From e680933da0855e866ca5e3f8c47682a3f7c99db5 Mon Sep 17 00:00:00 2001
From: Trevor James Smith <10819524+Zeitsperre@users.noreply.github.com>
Date: Mon, 29 Jun 2026 15:56:38 -0400
Subject: [PATCH 1/4] pin actions and python deps to commit hashes

Signed-off-by: Trevor James Smith <10819524+Zeitsperre@users.noreply.github.com>
---
 .github/workflows/main.yml |  72 ++++++++++++++-------
 CI/requirements_ci.in      |   2 +
 CI/requirements_ci.txt     | 127 +++++++++++++++++++++++++++++++++++++
 3 files changed, 177 insertions(+), 24 deletions(-)
 create mode 100644 CI/requirements_ci.in
 create mode 100644 CI/requirements_ci.txt

diff --git a/.github/workflows/main.yml b/.github/workflows/main.yml
index 472e27ad..2022faab 100644
--- a/.github/workflows/main.yml
+++ b/.github/workflows/main.yml
@@ -11,19 +11,26 @@ concurrency:
   group: "${{ github.workflow }}-${{ github.ref }}"
   cancel-in-progress: ${{ github.ref != 'refs/heads/main' }}
 
+permissions:
+  contents: read
+
 jobs:
   lint:
     name: Linting Suite
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v6
-      - uses: actions/setup-python@v6
+      - name: Checkout Repository
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        with:
+          persist-credentials: false
+      - name: Set up Python3.10
+        uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
         with:
           python-version: "3.10"
-          cache: 'pip'
-      - name: Install tox
+          cache: pip
+      - name: Install CI libraries
         run: |
-          pip install tox>=4.30.3
+          python -m pip install --require-hashes -r CI/requirements_ci.txt
       - name: Run linting suite ⚙️
         run: |
           tox -e lint
@@ -31,44 +38,56 @@ jobs:
   test:
     name: Testing with (Python${{ matrix.python-version }}, ${{ matrix.os }})
     needs: lint
-    runs-on: ${{ matrix.os }}-latest
+    runs-on: ${{ matrix.os }}
     strategy:
       matrix:
         python-version: [ "3.10", "3.11", "3.12", "3.13" ]
-        os: ["ubuntu"]
+        os: ["ubuntu-latest"]
         include:
           # - python-version: "3.11"
           #   os: "windows"
           - python-version: "3.11"
-            os: "macos"
+            os: "macos-latest"
     steps:
-      - uses: actions/checkout@v6
+      - name: Checkout Repository
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        with:
+          persist-credentials: false
+
       - name: Install packages 📦 (Linux)
-        if: ${{ matrix.os == 'ubuntu' }}
+        if: ${{ matrix.os == 'ubuntu-latest' }}
         run: |
           sudo apt-get update
           sudo apt-get -y install libnetcdf-dev libhdf5-dev
       - name: Install packages 📦 (macOS)
-        if: ${{ matrix.os == 'macos' }}
+        if: ${{ matrix.os == 'macos-latest' }}
         uses: tecolicom/actions-use-homebrew-tools@b9c066b79607fa3d71e0be05d7003bb75fd9ff34 # v1.3
         with:
           tools: hdf5 netcdf
           cache: "yes"
-      - uses: actions/setup-python@v6
-        name: Setup Python ${{ matrix.python-version }}
+      
+      - name: Set up Python${{ matrix.python-version }}
+        uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
         with:
           python-version: ${{ matrix.python-version }}
-          cache: 'pip'
-      - name: Install tox 📦
+          cache: pip
+      
+      - name: Install CI libraries
         run: |
-          python -m pip install "tox>=4.30.3" "tox-gh>=1.5"
+          python -m pip install --require-hashes -r CI/requirements_ci.txt
+      
       - name: Run tests with tox ⚙️
         run: |
           tox
         env:
           TOX_GH_MAJOR_MINOR: ${{ matrix.python-version }}
+      
+      - name: Trust Coveralls Homebrew tap # Homebrew v6.0 requirement; Remove when coverallsapp/github-action >2.3.7
+        if: matrix.os == 'macos'
+        run: |
+          brew trust coverallsapp/coveralls
       - name: Report Coverage
-        uses: coverallsapp/github-action@v2
+        uses: coverallsapp/github-action@5cbfd81b66ca5d10c19b062c04de0199c215fb6e # v2.3.7
         with:
           flag-name: run-${{ matrix.python-version }}
           parallel: true
@@ -78,16 +97,21 @@ jobs:
     needs: lint
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v6
-      - uses: actions/setup-python@v6
-        name: Setup Python 3.10
+      - name: Checkout Repository
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        with:
+          persist-credentials: false
+      - name: Set up Python3.10
+        uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
         with:
           python-version: "3.10"
-          cache: 'pip'
+          cache: pip
+      - name: Install CI libraries
+        run: |
+          python -m pip install --require-hashes -r CI/requirements_ci.txt
       - name: Build documentation 🏗️
         run: |
-          pip install -e .[dev]
-          cd docs && make html
+          tox -e docs
 
