Update GA workflows

.github/workflows/checks.yaml

@@ -18,6 +18,9 @@ concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}
   cancel-in-progress: true
 
+permissions:
+  contents: read # for actions/checkout
+
 jobs:
   checks:
     runs-on: "ubuntu-24.04"
@@ -27,16 +30,18 @@ jobs:
       VENV_PATH: '.venv'
 
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        with:
+          persist-credentials: false
 
       - name: Setup uv
-        uses: astral-sh/setup-uv@v7
+        uses: astral-sh/setup-uv@11f9893b081a58869d3b5fccaea48c9e9e46f990 # v8.3.2
         with:
           python-version: ${{ env.UV_PYTHON }}
           enable-cache: true
 
       - name: Cache uv venv
-        uses: actions/cache@v4
+        uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.5
         with:
           path: ${{ env.VENV_PATH }}
           key: ${{ runner.os }}-${{ hashFiles('uv.lock') }}

.github/workflows/cla-check.yaml

@@ -1,21 +1,27 @@
-# ------------------------------------------------------------------------------
-#  (c) Crown copyright Met Office. All rights reserved.
-#  The file LICENCE, distributed with this code, contains details of the terms
-#  under which the code may be used.
-# ------------------------------------------------------------------------------
-# Check Contributor License Agreement
-# This check is excluded files in source/rose_picker/rose/ directory as these
-# are third-party code and not covered by the Momentum-CA.
+# -----------------------------------------------------------------------------
+# (C) Crown copyright Met Office. All rights reserved.
+# The file LICENCE, distributed with this code, contains details of the terms
+# under which the code may be used.
+# -----------------------------------------------------------------------------
+
+# Check Contributor Licence Agreement
 
 name: Legal
 
 on:
   pull_request_target:
-    paths-ignore:
-      - "source/rose_picker/rose/**"
+
+concurrency:
+  # Automatically cancels the workflow run instantly before the
+  # engine can parse empty jobs and generate notification emails
+  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.sha }}
+  cancel-in-progress: ${{ github.event.pull_request.head.repo.full_name != 'MetOffice/rose_picker' }}
+
+permissions: {}
 
 jobs:
   cla:
-    uses: MetOffice/growss/.github/workflows/cla-check.yaml@main
-    with:
-      runner: "ubuntu-24.04"
+    permissions:
+      contents: read  # Required to evaluate the event trigger metadata safely
+      pull-requests: write  # Required for the downstream engine to post status comments on the PR
+    uses: MetOffice/growss/.github/workflows/cla-check.yaml@0f9ffe6a138ae9943053621916a850a075997db8 # v1.0.0

.github/workflows/track-review-project.yaml

@@ -0,0 +1,26 @@
+# -----------------------------------------------------------------------------
+# (C) Crown copyright Met Office. All rights reserved.
+# The file LICENCE, distributed with this code, contains details of the terms
+# under which the code may be used.
+# -----------------------------------------------------------------------------
+
+name: Track Review Project
+
+on:
+  workflow_run:
+    workflows: [Trigger Review Project]
+    types:
+      - completed
+
+permissions:
+  contents: read  # Required to evaluate the event trigger metadata safely
+
+jobs:
+  track_review_project:
+    permissions:
+      actions: read  # Required to check out code or parse files safely
+      contents: read  # Required to read the upstream triggered workflow run artifact status
+      pull-requests: write  # Required for the downstream engine to add comments or update metadata on the PR
+    uses: MetOffice/growss/.github/workflows/track-review-project.yaml@0f9ffe6a138ae9943053621916a850a075997db8 # v1.0.0
+    secrets:
+      PROJECT_ACTION_PAT: ${{ secrets.PROJECT_ACTION_PAT }}

.github/workflows/trigger-project-workflow.yaml

@@ -0,0 +1,26 @@
+# -----------------------------------------------------------------------------
+# (C) Crown copyright Met Office. All rights reserved.
+# The file LICENCE, distributed with this code, contains details of the terms
+# under which the code may be used.
+# -----------------------------------------------------------------------------
+
+name: Trigger Review Project
+
+on:
+  pull_request_target:
+    types: ["opened", "synchronize", "reopened", "edited", "review_requested", "review_request_removed", "closed"]
+  pull_request_review:
+  pull_request_review_comment:
+
+permissions:
+  contents: read  # Required to evaluate the event trigger metadata safely
+
+jobs:
+  trigger_project_workflow:
+    if: github.repository == 'MetOffice/rose_picker'
+
+    permissions:
+      actions: read  # Required to check out code or parse files safely
+      contents: read  # Required to read the upstream triggered workflow run artifact status
+      pull-requests: write  # Required for the downstream engine to add comments or update metadata on the PR
+    uses: MetOffice/growss/.github/workflows/trigger-project-workflow.yaml@0f9ffe6a138ae9943053621916a850a075997db8 # v1.0.0

.github/zizmor.yml

@@ -0,0 +1,15 @@
+# ------------------------------------------------------------------------------
+# (c) Crown copyright Met Office. All rights reserved.
+# The file LICENCE, distributed with this code, contains details of the terms
+# under which the code may be used.
+# ------------------------------------------------------------------------------
+
+# Rules for Zizmor GitHub workflow linter. This file is used to configure which
+# rules to ignore for specific workflow files, allowing for exceptions to be
+# made where necessary while still enforcing best practices across the codebase.
+rules:
+  dangerous-triggers:
+    ignore:
+      - "cla-check.yaml"
+      - "track-review-project.yaml"
+      - "trigger-project-workflow.yaml"