Release v1.14.1

.config/dotnet-tools.json

@@ -3,10 +3,10 @@
   "isRoot": true,
   "tools": {
     "dotnet-ef": {
-      "version": "10.0.7",
+      "version": "10.0.9",
       "commands": [
         "dotnet-ef"
       ]
     }
   }
-}
+}

.github/dependabot.yml

@@ -12,3 +12,12 @@ updates:
       all-updates:
         patterns:
           - "*"
+    cooldown:
+      default-days: 7
+  - package-ecosystem: "github-actions"
+    directories:
+      - "/"
+    schedule:
+      interval: "weekly"
+    cooldown:
+      default-days: 7

.github/workflows/check-ruleset.yaml

@@ -1,5 +1,5 @@
 # GitHub Actions Workflow: Check Repository Ruleset
-# 
+#
 # This workflow ensures that the repository's branch protection rules
 # match the expected ruleset defined in the template repository.
 #
@@ -28,39 +28,18 @@ name: Check Repository Ruleset
 
 on:
   push:
-    branches: [main]
+    branches: [dev]
   pull_request:
 
+permissions:
+  contents: read
 jobs:
-  check-ruleset:
-    if: github.actor != 'dependabot[bot]'
-    runs-on: ubuntu-latest
-
-    steps:
-      - name: Checkout repository
-        uses: actions/checkout@v5
-
-      - name: Create GitHub App token
-        id: app-token
-        uses: actions/create-github-app-token@v3
-        with:
-          app-id: ${{ vars.ORG_ACTIONS_BOT_APP_ID }}
-          private-key: ${{ secrets.ORG_ACTIONS_BOT_PRIVATE_KEY }}
-          owner: UoMResearchIT
-
-      - name: Fetch Standard RSE Ruleset
-        id: expected
-        uses: UoMResearchIT/actions/get-repo-ruleset@v0.3
-        with:
-          repository: UoMResearchIT/RSE-Repository-Template
-          token: ${{ steps.app-token.outputs.token }}
-
-      - name: Fetch This Repository's Ruleset
-        id: current
-        uses: UoMResearchIT/actions/get-repo-ruleset@v0.3
-
-      - name: Compare Rulesets
-        uses: UoMResearchIT/actions/check-ruleset-containment@v0.3
-        with:
-          current: ${{ steps.current.outputs.filename }}
-          expected: ${{ steps.expected.outputs.filename }}
+  check:
+    if: github.repository_owner == 'UoMResearchIT'
+    name: Check Ruleset
+    uses: UoMResearchIT/actions/.github/workflows/check-ruleset.yaml@c1106820e385a14b9cfa3c4682b1a1ac11354968 # main
+    with:
+      bot-id: ${{ vars.ORG_ACTIONS_BOT_APP_ID }}
+      ignore: '["require_code_owner_review"]'
+    secrets:
+      bot-key: ${{ secrets.ORG_ACTIONS_BOT_PRIVATE_KEY }}

.github/workflows/docker-images-build-health-check.yml

@@ -2,10 +2,11 @@ name: Docker Images Build and Health Check
 
 on:
   push:
-    branches:
-      - dev
+    branches: [dev]
   pull_request:
 
+permissions:
+  contents: read
 jobs:
   build:
     runs-on: ubuntu-latest
@@ -22,17 +23,19 @@ jobs:
       SUPERUSER_EMAIL: captain.marvel@manchester.ac.uk
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        with:
+          persist-credentials: false
 
       - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@v3
-        
+        uses: docker/setup-buildx-action@d7f5e7f509e45cec5c76c4d5afdd7de93d0b3df5 # v4.1.0
+
       - name: Create state directory for bind mount
         run: mkdir -p capx-state
 
       - name: Build Docker images
         run: docker compose build
-        
+
       - name: Start container and wait for health checks
         run: docker compose up --wait --wait-timeout 120
 

.github/workflows/dotnet.yml

@@ -5,9 +5,8 @@ name: C# .NET
 
 on:
   push:
-    branches: ["dev"]
+    branches: [dev]
   pull_request:
-    branches: ["dev"]
 
 jobs:
   format-check:
@@ -16,26 +15,31 @@ jobs:
     defaults:
       run:
         working-directory: ./PPMTool
+    permissions:
+      contents: read
 
     steps:
       - name: Create GitHub App token
         id: app-token
-        uses: actions/create-github-app-token@v3
+        uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0
         with:
-          app-id: ${{ vars.ORG_ACTIONS_BOT_APP_ID }}
+          client-id: ${{ vars.ORG_ACTIONS_BOT_APP_ID }}
           private-key: ${{ secrets.ORG_ACTIONS_BOT_PRIVATE_KEY }}
           owner: UoMResearchIT
+          # NB: No current submodules; the .gitmodules file is empty
+          repositories: CapX
+          permission-contents: read
 