   finish:
     name: Finish
@@ -99,6 +123,6 @@ jobs:
       pull-requests: write
     steps:
       - name: Coveralls Finished
-        uses: coverallsapp/github-action@v2
+        uses: coverallsapp/github-action@5cbfd81b66ca5d10c19b062c04de0199c215fb6e # v2.3.7
         with:
           parallel-finished: true
diff --git a/CI/requirements_ci.in b/CI/requirements_ci.in
new file mode 100644
index 00000000..e56e6aec
--- /dev/null
+++ b/CI/requirements_ci.in
@@ -0,0 +1,2 @@
+tox==4.56.1
+tox-gh==1.7.1
diff --git a/CI/requirements_ci.txt b/CI/requirements_ci.txt
new file mode 100644
index 00000000..da8a4d57
--- /dev/null
+++ b/CI/requirements_ci.txt
@@ -0,0 +1,127 @@
+#
+# This file is autogenerated by pip-compile with Python 3.10
+# by the following command:
+#
+#    pip-compile --generate-hashes --output-file=CI/requirements_ci.txt CI/requirements_ci.in
+#
+cachetools==7.1.4 \
+    --hash=sha256:323dc4127934744db5b54eb4924482d7edafbf9554e820d1531c2e08c0e4ef54 \
+    --hash=sha256:437f55a4e0c1b01a4f3077cc470e6991d47430970e36fbcb77e2be0df4fc1cd6
+    # via tox
+colorama==0.4.6 \
+    --hash=sha256:08695f5cb7ed6e0531a20572697297273c47b8cae5a63ffc6d6ed5c201be6e44 \
+    --hash=sha256:4f1d9991f5acc0ca119f9d443620b77f9d6b33703e51011c16baf57afb285fc6
+    # via tox
+distlib==0.4.3 \
+    --hash=sha256:4b0ce306c966eb73bc3a7b6abad017c556dadd92c44701562cd528ac7fde4d5b \
+    --hash=sha256:f152097224a0ae24be5a0f6bae1b9359af82133bce63f98a95f86cae1aede9ed
+    # via virtualenv
+filelock==3.29.4 \
+    --hash=sha256:10cdb3656fc44541cdf30652a93fb10ec6b05325620eb316bd26893e4201538a \
+    --hash=sha256:dac1648087d5115554850d113e7dd8c83ab2d38e3435dde2d4f163847e57b767
+    # via
+    #   python-discovery
+    #   tox
+    #   virtualenv
+packaging==26.2 \
+    --hash=sha256:5fc45236b9446107ff2415ce77c807cee2862cb6fac22b8a73826d0693b0980e \
+    --hash=sha256:ff452ff5a3e828ce110190feff1178bb1f2ea2281fa2075aadb987c2fb221661
+    # via
+    #   pyproject-api
+    #   tox
+platformdirs==4.10.0 \
+    --hash=sha256:31e761a6a0ca04faf7353ea759bdba55652be214725111e5aac52dfa29d4bef7 \
+    --hash=sha256:fb516cdb12eb0d857d0cd85a7c57cea4d060bee4578d6cf5a14dfdf8cbf8784a
+    # via
+    #   python-discovery
+    #   tox
+    #   virtualenv
+pluggy==1.6.0 \
+    --hash=sha256:7dcc130b76258d33b90f61b658791dede3486c3e6bfb003ee5c9bfb396dd22f3 \
+    --hash=sha256:e920276dd6813095e9377c0bc5566d94c932c33b27a3e3945d8389c374dd4746
+    # via tox
+pyproject-api==1.10.1 \
+    --hash=sha256:c2b2726bd7aa9217b6c50b621fef5b2ae5def4d55b779c9e0694c15e0a8517ba \
+    --hash=sha256:fa9e6f66c35b5017e909825d8f2b5d5482ea699d7be809d21c03bd1f7317f36a
+    # via tox
+python-discovery==1.4.2 \
