From a86f33c0264f62856b3361f325424051c3e7c088 Mon Sep 17 00:00:00 2001
From: cicdguy <26552821+cicdguy@users.noreply.github.com>
Date: Tue, 5 Nov 2024 08:28:36 -0600
Subject: [PATCH] fix: Add explicit git-ref for SD action

---
 .github/workflows/check-r-tags.yml      |  2 +-
 .github/workflows/check-templates.yml   |  4 +--
 .github/workflows/code-coverage.yml     |  3 ++-
 .github/workflows/common.yml.inactive   |  2 +-
 .github/workflows/cran-status.yml       |  2 +-
 .github/workflows/lintr.yml             |  3 ++-
 .github/workflows/man-pages.yml         |  3 ++-
 .github/workflows/pkgdown.yml           |  5 ++--
 .github/workflows/push-docker-image.yml | 36 ++++++++++++++++---------
 .github/workflows/r-cmd-check.yml       |  5 ++--
 .github/workflows/r-pkg-validation.yml  |  3 ++-
 .github/workflows/readme-render.yml     |  3 ++-
 .github/workflows/spellcheck.yml        |  3 ++-
 .github/workflows/style.yml             |  3 ++-
 14 files changed, 47 insertions(+), 30 deletions(-)

diff --git a/.github/workflows/check-r-tags.yml b/.github/workflows/check-r-tags.yml
index b2876e52..2e7aaa09 100644
--- a/.github/workflows/check-r-tags.yml
+++ b/.github/workflows/check-r-tags.yml
@@ -18,7 +18,7 @@ concurrency:
 
 jobs:
   check-r-release:
-    runs-on: ubuntu-22.04
+    runs-on: ubuntu-latest
     steps:
       - name: List rocker/rstudio tags
         run: |
diff --git a/.github/workflows/check-templates.yml b/.github/workflows/check-templates.yml
index 3920ae7f..28266331 100644
--- a/.github/workflows/check-templates.yml
+++ b/.github/workflows/check-templates.yml
@@ -29,7 +29,7 @@ jobs:
     name: Verify
     if: >
       !contains(github.event.commits[0].message, '[skip check_templates]')
-    runs-on: ubuntu-22.04
+    runs-on: ubuntu-latest
     container:
       image: "ghcr.io/pharmaverse/admiralci-${{ inputs.r-version }}:latest"
     env:
@@ -56,7 +56,7 @@ jobs:
 
       - name: Add safe directory
         run: |
-          git config --global --add safe.directory "${GITHUB_WORKSPACE}" # open issue: git dubious ownership running in docker container context: https://github.com/actions/runner/issues/2033
+          git config --global --add safe.directory "${GITHUB_WORKSPACE}"
         shell: bash
 
       - name: Normalize inputs
diff --git a/.github/workflows/code-coverage.yml b/.github/workflows/code-coverage.yml
index 04b14eec..58e8347e 100644
--- a/.github/workflows/code-coverage.yml
+++ b/.github/workflows/code-coverage.yml
@@ -36,7 +36,7 @@ concurrency:
 jobs:
   coverage:
     name: Test Coverage
-    runs-on: ubuntu-22.04
+    runs-on: ubuntu-latest
     container:
       image: "ghcr.io/pharmaverse/admiralci-${{ inputs.r-version }}:latest"
     if: >
@@ -81,6 +81,7 @@ jobs:
           renv-restore: false
           enable-check: false
           direction: upstream
+          git-ref: ${{ steps.branch-name.outputs.current_branch }}
         env:
           GITHUB_PAT: ${{ secrets.GITHUB_TOKEN }}
 
