hydrologie · Zeitsperre · Jun 3, 2026 · Jun 3, 2026 · Jun 3, 2026 · Jun 3, 2026
diff --git a/.coveralls.yml b/.coveralls.yml
diff --git a/.cruft.json b/.cruft.json
@@ -1,6 +1,6 @@
 {
   "template": "https://github.com/Ouranosinc/cookiecutter-pypackage",
-  "commit": "cb8b26cb78a428f6ce447a0ab1b08c0c171ad5aa",
+  "commit": "770fc5056ab143530fcee23d7914551956916b8d",
   "checkout": null,
   "context": {
     "cookiecutter": {
@@ -20,10 +20,22 @@
       "command_line_interface": "No command-line interface",
       "create_author_file": "y",
       "open_source_license": "MIT license",
+      "ai_tools_policy": "Standard",
       "generated_with_cruft": "y",
       "__gh_slug": "https://github.com/hydrologie/xdatasets",
+      "_copy_without_render": [
+        ".github/workflows/auto-accept-ci-changes.yml",
+        ".github/workflows/cache-cleaner.yml",
+        ".github/workflows/codeql.yml",
+        ".github/workflows/dependency-review.yml",
+        ".github/workflows/label.yml",
+        ".github/workflows/publish-pypi.yml",
+        ".github/workflows/scorecard.yml",
+        ".github/workflows/tag-testpypi.yml",
+        ".github/workflows/workflow-warning.yml"
+      ],
       "_template": "https://github.com/Ouranosinc/cookiecutter-pypackage",
-      "_commit": "cb8b26cb78a428f6ce447a0ab1b08c0c171ad5aa"
+      "_commit": "770fc5056ab143530fcee23d7914551956916b8d"
     }
   },
   "directory": null

diff --git a/.github/workflows/auto-accept-ci-changes.yml b/.github/workflows/auto-accept-ci-changes.yml
@@ -35,6 +35,8 @@ jobs:
         with:
           app-id: ${{ secrets.HYDROLOGIE_HELPER_BOT_ID }}
           private-key: ${{ secrets.HYDROLOGIE_HELPER_BOT_KEY }}
+          permission-contents: write
+          permission-pull-requests: write
 
       - name: Fetch Dependabot metadata
         id: dependabot-metadata

diff --git a/.github/workflows/bump-version.yml b/.github/workflows/bump-version.yml
@@ -44,7 +44,7 @@ jobs:
     runs-on: ubuntu-latest
     environment: automation
     permissions:
-      actions: read
+      contents: write
     strategy:
       matrix:
         python-version: [ "3.13" ]
@@ -66,14 +66,15 @@ jobs:
         with:
           app-id: ${{ secrets.HYDROLOGIE_HELPER_BOT_ID }}
           private-key: ${{ secrets.HYDROLOGIE_HELPER_BOT_KEY }}
+          permission-contents: write
 
       - name: Checkout Repository
         uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
         with:
           persist-credentials: false
           token: ${{ steps.token_generator.outputs.token }}
 
-      - name: Set up Python3
+      - name: Set up Python${{ matrix.python-version }}
         uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1 # v6.3.0
         with:
           python-version: ${{ matrix.python-version }}

diff --git a/.github/workflows/publish-pypi.yml b/.github/workflows/publish-pypi.yml
@@ -24,13 +24,7 @@ jobs:
         uses: step-security/harden-runner@9af89fc71515a100421586dfdb3dc9c984fbf411 # v2.19.4
         with:
           disable-sudo: true
-          egress-policy: block
-          allowed-endpoints: >
-            files.pythonhosted.org:443
-            github.com:443
-            pypi.org:443
-            ruf-repo-cdn.sigstore.dev:443
-            upload.pypi.org:443
+          egress-policy: audit
 
       - name: Checkout Repository
         uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0

diff --git a/.github/workflows/tag-testpypi.yml b/.github/workflows/tag-testpypi.yml
@@ -51,13 +51,7 @@ jobs:
         uses: step-security/harden-runner@9af89fc71515a100421586dfdb3dc9c984fbf411 # v2.19.4
         with:
           disable-sudo: true
-          egress-policy: block
-          allowed-endpoints: >
-            files.pythonhosted.org:443
-            github.com:443
-            pypi.org:443
-            ruf-repo-cdn.sigstore.dev:443
-            test.pypi.org:443
+          egress-policy: audit
 
