From fcff56efe96cf56c9c0a370e6940e34877b72dea Mon Sep 17 00:00:00 2001
From: Wei Ji <23487320+weiji14@users.noreply.github.com>
Date: Wed, 19 Mar 2025 10:46:27 +1300
Subject: [PATCH 1/9] Add pre-commit hook for Zizmor

A static analysis tool for GitHub Actions. Docs at https://woodruffw.github.io/zizmor/usage/#use-with-pre-commit
---
 .pre-commit-config.yaml | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/.pre-commit-config.yaml b/.pre-commit-config.yaml
index ba2140dbd99..fce98d0e485 100644
--- a/.pre-commit-config.yaml
+++ b/.pre-commit-config.yaml
@@ -15,6 +15,11 @@ repos:
     - id: remove-crlf
     - id: chmod
       args: ['644']
+- repo: https://github.com/woodruffw/zizmor-pre-commit
+  rev: v1.5.1
+  hooks:
+  - id: zizmor
+
 
 # https://pre-commit.ci/#configuration
 ci:

From 15b1a93e7da4808f73ed72be7e155d56675d1e4a Mon Sep 17 00:00:00 2001
From: Wei Ji <23487320+weiji14@users.noreply.github.com>
Date: Wed, 19 Mar 2025 11:04:47 +1300
Subject: [PATCH 2/9] Set persist-credentials: false with actions/checkout

Xref https://woodruffw.github.io/zizmor/audits/#artipacked
---
 .github/workflows/benchmarks.yml              | 1 +
 .github/workflows/cache_data.yaml             | 1 +
 .github/workflows/check-links.yml             | 2 ++
 .github/workflows/ci_docs.yml                 | 2 ++
 .github/workflows/ci_doctests.yaml            | 1 +
 .github/workflows/ci_tests.yaml               | 1 +
 .github/workflows/ci_tests_dev.yaml           | 2 ++
 .github/workflows/ci_tests_legacy.yaml        | 1 +
 .github/workflows/dvc-diff.yml                | 1 +
 .github/workflows/format-command.yml          | 1 +
 .github/workflows/release-baseline-images.yml | 2 ++
 .github/workflows/style_checks.yaml           | 2 ++
 .github/workflows/type_checks.yml             | 2 ++
 13 files changed, 19 insertions(+)

diff --git a/.github/workflows/benchmarks.yml b/.github/workflows/benchmarks.yml
index b958936f2de..2f8cea46927 100644
--- a/.github/workflows/benchmarks.yml
+++ b/.github/workflows/benchmarks.yml
@@ -38,6 +38,7 @@ jobs:
         with:
           # fetch all history so that setuptools-scm works
           fetch-depth: 0
+          persist-credentials: false
 
       - name: Get current week number of year
         id: date
diff --git a/.github/workflows/cache_data.yaml b/.github/workflows/cache_data.yaml
index 68f7c7aa508..8af64b036a1 100644
--- a/.github/workflows/cache_data.yaml
+++ b/.github/workflows/cache_data.yaml
@@ -40,6 +40,7 @@ jobs:
         with:
           # fetch all history so that setuptools-scm works
           fetch-depth: 0
+          persist-credentials: false
 
       # Install Micromamba with conda-forge dependencies
       - name: Setup Micromamba
diff --git a/.github/workflows/check-links.yml b/.github/workflows/check-links.yml
index c2013a36447..a419aaace56 100644
--- a/.github/workflows/check-links.yml
+++ b/.github/workflows/check-links.yml
@@ -26,12 +26,14 @@ jobs:
       uses: actions/checkout@v4.2.2
       with:
         path: repository
+        persist-credentials: false
 
     - name: Checkout the documentation
       uses: actions/checkout@v4.2.2
       with:
         ref: gh-pages
         path: documentation
+        persist-credentials: false
 
     - name: Link Checker
       id: lychee
diff --git a/.github/workflows/ci_docs.yml b/.github/workflows/ci_docs.yml
index a0e7e11c5b6..d59e2c682f5 100644
--- a/.github/workflows/ci_docs.yml
+++ b/.github/workflows/ci_docs.yml
@@ -73,6 +73,7 @@ jobs:
         with:
           # fetch all history so that setuptools-scm works
           fetch-depth: 0
+          persist-credentials: false
 
