From d193a7445c0f79017359a3686f3e153a834cdd5c Mon Sep 17 00:00:00 2001
From: Trevor James Smith <10819524+Zeitsperre@users.noreply.github.com>
Date: Wed, 17 Jul 2024 10:41:48 -0400
Subject: [PATCH 1/8] use hashes for dependencies, use app for bumpversion
 commits

---
 .github/workflows/bump-version-tag.yml |  47 +++---
 .github/workflows/docker-testing.yml   |  19 ++-
 .github/workflows/label.yml            |   4 +-
 .github/workflows/main.yml             |  26 ++--
 CI/requirements.in                     |   2 +
 CI/requirements.txt                    | 194 +++++++++++++++++++++++++
 6 files changed, 256 insertions(+), 36 deletions(-)
 create mode 100644 CI/requirements.in
 create mode 100644 CI/requirements.txt

diff --git a/.github/workflows/bump-version-tag.yml b/.github/workflows/bump-version-tag.yml
index d6cfd3de..d40efa06 100644
--- a/.github/workflows/bump-version-tag.yml
+++ b/.github/workflows/bump-version-tag.yml
@@ -10,6 +10,8 @@ on:
       - .github/*/*.yml
       - AUTHORS.rst
       - CHANGES.rst
+      - CI/*.in
+      - CI/*.txt
       - Dockerfile
       - Makefile
       - docker-compose.yml
@@ -18,6 +20,7 @@ on:
       - docs/*/*.rst
       - docs/Makefile
       - docs/_static/*
+      - environment.yml
       - environment-docs.yml
       - finch/__version__.py
       - requirements*.txt
@@ -41,36 +44,41 @@ jobs:
           disable-sudo: true
           egress-policy: block
           allowed-endpoints: >
+            api.github.com:443
             files.pythonhosted.org:443
             github.com:443
             pypi.org:443
-      - uses: actions/checkout@v4
+      - name: Generate App Token
+        id: token_generator
+        uses: actions/create-github-app-token@31c86eb3b33c9b601a1f60f98dcbfd1d70f379b4 # v1.10.3
         with:
-          persist-credentials: false
-      - uses: actions/setup-python@v5
+          app-id: ${{ secrets.OURANOS_HELPER_BOT_ID }}
+          private-key: ${{ secrets.OURANOS_HELPER_BOT_KEY }}
+      - name: Checkout Repository
+        uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4.1.7
+        with:
+          token: ${{ steps.token_generator.outputs.token }}
+      - name: Set up Python3
+        uses: actions/setup-python@39cd14951b08e74b54015e9e001cdefcf80e669f # v5.1.1
         with:
           python-version: "3.x"
-      - name: Config Commit Bot
-        run: |
-          git config --local user.email "bumpversion[bot]@ouranos.ca"
-          git config --local user.name "bumpversion[bot]"
+      - name: Import GPG Key
+        uses: crazy-max/ghaction-import-gpg@01dd5d3ca463c7f10f7f4f7b4f177225ac661ee4 # v6.1.0
+        with:
+          gpg_private_key: ${{ secrets.OURANOS_HELPER_BOT_GPG_PRIVATE_KEY }}
+          passphrase: ${{ secrets.OURANOS_HELPER_BOT_GPG_PRIVATE_KEY_PASSWORD }}
+          git_user_signingkey: true
+          git_commit_gpgsign: true
+          trust_level: 5
       - name: Current Version
         run: |
           CURRENT_VERSION="$(grep -E '__version__' finch/__version__.py | cut -d ' ' -f3)"
           echo "current_version=${CURRENT_VERSION}"
           echo "CURRENT_VERSION=${CURRENT_VERSION}" >> $GITHUB_ENV
-      - name: Bump Version
-        if: ${{ github.event.inputs.tag == 'false' }}
+      - name: Install CI libraries
         run: |
-          pip install bump-my-version
-          echo "running `bump-my-version bump  --no-tag ${{ github.event.inputs.bumpversion }}`"
-          NEW_VERSION="$(grep -E '__version__' finch/__version__.py | cut -d ' ' -f3)"
-          echo "new_version=${NEW_VERSION}"
-      - name: Install bump-my-version
-        run: |
-          python -m pip install bump-my-version>=0.18.3
+          python -m pip install -r CI/requirements_ci.txt
       - name: Conditional Bump
-        id: bump
         run: |
           if [[ ${{ env.CURRENT_VERSION }} =~ -dev(\.\d+)? ]]; then
             echo "Development version (ends in 'dev(\.\d+)?'), bumping 'build' version"
@@ -79,12 +87,11 @@ jobs:
             echo "Version is stable, bumping 'patch' version"
             bump-my-version bump patch
           fi
-          NEW_VERSION="$(grep -E '__version__'  finch/__version__.py | cut -d ' ' -f3)"
+          NEW_VERSION="$(grep -E '__version__' finch/__version__.py | cut -d ' ' -f3)"
           echo "new_version=${NEW_VERSION}"
           echo "NEW_VERSION=${NEW_VERSION}" >> $GITHUB_ENV
       - name: Push Changes
-        uses: ad-m/github-push-action@master
+        uses: ad-m/github-push-action@d91a481090679876dfc4178fef17f286781251df # v0.8.0
         with:
           force: false
-          github_token: ${{ secrets.BUMPVERSION_TOKEN }}
           branch: ${{ github.ref }}
diff --git a/.github/workflows/docker-testing.yml b/.github/workflows/docker-testing.yml
index fa638e8f..d3b8bf2d 100644
--- a/.github/workflows/docker-testing.yml
+++ b/.github/workflows/docker-testing.yml
@@ -11,14 +11,24 @@ concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}
   cancel-in-progress: ${{ github.ref != 'refs/heads/master' }}
 
+permissions:
+  contents: read
+
 jobs:
   build:
     name: Build and Test Docker image
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
-      - uses: docker/setup-buildx-action@v3
-      - uses: docker/build-push-action@v6
+      - name: Harden Runner
+        uses: step-security/harden-runner@17d0e2bd7d51742c71671bd19fa12bdc9d40a3d6 # v2.8.1
+        with:
+          egress-policy: audit
+      - name: Checkout Repository
+        uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4.1.7
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@4fd812986e6c8c2a69e18311145f9371337f27d4 # v3.4.0
+      - name: Build Docker image (no push)
+        uses: docker/build-push-action@1ca370b3a9802c92e886402e0dd88098a2533b12 # v6.4.1
         with:
           context: .
           file: "Dockerfile"
@@ -27,7 +37,8 @@ jobs:
           cache-from: type=gha
           cache-to: type=gha,mode=max
           push: false
-      - uses: addnab/docker-run-action@v3
+      - name: Run Docker image
+        uses: addnab/docker-run-action@4f65fabd2431ebc8d299f8e5a018d79a769ae185 # v3
         with:
           image: localfinch:latest
           options: -p 5000:5000
diff --git a/.github/workflows/label.yml b/.github/workflows/label.yml
index 2b7573f4..377b87ad 100644
--- a/.github/workflows/label.yml
+++ b/.github/workflows/label.yml
@@ -21,6 +21,7 @@ permissions:
 
 jobs:
   label:
+    name: Label
     runs-on: ubuntu-latest
     permissions:
       checks: write
@@ -34,6 +35,7 @@ jobs:
           egress-policy: block
           allowed-endpoints: >
             api.github.com:443
-      - uses: actions/labeler@8558fd74291d67161a8a78ce36a881fa63b766a9 # v5.0.0
+      - name: Labeler
+        uses: actions/labeler@8558fd74291d67161a8a78ce36a881fa63b766a9 # v5.0.0
         with:
           repo-token: "${{ secrets.GITHUB_TOKEN }}"
diff --git a/.github/workflows/main.yml b/.github/workflows/main.yml
index e48cf742..20ad9680 100644
--- a/.github/workflows/main.yml
+++ b/.github/workflows/main.yml
@@ -11,21 +11,26 @@ concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}
   cancel-in-progress: ${{ github.ref != 'refs/heads/master' }}
 