+    --hash=sha256:475803f53b7b2ed6e490e27373f9d8340f7d2eebf9acdaf645d7d714c97bb500 \
+    --hash=sha256:8f3746c4b4968d22afbb97d36e1a0e5b66e6c0f297290f2e95f05b9b8bf18690
+    # via
+    #   tox
+    #   virtualenv
+tomli==2.4.1 \
+    --hash=sha256:01f520d4f53ef97964a240a035ec2a869fe1a37dde002b57ebc4417a27ccd853 \
+    --hash=sha256:0d85819802132122da43cb86656f8d1f8c6587d54ae7dcaf30e90533028b49fe \
+    --hash=sha256:136443dbd7e1dee43c68ac2694fde36b2849865fa258d39bf822c10e8068eac5 \
+    --hash=sha256:1d8591993e228b0c930c4bb0db464bdad97b3289fb981255d6c9a41aedc84b2d \
+    --hash=sha256:2190f2e9dd7508d2a90ded5ed369255980a1bcdd58e52f7fe24b8162bf9fedbd \
+    --hash=sha256:2c1c351919aca02858f740c6d33adea0c5deea37f9ecca1cc1ef9e884a619d26 \
+    --hash=sha256:36d2bd2ad5fb9eaddba5226aa02c8ec3fa4f192631e347b3ed28186d43be6b54 \
+    --hash=sha256:3d48a93ee1c9b79c04bb38772ee1b64dcf18ff43085896ea460ca8dec96f35f6 \
+    --hash=sha256:47149d5bd38761ac8be13a84864bf0b7b70bc051806bc3669ab1cbc56216b23c \
+    --hash=sha256:4ab97e64ccda8756376892c53a72bd1f964e519c77236368527f758fbc36a53a \
+    --hash=sha256:4b605484e43cdc43f0954ddae319fb75f04cc10dd80d830540060ee7cd0243cd \
+    --hash=sha256:504aa796fe0569bb43171066009ead363de03675276d2d121ac1a4572397870f \
+    --hash=sha256:51529d40e3ca50046d7606fa99ce3956a617f9b36380da3b7f0dd3dd28e68cb5 \
+    --hash=sha256:52c8ef851d9a240f11a88c003eacb03c31fc1c9c4ec64a99a0f922b93874fda9 \
+    --hash=sha256:559db847dc486944896521f68d8190be1c9e719fced785720d2216fe7022b662 \
+    --hash=sha256:5a881ab208c0baf688221f8cecc5401bd291d67e38a1ac884d6736cbcd8247e9 \
+    --hash=sha256:5cb41aa38891e073ee49d55fbc7839cfdb2bc0e600add13874d048c94aadddd1 \
+    --hash=sha256:5e262d41726bc187e69af7825504c933b6794dc3fbd5945e41a79bb14c31f585 \
+    --hash=sha256:5ee18d9ebdb417e384b58fe414e8d6af9f4e7a0ae761519fb50f721de398dd4e \
+    --hash=sha256:7008df2e7655c495dd12d2a4ad038ff878d4ca4b81fccaf82b714e07eae4402c \
+    --hash=sha256:734e20b57ba95624ecf1841e72b53f6e186355e216e5412de414e3c51e5e3c41 \
+    --hash=sha256:7c7e1a961a0b2f2472c1ac5b69affa0ae1132c39adcb67aba98568702b9cc23f \
+    --hash=sha256:7f86fd587c4ed9dd76f318225e7d9b29cfc5a9d43de44e5754db8d1128487085 \
+    --hash=sha256:7f94b27a62cfad8496c8d2513e1a222dd446f095fca8987fceef261225538a15 \
+    --hash=sha256:88dceee75c2c63af144e456745e10101eb67361050196b0b6af5d717254dddf7 \
+    --hash=sha256:8a650c2dbafa08d42e51ba0b62740dae4ecb9338eefa093aa5c78ceb546fcd5c \
+    --hash=sha256:8d65a2fbf9d2f8352685bc1364177ee3923d6baf5e7f43ea4959d7d8bc326a36 \
+    --hash=sha256:96481a5786729fd470164b47cdb3e0e58062a496f455ee41b4403be77cb5a076 \
+    --hash=sha256:a120733b01c45e9a0c34aeef92bf0cf1d56cfe81ed9d47d562f9ed591a9828ac \