       - name: Get current week number of year
         id: date
@@ -172,6 +173,7 @@ jobs:
           path: deploy
           # Download the entire history
           fetch-depth: 0
+          persist-credentials: false
         if: (github.event_name == 'release' || github.event_name == 'push') && (matrix.os == 'ubuntu-latest')
 
       - name: Push the built HTML to gh-pages
diff --git a/.github/workflows/ci_doctests.yaml b/.github/workflows/ci_doctests.yaml
index 040c72bddf7..cdda70d2f34 100644
--- a/.github/workflows/ci_doctests.yaml
+++ b/.github/workflows/ci_doctests.yaml
@@ -39,6 +39,7 @@ jobs:
         with:
           # fetch all history so that setuptools-scm works
           fetch-depth: 0
+          persist-credentials: false
 
       # Install Micromamba with conda-forge dependencies
       - name: Setup Micromamba
diff --git a/.github/workflows/ci_tests.yaml b/.github/workflows/ci_tests.yaml
index d56cf362510..943b4748f59 100644
--- a/.github/workflows/ci_tests.yaml
+++ b/.github/workflows/ci_tests.yaml
@@ -108,6 +108,7 @@ jobs:
         with:
           # fetch all history so that setuptools-scm works
           fetch-depth: 0
+          persist-credentials: false
 
       - name: Get current week number of year
         id: date
diff --git a/.github/workflows/ci_tests_dev.yaml b/.github/workflows/ci_tests_dev.yaml
index ec70fc40da8..c851af64799 100644
--- a/.github/workflows/ci_tests_dev.yaml
+++ b/.github/workflows/ci_tests_dev.yaml
@@ -50,6 +50,7 @@ jobs:
         with:
           # fetch all history so that setuptools-scm works
           fetch-depth: 0
+          persist-credentials: false
 
       - name: Get current week number of year
         id: date
@@ -96,6 +97,7 @@ jobs:
           repository: 'GenericMappingTools/gmt'
           ref: ${{ matrix.gmt_git_ref }}
           path: 'gmt'
+          persist-credentials: false
 
       # Build GMT from source on Linux/macOS, script is adapted from
       # https://github.com/GenericMappingTools/gmt/blob/6.5.0/ci/build-gmt.sh
diff --git a/.github/workflows/ci_tests_legacy.yaml b/.github/workflows/ci_tests_legacy.yaml
index 6f3cb46bfb4..dcfe7b8beea 100644
--- a/.github/workflows/ci_tests_legacy.yaml
+++ b/.github/workflows/ci_tests_legacy.yaml
@@ -48,6 +48,7 @@ jobs:
         with:
           # fetch all history so that setuptools-scm works
           fetch-depth: 0
+          persist-credentials: false
 
       # Install Micromamba with conda-forge dependencies
       - name: Setup Micromamba
diff --git a/.github/workflows/dvc-diff.yml b/.github/workflows/dvc-diff.yml
index f72178e293c..dbf1f0d5bf1 100644
--- a/.github/workflows/dvc-diff.yml
+++ b/.github/workflows/dvc-diff.yml
@@ -25,6 +25,7 @@ jobs:
       with:
         # fetch all history so that dvc diff works
         fetch-depth: 0
+        persist-credentials: false
 
     - name: Setup data version control (DVC)
       uses: iterative/setup-dvc@v1.1.2
diff --git a/.github/workflows/format-command.yml b/.github/workflows/format-command.yml
index 76614adbdcb..75a449b514a 100644
--- a/.github/workflows/format-command.yml
+++ b/.github/workflows/format-command.yml
@@ -23,6 +23,7 @@ jobs:
           token: ${{ steps.generate-token.outputs.token }}
           repository: ${{ github.event.client_payload.pull_request.head.repo.full_name }}
           ref: ${{ github.event.client_payload.pull_request.head.ref }}
+          persist-credentials: false
 
       # Setup Python environment
       - uses: actions/setup-python@v5.4.0
diff --git a/.github/workflows/release-baseline-images.yml b/.github/workflows/release-baseline-images.yml
index 28695af0afe..fe90da89ef7 100644
--- a/.github/workflows/release-baseline-images.yml
+++ b/.github/workflows/release-baseline-images.yml
@@ -24,6 +24,8 @@ jobs:
     steps:
     - name: Checkout
       uses: actions/checkout@v4.2.2
+      with:
+        persist-credentials: false
 