+permissions:
+  contents: read
+
 jobs:
   lint:
     name: Code linting
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
-      - uses: actions/setup-python@v5
+      - name: Checkout Repository
+        uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4.1.7
+      - name: Set up Python${{ matrix.python-version }}
+        uses: actions/setup-python@39cd14951b08e74b54015e9e001cdefcf80e669f # v5.1.1
         with:
-          python-version: "3.8"
+          python-version: "3.x"
       - name: Install flake8
         run: |
-          python -m pip install flake8
+          python -m pip install -r CI/requirements_ci.txt
       - name: Run linting suite
         run: |
-          flake8
+          python -m flake8
 
   conda:
     name: Build ⚙️ and test 🧪
@@ -38,19 +43,18 @@ jobs:
         matrix:
             python-version: ["3.8", "3.9", "3.10", "3.11"]
     steps:
-      - uses: actions/checkout@v4
-      - name: Setup conda and environment
-        uses: mamba-org/setup-micromamba@v1
+      - name: Checkout Repository
+        uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4.1.7
+      - name: Setup Conda (Micromamba) with Python${{ matrix.python-version }}
+        uses: mamba-org/setup-micromamba@f8b8a1e23a26f60a44c853292711bacfd3eac822 # v1.9.0
         with:
           cache-downloads: true
           cache-environment: true
           environment-file: environment.yml
           create-args: >-
-            conda
             python=${{ matrix.python-version }}
-      - name: Conda and Mamba versions
+      - name: Mamba version
         run: |
-          conda --version
           echo "micromamba: $(micromamba --version)"
       - name: Install finch-wps
         run: |
diff --git a/CI/requirements.in b/CI/requirements.in
new file mode 100644
index 00000000..8945c9b5
--- /dev/null
+++ b/CI/requirements.in
@@ -0,0 +1,2 @@
+bump-my-version==0.24.2
+flake8==7.1.0
diff --git a/CI/requirements.txt b/CI/requirements.txt
new file mode 100644
index 00000000..07380a21
--- /dev/null
+++ b/CI/requirements.txt
@@ -0,0 +1,194 @@
+#
+# This file is autogenerated by pip-compile with Python 3.12
+# by the following command:
+#
+#    pip-compile --generate-hashes --output-file=CI/requirements.txt CI/requirements.in
+#
+annotated-types==0.7.0 \
+    --hash=sha256:1f02e8b43a8fbbc3f3e0d4f0f4bfc8131bcb4eebe8849b8e5c773f3a1c582a53 \
+    --hash=sha256:aff07c09a53a08bc8cfccb9c85b05f1aa9a2a6f23728d790723543408344ce89
+    # via pydantic
+bracex==2.4 \
+    --hash=sha256:a27eaf1df42cf561fed58b7a8f3fdf129d1ea16a81e1fadd1d17989bc6384beb \
+    --hash=sha256:efdc71eff95eaff5e0f8cfebe7d01adf2c8637c8c92edaf63ef348c241a82418
+    # via wcmatch
+bump-my-version==0.24.2 \
+    --hash=sha256:38581935e821266df24f292bbfe73f1a4ded368b62e52b44218f31aeea2be13c \
+    --hash=sha256:b7264acd237fad34712db1ee61aac29576ad1791a5c31b9fa0b55b34ba18e91f
+    # via -r CI/requirements.in
+click==8.1.7 \
+    --hash=sha256:ae74fb96c20a0277a1d615f1e4d73c8414f5a98db8b799a7931d1582f3390c28 \
+    --hash=sha256:ca9853ad459e787e2192211578cc907e7594e294c7ccc834310722b41b9ca6de
+    # via
+    #   bump-my-version
+    #   rich-click
+flake8==7.1.0 \
+    --hash=sha256:2e416edcc62471a64cea09353f4e7bdba32aeb079b6e360554c659a122b1bc6a \
+    --hash=sha256:48a07b626b55236e0fb4784ee69a465fbf59d79eec1f5b4785c3d3bc57d17aa5
+    # via -r CI/requirements.in
+markdown-it-py==3.0.0 \
+    --hash=sha256:355216845c60bd96232cd8d8c40e8f9765cc86f46880e43a8fd22dc1a1a8cab1 \
+    --hash=sha256:e3f60a94fa066dc52ec76661e37c851cb232d92f9886b15cb560aaada2df8feb
+    # via rich
+mccabe==0.7.0 \
+    --hash=sha256:348e0240c33b60bbdf4e523192ef919f28cb2c3d7d5c7794f74009290f236325 \
+    --hash=sha256:6c2d30ab6be0e4a46919781807b4f0d834ebdd6c6e3dca0bda5a15f863427b6e
+    # via flake8
+mdurl==0.1.2 \
+    --hash=sha256:84008a41e51615a49fc9966191ff91509e3c40b939176e643fd50a5c2196b8f8 \
+    --hash=sha256:bb413d29f5eea38f31dd4754dd7377d4465116fb207585f97bf925588687c1ba
+    # via markdown-it-py
+prompt-toolkit==3.0.36 \
+    --hash=sha256:3e163f254bef5a03b146397d7c1963bd3e2812f0964bb9a24e6ec761fd28db63 \
+    --hash=sha256:aa64ad242a462c5ff0363a7b9cfe696c20d55d9fc60c11fd8e632d064804d305
+    # via questionary
+pycodestyle==2.12.0 \
+    --hash=sha256:442f950141b4f43df752dd303511ffded3a04c2b6fb7f65980574f0c31e6e79c \
+    --hash=sha256:949a39f6b86c3e1515ba1787c2022131d165a8ad271b11370a8819aa070269e4
+    # via flake8
+pydantic==2.8.2 \
+    --hash=sha256:6f62c13d067b0755ad1c21a34bdd06c0c12625a22b0fc09c6b149816604f7c2a \
+    --hash=sha256:73ee9fddd406dc318b885c7a2eab8a6472b68b8fb5ba8150949fc3db939f23c8
+    # via
+    #   bump-my-version
+    #   pydantic-settings
+pydantic-core==2.20.1 \
+    --hash=sha256:035ede2e16da7281041f0e626459bcae33ed998cca6a0a007a5ebb73414ac72d \
+    --hash=sha256:04024d270cf63f586ad41fff13fde4311c4fc13ea74676962c876d9577bcc78f \
+    --hash=sha256:0827505a5c87e8aa285dc31e9ec7f4a17c81a813d45f70b1d9164e03a813a686 \
