From c132a21b8a207d89361c6938262f3c1a40654755 Mon Sep 17 00:00:00 2001 From: Robadob <742154+Robadob@users.noreply.github.com> Date: Tue, 1 Sep 2026 00:58:39 +0000 Subject: [PATCH] [actions] update sandpaper workflow to version v1.0.2 --- .github/workflows/README.md | 342 +++++++++---------- .github/workflows/docker_apply_cache.yaml | 228 +++++-------- .github/workflows/docker_build_deploy.yaml | 31 +- .github/workflows/docker_pr_receive.yaml | 88 +---- .github/workflows/pr-close-signal.yaml | 2 +- .github/workflows/pr-comment.yaml | 20 +- .github/workflows/pr-post-remove-branch.yaml | 4 +- .github/workflows/pr-preflight.yaml | 4 +- .github/workflows/sandpaper-version.txt | 1 - .github/workflows/update-cache.yaml | 14 +- .github/workflows/update-workflows.yaml | 20 +- .github/workflows/workflows-version.txt | 1 + 12 files changed, 320 insertions(+), 435 deletions(-) delete mode 100644 .github/workflows/sandpaper-version.txt create mode 100644 .github/workflows/workflows-version.txt diff --git a/.github/workflows/README.md b/.github/workflows/README.md index a57a31c0..4516bb10 100644 --- a/.github/workflows/README.md +++ b/.github/workflows/README.md @@ -1,21 +1,9 @@ -# Carpentries Workflows +# Workbench Workflows Documentation -This directory contains workflows to be used for Lessons using the Carpentries Workbench lesson infrastructure. +These GitHub Actions workflows manage and maintain the build processes for lessons using the Carpentries Workbench on GitHub. -The three `docker-` workflows build lessons and maintain packages. -The workflows run using the [workbench-docker](https://github.com/carpentries/workbench-docker) container. -This container comprises prebuilt and installed dependencies of the core Workbench packages, i.e. sandpaper, pegboard and varnish. -Two `update-` workflows handle: - - checking for new renv packages and creating a Pull Request (PR) when a renv.lock file updates (`update-cache.yaml`) - - checking for updated versions of these workflow files (`update-workflows.yaml`) - -The rest of the `pr-` workflows handle pull request management via base GitHub Actions. - -For Carpentries Core Curriculum lessons across our lesson programmes, maintenance of these workflows should be minimal. -For your own lesson repositories, it is important to understand the different workflows and what they do. - -## Managing Updates +## Managing Workflow Updates By using prebuilt Docker containers that are managed by the Carpentries core Workbench maintainers, these workflows are designed to be rarely updated. @@ -24,7 +12,11 @@ You can do this locally using your own R and Workbench installation, or via the ### Updating locally -In a terminal/git bash, navigate to the lesson folder where you want to update the workflows. +In a terminal/git bash, navigate to the lesson folder where you want to update the workflows, e.g.: + +```bash +cd ~/lessons/shell-novice +``` Then, start an R session and: @@ -47,20 +39,46 @@ $ git commit -m "Manual update to docker workflows" $ git push origin main ``` -This will automatically start the "01 Maintain: Build and Deploy Site" workflow. +> [!NOTE] +> For non-renv lessons, this is all the setup you need! +> +> For renv-enabled lessons: +> - Cancel any "01 Maintain: Build and Deploy Site" workflow currently running +> - Run the "02 Maintain: Check for Updated Packages" workflow and merge any PR opened to update the renv lockfile +> - This should automatically run the "03 Maintain: Apply Package Cache" workflow to install packages and build the cache +> - A successful cache build should then trigger the "01 Maintain: Build and Deploy Site" workflow -This will be the extent of requirements for non-renv lessons. +#### Updating to a specific workflow release or branch -#### Lessons that use Rmd and {renv} +To test new Workbench workflow features or branches, or to pin to a specific release, the `branch` option can be supplied to `update_github_workflows()`. -For renv-enabled lessons: -- Cancel the "01 Maintain: Build and Deploy Site" run that automatically started following the push to main -- Run the "02 Maintain: Check for Updated Packages" -- Run the "03 Maintain: Apply Package Cache" -- Run the "01 Maintain: Build and Deploy Site" +For a given branch: + +```r +sandpaper::update_github_workflows(branch="develop") +``` + +Or for a given release version: +```r +sandpaper::update_github_workflows(branch="1.0.1") +``` ### Updating using GitHub +#### Official lessons + +"Official" lessons are those in the lesson program repositories, Incubator, or Lab. +They need no extra setup as this is all managed for you as part of the Carpentries GitHub organisations. + +To update the workflows, either: +- wait for the scheduled run of the "04 Maintain: Update Workflow Files" at approximately midnight every Tuesday +- go to the Actions tab on GitHub, click "04 Maintain: Update Workflow Files" on the left, then "Run Workflow" on the right + +Once complete, this will raise a PR with any changes to the workflows that are needed. +If you are happy with the changes made, you can merge the PR into your lesson repository. + +#### Your own lessons + This presumes you: - already have a lesson repository available on GitHub - have enabled workflows in the lesson repo @@ -74,208 +92,190 @@ Once set up, run the "04 Maintain: Update Workflow Files" (`update-workflows.yam This will raise a PR with any changes to the workflows that are needed. If you are happy with the changes made, you can merge the PR into your lesson repository. -## Lesson Builds and Deployment - -### 01 Maintain: Build and Deploy Site (docker_build_deploy.yaml) - -This is the main workflow that you will encounter most often. -It will only act on the main branch of the lesson repository. +## Dependency Images for RMarkdown Lessons -This workflow does the following: - 1. checks out the lesson - 2. provisions the following resources - - the Workbench Docker container - - lesson dependencies if needed (stored in a cache) - 3. builds the lesson via `sandpaper:::ci_deploy()` +Lessons that use R packages and RMarkdown are built on GitHub using Docker images within these workflows. +These images are based on the [workbench-docker](https://github.com/carpentries/workbench-docker) image. +This base image only contains the Workbench packages to build lessons and not any extra R packages your lesson might need. -If your lesson contains rendered content using RMarkdown and/or any associated R package dependencies, you will need to generate and apply the renv cache. -Please read the [Caching](#caching) section below. +Therefore, there are two steps to perform to resolve the required R packages in a lesson, and then generate a Docker image layer comprising those packages. -#### Caching +The "02 Maintain: Check for Updated Packages" workflow checks for any used R packages and their versions, and if successful, opens a Pull Request to update your