     - name: Setup data version control (DVC)
       uses: iterative/setup-dvc@v1.1.2
diff --git a/.github/workflows/style_checks.yaml b/.github/workflows/style_checks.yaml
index 8bd11e06a50..65141d168fe 100644
--- a/.github/workflows/style_checks.yaml
+++ b/.github/workflows/style_checks.yaml
@@ -25,6 +25,8 @@ jobs:
       # Checkout current git repository
       - name: Checkout
         uses: actions/checkout@v4.2.2
+        with:
+          persist-credentials: false
 
       # Setup Python
       - name: Set up Python
diff --git a/.github/workflows/type_checks.yml b/.github/workflows/type_checks.yml
index 571124375cc..b68f629c80e 100644
--- a/.github/workflows/type_checks.yml
+++ b/.github/workflows/type_checks.yml
@@ -34,6 +34,8 @@ jobs:
       # Checkout current git repository
       - name: Checkout
         uses: actions/checkout@v4.2.2
+        with:
+          persist-credentials: false
 
       # Setup Python
       - name: Set up Python

From cd2fcd63c8c6067d944a79dc6875048bab37deb8 Mon Sep 17 00:00:00 2001
From: Wei Ji <23487320+weiji14@users.noreply.github.com>
Date: Wed, 19 Mar 2025 11:09:15 +1300
Subject: [PATCH 3/9] Set permissions: {} for GitHub Actions workflows

Xref https://woodruffw.github.io/zizmor/audits/#excessive-permissions
---
 .github/workflows/benchmarks.yml             | 2 ++
 .github/workflows/cache_data.yaml            | 2 ++
 .github/workflows/check-links.yml            | 2 ++
 .github/workflows/ci_docs.yml                | 2 ++
 .github/workflows/ci_doctests.yaml           | 2 ++
 .github/workflows/ci_tests_dev.yaml          | 2 ++
 .github/workflows/ci_tests_legacy.yaml       | 2 ++
 .github/workflows/dvc-diff.yml               | 2 ++
 .github/workflows/format-command.yml         | 4 ++++
 .github/workflows/publish-to-pypi.yml        | 2 ++
 .github/workflows/release-drafter.yml        | 2 ++
 .github/workflows/slash-command-dispatch.yml | 4 ++++
 .github/workflows/style_checks.yaml          | 2 ++
 .github/workflows/type_checks.yml            | 2 ++
 14 files changed, 32 insertions(+)

diff --git a/.github/workflows/benchmarks.yml b/.github/workflows/benchmarks.yml
index 2f8cea46927..d00c8b78f1d 100644
--- a/.github/workflows/benchmarks.yml
+++ b/.github/workflows/benchmarks.yml
@@ -23,6 +23,8 @@ concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}
   cancel-in-progress: ${{ github.ref != 'refs/heads/main' }}
 
+permissions: {}
+
 jobs:
   benchmarks:
     runs-on: ubuntu-latest
diff --git a/.github/workflows/cache_data.yaml b/.github/workflows/cache_data.yaml
index 8af64b036a1..d7c52d5fd6c 100644
--- a/.github/workflows/cache_data.yaml
+++ b/.github/workflows/cache_data.yaml
@@ -25,6 +25,8 @@ on:
   schedule:
     - cron: '0 12 * * 0'
 
+permissions: {}
+
 jobs:
   gmt_cache:
     name: Cache GMT artifacts
diff --git a/.github/workflows/check-links.yml b/.github/workflows/check-links.yml
index a419aaace56..825feb1746c 100644
--- a/.github/workflows/check-links.yml
+++ b/.github/workflows/check-links.yml
@@ -15,6 +15,8 @@ on:
   schedule:
     - cron: '0 12 * * 0'
 
+permissions: {}
+
 jobs:
   check_links:
     name: Check Links
diff --git a/.github/workflows/ci_docs.yml b/.github/workflows/ci_docs.yml
index d59e2c682f5..d3bac39b1b0 100644
--- a/.github/workflows/ci_docs.yml
+++ b/.github/workflows/ci_docs.yml
@@ -43,6 +43,8 @@ concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}
   cancel-in-progress: ${{ github.ref != 'refs/heads/main' }}
 
+permissions: {}
+
 jobs:
   docs:
     name: ${{ matrix.os }}
diff --git a/.github/workflows/ci_doctests.yaml b/.github/workflows/ci_doctests.yaml
index cdda70d2f34..19b67c471f6 100644
--- a/.github/workflows/ci_doctests.yaml
+++ b/.github/workflows/ci_doctests.yaml
@@ -18,6 +18,8 @@ concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}
   cancel-in-progress: ${{ github.ref != 'refs/heads/main' }}
 