+    --hash=sha256:084659fac3c83fd674596612aeff6041a18402f1e1bc19ca39e417d554468482 \
+    --hash=sha256:10d4204d8ca33146e761c79f83cc861df20e7ae9f6487ca290a97702daf56006 \
+    --hash=sha256:11b71d67b4725e7e2a9f6e9c0ac1239bbc0c48cce3dc59f98635efc57d6dac83 \
+    --hash=sha256:150906b40ff188a3260cbee25380e7494ee85048584998c1e66df0c7a11c17a6 \
+    --hash=sha256:175873691124f3d0da55aeea1d90660a6ea7a3cfea137c38afa0a5ffabe37b88 \
+    --hash=sha256:177f55a886d74f1808763976ac4efd29b7ed15c69f4d838bbd74d9d09cf6fa86 \
+    --hash=sha256:19c0fa39fa154e7e0b7f82f88ef85faa2a4c23cc65aae2f5aea625e3c13c735a \
+    --hash=sha256:1eedfeb6089ed3fad42e81a67755846ad4dcc14d73698c120a82e4ccf0f1f9f6 \
+    --hash=sha256:225b67a1f6d602de0ce7f6c1c3ae89a4aa25d3de9be857999e9124f15dab486a \
+    --hash=sha256:242b8feb3c493ab78be289c034a1f659e8826e2233786e36f2893a950a719bb6 \
+    --hash=sha256:254ec27fdb5b1ee60684f91683be95e5133c994cc54e86a0b0963afa25c8f8a6 \
+    --hash=sha256:25e9185e2d06c16ee438ed39bf62935ec436474a6ac4f9358524220f1b236e43 \
+    --hash=sha256:26ab812fa0c845df815e506be30337e2df27e88399b985d0bb4e3ecfe72df31c \
+    --hash=sha256:26ca695eeee5f9f1aeeb211ffc12f10bcb6f71e2989988fda61dabd65db878d4 \
+    --hash=sha256:26dc97754b57d2fd00ac2b24dfa341abffc380b823211994c4efac7f13b9e90e \
+    --hash=sha256:270755f15174fb983890c49881e93f8f1b80f0b5e3a3cc1394a255706cabd203 \
+    --hash=sha256:2aafc5a503855ea5885559eae883978c9b6d8c8993d67766ee73d82e841300dd \
+    --hash=sha256:2d036c7187b9422ae5b262badb87a20a49eb6c5238b2004e96d4da1231badef1 \
+    --hash=sha256:33499e85e739a4b60c9dac710c20a08dc73cb3240c9a0e22325e671b27b70d24 \
+    --hash=sha256:37eee5b638f0e0dcd18d21f59b679686bbd18917b87db0193ae36f9c23c355fc \
+    --hash=sha256:38cf1c40a921d05c5edc61a785c0ddb4bed67827069f535d794ce6bcded919fc \
+    --hash=sha256:3acae97ffd19bf091c72df4d726d552c473f3576409b2a7ca36b2f535ffff4a3 \
+    --hash=sha256:3c5ebac750d9d5f2706654c638c041635c385596caf68f81342011ddfa1e5598 \
+    --hash=sha256:3d482efec8b7dc6bfaedc0f166b2ce349df0011f5d2f1f25537ced4cfc34fd98 \
+    --hash=sha256:407653af5617f0757261ae249d3fba09504d7a71ab36ac057c938572d1bc9331 \
+    --hash=sha256:40a783fb7ee353c50bd3853e626f15677ea527ae556429453685ae32280c19c2 \
+    --hash=sha256:41e81317dd6a0127cabce83c0c9c3fbecceae981c8391e6f1dec88a77c8a569a \
+    --hash=sha256:41f4c96227a67a013e7de5ff8f20fb496ce573893b7f4f2707d065907bffdbd6 \
+    --hash=sha256:469f29f9093c9d834432034d33f5fe45699e664f12a13bf38c04967ce233d688 \
+    --hash=sha256:4745f4ac52cc6686390c40eaa01d48b18997cb130833154801a442323cc78f91 \
+    --hash=sha256:4868f6bd7c9d98904b748a2653031fc9c2f85b6237009d475b1008bfaeb0a5aa \
+    --hash=sha256:4aa223cd1e36b642092c326d694d8bf59b71ddddc94cdb752bbbb1c5c91d833b \
+    --hash=sha256:4dd484681c15e6b9a977c785a345d3e378d72678fd5f1f3c0509608da24f2ac0 \
+    --hash=sha256:4f2790949cf385d985a31984907fecb3896999329103df4e4983a4a41e13e840 \
+    --hash=sha256:512ecfbefef6dac7bc5eaaf46177b2de58cdf7acac8793fe033b24ece0b9566c \
+    --hash=sha256:516d9227919612425c8ef1c9b869bbbee249bc91912c8aaffb66116c0b447ebd \
+    --hash=sha256:53e431da3fc53360db73eedf6f7124d1076e1b4ee4276b36fb25514544ceb4a3 \
+    --hash=sha256:595ba5be69b35777474fa07f80fc260ea71255656191adb22a8c53aba4479231 \
+    --hash=sha256:5b5ff4911aea936a47d9376fd3ab17e970cc543d1b68921886e7f64bd28308d1 \
+    --hash=sha256:5d41e6daee2813ecceea8eda38062d69e280b39df793f5a942fa515b8ed67953 \
+    --hash=sha256:5e999ba8dd90e93d57410c5e67ebb67ffcaadcea0ad973240fdfd3a135506250 \
+    --hash=sha256:5f239eb799a2081495ea659d8d4a43a8f42cd1fe9ff2e7e436295c38a10c286a \
+    --hash=sha256:635fee4e041ab9c479e31edda27fcf966ea9614fff1317e280d99eb3e5ab6fe2 \
+    --hash=sha256:65db0f2eefcaad1a3950f498aabb4875c8890438bc80b19362cf633b87a8ab20 \
+    --hash=sha256:6b507132dcfc0dea440cce23ee2182c0ce7aba7054576efc65634f080dbe9434 \
+    --hash=sha256:6b9d9bb600328a1ce523ab4f454859e9d439150abb0906c5a1983c146580ebab \
+    --hash=sha256:70c8daf4faca8da5a6d655f9af86faf6ec2e1768f4b8b9d0226c02f3d6209703 \
+    --hash=sha256:77bf3ac639c1ff567ae3b47f8d4cc3dc20f9966a2a6dd2311dcc055d3d04fb8a \
+    --hash=sha256:784c1214cb6dd1e3b15dd8b91b9a53852aed16671cc3fbe4786f4f1db07089e2 \
+    --hash=sha256:7eb6a0587eded33aeefea9f916899d42b1799b7b14b8f8ff2753c0ac1741edac \
+    --hash=sha256:7ed1b0132f24beeec5a78b67d9388656d03e6a7c837394f99257e2d55b461611 \
+    --hash=sha256:8ad4aeb3e9a97286573c03df758fc7627aecdd02f1da04516a86dc159bf70121 \
+    --hash=sha256:964faa8a861d2664f0c7ab0c181af0bea66098b1919439815ca8803ef136fc4e \
+    --hash=sha256:9dc1b507c12eb0481d071f3c1808f0529ad41dc415d0ca11f7ebfc666e66a18b \
+    --hash=sha256:9ebfef07dbe1d93efb94b4700f2d278494e9162565a54f124c404a5656d7ff09 \
+    --hash=sha256:a45f84b09ac9c3d35dfcf6a27fd0634d30d183205230a0ebe8373a0e8cfa0906 \
+    --hash=sha256:a4f55095ad087474999ee28d3398bae183a66be4823f753cd7d67dd0153427c9 \
