Update actions and change defaults of compression (fix vars) (#3042)

* Update actions and change defaults of compression (fix vars)

* Unique location for branches

9 files changed, 162 insertions, 9 deletions

diff --git a/.github/workflows/clang-format-check.yml b/.github/workflows/clang-format-check.yml
index 70809a1..56d2b48 100644
--- a/.github/workflows/clang-format-check.yml
+++ b/.github/workflows/clang-format-check.yml
@@ -1,6 +1,8 @@
 name: clang-format Check
 on:
   pull_request:
+permissions:
+  contents: read
 jobs:
   formatting-check:
     name: Formatting Check
diff --git a/.github/workflows/clang-format-fix.yml b/.github/workflows/clang-format-fix.yml
index 00d2352..5981118 100644
--- a/.github/workflows/clang-format-fix.yml
+++ b/.github/workflows/clang-format-fix.yml
@@ -11,11 +11,15 @@ name: clang-format Commit Changes
 on: 
   workflow_dispatch:
   push:
+permissions:
+  contents: read
 jobs:
   formatting-check:
     name: Commit Format Changes
     runs-on: ubuntu-latest
     if: "!contains(github.event.head_commit.message, 'skip-ci')"
+    permissions:
+        contents: write # In order to allow EndBug/add-and-commit to commit changes
     steps:
     - uses: actions/checkout@v3
     - name: Fix C and Java formatting issues detected by clang-format
diff --git a/.github/workflows/cmake-ctest.yml b/.github/workflows/cmake-ctest.yml
index 9a05afd..083b595 100644
--- a/.github/workflows/cmake-ctest.yml
+++ b/.github/workflows/cmake-ctest.yml
@@ -9,6 +9,9 @@ on:
         required: true
         type: string
 
+permissions:
+  contents: read
+
 # A workflow run is made up of one or more jobs that can run sequentially or
 # in parallel
 jobs:
diff --git a/.github/workflows/codespell.yml b/.github/workflows/codespell.yml
index ddf1038..37294bf 100644
--- a/.github/workflows/codespell.yml
+++ b/.github/workflows/codespell.yml
@@ -3,6 +3,8 @@
 # https://github.com/codespell-project/actions-codespell
 name: codespell
 on: [push, pull_request]
+permissions:
+  contents: read
 jobs:
   codespell:
     name: Check for spelling errors
diff --git a/.github/workflows/daily-build.yml b/.github/workflows/daily-build.yml
index 8770c56..64da61c 100644
--- a/.github/workflows/daily-build.yml
+++ b/.github/workflows/daily-build.yml
@@ -20,9 +20,11 @@ jobs:
     if: ${{ needs.call-workflow-tarball.outputs.has_changes == 'true' }}
 
   call-workflow-release:
-    needs: call-workflow-ctest
+    needs: [call-workflow-tarball, call-workflow-ctest]
     uses: ./.github/workflows/release.yml
     with:
       file_base: ${{ needs.call-workflow-tarball.outputs.file_base }}
+      file_branch: ${{ needs.call-workflow-tarball.outputs.file_branch }}
+      file_sha: ${{ needs.call-workflow-tarball.outputs.file_sha }}
     if: ${{ needs.call-workflow-tarball.outputs.has_changes == 'true' }}
 
diff --git a/.github/workflows/hdfeos5.yml b/.github/workflows/hdfeos5.yml
index 03c9746..089e8df 100644
--- a/.github/workflows/hdfeos5.yml
+++ b/.github/workflows/hdfeos5.yml
@@ -19,6 +19,9 @@ concurrency:
   group: ${{ github.workflow }}-${{ github.sha || github.event.pull_request.number }}
   cancel-in-progress: true
 
+permissions:
+  contents: read
+
 jobs:
   build:
     name: Build hdfeos5
diff --git a/.github/workflows/main.yml b/.github/workflows/main.yml
index 277262c..da65941 100644
--- a/.github/workflows/main.yml
+++ b/.github/workflows/main.yml
@@ -20,6 +20,9 @@ concurrency:
   group: ${{ github.workflow }}-${{ github.sha || github.event.pull_request.number }}
   cancel-in-progress: true
 