+permissions: {}
+
 jobs:
   test:
     name: ${{ matrix.os }}
diff --git a/.github/workflows/ci_tests_dev.yaml b/.github/workflows/ci_tests_dev.yaml
index c851af64799..183b618883b 100644
--- a/.github/workflows/ci_tests_dev.yaml
+++ b/.github/workflows/ci_tests_dev.yaml
@@ -28,6 +28,8 @@ concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}
   cancel-in-progress: ${{ github.ref != 'refs/heads/main' }}
 
+permissions: {}
+
 jobs:
   test_gmt_dev:
     name: ${{ matrix.os }} - GMT ${{ matrix.gmt_git_ref }}
diff --git a/.github/workflows/ci_tests_legacy.yaml b/.github/workflows/ci_tests_legacy.yaml
index dcfe7b8beea..65d07498781 100644
--- a/.github/workflows/ci_tests_legacy.yaml
+++ b/.github/workflows/ci_tests_legacy.yaml
@@ -26,6 +26,8 @@ concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}
   cancel-in-progress: ${{ github.ref != 'refs/heads/main' }}
 
+permissions: {}
+
 jobs:
   test:
     name: ${{ matrix.os }} - GMT ${{ matrix.gmt_version }}
diff --git a/.github/workflows/dvc-diff.yml b/.github/workflows/dvc-diff.yml
index dbf1f0d5bf1..6790bb336b6 100644
--- a/.github/workflows/dvc-diff.yml
+++ b/.github/workflows/dvc-diff.yml
@@ -14,6 +14,8 @@ on:
     paths:
       - 'pygmt/tests/baseline/*.png.dvc'
 
+permissions: {}
+
 jobs:
   dvc-diff:
     name: DVC image diff
diff --git a/.github/workflows/format-command.yml b/.github/workflows/format-command.yml
index 75a449b514a..432febe91a5 100644
--- a/.github/workflows/format-command.yml
+++ b/.github/workflows/format-command.yml
@@ -3,9 +3,13 @@
 # This workflow is triggered in a PR if the slash command `/format` is used.
 #
 name: format-command
+
 on:
   repository_dispatch:
     types: [format-command]
+
+permissions: {}
+
 jobs:
   format:
     runs-on: ubuntu-latest
diff --git a/.github/workflows/publish-to-pypi.yml b/.github/workflows/publish-to-pypi.yml
index 0e245eed8b3..8393ae0d170 100644
--- a/.github/workflows/publish-to-pypi.yml
+++ b/.github/workflows/publish-to-pypi.yml
@@ -34,6 +34,8 @@ on:
   #  branches:
   #    - main
 
+permissions: {}
+
 jobs:
   build:
     name: Build distribution 📦
diff --git a/.github/workflows/release-drafter.yml b/.github/workflows/release-drafter.yml
index 5865c1af305..ca2d2a449f7 100644
--- a/.github/workflows/release-drafter.yml
+++ b/.github/workflows/release-drafter.yml
@@ -11,6 +11,8 @@ on:
     branches:
       - main
 
+permissions: {}
+
 jobs:
   update_release_draft:
     runs-on: ubuntu-latest
diff --git a/.github/workflows/slash-command-dispatch.yml b/.github/workflows/slash-command-dispatch.yml
index c551b14954f..da2cc8a3a5d 100644
--- a/.github/workflows/slash-command-dispatch.yml
+++ b/.github/workflows/slash-command-dispatch.yml
@@ -3,11 +3,15 @@
 # Currently, only one slash command `format` is supported.
 #
 name: Slash Command Dispatch
+
 on:
   issue_comment:
     types: [created]
     # Add "edited" type for test purposes. Where possible, avoid using to prevent processing unnecessary events.
     # types: [created, edited]
+
+permissions: {}
+
 jobs:
   slashCommandDispatch:
     if: ${{ github.event.issue.pull_request }}
diff --git a/.github/workflows/style_checks.yaml b/.github/workflows/style_checks.yaml
index 65141d168fe..fd44ab732d0 100644
--- a/.github/workflows/style_checks.yaml
+++ b/.github/workflows/style_checks.yaml
@@ -16,6 +16,8 @@ on:
   schedule:
     - cron: '0 0 * * *'
 