+    --hash=sha256:a6d511cc297ff0883bc3708b465ff82d7560193169a8b93260f74ecb0a5e08a7 \
+    --hash=sha256:a8ad4c766d3f33ba8fd692f9aa297c9058970530a32c728a2c4bfd2616d3358b \
+    --hash=sha256:aa2f457b4af386254372dfa78a2eda2563680d982422641a85f271c859df1987 \
+    --hash=sha256:b03f7941783b4c4a26051846dea594628b38f6940a2fdc0df00b221aed39314c \
+    --hash=sha256:b0dae11d8f5ded51699c74d9548dcc5938e0804cc8298ec0aa0da95c21fff57b \
+    --hash=sha256:b91ced227c41aa29c672814f50dbb05ec93536abf8f43cd14ec9521ea09afe4e \
+    --hash=sha256:bc633a9fe1eb87e250b5c57d389cf28998e4292336926b0b6cdaee353f89a237 \
+    --hash=sha256:bebb4d6715c814597f85297c332297c6ce81e29436125ca59d1159b07f423eb1 \
+    --hash=sha256:c336a6d235522a62fef872c6295a42ecb0c4e1d0f1a3e500fe949415761b8a19 \
+    --hash=sha256:c6514f963b023aeee506678a1cf821fe31159b925c4b76fe2afa94cc70b3222b \
+    --hash=sha256:c693e916709c2465b02ca0ad7b387c4f8423d1db7b4649c551f27a529181c5ad \
+    --hash=sha256:c81131869240e3e568916ef4c307f8b99583efaa60a8112ef27a366eefba8ef0 \
+    --hash=sha256:d02a72df14dfdbaf228424573a07af10637bd490f0901cee872c4f434a735b94 \
+    --hash=sha256:d2a8fa9d6d6f891f3deec72f5cc668e6f66b188ab14bb1ab52422fe8e644f312 \
+    --hash=sha256:d2b27e6af28f07e2f195552b37d7d66b150adbaa39a6d327766ffd695799780f \
+    --hash=sha256:d2fe69c5434391727efa54b47a1e7986bb0186e72a41b203df8f5b0a19a4f669 \
+    --hash=sha256:d3f3ed29cd9f978c604708511a1f9c2fdcb6c38b9aae36a51905b8811ee5cbf1 \
+    --hash=sha256:d573faf8eb7e6b1cbbcb4f5b247c60ca8be39fe2c674495df0eb4318303137fe \
+    --hash=sha256:e0bbdd76ce9aa5d4209d65f2b27fc6e5ef1312ae6c5333c26db3f5ade53a1e99 \
+    --hash=sha256:e7c4ea22b6739b162c9ecaaa41d718dfad48a244909fe7ef4b54c0b530effc5a \
+    --hash=sha256:e93e1a4b4b33daed65d781a57a522ff153dcf748dee70b40c7258c5861e1768a \
+    --hash=sha256:e97fdf088d4b31ff4ba35db26d9cc472ac7ef4a2ff2badeabf8d727b3377fc52 \
+    --hash=sha256:e9fa4c9bf273ca41f940bceb86922a7667cd5bf90e95dbb157cbb8441008482c \
+    --hash=sha256:eaad4ff2de1c3823fddf82f41121bdf453d922e9a238642b1dedb33c4e4f98ad \
+    --hash=sha256:f1f62b2413c3a0e846c3b838b2ecd6c7a19ec6793b2a522745b0869e37ab5bc1 \
+    --hash=sha256:f6d6cff3538391e8486a431569b77921adfcdef14eb18fbf19b7c0a5294d4e6a \
+    --hash=sha256:f9aa05d09ecf4c75157197f27cdc9cfaeb7c5f15021c6373932bf3e124af029f \
+    --hash=sha256:fa2fddcb7107e0d1808086ca306dcade7df60a13a6c347a7acf1ec139aa6789a \
+    --hash=sha256:faa6b09ee09433b87992fb5a2859efd1c264ddc37280d2dd5db502126d0e7f27
+    # via pydantic
+pydantic-settings==2.3.4 \
+    --hash=sha256:11ad8bacb68a045f00e4f862c7a718c8a9ec766aa8fd4c32e39a0594b207b53a \
+    --hash=sha256:c5802e3d62b78e82522319bbc9b8f8ffb28ad1c988a99311d04f2a6051fca0a7
+    # via bump-my-version
+pyflakes==3.2.0 \
+    --hash=sha256:1c61603ff154621fb2a9172037d84dca3500def8c8b630657d1701f026f8af3f \
+    --hash=sha256:84b5be138a2dfbb40689ca07e2152deb896a65c3a3e24c251c5c62489568074a
+    # via flake8
+pygments==2.18.0 \
+    --hash=sha256:786ff802f32e91311bff3889f6e9a86e81505fe99f2735bb6d60ae0c5004f199 \
+    --hash=sha256:b8e6aca0523f3ab76fee51799c488e38782ac06eafcf95e7ba832985c8e7b13a
+    # via rich
+python-dotenv==1.0.1 \
+    --hash=sha256:e324ee90a023d808f1959c46bcbc04446a10ced277783dc6ee09987c37ec10ca \
+    --hash=sha256:f7b63ef50f1b690dddf550d03497b66d609393b40b564ed0d674909a68ebf16a
+    # via pydantic-settings
+questionary==2.0.1 \
+    --hash=sha256:8ab9a01d0b91b68444dff7f6652c1e754105533f083cbe27597c8110ecc230a2 \
+    --hash=sha256:bcce898bf3dbb446ff62830c86c5c6fb9a22a54146f0f5597d3da43b10d8fc8b
+    # via bump-my-version
+rich==13.7.1 \
+    --hash=sha256:4edbae314f59eb482f54e9e30bf00d33350aaa94f4bfcd4e9e3110e64d0d7222 \
+    --hash=sha256:9be308cb1fe2f1f57d67ce99e95af38a1e2bc71ad9813b0e247cf7ffbcc3a432
+    # via
+    #   bump-my-version
+    #   rich-click
+rich-click==1.8.3 \
+    --hash=sha256:636d9c040d31c5eee242201b5bf4f2d358bfae4db14bb22ec1cafa717cfd02cd \
+    --hash=sha256:6d75bdfa7aa9ed2c467789a0688bc6da23fbe3a143e19aa6ad3f8bac113d2ab3
+    # via bump-my-version
+tomlkit==0.13.0 \
+    --hash=sha256:08ad192699734149f5b97b45f1f18dad7eb1b6d16bc72ad0c2335772650d7b72 \
+    --hash=sha256:7075d3042d03b80f603482d69bf0c8f345c2b30e41699fd8883227f89972b264
+    # via bump-my-version
+typing-extensions==4.12.2 \
+    --hash=sha256:04e5ca0351e0f3f85c6853954072df659d0d13fac324d0072316b67d7794700d \
+    --hash=sha256:1a7ead55c7e559dd4dee8856e3a88b41225abfe1ce8df57b7c13915fe121ffb8
+    # via
+    #   pydantic
+    #   pydantic-core
+    #   rich-click
+wcmatch==8.5.2 \
+    --hash=sha256:17d3ad3758f9d0b5b4dedc770b65420d4dac62e680229c287bf24c9db856a478 \
+    --hash=sha256:a70222b86dea82fb382dd87b73278c10756c138bd6f8f714e2183128887b9eb2
+    # via bump-my-version
+wcwidth==0.2.13 \
+    --hash=sha256:3da69048e4540d84af32131829ff948f1e022c1c6bdb8d6102117aac784f6859 \
+    --hash=sha256:72ea0c06399eb286d978fdedb6923a9eb47e1c486ce63e9b4e64fc18303972b5
+    # via prompt-toolkit