       - name: Checkout Repository
         uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0

diff --git a/.readthedocs.yml b/.readthedocs.yml
@@ -11,10 +11,12 @@ sphinx:
   fail_on_warning: true
 
 build:
-  os: "ubuntu-24.04"
+  os: "ubuntu-26.04"
   tools:
-    python: "mambaforge-23.11"
+    python: "miniforge3-25.11"
   jobs:
+    post_create_environment:
+      - python -m pip install --group docs
     pre_build:
       - sphinx-apidoc -o docs/apidoc --private --module-first src/xdatasets
 #      - sphinx-build -M gettext docs docs/_build
@@ -26,5 +28,3 @@ python:
   install:
     - method: pip
       path: .
-      extra_requirements:
-        - docs
diff --git a/AGENTS.md b/AGENTS.md
@@ -0,0 +1,35 @@
+# Agents
+
+Rules for AI coding agents working in this repository.
+
+## General
+
+- Follow existing code conventions and patterns
+- Do not modify files outside the scope of the current task
+- Prefer editing existing files over creating new ones
+- Do not add dependencies without explicit approval
+- Keep changes atomic -- one concern per commit
+- Ask for clarification when requirements are ambiguous
+- Do not generate PR descriptions or review comments on others' code
+
+## Setup
+
+> Add your project's setup commands here (npm install, go build, make, etc.)
+
+## Testing
+
+Write tests for new functionality. Run the full suite before submitting.
+
+## Commits
+
+- Use clear, descriptive commit messages
+- One logical change per commit
+- Reference relevant issues when applicable
+- Include `Assisted-by: <tool name>` trailer on AI-assisted commits
+
+## Review
+
+Changes touching more than one module or any security-relevant code require human review. Minor fixes and doc updates follow the standard process.
+
+---
+*Generated by [aipolicy.1mb.dev](https://aipolicy.1mb.dev) · v1.0*
diff --git a/AI_POLICY.md b/AI_POLICY.md
@@ -0,0 +1,58 @@
+# AI Policy
+
+## Accountability
+
+You are responsible for every line of code you submit, regardless of how it was produced. If you use AI tools, review and verify all output before committing.
+
+## AI Tool Usage
+
+AI tools are permitted. Standard review process applies to all contributions.
+
+## AI-Generated Code
+
+AI-generated code must be reviewed by a human maintainer before merging. Keep changes atomic -- you must be able to explain any line on request.
+
+## Disclosure
+
+Mark AI involvement in commit messages with a trailer:
+
+```text
+Assisted-by: <tool name>
+```
+
+Code changes from less sophisticated phrase-completion tools do not require an AI disclosure.
+
+## Prohibited Uses
+
+- Submitting AI output you have not read and understood
+- Using AI to generate code that circumvents tests or CI checks
+- Feeding reviewer feedback back into AI without understanding it first
+- AI-generated PR descriptions -- describe your own work
+- AI-generated review comments on other contributors' PRs
+
+## AI in CI/CD
+
+AI tools may be used in CI/CD pipelines for code analysis, test generation, and deployment.
+
+## Training Data
+
+This project requests that its code not be used for AI model training. We ask that AI tool providers honor this preference.
+
+## Low Effort Contributions
+
+AI-generated low-effort contributions are unacceptable; Human and AI contributors must be capable of explaining their changes, responding to review comments, and precisely adapting their contributions as requested.
+
+## Licensing
+
+AI-generated contributions must be compatible with this project's license. Contributors must be able to certify their submissions under the project's contribution terms.
+
+## Enforcement
+
+Maintainers may close AI-generated PRs that do not meet these standards without detailed feedback.
+
+## Policy Evolution
+
+This policy will evolve as tooling and conventions change. Contributions to the policy itself are welcome.
+
+---
+*Generated by [aipolicy.1mb.dev](https://aipolicy.1mb.dev) · v1.0*
diff --git a/CHANGELOG.rst b/CHANGELOG.rst
@@ -5,7 +5,7 @@ Changelog
 `Unreleased <https://github.com/hydrologie/xdatasets>`_ (latest)
 ----------------------------------------------------------------
 
-Contributors: Trevor James Smith (:user:`Zeitsperre`)
+Contributors: Trevor James Smith (:user:`Zeitsperre`).
 
 Changes
 ^^^^^^^
@@ -18,17 +18,26 @@ Changes
     * `pre-commit` has been replaced by `prek`.
     * `Makefile` now handles some dependency installation logic.
     * Configuration issues in `tox.toml` have been resolved.
+* `xdatasets` now has guidance documents on acceptable usages of AI and the expected methods of AI usage disclosure. See the documentation for more details.
+* Updated the cookiecutter template to use the latest commit. (:pull:`300`):
+    * Adjusted the permissions for some workflows to address security issues.
+    * Added the new "standard" AI disclosure guidance for code contributions.
+    * Updated the ReadTheDocs configuration to use newer OS and conda images.
+    * Modified ``make servedocs`` to use `sphinx-autobuild` (``make livehtml``).
+    * Added guidance for maintainers on git commit signing and immutable releases.
+    * Adjusted the source distribution inclusion/exclusion list.
+    * Set `bump-my-version` to sign tags by default.
 
 Fixes
 ^^^^^
 * No change.
 
