refactor(ci): route every reusable workflow through setup-r-deps; drop the retry fallback

[achubaty]

Waves 1a–1e of the CI remediation plan. These all touch the same handful of
files, so they are one unit of work, split into six commits.

1a — pkgdown, test-coverage and test-downstream now go through setup-r-deps

Only R-CMD-check.yaml called the composite action. The other three each
carried their own inline apt block, their own setup-pandoc (with three
different retry counts: 3 in setup-r-deps, 1 in test-downstream, 0 in
pkgdown/test-coverage), and their own hardcoded
extra-repositories: 'https://PredictiveEcology.r-universe.dev/'.
test-downstream.yaml also carried a stale copy of the dependency retry
fallback that dropped inputs.extra-packages — the bug fixed in setup-r-deps
in #24 and never backported.

The side effect that matters most: all three now get the RcppParallel/oneTBB
rebuild probe that only R-CMD-check had. A package built against the old TBB
ABI installs without complaint and only fails at dlopen, so on the coverage
job that was covr dying with no coverage and no useful message.

Genuine per-workflow behaviour is preserved:

workflow	preserved
test-coverage	run-in-tmux, and the entire covr/codecov step verbatim
pkgdown	local::. + needs: website, the deploy step, contents: write
test-downstream	the Remotes: unpin and the RemoteSha assertion

The RemoteSha assertion step is byte-identical (verified by diffing the
parsed YAML against main). The unpin script is byte-identical apart from the
environment variable it reads (PKG → PKG_UNDER_TEST), and I ran the
extracted script against a synthetic downstream DESCRIPTION with a one-line
Remotes: field to confirm the YAML round-trip preserved it.

Two ordering details in test-downstream:

• Identify package under test stays deliberately shell-only and moves ahead
  of the dependency setup. It now also exports the name via $GITHUB_ENV,
  because a composite action's steps cannot see the caller's step-level env:.
• The unpin runs as setup-r-deps' new pre-install hook, i.e. still after
  setup-r and still before pak resolves anything. That window is the only
  place it works, and it is now inside the action rather than between two of
  the job's steps.

test-coverage's tmux install moves after setup-r-deps (which is what runs
apt-get update) and now runs its own apt-get update, so system-deps: false
cannot break it.

1b — system-deps and pandoc as workflow_call inputs

setup-r-deps has gated its "Install geospatial system dependencies" step on
system-deps == 'true' since it was extracted, but no reusable workflow ever
forwarded the input, so no caller could turn it off. Both are now inputs on
R-CMD-check, test-coverage and test-downstream, defaulting to true.
system-deps is also on pkgdown; pandoc deliberately is not, because pkgdown
cannot render a site without it.

Not auto-derived from the DESCRIPTION, as the plan requires: reproducible
and SpaDES.project reach terra/sf/raster/geodata through Suggests only, so
any rule based on hard dependencies would decide "pure R" for exactly the two
packages that need GDAL most.

1c — cache-version

Now an input on pkgdown and test-coverage, matching R-CMD-check. Neither could
evict a poisoned dependency cache without a PR to this repo, and a stale cache
was the root cause of both historical libgdal ABI incidents.

Slight scope extension, flagged for review: I added it to
test-downstream.yaml too, plus extra-repositories on all three. The
cache-version rationale applies identically to test-downstream (the plan says
"the only two", which I think undercounts by one), and exposing
extra-repositories with the r-universe default it already hardcoded is what
made the consolidation behaviour-preserving rather than a change. Happy to drop
either if you disagree.

1d — false comments

• The "r-universe terra is libgdal37" claim is gone from pkgdown and
  test-coverage (both comment blocks were deleted wholesale by 1a). It was never
  true: r-universe's base image has never contained ubuntugis, pinned
  FROM ubuntu:noble in May 2026 (libgdal.so.34, matching PPM) and is .38
  today.
• The ABI comment in install-spatial-deps no longer blames quickPlot.
  quickPlot is NeedsCompilation: no (confirmed: no src/, and
  packageDescription("quickPlot", fields = "NeedsCompilation") is no) and
  links nothing — it merely happens to be the package that loads sf/terra
  first.
• libgdal34 → libgdal34t64, which is noble's package name;
  libgdal.so.34 is the soname it provides, so the error string is unchanged.
• Most importantly, install-spatial-deps now says why it still exists, in
  the action and in its README. It exists for the SpaDES module
  repositories: no DESCRIPTION (dependencies live in
  defineModule(reqdPkgs = ...)), installation via Require::Require() rather
  than pak, and Require's .onLoad deliberately sets PKG_SYSREQS=false /
  PKG_SYSREQS_SUDO=false because CRAN treats a package shelling out to sudo
  as machine hijacking. Verified empirically against Require 2.0.0.9036:
  loading the package sets both variables to false. On that path nothing else
  installs GDAL. Without the note, the action reads as dead code now that
  setup-r-deps covers the package repos.

1e — the retry fallback, and permissions:

The fallback was never a retry. The primary path is pak::lockfile_install()
(upgrade = FALSE); the fallback called pak::local_install_dev_deps(), whose
default is upgrade = TRUE — bypassing both the lockfile and the cache to
resolve a more aggressive set than the one that had just failed. Paired with
continue-on-error: true on the primary step, a genuinely broken dependency
bought ~90 minutes of futile reinstallation instead of an immediate red.
continue-on-error is deleted with it, so a failed install is now red at once.

It is also unnecessary. From the installed pak's own NEWS:

pak now retries failed HTTP requests by default, using an exponential backoff
(and honoring the Retry-After header).