+    --hash=sha256:b1d22e6e9387bf4739fbe23bfa80e93f6b0373a7f1b96c6227c32bef95a4d7a8 \
+    --hash=sha256:b8c198f8c1805dc42708689ed6864951fd2494f924149d3e4bce7710f8eb5232 \
+    --hash=sha256:c2541745709bad0264b7d4705ad453b76ccd191e64aa6f0fc66b69a293a45ece \
+    --hash=sha256:c742f741d58a28940ce01d58f0ab2ea3ced8b12402f162f4d534dfe18ba1cd6a \
+    --hash=sha256:c7f2c7f2b9ca6bdeef8f0fa897f8e05085923eb091721675170254cbc5b02897 \
+    --hash=sha256:d312ef37c91508b0ab2cee7da26ec0b3ed2f03ce12bd87a588d771ae15dcf82d \
+    --hash=sha256:d4d8fe59808a54658fcc0160ecfb1b30f9089906c50b23bcb4c69eddc19ec2b4 \
+    --hash=sha256:da25dc3563bff5965356133435b757a795a17b17d01dbc0f42fb32447ddfd917 \
+    --hash=sha256:eab21f45c7f66c13f2a9e0e1535309cee140182a9cdae1e041d02e47291e8396 \
+    --hash=sha256:eb0dc4e38e6a1fd579e5d50369aa2e10acfc9cace504579b2faabb478e76941a \
+    --hash=sha256:ec9bfaf3ad2df51ace80688143a6a4ebc09a248f6ff781a9945e51937008fcbc \
+    --hash=sha256:ede3e6487c5ef5d28634ba3f31f989030ad6af71edfb0055cbbd14189ff240ba \
+    --hash=sha256:f3c6818a1a86dd6dca7ddcaaf76947d5ba31aecc28cb1b67009a5877c9a64f3f \
+    --hash=sha256:f758f1b9299d059cc3f6546ae2af89670cb1c4d48ea29c3cacc4fe7de3058257 \
+    --hash=sha256:f8f0fc26ec2cc2b965b7a3b87cd19c5c6b8c5e5f436b984e85f486d652285c30 \
+    --hash=sha256:fd0409a3653af6c147209d267a0e4243f0ae46b011aa978b1080359fddc9b6cf \
+    --hash=sha256:ff18e6a727ee0ab0388507b89d1bc6a22b138d1e2fa56d1ad494586d61d2eae9 \
+    --hash=sha256:ff2983983d34813c1aeb0fa89091e76c3a22889ee83ab27c5eeb45100560c049
+    # via
+    #   pyproject-api
+    #   tox
+tomli-w==1.2.0 \
+    --hash=sha256:188306098d013b691fcadc011abd66727d3c414c571bb01b1a174ba8c983cf90 \
+    --hash=sha256:2dd14fac5a47c27be9cd4c976af5a12d87fb1f0b4512f81d69cce3b35ae25021
+    # via tox
+tox==4.56.1 \
+    --hash=sha256:4d06b925c4dd67872099b39c5a46fba79a2169c5f6e32060f95a8b1181f0ef55 \
+    --hash=sha256:db1c2610802553189cf40de251661d066a635ee0ed9bf2a60093b5f1a7f36ef8
+    # via
+    #   -r CI/requirements_ci.in
+    #   tox-gh
+tox-gh==1.7.1 \
+    --hash=sha256:4f4871ee4091b41464f2df9ab1fcedb14a48accdecbb60d53297301a9d8984c6 \
+    --hash=sha256:a82285b16a597516f9a24f20326b124ddc7924a8b70cb05a9192e1c53d7f701d
+    # via -r CI/requirements_ci.in
+typing-extensions==4.15.0 \
+    --hash=sha256:0cea48d173cc12fa28ecabc3b837ea3cf6f38c6d1136f85cbaaf598984861466 \
+    --hash=sha256:f0fa19c6845758ab08074a0cfa8b7aecb71c999ca73d62883bc25cc018c4e548
+    # via
+    #   tox
+    #   virtualenv
+virtualenv==21.5.1 \
+    --hash=sha256:55aa670b67bbfb991b03fda39bd3276d92c419d702376e98c5df1c9989a26783 \
+    --hash=sha256:dca3bf98275a59c652b69d68e73433e597d977c2da9198882479d1a7188009c8
+    # via tox

