Merge branch 'main' into alias-system

Author: seisman

.github/workflows/benchmarks.yml

@@ -23,6 +23,8 @@ concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}
   cancel-in-progress: ${{ github.ref != 'refs/heads/main' }}
 
+permissions: {}
+
 jobs:
   benchmarks:
     runs-on: ubuntu-latest
@@ -38,6 +40,7 @@ jobs:
         with:
           # fetch all history so that setuptools-scm works
           fetch-depth: 0
+          persist-credentials: false
 
       - name: Get current week number of year
         id: date
@@ -82,7 +85,7 @@ jobs:
 
       # Run the benchmark tests
       - name: Run benchmarks
-        uses: CodSpeedHQ/action@v3.4.0
+        uses: CodSpeedHQ/action@v3.5.0
         with:
           # 'bash -el -c' is needed to use the custom shell.
           # See https://github.com/CodSpeedHQ/action/issues/65.

.github/workflows/cache_data.yaml

@@ -25,6 +25,8 @@ on:
   schedule:
     - cron: '0 12 * * 0'
 
+permissions: {}
+
 jobs:
   gmt_cache:
     name: Cache GMT artifacts
@@ -40,6 +42,7 @@ jobs:
         with:
           # fetch all history so that setuptools-scm works
           fetch-depth: 0
+          persist-credentials: false
 
       # Install Micromamba with conda-forge dependencies
       - name: Setup Micromamba

.github/workflows/check-links.yml

@@ -15,6 +15,9 @@ on:
   schedule:
     - cron: '0 12 * * 0'
 
+permissions:
+  issues: write
+
 jobs:
   check_links:
     name: Check Links
@@ -26,12 +29,14 @@ jobs:
       uses: actions/checkout@v4.2.2
       with:
         path: repository
+        persist-credentials: false
 
     - name: Checkout the documentation
       uses: actions/checkout@v4.2.2
       with:
         ref: gh-pages
         path: documentation
+        persist-credentials: false
 
     - name: Link Checker
       id: lychee
@@ -45,11 +50,14 @@ jobs:
           --exclude "^https://docs.generic-mapping-tools.org/6.[0-9]?/%s$"
           --exclude "^https://docs.generic-mapping-tools.org/6.[0-9]?/%3Cmodule-name%3E.html$"
           --exclude "^https://doi.org"
+          --exclude "^https://github.com/%7Brepository%7D"
           --exclude "^https://github.com/GenericMappingTools/gmt/releases/tag/X.Y.Z$"
           --exclude "^https://github.com/GenericMappingTools/pygmt/edit"
           --exclude "^https://github.com/GenericMappingTools/pygmt/issues/new"
           --exclude "^https://github.com/GenericMappingTools/pygmt/pull/[0-9]*$"
           --exclude "^https://github.com/GenericMappingTools/pygmt/issues/[0-9]*$"
+          --exclude "^https://github.com/GenericMappingTools/pygmt/releases/download/%7B%7Bpath%7D%7D/pygmt-docs.pdf"
+          --exclude "^https://github.com/GenericMappingTools/pygmt/releases/download/%7B%7Bpath%7D%7D/pygmt-docs.zip"
           --exclude "^https://github.com/GenericMappingTools/pygmt/releases/tag/%7B%7Bpath%7D%7D"
           --exclude "^https://hackmd.io/@pygmt"
           --exclude "^https://test.pypi.org/simple/"
@@ -58,6 +66,8 @@ jobs:
           --exclude "^https://www.pygmt.org/%7B%7Bpath%7D%7D"
           --exclude "^https://www.researchgate.net/"
           --exclude "^https://zenodo.org/badge/DOI/"
+          --exclude-path "repository/doc/**/*.rst"
+          --exclude-path "repository/doc/**/*.md"
           --verbose
           "repository/**/*.rst"
           "repository/**/*.md"
@@ -69,10 +79,11 @@ jobs:
       run: echo "date=$(date +'%Y-%m-%d')" >> $GITHUB_OUTPUT
 
     - name: Create Issue From File
-      if: env.lychee_exit_code != 0
+      if: ${{ steps.lychee.outputs.exit_code }} != 0
       run: |
         cd repository/
-        title="Link Checker Report on ${{ steps.date.outputs.date }}"
+        title="Link Checker Report on ${CURRENT_DATE}"
         gh issue create --title "$title" --body-file /tmp/lychee-out.md
       env:
         GH_TOKEN: ${{ github.token }}
+        CURRENT_DATE: ${{ steps.date.outputs.date }}