From 40ba2c58781d999936e4d44f452dd4f0eb757825 Mon Sep 17 00:00:00 2001
From: Trevor James Smith <10819524+Zeitsperre@users.noreply.github.com>
Date: Wed, 17 Jul 2024 10:46:09 -0400
Subject: [PATCH 2/8] rename files

---
 CI/{requirements.in => requirements_ci.in}   | 0
 CI/{requirements.txt => requirements_ci.txt} | 2 +-
 2 files changed, 1 insertion(+), 1 deletion(-)
 rename CI/{requirements.in => requirements_ci.in} (100%)
 rename CI/{requirements.txt => requirements_ci.txt} (99%)

diff --git a/CI/requirements.in b/CI/requirements_ci.in
similarity index 100%
rename from CI/requirements.in
rename to CI/requirements_ci.in
diff --git a/CI/requirements.txt b/CI/requirements_ci.txt
similarity index 99%
rename from CI/requirements.txt
rename to CI/requirements_ci.txt
index 07380a21..1c74ca78 100644
--- a/CI/requirements.txt
+++ b/CI/requirements_ci.txt
@@ -2,7 +2,7 @@
 # This file is autogenerated by pip-compile with Python 3.12
 # by the following command:
 #
-#    pip-compile --generate-hashes --output-file=CI/requirements.txt CI/requirements.in
+#    pip-compile --generate-hashes --output-file=CI/requirements_ci.txt CI/requirements_ci.in
 #
 annotated-types==0.7.0 \
     --hash=sha256:1f02e8b43a8fbbc3f3e0d4f0f4bfc8131bcb4eebe8849b8e5c773f3a1c582a53 \

From 06498f275aaa0ee0d103cdc86fcfe28b9e6add4a Mon Sep 17 00:00:00 2001
From: Trevor James Smith <10819524+Zeitsperre@users.noreply.github.com>
Date: Wed, 17 Jul 2024 11:01:12 -0400
Subject: [PATCH 3/8] pin cf-xarray

---
 environment.yml       | 2 +-
 requirements.txt      | 2 +-
 requirements_docs.txt | 2 +-
 3 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/environment.yml b/environment.yml
index 8a615f69..8cce36fe 100644
--- a/environment.yml
+++ b/environment.yml
@@ -7,7 +7,7 @@ dependencies:
   - anyascii
   - bottleneck
   - cftime
-  - cf_xarray
+  - cf_xarray >=0.6.1,<0.9.4
   - click >=8.0.0
   - clisops >=0.11.0
   - dask
diff --git a/requirements.txt b/requirements.txt
index 6389820a..1a8b6bee 100644
--- a/requirements.txt
+++ b/requirements.txt
@@ -1,7 +1,7 @@
 anyascii
 bottleneck
 cftime
-cf-xarray
+cf-xarray>=0.6.1,<0.9.4
 click>=8.0.0
 clisops>=0.11.0
 dask[complete]
diff --git a/requirements_docs.txt b/requirements_docs.txt
index 63bb375b..2a292a30 100644
--- a/requirements_docs.txt
+++ b/requirements_docs.txt
@@ -1,7 +1,7 @@
 anyascii
 birdhouse-birdy>=0.8.1
 cftime
-cf-xarray
+cf-xarray>=0.6.1,<0.9.4
 ipython
 matplotlib
 nbsphinx

From 6d2f89384dab3df9e2ef50281055c4222f317732 Mon Sep 17 00:00:00 2001
From: Trevor James Smith <10819524+Zeitsperre@users.noreply.github.com>
Date: Wed, 17 Jul 2024 11:01:21 -0400
Subject: [PATCH 4/8] require hashes

---
 .github/workflows/bump-version-tag.yml | 2 +-
 .github/workflows/main.yml             | 4 ++--
 2 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/.github/workflows/bump-version-tag.yml b/.github/workflows/bump-version-tag.yml
index d40efa06..45671d1e 100644
--- a/.github/workflows/bump-version-tag.yml
+++ b/.github/workflows/bump-version-tag.yml
@@ -77,7 +77,7 @@ jobs:
           echo "CURRENT_VERSION=${CURRENT_VERSION}" >> $GITHUB_ENV
       - name: Install CI libraries
         run: |
-          python -m pip install -r CI/requirements_ci.txt
+          python -m pip install -r --require-hashes CI/requirements_ci.txt
       - name: Conditional Bump
         run: |
           if [[ ${{ env.CURRENT_VERSION }} =~ -dev(\.\d+)? ]]; then
diff --git a/.github/workflows/main.yml b/.github/workflows/main.yml
index 20ad9680..1ddf1854 100644
--- a/.github/workflows/main.yml
+++ b/.github/workflows/main.yml
@@ -25,9 +25,9 @@ jobs:
         uses: actions/setup-python@39cd14951b08e74b54015e9e001cdefcf80e669f # v5.1.1
         with:
           python-version: "3.x"
-      - name: Install flake8
+      - name: Install CI libraries
         run: |
-          python -m pip install -r CI/requirements_ci.txt
+          python -m pip install --require-hashes -r CI/requirements_ci.txt
       - name: Run linting suite
         run: |
           python -m flake8

From 15e509fee7c674dea3b729ab0769f377d480447b Mon Sep 17 00:00:00 2001
From: Trevor James Smith <10819524+Zeitsperre@users.noreply.github.com>
Date: Wed, 17 Jul 2024 11:20:28 -0400
Subject: [PATCH 5/8] pin cf-xarray lower