lesson's renv lockfile (`renv.lock`). +Once the PR is merged, the "03 Maintain: Apply Package Cache" workflow builds the dependency image layer with `docker build` and publishes it in your user or organisation account Packages area. > [!NOTE] > Caching is only relevant for lessons that use Rmd files and renv to manage R packages. > If you are building basic markdown documents, caching will not apply to you, and the only > workflow that needs to be run is "01 Maintain: Build and Deploy Site". -In summary, generating a reusable package cache is achieved by running the "02 Maintain: Check for Updated Packages" workflow, and then the "03 Maintain: Apply Package Cache" workflow. +### Publishing dependency images -These workflows are separated to ensure that once you have a successful build with a working renv cache, this cache is stored within GitHub's infrastructure, and will be reused by the Workbench Docker container. -This means that lesson builds will be faster once an renv cache is created and reused by the Docker container. +The two dependency workflows are separated to ensure that once you have a successful build with a working renv environment, the resulting dependency image is stored and will be reused by the Workbench Docker container. +This means that lesson builds will be faster and more consistent once a dependency image is created and reused. This is doubly important if you need very specific versions of R packages, i.e. "pinning". -Another major bonus of this setup is that you can keep using this cache indefinitely to build your lesson. -This is important if you need very specific versions of R packages ("pinning"). +This setup means that this dependency image layer is available indefinitely: +- to build your lesson, improving robustness and reproducibility +- for others to use as a complete environment in their local builds, teaching environments, or Codespaces -If and when you want to perform an update to the cache, you can re-run the "02 Maintain: Check for Updated Packages" and verify that your lesson still builds with the new packages. -If all looks good, re-run the "03 Maintain: Apply Package Cache" workflow, and this will write a new renv cache file to GitHub. +If and when you want to perform an update to the dependency image, you can re-run the "02 Maintain: Check for Updated Packages" workflow and verify that your lesson still builds with any new packages or changes. +The "03 Maintain: Apply Package Cache" workflow will publish a new repository- or organisation-local GHCR image for the lesson. -In any case, the renv cache is invalidated by new versions of the `renv.lock` file. +As such, the dependency image is invalidated by new versions of the `renv.lock` file. This happens: - - if you update your lockfile locally by using the `sandpaper::update_cache()` function, and then push it to the lesson repository + - if you update your lockfile locally by using the `sandpaper::update_cache()` and `sandpaper::manage_deps()` functions, and then push it to the lesson repository - when you run the "02 Maintain: Check for Updated Packages" and there are new packages to install -More information on managing local renv caches for lessons can be found in the [Sandpaper packages vignettes](https://carpentries.github.io/sandpaper/articles/building-with-renv.html). +More information on managing local renv-based lesson dependencies can be found in the [Sandpaper packages vignettes](https://carpentries.github.io/sandpaper/articles/building-with-renv.html). -#### Using different package cache versions +#### Using different dependency image versions -There are times when you may want to go back to a previous renv package cache file: +There are times when you may want to go back to a previous dependency image: - if you run "02 Maintain: Check for Updated Packages" and "03 Maintain: Apply Package Cache" and the cache generation fails for some reason - if there is a new R package that produces incorrect or broken lesson output + - a new R version is released and downstream packages fail to build and install, and need updating by the package maintainer(s) -To choose a previous cache file version for your builds, go to the Actions tab, and click Caches in the left hand pane. - -Cache files should have the following name format: +Dependency images will have the following name format, where IMAGE is the workbench-docker image version, and HASHSUM is the `renv.lock` lockfile hash: ``` - OS HASHSUM -[ | ] [ | ] -Linux--renv-2e499eb706112971b2cffceb49b55a6efe49f3ed75cd6579b10ff224489daca4 +IMAGE HASHSUM +[ | ] [ | ] +v0.2.4_renv-2e499eb706112971b2cffceb49b55a6efe49f3ed75cd6579b10ff224489daca4 ``` -Once you have 2 or more cache files, you can choose which one you want to use. - -Copy the hashsum part of the desired cache file you want to use, e.g. `2e499eb706112971b2cffceb49b55a6efe49f3ed75cd6579b10ff224489daca4`. +Copy the hashsum part of the desired image tag you want to use, e.g. `2e499eb706112971b2cffceb49b55a6efe49f3ed75cd6579b10ff224489daca4`. Then either: 1. Add a repository variable called CACHE_VERSION, and paste in the hash - - Go to ... - 2. Run the "01 Maintain: Build and Deploy Site" manually, supplying the CACHE_VERSION input - - Go to ... + 2. Run the "01 Maintain: Build and Deploy Site" manually, supplying the `Optional renv cache version override` input -If you have no caches listed, make sure to run the "02 Maintain: Check for Updated Packages" and "03 Maintain: Apply Package Cache" to create a new renv cache file. +If you have no images listed, make sure to run the "02 Maintain: Check for Updated Packages" and "03 Maintain: Apply Package Cache" workflows to publish a new dependency image. -## Updates +> [!NOTE] +> If you are maintaining an official lesson, dependency images are saved to the Carpentries lesson program organisation, e.g. `datacarpentry`, GHCR package namespace. +> Once a successful dependency image has been published, the build workflows will use it automatically when the matching Docker version tag exists, e.g. 