+permissions: {}
+
 jobs:
   style_check:
     name: Style Checks
diff --git a/.github/workflows/type_checks.yml b/.github/workflows/type_checks.yml
index b68f629c80e..3b04e0a34cc 100644
--- a/.github/workflows/type_checks.yml
+++ b/.github/workflows/type_checks.yml
@@ -25,6 +25,8 @@ concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}
   cancel-in-progress: ${{ github.ref != 'refs/heads/main' }}
 
+permissions: {}
+
 jobs:
   static_check:
     name: Static Type Check

From 6e57354ff7c89d0c8ad6a3c54613b9ce0574c64b Mon Sep 17 00:00:00 2001
From: Wei Ji <23487320+weiji14@users.noreply.github.com>
Date: Wed, 19 Mar 2025 11:20:37 +1300
Subject: [PATCH 4/9] Fix potential sources of code injection via template
 expansion

Xref https://woodruffw.github.io/zizmor/audits/#template-injection
---
 .github/workflows/check-links.yml             | 3 ++-
 .github/workflows/ci_docs.yml                 | 3 ++-
 .github/workflows/ci_tests_dev.yaml           | 4 ++--
 .github/workflows/dvc-diff.yml                | 3 ++-
 .github/workflows/release-baseline-images.yml | 3 ++-
 5 files changed, 10 insertions(+), 6 deletions(-)

diff --git a/.github/workflows/check-links.yml b/.github/workflows/check-links.yml
index 825feb1746c..4c03656becc 100644
--- a/.github/workflows/check-links.yml
+++ b/.github/workflows/check-links.yml
@@ -76,7 +76,8 @@ jobs:
       if: env.lychee_exit_code != 0
       run: |
         cd repository/
-        title="Link Checker Report on ${{ steps.date.outputs.date }}"
+        title="Link Checker Report on ${CURRENT_DATE}"
         gh issue create --title "$title" --body-file /tmp/lychee-out.md
       env:
         GH_TOKEN: ${{ github.token }}
+        CURRENT_DATE: ${{ steps.date.outputs.date }}
diff --git a/.github/workflows/ci_docs.yml b/.github/workflows/ci_docs.yml
index d3bac39b1b0..67dabf6bab6 100644
--- a/.github/workflows/ci_docs.yml
+++ b/.github/workflows/ci_docs.yml
@@ -162,10 +162,11 @@ jobs:
         if: github.event_name == 'push' && matrix.os == 'ubuntu-latest'
 
       - name: Upload the HTML ZIP archive and PDF as release assets
-        run: gh release upload ${{ github.ref_name }} doc/_build/pygmt-docs.zip doc/_build/pygmt-docs.pdf
+        run: gh release upload ${REF_NAME} doc/_build/pygmt-docs.zip doc/_build/pygmt-docs.pdf
         if: github.event_name == 'release' && matrix.os == 'ubuntu-latest'
         env:
           GH_TOKEN: ${{ github.token }}
+          REF_NAME: ${{ github.ref_name }}
 
       - name: Checkout the gh-pages branch
         uses: actions/checkout@v4.2.2
diff --git a/.github/workflows/ci_tests_dev.yaml b/.github/workflows/ci_tests_dev.yaml
index 183b618883b..20dcab6974c 100644
--- a/.github/workflows/ci_tests_dev.yaml
+++ b/.github/workflows/ci_tests_dev.yaml
@@ -109,7 +109,7 @@ jobs:
           mkdir build
           cd build
           cmake -G Ninja .. \
-            -DCMAKE_INSTALL_PREFIX=${{ env.GMT_INSTALL_DIR }} \
+            -DCMAKE_INSTALL_PREFIX=${GMT_INSTALL_DIR} \
             -DCMAKE_BUILD_TYPE=Release \
             -DGMT_ENABLE_OPENMP=TRUE \
             -DGMT_USE_THREADS=TRUE
@@ -129,7 +129,7 @@ jobs:
           cd build
           call "C:\Program Files\Microsoft Visual Studio\2022\Enterprise\VC\Auxiliary\Build\vcvars64.bat"
           cmake -G Ninja .. ^
-            -DCMAKE_INSTALL_PREFIX=${{ env.GMT_INSTALL_DIR }} ^
+            -DCMAKE_INSTALL_PREFIX=${GMT_INSTALL_DIR} ^
             -DCMAKE_BUILD_TYPE=Release ^
             -DCMAKE_PREFIX_PATH=${{ env.MAMBA_ROOT_PREFIX }}\envs\pygmt\Library ^
             -DGMT_ENABLE_OPENMP=TRUE ^
diff --git a/.github/workflows/dvc-diff.yml b/.github/workflows/dvc-diff.yml
index 6790bb336b6..a14e32308d6 100644
--- a/.github/workflows/dvc-diff.yml
+++ b/.github/workflows/dvc-diff.yml
@@ -56,6 +56,7 @@ jobs:
     - name: Generate the image diff report
       env:
         repo_token: ${{ github.token }}
+        PR_HEAD_SHA: ${{ github.event.pull_request.head.sha }}
       run: |
         echo -e "## Summary of changed images\n" > report.md
         echo -e "This is an auto-generated report of images that have changed on the DVC remote\n" >> report.md
@@ -97,7 +98,7 @@ jobs:
         echo -e "</details>\n" >> report.md
 
