Add static analysis workflow

.github/workflows/static_analysis.yml

@@ -0,0 +1,63 @@
+# Workflow to perform static analysis on the project
+name: Static analysis
+
+# Controls when the workflow will run
+on:
+  # Triggers the workflow on pushes to the "main" branch, i.e., PR merges
+  push:
+    branches: [ "main" ]
+
+  # Triggers the workflow on pushes to open pull requests to main with documentation changes
+  pull_request:
+    paths:
+      - '.github/workflows/*.yml'
+      - '**/*.jinja'
+      - 'requirements-dev.txt'
+
+  # Allows you to run this workflow manually from the Actions tab
+  workflow_dispatch:
+
+# Helps prevent parallel runs of the workflow from overlapping
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
+# Write permissions are not needed for this workflow
+permissions: {}
+
+# Workflow run - one or more jobs that can run sequentially or in parallel
+jobs:
+  # Run static analysis tools
+  static-analysis:
+    name: static analysis
+    # The type of runner that the job will run on
+    runs-on: ubuntu-latest
+    # The timeout minutes for the job to complete
+    timeout-minutes: 5
+
+    # Steps represent a sequence of tasks that will be executed as part of the job
+    steps:
+      - name: Checkout code
+        with:
+          persist-credentials: false
+        uses: actions/checkout@v4
+
+      - name: Jinja linting with djlint
+        run: |
+          pip install -r requirements-dev.txt
+          djlint template/.github/workflows/*.yml.jinja
+
+  # Apply GitHub Actions linter, zizmor
+  zizmor:
+    name: zizmor
+    runs-on: ubuntu-latest
+    permissions:
+      security-events: write # Trusted with write permissions
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
+        with:
+          persist-credentials: false
+
+      - name: Run zizmor
+        uses: zizmorcore/zizmor-action@e673c3917a1aef3c65c972347ed84ccd013ecda4 # v0.2.0

copier.yml

@@ -33,6 +33,7 @@ requirements_file_paths:
     A YAML list of requirements file patterns including the file extension.
     Example:
       - 'requirements.txt'
+      - 'requirements-dev.txt'
 
 build_docs_timeout:
   type: int

requirements-dev.txt

@@ -0,0 +1 @@
+djlint

requirements.txt

@@ -0,0 +1 @@
+copier

template/.github/workflows/build_docs.yml.jinja

@@ -9,7 +9,6 @@ on:
 
   # Triggers the workflow on pushes to open pull requests to main with documentation changes
   pull_request:
-    branches: [ "main" ]
     paths:
       - '.github/workflows/build_docs.yml'{% for trigger in docs_file_paths %}
       - '{{ trigger | safe }}'{% endfor %}
@@ -37,6 +36,12 @@ jobs:
 
     # Steps represent a sequence of tasks that will be executed as part of the job
     steps:
+      # Checkout your repository under $GITHUB_WORKSPACE so your job can access it
+      - name: Checkout code
+        with:
+          persist-credentials: false
+        uses: actions/checkout@v4
+
       {%- if carbon_aware -%}
       {% raw %}
       - name: Start Measurement
@@ -87,6 +92,12 @@ jobs:
 
     # Steps represent a sequence of tasks that will be executed as part of the job
     steps:
+      # Checkout your repository under $GITHUB_WORKSPACE so your job can access it
+      - name: Checkout code
+        with:
+          persist-credentials: false
+        uses: actions/checkout@v4
+
       {%- if carbon_aware -%}
       {% raw %}
       - name: Start Measurement

template/.github/workflows/render_joss_paper.yml.jinja

@@ -9,7 +9,6 @@ on:
 
   # Triggers the workflow on pushes to open pull requests to main with documentation changes
   pull_request:
-    branches: [ "main" ]
     paths:
       - '.github/workflows/render_joss_paper.yml'
       - 'paper/*'
@@ -31,7 +30,7 @@ jobs:
     timeout-minutes: {{ joss_render_timeout }}
 
     steps:
-      # Checks-out your repository under $GITHUB_WORKSPACE, so your job can access it
+      # Checkout your repository under $GITHUB_WORKSPACE so your job can access it
       - name: Checkout
         uses: actions/checkout@v4
         with:

template/.github/workflows/static_analysis.yml.jinja

@@ -9,9 +9,9 @@ on:
 
   # Triggers the workflow on pushes to open pull requests to main with documentation changes
   pull_request:
-    branches: [ "main" ]
     paths:
       - '.github/workflows/*.yml'{% for trigger in source_file_paths %}
+      - '{{ trigger | safe }}'{% endfor %}{% for trigger in requirements_file_paths %}
       - '{{ trigger | safe }}'{% endfor %}
 
   # Allows you to run this workflow manually from the Actions tab
@@ -37,6 +37,12 @@ jobs:
 
     # Steps represent a sequence of tasks that will be executed as part of the job
     steps:
+      # Checkout your repository under $GITHUB_WORKSPACE so your job can access it
+      - name: Checkout code
+        with:
+          persist-credentials: false
+        uses: actions/checkout@v4
+
       {%- if carbon_aware -%}
       {% raw %}
       - name: Start Measurement

template/.github/workflows/test_suite.yml.jinja

@@ -9,7 +9,6 @@ on:
 
   # Triggers the workflow on pushes to open pull requests to main with documentation changes
   pull_request:
-    branches: [ "main" ]
     paths:
       - '.github/workflows/test_suite.yml'{% for trigger in source_file_paths %}
       - '{{ trigger | safe }}'{% endfor %}{% for trigger in build_sys_file_paths %}
@@ -39,6 +38,12 @@ jobs:
 
     # Steps represent a sequence of tasks that will be executed as part of the job
     steps:
+      # Checkout your repository under $GITHUB_WORKSPACE so your job can access it
+      - name: Checkout code
+        with:
+          persist-credentials: false
+        uses: actions/checkout@v4
+
       {%- if carbon_aware -%}
       {% raw %}
       - name: Start Measurement