.github/workflows/ci_docs.yml

@@ -2,15 +2,14 @@
 #
 # This workflow builds the documentation on Linux/macOS/Windows.
 #
-# It is run on every commit to the main and pull request branches, and also
-# when a new release is published.
-# In draft pull requests, only the job on Linux is triggered to save on
-# Continuous Integration resources.
+# It is run on every commit to the main and pull request branches, and also when a new
+# release is published. In draft pull requests, only the job on Linux is triggered to
+# save on Continuous Integration resources.
 #
 # On the main branch, the workflow also handles the documentation deployment:
 #
-# * Updating the development documentation by pushing the built HTML pages
-#   from the main branch onto the dev folder of the gh-pages branch.
+# * Updating the development documentation by pushing the built HTML pages from the main
+#   branch onto the dev folder of the gh-pages branch.
 # * Updating the latest documentation link to the new release.
 #
 name: Docs
@@ -43,6 +42,9 @@ concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}
   cancel-in-progress: ${{ github.ref != 'refs/heads/main' }}
 
+permissions:
+  contents: write
+
 jobs:
   docs:
     name: ${{ matrix.os }}
@@ -73,6 +75,7 @@ jobs:
         with:
           # fetch all history so that setuptools-scm works
           fetch-depth: 0
+          persist-credentials: false
 
       - name: Get current week number of year
         id: date
@@ -159,10 +162,11 @@ jobs:
         if: github.event_name == 'push' && matrix.os == 'ubuntu-latest'
 
       - name: Upload the HTML ZIP archive and PDF as release assets
-        run: gh release upload ${{ github.ref_name }} doc/_build/pygmt-docs.zip doc/_build/pygmt-docs.pdf
+        run: gh release upload ${REF_NAME} doc/_build/pygmt-docs.zip doc/_build/pygmt-docs.pdf
         if: github.event_name == 'release' && matrix.os == 'ubuntu-latest'
         env:
           GH_TOKEN: ${{ github.token }}
+          REF_NAME: ${{ github.ref_name }}
 
       - name: Checkout the gh-pages branch
         uses: actions/checkout@v4.2.2
@@ -172,6 +176,7 @@ jobs:
           path: deploy
           # Download the entire history
           fetch-depth: 0
+          persist-credentials: true
         if: (github.event_name == 'release' || github.event_name == 'push') && (matrix.os == 'ubuntu-latest')
 
       - name: Push the built HTML to gh-pages

.github/workflows/ci_doctests.yaml

@@ -18,6 +18,8 @@ concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}
   cancel-in-progress: ${{ github.ref != 'refs/heads/main' }}
 
+permissions: {}
+
 jobs:
   test:
     name: ${{ matrix.os }}
@@ -39,6 +41,7 @@ jobs:
         with:
           # fetch all history so that setuptools-scm works
           fetch-depth: 0
+          persist-credentials: false
 
       # Install Micromamba with conda-forge dependencies
       - name: Setup Micromamba

.github/workflows/ci_tests.yaml

@@ -108,6 +108,7 @@ jobs:
         with:
           # fetch all history so that setuptools-scm works
           fetch-depth: 0
+          persist-credentials: false
 
       - name: Get current week number of year
         id: date
@@ -151,7 +152,7 @@ jobs:
           GH_TOKEN: ${{ github.token }}
 
       - name: Install uv
-        uses: astral-sh/setup-uv@v5.3.1
+        uses: astral-sh/setup-uv@v5.4.0
         with:
           python-version: ${{ matrix.python-version }}
 

.github/workflows/ci_tests_dev.yaml

@@ -28,6 +28,8 @@ concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}
   cancel-in-progress: ${{ github.ref != 'refs/heads/main' }}
 
+permissions: {}
+
 jobs:
   test_gmt_dev:
     name: ${{ matrix.os }} - GMT ${{ matrix.gmt_git_ref }}
@@ -50,6 +52,7 @@ jobs:
         with:
           # fetch all history so that setuptools-scm works
           fetch-depth: 0
+          persist-credentials: false
 
