Merge release/3.19.0 in urban-health-model

.github/workflows/build-and-test.yml

@@ -185,7 +185,7 @@ jobs:
         if: github.event_name != 'pull_request'
         env:
           CLOUDSDK_PYTHON: ${{ steps.python-gsutil-task.outputs.python-path }}
-        run: make deploy
+        run: make deploy_dist
 
   test-source-distribution:
     name: Check sdist
@@ -270,7 +270,7 @@ jobs:
         if: github.event_name != 'pull_request' && matrix.os == 'macos-15-intel' && matrix.python-version == env.LATEST_SUPPORTED_PYTHON_VERSION
         env:
           CLOUDSDK_PYTHON: ${{ steps.python-gsutil-task.outputs.python-path }}
-        run: make deploy
+        run: make deploy_dist
 
   validate-resources:
     name: Validate Sampledata & User Guide
@@ -461,23 +461,18 @@ jobs:
           yarn run build
           yarn run dist
 
-      - name: Test electron app with puppeteer
-        continue-on-error: true  # test is flaky on GHA
-        working-directory: workbench
-        run: npx cross-env CI=true yarn run test-electron-app
-
       # gsutil (part of make deploy) never seems to support the latest python version.
       - name: Set up python for gsutil
         uses: actions/setup-python@v6
         with:
           python-version: ${{ env.GSUTIL_PYTHON_VERSION }}
         id: python-gsutil-task
 
-      - name: Deploy artifacts to GCS
+      - name: Deploy binaries and user guide to GCS
         if: github.event_name != 'pull_request'
         env:
           CLOUDSDK_PYTHON: ${{ steps.python-gsutil-task.outputs.python-path }}
-        run: make deploy
+        run: make deploy_dist deploy_userguide deploy_workbench
 
       # This relies on the file existing on GCP, so it must be run after `make
       # deploy` is called.
@@ -502,13 +497,6 @@ jobs:
           name: InVEST-user-guide
           path: dist/InVEST_*_userguide.zip
 
-      - name: Upload workbench logging from puppeteer
-        uses: actions/upload-artifact@v4
-        if: always()
-        with:
-          name: ${{ runner.os }}_puppeteer_log.zip'
-          path: ${{ matrix.puppeteer-log }}
-
       - name: Run invest-autotest with binaries
         id: invest-autotest
         if : |
@@ -532,6 +520,17 @@ jobs:
           DEST=gs://releases.naturalcapitalproject.org/invest-reports/latest
           gsutil -m rsync -r ${{ steps.invest-autotest-deploy.outputs.REPORTS_BASE_URL }} $DEST
 
+      - name: Test electron app with puppeteer
+        working-directory: workbench
+        run: npx cross-env CI=true yarn run test-electron-app
+
+      - name: Upload workbench logging from puppeteer
+        uses: actions/upload-artifact@v4
+        if: always()
+        with:
+          name: ${{ runner.os }}_puppeteer_log.zip'
+          path: ${{ matrix.puppeteer-log }}
+
       - name: Tar the workspace to preserve permissions
         if: failure()
         run: tar -cvf ${{ matrix.workspace-path}} ${{ github.workspace }}
@@ -579,8 +578,8 @@ jobs:
         if: github.event_name != 'pull_request'
         uses: google-github-actions/setup-gcloud@v3
 
-      - name: Deploy artifacts to GCS
+      - name: Deploy sample data to GCS
         if: github.event_name != 'pull_request'
         env:
           CLOUDSDK_PYTHON: ${{ steps.python-gsutil-task.outputs.python-path }}
-        run: make deploy
+        run: make deploy_data

HISTORY.rst

@@ -61,10 +61,36 @@
   7. InVEST model Z (model names should be sorted A-Z)
 
