Skip to content

chore(deps): bump r-lib/actions/setup-r from 2.11.4 to 2.13.0 - #2014

Draft
dependabot[bot] wants to merge 45 commits into
mainfrom
dependabot/github_actions/main/r-lib/actions/setup-r-2.13.0
Draft

chore(deps): bump r-lib/actions/setup-r from 2.11.4 to 2.13.0#2014
dependabot[bot] wants to merge 45 commits into
mainfrom
dependabot/github_actions/main/r-lib/actions/setup-r-2.13.0

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Sep 7, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Bumps r-lib/actions/setup-r from 2.11.4 to 2.13.0.

Changelog

Sourced from r-lib/actions/setup-r's changelog.

v2.13.0 (2026-08028)

  • [setup-r] now retries r-hub.io HTTP failures (#1088, @​nbenn).

  • [setup-r] now sets the correct RTOOLS environment variables on aarch64 Windows (@​vjymisal0, #1104).

  • [setup-r] keep repositories if they are set by the build. E.g. aarch64 Windows builds now set them (@​jeroen, #1101).

  • [setup-r] now retries transient failures when resolving the R version from api.r-hub.io, rather than failing the job on the first timeout or server error (@​nbenn, #1086).

  • [setup-r-dependencies] now switches back to classic sudo, if available, on Linux. This fixes installing pak on Ubuntu 26.04 runners (@​jeroen, #1096).

v2.12.1 (2026-06-23)

  • [setup-r] now avoids a warning about an url.parse() deprecation (#1074).

  • [setup-r-dependencies] now uses quarto-dev/quarto-actions v2.2.0 (@​jdblischak, #1076).

  • Examples: test-coverage.yaml now uses codecov/codecov-action v7 (@​shikokuchuo, #1081).

  • New example claude-investigate.yaml workflow (@​DavisVaughan, #1084).

v2.12.0 (2026-04-29)

  • All node.js actions use node 24 now. Relatedly, all example workflows use recent versions of actions that use node 24.

  • [setup-r] now uses use-public-rspm: true by default on Linux and Windows. macOS binaries require further opt-in with use-public-rspm: always.

  • It is now possible to require actions to be pinned to a full-length commit SHA in repositories using r-lib/actions (#1070).

  • [setup-pandoc][setup-r-dependencies] now default to Pandoc version 3.8.3.

  • [setup-r-dependencies] now includes the R architecture in the cache key, so caches for macos-15 (Apple Silicon) and macos-15-intel (Rosetta/x86_64) no longer collide (#1035).

... (truncated)

Commits
  • 465b7d8 NEWS for 2.13.0 (#1105)
  • d06a540 [setup-r] retry transient r-hub.io request failures (#1088)
  • ed9aa85 fix(setup-r): export correct RTOOLS HOME env vars on Windows ARM64 and x64 (#...
  • c86f32c setup-r-dependencies: set JAVA_HOME on Windows runners from Java 21 env vars ...
  • 2a66450 setup-r-dependencies: switch back to classic sudo on runners with sudo-rs (#1...
  • 5cc1f0d Fix minor typo (#1098)
  • 33d09fb fix: Remove stray ::group:: (#1103)
  • aae88a2 Special-case CRAN mirror for Windows ARM64 (#1101)
  • b7484da [setup-r] Support installing RTools without installing R (#1093)
  • d3c5be5 Update NEWS for v1.12.1 (#1087)
  • Additional commits viewable in compare view

@dependabot dependabot Bot added dependencies Pull requests that update a dependency file github_actions Pull requests that update GitHub Actions code labels Sep 7, 2026
@dependabot
dependabot Bot requested a review from seonghobae as a code owner September 7, 2026 13:36
@dependabot dependabot Bot added the github_actions Pull requests that update GitHub Actions code label Sep 7, 2026
opencode-agent[bot]
opencode-agent Bot requested changes Sep 7, 2026
View reviewed changes

@opencode-agent opencode-agent Bot left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview

OpenCode could not approve from deterministic current-head evidence because GitHub Checks have failed.