---
 environment.yml       | 2 +-
 requirements.txt      | 2 +-
 requirements_docs.txt | 2 +-
 3 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/environment.yml b/environment.yml
index 8cce36fe..8fd7723e 100644
--- a/environment.yml
+++ b/environment.yml
@@ -7,7 +7,7 @@ dependencies:
   - anyascii
   - bottleneck
   - cftime
-  - cf_xarray >=0.6.1,<0.9.4
+  - cf_xarray >=0.6.1,<0.9.3
   - click >=8.0.0
   - clisops >=0.11.0
   - dask
diff --git a/requirements.txt b/requirements.txt
index 1a8b6bee..a5e884b1 100644
--- a/requirements.txt
+++ b/requirements.txt
@@ -1,7 +1,7 @@
 anyascii
 bottleneck
 cftime
-cf-xarray>=0.6.1,<0.9.4
+cf-xarray>=0.6.1,<0.9.3
 click>=8.0.0
 clisops>=0.11.0
 dask[complete]
diff --git a/requirements_docs.txt b/requirements_docs.txt
index 2a292a30..8b749271 100644
--- a/requirements_docs.txt
+++ b/requirements_docs.txt
@@ -1,7 +1,7 @@
 anyascii
 birdhouse-birdy>=0.8.1
 cftime
-cf-xarray>=0.6.1,<0.9.4
+cf-xarray>=0.6.1,<0.9.3
 ipython
 matplotlib
 nbsphinx

From cb967e5534ec7bea17395b15fa758b563bd39dd1 Mon Sep 17 00:00:00 2001
From: Zeitsperre <10819524+Zeitsperre@users.noreply.github.com>
Date: Thu, 18 Jul 2024 15:10:53 -0400
Subject: [PATCH 6/8] fix permissions

---
 .github/workflows/bump-version-tag.yml |  1 -
 .github/workflows/docker-testing.yml   | 10 +++++++++-
 .github/workflows/label.yml            |  2 --
 .github/workflows/main.yml             |  8 ++++++++
 4 files changed, 17 insertions(+), 4 deletions(-)

diff --git a/.github/workflows/bump-version-tag.yml b/.github/workflows/bump-version-tag.yml
index 45671d1e..852ee334 100644
--- a/.github/workflows/bump-version-tag.yml
+++ b/.github/workflows/bump-version-tag.yml
@@ -36,7 +36,6 @@ jobs:
     runs-on: ubuntu-latest
     permissions:
       actions: read
-      contents: write
     steps:
       - name: Harden Runner
         uses: step-security/harden-runner@17d0e2bd7d51742c71671bd19fa12bdc9d40a3d6 # v2.8.1
diff --git a/.github/workflows/docker-testing.yml b/.github/workflows/docker-testing.yml
index d3b8bf2d..4057b070 100644
--- a/.github/workflows/docker-testing.yml
+++ b/.github/workflows/docker-testing.yml
@@ -22,7 +22,15 @@ jobs:
       - name: Harden Runner
         uses: step-security/harden-runner@17d0e2bd7d51742c71671bd19fa12bdc9d40a3d6 # v2.8.1
         with:
-          egress-policy: audit
+          disable-sudo: true
+          egress-policy: block
+          allowed-endpoints: >
+            auth.docker.io:443
+            conda.anaconda.org:443
+            github.com:443
+            production.cloudflare.docker.com:443
+            pypi.org:443
+            registry-1.docker.io:443
       - name: Checkout Repository
         uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4.1.7
       - name: Set up Docker Buildx
diff --git a/.github/workflows/label.yml b/.github/workflows/label.yml
index 377b87ad..bee6ff10 100644
--- a/.github/workflows/label.yml
+++ b/.github/workflows/label.yml
@@ -24,8 +24,6 @@ jobs:
     name: Label
     runs-on: ubuntu-latest
     permissions:
-      checks: write
-      contents: read
       pull-requests: write
     steps:
       - name: Harden Runner
diff --git a/.github/workflows/main.yml b/.github/workflows/main.yml
index 1ddf1854..ca700df3 100644
--- a/.github/workflows/main.yml
+++ b/.github/workflows/main.yml
@@ -19,6 +19,10 @@ jobs:
     name: Code linting
     runs-on: ubuntu-latest
     steps:
+      - name: Harden Runner
+        uses: step-security/harden-runner@17d0e2bd7d51742c71671bd19fa12bdc9d40a3d6 # v2.8.1
+        with:
+          egress-policy: audit
       - name: Checkout Repository
         uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4.1.7
       - name: Set up Python${{ matrix.python-version }}
@@ -43,6 +47,10 @@ jobs:
         matrix:
             python-version: ["3.8", "3.9", "3.10", "3.11"]
     steps:
+      - name: Harden Runner
+        uses: step-security/harden-runner@17d0e2bd7d51742c71671bd19fa12bdc9d40a3d6 # v2.8.1
+        with:
+          egress-policy: audit
       - name: Checkout Repository
         uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4.1.7
       - name: Setup Conda (Micromamba) with Python${{ matrix.python-version }}

From 0213e7efd8ced7e75819c1fbf06a289ae01fe925 Mon Sep 17 00:00:00 2001
From: Trevor James Smith <10819524+Zeitsperre@users.noreply.github.com>
Date: Tue, 23 Jul 2024 09:41:09 -0400
Subject: [PATCH 7/8] fix secret names

---
 .github/workflows/bump-version-tag.yml | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/.github/workflows/bump-version-tag.yml b/.github/workflows/bump-version-tag.yml
index 852ee334..8d500086 100644
--- a/.github/workflows/bump-version-tag.yml
+++ b/.github/workflows/bump-version-tag.yml
@@ -51,8 +51,8 @@ jobs:
         id: token_generator
         uses: actions/create-github-app-token@31c86eb3b33c9b601a1f60f98dcbfd1d70f379b4 # v1.10.3
         with:
-          app-id: ${{ secrets.OURANOS_HELPER_BOT_ID }}
-          private-key: ${{ secrets.OURANOS_HELPER_BOT_KEY }}
+          app-id: ${{ secrets.BIRDHOUSE_HELPER_BOT_ID }}
+          private-key: ${{ secrets.BIRDHOUSE_HELPER_BOT_KEY }}
       - name: Checkout Repository
         uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4.1.7
         with:
@@ -64,8 +64,8 @@ jobs:
       - name: Import GPG Key
         uses: crazy-max/ghaction-import-gpg@01dd5d3ca463c7f10f7f4f7b4f177225ac661ee4 # v6.1.0
         with:
-          gpg_private_key: ${{ secrets.OURANOS_HELPER_BOT_GPG_PRIVATE_KEY }}
-          passphrase: ${{ secrets.OURANOS_HELPER_BOT_GPG_PRIVATE_KEY_PASSWORD }}
+          gpg_private_key: ${{ secrets.BIRDHOUSE_HELPER_BOT_GPG_PRIVATE_KEY }}
+          passphrase: ${{ secrets.BIRDHOUSE_HELPER_BOT_GPG_PRIVATE_KEY_PASSWORD }}
           git_user_signingkey: true
           git_commit_gpgsign: true
           trust_level: 5

From 8ffa459400cab4c4048ddd012b1e32e26d522a4c Mon Sep 17 00:00:00 2001
From: Trevor James Smith <10819524+Zeitsperre@users.noreply.github.com>
Date: Tue, 23 Jul 2024 10:25:57 -0400
Subject: [PATCH 8/8] update changes to changelog

---
 CHANGES.rst               | 191 ++++++++++++++++++++++----------------
 docs/source/changelog.rst |   1 +
 docs/source/changes.rst   |   1 -
 docs/source/index.rst     |   2 +-
 4 files changed, 112 insertions(+), 83 deletions(-)
 create mode 100644 docs/source/changelog.rst
 delete mode 100644 docs/source/changes.rst

diff --git a/CHANGES.rst b/CHANGES.rst
index 76208ebe..a0f40149 100644
--- a/CHANGES.rst
+++ b/CHANGES.rst
@@ -1,14 +1,26 @@
-Changes
-*******
+=========
+Changelog
+=========
+
+v0.13.0 (unreleased)
+--------------------
+
+* Added support for Birdhouse Helper Bot (for bumping versions).
+* CI Actions and Python dependencies are now pinned to hashes.
+* Permissions have been set for all workflows.
+* Pinned `cf-xarray`` below v0.9.3.
+* Reformatted and renamed `CHANGES.rst` to `CHANGELOG.rst`.
+
+v0.12.1 (2024-06-25)
+--------------------
 
-0.12.1 (2024-06-25)
-===================
 * Replaced `unidecode` with `anyascii` due to a licensing issue.
 * Synchronized some dependencies across build systems.
 * Added a workaround in ``wps_geoseries_to_netcdf`` to handle a `pandas` v2.0 behaviour change.
 