'latest' or a specific version. +> +> If you are developing a lesson in your own repository, the dependency images are stored in your repository's GHCR package namespace. +> You can see available images by going to your user or organisation's Packages tab, e.g. `https://github.com/?tab=packages`. -### Setup Information +#### Pruning dependency image layers -These workflows run on a mix of schedules, automatic triggers, and at the maintainer's request. -Because they create pull requests that update workflows/require the downstream actions to run, -they need a special repository/organization secret token called -`SANDPAPER_WORKFLOW` and it must have the `public_repo` and `workflow` scope. +Through the lifetime of a lesson, an increasing number of dependency images will be generated. +As the images are public, GitHub currently charges no storage, or network ingress or egress fees to upload or download them. -This can be an individual user token, OR it can be a trusted bot account. If you -have a repository in one of the official Carpentries organisations, then you do not -need to worry about this token being present because the Carpentries Core Team -will take care of supplying this token. +The "03 Maintain: Apply Package Cache" workflow will automatically check the number of published dependency images and keep each version published plus one underlying untagged digest (if any) for each version. +This means it is possible to roll back easily to a previous version or digest, but not end up with a huge number of dependency images to manage. -If you want to use your personal account: you can go to - -to create a token. Once you have created your token, you should copy it to your -clipboard and then go to your repository's settings > secrets > actions and -create or edit the `SANDPAPER_WORKFLOW` secret, pasting in the generated token. +In any case, you can manually delete any versions you wish by: +- going to your user or organisation's Packages tab, e.g. `https://github.com/?tab=packages`. +- selecting the dependency image you want to manage, e.g. `-deps` +- selecting `Package settings` on the right hand side +- deleting any images -If you do not specify your token correctly, the runs will not fail and they will -give you instructions to provide the token for your repository. +> [!NOTE] +> Deleting these images manually may break your builds. +> Only perform this action if you are sure you want to delete the generated dependency images. +> +> If you mistakenly delete an image, you can rebuild it by rerunning the "03 Maintain: Apply Package Cache" workflow. -### "02 Maintain: Check for Updated Packages" (update-cache.yaml) -For lessons that have generated content, we use {renv} to ensure that the output -is stable. This is controlled by a single lockfile which documents the packages -needed for the lesson and the version numbers. This workflow is skipped in -lessons that do not have generated content. +## User Settings -Packages are frequently updated, fixing bugs or introducing new features. It's a -good idea to make sure these packages can be both: updated periodically, or; or left -static to ensure consistent lesson builds. +Input level variables are documented in the `carpentries/actions` repository READMEs for each composite action. -The update cache workflow will do this by: -- checking repositories for updates -- updating the renv lockfile -- summarising the updated packages and their versions in a branch called `updates/packages` -- creating a pull request with _only the renv lockfile changed_ +Specific repository level variables can be set that will force particular options across all workflow runs. -From here, the markdown documents will be rebuilt and you can inspect what has -changed based on how the packages have updated. +### 01 Maintain: Build and Deploy Site (docker_build_deploy.yaml) -If all steps pass in this workflow, you can safely merge the PR that is raised. -Once the PR is merged, the "03 Maintain: Apply Package Cache" workflow will run -automatically. +Repository-level variables for this workflow are: +- WORKBENCH_TAG + - The workbench-docker release version to use for a given build + - This can be set to a specific version number to force all builds to use a given container version + - Default is unset or `latest` +- BUILD_RESET + - Force a reset of previously build markdown files + - Setting this variable value to `true` will force sandpaper to delete any previously build markdown files + - Default is unset or `false` +- AUTO_MERGE_WORKBENCH_VERSION_UPDATE + - Control merge behaviour of the workbench-docker version update PR + - When a new workbench Docker image version is detected, usually after a sandpaper, varnish, or pegboard update, its version number will be incremented + - If a newer version is available, a PR will be auto-generated that updates the `.github/workbench-docker-version.txt` file, and this PR will be auto-merged + - To not auto-merge this PR and to choose when to update the Docker version used, set this to `false`. + - Default is unset or `true` +- LANG_CODE + - Two-letter language code that triggers the use of Joel Nitta's {dovetail} package for lesson translation + - This is used in the internationalisation repos of the main Carpentry lesson programs + - Default is unset or `''` + +### 02 Maintain: Check for Updated Packages (update-cache.yaml) + +Repository-level variables for this workflow are: +- LOCKFILE_CACHE_GEN + - Passed to the `generate-cache` input of the [update-lockfile](https://github.com/carpentries/actions/tree/main/update-lockfile) action + - A temporary renv cache is generated when this workflow runs + - If this option is set to `false`, no temporary cache will be generated + - Default is `true` +- FORCE_RENV_INIT + - Passed to the `force-renv-init` input of the [update-lockfile](https://github.com/carpentries/actions/tree/main/update-lockfile) action + - renv initialises a cache based on a given lockfile + - If this lockfile is particularly old or packages have broken/unresolvable dependencies, then builds will fail + - If this option is set to `true`, a full renv reinitialisation will occur, "wiping the slate clean" + - This option is useful if you're using Bioconductor packages which often break when new Bioconductor releases happen + - Default is `false` +- UPDATE_PACKAGES + - Passed to the `update` input of the [update-lockfile](https://github.com/carpentries/actions/tree/main/update-lockfile) action + - If set to `false` only package hydration will happen and no package update checks will occur + - Default is `true` ### 03 Maintain: Apply Package Cache (docker_apply_cache.yaml) -This workflow takes the updated lockfile produced in "02 Maintain: Check for Updated Packages" -and uses it to produce a cached file stored within GitHub's infrastructure. - -This cached file can then be reused repeatedly by the "01 Maintain: Build and Deploy Site" -workflow. - -This workflow is run automatically when the PR generated by "02 Maintain: Check for Updated Packages" -is closed and merged. - -You would only ever need to run this workflow manually: -- if your cache gets removed by GitHub due to age or non-use -- if your cache file contains packages that cannot be used by a Workbench Docker container's newer R version - -### "04 Maintain: Update Workflow Files" (update-workflows.yaml) - -The {sandpaper} repository was designed to do as much as possible to separate -the tools from the content. For local builds, this is absolutely true as you -can develop and build lessons without any GitHub workflows. When it comes to -workflow files on GitHub itself for managed builds online, the workflows must -live inside the lesson repository. - -This workflow ensures that the workflow files are up-to-date. It downloads the -`update-workflows.sh` script from GitHub and runs it. The script will do the -following: +Repository-level variables for this workflow are: +- WORKBENCH_TAG + - The workbench-docker release version to use for a given build + - This can be set to a specific version number to force all builds to use a given container version + - Default is unset or `latest` -1. check the recorded version of sandpaper against the current version on GitHub -2. update the files if there is a difference in versions +### 04 Maintain: Update Workflow Files (update-workflows.yaml) -After the files are updated, and if there are any changes, they are pushed to a -branch called `update/workflows` and a pull request is created. Maintainers are -encouraged to review the changes and accept the pull request if the outputs -are okay. +There are no repository variables for this workflow. -This update is run weekly or on demand. ## Pull Request and Review Management -Because our lessons execute code, pull requests are a secruity risk for any -lesson and thus have security measures associted with them. **Do not merge any -pull requests that do not pass checks and do not have bots commented on them.** +Because our lessons execute code, pull requests are a security risk for any lesson and thus have security measures associated with them. +**Do not merge any pull requests that do not pass checks and do not have bots commented on them.** -This series of workflows all go together and are described in the following -diagram and the below sections: +This series of workflows all go together and are described in the following diagram and the below sections: ![Graph representation of a pull request](https://carpentries.github.io/sandpaper/articles/img/pr-flow.dot.svg) ### Pre Flight Pull Request Validation (pr-preflight.yaml) -This workflow runs every time a pull request is created and its purpose is to -validate that the pull request is okay to run. This means the following things: +This workflow runs every time a pull request is created and its purpose is to validate that the pull request is okay to run. +This means the following things: 1. The pull request does not contain modified workflow files -2. If the pull request contains modified workflow files, it does not contain - modified content files (such as a situation where @carpentries-bot will - make an automated pull request) -3. The pull request does not contain an invalid commit hash (e.g. from a fork - that was made before a lesson was transitioned from styles to use the - workbench). +2. If the pull request contains modified workflow files, it does not contain modified content files + (such as a situation where @carpentries-bot will make an automated pull request) +3. The pull request does not contain an invalid commit hash + (e.g. from a fork that was made before a lesson was transitioned from styles to use the Workbench). -Once the checks are finished, a comment is issued to the pull request, which -will allow maintainers to determine if it is safe to run the -"Receive Pull Request" workflow from new contributors. +Once the checks are finished, a comment is issued to the pull request, which will allow maintainers to determine if it is safe to run the "Receive Pull Request" workflow from new contributors. ### Receive Pull Request (docker_pr_receive.yaml) -**Note of caution:** This workflow runs arbitrary code by anyone who creates a -pull request. GitHub has safeguarded the token used in this workflow to have no -privileges in the repository, but we have taken precautions to protect against -spoofing. +**Note of caution:** This workflow runs arbitrary code by anyone who creates a pull request. +GitHub has safeguarded the token used in this workflow to have no privileges in the repository, but we have taken precautions to protect against spoofing. -This workflow is triggered with every push to a pull request. If this workflow -is already running and a new push is sent to the pull request, the workflow -running from the previous push will be cancelled and a new workflow run will be -started. +This workflow is triggered with every push to a pull request. +If this workflow is already running and a new push is sent to the pull request, the workflow running from the previous push will be cancelled and a new workflow run will be started. -The first step of this workflow is to check if it is valid (e.g. that no -workflow files have been modified). If there are workflow files that have been -modified, a comment is made that indicates that the workflow is not run. If -both a workflow file and lesson content is modified, an error will occurr. +The first step of this workflow is to check if it is valid (e.g. that no workflow files have been modified): +- If there are workflow files that have been modified, a comment is made that indicates that the workflow will not continue. +- If both a workflow file and lesson content is modified, an error will occur and the workflow will not continue. -The second step (if valid) is to build the generated content from the pull -request. This builds the content and uploads three artifacts: +The second step (if valid) is to build the generated content from the pull request. +This builds the content and uploads three artifacts: 1. The pull request number (pr) 2. A summary of changes after the rendering process (diff) @@ -288,25 +288,21 @@ The artifacts produced are used by the "Comment on Pull Request" workflow. This workflow is triggered if the `docker_pr_receive.yaml` workflow is successful. The steps in this workflow are: -1. Test if the workflow is valid and comment the validity of the workflow to the - pull request. -2. If it is valid: create an orphan branch with two commits: the current state - of the repository and the proposed changes. +1. Test if the workflow is valid and comment the validity of the workflow to the pull request. +2. If it is valid: create an orphan branch with two commits: the current state of the repository and the proposed changes. 