Findings

1. HIGH Current-head GitHub Checks - Fix failed required checks before approval

  • Problem: Failed same-head checks remain for 44004a47acd6314704c8e904ce67b76014336cf1.
  • Root cause: The model-unavailable evidence fallback is allowed only when peer GitHub Checks are complete and clean.
  • Fix: Read and fix the failed check logs below, then rerun the current-head checks.
  • Regression test: Keep the model-unavailable fallback gated on an empty failed-check rollup.

Failed checks:

Changed-File Evidence Map

flowchart LR
  PR["PR changed files"] --> Evidence["OpenCode bounded evidence"]
  Evidence --> S1["Workflow: r-package-check.yml"]
  S1 --> I1["GitHub Actions review job"]
  I1 --> R1["Review risk: Workflow: r-package-check.yml"]
  R1 --> V1["actionlint plus required checks"]
Loading

@opencode-agent

opencode-agent Bot commented Sep 7, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

OpenCode Review Overview

Coverage evidence did not pass, so approval is blocked. The formal pull-request review is the source-backed diff review, not this status comment.

@dependabot
dependabot Bot force-pushed the dependabot/github_actions/main/r-lib/actions/setup-r-2.13.0 branch 2 times, most recently from ed46e85 to 17c449d Compare September 10, 2026 05:17
@coderabbitai

coderabbitai Bot commented Sep 10, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Important

Review skipped

Bot user detected.

To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Advanced

Run ID: 9b24adb1-7684-4a75-b854-5d62bca50c2f

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

  • 🔍 Trigger review

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

Comment @coderabbitai help to get the list of available commands.

opencode-agent[bot]
opencode-agent Bot requested changes Sep 10, 2026
View reviewed changes

@opencode-agent opencode-agent Bot left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview

OpenCode could not approve from deterministic current-head evidence because GitHub Checks have failed.

Findings

1. HIGH Current-head GitHub Checks - Fix failed required checks before approval

  • Problem: Failed same-head checks remain for 17c449d3eb07ecfb72a1ce999fcce20d666ab83e.
  • Root cause: The model-unavailable evidence fallback is allowed only when peer GitHub Checks are complete and clean.
  • Fix: Read and fix the failed check logs below, then rerun the current-head checks.
  • Regression test: Keep the model-unavailable fallback gated on an empty failed-check rollup.

Failed checks:

Changed-File Evidence Map

flowchart LR
  PR["PR changed files"] --> Evidence["OpenCode bounded evidence"]
  Evidence --> S1["Workflow: r-package-check.yml"]
  S1 --> I1["GitHub Actions review job"]
  I1 --> R1["Review risk: Workflow: r-package-check.yml"]
  R1 --> V1["actionlint plus required checks"]
Loading

@dependabot
dependabot Bot force-pushed the dependabot/github_actions/main/r-lib/actions/setup-r-2.13.0 branch from 17c449d to b14e268 Compare September 12, 2026 09:42
opencode-agent[bot]
opencode-agent Bot requested changes Sep 12, 2026
View reviewed changes

@opencode-agent opencode-agent Bot left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview

OpenCode could not approve from deterministic current-head evidence because GitHub Checks have failed.

Findings

1. HIGH Current-head GitHub Checks - Fix failed required checks before approval

  • Problem: Failed same-head checks remain for b14e268003fad68e88569c3093c1719fecdc980a.
  • Root cause: The model-unavailable evidence fallback is allowed only when peer GitHub Checks are complete and clean.
  • Fix: Read and fix the failed check logs below, then rerun the current-head checks.
  • Regression test: Keep the model-unavailable fallback gated on an empty failed-check rollup.

Failed checks:

Changed-File Evidence Map

flowchart LR
  PR["PR changed files"] --> Evidence["OpenCode bounded evidence"]
  Evidence --> S1["Workflow: r-package-check.yml"]
  S1 --> I1["GitHub Actions review job"]
  I1 --> R1["Review risk: Workflow: r-package-check.yml"]
  R1 --> V1["actionlint plus required checks"]
Loading

@dependabot
dependabot Bot force-pushed the dependabot/github_actions/main/r-lib/actions/setup-r-2.13.0 branch 2 times, most recently from db79b08 to f8cc73d Compare September 13, 2026 04:40
opencode-agent[bot]
opencode-agent Bot requested changes Sep 13, 2026
View reviewed changes

@opencode-agent opencode-agent Bot left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview

OpenCode could not approve from deterministic current-head evidence because GitHub Checks have failed.