diff --git a/.github/workflows/common.yml.inactive b/.github/workflows/common.yml.inactive
index db45f864..ca87e5b1 100644
--- a/.github/workflows/common.yml.inactive
+++ b/.github/workflows/common.yml.inactive
@@ -45,7 +45,7 @@ env:
 jobs:
   get_r_version:
     name: Get R version
-    runs-on: ubuntu-22.04
+    runs-on: ubuntu-latest
     outputs:
       r-version: ${{ steps.get_r_version.outputs.R_VERSION }}
     steps:
diff --git a/.github/workflows/cran-status.yml b/.github/workflows/cran-status.yml
index 4c3970d4..f7a07515 100644
--- a/.github/workflows/cran-status.yml
+++ b/.github/workflows/cran-status.yml
@@ -66,7 +66,7 @@ concurrency:
 jobs:
   cran-status:
     name: Check Status
-    runs-on: ubuntu-22.04
+    runs-on: ubuntu-latest
     container:
       image: rocker/tidyverse:latest
     steps:
diff --git a/.github/workflows/lintr.yml b/.github/workflows/lintr.yml
index 4699c422..68af4692 100644
--- a/.github/workflows/lintr.yml
+++ b/.github/workflows/lintr.yml
@@ -56,7 +56,7 @@ concurrency:
 jobs:
   lint:
     name: Lint
-    runs-on: ubuntu-22.04
+    runs-on: ubuntu-latest
     container:
       image: "ghcr.io/pharmaverse/admiralci-${{ inputs.r-version }}:latest"
     if: >
@@ -96,6 +96,7 @@ jobs:
           renv-restore: false
           enable-check: false
           direction: upstream
+          git-ref: ${{ steps.branch-name.outputs.current_branch }}
         env:
           GITHUB_PAT: ${{ secrets.GITHUB_TOKEN }}
 
diff --git a/.github/workflows/man-pages.yml b/.github/workflows/man-pages.yml
index c4c2a497..aaeded87 100644
--- a/.github/workflows/man-pages.yml
+++ b/.github/workflows/man-pages.yml
@@ -26,7 +26,7 @@ concurrency:
 jobs:
   lint:
     name: Roxygen
-    runs-on: ubuntu-22.04
+    runs-on: ubuntu-latest
     container:
       image: "ghcr.io/pharmaverse/admiralci-${{ inputs.r-version }}:latest"
     if: >
@@ -66,6 +66,7 @@ jobs:
           renv-restore: false
           enable-check: false
           direction: upstream
+          git-ref: ${{ steps.branch-name.outputs.current_branch }}
         env:
           GITHUB_PAT: ${{ secrets.GITHUB_TOKEN }}
 
diff --git a/.github/workflows/pkgdown.yml b/.github/workflows/pkgdown.yml
index d530a245..e638b6f3 100644
--- a/.github/workflows/pkgdown.yml
+++ b/.github/workflows/pkgdown.yml
@@ -83,7 +83,7 @@ concurrency:
 jobs:
   pkgdown:
     name: pkgdown
-    runs-on: ubuntu-22.04
+    runs-on: ubuntu-latest
     container:
       image: "ghcr.io/pharmaverse/admiralci-${{ inputs.r-version }}:latest"
     env:
@@ -149,6 +149,7 @@ jobs:
           renv-restore: false
           enable-check: false
           direction: upstream
+          git-ref: ${{ steps.branch-name.outputs.current_branch }}
         env:
           GITHUB_PAT: ${{ secrets.GITHUB_TOKEN }}
 
@@ -267,7 +268,7 @@ jobs:
   multi-version-docs:
     name: Multi-version docs
     needs: pkgdown
-    runs-on: ubuntu-22.04
+    runs-on: ubuntu-latest
     if: >
       !inputs.skip-multiversion-docs &&
         !contains(github.event.commits[0].message, '[skip docs]')
diff --git a/.github/workflows/push-docker-image.yml b/.github/workflows/push-docker-image.yml
index a73b424e..955db5d5 100644
--- a/.github/workflows/push-docker-image.yml
+++ b/.github/workflows/push-docker-image.yml
@@ -18,7 +18,8 @@ concurrency:
 
 jobs:
   get_old_release:
-    runs-on: ubuntu-22.04
+    name: Get Old Release Version
+    runs-on: ubuntu-latest
     outputs:
       oldrel: ${{ steps.oldrelease.outputs.oldrelease }}
 
