From f576159d07ab2a4ff03284b6416ece458191eb6b Mon Sep 17 00:00:00 2001 From: Jean Cochrane Date: Tue, 27 Oct 2026 16:57:49 -0500 Subject: [PATCH 1/2] pre-commit: Upgrade third-party actions, switch to uv + R 4.6, and remove RSPM override --- pre-commit/action.yaml | 16 ++++++++-------- 1 file changed, 8 insertions(+), 8 deletions(-) diff --git a/pre-commit/action.yaml b/pre-commit/action.yaml index 86befbd..fb73d9d 100644 --- a/pre-commit/action.yaml +++ b/pre-commit/action.yaml @@ -5,22 +5,22 @@ runs: using: composite steps: - name: Checkout - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2 + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - # R is no longer preinstalled on GitHub runners as of Ubuntu 24.04, so we - # need to install it to support consumers that are checking R code - name: Setup R - uses: r-lib/actions/setup-r@a51a8012b0aab7c32ef9d19bf54da93f3254335e # v2.12.0 + uses: r-lib/actions/setup-r@f9a764fea8d5c63df6ef9a5c7795bf7deb5d7e05 # v2.14.0 with: - r-version: "4.5" - use-public-rspm: true + r-version: "4.6" + + - name: Setup uv + uses: astral-sh/setup-uv@v10.3.2 - name: Install pre-commit - run: pip install pre-commit + run: uv tool install pre-commit shell: bash - name: Cache pre-commit environment - uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.5 + uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v5.1.0 with: path: | ~/.cache/pre-commit From 5c5b2820b043cca2cfc6c1fdf8f55429690a1bf0 Mon Sep 17 00:00:00 2001 From: Jean Cochrane Date: Tue, 27 Oct 2026 17:11:33 -0500 Subject: [PATCH 2/2] Try explicitly setting `use-public-rspm` to `false` --- pre-commit/action.yaml | 3 +++ 1 file changed, 3 insertions(+) diff --git a/pre-commit/action.yaml b/pre-commit/action.yaml index fb73d9d..0f6e445 100644 --- a/pre-commit/action.yaml +++ b/pre-commit/action.yaml @@ -11,6 +11,9 @@ runs: uses: r-lib/actions/setup-r@f9a764fea8d5c63df6ef9a5c7795bf7deb5d7e05 # v2.14.0 with: r-version: "4.6" + # Disable RSPM override so that we ensure we download packages from the + # exact same sources as recorded in the lockfile for R pre-commit hooks + use-public-rspm: false - name: Setup uv uses: astral-sh/setup-uv@v10.3.2