Findings

1. HIGH Current-head GitHub Checks - Fix failed required checks before approval

  • Problem: Failed same-head checks remain for f8cc73d15bdec43fc4bb08385b1b920d1e947134.
  • Root cause: The model-unavailable evidence fallback is allowed only when peer GitHub Checks are complete and clean.
  • Fix: Read and fix the failed check logs below, then rerun the current-head checks.
  • Regression test: Keep the model-unavailable fallback gated on an empty failed-check rollup.

Failed checks:

Changed-File Evidence Map

flowchart LR
  PR["PR changed files"] --> Evidence["OpenCode bounded evidence"]
  Evidence --> S1["Workflow: r-package-check.yml"]
  S1 --> I1["GitHub Actions review job"]
  I1 --> R1["Review risk: Workflow: r-package-check.yml"]
  R1 --> V1["actionlint plus required checks"]
Loading

@dependabot dependabot Bot changed the title build(deps): bump r-lib/actions/setup-r from 2.11.4 to 2.13.0 chore(deps): bump r-lib/actions/setup-r from 2.11.4 to 2.13.0 Sep 13, 2026
@dependabot
dependabot Bot force-pushed the dependabot/github_actions/main/r-lib/actions/setup-r-2.13.0 branch 3 times, most recently from 0d7809a to a95863f Compare September 14, 2026 13:50
opencode-agent[bot]
opencode-agent Bot requested changes Sep 15, 2026
View reviewed changes

@opencode-agent opencode-agent Bot left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview

OpenCode could not approve from deterministic current-head evidence because GitHub Checks have failed.

Findings

1. HIGH Current-head GitHub Checks - Fix failed required checks before approval

  • Problem: Failed same-head checks remain for a95863f9200a77392de9bc505c0219d3288a993c.
  • Root cause: The model-unavailable evidence fallback is allowed only when peer GitHub Checks are complete and clean.
  • Fix: Read and fix the failed check logs below, then rerun the current-head checks.
  • Regression test: Keep the model-unavailable fallback gated on an empty failed-check rollup.

Failed checks:

Changed-File Evidence Map

flowchart LR
  PR["PR changed files"] --> Evidence["OpenCode bounded evidence"]
  Evidence --> S1["Workflow: r-package-check.yml"]
  S1 --> I1["GitHub Actions review job"]
  I1 --> R1["Review risk: Workflow: r-package-check.yml"]
  R1 --> V1["actionlint plus required checks"]
Loading

opencode-agent[bot]
opencode-agent Bot requested changes Sep 16, 2026
View reviewed changes

@opencode-agent opencode-agent Bot left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview

OpenCode could not approve from deterministic current-head evidence because GitHub Checks have failed.

Findings

1. HIGH Current-head GitHub Checks - Fix failed required checks before approval

  • Problem: Failed same-head checks remain for a95863f9200a77392de9bc505c0219d3288a993c.
  • Root cause: The model-unavailable evidence fallback is allowed only when peer GitHub Checks are complete and clean.
  • Fix: Read and fix the failed check logs below, then rerun the current-head checks.
  • Regression test: Keep the model-unavailable fallback gated on an empty failed-check rollup.