+permissions:
+  contents: read
+
 # A workflow run is made up of one or more jobs that can run sequentially or
 # in parallel. We just have one job, but the matrix items defined below will
 # run in parallel.
@@ -79,7 +82,9 @@ jobs:
             fortran: OFF
             java: ON
             libaecfc: ON
+            localaec: OFF
             zlibfc: ON
+            localzlib: OFF
             parallel: OFF
             mirror_vfd: OFF
             direct_vfd: OFF
@@ -96,7 +101,9 @@ jobs:
             fortran: ON
             java: ON
             libaecfc: ON
+            localaec: OFF
             zlibfc: ON
+            localzlib: OFF
             parallel: OFF
             mirror_vfd: ON
             direct_vfd: ON
@@ -155,7 +162,9 @@ jobs:
             fortran: OFF
             java: ON
             libaecfc: ON
+            localaec: OFF
             zlibfc: ON
+            localzlib: OFF
             parallel: OFF
             mirror_vfd: ON
             direct_vfd: OFF
@@ -287,6 +296,7 @@ jobs:
               cmake: "Debug"
               autotools: "debug"
 
+          # Debug -Werror
           - name: "Ubuntu gcc Autotools -Werror (build only)"
             os: ubuntu-latest
             cpp: enable
@@ -310,6 +320,7 @@ jobs:
               cmake: "Debug"
               autotools: "debug"
 
+          # Production/Release -Werror
           - name: "Ubuntu gcc Autotools -Werror (build only)"
             os: ubuntu-latest
             cpp: enable
@@ -454,7 +465,7 @@ jobs:
           cd "${{ runner.workspace }}/build"
           ${{ matrix.flags }} $GITHUB_WORKSPACE/configure --enable-build-mode=${{ matrix.build_mode.autotools }} --${{ matrix.deprec_sym }}-deprecated-symbols --with-default-api-version=${{ matrix.default_api }} --enable-shared --${{ matrix.parallel }}-parallel --${{ matrix.cpp }}-cxx --${{ matrix.fortran }}-fortran --${{ matrix.java }}-java --${{ matrix.mirror_vfd }}-mirror-vfd --${{ matrix.direct_vfd }}-direct-vfd --with-szlib=${{ matrix.szip }}
         shell: bash
-        if: (matrix.generator == 'autogen') && (! matrix.thread_safe.enabled)
+        if: (matrix.generator == 'autogen') && ! (matrix.thread_safety.enabled)
 
       - name: Autotools Configure (Thread-Safe)
         run: |
@@ -463,7 +474,7 @@ jobs:
           cd "${{ runner.workspace }}/build"
           ${{ matrix.flags }} $GITHUB_WORKSPACE/configure --enable-build-mode=${{ matrix.build_mode.autotools }} --enable-shared --enable-threadsafe --disable-hl --${{ matrix.parallel }}-parallel --${{ matrix.mirror_vfd }}-mirror-vfd --${{ matrix.direct_vfd }}-direct-vfd --with-szlib=${{ matrix.szip }}
         shell: bash
-        if: (matrix.generator == 'autogen') && (matrix.thread_safe.enabled)
+        if: (matrix.generator == 'autogen') && (matrix.thread_safety.enabled)
 
       #
       # CMAKE CONFIGURE
@@ -473,18 +484,18 @@ jobs:
         run: |
           mkdir "${{ runner.workspace }}/build"
           cd "${{ runner.workspace }}/build"
-          cmake ${{ matrix.generator }} -DCMAKE_BUILD_TYPE=${{ matrix.build_mode.cmake }} -DCMAKE_TOOLCHAIN_FILE=${{ matrix.toolchain }} -DBUILD_SHARED_LIBS=ON -DHDF5_ENABLE_ALL_WARNINGS=ON -DHDF5_ENABLE_PARALLEL:BOOL=${{ matrix.parallel }} -DHDF5_BUILD_CPP_LIB:BOOL=${{ matrix.cpp }} -DHDF5_BUILD_FORTRAN=${{ matrix.fortran }} -DHDF5_BUILD_JAVA=${{ matrix.java }} -DBUILD_SZIP_WITH_FETCHCONTENT=${{ matrix.libaecfc }} -DBUILD_ZLIB_WITH_FETCHCONTENT=${{ matrix.zlibfc }} -DHDF5_ENABLE_MIRROR_VFD:BOOL=${{ matrix.mirror_vfd }} -DHDF5_ENABLE_DIRECT_VFD:BOOL=${{ matrix.direct_vfd }} $GITHUB_WORKSPACE
+          cmake -C $GITHUB_WORKSPACE/config/cmake/cacheinit.cmake ${{ matrix.generator }} -DCMAKE_BUILD_TYPE=${{ matrix.build_mode.cmake }} -DCMAKE_TOOLCHAIN_FILE=${{ matrix.toolchain }} -DBUILD_SHARED_LIBS=ON -DHDF5_ENABLE_ALL_WARNINGS=ON -DHDF5_ENABLE_PARALLEL:BOOL=${{ matrix.parallel }} -DHDF5_BUILD_CPP_LIB:BOOL=${{ matrix.cpp }} -DHDF5_BUILD_FORTRAN=${{ matrix.fortran }} -DHDF5_BUILD_JAVA=${{ matrix.java }} -DBUILD_SZIP_WITH_FETCHCONTENT=${{ matrix.libaecfc }} -DLIBAEC_USE_LOCALCONTENT=${{ matrix.localaec }} -DBUILD_ZLIB_WITH_FETCHCONTENT=${{ matrix.zlibfc }} -DZLIB_USE_LOCALCONTENT=${{ matrix.localzlib }} -DHDF5_ENABLE_MIRROR_VFD:BOOL=${{ matrix.mirror_vfd }} -DHDF5_ENABLE_DIRECT_VFD:BOOL=${{ matrix.direct_vfd }} $GITHUB_WORKSPACE
         shell: bash
-        if: (matrix.generator != 'autogen') && (! matrix.thread_safe.enabled)
+        if: (matrix.generator != 'autogen') && ! (matrix.thread_safety.enabled)
 