3. If it is valid: update the pull request comment with the summary of changes -Importantly: if the pull request is invalid, the branch is not created so any -malicious code is not published. +Importantly: if the pull request is invalid, the branch is not created so any malicious code is not published. -From here, the maintainer can request changes from the author and eventually -either merge or reject the PR. When this happens, if the PR was valid, the -preview branch needs to be deleted. +From here, the maintainer can request changes from the author and eventually either merge or reject the PR. +When this happens, if the PR was valid, the preview branch needs to be deleted. ### Send Close PR Signal (pr-close-signal.yaml) -Triggered any time a pull request is closed. This emits an artifact that is the -pull request number for the next action +Triggered any time a pull request is closed. +This emits an artifact that is the pull request number for the next action. ### Remove Pull Request Branch (pr-post-remove-branch.yaml) -Tiggered by `pr-close-signal.yaml`. This removes the temporary branch associated with -the pull request (if it was created). +Triggered by `pr-close-signal.yaml`. +This removes the temporary branch associated with the pull request (if it was created). diff --git a/.github/workflows/docker_apply_cache.yaml b/.github/workflows/docker_apply_cache.yaml index 2c3a3bce..dcebb3b3 100644 --- a/.github/workflows/docker_apply_cache.yaml +++ b/.github/workflows/docker_apply_cache.yaml @@ -1,5 +1,5 @@ name: "03 Maintain: Apply Package Cache" -description: "Generate the package cache for the lesson after a pull request has been merged or via manual trigger, and cache in S3 or GitHub" +description: "Build and publish the lesson dependency image after a pull request has been merged or via manual trigger" on: workflow_dispatch: inputs: @@ -7,6 +7,16 @@ on: description: 'Who triggered this build?' required: true default: 'Maintainer (via GitHub)' + force-dependency-image-rebuild: + description: 'Rebuild the dependency image layer even if one already exists?' + required: false + default: false + type: boolean + prune-keep-count: + description: 'How many existing dependency image layers to keep?' + required: false + default: 1 + type: number pull_request: types: - closed @@ -42,171 +52,120 @@ jobs: runs-on: ubuntu-latest needs: preflight if: needs.preflight.outputs.do-apply == 'true' - permissions: - id-token: write outputs: renv-needed: ${{ steps.check-for-renv.outputs.renv-needed }} renv-cache-hashsum: ${{ steps.check-for-renv.outputs.renv-cache-hashsum }} - renv-cache-available: ${{ steps.check-for-renv.outputs.renv-cache-available }} steps: - name: "Check for renv" id: check-for-renv - uses: carpentries/actions/renv-checks@main + uses: carpentries/actions/renv-checks@v1 with: - role-to-assume: ${{ secrets.AWS_GH_OIDC_ARN }} - aws-region: ${{ secrets.AWS_GH_OIDC_REGION }} WORKBENCH_TAG: ${{ vars.WORKBENCH_TAG || 'latest' }} - token: ${{ secrets.GITHUB_TOKEN }} + skip-cache-check: true no-renv-cache-used: - name: "No renv cache used" + name: "No renv package dependency image needed" runs-on: ubuntu-latest needs: check-renv if: needs.check-renv.outputs.renv-needed != 'true' steps: - - name: "No renv cache needed" - run: echo "No renv cache needed for this lesson" - - renv-cache-available: - name: "renv cache available" - runs-on: ubuntu-latest - needs: check-renv - if: needs.check-renv.outputs.renv-cache-available == 'true' - steps: - - name: "renv cache available" - run: echo "renv cache available for this lesson" + - name: "No dependency image needed" + run: echo "No renv dependency image needed for this lesson" update-renv-cache: - name: "Update renv Cache" + name: "Publish renv package dependency image" runs-on: ubuntu-latest needs: check-renv - if: | - needs.check-renv.outputs.renv-needed == 'true' && - needs.check-renv.outputs.renv-cache-available != 'true' && - ( - github.event_name == 'workflow_dispatch' || - ( - github.event.pull_request.merged == true && - ( - ( - contains( - join(github.event.pull_request.labels.*.name, ','), - 'type: package cache' - ) && - github.event.pull_request.head.ref == 'update/packages' - ) - || - ( - contains( - join(github.event.pull_request.labels.*.name, ','), - 'type: workflows' - ) && - github.event.pull_request.head.ref == 'update/workflows' - ) - || - ( - contains( - join(github.event.pull_request.labels.*.name, ','), - 'type: docker version' - ) && - github.event.pull_request.head.ref == 'update/workbench-docker-version' - ) - ) - ) - ) + if: needs.check-renv.outputs.renv-needed == 'true' permissions: - checks: write - contents: write - pages: write - id-token: write - container: - image: ghcr.io/carpentries/workbench-docker:${{ vars.WORKBENCH_TAG || 'latest' }} - env: - WORKBENCH_PROFILE: "ci" - GITHUB_PAT: ${{ secrets.GITHUB_TOKEN }} - RENV_PATHS_ROOT: /home/rstudio/lesson/renv - RENV_PROFILE: "lesson-requirements" - RENV_VERSION: ${{ needs.check-renv.outputs.renv-cache-hashsum }} - RENV_CONFIG_EXTERNAL_LIBRARIES: "/usr/local/lib/R/site-library" - volumes: - - ${{ github.workspace }}:/home/rstudio/lesson - options: --cpus 2 + contents: read + packages: write steps: - - uses: actions/checkout@v4 - - - name: "Debugging Info" - run: | - echo "Current Directory: $(pwd)" - ls -lah /home/rstudio/.workbench - ls -lah $(pwd) - Rscript -e 'sessionInfo()' - shell: bash - - - name: "Mark Repository as Safe" - run: | - git config --global --add safe.directory $(pwd) - shell: bash - - - name: "Ensure sandpaper is loadable" - run: | - .libPaths() - library(sandpaper) - shell: Rscript {0} - - - name: "Setup Lesson Dependencies" - run: | - Rscript /home/rstudio/.workbench/setup_lesson_deps.R - shell: bash - - - name: "Fortify renv Cache" - run: | - Rscript /home/rstudio/.workbench/fortify_renv_cache.R - shell: bash + - uses: actions/checkout@v6 - name: "Get Container Version Used" id: wb-vers - uses: carpentries/actions/container-version@main + uses: carpentries/actions/container-version@v1 with: WORKBENCH_TAG: ${{ vars.WORKBENCH_TAG }} renv-needed: ${{ needs.check-renv.outputs.renv-needed }} token: ${{ secrets.GITHUB_TOKEN }} - - name: "Validate Current Org and Workflow" - id: validate-org-workflow - uses: carpentries/actions/validate-org-workflow@main + - name: Log in to GHCR + uses: docker/login-action@v4 with: - repo: ${{ github.repository }} - workflow: ${{ github.workflow }} + registry: ghcr.io + username: ${{ github.actor }} + password: ${{ secrets.GITHUB_TOKEN }} + + - name: Set dependency image tags + id: image + env: + IMAGE_OWNER: ${{ github.repository_owner }} + IMAGE_NAME: ${{ github.event.repository.name }} + WB_VERSION: ${{ steps.wb-vers.outputs.container-version }} + RENV_HASH: ${{ needs.check-renv.outputs.renv-cache-hashsum }} + run: | + set -euo pipefail + exact_image="ghcr.io/${IMAGE_OWNER}/${IMAGE_NAME}-deps:${WB_VERSION}_renv-${RENV_HASH}" + latest_image="ghcr.io/${IMAGE_OWNER}/${IMAGE_NAME}-deps:latest" - - name: "Configure AWS credentials via OIDC" - id: aws-creds + # lowercaseify + echo "exact_image=${exact_image,,}" >> "$GITHUB_OUTPUT" + echo "latest_image=${latest_image,,}" >> "$GITHUB_OUTPUT" + shell: bash + + - name: Check for existing dependency image tag + id: image-exists env: - role-to-assume: ${{ secrets.AWS_GH_OIDC_ARN }} - aws-region: ${{ secrets.AWS_GH_OIDC_REGION }} + EXACT_IMAGE: ${{ steps.image.outputs.exact_image }} + run: | + set -euo pipefail + if docker manifest inspect "${EXACT_IMAGE}" >/dev/null 2>&1; then + echo "exists=true" >> "$GITHUB_OUTPUT" + echo "## ⚠️ Dependency image already exists" >> $GITHUB_STEP_SUMMARY + echo "Dependency image already exists for this renv hash: ${EXACT_IMAGE}" >> $GITHUB_STEP_SUMMARY + echo "Dependency image already exists for this renv hash: ${EXACT_IMAGE}" + else + echo "exists=false" >> "$GITHUB_OUTPUT" + echo "No existing dependency image found for this renv hash: ${EXACT_IMAGE}" + fi + shell: bash + + - name: Build and push dependency image layer + id: build-push-deps-layer if: | - steps.validate-org-workflow.outputs.is_valid == 'true' && - env.role-to-assume != '' && - env.aws-region != '' - uses: aws-actions/configure-aws-credentials@v5.0.0 + steps.image-exists.outputs.exists != 'true' || + ( + github.event_name == 'workflow_dispatch' && + github.event.inputs.force-dependency-image-rebuild == 'true' + ) + uses: carpentries/actions/build-dependency-image@v1 with: - role-to-assume: ${{ env.role-to-assume }} - aws-region: ${{ env.aws-region }} - output-credentials: true - - - name: "Upload cache object to S3" - id: upload-cache - uses: carpentries/actions-cache@frog-matchedkey-1 + workbench-tag: ${{ vars.WORKBENCH_TAG || 'latest' }} + github-token: ${{ secrets.GITHUB_TOKEN }} + github-repository: ${{ github.repository }} + github-sha: ${{ github.sha }} + exact-image: ${{ steps.image.outputs.exact_image }} + latest-image: ${{ steps.image.outputs.latest_image }} + build-context: ${{ github.workspace }} + + prune-dependency-images: + name: "Prune Dependency Images" + runs-on: ubuntu-latest + needs: check-renv + steps: + - name: Prune any old dependency image layers + uses: carpentries/actions/prune-dependency-images@v1 + if: needs.check-renv.outputs.renv-needed == 'true' with: - accessKey: ${{ steps.aws-creds.outputs.aws-access-key-id }} - secretKey: ${{ steps.aws-creds.outputs.aws-secret-access-key }} - sessionToken: ${{ steps.aws-creds.outputs.aws-session-token }} - bucket: workbench-docker-caches - path: | - /home/rstudio/lesson/renv - /usr/local/lib/R/site-library - key: ${{ github.repository }}/${{ steps.wb-vers.outputs.container-version }}_renv-${{ needs.check-renv.outputs.renv-cache-hashsum }} - restore-keys: - ${{ github.repository }}/${{ steps.wb-vers.outputs.container-version }}_renv- + github-token: ${{ secrets.GITHUB_TOKEN }} + owner: ${{ github.repository_owner }} + owner-type: ${{ github.event.repository.owner.type }} + repository: ${{ github.event.repository.name }} + package-name: ${{ github.event.repository.name }}-deps + keep-count: ${{ github.event.inputs.prune-keep-count }} + continue-on-error: true record-cache-result: name: "Record Caching Status" @@ -217,13 +176,12 @@ jobs: GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} steps: - name: "Record cache result" - run: | - echo "${{ needs.update-renv-cache.result == 'success' || needs.check-renv.outputs.renv-cache-available == 'true' || 'false' }}" > ${{ github.workspace }}/apply-cache-result + echo "${{ needs.check-renv.outputs.renv-needed != 'true' || needs.update-renv-cache.result == 'success' }}" > ${{ github.workspace }}/apply-cache-result shell: bash - name: "Upload cache result" - uses: actions/upload-artifact@v4 + uses: actions/upload-artifact@v7 with: name: apply-cache-result path: ${{ github.workspace }}/apply-cache-result diff --git a/.github/workflows/docker_build_deploy.yaml b/.github/workflows/docker_build_deploy.yaml index df3e8d1b..bb0d0fd6 100644 --- a/.github/workflows/docker_build_deploy.yaml +++ b/.github/workflows/docker_build_deploy.yaml @@ -4,6 +4,7 @@ on: push: branches: - 'main' + - 'l10n_main' paths-ignore: - '.github/workflows/**.yaml' - '.github/workbench-docker-version.txt' @@ -47,6 +48,7 @@ jobs: do-build: ${{ steps.build-check.outputs.do-build }} renv-needed: ${{ steps.build-check.outputs.renv-needed }} renv-cache-hashsum: ${{ steps.build-check.outputs.renv-cache-hashsum }} + dependency-image-ref: ${{ steps.build-check.outputs.dependency-image-ref }} workbench-container-file-exists: ${{ steps.wb-vers.outputs.workbench-container-file-exists }} wb-vers: ${{ steps.wb-vers.outputs.container-version }} last-wb-vers: ${{ steps.wb-vers.outputs.last-container-version }} @@ -56,16 +58,16 @@ jobs: steps: - name: "Should we run build and deploy?" id: build-check - uses: carpentries/actions/build-preflight@main + uses: carpentries/actions/build-preflight@v1 - name: "Checkout Lesson" if: steps.build-check.outputs.do-build == 'true' - uses: actions/checkout@v4 + uses: actions/checkout@v6 - name: "Get container version info" id: wb-vers if: steps.build-check.outputs.do-build == 'true' - uses: carpentries/actions/container-version@main + uses: carpentries/actions/container-version@v1 with: WORKBENCH_TAG: ${{ vars.WORKBENCH_TAG }} renv-needed: ${{ steps.build-check.outputs.renv-needed }} @@ -85,9 +87,8 @@ jobs: checks: write contents: write pages: write - id-token: write container: - image: ghcr.io/carpentries/workbench-docker:${{ vars.WORKBENCH_TAG || 'latest' }} + image: ${{ needs.preflight.outputs.dependency-image-ref }} env: WORKBENCH_PROFILE: "ci" GITHUB_PAT: ${{ secrets.GITHUB_TOKEN }} @@ -98,7 +99,7 @@ jobs: - ${{ github.workspace }}:/home/rstudio/lesson options: --cpus 1 steps: - - uses: actions/checkout@v4 + - uses: actions/checkout@v6 - name: "Debugging Info" run: | @@ -115,23 +116,13 @@ jobs: git config --global --add safe.directory $(pwd) shell: bash - - name: "Setup Lesson Dependencies" - id: build-container-deps - uses: carpentries/actions/build-container-deps@main - with: - CACHE_VERSION: ${{ vars.CACHE_VERSION || github.event.inputs.CACHE_VERSION || '' }} - WORKBENCH_TAG: ${{ vars.WORKBENCH_TAG || 'latest' }} - LESSON_PATH: ${{ vars.LESSON_PATH || '/home/rstudio/lesson' }} - role-to-assume: ${{ secrets.AWS_GH_OIDC_ARN }} - aws-region: ${{ secrets.AWS_GH_OIDC_REGION }} - token: ${{ secrets.GITHUB_TOKEN }} - - name: "Run Container and Build Site" id: build-and-deploy - uses: carpentries/actions/build-and-deploy@main + uses: carpentries/actions/build-and-deploy@v1 with: reset: ${{ vars.BUILD_RESET || github.event.inputs.reset || 'false' }} - skip-manage-deps: ${{ github.event.inputs.force-skip-manage-deps == 'true' || steps.build-container-deps.outputs.renv-cache-available || steps.build-container-deps.outputs.backup-cache-used || 'false' }} + skip-manage-deps: ${{ github.event.inputs.force-skip-manage-deps == 'true' || contains(needs.preflight.outputs.dependency-image-ref, '-deps:') }} + lang-code: ${{ vars.LANG_CODE || '' }} update-container-version: name: "Update container version used" @@ -150,7 +141,7 @@ jobs: ) steps: - name: "Record container version used" - uses: carpentries/actions/record-container-version@main + uses: carpentries/actions/record-container-version@v1 with: CONTAINER_VER: ${{ needs.preflight.outputs.wb-vers }} AUTO_MERGE: ${{ vars.AUTO_MERGE_CONTAINER_VERSION_UPDATE || 'true' }} diff --git a/.github/workflows/docker_pr_receive.yaml b/.github/workflows/docker_pr_receive.yaml index 3d01d9dc..9ed11c95 100644 --- a/.github/workflows/docker_pr_receive.yaml +++ b/.github/workflows/docker_pr_receive.yaml @@ -26,7 +26,7 @@ jobs: branch-exists: ${{ steps.check.outputs.exists }} steps: - name: "Checkout Lesson" - uses: actions/checkout@v4 + uses: actions/checkout@v6 - name: "Check if md-outputs branch exists" id: check @@ -76,7 +76,7 @@ jobs: - name: "Upload PR number" id: upload if: always() - uses: actions/upload-artifact@v4 + uses: actions/upload-artifact@v7 with: name: pr path: ${{ github.workspace }}/NR @@ -96,7 +96,7 @@ jobs: - name: "Check PR" id: check-pr - uses: carpentries/actions/check-valid-pr@main + uses: carpentries/actions/check-valid-pr@v1 with: pr: ${{ env.NR }} invalid: ${{ fromJSON(steps.hash.outputs.json)[github.repository] }} @@ -107,13 +107,14 @@ jobs: outputs: renv-needed: ${{ steps.renv-check.outputs.renv-needed }} renv-cache-hashsum: ${{ steps.renv-check.outputs.renv-cache-hashsum }} + dependency-image-ref: ${{ steps.renv-check.outputs.dependency-image-ref }} steps: - name: "Checkout Lesson" - uses: actions/checkout@v4 + uses: actions/checkout@v6 - name: "Is renv required?" id: renv-check - uses: carpentries/actions/renv-checks@main + uses: carpentries/actions/renv-checks@v1 with: CACHE_VERSION: ${{ inputs.CACHE_VERSION || '' }} skip-cache-check: true @@ -131,14 +132,10 @@ jobs: GHWMD: ${{ github.workspace }}/site/built PR_BRANCH: ${{ needs.test-pr.outputs.pr_branch }} PR_NUMBER: ${{ needs.test-pr.outputs.pr_number }} - GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} permissions: - checks: write - contents: write - pages: write - id-token: write + contents: read container: - image: ghcr.io/carpentries/workbench-docker:${{ vars.WORKBENCH_TAG || 'latest' }} + image: ${{ needs.check-renv.outputs.dependency-image-ref }} env: WORKBENCH_PROFILE: "ci" GITHUB_PAT: ${{ secrets.GITHUB_TOKEN }} @@ -150,13 +147,12 @@ jobs: - ${{ github.workspace }}:/home/rstudio/lesson options: --cpus 2 outputs: - workbench-update: ${{ steps.wb-vers.outputs.workbench-update }} build-site: ${{ steps.build-site.outcome }} steps: - - uses: actions/checkout@v4 + - uses: actions/checkout@v6 - name: "Check Out Staging Branch" - uses: actions/checkout@v4 + uses: actions/checkout@v6 with: ref: md-outputs path: ${{ env.GHWMD }} @@ -178,64 +174,6 @@ jobs: Rscript /home/rstudio/.workbench/setup_lesson_deps.R shell: bash - - name: Get Container Version Used - id: wb-vers - if: needs.check-renv.outputs.renv-needed == 'true' - uses: carpentries/actions/container-version@main - with: - WORKBENCH_TAG: ${{ vars.WORKBENCH_TAG }} - renv-needed: ${{ needs.check-renv.outputs.renv-needed }} - token: ${{ secrets.GITHUB_TOKEN }} - - - name: "Validate Current Org and Workflow" - id: validate-org-workflow - if: needs.check-renv.outputs.renv-needed == 'true' - uses: carpentries/actions/validate-org-workflow@main - with: - repo: ${{ github.repository }} - workflow: ${{ github.workflow }} - - - name: Configure AWS credentials via OIDC - id: aws-creds - env: - role-to-assume: ${{ secrets.AWS_GH_OIDC_ARN }} - aws-region: ${{ secrets.AWS_GH_OIDC_REGION }} - if: | - steps.validate-org-workflow.outputs.is_valid == 'true' && - needs.check-renv.outputs.renv-needed == 'true' && - env.role-to-assume != '' && - env.aws-region != '' - uses: aws-actions/configure-aws-credentials@v5.0.0 - with: - role-to-assume: ${{ env.role-to-assume }} - aws-region: ${{ env.aws-region }} - output-credentials: true - - - name: Get cache object from S3 - id: s3-cache - uses: carpentries/actions-cache/restore@frog-matchedkey-1 - if: needs.check-renv.outputs.renv-needed == 'true' - with: - # insecure: false # optional, use http instead of https. default false - accessKey: ${{ steps.aws-creds.outputs.aws-access-key-id }} - secretKey: ${{ steps.aws-creds.outputs.aws-secret-access-key }} - sessionToken: ${{ steps.aws-creds.outputs.aws-session-token }} - bucket: workbench-docker-caches - path: | - /home/rstudio/lesson/renv - /usr/local/lib/R/site-library - key: ${{ github.repository }}/${{ steps.wb-vers.outputs.container-version }}_renv-${{ needs.check-renv.outputs.renv-cache-hashsum }} - restore-keys: - ${{ github.repository }}/${{ steps.wb-vers.outputs.container-version }}_renv- - - - name: "Fortify renv Cache" - if: | - needs.check-renv.outputs.renv-needed == 'true' && - steps.s3-cache.outputs.cache-hit != 'true' - run: | - Rscript /home/rstudio/.workbench/fortify_renv_cache.R - shell: bash - - name: "Validate and Build Markdown" id: build-site run: | @@ -258,21 +196,21 @@ jobs: shell: Rscript {0} - name: "Upload PR" - uses: actions/upload-artifact@v4 + uses: actions/upload-artifact@v7 with: name: pr path: ${{ env.PR }} overwrite: true - name: "Upload Diff" - uses: actions/upload-artifact@v4 + uses: actions/upload-artifact@v7 with: name: diff path: ${{ env.CHIVE }} retention-days: 1 - name: "Upload Build" - uses: actions/upload-artifact@v4 + uses: actions/upload-artifact@v7 with: name: built path: ${{ env.GHWMD }} diff --git a/.github/workflows/pr-close-signal.yaml b/.github/workflows/pr-close-signal.yaml index b1303c26..de1f2544 100644 --- a/.github/workflows/pr-close-signal.yaml +++ b/.github/workflows/pr-close-signal.yaml @@ -16,7 +16,7 @@ jobs: mkdir -p ./pr printf ${{ github.event.number }} > ./pr/NUM - name: Upload Diff - uses: actions/upload-artifact@v4 + uses: actions/upload-artifact@v7 with: name: pr path: ./pr diff --git a/.github/workflows/pr-comment.yaml b/.github/workflows/pr-comment.yaml index 7614abd0..c2928514 100644 --- a/.github/workflows/pr-comment.yaml +++ b/.github/workflows/pr-comment.yaml @@ -22,7 +22,7 @@ jobs: steps: - name: "Download PR artifact" id: dl - uses: carpentries/actions/download-workflow-artifact@main + uses: carpentries/actions/download-workflow-artifact@v1 with: run: ${{ github.event.workflow_run.id }} name: 'pr' @@ -42,7 +42,7 @@ jobs: exit 1 - name: "Checkout Lesson" - uses: actions/checkout@v4 + uses: actions/checkout@v6 - name: "Verify committed files" id: changed-files @@ -81,7 +81,7 @@ jobs: - name: "Check PR" id: check-pr if: ${{ steps.dl.outputs.success == 'true' }} - uses: carpentries/actions/check-valid-pr@main + uses: carpentries/actions/check-valid-pr@v1 with: pr: ${{ steps.get-pr.outputs.NUM }} sha: ${{ github.event.workflow_run.head_sha }} @@ -92,7 +92,7 @@ jobs: - name: "Comment result of validation" id: comment-diff if: always() - uses: carpentries/actions/comment-diff@main + uses: carpentries/actions/comment-diff@v1 with: pr: ${{ steps.get-pr.outputs.NUM }} body: ${{ steps.check-pr.outputs.MSG }} @@ -112,7 +112,7 @@ jobs: contents: write steps: - name: "Checkout md outputs" - uses: actions/checkout@v4 + uses: actions/checkout@v6 with: ref: md-outputs path: built @@ -120,7 +120,7 @@ jobs: - name: "Download built markdown" id: dl - uses: carpentries/actions/download-workflow-artifact@main + uses: carpentries/actions/download-workflow-artifact@v1 with: run: ${{ github.event.workflow_run.id }} name: 'built' @@ -159,7 +159,7 @@ jobs: steps: - name: "Download comment artifact" id: dl - uses: carpentries/actions/download-workflow-artifact@main + uses: carpentries/actions/download-workflow-artifact@v1 with: run: ${{ github.event.workflow_run.id }} name: 'diff' @@ -170,7 +170,7 @@ jobs: - name: "Comment on PR" id: comment-diff if: steps.dl.outputs.success == 'true' - uses: carpentries/actions/comment-diff@main + uses: carpentries/actions/comment-diff@v1 with: pr: ${{ env.NR }} path: ${{ github.workspace }}/diff.md @@ -192,7 +192,7 @@ jobs: steps: - name: "Check for spoofing" id: dl - uses: carpentries/actions/download-workflow-artifact@main + uses: carpentries/actions/download-workflow-artifact@v1 with: run: ${{ github.event.workflow_run.id }} name: 'built' @@ -210,7 +210,7 @@ jobs: - name: "Comment on PR" id: comment-diff - uses: carpentries/actions/comment-diff@main + uses: carpentries/actions/comment-diff@v1 with: pr: ${{ env.NR }} body: ${{ env.body }} diff --git a/.github/workflows/pr-post-remove-branch.yaml b/.github/workflows/pr-post-remove-branch.yaml index 9419e2be..ebbe22df 100644 --- a/.github/workflows/pr-post-remove-branch.yaml +++ b/.github/workflows/pr-post-remove-branch.yaml @@ -17,7 +17,7 @@ jobs: contents: write steps: - name: 'Download artifact' - uses: carpentries/actions/download-workflow-artifact@main + uses: carpentries/actions/download-workflow-artifact@v1 with: run: ${{ github.event.workflow_run.id }} name: pr @@ -27,6 +27,6 @@ jobs: unzip pr.zip echo "NUM=$(<./NUM)" >> $GITHUB_OUTPUT - name: 'Remove branch' - uses: carpentries/actions/remove-branch@main + uses: carpentries/actions/remove-branch@v1 with: pr: ${{ steps.get-pr.outputs.NUM }} diff --git a/.github/workflows/pr-preflight.yaml b/.github/workflows/pr-preflight.yaml index d0d7420d..d292d91f 100644 --- a/.github/workflows/pr-preflight.yaml +++ b/.github/workflows/pr-preflight.yaml @@ -25,7 +25,7 @@ jobs: EOF" >> $GITHUB_OUTPUT - name: "Check PR" id: check-pr - uses: carpentries/actions/check-valid-pr@main + uses: carpentries/actions/check-valid-pr@v1 with: pr: ${{ github.event.number }} invalid: ${{ fromJSON(steps.hash.outputs.json)[github.repository] }} @@ -33,7 +33,7 @@ jobs: - name: "Comment result of validation" id: comment-diff if: ${{ always() }} - uses: carpentries/actions/comment-diff@main + uses: carpentries/actions/comment-diff@v1 with: pr: ${{ github.event.number }} body: ${{ steps.check-pr.outputs.MSG }} diff --git a/.github/workflows/sandpaper-version.txt b/.github/workflows/sandpaper-version.txt deleted file mode 100644 index 543466e4..00000000 --- a/.github/workflows/sandpaper-version.txt +++ /dev/null @@ -1 +0,0 @@ -0.18.5 diff --git a/.github/workflows/update-cache.yaml b/.github/workflows/update-cache.yaml index ce318f6f..b711f2d8 100644 --- a/.github/workflows/update-cache.yaml +++ b/.github/workflows/update-cache.yaml @@ -2,7 +2,7 @@ name: "02 Maintain: Check for Updated Packages" description: "Check for updated R packages and create a pull request to update the lesson's renv lockfile and package cache" on: schedule: - - cron: '0 0 * * 2' + - cron: '0 0 * * 2' # every Tuesday at midnight UTC workflow_dispatch: inputs: name: @@ -63,11 +63,11 @@ jobs: renv-needed: ${{ steps.renv-check.outputs.renv-needed }} steps: - name: "Checkout Lesson" - uses: actions/checkout@v4 + uses: actions/checkout@v6 - name: "Is renv required?" id: renv-check - uses: carpentries/actions/renv-checks@main + uses: carpentries/actions/renv-checks@v1 with: CACHE_VERSION: ${{ inputs.CACHE_VERSION || '' }} skip-cache-check: true @@ -89,7 +89,7 @@ jobs: RENV_PATHS_ROOT: ~/.local/share/renv/ steps: - name: "Checkout Lesson" - uses: actions/checkout@v4 + uses: actions/checkout@v6 - name: "Set up R" uses: r-lib/actions/setup-r@v2 @@ -99,7 +99,7 @@ jobs: - name: "Update {renv} deps and determine if a PR is needed" id: update - uses: carpentries/actions/update-lockfile@main + uses: carpentries/actions/update-lockfile@v1 with: update: ${{ env.UPDATE_PACKAGES }} force-renv-init: ${{ env.FORCE_RENV_INIT }} @@ -108,7 +108,7 @@ jobs: - name: "Validate Current Org and Workflow" id: validate-org-workflow - uses: carpentries/actions/validate-org-workflow@main + uses: carpentries/actions/validate-org-workflow@v1 with: repo: ${{ github.repository }} workflow: ${{ github.workflow }} @@ -121,7 +121,7 @@ jobs: steps.validate-org-workflow.outputs.is_valid == 'true' && env.role-to-assume != '' && env.aws-region != '' - uses: aws-actions/configure-aws-credentials@v5.0.0 + uses: aws-actions/configure-aws-credentials@v6 with: role-to-assume: ${{ env.role-to-assume }} aws-region: ${{ env.aws-region }} diff --git a/.github/workflows/update-workflows.yaml b/.github/workflows/update-workflows.yaml index 09ec1b63..6d63a32c 100644 --- a/.github/workflows/update-workflows.yaml +++ b/.github/workflows/update-workflows.yaml @@ -1,5 +1,6 @@ name: "04 Maintain: Update Workflow Files" description: "Update workflow files from the carpentries/sandpaper repository" + on: schedule: - cron: '0 0 * * 2' @@ -9,10 +10,10 @@ on: description: 'Who triggered this build (enter github username to tag yourself)?' required: true default: 'weekly run' - tarball: - description: 'Absolute URL to the desired sandpaper repo tarball' + version: + description: 'Workflows version number (e.g. 0.0.1), branch name (e.g. main), or "latest"' required: false - default: '' + default: 'latest' clean: description: 'Workflow files/file extensions to clean (no wildcards, enter "" for none)' required: false @@ -28,11 +29,11 @@ jobs: id-token: write steps: - name: "Checkout Repository" - uses: actions/checkout@v4 + uses: actions/checkout@v6 - name: "Validate Current Org and Workflow" id: validate-org-workflow - uses: carpentries/actions/validate-org-workflow@main + uses: carpentries/actions/validate-org-workflow@v1 with: repo: ${{ github.repository }} workflow: ${{ github.workflow }} @@ -45,7 +46,7 @@ jobs: steps.validate-org-workflow.outputs.is_valid == 'true' && env.role-to-assume != '' && env.aws-region != '' - uses: aws-actions/configure-aws-credentials@v5.0.0 + uses: aws-actions/configure-aws-credentials@v6 with: role-to-assume: ${{ env.role-to-assume }} aws-region: ${{ env.aws-region }} @@ -70,7 +71,7 @@ jobs: - name: "Validate token" id: validate-token - uses: carpentries/actions/check-valid-credentials@main + uses: carpentries/actions/check-valid-credentials@v1 with: token: ${{ steps.set-pat.outputs.pat || secrets.SANDPAPER_WORKFLOW }} @@ -86,10 +87,11 @@ jobs: - name: Update Workflows id: update if: ${{ steps.validate-token.outputs.wf == 'true' }} - uses: carpentries/actions/update-workflows@main + uses: carpentries/actions/update-workflows@v1 with: - repo: ${{ github.event.inputs.tarball || 'https://carpentries.r-universe.dev' }} + version: ${{ github.event.inputs.version || 'latest' }} clean: ${{ github.event.inputs.clean || '.yaml' }} + token: ${{ steps.set-pat.outputs.pat || secrets.SANDPAPER_WORKFLOW }} - name: Create Pull Request id: cpr diff --git a/.github/workflows/workflows-version.txt b/.github/workflows/workflows-version.txt new file mode 100644 index 00000000..570c7965 --- /dev/null +++ b/.github/workflows/workflows-version.txt @@ -0,0 +1 @@ +v1.0.2