Failed checks:

Changed-File Evidence Map

flowchart LR
  PR["PR changed files"] --> Evidence["OpenCode bounded evidence"]
  Evidence --> S1["Workflow: r-package-check.yml"]
  S1 --> I1["GitHub Actions review job"]
  I1 --> R1["Review risk: Workflow: r-package-check.yml"]
  R1 --> V1["actionlint plus required checks"]
Loading

@dependabot
dependabot Bot force-pushed the dependabot/github_actions/main/r-lib/actions/setup-r-2.13.0 branch 3 times, most recently from d7f054b to 7e092cd Compare September 17, 2026 15:56
@dependabot
chore(deps): bump r-lib/actions/setup-r from 2.11.4 to 2.13.0
0bd1e7e 
Bumps [r-lib/actions/setup-r](https://github.com/r-lib/actions) from 2.11.4 to 2.13.0.
- [Release notes](https://github.com/r-lib/actions/releases)
- [Changelog](https://github.com/r-lib/actions/blob/v2-branch/NEWS.md)
- [Commits](r-lib/actions@6f6e5bc...465b7d8)

---
updated-dependencies:
- dependency-name: r-lib/actions/setup-r
  dependency-version: 2.13.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot
dependabot Bot force-pushed the dependabot/github_actions/main/r-lib/actions/setup-r-2.13.0 branch from 7e092cd to 0bd1e7e Compare September 17, 2026 19:20
@seonghobae seonghobae mentioned this pull request Sep 18, 2026
Open
seonghobae and others added 26 commits September 20, 2026 07:45
@seonghobae
test(strix): require consumer-free trusted binder fixture
fb9c0e2
@seonghobae
repair(strix): restore executable harness after binary blob corruption
78b33a8
@seonghobae
test(strix): require binder-free consumer fixture
191bd63
@seonghobae
test(strix): separate trusted gate from consumer root
ef1a866
@seonghobae
docs(strix): bind consumer isolation evidence to exact commits
abc9a7d
@seonghobae
docs(strix): describe separated trusted runtime fixture
00082e8
@seonghobae
test(strix): retain canonical gate source under scan
782d67b
@seonghobae
fix(deps): restore AnyIO owner isolation
8a5251b
@seonghobae
test(strix): red specialized fixture owner boundary
a8d6261
Seongho Bae @claude
test(strix): materialize specialized fixtures' trusted runtime outsid…
bbe225d 
…e the consumer root

Green step for a8d6261. The 24 specialized cases in
test_strix_quick_gate.sh installed the trusted gate/model/binder into
$repo_root_dir/scripts/ci and ran ./scripts/ci/strix_quick_gate.sh, so a
consumer-root binder lookup could never fail there and masked the #2292
defect. Each case now materializes into
$tmp_dir/trusted-source/scripts/ci and runs the gate from that directory
with STRIX_REPO_ROOT=$repo_root_dir, which keeps the old repo-root
semantics (the gate defaults REPO_ROOT to SCRIPT_DIR/../..).

Evidence:
- tests/test_strix_trusted_fixture_boundary.py: fails on a8d6261 (CI
  job 106083294309), passes here.
- bash scripts/ci/test_strix_quick_gate.sh on Linux, umask 022:
  a8d6261 PASS (rc=0, 727s) and this commit PASS (rc=0, 726s).
- strix-related pytest (8 files): 242 passed.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01P5o6j4zfxGPdRaH4Lug8UY
@seonghobae
test(strix): pin trusted evidence-binder path
1794626
@seonghobae
repair(codeql): restore exact endpoint-set assertion
657d104
@seonghobae
chore(foundation): converge dependency and CodeQL repairs
f1a8dc8
@seonghobae
fix(opencode): adopt AnyIO security prerequisite
42e4198
@seonghobae
fix(test-gate): restore full branch coverage
38cfcae 
Remove the unused queue-health collector and CLI, validate run IDs at the shared parsing boundary, and exercise document-reader and scheduler edge cases. The main baseline failed the 100% gate before PR #2358.
@seonghobae
test(queue-health): scope permission assertion to workflow token
21247ef
@seonghobae
test(queue-health): isolate collector edge cases
57c168b
@seonghobae
repair(foundation): converge CodeQL endpoint contract into coverage o…
f229816 
…wner
@seonghobae
fix(security): update AnyIO lock for audit gate
3b3ce16
@seonghobae
fix(codeql): unblock CodeQL scan dispatch for all .github PRs
14fe2b6 
- Select a target-scoped credential that can actually read code-scanning
  analyses before the GHAS base/head configuration identity check, instead
  of the first non-empty token (the OpenCode app token returns 403).
  Ported from #2275.
- Replace the set-membership URL assertion flagged by CodeQL
  py/incomplete-url-substring-sanitization with an issubset check.
  Ported from #2351.
@seonghobae
repair(foundation): converge coverage, dependency, and CodeQL owners
950ab88 
Preserve #2385, #2359, and #2286 as explicit parents while composing their byte-identical overlapping locks and endpoint contract. This creates one exact-head bootstrap stack for the coverage-image, 100% coverage, AnyIO audit, and CodeQL dispatch failures without force-push, rebase, or delta disposal.
@seonghobae
fix(ci): bind AnyIO security pin to Strix input
8e1aba9
@seonghobae
merge: adopt current CI owner and repair CodeQL URL oracle
361a9eb
@seonghobae
test(strix): require Job Analysis authority context
1fd22f4
@seonghobae
fix(strix): include Job Analysis authority context
808a8a7
@seonghobae
docs(strix): record Job Analysis authority context
b90d873
@seonghobae ChatGPT Codex Connector