That entry is under the # pak 0.11.0 heading, not 0.11.1 as the plan
states — 0.11.1 is simply the release that carries it (CRAN, 2026-07-22), and
setup-r-dependencies defaults to pak-version: stable. The conclusion is
unaffected; noting the version discrepancy for the record.

permissions: blocks: none of the four reusable workflows declared any, so a
caller inheriting an org default of read/write handed a writable GITHUB_TOKEN
to every step — including the third-party packages post-install fetches from
GitHub. Three get contents: read; pkgdown's job gets contents: write, which
its gh-pages deploy genuinely needs.

Not read-all, despite the plan (and r-lib) suggesting it — this would have
broken SpaDES.tools. A called workflow whose permissions: request exceeds
what the caller's job granted fails validation, before the run starts
(The workflow is requesting 'actions: read', but is only allowed 'actions: none'), rather than being silently clamped. I audited every caller in
the org: SpaDES.tools' thin callers set permissions: {} at file level and
re-grant exactly contents: read on the job, so read-all — which requests
read on every scope — would have taken down its R-CMD-check, test-coverage
and test-downstream on their next run. read-all is correct for a standalone
workflow like r-lib's templates; it is not correct here. contents: read is
what the checkout needs, and is a subset of every current caller's grant.
See commit ffaa23b; the intermediate read-all version is left in history
deliberately, since the reasoning is the useful part.

self-test

self-test.yaml cannot reach the reusable workflows (its header explains why:
no DESCRIPTION at this repo's root), but it does cover the composite actions,
and both new setup-r-deps inputs are now exercised. An unknown input to a
composite action is a warning, not an error, so a rename would otherwise
surface as a pkgdown build quietly missing its site tooling — not as anything
red.

• pre-install asserts positively that it runs before dependency resolution:
  it fails if terra, sessioninfo or abind are already installed at that point,
  and drops a marker a later step checks.
• needs is covered by a new Config/Needs/self-test: abind in the fixture.
  abind is in nothing else's dependency closure here, so its presence can only
  have arrived through that input.

Validation

• actionlint 1.7.12 clean on the whole repo (clean on main too, so this is a
  like-for-like comparison).
• Every YAML file parses (yaml.safe_load).
• Every embedded R script extracted from every workflow and action and
  syntax-checked with parse().
• The extracted unpin script executed against a synthetic downstream
  DESCRIPTION; read.dcf() round-trips the rewritten file.

Risks a human should look at

1. The apt package set shifts slightly for the three consolidated
   workflows. install-spatial-deps adds pkg-config, uses
   --no-install-recommends, and drops the apt-get install -f -y /
   --fix-missing belt-and-braces the inline blocks had. Intended, but it is a
   real behaviour change on three workflows at once.

2. pre-install interpolates a ~35-line R script through a composite action
   input. It works and is tested, but it is not pretty; the alternative was
   rewriting the unpin in shell, which I would not do to that particular code.

3. Draft on purpose: the reusable workflows reference
   PredictiveEcology/actions/setup-r-deps@main, so needs and pre-install
   do not exist for them until this merges. The self-test uses the local path
   and does cover the branch's copy, but the workflows themselves are only
   proven by a consumer's first run after merge. Worth watching one
   test-downstream and one pkgdown run.

4. pkgdown now fails earlier when a caller under-grants. Declaring
   contents: write means a caller whose job does not grant it fails
   validation up front, instead of running the whole build and failing at the
   deploy step. That is better behaviour, but it is a behaviour change: it
   assumes the four callers that declare no permissions: at all
   (SpaDES.core, reproducible, SpaDES, SpaDES.project) sit on a repository
   default of read/write. They must today, or their deploys would already be
   failing — worth a sanity check before this leaves draft.

5. Caller audit, for the record. Only SpaDES.tools declares permissions
   on its caller jobs (contents: read ×3, contents: write for pkgdown);
   SpaDES.core, reproducible, SpaDES, SpaDES.project, NetLogoR and map declare
   none and inherit the repository default. No caller passes an input this PR
   removes, because it removes none.

🤖 Generated with Claude Code

[achubaty]

Withdrawing this — PredictiveEcology/actions is under active rework by its owner, so an external PR here would be superseded rather than reviewed. Closing to keep the repo's PR queue clean.

The branch ci/route-workflows-through-setup-r-deps is left in place, so nothing is lost if any of it is wanted later. The substantive findings behind it, for the record:

• test-coverage, pkgdown and test-downstream each carry their own copy of the dependency setup that setup-r-deps already provides — including three setup-pandoc invocations with three different retry counts (3/1/0), three hardcoded extra-repositories, and a copy of the retry fallback in test-downstream that still drops inputs.extra-packages (a bug already fixed in setup-r-deps). They also never run the RcppParallel/oneTBB rebuild probe.
• setup-r-deps declares system-deps and pandoc, but no reusable workflow forwards them, so no caller can opt out of the geospatial install.
• pkgdown.yaml and test-coverage.yaml expose no cache-version, and a stale package cache was the actual root cause of both historical libgdal ABI incidents.
• Worth knowing before anyone adds permissions: to the reusable workflows: a called workflow requesting more than the caller's job granted fails validation before the run starts, it is not silently clamped. permissions: read-all would therefore have broken SpaDES.tools, whose thin callers set permissions: {} and re-grant exactly contents: read. contents: read is the safe value for a reusable workflow; read-all is right only for standalone templates.

🤖 Generated with Claude Code