@@ -28,10 +29,11 @@ jobs:
         run: echo "oldrelease=${{ env.OLD_RELEASE }}" >> $GITHUB_OUTPUT
 
   deploy-image:
-    runs-on: ubuntu-22.04
+    name: Deploy Image
+    runs-on: ubuntu-latest
     needs: ["get_old_release"]
     strategy:
-      fail-fast: false # if one of the job "deploy-image" fails, the other parallel jobs will just continue
+      fail-fast: false
       matrix:
         tags: ["devel", "latest", "${{ needs.get_old_release.outputs.oldrel }}"]
 
@@ -46,19 +48,27 @@ jobs:
         with:
           fetch-depth: 0
 
-      - name: Print message
-        run: |
-          echo "updating docker image for R version ${{ matrix.tags }}"
-
       - name: Set image specs
         id: image_specs
         run: |
           package_name=$(grep "Package:" DESCRIPTION | awk '{print $NF}')
-          if [ "${{ matrix.tags }}" == "latest" ]; then image_name="${package_name}-release"; else image_name="${package_name}-${{ matrix.tags }}"; fi
-          if [ "${{ matrix.tags }}" == "devel" ]; then R_REPOS="https://packagemanager.posit.co/cran/__linux__/focal/latest"; fi
-          echo "r_repos=$R_REPOS" >> $GITHUB_OUTPUT
           r_version="${{ matrix.tags }}"
-          if [ "$r_version" == "${{ env.OLD_RELEASE }}" ]; then image_name="${package_name}-oldrel"; fi
+          ########### LATEST aka RELEAESE IMAGE NAME ###########
+          if [ "${{ matrix.tags }}" == "latest" ]; then
+              image_name="${package_name}-release"
+          else
+              image_name="${package_name}-${{ matrix.tags }}"
+          fi
+          ########### DEVEL IMAGE NAME ###########
+          if [ "${{ matrix.tags }}" == "devel" ]; then
+              R_REPOS="https://packagemanager.posit.co/cran/__linux__/focal/latest"
+          fi
+          ########### OLDREL IMAGE NAME ###########
+          if [ "$r_version" == "${{ env.OLD_RELEASE }}" ]; then
+              image_name="${package_name}-oldrel"
+          fi
+          #### Set outputs ####
+          echo "r_repos=$R_REPOS" >> $GITHUB_OUTPUT
           echo "image_name=${image_name}" >> $GITHUB_OUTPUT
 
       - name: Call deploy docker image action ${{ matrix.tags }}
@@ -122,8 +132,8 @@ jobs:
             xmlparsedata
 
   store_deps:
-    name: Store Deps
-    runs-on: ubuntu-22.04
+    name: Upload Image Manifests
+    runs-on: ubuntu-latest
     needs: ["get_old_release", "deploy-image"]
     container:
       image: "ghcr.io/pharmaverse/admiralci-${{ matrix.tags }}:latest"
diff --git a/.github/workflows/r-cmd-check.yml b/.github/workflows/r-cmd-check.yml
index 814d4232..c8f77a1c 100644
--- a/.github/workflows/r-cmd-check.yml
+++ b/.github/workflows/r-cmd-check.yml
@@ -24,7 +24,7 @@ concurrency:
 
 jobs:
   R-CMD-check:
-    runs-on: ubuntu-22.04
+    runs-on: ubuntu-latest
     container:
       image: "ghcr.io/pharmaverse/admiralci-${{ matrix.r_version }}:latest"
     name: (${{ matrix.r_version }})
@@ -73,8 +73,6 @@ jobs:
           github.event_name != 'pull_request'
         with:
           ref: ${{ steps.branch-name.outputs.head_ref_branch }}
-          set-safe-directory: true
-          fetch-depth: 0
 
