From 16cc622e499835b11963a7c07d7c03423ce51439 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?S=C3=A9bastien=20Hensgen?= <24550538+sebhmg@users.noreply.github.com> Date: Tue, 9 Jun 2026 16:27:14 -0400 Subject: [PATCH 1/7] move recipe under dedicated folder --- .github/workflows/python_deploy_dev.yml | 5 +++-- .github/workflows/python_deploy_prod.yml | 4 ++-- recipe.yaml => conda.recipe/recipe.yaml | 2 +- 3 files changed, 6 insertions(+), 5 deletions(-) rename recipe.yaml => conda.recipe/recipe.yaml (99%) diff --git a/.github/workflows/python_deploy_dev.yml b/.github/workflows/python_deploy_dev.yml index 93b2f4a3..a595ba63 100644 --- a/.github/workflows/python_deploy_dev.yml +++ b/.github/workflows/python_deploy_dev.yml @@ -15,13 +15,14 @@ jobs: call-workflow-conda-publish: name: Publish development conda package on JFrog Artifactory if: github.repository == 'MiraGeoscience/gempy_engine' - uses: MiraGeoscience/CI-tools/.github/workflows/reusable-python-publish_rattler_package.yml@v3 + uses: MiraGeoscience/CI-tools/.github/workflows/reusable-python-publish_rattler_package.yml@v3.6.0-alpha.1 permissions: id-token: write contents: write with: package-name: 'gempy-engine' python-version: '3.12' + recipe-path: conda.recipe/recipe.yaml source-repo-names: '["public-noremote-conda-dev"]' conda-channels: '["conda-forge"]' publish-repo-names: '["public-noremote-conda-dev"]' @@ -32,7 +33,7 @@ jobs: call-workflow-pypi-publish: name: Publish development pypi package (JFrog Artifactory) if: github.repository == 'MiraGeoscience/gempy_engine' - uses: MiraGeoscience/CI-tools/.github/workflows/reusable-python-publish_pypi_package.yml@v3 + uses: MiraGeoscience/CI-tools/.github/workflows/reusable-python-publish_pypi_package.yml@v3.6.0-alpha.1 permissions: id-token: write contents: write diff --git a/.github/workflows/python_deploy_prod.yml b/.github/workflows/python_deploy_prod.yml index d44b1d6c..43215854 100644 --- a/.github/workflows/python_deploy_prod.yml +++ b/.github/workflows/python_deploy_prod.yml @@ -31,7 +31,7 @@ jobs: if: | github.repository == 'MiraGeoscience/gempy_engine' && (github.event_name == 'release' || github.event.inputs.publish-conda == 'true') - uses: MiraGeoscience/CI-tools/.github/workflows/reusable-python-release_conda_assets.yml@v3 + uses: MiraGeoscience/CI-tools/.github/workflows/reusable-python-release_conda_assets.yml@v3.6.0-alpha.1 permissions: id-token: write contents: write @@ -46,7 +46,7 @@ jobs: if: | github.repository == 'MiraGeoscience/gempy_engine' && (github.event_name == 'release' || github.event.inputs.publish-pypi == 'true') - uses: MiraGeoscience/CI-tools/.github/workflows/reusable-python-release_pypi_assets.yml@v3 + uses: MiraGeoscience/CI-tools/.github/workflows/reusable-python-release_pypi_assets.yml@v3.6.0-alpha.1 permissions: id-token: write contents: write diff --git a/recipe.yaml b/conda.recipe/recipe.yaml similarity index 99% rename from recipe.yaml rename to conda.recipe/recipe.yaml index f23eb61a..402f1ba2 100644 --- a/recipe.yaml +++ b/conda.recipe/recipe.yaml @@ -12,7 +12,7 @@ package: source: # url: https://pypi.org/packages/source/${{ name[0] }}/${{ name }}/gempy_engine-${{ version }}.tar.gz # sha256: - path: . + path: .. build: number: 0 From 91aeff9ab97a88e9c72444d494b13494f27aeefe Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?S=C3=A9bastien=20Hensgen?= <24550538+sebhmg@users.noreply.github.com> Date: Tue, 9 Jun 2026 21:16:55 -0400 Subject: [PATCH 2/7] remove unnecessary quotes in yaml --- .github/workflows/python_deploy_dev.yml | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/.github/workflows/python_deploy_dev.yml b/.github/workflows/python_deploy_dev.yml index a595ba63..c22c03cd 100644 --- a/.github/workflows/python_deploy_dev.yml +++ b/.github/workflows/python_deploy_dev.yml @@ -20,7 +20,7 @@ jobs: id-token: write contents: write with: - package-name: 'gempy-engine' + package-name: gempy-engine python-version: '3.12' recipe-path: conda.recipe/recipe.yaml source-repo-names: '["public-noremote-conda-dev"]' @@ -38,8 +38,8 @@ jobs: id-token: write contents: write with: - package-manager: 'setuptools' - package-name: 'gempy-engine' + package-manager: setuptools + package-name: gempy-engine version-tag: ${{ github.ref_name }} python-version: '3.12' virtual-repo-names: '["public-pypi-dev"]' From 2ff7986b89bf6e6b684300625a831137b50c2c04 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?S=C3=A9bastien=20Hensgen?