Update install restricted files to use version appropriate branch and make into cset subcommand

Makefile

@@ -30,6 +30,7 @@ conda: prepare-lockfiles
 # Prevent pip from accessing the network; we have everything in our conda env.
 setup: conda .git/hooks/pre-commit ## Setup development environment.
 	${CONDA_EXE} run -n cset-dev pip install --no-deps --no-index --no-build-isolation --editable .
+	${CONDA_EXE} run -n cset-dev cset install-restricted-files src/CSET/cset_workflow || true
 	@echo "Run '${CONDA_EXE} activate cset-dev' to use conda environment."
 
 docs: ## Build documentation.

docs/source/contributing/architecture.rst

@@ -185,7 +185,6 @@ src/CSET/cset_workflow
     ├── site                         # Site-specific cylc configuration.
     │   └── localhost.cylc
     ├── flow.cylc                    # Workflow definition detailing how tasks are run.
-    ├── install_restricted_files.sh  # Script for installing site-specific files.
     ├── README.md
     ├── rose-suite.conf              # User configuration of workflow and diagnostics.
     └── rose-suite.conf.example      # Blank user configuration to be copied.

docs/source/contributing/dependencies.rst

@@ -9,6 +9,7 @@ requirements that must be installed separately.
 * conda - Used for managing the conda environment. Alternatively mamba or micromamba can be used.
 * cylc 8 - Used for running the workflow. As it typically requires significant site integration it is not installed with CSET.
 * GNU find - We use the ``-printf`` option that is GNU specific.
+* Git - Used for installing the restricted files, but not needed during runtime.
 
 Requirements of a new dependency
 --------------------------------

docs/source/getting-started/run_full_cylc_workflow.rst

@@ -71,13 +71,19 @@ With the newly created conda environment activated, run the ``cset
 extract-workflow`` command to unpack the workflow from inside the CSET package
 into a directory of your choosing. A sensible choice is ``~/cylc-src``, which is
 the default location where cylc will search for workflows.
+If you are at a Momentum® Partnership site with restricted site specific files
+you should also include the ``--restricted`` flag to install them.
 
 .. code-block:: bash
 
     # Create the cylc-src directory if it doesn't exist.
     mkdir -p ~/cylc-src
+
     # Extract the workflow from CSET into the chosen directory.
-    cset extract-workflow ~/cylc-src
+    # Alternatively install the restricted site-specific files at Momentum sites.
+    cset extract-workflow --restricted ~/cylc-src  # Momentum Partners.
+    cset extract-workflow ~/cylc-src               # Everyone else.
+
     # Change into the freshly unpacked workflow directory.
     cd ~/cylc-src/cset-workflow-vX.Y.Z
 
@@ -86,18 +92,19 @@ Your directory should look like this:
 .. code-block:: bash
 
     $ ls
-    app  conda-environment  includes                     lib   opt        rose-suite.conf.example
-    bin  flow.cylc          install_restricted_files.sh  meta  README.md  site
+    app  conda-environment  includes  meta  README.md                site
+    bin  flow.cylc          lib       opt   rose-suite.conf.example
 
 If you are at a site with specific CSET integration, such as the Met Office or
-Momentum Partnership, you will want to install the site specific configuration
+Momentum Partnership, and did not use the ``--restricted`` option to ``cset
+extract-workflow`` you will want to install the site specific configuration
 files that specify where cylc will run the tasks. This is done by running the
-``install_restricted_files.sh`` script. For other users, you can skip this step
-and use the ``localhost`` site instead.
+``cset install-restricted-files`` command. For other users, you can skip this
+step and use the ``localhost`` site instead.
 
 .. code-block:: bash
 
-    ./install_restricted_files.sh
+    cset install-restricted-files /path/to/workflow
 
 You have now installed the CSET workflow and are ready to use it.
 

docs/source/reference/cli.rst

@@ -98,10 +98,40 @@ usage see :doc:`/getting-started/run_full_cylc_workflow`.
 