       - name: Restore cache
         uses: actions/cache@v4
@@ -89,6 +87,7 @@ jobs:
           (github.event_name == 'workflow_dispatch' && matrix.r_version == 'devel') ||
           matrix.r_version != 'devel'
         with:
+          git-ref: ${{ steps.branch-name.outputs.current_branch }}
           run-system-dependencies: false
           renv-restore: false
           enable-check: false
diff --git a/.github/workflows/r-pkg-validation.yml b/.github/workflows/r-pkg-validation.yml
index 866b6650..b06d170e 100644
--- a/.github/workflows/r-pkg-validation.yml
+++ b/.github/workflows/r-pkg-validation.yml
@@ -24,7 +24,7 @@ on:
 jobs:
   r-pkg-validation:
     name: Generate
-    runs-on: ubuntu-22.04
+    runs-on: ubuntu-latest
     container:
       image: "ghcr.io/pharmaverse/admiralci-${{ inputs.r-version }}:latest"
     # Set Github token permissions
@@ -69,6 +69,7 @@ jobs:
           enable-check: false
           cran-repos: "RSPM=${{ env.R_REPOS }}"
           direction: upstream
+          git-ref: ${{ steps.branch-name.outputs.current_branch }}
         env:
           GITHUB_PAT: ${{ secrets.GITHUB_TOKEN }}
 
diff --git a/.github/workflows/readme-render.yml b/.github/workflows/readme-render.yml
index 7d5f2826..be2ca1dd 100644
--- a/.github/workflows/readme-render.yml
+++ b/.github/workflows/readme-render.yml
@@ -32,7 +32,7 @@ on:
 jobs:
   render:
     name: Render
-    runs-on: ubuntu-22.04
+    runs-on: ubuntu-latest
     container:
       image: "ghcr.io/pharmaverse/admiralci-${{ inputs.r-version }}:latest"
     env:
@@ -70,6 +70,7 @@ jobs:
           renv-restore: false
           enable-check: false
           direction: upstream
+          git-ref: ${{ steps.branch-name.outputs.current_branch }}
         env:
           GITHUB_PAT: ${{ secrets.GITHUB_TOKEN }}
 
diff --git a/.github/workflows/spellcheck.yml b/.github/workflows/spellcheck.yml
index abee17f0..cd4c9e2e 100644
--- a/.github/workflows/spellcheck.yml
+++ b/.github/workflows/spellcheck.yml
@@ -37,7 +37,7 @@ concurrency:
 jobs:
   spellcheck:
     name: Spellcheck
-    runs-on: ubuntu-22.04
+    runs-on: ubuntu-latest
     container:
       image: "ghcr.io/pharmaverse/admiralci-${{ inputs.r-version }}:latest"
     env:
@@ -77,6 +77,7 @@ jobs:
           renv-restore: false
           enable-check: false
           direction: upstream
+          git-ref: ${{ steps.branch-name.outputs.current_branch }}
         env:
           GITHUB_PAT: ${{ secrets.GITHUB_TOKEN }}
       ##################### END boilerplate steps #####################
diff --git a/.github/workflows/style.yml b/.github/workflows/style.yml
index f295b6b1..8a434b15 100644
--- a/.github/workflows/style.yml
+++ b/.github/workflows/style.yml
@@ -27,7 +27,7 @@ concurrency:
 jobs:
   style:
     name: Code Style
-    runs-on: ubuntu-22.04
+    runs-on: ubuntu-latest
     container:
       image: "ghcr.io/pharmaverse/admiralci-${{ inputs.r-version }}:latest"
     if: >
@@ -65,6 +65,7 @@ jobs:
           renv-restore: false
           enable-check: false
           direction: upstream
+          git-ref: ${{ steps.branch-name.outputs.current_branch }}
         env:
           GITHUB_PAT: ${{ secrets.GITHUB_TOKEN }}
       ##################### END boilerplate steps #####################