-      - uses: actions/checkout@v5
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
         with:
           submodules: 'true'
           token: ${{ steps.app-token.outputs.token }}
           persist-credentials: false
 
       - name: Setup .NET
-        uses: actions/setup-dotnet@v5
+        uses: actions/setup-dotnet@9a946fdbd5fb07b82b2f5a4466058b876ab72bb2 # v5.3.0
         with:
           dotnet-version: 10.0.x
 
       - name: Format
-        run: dotnet format PPMTool.sln --exclude ../Blazor-ApexCharts/src/Blazor-ApexCharts.csproj --verify-no-changes --no-restore --verbosity detailed
+        run: dotnet format PPMTool.sln --verify-no-changes --no-restore --verbosity detailed

.github/workflows/license-copyright-add.yml

@@ -4,12 +4,11 @@
 
 name: Add Licence and Copyright Headers
 
-on:
-  pull_request
+on: pull_request
 
 jobs:
   add-headers:
     permissions:
       pull-requests: write
       contents: write
-    uses: UoMResearchIT/actions/.github/workflows/apply-reuse.yml@main
+    uses: UoMResearchIT/actions/.github/workflows/apply-reuse.yml@c1106820e385a14b9cfa3c4682b1a1ac11354968 # main

.github/workflows/naming-conventions.yml

@@ -5,6 +5,7 @@ on:
   pull_request:
     branches:
       - '**'
+permissions: {}
 
 jobs:
   check-repo-name-conventions:
@@ -14,26 +15,31 @@ jobs:
     steps:
       - name: Check repository name
         run: |
-          REPO_NAME=${{ github.repository }}
           REPO_NAME=${REPO_NAME##*/}
           if [[ ! "$REPO_NAME" =~ ^([A-Z][A-Za-z0-9]*)(-[A-Z][A-Za-z0-9]*)*$ ]]; then
             echo "Repository name '$REPO_NAME' does not follow the naming convention established in the RSE Agile Method Handbook."
             exit 1
           fi
-
+        env:
+          REPO_NAME: ${{ github.repository }}
+
   check-branch-name-conventions:
     if: github.event_name == 'pull_request' && github.actor != 'dependabot[bot]'
     runs-on: ubuntu-latest
+    permissions:
+      contents: read
 
     steps:
       - name: Check out repository
-        uses: actions/checkout@v5
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        with:
+          persist-credentials: false
 
       - name: Check branch name
         run: |
-          BRANCH_NAME=${{ github.event.pull_request.head.ref }}
-          if [[ ! "$BRANCH_NAME" =~ ^[a-z0-9]+(-[a-z0-9]+)*$ ]]; then
+          if [[ ! "$BRANCH_NAME" =~ ^(copilot\/)?[a-z0-9]+(-[a-z0-9]+)*$ ]]; then
             echo "Branch name '$BRANCH_NAME' does not follow the naming convention established in the RSE Agile Method Handbook."
             exit 1
           fi
-
+        env:
+          BRANCH_NAME: ${{ github.event.pull_request.head.ref }}

.github/workflows/run-zizmor.yml

@@ -0,0 +1,37 @@
+# Copyright (c) 2026 The University of Manchester
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     https://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+name: GitHub Actions Security Analysis with zizmor 🌈
+
+on:
+  push:
+    branches: [dev]
+  pull_request:
+
+permissions: {}
+
+jobs:
+  zizmor:
+    name: Scan with Zizmor
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        with:
+          persist-credentials: false
+
+      - name: Run zizmor 🌈
+        uses: zizmorcore/zizmor-action@5f14fd08f7cf1cb1609c1e344975f152c7ee938d # v0.5.6
+        with:
+          advanced-security: false

CODEOWNERS

@@ -0,0 +1,6 @@
+# SPDX-FileCopyrightText: 2026 University of Manchester
+#
+# SPDX-License-Identifier: apache-2.0
+
+# Everything
+* @aharwood2 @PhilBradbury @sjmf @philiptharrison @gdonval

CONTRIBUTING.md

@@ -22,10 +22,10 @@ By contributing to this repository, you agree that your contributions will be li
 
 This project is open source and welcomes contributions from the wider community. However, its development and release process follows a structured governance model.
 
