfix/**
+
+permissions: {}
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.head_ref || github.run_id }}
+  cancel-in-progress: true
+
+jobs:
+  call-workflow-zizmor-annotate:
+    name: Zizmor analysis (advanced security)
+    # run on the Mira repo only (upstream SimPEG repo has its own workflow for Zizmor)
+    if: ${{ github.event_name != 'pull_request' && startsWith(github.repository, 'MiraGeoscience/') }}
+    permissions:
+      security-events: write
+      contents: read
+      actions: read
+    uses: MiraGeoscience/CI-tools/.github/workflows/reusable-zizmor-advanced-security.yml@v2
+
+  call-workflow-zizmor-advanced-security:
+    name: Zizmor analysis (annotate)
+    # run on the Mira repo only (upstream SimPEG repo has its own workflow for Zizmor)
+    if: ${{ github.event_name == 'pull_request'  && startsWith(github.repository, 'MiraGeoscience/') }}
+    permissions:
+      checks: write
+      contents: read
+      actions: read
+    uses: MiraGeoscience/CI-tools/.github/workflows/reusable-zizmor-annotate.yml@v2

.gitignore

@@ -96,3 +96,4 @@ tutorials/13-joint_inversion/cross_gradient_data/*
 
 # setuptools_scm
 simpeg/version.py
+/_version.txt

pyproject.toml

@@ -104,6 +104,7 @@ include = ["simpeg*"]
 
 [tool.setuptools_scm]
 version_file = "simpeg/version.py"
+write_to = "_version.txt"
 local_scheme = "node-and-date"
 
 [tool.coverage.run]

recipe.yaml

@@ -2,8 +2,10 @@ schema_version: 1
 
 context:
   name: "mira-simpeg"
-  version: "0.23.0.2b1"
+  # Read version from _version.txt file generated by setuptools_scm
+  version: ${{ load_from_file("_version.txt") | default("0.0.0.dev0") }}
   python_min: "3.10"
+  module_name: simpeg
 
 package:
   name: ${{ name|lower }}
@@ -46,31 +48,35 @@ requirements:
 tests:
   - python:
       imports:
-        - simpeg
-        - simpeg.electromagnetics
-        - simpeg.electromagnetics.analytics
-        - simpeg.electromagnetics.frequency_domain
-        - simpeg.electromagnetics.natural_source
-        - simpeg.electromagnetics.natural_source.utils
-        - simpeg.electromagnetics.static
-        - simpeg.electromagnetics.static.resistivity
-        - simpeg.electromagnetics.static.induced_polarization
-        - simpeg.electromagnetics.static.spectral_induced_polarization
-        - simpeg.electromagnetics.static.utils
-        - simpeg.electromagnetics.time_domain
-        - simpeg.electromagnetics.utils
-        - simpeg.electromagnetics.viscous_remanent_magnetization
-        - simpeg.flow
-        - simpeg.flow.richards
-        - simpeg.potential_fields
-        - simpeg.potential_fields.gravity
-        - simpeg.potential_fields.magnetics
-        - simpeg.seismic
-        - simpeg.seismic.straight_ray_tomography
-        - simpeg.utils
-        - simpeg.utils.drivers
-        - simpeg.regularization
-        - simpeg.meta
+        - ${{ module_name }}
+        - ${{ module_name }}.electromagnetics
+        - ${{ module_name }}.electromagnetics.analytics
+        - ${{ module_name }}.electromagnetics.frequency_domain
+        - ${{ module_name }}.electromagnetics.natural_source
+        - ${{ module_name }}.electromagnetics.natural_source.utils
+        - ${{ module_name }}.electromagnetics.static
+        - ${{ module_name }}.electromagnetics.static.resistivity
+        - ${{ module_name }}.electromagnetics.static.induced_polarization
+        - ${{ module_name }}.electromagnetics.static.spectral_induced_polarization
+        - ${{ module_name }}.electromagnetics.static.utils
+        - ${{ module_name }}.electromagnetics.time_domain
+        - ${{ module_name }}.electromagnetics.utils
+        - ${{ module_name }}.electromagnetics.viscous_remanent_magnetization
+        - ${{ module_name }}.flow
+        - ${{ module_name }}.flow.richards
+        - ${{ module_name }}.potential_fields
+        - ${{ module_name }}.potential_fields.gravity
+        - ${{ module_name }}.potential_fields.magnetics
+        - ${{ module_name }}.seismic
+        - ${{ module_name }}.seismic.straight_ray_tomography
+        - ${{ module_name }}.utils
+        - ${{ module_name }}.utils.drivers
+        - ${{ module_name }}.regularization
+        - ${{ module_name }}.meta
+        - ${{ module_name }}.version
+  - package_contents:
+      files:
+        - site-packages/${{ module_name }}/version.py
 
 about:
   summary: "Mira Geoscience fork of SimPEG: Simulation and Parameter Estimation in Geophysics"

zizmor.yml

@@ -0,0 +1 @@
+rules: