Modernization: Phase 0 audit + Phase 1 correctness & dependency hygiene (0.4.0)

.Rbuildignore

@@ -16,4 +16,13 @@ paper.pdf$
 ^\.github$
 ^codecov\.yml$
 ^README\.Rmd$
+^README\.html$
 ^CRAN-SUBMISSION$
+^data-raw$
+^AUDIT\.md$
+^CLAUDE\.md$
+^issue_comments$
+^bench$
+^ROADMAP\.md$
+^ISSUE-RESOLUTION\.md$
+^vignettes/.*\.html$

.github/workflows/R-CMD-check.yaml

@@ -1,17 +1,14 @@
-# For help debugging build failures open an issue on the RStudio community with the 'github-actions' tag.
-# https://community.rstudio.com/new-topic?category=Package%20development&tags=github-actions
+# Workflow derived from https://github.com/r-lib/actions/tree/v2/examples
 on:
   push:
-    branches:
-      - main
-      - master
+    branches: [main, master]
   pull_request:
-    branches:
-      - main
-      - master
+    branches: [main, master]
 
 name: R-CMD-check
 
+permissions: read-all
+
 jobs:
   R-CMD-check:
     runs-on: ${{ matrix.config.os }}
@@ -22,65 +19,41 @@ jobs:
       fail-fast: false
       matrix:
         config:
+          - {os: macos-latest,   r: 'release'}
           - {os: windows-latest, r: 'release'}
-          - {os: macOS-latest, r: 'release'}
-          - {os: ubuntu-20.04, r: 'release', rspm: "https://packagemanager.rstudio.com/cran/__linux__/focal/latest"}
-          - {os: ubuntu-20.04, r: 'devel', rspm: "https://packagemanager.rstudio.com/cran/__linux__/focal/latest"}
+          - {os: ubuntu-latest,  r: 'devel', http-user-agent: 'release'}
+          - {os: ubuntu-latest,  r: 'release'}
+          - {os: ubuntu-latest,  r: 'oldrel-1'}
 
     env:
-      R_REMOTES_NO_ERRORS_FROM_WARNINGS: true
-      RSPM: ${{ matrix.config.rspm }}
       GITHUB_PAT: ${{ secrets.GITHUB_TOKEN }}
+      R_KEEP_PKG_SOURCE: yes
 
     steps:
-      - uses: actions/checkout@v2
-
-      - uses: r-lib/actions/setup-r@v1
+      - uses: actions/checkout@v4
         with:
-          r-version: ${{ matrix.config.r }}
-
-      - uses: r-lib/actions/setup-pandoc@v1
+          fetch-depth: 0
 
-      - name: Query dependencies
-        run: |
-          install.packages('remotes')
-          saveRDS(remotes::dev_package_deps(dependencies = TRUE), ".github/depends.Rds", version = 2)
-          writeLines(sprintf("R-%i.%i", getRversion()$major, getRversion()$minor), ".github/R-version")
-        shell: Rscript {0}
+      - uses: r-lib/actions/setup-pandoc@v2
 
-      - name: Restore R package cache
-        if: runner.os != 'Windows'
-        uses: actions/cache@v2
+      - uses: r-lib/actions/setup-r@v2
         with:
-          path: ${{ env.R_LIBS_USER }}
-          key: ${{ runner.os }}-${{ hashFiles('.github/R-version') }}-1-${{ hashFiles('.github/depends.Rds') }}
-          restore-keys: ${{ runner.os }}-${{ hashFiles('.github/R-version') }}-1-
-
-      - name: Install system dependencies
-        if: runner.os == 'Linux'
-        run: |
-          while read -r cmd
-          do
-            eval sudo $cmd
-          done < <(Rscript -e 'writeLines(remotes::system_requirements("ubuntu", "20.04"))')
+          r-version: ${{ matrix.config.r }}
+          http-user-agent: ${{ matrix.config.http-user-agent }}
+          use-public-rspm: true
 
-      - name: Install dependencies
-        run: |
-          remotes::install_deps(dependencies = TRUE)
-          remotes::install_cran("rcmdcheck")
-        shell: Rscript {0}
+      - uses: r-lib/actions/setup-r-dependencies@v2
+        with:
+          extra-packages: any::rcmdcheck
+          needs: check
 
-      - name: Check
+      - name: Exact zipcodeR 0.3.5 differential gate
         env:
-          _R_CHECK_CRAN_INCOMING_REMOTE_: false
-        run: |
-          options(crayon.enabled = TRUE)
-          rcmdcheck::rcmdcheck(args = c("--no-manual", "--as-cran"), error_on = "warning", check_dir = "check")
-        shell: Rscript {0}
+          ZIPCODER_BASELINE_REF: origin/master
+        run: Rscript tools/compatibility-check.R
 
-      - name: Upload check results
-        if: failure()
-        uses: actions/upload-artifact@main
+      - uses: r-lib/actions/check-r-package@v2
         with:
-          name: ${{ runner.os }}-r${{ matrix.config.r }}-results
-          path: check
+          args: 'c("--no-manual", "--as-cran")'
+          upload-snapshots: true
+          build_args: 'c("--no-manual", "--compact-vignettes=gs+qpdf")'

.github/workflows/pkgdown.yaml

@@ -32,13 +32,9 @@ jobs:
 
