From 87cb2d21a2faaafbd50d5a962c9ad7cf8a7b0d53 Mon Sep 17 00:00:00 2001
From: wpbonelli <wbonelli@ucar.edu>
Date: Tue, 11 Aug 2026 20:11:39 -0700
Subject: [PATCH 1/3] chore: install certifi

---
 action.yml | 1 +
 1 file changed, 1 insertion(+)

diff --git a/action.yml b/action.yml
index 7eeb165..7a4a740 100644
--- a/action.yml
+++ b/action.yml
@@ -161,6 +161,7 @@ runs:
           echo "get-modflow command not available, downloading install script"
           script_path="$RUNNER_TEMP/get_modflow.py"
           curl https://raw.githubusercontent.com/modflowpy/flopy/develop/flopy/utils/get_modflow.py -o "$script_path"
+          python3 -m pip install --quiet --disable-pip-version-check certifi || true
           cmd="python3 $script_path"
         fi
 

From 23e64c43392bc2c34d028f70db604138090bb9c0 Mon Sep 17 00:00:00 2001
From: wpbonelli <wbonelli@ucar.edu>
Date: Wed, 12 Aug 2026 11:33:29 -0700
Subject: [PATCH 2/3] fix

---
 action.yml   | 10 +++++++++-
 test/test.py |  2 +-
 2 files changed, 10 insertions(+), 2 deletions(-)

diff --git a/action.yml b/action.yml
index 7a4a740..a4a6c51 100644
--- a/action.yml
+++ b/action.yml
@@ -152,6 +152,15 @@ runs:
           args="$args --ostag ${{ inputs.ostag }}"
         fi
 
+        # work around broken/incomplete local CA trust stores on some runners by pointing
+        # Python's default SSL context at certifi's CA bundle, regardless of which install
+        # path below ends up running
+        python3 -m pip install --quiet --disable-pip-version-check certifi || true
+        cert_file="$(python3 -m certifi 2>/dev/null || true)"
+        if [[ -n "$cert_file" ]]; then
+          export SSL_CERT_FILE="$cert_file"
+        fi
+
         # download the installation script if necessary
         if command -v get-modflow &> /dev/null
         then
@@ -161,7 +170,6 @@ runs:
           echo "get-modflow command not available, downloading install script"
           script_path="$RUNNER_TEMP/get_modflow.py"
           curl https://raw.githubusercontent.com/modflowpy/flopy/develop/flopy/utils/get_modflow.py -o "$script_path"
-          python3 -m pip install --quiet --disable-pip-version-check certifi || true
           cmd="python3 $script_path"
         fi
 
diff --git a/test/test.py b/test/test.py
index 886923a..a4b06b8 100644
--- a/test/test.py
+++ b/test/test.py
@@ -31,7 +31,7 @@
         'crt',
         'mt3dms',
         'mf2005dbl',
-        'zonbud3',
+        'zonbud',
         'gridgen',
         'mflgrdbl',
         'mfnwt',

From e889356ebfca26eb2aee117e211e866e5521d4df Mon Sep 17 00:00:00 2001
From: wpbonelli <wbonelli@ucar.edu>
Date: Wed, 12 Aug 2026 12:05:31 -0700
Subject: [PATCH 3/3] tolerate old name

---
 test/test.py | 20 ++++++++++++++++++--
 1 file changed, 18 insertions(+), 2 deletions(-)

diff --git a/test/test.py b/test/test.py
index a4b06b8..d356a4e 100644
--- a/test/test.py
+++ b/test/test.py
@@ -59,6 +59,12 @@
     "modflow6-nightly-build": ["libmf6"]
 }
 
+# executables that have been renamed upstream at some point; accept the old
+# name too, so tests pass against both latest and older pinned release tags
+exe_aliases = {
+    'zonbud': ['zonbud3'],
+}
+
 # apply subset filter, if provided
 if subset:
     expected_exes = {k: [vv for vv in v if vv in subset] for k, v in expected_exes.items()}
@@ -98,6 +104,14 @@ def get_expected_files(repository) -> Tuple[List[str], List[str]]:
     return exes, libs
 
 
+def alt_names(exe) -> List[str]:
+    """Given an (possibly suffixed) expected exe name, return itself plus any
+    known former/alternate names it may appear as, with the same suffix."""
+    base, _, suffix = exe.partition('.')
+    suffix = f".{suffix}" if suffix else ""
+    return [exe] + [f"{alias}{suffix}" for alias in exe_aliases.get(base, [])]
+
+
 # check install location exists
 assert path.is_dir(), f"Install location {path} doesn't exist"
 print(f"Found install location: {path}")
@@ -109,15 +123,17 @@ def get_expected_files(repository) -> Tuple[List[str], List[str]]:
 
 # check executables exist
 found = sorted([p.name for p in path.glob("*")])
+found_set = set(found)
 exp_exes, exp_libs = get_expected_files(repo)
 expected = exp_exes + exp_libs
-assert set(found) >= set(exp_exes), f"Executables/libraries missing:\n Found {set(found)}\n Expected {set(exp_exes)}"
+missing = [exe for exe in exp_exes if not (set(alt_names(exe)) & found_set)]
+assert not missing, f"Executables/libraries missing:\n Found {found_set}\n Expected {set(exp_exes)}"
 print(f"Found all expected executables/libraries:")
 pprint(expected)
 
 # check executables are on the PATH
 for exe in exp_exes:
-    assert which(exe), f"Executable {exe} not found on path"
+    assert any(which(name) for name in alt_names(exe)), f"Executable {exe} not found on path"
 print(f"Verified executables are on system path")