       - name: Get current week number of year
         id: date
@@ -96,6 +99,7 @@ jobs:
           repository: 'GenericMappingTools/gmt'
           ref: ${{ matrix.gmt_git_ref }}
           path: 'gmt'
+          persist-credentials: false
 
       # Build GMT from source on Linux/macOS, script is adapted from
       # https://github.com/GenericMappingTools/gmt/blob/6.5.0/ci/build-gmt.sh
@@ -105,7 +109,7 @@ jobs:
           mkdir build
           cd build
           cmake -G Ninja .. \
-            -DCMAKE_INSTALL_PREFIX=${{ env.GMT_INSTALL_DIR }} \
+            -DCMAKE_INSTALL_PREFIX=${GMT_INSTALL_DIR} \
             -DCMAKE_BUILD_TYPE=Release \
             -DGMT_ENABLE_OPENMP=TRUE \
             -DGMT_USE_THREADS=TRUE
@@ -125,7 +129,7 @@ jobs:
           cd build
           call "C:\Program Files\Microsoft Visual Studio\2022\Enterprise\VC\Auxiliary\Build\vcvars64.bat"
           cmake -G Ninja .. ^
-            -DCMAKE_INSTALL_PREFIX=${{ env.GMT_INSTALL_DIR }} ^
+            -DCMAKE_INSTALL_PREFIX=%GMT_INSTALL_DIR% ^
             -DCMAKE_BUILD_TYPE=Release ^
             -DCMAKE_PREFIX_PATH=${{ env.MAMBA_ROOT_PREFIX }}\envs\pygmt\Library ^
             -DGMT_ENABLE_OPENMP=TRUE ^

.github/workflows/ci_tests_legacy.yaml

@@ -26,6 +26,8 @@ concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}
   cancel-in-progress: ${{ github.ref != 'refs/heads/main' }}
 
+permissions: {}
+
 jobs:
   test:
     name: ${{ matrix.os }} - GMT ${{ matrix.gmt_version }}
@@ -48,6 +50,7 @@ jobs:
         with:
           # fetch all history so that setuptools-scm works
           fetch-depth: 0
+          persist-credentials: false
 
       # Install Micromamba with conda-forge dependencies
       - name: Setup Micromamba

.github/workflows/dvc-diff.yml

@@ -14,6 +14,8 @@ on:
     paths:
       - 'pygmt/tests/baseline/*.png.dvc'
 
+permissions: {}
+
 jobs:
   dvc-diff:
     name: DVC image diff
@@ -25,6 +27,7 @@ jobs:
       with:
         # fetch all history so that dvc diff works
         fetch-depth: 0
+        persist-credentials: false
 
     - name: Setup data version control (DVC)
       uses: iterative/setup-dvc@v1.1.2
@@ -53,6 +56,7 @@ jobs:
     - name: Generate the image diff report
       env:
         repo_token: ${{ github.token }}
+        PR_HEAD_SHA: ${{ github.event.pull_request.head.sha }}
       run: |
         echo -e "## Summary of changed images\n" > report.md
         echo -e "This is an auto-generated report of images that have changed on the DVC remote\n" >> report.md
@@ -94,7 +98,7 @@ jobs:
         echo -e "</details>\n" >> report.md
 
         # Mention git commit SHA in the report
-        echo -e "Report last updated at commit ${{ github.event.pull_request.head.sha }}" >> report.md
+        echo -e "Report last updated at commit ${PR_HEAD_SHA}" >> report.md
 
         # create/update PR comment
         cml comment update report.md

.github/workflows/format-command.yml

@@ -3,9 +3,14 @@
 # This workflow is triggered in a PR if the slash command `/format` is used.
 #
 name: format-command
+
 on:
   repository_dispatch:
     types: [format-command]
+
+permissions:
+  contents: write
+
 jobs:
   format:
     runs-on: ubuntu-latest
@@ -23,9 +28,10 @@ jobs:
           token: ${{ steps.generate-token.outputs.token }}
           repository: ${{ github.event.client_payload.pull_request.head.repo.full_name }}
           ref: ${{ github.event.client_payload.pull_request.head.ref }}
+          persist-credentials: false
 
       # Setup Python environment
-      - uses: actions/setup-python@v5.4.0
+      - uses: actions/setup-python@v5.5.0
         with:
           python-version: '3.13'