 .. code-block:: text
 
-    usage: cset extract-workflow [-h] location
+    usage: cset extract-workflow [-h] [--restricted]
+                                 [--restricted-url RESTRICTED_URL]
+                                 location
 
     positional arguments:
-      location    directory to save workflow into
+      location              directory to save workflow into
 
     options:
-      -h, --help  show this help message and exit
+      -h, --help            show this help message and exit
+      --restricted          install restricted site-specific files during
+                            extraction
+      --restricted-url RESTRICTED_URL
+                            Alternative Git URL to fetch the restricted files
+                            from. If omitted, defaults to trying to clone first
+                            from 'localmirrors:', then from GitHub via SSH and
+                            HTTPS.
+
+cset install-restricted-files
+~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+
+Download and install restricted site-specific files into the CSET workflow.
+
+.. code-block:: text
+
+    usage: cset install-restricted-files [-h] [--restricted-url RESTRICTED_URL]
+                                         location
+
+    positional arguments:
+      location              directory containing workflow
+
+    options:
+      -h, --help            show this help message and exit
+      --restricted-url RESTRICTED_URL
+                            Alternative Git URL to fetch the restricted files
+                            from. If omitted, defaults to trying to clone first
+                            from 'localmirrors:', then from GitHub via SSH and
+                            HTTPS.

docs/source/usage/add-site.rst

@@ -129,8 +129,8 @@ add your site file.
 If you would prefer to keep your site-specific configuration non-public, and are
 a Momentum Partnership member, we have a designated `CSET site-specific config
 repository`_ that contains these configurations for various Momentum Partners.
-It is this repository that is installed via the ``install_restricted_files.sh``
-script. Even when your file remains restricted like this you should still
+It is this repository that is installed via ``cset install-restricted-files``.
+Even when your file remains restricted like this you should still
 contribute your rose metadata changes to the `main CSET GitHub repository`_ so
 your site shows up as an option to users.
 

src/CSET/__init__.py

@@ -1,4 +1,4 @@
-# © Crown copyright, Met Office (2022-2025) and CSET contributors.
+# © Crown copyright, Met Office (2022-2026) and CSET contributors.
 #
 # Licensed under the Apache License, Version 2.0 (the "License");
 # you may not use this file except in compliance with the License.
@@ -169,8 +169,40 @@ def setup_argument_parser() -> argparse.ArgumentParser:
     parser_extract_workflow.add_argument(
         "location", type=Path, help="directory to save workflow into"
     )
+    parser_extract_workflow.add_argument(
+        "--restricted",
+        action="store_true",
+        help="install restricted site-specific files during extraction",
+    )
+    parser_extract_workflow.add_argument(
+        "--restricted-url",
+        type=str,
+        help=(
+            "Alternative Git URL to fetch the restricted files from. "
+            "If omitted, defaults to trying to clone first from "
+            "'localmirrors:', then from GitHub via SSH and HTTPS."
+        ),
+    )
     parser_extract_workflow.set_defaults(func=_extract_workflow_command)
 
+    parser_install_restricted_files = subparsers.add_parser(
+        "install-restricted-files",
+        help="download and install restricted site-specific files for the CSET cylc workflow",
+    )
+    parser_install_restricted_files.add_argument(
+        "location", type=Path, help="directory containing workflow"
+    )
+    parser_install_restricted_files.add_argument(
+        "--restricted-url",
+        type=str,
+        help=(
+            "Alternative Git URL to fetch the restricted files from. "
+            "If omitted, defaults to trying to clone first from "
+            "'localmirrors:', then from GitHub via SSH and HTTPS."
+        ),
+    )
+    parser_install_restricted_files.set_defaults(func=_install_restricted_files_command)
+
     return parser
 
 
@@ -256,6 +288,14 @@ def _cookbook_command(args, unparsed_args):
 
 
 def _extract_workflow_command(args, unparsed_args):
-    from CSET.extract_workflow import install_workflow
+    from CSET.extract_workflow import install_restricted_files, install_workflow
+
+    workflow_dir = install_workflow(args.location)
+    if args.restricted:
+        install_restricted_files(workflow_dir, args.restricted_url)
+
+
+def _install_restricted_files_command(args, unparsed_args):
+    from CSET.extract_workflow import install_restricted_files
 
-    install_workflow(args.location)
+    install_restricted_files(args.location, args.restricted_url)