seonghobae commented Sep 26, 2026

Copy link
Copy Markdown
Contributor

Exact-head admission audit: 0bd1e7e62bcdd627b43bac9e2e49a9f310ae54d9 (base main@64aa08d7fa487deacd41c761c36277ca68cab6c9, 1 ahead / 0 behind).

현재 blocker: 활성 CHANGES_REQUESTED 1건; terminal workflow: SAST Semgrep:failure, Python Security:failure, CodeQL PR:cancelled.

유효 commit·diff·review evidence를 보존한 채 Draft/Proposed로 교정합니다. Base 이동이나 queue 대기만을 이유로 Close하지 않으며, Force Push·synthetic status/approval·manual rerun·bypass는 사용하지 않습니다. Blocker 수리 후 새 exact head에서 Checks와 review admission을 다시 받아야 합니다.

@seonghobae
seonghobae marked this pull request as draft September 26, 2026 18:59
@seonghobae ChatGPT Codex Connector

seonghobae commented Sep 26, 2026

Copy link
Copy Markdown
Contributor

Exact-head root-cause repair, ordinary-forward only.

Predecessor 0bd1e7e62bcdd627b43bac9e2e49a9f310ae54d9 failed:

  • SAST Semgrep run 35264311882, job 105347517434: dynamic-urllib findings in codeql_ghas_configuration_identity.py and strix_evidence_binding.py;
  • Python Security run 35264312029, Bandit job 105419619335: the same two B310 findings.

Those are inherited central URL-authority defects, so this branch now ordinary-merges canonical owner #2291 (b90d873e67860944308d5cef919a1f95243ef98f) with a two-parent commit.

The dependency delta also exposed a real repository contract RED: updating only setup-r made the five actions from the r-lib/actions monorepo use mixed immutable commits. The repair pins pandoc, TinyTeX, R, dependency installation, and package checking together at v2.13.0 commit 465b7d8e732ca3921382b1674c59bada9cbf3399; the existing uniform-pin test was observed RED before the change and GREEN after it.

New exact head: 901f24ff5fc001ac12660f0df935ccc6ca630699.
Verification on tree 66b92d9ef2945c2201296119411f9a8254d81743:

  • focused owner + R workflow contracts: 100 passed;
  • Bandit MEDIUM+/MEDIUM+: 0 findings;
  • compileall and diff check: pass.
  • actionlint was unavailable in the execution environment; the workflow's repository contract tests passed.

The PR remains Open and Draft. Fresh exact-head hosted Checks are required; queued, skipped, pending, or absent evidence is not GREEN.

This branch has not been deployed

No deployments
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@opencode-agent opencode-agent[bot] opencode-agent[bot] requested changes
@seonghobae seonghobae Awaiting requested review from seonghobae seonghobae is a code owner

Requested changes must be addressed to merge this pull request.

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file github_actions Pull requests that update GitHub Actions code maintenance priority: low

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@seonghobae