 
+Unreleased Changes
+------------------
+
+Seasonal Water Yield
+====================
+* The model now generates a report, a visual summary of results, available in
+  the output workspace and also viewable from the Workbench after the model run
+  completes. (`#2321 <https://github.com/natcap/invest/issues/2321>`_)
+* The model now generates an additional output, a CSV containing average monthly
+  quickflow, baseflow, and precipitation values, in cubic meters per month, for
+  each feature in the AOI. This output is used by the report to generate some
+  plots. Note that this CSV is only created when the model is run without
+  inputting a Local Recharge raster.
+  (`#2321 <https://github.com/natcap/invest/issues/2321>`_)
+* Various updates to model output data metadata, including correcting the
+  units of some outputs.
+  (`#2450 <https://github.com/natcap/invest/issues/2450>`_)
+* Updated the naming convention of several monthly intermediate outputs to be
+  1-indexed rather than 0-indexed. This makes filenames consistent throughout
+  the model, where 1=January and 12=December.
+  (`#2451 <https://github.com/natcap/invest/issues/2451>`_)
+
+
+General
+=======
+* Refactored ``make deploy`` into artifact-specific targets (``deploy_dist``,
+  ``deploy_data``, ``deploy_userguide``, ``deploy_workbench``) and updated
+  these targets to fail on missing artifacts instead of silently ignoring
+  errors. (`#831 <https://github.com/natcap/invest/issues/813>`_)
 
-..
-  Unreleased Changes
-  ------------------
 
 3.18.0 (2026-02-25)
 -------------------

Makefile

@@ -6,7 +6,7 @@ GIT_SAMPLE_DATA_REPO_REV    := cfd1f07673e66823fd22989a2b87afb017aac447
 
 GIT_TEST_DATA_REPO          := https://bitbucket.org/natcap/invest-test-data.git
 GIT_TEST_DATA_REPO_PATH     := $(DATA_DIR)/invest-test-data
-GIT_TEST_DATA_REPO_REV      := c791f2b50e67680832054536899efacbc72e9e0b
+GIT_TEST_DATA_REPO_REV      := 94c4bc9f0f22082d2251b6b14063eb0ff4094451
 
 GIT_UG_REPO                 := https://github.com/natcap/invest.users-guide
 GIT_UG_REPO_PATH            := doc/users-guide
@@ -124,7 +124,8 @@ INVEST_AUTOTESTER := $(PYTHON) scripts/invest-autotest.py --cwd $(GIT_SAMPLE_DAT
 
 
 .PHONY: fetch install binaries apidocs userguide changelog sampledata \
-sampledata_single test clean help check python_packages purge deploy codesign \
+sampledata_single test clean help check python_packages purge deploy \
+deploy_dist deploy_data deploy_userguide deploy_workbench codesign \
 validate_sampledata validate_userguide_filenames invest_autotest deploy_autotest_reports \
 $(GIT_SAMPLE_DATA_REPO_PATH) $(GIT_TEST_DATA_REPO_PATH) $(GIT_UG_REPO_REV)
 
@@ -159,6 +160,10 @@ help:
 	@echo "  invest_autotest              to run invest via the CLI on all sampledata datastacks"
 	@echo "  deploy_autotest_reports      to deploy to GCS any model's HTML report generated by the autotest"
 	@echo "  deploy                       to deploy any artifacts in dist/ folder to GCS"
+	@echo "  deploy_dist                  to deploy the contents of dist/ folder to GCS"
+	@echo "  deploy_data                  to deploy the contents of dist/data/ folder to GCS"
+	@echo "  deploy_userguide             to deploy the contents of dist/userguide/ folder to GCS"
+	@echo "  deploy_workbench             to deploy the contents of workbench/dist/ folder to GCS"
 	@echo "  clean                        to remove temporary directories and files (but not dist/)"
 	@echo "  purge                        to remove temporary directories, cloned repositories and the built environment."
 	@echo "  help                         to print this help and exit"
@@ -356,6 +361,18 @@ deploy:
 	@echo "Application binaries (if they were created) can be downloaded from:"
 	@echo "  * $(DOWNLOAD_DIR_URL)"
 