-- The software is owned and licensed by **The University of Manchester**.
-- Strategic direction, release planning, and final decisions on what is included in the codebase are managed by the **dRTP Operational Management Community of Practice**.
+- The software was originally developed by **The University of Manchester** and is licensed under an open-source licence.
+- Strategic direction, release planning, and final decisions on what is included in the codebase are managed by the **dRTP Operational Management Community of Practice** funded by the UKRI Digital Research Infrastructure Programme via the DisCouRSE Network Plus flexible fund.
 
-This means that while the repository is open to contributions, inclusion in official releases is determined collectively by this group.
+This means that while the repository is open to contributions, inclusion in official releases is determined collectively by this group. There is no funded development team to address issues but members of the **dRTP Operational Management Community of Practice** will progress priority items on a best-efforts basis.
 
 ## How Contributions Work
 
@@ -48,31 +48,27 @@ If you wish to contribute code:
 
 All pull requests:
 
-- Must pass any configured checks
-- Must be reviewed and approved by members of the Community of Practice before merging
-- May be discussed or refined collaboratively
+- Must pass any configured checks.
+- Must be reviewed and approved by members of the **dRTP Operational Management Community of Practice** before merging.
+- May be discussed or refined collaboratively.
 
 ## Decision Making and Releases
 
 The **dRTP Operational Management Community of Practice**:
 
-- Reviews proposed changes
-- Prioritises development work
-- Determines what changes are accepted
-- Decides when releases are made
+- Reviews proposed changes from the perspective of deployed instances.
+- Prioritises development work based on urgency and impact.
+- Determines what changes are accepted based on a proportionate review process.
+- Decides when releases are made and how they are grouped.
 
-This is similar to governance models used by large open source ecosystems (e.g., .NET), where:
-
-- The project is open and community-driven
-- A defined group maintains responsibility for quality, direction, and release cadence
+This is similar to governance models used by large open-source ecosystems (e.g., .NET), where the project is open and community-driven but defined group maintains responsibility for quality, direction, and release cadence. This review and ratification process will happen at least once a month.
 
 ## Expectations
 
-Please note:
-
-- Not all contributions will be accepted
-- Feature requests may be deferred or declined based on priorities
-- Timelines for review and release are determined by the governing community
+- Not all contributions will be accepted.
+- Feature requests may be deferred based on priorities or declined.
+- Timelines for review and release are determined by the **dRTP Operational Management Community of Practice**.
+- Backwards compatibility should be preserved unless the **dRTP Operational Management Community of Practice** decides otherwise.
 
 ## Code of Conduct
 

PPMTool.Data/Context/PPMToolContext.cs

@@ -70,6 +70,22 @@ protected override void OnConfiguring(DbContextOptionsBuilder optionsBuilder)
         protected override void OnModelCreating(ModelBuilder modelBuilder)
         {
             base.OnModelCreating(modelBuilder);
+
+            // Npgsql v6+ maps DateTime -> timestamptz and rejects Kind=Unspecified.
+            // The codebase uses DateTime.Today/DateTime.Now throughout, which produce
+            // Kind=Unspecified. Map all DateTime columns to timestamp without time zone
+            // so Npgsql treats them as local/unspecified rather than requiring UTC.
+            if (Database.ProviderName == "Npgsql.EntityFrameworkCore.PostgreSQL")
+            {
+                foreach (var entityType in modelBuilder.Model.GetEntityTypes())
+                {
+                    foreach (var property in entityType.GetProperties()
+                        .Where(p => p.ClrType == typeof(DateTime) || p.ClrType == typeof(DateTime?)))
+                    {
+                        property.SetColumnType("timestamp without time zone");
+                    }
+                }
+            }
         }
 
         /// <summary>

PPMTool.Data/Entities/BaseBookableItem.cs

@@ -0,0 +1,25 @@
+// SPDX-FileCopyrightText: 2026 University of Manchester
+//
+// SPDX-License-Identifier: apache-2.0
+
+using PPMTool.Data.Interfaces;
+
+namespace PPMTool.Data.Entities
+{
+    /// <summary>
+    /// An abstract base class for timesheet codes or tasks
+    /// </summary>
+    public abstract class BaseBookableItem : ILoggableObject
+    {
+        /// <summary>
+        /// Whether this item is active and can be booked to
+        /// </summary>
+        public bool IsActive { get; set; } = true;
+
+        /// <summary>
+        /// Pass the interface on to the concrete classes
+        /// </summary>
+        /// <returns></returns>
+        public abstract string GetSensibleObjectName();
+    }
+}