From f291728b26527b426a278ea7bbae2da7995cfe3f Mon Sep 17 00:00:00 2001
From: Trevor James Smith <10819524+Zeitsperre@users.noreply.github.com>
Date: Mon, 29 Jun 2026 15:57:11 -0400
Subject: [PATCH 2/4] sphinx adjustments, add docs recipe to tox.ini

Signed-off-by: Trevor James Smith <10819524+Zeitsperre@users.noreply.github.com>
---
 docs/conf.py | 5 +++--
 tox.ini      | 6 ++++++
 2 files changed, 9 insertions(+), 2 deletions(-)

diff --git a/docs/conf.py b/docs/conf.py
index 59668a73..ef2394e3 100644
--- a/docs/conf.py
+++ b/docs/conf.py
@@ -4,13 +4,14 @@
 ##################################################################
 
 import sys
+import datetime
 
 project = u'PyWPS'
 
 license = ('This work is licensed under a Creative Commons Attribution 4.0 '
            'International License')
 
-copyright = ('Copyright (C) 2014-2016 PyWPS Development Team, '
+copyright = (f'Copyright (C) 2014-{datetime.datetime.now().year} PyWPS Development Team, '
              'represented by Jachym Cepicky.')
 copyright += license
 
@@ -31,7 +32,7 @@
 ]
 
 exclude_patterns = ['_build']
-source_suffix = '.rst'
+source_suffix = {'.rst': 'restructuredtext'}
 master_doc = 'index'
 
 pygments_style = 'sphinx'
diff --git a/tox.ini b/tox.ini
index 41848e6c..01903acc 100644
--- a/tox.ini
+++ b/tox.ini
@@ -11,6 +11,12 @@ python =
     3.12 = py3.12
     3.13 = py3.13-extra
 
+[testenv:docs]
+commands =
+    make docs
+allowlist_externals =
+    make
+
 [testenv:lint]
 skip_install = true
 extras =

From b41315f8b2f76d9453bf41272950e60fa7999ab3 Mon Sep 17 00:00:00 2001
From: Trevor James Smith <10819524+Zeitsperre@users.noreply.github.com>
Date: Mon, 29 Jun 2026 17:19:48 -0400
Subject: [PATCH 3/4] macos-latest needed in step condition

Signed-off-by: Trevor James Smith <10819524+Zeitsperre@users.noreply.github.com>
---
 .github/workflows/main.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/workflows/main.yml b/.github/workflows/main.yml
index 2022faab..ff9320d6 100644
--- a/.github/workflows/main.yml
+++ b/.github/workflows/main.yml
@@ -83,7 +83,7 @@ jobs:
           TOX_GH_MAJOR_MINOR: ${{ matrix.python-version }}
       
       - name: Trust Coveralls Homebrew tap # Homebrew v6.0 requirement; Remove when coverallsapp/github-action >2.3.7
-        if: matrix.os == 'macos'
+        if: matrix.os == 'macos-latest'
         run: |
           brew trust coverallsapp/coveralls
       - name: Report Coverage

From bcd11f558d337d5d1ba3d67f326eb4d8de044f60 Mon Sep 17 00:00:00 2001
From: Trevor James Smith <10819524+Zeitsperre@users.noreply.github.com>
Date: Tue, 30 Jun 2026 11:47:13 -0400
Subject: [PATCH 4/4] update RTD ubuntu image, bump tox, consistent tox build
 names

Signed-off-by: Trevor James Smith <10819524+Zeitsperre@users.noreply.github.com>
---
 .readthedocs.yml | 2 +-
 pyproject.toml   | 2 +-
 tox.ini          | 8 +++++---
 3 files changed, 7 insertions(+), 5 deletions(-)

diff --git a/.readthedocs.yml b/.readthedocs.yml
index efc2f6e8..81e56195 100644
--- a/.readthedocs.yml
+++ b/.readthedocs.yml
@@ -10,7 +10,7 @@ formats:
   - epub
 
 build:
-  os: "ubuntu-24.04"
+  os: "ubuntu-26.04"
   tools:
     python: "3.11"  # Use standard CPython version; `mambaforge-22.9` is not valid here
 
diff --git a/pyproject.toml b/pyproject.toml
index cf96b962..53b04967 100644
--- a/pyproject.toml
+++ b/pyproject.toml
@@ -57,7 +57,7 @@ dev = [
   "pytest-cov",
   "ruff >=0.14.0",
   "sphinx",
-  "tox >=4.30.3",
+  "tox >=4.56.1",
   "twine",
   "wheel"
 ]
diff --git a/tox.ini b/tox.ini
index 01903acc..f85b87f9 100644
--- a/tox.ini
+++ b/tox.ini
@@ -1,7 +1,7 @@
 [tox]
 envlist =
-    py{310,311,312,313}{-extra,},
-    lint
+    lint,
+    py3.{10,11,12,13}{-extra,}
 opts = --verbose
 
 [gh]
@@ -23,7 +23,9 @@ extras =
 deps =
     ruff
 commands =
-    ruff check pywps
+    make lint
+allowlist_externals = 
+    make
 
 [testenv]
 setenv =