+deploy_dist:
+	$(GSUTIL) -m rsync $(DIST_DIR) $(DIST_URL_BASE)
+
+deploy_data:
+	$(GSUTIL) -m rsync -r $(DIST_DIR)/data $(DIST_URL_BASE)/data
+
+deploy_userguide:
+	$(GSUTIL) -m rsync -r $(DIST_DIR)/userguide $(DIST_URL_BASE)/userguide
+
+deploy_workbench:
+	$(GSUTIL) -m rsync -r $(WORKBENCH_DIST_DIR) $(DIST_URL_BASE)/workbench
+
 changelog:
 	$(RST2HTML5) $(CHANGELOG_SRC) $(CHANGELOG_DEST)
 

codesigning/Makefile

@@ -1,3 +1,5 @@
+ENV := env
+CWD := $(shell pwd)
 .PHONY: deploy-cloudfunction deploy-worker
 
 deploy-cloudfunction:
@@ -14,8 +16,12 @@ deploy-cloudfunction:
 		--source gcp-cloudfunc/
 
 # NOTE: This must be executed from a computer that has SSH access to ncp-inkwell.
-deploy-worker:
-	cd signing-worker && ansible-playbook \
+deploy-worker: env
+	cd signing-worker && $(CWD)/$(ENV)/bin/ansible-playbook \
 		--ask-become-pass \
-		--inventory-file inventory.ini \
+		--inventory inventory.ini \
 		playbook.yml
+
+env:
+	python -m venv $(ENV)
+	$(CWD)/$(ENV)/bin/python -m pip install -r requirements.txt

codesigning/requirements.txt

@@ -0,0 +1,2 @@
+# All runtime requirement for the remote system are handled within the ansible playbook
+ansible

codesigning/signing-worker/natcap-codesign.py

@@ -125,6 +125,7 @@ def download_file(url):
     Returns:
         ``None``
     """
+    # See the .service file for the WorkingDirectory.
     local_filename = url.split('/')[-1]
     with requests.get(url, stream=True) as r:
         r.raise_for_status()
@@ -305,6 +306,7 @@ def dmg_has_signature(filename):
 
 def main():
     while True:
+        filename = None
         try:
             file_to_sign = get_from_queue()
             if file_to_sign is None:
@@ -346,15 +348,21 @@ def main():
                             filename=filename,
                             url=file_to_sign['https-url']))
                     LOGGER.info("Signing complete.")
-
-                LOGGER.info(f"Removing {filename}")
-                os.remove(filename)
         except Exception as e:
             LOGGER.exception(f"Unexpected error signing file: {e}")
             post_to_slack(
                 SLACK_NOTIFICATION_FAILURE.format(
                     filename=file_to_sign['https-url'],
                     traceback=traceback.format_exc()))
+        finally:
+            # Always clean up the downloaded file, even if things failed.
+            # As of debian:trixie, /tmp is a separate filesystem with a hard
+            # upper limit. Cleaning up files as we go will help avoid running
+            # out of disk space.
+            if filename is not None:
+                LOGGER.info(f"Removing {filename}")
+                os.remove(filename)
+
         time.sleep(60)
 
 

codesigning/signing-worker/natcap-codesign.service

@@ -1,4 +1,4 @@
-# Systemd service for debian:bookworm for signing InVEST windows binaries.
+# Systemd service for debian:trixie for signing InVEST windows and mac binaries.
 #
 # To install this service, copy this onto the host as /etc/systemd/system/natcap-codesign.service
 #
@@ -32,6 +32,8 @@ After=network.target
 Type=simple
 Restart=always
 ExecStart=python3 /opt/natcap-codesign/natcap-codesign.py /opt/natcap-codesign/codesign-cert-chain.pem
-User=natcap-codesign
+# At least as of debian:trixie, must be run as root to be able to acess the
+# installed yubikey.
+User=root
 Group=natcap-codesign
 WorkingDirectory=/tmp

codesigning/signing-worker/playbook.yml

@@ -46,6 +46,10 @@
           - logwatch
           - fwlogwatch
           - sendmail
+          - pcscd
+          - pcsc-tools
+          - libpcsclite1
+          - libu2f-udev
 
     - name: Configure logwatch
       ansible.builtin.copy:

src/natcap/invest/carbon/reporter.py

@@ -201,7 +201,7 @@ def report(file_registry: dict, args_dict: dict, model_spec: ModelSpec,
     ]
 
     input_raster_stats_table = raster_utils.raster_inputs_summary(
-        args_dict).to_html(na_rep='')
+        args_dict, model_spec).to_html(na_rep='')
 
     output_raster_stats_table = raster_utils.raster_workspace_summary(
         file_registry).to_html(na_rep='')