-0.12.0 (2024-03-25)
-===================
+v0.12.0 (2024-03-25)
+--------------------
+
 * Renamed the installed package from `finch` to `birdhouse-finch`.
 * First release of the `birdhouse-finch` package on PyPI.
 * Versioning now adheres to SemVer v2.0.0.
@@ -21,13 +33,15 @@ Changes
 * Cleaned up the setup code.
 * Added more files to be ignored in the `.gitignore` and in the `Manifest.in`.
 
-0.11.4 (2023-12-20)
-===================
+v0.11.4 (2023-12-20)
+--------------------
+
 * Fixed a bug that occurred when fixing a broken cftime-index with newer `cftime` versions.
 * Placed pins on xarray and pandas to prevent future errors from changes to frequency codes.
 
-0.11.3 (2023-08-23)
-===================
+v0.11.3 (2023-08-23)
+--------------------
+
 * Updated ReadTheDocs to use the new mambaforge version (`2022.9`).
 * Addressed calls in GitHub Action usage that were emitting warnings.
 * Updated `MANIFEST.in` to include and exclude the relevant files for the source distribution.
@@ -38,8 +52,9 @@ Changes
 * Sorted software requirements for legibility.
 * Removed Travis-CI shell script.
 
-0.11.2 (2023-07-27)
-===================
+v0.11.2 (2023-07-27)
+--------------------
+
 * Added a Docker-based testing suite to the GitHub Workflows.
 * Added a wider range of Python versions to test against in the GitHub Workflows.
 * Migrated conda-build action from mamba-org/provision-with-micromamba to mamba-org/setup-micromamba.
@@ -49,8 +64,9 @@ Changes
 * Added a GitHub Workflow to bump the version number and to create tags from the version bumping process on dispatch.
 * Added a pre-commit hook for validating the ReadTheDocs configuration and GitHub Workflows.
 
-0.11.1 (2023-06-19)
-===================
+v0.11.1 (2023-06-19)
+--------------------
+
 * Update to xclim 0.43.0.
 * Added xclim yml module support:
     - Added humidex days above calculation via yml module.
@@ -58,15 +74,17 @@ Changes
 * Fixed bug for CanDCS-U6 ensemble "26models" list.
 * Passing an empty string to `ensemble_percentiles` in ensemble processes will return the merged un-reduced ensemble. The different members are listed along the `realization` coordinates through raw names allowing for basic distinction between the input members.
 
-0.11.0 (2023-06-13)
-===================
+v0.11.0 (2023-06-13)
+--------------------
+
 * Fixed iter_local when depth > 0 to avoid all files to be considered twice
 * Revised documentation configuration on ReadTheDocs to leverage Anaconda (Mambaforge)
 * Minor adjustments to dependency configurations
 * Removed configuration elements handling from `finch start`. One can still pass custom config files, but all configuration defaults are handled by `finch/default.cfg` and the WSGI function. `jinja2` is not a dependency anymore.
 
-0.10.0 (2022-11-04)
-===================
+v0.10.0 (2022-11-04)
+--------------------
+
 * Generalize ensemble datasets configuration.
     - Datasets usable by ensemble processes are now specified through a YAML file which is pointed to in the configuration.
     - As a consequence processes are generated according to the available variables. Similarly for the allowed values of some inputs on these processes.
@@ -77,40 +95,45 @@ Changes
 * Update to xclim 0.38.0.
 * Improved subset_grid_point_dataset & subset_bbox_dataset performance when using local files.
 
-0.9.2 (2022-07-19)
-==================
+v0.9.2 (2022-07-19)
+-------------------
+
 * Fix Finch unable to startup in the Docker image.
 
-0.9.1 (2022-07-07)
-==================
+v0.9.1 (2022-07-07)
+-------------------
+
 * Avoid using a broken version of ``libarchive`` in the Docker image.
 
-0.9.0 (2022-07-06)
-==================
+v0.9.0 (2022-07-06)
+------------------
+
 * Fix use of ``output_name``, add ``output_format`` to xclim indicators.
 * Change all outputs to use ``output`` as the main output field name (instead of ``output_netcdf``).
-* Updated to xclim 0.37:
-
+* Updated to xclim 0.37.0:
     - Percentile inputs of xclim indicators have been renamed with generic names, excluding an explicit mention to the target percentile.
     - In ensemble processes, these percentiles can now be chosen through ``perc_[var]`` inputs. The default values are inherited from earlier versions of xclim.
 * Average shape process downgraded to be single-threaded, as ESMF seems to have issues with multithreading.
 * Removed deprecated processes ``subset_ensemble_bbox_BCCAQv2``, ``subset_ensemble_BCCAQv2`` and ``BCCAQv2_heat_wave_frequency_gridpoint``.
 * Added ``csv_precision`` to all processes allowing CSV output. When given, it controls the number of decimal places in the output.
 
-0.8.3 (2022-04-21)
-==================
+v0.8.3 (2022-04-21)
+-------------------
+
 * Preserve RCP dimension in ensemble processes, even when only RCP is selected.
 * Pin ``dask`` and ``distributed`` at ``2022.1.0``, see https://github.com/Ouranosinc/PAVICS-e2e-workflow-tests/issues/100
 
-0.8.2 (2022-02-07)
-==================
+v0.8.2 (2022-02-07)
+-------------------
+
 * Add ``geoseries_to_netcdf`` process, converting a geojson (like a OGC-API request) to a CF-compliant netCDF.
 * Add ``output_name`` argument to most processes (excepted subsetting and averaging processes), to control the name (or prefix) of the output file.
 * New dependency ``python-slugify`` to ensure filenames are safe and valid.
 * Pinning dask to ``<=2022.1.0`` to avoid a performance issue with ``2022.1.1``.
 
-0.8.0 (2022-01-13)
-==================
+v0.8.0 (2022-01-13)
+-------------------
+
 * Add ``hourly_to_daily`` process, converting hourly data to daily data using a reduction operation (sum, mean, max, min).
 * Upgrade to clisops 0.8.0 to accelerate spatial averages over regions.
 * Upgrade to xesmf 0.6.2 to fix spatial averaging bug not weighing correctly cells with varing areas.
@@ -120,57 +143,63 @@ Notes
 -----
 * Upgrading to birdy 0.8.1 will remove annoying warnings when accessing netCDF files from THREDDS.
 