         # Mention git commit SHA in the report
-        echo -e "Report last updated at commit ${{ github.event.pull_request.head.sha }}" >> report.md
+        echo -e "Report last updated at commit ${PR_HEAD_SHA}" >> report.md
 
         # create/update PR comment
         cml comment update report.md
diff --git a/.github/workflows/release-baseline-images.yml b/.github/workflows/release-baseline-images.yml
index fe90da89ef7..aec92644c78 100644
--- a/.github/workflows/release-baseline-images.yml
+++ b/.github/workflows/release-baseline-images.yml
@@ -41,6 +41,7 @@ jobs:
         shasum -a 256 baseline-images.zip
 
     - name: Upload baseline image as a release asset
-      run: gh release upload ${{ github.ref_name }} baseline-images.zip
+      run: gh release upload ${REF_NAME} baseline-images.zip
       env:
         GH_TOKEN: ${{ github.token }}
+        REF_NAME: ${{ github.ref_name }}

From 53a31a617bab0d4cfe7b9732b9652b4454035916 Mon Sep 17 00:00:00 2001
From: Wei Ji <23487320+weiji14@users.noreply.github.com>
Date: Wed, 19 Mar 2025 11:43:10 +1300
Subject: [PATCH 5/9] Use ${env:GMT_INSTALL_DIR} on Windows

Different environment variable syntax for Powershell
---
 .github/workflows/ci_tests_dev.yaml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/workflows/ci_tests_dev.yaml b/.github/workflows/ci_tests_dev.yaml
index 20dcab6974c..daf8fd349d4 100644
--- a/.github/workflows/ci_tests_dev.yaml
+++ b/.github/workflows/ci_tests_dev.yaml
@@ -129,7 +129,7 @@ jobs:
           cd build
           call "C:\Program Files\Microsoft Visual Studio\2022\Enterprise\VC\Auxiliary\Build\vcvars64.bat"
           cmake -G Ninja .. ^
-            -DCMAKE_INSTALL_PREFIX=${GMT_INSTALL_DIR} ^
+            -DCMAKE_INSTALL_PREFIX=${env:GMT_INSTALL_DIR} ^
             -DCMAKE_BUILD_TYPE=Release ^
             -DCMAKE_PREFIX_PATH=${{ env.MAMBA_ROOT_PREFIX }}\envs\pygmt\Library ^
             -DGMT_ENABLE_OPENMP=TRUE ^

From ee4f75ea73fec531417773712222a3a2cea61d5b Mon Sep 17 00:00:00 2001
From: Wei Ji <23487320+weiji14@users.noreply.github.com>
Date: Wed, 19 Mar 2025 13:31:41 +1300
Subject: [PATCH 6/9] Set $env:GMT_INSTALL_DIR without braces

Co-authored-by: Dongdong Tian <seisman.info@gmail.com>
---
 .github/workflows/ci_tests_dev.yaml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/workflows/ci_tests_dev.yaml b/.github/workflows/ci_tests_dev.yaml
index daf8fd349d4..de62424aeb4 100644
--- a/.github/workflows/ci_tests_dev.yaml
+++ b/.github/workflows/ci_tests_dev.yaml
@@ -129,7 +129,7 @@ jobs:
           cd build
           call "C:\Program Files\Microsoft Visual Studio\2022\Enterprise\VC\Auxiliary\Build\vcvars64.bat"
           cmake -G Ninja .. ^
-            -DCMAKE_INSTALL_PREFIX=${env:GMT_INSTALL_DIR} ^
+            -DCMAKE_INSTALL_PREFIX=$env:GMT_INSTALL_DIR ^
             -DCMAKE_BUILD_TYPE=Release ^
             -DCMAKE_PREFIX_PATH=${{ env.MAMBA_ROOT_PREFIX }}\envs\pygmt\Library ^
             -DGMT_ENABLE_OPENMP=TRUE ^