 .. _changes_0.3.9:
 
-`v0.3.9 <https://github.com/hydrologie/xdatasets/tree/0.3.9>`_
-------------------------------------------------------------------------------
+`v0.3.9 <https://github.com/hydrologie/xdatasets/tree/0.3.9>`_ (2026-02-19)
+---------------------------------------------------------------------------
 
-Contributors: Juliette Lavoie (:user:`juliettelavoie`), Trevor James Smith (:user:`Zeitsperre`)
+Contributors: Juliette Lavoie (:user:`juliettelavoie`), Trevor James Smith (:user:`Zeitsperre`).
 
 Changes
 ^^^^^^^
@@ -57,8 +66,8 @@ Changes
 
 .. _changes_0.3.7:
 
-v0.3.7 (2025-02-10)
--------------------
+`v0.3.7 <https://github.com/hydrologie/xdatasets/tree/0.3.7>`_ (2025-02-10)
+---------------------------------------------------------------------------
 
 Contributors: Trevor James Smith (:user:`Zeitsperre`), Gabriel Rondeau-Genesse (:user:`RondeauG`), Sebastien Langlois (:user:`sebastienlanglois`)
 
@@ -92,10 +101,10 @@ Changes
 
 .. _changes_0.3.6:
 
-v0.3.6 (2024-07-12)
--------------------
+`v0.3.6 <https://github.com/hydrologie/xdatasets/tree/0.3.6>`_ (2024-07-12)
+---------------------------------------------------------------------------
 
-Contributors: Trevor James Smith (:user:`Zeitsperre`)
+Contributors: Trevor James Smith (:user:`Zeitsperre`).
 
 Changes
 ^^^^^^^
@@ -113,10 +122,10 @@ Changes
 
 .. _changes_0.3.5:
 
-v0.3.5 (2024-02-19)
--------------------
+`v0.3.5 <https://github.com/hydrologie/xdatasets/tree/0.3.5>`_ (2024-02-19)
+---------------------------------------------------------------------------
 
-Contributors: Trevor James Smith (:user:`Zeitsperre`)
+Contributors: Trevor James Smith (:user:`Zeitsperre`).
 
 Changes
 ^^^^^^^
@@ -135,32 +144,32 @@ Changes
 
 .. _changes_0.3.4:
 
-v0.3.4 (2024-01-31)
--------------------
+`v0.3.4 <https://github.com/hydrologie/xdatasets/tree/0.3.4>`_ (2024-01-31)
+---------------------------------------------------------------------------
 
-Contributors: Sebastien Langlois (:user:`sebastienlanglois`)
+Contributors: Sebastien Langlois (:user:`sebastienlanglois`).
 
 Fixes
 ^^^^^
 * Fix user-defined climate request (:pull:`50`)
 
 .. _changes_0.3.3:
 
-v0.3.3 (2024-01-11)
--------------------
+`v0.3.3 <https://github.com/hydrologie/xdatasets/tree/0.3.3>`_ (2024-01-11)
+---------------------------------------------------------------------------
 
-Contributors: Sebastien Langlois (:user:`sebastienlanglois`)
+Contributors: Sebastien Langlois (:user:`sebastienlanglois`).
 
 Changes
 ^^^^^^^
 * Support hydrometric queries when dataset's coordinates are lazy. (:pull:`46`)
 
 .. _changes_0.3.2:
 
-v0.3.2 (2024-01-10)
--------------------
+`v0.3.2 <https://github.com/hydrologie/xdatasets/tree/0.3.2>`_ (2024-01-10)
+---------------------------------------------------------------------------
 
-Contributors: Sebastien Langlois (:user:`sebastienlanglois`)
+Contributors: Sebastien Langlois (:user:`sebastienlanglois`).
 
 Changes
 ^^^^^^^
@@ -169,21 +178,21 @@ Changes
 
 .. _changes_0.3.1:
 
-v0.3.1 (2023-12-01)
--------------------
+`v0.3.1 <https://github.com/hydrologie/xdatasets/tree/0.3.1>`_ (2023-12-01)
+---------------------------------------------------------------------------
 
-Contributors: Trevor James Smith (:user:`Zeitsperre`)
+Contributors: Trevor James Smith (:user:`Zeitsperre`).
 
 Fixes
 ^^^^^
 * Patch update to address a missing dependency (`s3fs`). (:pull:`36`)
 
 .. _changes_0.3.0:
 
-v0.3.0 (2023-11-30)
--------------------
+`v0.3.0 <https://github.com/hydrologie/xdatasets/tree/0.3.0>`_ (2023-11-30)
+---------------------------------------------------------------------------
 
-Contributors: Trevor James Smith (:user:`Zeitsperre`)
+Contributors: Trevor James Smith (:user:`Zeitsperre`).
 
 Changes
 ^^^^^^^
@@ -200,6 +209,6 @@ Changes
 v0.1.2-alpha (2023-01-13)
 -------------------------
 
-Contributors: Sebastien Langlois (:user:`sebastienlanglois`)
+Contributors: Sebastien Langlois (:user:`sebastienlanglois`).
 
 First release on PyPI.