= <24550538+sebhmg@users.noreply.github.com> Date: Tue, 9 Jun 2026 22:34:15 -0400 Subject: [PATCH 3/7] publish to dedicated repo --- .github/workflows/python_deploy_dev.yml | 6 +++--- .github/workflows/python_deploy_prod.yml | 4 ++-- 2 files changed, 5 insertions(+), 5 deletions(-) diff --git a/.github/workflows/python_deploy_dev.yml b/.github/workflows/python_deploy_dev.yml index c22c03cd..de293d4f 100644 --- a/.github/workflows/python_deploy_dev.yml +++ b/.github/workflows/python_deploy_dev.yml @@ -23,9 +23,9 @@ jobs: package-name: gempy-engine python-version: '3.12' recipe-path: conda.recipe/recipe.yaml - source-repo-names: '["public-noremote-conda-dev"]' + source-repo-names: '["gempy-noremote-conda-dev"]' conda-channels: '["conda-forge"]' - publish-repo-names: '["public-noremote-conda-dev"]' + publish-repo-names: '["gempy-noremote-conda-dev"]' build-experimental: true secrets: JFROG_ARTIFACTORY_URL: ${{ secrets.JFROG_ARTIFACTORY_URL }} @@ -42,7 +42,7 @@ jobs: package-name: gempy-engine version-tag: ${{ github.ref_name }} python-version: '3.12' - virtual-repo-names: '["public-pypi-dev"]' + virtual-repo-names: '["gempy-pypi-dev"]' secrets: JFROG_ARTIFACTORY_URL: ${{ secrets.JFROG_ARTIFACTORY_URL }} JFROG_ARTIFACTORY_TOKEN: ${{ secrets.JFROG_ARTIFACTORY_TOKEN }} diff --git a/.github/workflows/python_deploy_prod.yml b/.github/workflows/python_deploy_prod.yml index 43215854..7179fae7 100644 --- a/.github/workflows/python_deploy_prod.yml +++ b/.github/workflows/python_deploy_prod.yml @@ -36,7 +36,7 @@ jobs: id-token: write contents: write with: - virtual-repo-names: '["public-noremote-conda-prod"]' + virtual-repo-names: '["gempy-noremote-conda-prod"]' release-tag: ${{ github.event.release.tag_name || github.event.inputs.release-tag }} secrets: JFROG_ARTIFACTORY_URL: ${{ secrets.JFROG_ARTIFACTORY_URL }} @@ -52,7 +52,7 @@ jobs: contents: write with: package-name: 'gempy-engine' - virtual-repo-names: '["public-pypi-prod"]' + virtual-repo-names: '["gempy-pypi-prod"]' release-tag: ${{ github.event.release.tag_name || github.event.inputs.release-tag }} secrets: JFROG_ARTIFACTORY_URL: ${{ secrets.JFROG_ARTIFACTORY_URL }} From 544641db576ff409bb32a60961a6c2c1eed91438 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?S=C3=A9bastien=20Hensgen?= <24550538+sebhmg@users.noreply.github.com> Date: Tue, 9 Jun 2026 22:42:58 -0400 Subject: [PATCH 4/7] try update CI-tools --- .github/workflows/python_deploy_dev.yml | 4 ++-- .github/workflows/python_deploy_prod.yml | 4 ++-- 2 files changed, 4 insertions(+), 4 deletions(-) diff --git a/.github/workflows/python_deploy_dev.yml b/.github/workflows/python_deploy_dev.yml index de293d4f..72ebd057 100644 --- a/.github/workflows/python_deploy_dev.yml +++ b/.github/workflows/python_deploy_dev.yml @@ -15,7 +15,7 @@ jobs: call-workflow-conda-publish: name: Publish development conda package on JFrog Artifactory if: github.repository == 'MiraGeoscience/gempy_engine' - uses: MiraGeoscience/CI-tools/.github/workflows/reusable-python-publish_rattler_package.yml@v3.6.0-alpha.1 + uses: MiraGeoscience/CI-tools/.github/workflows/reusable-python-publish_rattler_package.yml@v3.6.0-alpha.2 permissions: id-token: write contents: write @@ -33,7 +33,7 @@ jobs: call-workflow-pypi-publish: name: Publish development pypi package (JFrog Artifactory) if: github.repository == 'MiraGeoscience/gempy_engine' - uses: MiraGeoscience/CI-tools/.github/workflows/reusable-python-publish_pypi_package.yml@v3.6.0-alpha.1 + uses: MiraGeoscience/CI-tools/.github/workflows/reusable-python-publish_pypi_package.yml@v3.6.0-alpha.2 permissions: id-token: write contents: write diff --git a/.github/workflows/python_deploy_prod.yml b/.github/workflows/python_deploy_prod.yml index 7179fae7..279a0362 100644 --- a/.github/workflows/python_deploy_prod.yml +++ b/.github/workflows/python_deploy_prod.yml @@ -31,7 +31,7 @@ jobs: if: | github.repository == 'MiraGeoscience/gempy_engine' && (github.event_name == 'release' || github.event.inputs.publish-conda == 'true') - uses: MiraGeoscience/CI-tools/.github/workflows/reusable-python-release_conda_assets.yml@v3.6.0-alpha.1 + uses: MiraGeoscience/CI-tools/.github/workflows/reusable-python-release_conda_assets.yml@v3.6.0-alpha.2 permissions: id-token: write contents: write @@ -46,7 +46,7 @@ jobs: if: | github.repository == 'MiraGeoscience/gempy_engine' && (github.event_name == 'release' || github.event.inputs.publish-pypi == 'true') - uses: MiraGeoscience/CI-tools/.github/workflows/reusable-python-release_pypi_assets.yml@v3.6.0-alpha.1 + uses: MiraGeoscience/CI-tools/.github/workflows/reusable-python-release_pypi_assets.yml@v3.6.0-alpha.2 permissions: id-token: write contents: write From 72d797e1302c0141a8248c755d53c85f67b999a5 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?S=C3=A9bastien=20Hensgen?= <24550538+sebhmg@users.noreply.github.com> Date: Tue, 9 Jun 2026 22:46:53 -0400 Subject: [PATCH 5/7] no need for Conda source repos here --- .github/workflows/python_deploy_dev.yml | 1 - 1 file changed, 1 deletion(-) diff --git a/.github/workflows/python_deploy_dev.yml b/.github/workflows/python_deploy_dev.yml index 72ebd057..b494e5e3 100644 --- a/.github/workflows/python_deploy_dev.yml +++ b/.github/workflows/python_deploy_dev.yml @@ -23,7 +23,6 @@ jobs: package-name: gempy-engine python-version: '3.12' recipe-path: conda.recipe/recipe.yaml - source-repo-names: '["gempy-noremote-conda-dev"]' conda-channels: '["conda-forge"]' publish-repo-names: '["gempy-noremote-conda-dev"]' build-experimental: true From ee37f1091e6217bb51a40de60e1bc3833a4c6594 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?S=C3=A9bastien=20Hensgen?= <24550538+sebhmg@users.noreply.github.com> Date: Wed, 10 Jun 2026 00:15:57 -0400 Subject: [PATCH 6/7] CI-tools @v3 again --- .github/workflows/python_deploy_dev.yml | 4 ++-- .github/workflows/python_deploy_prod.yml | 4 ++-- 2 files changed, 4 insertions(+), 4 deletions(-) diff --git a/.github/workflows/python_deploy_dev.yml b/.github/workflows/python_deploy_dev.yml index b494e5e3..464468ed 100644 --- a/.github/workflows/python_deploy_dev.yml +++ b/.github/workflows/python_deploy_dev.yml @@ -15,7 +15,7 @@ jobs: call-workflow-conda-publish: name: Publish development conda package on JFrog Artifactory if: github.repository == 'MiraGeoscience/gempy_engine' - uses: MiraGeoscience/CI-tools/.github/workflows/reusable-python-publish_rattler_package.yml@v3.6.0-alpha.2 + uses: MiraGeoscience/CI-tools/.github/workflows/reusable-python-publish_rattler_package.yml@v3 permissions: id-token: write contents: write @@ -32,7 +32,7 @@ jobs: call-workflow-pypi-publish: name: Publish development pypi package (JFrog Artifactory) if: github.repository == 'MiraGeoscience/gempy_engine' - uses: MiraGeoscience/CI-tools/.github/workflows/reusable-python-publish_pypi_package.yml@v3.6.0-alpha.2 + uses: MiraGeoscience/CI-tools/.github/workflows/reusable-python-publish_pypi_package.yml@v3 permissions: id-token: write contents: write diff --git a/.github/workflows/python_deploy_prod.yml b/.github/workflows/python_deploy_prod.yml index 279a0362..ee30cb9a 100644 --- a/.github/workflows/python_deploy_prod.yml +++ b/.github/workflows/python_deploy_prod.yml @@ -31,7 +31,7 @@ jobs: if: | github.repository == 'MiraGeoscience/gempy_engine' && (github.event_name == 'release' || github.event.inputs.publish-conda == 'true') - uses: MiraGeoscience/CI-tools/.github/workflows/reusable-python-release_conda_assets.yml@v3.6.0-alpha.2 + uses: MiraGeoscience/CI-tools/.github/workflows/reusable-python-release_conda_assets.yml@v3 permissions: id-token: write contents: write @@ -46,7 +46,7 @@ jobs: if: | github.repository == 'MiraGeoscience/gempy_engine' && (github.event_name == 'release' || github.event.inputs.publish-pypi == 'true') - uses: MiraGeoscience/CI-tools/.github/workflows/reusable-python-release_pypi_assets.yml@v3.6.0-alpha.2 + uses: MiraGeoscience/CI-tools/.github/workflows/reusable-python-release_pypi_assets.yml@v3 permissions: id-token: write contents: write From f09318e88f32e421bb6a6b0e0501af761d30edc8 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?S=C3=A9bastien=20Hensgen?= <24550538+sebhmg@users.noreply.github.com> Date: Wed, 10 Jun 2026 00:24:29 -0400 Subject: [PATCH 7/7] add more github workflows --- .github/workflows/issue_to_jira.yml | 22 ++++++++++++++ .github/workflows/pr_jira_actions.yml | 19 ++++++++++++ .github/workflows/security_scan.yml | 44 +++++++++++++++++++++++++++ 3 files changed, 85 insertions(+) create mode 100644 .github/workflows/issue_to_jira.yml create mode 100644 .github/workflows/pr_jira_actions.yml create mode 100644 .github/workflows/security_scan.yml diff --git a/.github/workflows/issue_to_jira.yml b/.github/workflows/issue_to_jira.yml new file mode 100644 index 00000000..64350558 --- /dev/null +++ b/.github/workflows/issue_to_jira.yml @@ -0,0 +1,22 @@ +name: Create JIRA issue + +on: + issues: + types: [opened] + +permissions: {} + +jobs: + call-workflow-create-jira-issue: + if: startsWith(github.repository, 'MiraGeoscience/') # run on the Mira repo only + uses: MiraGeoscience/CI-tools/.github/workflows/reusable-jira-issue_to_jira.yml@v3 + permissions: + contents: read + issues: write + with: + project-key: 'GEOPY' + components: '[{"name": "gempy"}]' + secrets: + JIRA_BASE_URL: ${{ secrets.JIRA_BASE_URL }} + JIRA_API_TOKEN: ${{ secrets.JIRA_API_TOKEN }} + JIRA_USER_EMAIL: ${{ secrets.JIRA_USER_EMAIL }} diff --git a/.github/workflows/pr_jira_actions.yml b/.github/workflows/pr_jira_actions.yml new file mode 100644 index 00000000..65299b54 --- /dev/null +++ b/.github/workflows/pr_jira_actions.yml @@ -0,0 +1,19 @@ +name: JIRA actions + +on: + pull_request: + types: [opened, synchronize, reopened, ready_for_review, edited] + +jobs: + call-workflow-pr_jira_actions: + if: | # run on the Mira repo only + startsWith(github.repository, 'MiraGeoscience/') && + (github.event.action != 'edited' || github.event.changes.title != null) + uses: MiraGeoscience/CI-tools/.github/workflows/reusable-jira-pr_actions.yml@v3 + permissions: + contents: read + pull-requests: write + secrets: + JIRA_API_TOKEN: ${{ secrets.JIRA_API_TOKEN }} + JIRA_USER_EMAIL: ${{ secrets.JIRA_USER_EMAIL }} + JIRA_BASE_URL: ${{ secrets.JIRA_BASE_URL }} diff --git a/.github/workflows/security_scan.yml b/.github/workflows/security_scan.yml new file mode 100644 index 00000000..63317b8f --- /dev/null +++ b/.github/workflows/security_scan.yml @@ -0,0 +1,44 @@ +name: Security Scan + +on: + pull_request: + types: [opened, synchronize, reopened, ready_for_review] + branches: + - develop + - main + - release/** + - feature/** + - hotfix/** + push: + branches: + - develop + - main + - release/** + - feature/** + - hotfix/** + +permissions: {} + +concurrency: + group: ${{ github.workflow }}-${{ github.head_ref || github.run_id }} + cancel-in-progress: true + +jobs: + call-workflow-zizmor-annotate: + name: Zizmor analysis (advanced security) + # run on the Mira repo only + if: github.event_name != 'pull_request' + permissions: + security-events: write + contents: read + actions: read + uses: MiraGeoscience/CI-tools/.github/workflows/reusable-zizmor-advanced-security.yml@v3 + + call-workflow-zizmor-advanced-security: + name: Zizmor analysis (annotate) + if: github.event_name == 'pull_request' + permissions: + checks: write + contents: read + actions: read + uses: MiraGeoscience/CI-tools/.github/workflows/reusable-zizmor-annotate.yml@v3