 
       - name: CMake Configure (Thread-Safe)
         run: |
           mkdir "${{ runner.workspace }}/build"
           cd "${{ runner.workspace }}/build"
-          cmake ${{ matrix.generator }} -DCMAKE_BUILD_TYPE=${{ matrix.build_mode.cmake }} -DCMAKE_TOOLCHAIN_FILE=${{ matrix.toolchain }} -DBUILD_SHARED_LIBS=ON -DHDF5_ENABLE_ALL_WARNINGS=ON -DHDF5_ENABLE_THREADSAFE:BOOL=ON -DHDF5_ENABLE_PARALLEL:BOOL=${{ matrix.parallel }} -DHDF5_BUILD_HL_LIB:BOOL=OFF -DHDF5_ENABLE_MIRROR_VFD:BOOL=${{ matrix.mirror_vfd }} -DHDF5_ENABLE_DIRECT_VFD:BOOL=${{ matrix.direct_vfd }} $GITHUB_WORKSPACE
+          cmake -C $GITHUB_WORKSPACE/config/cmake/cacheinit.cmake ${{ matrix.generator }} -DCMAKE_BUILD_TYPE=${{ matrix.build_mode.cmake }} -DCMAKE_TOOLCHAIN_FILE=${{ matrix.toolchain }} -DBUILD_SHARED_LIBS=ON -DHDF5_ENABLE_ALL_WARNINGS=ON -DHDF5_ENABLE_THREADSAFE:BOOL=ON -DHDF5_ENABLE_PARALLEL:BOOL=${{ matrix.parallel }} -DHDF5_BUILD_CPP_LIB:BOOL=OFF -DHDF5_BUILD_FORTRAN:BOOL=OFF -DHDF5_BUILD_JAVA:BOOL=OFF -DHDF5_BUILD_HL_LIB:BOOL=OFF -DBUILD_SZIP_WITH_FETCHCONTENT=${{ matrix.libaecfc }} -DLIBAEC_USE_LOCALCONTENT=${{ matrix.localaec }} -DBUILD_ZLIB_WITH_FETCHCONTENT=${{ matrix.zlibfc }} -DZLIB_USE_LOCALCONTENT=${{ matrix.localzlib }} -DHDF5_ENABLE_MIRROR_VFD:BOOL=${{ matrix.mirror_vfd }} -DHDF5_ENABLE_DIRECT_VFD:BOOL=${{ matrix.direct_vfd }} $GITHUB_WORKSPACE
         shell: bash
-        if: (matrix.generator != 'autogen') && (matrix.thread_safe.enabled)
+        if: (matrix.generator != 'autogen') && (matrix.thread_safety.enabled)
 
       #
       # BUILD
@@ -498,16 +509,18 @@ jobs:
       - name: CMake Build
         run: cmake --build . --parallel 3 --config ${{ matrix.build_mode.cmake }}
         working-directory: ${{ runner.workspace }}/build
-        if: matrix.generator != 'autogen'
+        if: (matrix.generator != 'autogen')
 
       #
       # RUN TESTS
       #
 
+      # NORMAL
+
       - name: Autotools Run Tests
         run: make check -j2
         working-directory: ${{ runner.workspace }}/build
-        if: (matrix.generator == 'autogen') && (matrix.run_tests)
+        if: (matrix.generator == 'autogen') && (matrix.run_tests) && ! (matrix.thread_safety.enabled)
 