From cdae545f70f534764ef23f20380b83d9bc9847eb Mon Sep 17 00:00:00 2001
From: Wei Ji <23487320+weiji14@users.noreply.github.com>
Date: Wed, 19 Mar 2025 14:04:31 +1300
Subject: [PATCH 7/9] Revert "Set $env:GMT_INSTALL_DIR without braces"

This reverts commit ee4f75ea73fec531417773712222a3a2cea61d5b.
---
 .github/workflows/ci_tests_dev.yaml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/workflows/ci_tests_dev.yaml b/.github/workflows/ci_tests_dev.yaml
index de62424aeb4..daf8fd349d4 100644
--- a/.github/workflows/ci_tests_dev.yaml
+++ b/.github/workflows/ci_tests_dev.yaml
@@ -129,7 +129,7 @@ jobs:
           cd build
           call "C:\Program Files\Microsoft Visual Studio\2022\Enterprise\VC\Auxiliary\Build\vcvars64.bat"
           cmake -G Ninja .. ^
-            -DCMAKE_INSTALL_PREFIX=$env:GMT_INSTALL_DIR ^
+            -DCMAKE_INSTALL_PREFIX=${env:GMT_INSTALL_DIR} ^
             -DCMAKE_BUILD_TYPE=Release ^
             -DCMAKE_PREFIX_PATH=${{ env.MAMBA_ROOT_PREFIX }}\envs\pygmt\Library ^
             -DGMT_ENABLE_OPENMP=TRUE ^

From 4cafdeb9062c2560ed98dc0050c1f0fa0b2992a3 Mon Sep 17 00:00:00 2001
From: Wei Ji <23487320+weiji14@users.noreply.github.com>
Date: Wed, 19 Mar 2025 14:15:27 +1300
Subject: [PATCH 8/9] Try running GMT build on Windows Powershell core

---
 .github/workflows/ci_tests_dev.yaml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/workflows/ci_tests_dev.yaml b/.github/workflows/ci_tests_dev.yaml
index daf8fd349d4..90e33a872fe 100644
--- a/.github/workflows/ci_tests_dev.yaml
+++ b/.github/workflows/ci_tests_dev.yaml
@@ -122,7 +122,7 @@ jobs:
         if: runner.os != 'Windows'
 
       - name: Build GMT on Windows
-        shell: cmd
+        shell: pwsh
         run: |
           cd gmt/
           mkdir build

From 3b2b21f19f88ae3347956c2aa351a15112a0cf67 Mon Sep 17 00:00:00 2001
From: Wei Ji <23487320+weiji14@users.noreply.github.com>
Date: Wed, 19 Mar 2025 14:34:15 +1300
Subject: [PATCH 9/9] Back to using Windows cmd, use %GMT_INSTALL_DIR%

---
 .github/workflows/ci_tests_dev.yaml | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/.github/workflows/ci_tests_dev.yaml b/.github/workflows/ci_tests_dev.yaml
index 90e33a872fe..a8b03098eaf 100644
--- a/.github/workflows/ci_tests_dev.yaml
+++ b/.github/workflows/ci_tests_dev.yaml
@@ -122,14 +122,14 @@ jobs:
         if: runner.os != 'Windows'
 
       - name: Build GMT on Windows
-        shell: pwsh
+        shell: cmd
         run: |
           cd gmt/
           mkdir build
           cd build
           call "C:\Program Files\Microsoft Visual Studio\2022\Enterprise\VC\Auxiliary\Build\vcvars64.bat"
           cmake -G Ninja .. ^
-            -DCMAKE_INSTALL_PREFIX=${env:GMT_INSTALL_DIR} ^
+            -DCMAKE_INSTALL_PREFIX=%GMT_INSTALL_DIR% ^
             -DCMAKE_BUILD_TYPE=Release ^
             -DCMAKE_PREFIX_PATH=${{ env.MAMBA_ROOT_PREFIX }}\envs\pygmt\Library ^
             -DGMT_ENABLE_OPENMP=TRUE ^