-0.7.7 (2021-11-16)
-==================
+v0.7.7 (2021-11-16)
+-------------------
+
 * Fix Sentry SDK initialization error
 
-0.7.6 (2021-11-16)
-==================
+v0.7.6 (2021-11-16)
+-------------------
+
 * Update to xclim 0.31
 * Added `SENTRY_ENV` configuration
 * Possibility to pass multiple "rcp" inputs for ensemble processes.
 * Writing to netcdf is done only after calling ``load()`` to avoid locks occurring within dask calls to ``to_netcdf`` in multi-processing mode.
 * Add an ``average`` parameter to ensemble processes. When true, a spatial average is returned.
 
-0.7.5 (2021-09-07)
-==================
-* Update to xclim 0.27
+v0.7.5 (2021-09-07)
+-------------------
+
+* Update to xclim 0.27.0
 * Added ``empirical_quantile_mapping`` process calling ``xclim.sdba.EmpiricalQuantileMapping``.
 * Update to PyWPS 4.4.5
 
-0.7.4 (2021-05-04)
-==================
-* Update to xclim 0.26.
+v0.7.4 (2021-05-04)
+-------------------
+
+* Update to xclim 0.26.0.
 * Default metadata attributes are given through configuration, instead of being hardcoded.
 * Inclusion of a list of input dataset urls in ensemble processes.
 * Correct ensemble statistics on day-of-year indicators.
 
-0.7.3 (2021-04-13)
-==================
+v0.7.3 (2021-04-13)
+-------------------
+
 * Workaround for clisops shutting down logging
 * More flexible chunking
 * New subsetting & averaging notebook
 * Require xESMF>=0.5.3
 
-0.7.2 (2021-04-01)
-==================
+v0.7.2 (2021-04-01)
+-------------------
+
 * Add `data_validation` and `cf_compliance` arguments for ensemble xclim processes.
 
-0.7.1 (2021-03-25)
-==================
+v0.7.1 (2021-03-25)
+-------------------
+
 * Add `data_validation` and `cf_compliance` arguments for xclim processes.
 * Skip `data_validation` checks for the BCCAQv2HeatWave process.
 
-
-0.7.0 (2021-03-15)
-==================
+v0.7.0 (2021-03-15)
+-------------------
 
 * Add new process averaging gridded fields over a polygon using xESMF
 * Update to xclim 0.24, allowing for considerable simplification of the indicator process building mechanism
 * Update to PyWPS 4.4
 
-0.6.1 (2021-01-26)
-==================
+v0.6.1 (2021-01-26)
+-------------------
 
 * Add partial support for xclim 0.23 with new indicators
 * Add support for land indicators
@@ -179,8 +208,8 @@ Notes
 * Fix bug in variable name inference
 * Add support for non-standard variable name (univariate case only)
 
-0.6.0 (2021-01-12)
-==================
+v0.6.0 (2021-01-12)
+-------------------
 
 * fix to chunk regions of subsetted files
 * use `cruft` to propagate changes from the birdhouse cookiecutter
@@ -190,33 +219,33 @@ Notes
 * add partial support for xclim v0.21
 * add support for shapefiles in `subset_shape`
 
-0.5.2 (2020-03-25)
-==================
+v0.5.2 (2020-03-25)
+-------------------
 
 * fix to remove realization coordinate from ensembles
 * added chunk datasets for local files also
 * update xclim to == 0.15.2
 
-0.5.1 (2020-03-18)
-==================
+v0.5.1 (2020-03-18)
+-------------------
 
 * fix local bccaqv2 files filtering
 
-0.5.0 (2020-03-18)
-==================
+v0.5.0 (2020-03-18)
+-------------------
 
 * update xclim to 0.15.0
 * add french translation of processes abstract and descriptions
 
-0.4.1 (2020-03-12)
-==================
+v0.4.1 (2020-03-12)
+-------------------
 
 * fix #103 (drs_filename) add defaults when `project_id` is unknown
 * drs_filenames: use dash instead of underscores in variable names
 * fix #80 frequency attrs of computed datasets
 
-0.4.0 (2020-03-10)
-==================
+v0.4.0 (2020-03-10)
+-------------------
 
 * Add ensembles processes
 * Allow ensemble process to specify which models are included
@@ -229,8 +258,8 @@ Notes
 * Pin PyWPS to 4.2.4
 * Add DODS to supported formats for resources
 
-0.3.x (2020-01-17)
-==================
+v0.3.x (2020-01-17)
+-------------------
 
 * Extract common inputs and outputs to wpsio.py
 * Speed up CSV creation
@@ -244,42 +273,42 @@ Notes
 * deprecate lon0 and lat0 for SubsetGridPointBCCAQV2Process
 * change point subset processes to accept a comma separated list of floats for multiple grid cells
 
-0.2.7 (2019-12-09)
-==================
+v0.2.7 (2019-12-09)
+-------------------
 
 * Fix for segmentation fault in libnetcdf (pin version to 4.6.2 until a fix is released)
 
-0.2.6 (2019-12-04)
-==================
+v0.2.6 (2019-12-04)
+-------------------
 
 * Notebooks are tested by Travis-CI
 * Bug fix
 * Update `xclim` to >= 0.12.2
 * Update `pywps` to > 4.2.3
 
-0.2.5 (2019-10-03)
-==================
+v0.2.5 (2019-10-03)
+-------------------
 
 * Add test for DAP input to subsetting
 * Update notebook to run on the Jenkins test suite
 
-0.2.3 (2019-05-27)
-==================
+v0.2.3 (2019-05-27)
+-------------------
 
 * Allow creating CSV output
 * Keep global attributes when computing indices
 * Add BCCAQV2HeatWave process
 * Add basic usage notebook
 
-0.2.1 (2019-05-06)
-==================
+v0.2.1 (2019-05-06)
+-------------------
 
 * Require Python>=3.6
 * Fix percentages in status update
 * Improve loggin
 
-0.2 (2019-05-02)
-================
+v0.2.0 (2019-05-02)
+-------------------
 
 * Added subset_gridpoint process
 * Support DAP links
@@ -290,7 +319,7 @@ Notes
 * Include Dockerfile
 * Use processes instead of threads
 
-0.1 (2018-11-15)
-================
+v0.1.0 (2018-11-15)
+-------------------
 
 * First release.
diff --git a/docs/source/changelog.rst b/docs/source/changelog.rst
new file mode 100644
index 00000000..09929fe4
--- /dev/null
+++ b/docs/source/changelog.rst
@@ -0,0 +1 @@
+.. include:: ../../CHANGELOG.rst
diff --git a/docs/source/changes.rst b/docs/source/changes.rst
deleted file mode 100644
index d76c92b6..00000000
--- a/docs/source/changes.rst
+++ /dev/null
@@ -1 +0,0 @@
-.. include:: ../../CHANGES.rst
diff --git a/docs/source/index.rst b/docs/source/index.rst
index 9063f816..a39989db 100644
--- a/docs/source/index.rst
+++ b/docs/source/index.rst
@@ -14,7 +14,7 @@
 
    processes
    authors
-   changes
+   changelog
 
 Indices and tables
 ==================