       - uses: r-lib/actions/setup-r-dependencies@v2
         with:
-          extra-packages: any::pkgdown, local::.
+          # the preferably pkgdown template is no longer on CRAN; install from GitHub
+          extra-packages: any::pkgdown, github::amirmasoudabdol/preferably, local::.
           needs: website
-
-      - name: Install dependencies
-        run: |
-          remotes::install_deps(dependencies = TRUE)
-          install.packages(c("pkgdown","preferably"), type = "binary")
 
       - name: Build site
         run: pkgdown::build_site_github_pages(new_process = FALSE, install = FALSE)

.github/workflows/refresh-data.yaml

@@ -0,0 +1,84 @@
+name: data-assets
+
+on:
+  workflow_dispatch:
+    inputs:
+      mode:
+        description: Inspect upstream sources or rebuild an already-pinned release
+        required: true
+        type: choice
+        options: [refresh, rebuild]
+      data_version:
+        description: Explicit immutable data version (for example 2026.08)
+        required: true
+        type: string
+      build_timestamp:
+        description: Explicit ISO-8601 build timestamp
+        required: true
+        type: string
+
+permissions:
+  contents: read
+
+jobs:
+  data-assets:
+    runs-on: ubuntu-latest
+    env:
+      CENSUS_API_KEY: ${{ secrets.CENSUS_API_KEY }}
+      PIPELINE_DATA_VERSION: ${{ inputs.data_version }}
+      PIPELINE_PROPOSED_VERSION: ${{ inputs.data_version }}
+      PIPELINE_BUILD_TIMESTAMP: ${{ inputs.build_timestamp }}
+      PIPELINE_BASELINE_REF: master
+      PIPELINE_MODE: ${{ inputs.mode }}
+
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+
+      - uses: r-lib/actions/setup-r@v2
+        with:
+          r-version: '4.6.1'
+          use-public-rspm: true
+
+      - name: Restore the pinned pipeline library
+        run: |
+          echo "762ec8acc2d2ccbe5a217859c846c2de83254e3948112b437dde7a0ad5b15999  data-raw/vendor/pak_0.11.1.tar.gz" | sha256sum --check
+          R CMD INSTALL data-raw/vendor/pak_0.11.1.tar.gz
+          Rscript -e 'pak::lockfile_install("data-raw/pkg.lock")'
+
+      - name: Inspect upstream source bytes
+        if: inputs.mode == 'refresh'
+        run: Rscript data-raw/refresh_sources.R
+
+      - name: Upload source-refresh proposal for human review
+        if: inputs.mode == 'refresh'
+        uses: actions/upload-artifact@v4
+        with:
+          name: source-refresh-${{ inputs.data_version }}
+          path: data-raw/refresh-candidate/${{ inputs.data_version }}/
+          if-no-files-found: error
+
+      - name: Deterministic rebuild, pass one
+        if: inputs.mode == 'rebuild'
+        run: |
+          Rscript data-raw/run_pipeline.R
+          sha256sum \
+            data-raw/release/zipcodeR-data-${{ inputs.data_version }}.rds \
+            data-raw/release/manifest-${{ inputs.data_version }}.json \
+            data-raw/release/zipcodeR-reproducibility-${{ inputs.data_version }}.tar.gz \
+            > /tmp/first.sha256
+
+      - name: Deterministic rebuild, pass two
+        if: inputs.mode == 'rebuild'
+        run: |
+          Rscript data-raw/run_pipeline.R
+          sha256sum --check /tmp/first.sha256
+
+      - name: Upload unpublished release candidates
+        if: inputs.mode == 'rebuild'
+        uses: actions/upload-artifact@v4
+        with:
+          name: zipcodeR-data-${{ inputs.data_version }}-unpublished
+          path: data-raw/release/
+          if-no-files-found: error

.github/workflows/test-coverage.yaml

@@ -0,0 +1,55 @@
+# Workflow derived from https://github.com/r-lib/actions/tree/v2/examples
+on:
+  push:
+    branches: [main, master]
+  pull_request:
+    branches: [main, master]
+
+name: test-coverage
+
+permissions: read-all
+
+jobs:
+  test-coverage:
+    runs-on: ubuntu-latest
+    env:
+      GITHUB_PAT: ${{ secrets.GITHUB_TOKEN }}
+
+    steps:
+      - uses: actions/checkout@v4
+
+      - uses: r-lib/actions/setup-r@v2
+        with:
+          use-public-rspm: true
+
+      - uses: r-lib/actions/setup-r-dependencies@v2
+        with:
+          extra-packages: any::covr, any::xml2
+          needs: coverage
+
+      - name: Test coverage
+        run: |
+          cov <- covr::package_coverage(
+            quiet = FALSE,
+            clean = FALSE,
+            install_path = file.path(normalizePath(Sys.getenv("RUNNER_TEMP"), winslash = "/"), "package")
+          )
+          print(cov)
+          covr::to_cobertura(cov)
+        shell: Rscript {0}
+
+      - uses: codecov/codecov-action@v4
+        with:
+          # Fail if error if not on PR, or if on PR and token is given
+          fail_ci_if_error: ${{ github.event_name != 'pull_request' || secrets.CODECOV_TOKEN }}
+          files: ./cobertura.xml
+          plugins: noop
+          disable_search: true
+          token: ${{ secrets.CODECOV_TOKEN }}
+
+      - name: Show testthat output
+        if: always()
+        run: |
+          ## --------------------------------------------------------------------
+          find '${{ runner.temp }}/package' -name 'testthat.Rout*' -exec cat '{}' \; || true
+        shell: bash

.gitignore

@@ -2,3 +2,5 @@
 .Rhistory
 .DS_Store
 README.knit.md
+README.html
+vignettes/*.html