R-CMD-check.yaml

# For help debugging build failures open an issue on the RStudio community with the 'github-actions' tag.
# https://community.rstudio.com/new-topic?category=Package%20development&tags=github-actions

# Details on pull_request_target and why it's insecure:
# https://securitylab.github.com/resources/github-actions-preventing-pwn-requests/
# Post describing a workaround, from which we take inspiration:
# https://michaelheap.com/access-secrets-from-forks/

name: R-CMD-check

on:
  push:
    branches:
      - master
      - 'feature/**'
      - 'bugfix/**'
  pull_request_target:
    types: [opened, synchronize]

jobs:
  pre-check:
    runs-on: ubuntu-latest
    steps:
      - name: Get User Permission
        id: checkAccess
        uses: actions-cool/check-user-permission@v2
        with:
          require: write
          username: ${{ github.triggering_actor }}
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
      - name: Check User Permission
        if: steps.checkAccess.outputs.require-result == 'false'
        run: |
          echo "${{ github.triggering_actor }} does not have permissions on this repo."
          echo "Current permission level is ${{ steps.checkAccess.outputs.user-permission }}"
          echo "Job originally triggered by ${{ github.actor }}"
          exit 1

  R-CMD-check:
    needs: [pre-check]
    runs-on: ${{ matrix.config.os }}
    timeout-minutes: 60

    name: ${{ matrix.config.os }} (${{ matrix.config.r }})

    strategy:
      # Run sequentially so that we don't run into rate limit errors that our
      # code would normally work around via retry logic
      max-parallel: 1
      fail-fast: false
      matrix:
        config:
          - {os: windows-latest, r: 'release'}
          - {os: macOS-latest, r: 'release'}
          - {os: ubuntu-20.04, r: 'release', rspm: "https://packagemanager.rstudio.com/cran/__linux__/focal/latest"}
          # - {os: ubuntu-20.04, r: 'devel', rspm: "https://packagemanager.rstudio.com/cran/__linux__/focal/latest"}

    env:
      R_REMOTES_NO_ERRORS_FROM_WARNINGS: true
      RSPM: ${{ matrix.config.rspm }}
      GITHUB_PAT: ${{ secrets.GITHUB_TOKEN }}
      PATENTSVIEW_API_KEY: ${{ secrets.PATENTSVIEW_API_KEY }}

    steps:
      - name: Checkout code
        uses: actions/checkout@v3
        with:
          # Use the head SHA for pull requests
          ref: ${{ github.event.pull_request.head.sha || github.sha }}

      - uses: r-lib/actions/setup-r@v2
        with:
          r-version: ${{ matrix.config.r }}

      - uses: r-lib/actions/setup-pandoc@v2

      - name: Check Secrets Access
        if: ${{ env.PATENTSVIEW_API_KEY == '' }}
        run: |
          echo "No access to secrets"
          exit 1

      - name: Check Secrets Access
        if: ${{ env.PATENTSVIEW_API_KEY == '' }}
        run: |
          echo "No access to secrets"
          exit 1

      - name: Query dependencies
        run: |
          install.packages('remotes')
          saveRDS(remotes::dev_package_deps(dependencies = TRUE), ".github/depends.Rds", version = 2)
          writeLines(sprintf("R-%i.%i", getRversion()$major, getRversion()$minor), ".github/R-version")
        shell: Rscript {0}

      - name: Restore R package cache
        if: runner.os != 'Windows'
        uses: actions/cache@v4
        with:
          path: ${{ env.R_LIBS_USER }}
          key: ${{ runner.os }}-${{ hashFiles('.github/R-version') }}-1-${{ hashFiles('.github/depends.Rds') }}
          restore-keys: ${{ runner.os }}-${{ hashFiles('.github/R-version') }}-1-

      - name: Install system dependencies
        if: runner.os == 'Linux'
        run: |
          while read -r cmd
          do
            eval sudo $cmd
          done < <(Rscript -e 'writeLines(remotes::system_requirements("ubuntu", "20.04"))')

      - name: Install dependencies
        run: |
          remotes::install_deps(dependencies = TRUE)
          remotes::install_cran("rcmdcheck")
          remotes::install_cran("covr")
        shell: Rscript {0}

      - name: Check
        env:
          _R_CHECK_CRAN_INCOMING_REMOTE_: false

        run: |
          options(crayon.enabled = TRUE)
          rcmdcheck::rcmdcheck(args = c("--no-manual", "--as-cran"), error_on = "warning", check_dir = "check")
        shell: Rscript {0}

      - name: Run examples
        env:
          _R_CHECK_CRAN_INCOMING_REMOTE_: false

        run: |
          options(crayon.enabled = TRUE)
          remotes::install_cran("devtools")
          devtools::run_examples(run_dontrun = TRUE)
        shell: Rscript {0}

      - name: Upload check results
        if: failure()
        uses: actions/upload-artifact@main
        with:
          name: ${{ runner.os }}-r${{ matrix.config.r }}-results
          path: check