       - name: CMake Run Tests
         run: ctest --build . --parallel 2 -C ${{ matrix.build_mode.cmake }} -V
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
new file mode 100644
index 0000000..16285d6
--- /dev/null
+++ b/.github/workflows/release.yml
@@ -0,0 +1,115 @@
+name: hdf5 1.14 release
+
+# Controls when the action will run. Triggers the workflow on a schedule
+on:
+  workflow_call:
+    inputs:
+      file_base:
+        description: "The common base name of the source tarballs"
+        required: true
+        type: string
+      file_branch:
+        description: "The branch name for the source tarballs"
+        required: true
+        type: string
+      file_sha:
+        description: "The sha for the source tarballs"
+        required: true
+        type: string
+
+# Previous workflows must pass to get here so tag the commit that created the files
+jobs:
+  create-tag:
+    runs-on: ubuntu-latest
+    permissions:
+        contents: write # In order to allow tag creation
+    steps:
+      # Checks-out your repository under $GITHUB_WORKSPACE, so your job can access it
+      - name: Get Sources
+        uses: actions/checkout@v3
+        with:
+          fetch-depth: 0
+
+      - run: |
+          git checkout ${{ inputs.file_sha }}
+
+      - uses: rickstaa/action-create-tag@v1
+        id: "tag_create"
+        with:
+          commit_sha: ${{ inputs.file_sha }}
+          tag: "snapshot"
+          force_push_tag: true
+          message: "Latest snapshot"
+
+      # Print result using the action output.
+      - run: |
+          echo "Tag already present: ${{ steps.tag_create.outputs.tag_exists }}"
+
+  getfiles:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Set file base name
+        id: set-file-base
+        run: |
+          FILE_NAME_BASE=$(echo "${{ inputs.file_base }}")
+          echo "FILE_BASE=$FILE_NAME_BASE" >> $GITHUB_OUTPUT
+
+      # Get files created by tarball script
+      - name: Get tgz-tarball (Linux)
+        uses: actions/download-artifact@v3
+        with:
+              name: tgz-tarball
+              path: ${{ github.workspace }}
+
+      - name: Get zip-tarball (Windows)
+        uses: actions/download-artifact@v3
+        with:
+              name: zip-tarball
+              path: ${{ github.workspace }}
+
+      # Get files created by cmake-ctest script
+      - name: Get published binary (Windows)
+        uses: actions/download-artifact@v3
+        with:
+              name: zip-vs2022-binary
+              path: ${{ github.workspace }}
+
+      - name: Get published binary (MacOS)
+        uses: actions/download-artifact@v3
+        with:
+              name: tgz-osx12-binary
+              path: ${{ github.workspace }}
+
+      - name: Get published binary (Linux)
+        uses: actions/download-artifact@v3
+        with:
+              name: tgz-ubuntu-2204-binary
+              path: ${{ github.workspace }}
+
+      # Get files used by release script
+
+  PreRelease:
+    runs-on: ubuntu-latest
+    needs: [create-tag, getfiles]
+    environment: snapshots_1_14
+    permissions:
+        contents: write
+    steps:
+      - name: Set file base name
+        id: get-file-base
+        run: |
+          FILE_NAME_BASE=$(echo "${{ inputs.file_base }}")
+          echo "FILE_BASE=$FILE_NAME_BASE" >> $GITHUB_OUTPUT
+
+      - name: PreRelease tag
+        uses: softprops/action-gh-release@v1
+        with:
+          tag_name: "snapshot"
+          prerelease: true
+          files: |
+              ${{ steps.get-file-base.outputs.FILE_BASE }}.tar.gz
+              ${{ steps.get-file-base.outputs.FILE_BASE }}.zip
+              ${{ steps.get-file-base.outputs.FILE_BASE }}-osx12.tar.gz
+              ${{ steps.get-file-base.outputs.FILE_BASE }}-ubuntu-2204.tar.gz
+              ${{ steps.get-file-base.outputs.FILE_BASE }}-win_vs2022.zip
+              if-no-files-found: error # 'warn' or 'ignore' are also available, defaults to `warn`
diff --git a/.github/workflows/tarball.yml b/.github/workflows/tarball.yml
index 54a601c..c186abb 100644
--- a/.github/workflows/tarball.yml
+++ b/.github/workflows/tarball.yml
@@ -10,6 +10,15 @@ on:
       file_base:
         description: "The common base name of the source tarballs"
         value: ${{ jobs.create_tarball.outputs.file_base }}
+      file_branch:
+        description: "The branch used for the source tarballs"
+        value: ${{ jobs.check_commits.outputs.branch_ref }}
+      file_sha:
+        description: "The sha used for the source tarballs"
+        value: ${{ jobs.check_commits.outputs.branch_sha }}
+
+permissions:
+  contents: read
 
 # A workflow run is made up of one or more jobs that can run sequentially or
 # in parallel