[yantosca]

Name and Institution (Required)

Name: Bob Yantosca
Institution: Harvard + GCST

Describe the update

This PR adds repository configuration and guidance files:

File	Description
.gitattributes	Normalizes line endings to LF, except *.bat files, which stay CRLF. Marks binary formats such as .nc, .npy, .pdf and images as binary. Excludes docs/ and gcpy/examples/ from GitHub's language statistics.
CLAUDE.md	Guidance for Claude Code: environment setup, tests, CI, linting, benchmarks, the release process, architecture, and contribution conventions.
SECURITY.md	Security policy. Vulnerabilities are reported privately through a GitHub security advisory. Private vulnerability reporting is now enabled for this repo.
.pylintrc	Relaxes Pylint checks that don't fit GCPy's code style: size limits, wildcard imports in __init__.py, and short scientific variable names.
.github/PULL_REQUEST_TEMPLATE.md	Adds an "AI disclosure" section.
.github/dependabot.yml	Tells GitHub to check if any GitHub actions (e.g. checkout) need updating. If so, a PR containing proposed fixes will be opened for GCST review.

It also includes these follow-up fixes, made after the 1.8.1 release:

• docs/make.bat and gcpy/benchmark/modules/GC_72_vertical_levels.csv had been committed with CRLF line endings. They are now stored as LF, and make.bat is still checked out with CRLF. Their diffs show every line changed, but only the line endings differ.

• gcpy/examples/dry_run/download_data.py: Now reads its YAML config with yaml.safe_load instead of yaml.load(..., Loader=yaml.FullLoader), and closes the file when done.

• .github/workflows/run-tests.yml and build-gcpy-environment-py31{2,3,4}.yml: Added permissions: contents: read, so every workflow now declares the access it needs. This makes it safe to switch the repo's default workflow token to read-only. Also shortened the ESMF/MPI comment in run-tests.yml; the full explanation is in CLAUDE.md.
  ### Expected changes

GCPy output is unchanged. download_data.py parses download_data.yml to the same result as before. The line-ending changes affect how the files are stored in Git, not their contents. CI should pass as before; zizmor reports no findings for the workflow changes.
### Related Github Issue

• Added files for the GCHP GitHub repo suggested by Claude Code GCHP#559
• Added files for the GCClassic GitHub repository suggested by Claude Code GCClassic#110
• Added files for the HEMCO repository suggested by Claude Code HEMCO#364
• Added files for the GEOS-Chem "science codebase" GitHub repo suggested by Claude Code geos-chem#3350
  ### AI disclosure Claude Code (Claude Opus) helped prepare this PR. It suggested the new files, checked CLAUDE.md against the repository after the 1.8.1 release, and made the fixes listed above. All changes were reviewed by the author.

[github-advanced-security]

You are seeing this message because GitHub Code Scanning has recently been set up for this repository, or this pull request contains the workflow file for the Code Scanning tool.

What Enabling Code Scanning Means:

• The 'Security' tab will display more code scanning analysis results (e.g., for the default branch).
• Depending on your configuration and choice of analysis tool, future pull requests will be annotated with code scanning analysis results.
• You will be able to see the analysis results for the pull request's branch on this overview once the scans have completed and the checks have passed.

For more information about GitHub Code Scanning, check out the documentation.