Renv fix

.github/workflows/action.yml

@@ -6,7 +6,10 @@ name: Render and Publish
 
 jobs:
   build-deploy:
-    runs-on: ubuntu-latest
+    # Pinned deliberately: setup-renv keys its package cache on the OS string,
+    # so a floating ubuntu-latest silently invalidates every cache when GitHub
+    # migrates the image (this is what broke CI in July 2026).
+    runs-on: ubuntu-24.04
     env:
       GITHUB_PAT: ${{ secrets.GITHUB_TOKEN }}
       R_KEEP_PKG_SOURCE: yes
@@ -23,10 +26,23 @@ jobs:
           cache: 'pip' # caching pip dependencies
       - run: pip install -r requirements.txt
 
-      - name: Install libcurl
+      - name: Install system dependencies
+        # Derived from Posit Package Manager's sysreqs API for the packages in
+        # renv.lock on ubuntu-24.04. Regenerate with:
+        #   https://packagemanager.posit.co/__api__/repos/cran/sysreqs?all=false&distribution=ubuntu&release=24.04&pkgname=<pkg>&...
+        # We install binaries, so these are needed as runtime shared libraries.
         run: |
           sudo apt-get update
-          sudo apt-get install -y libcurl4-openssl-dev libudunits2-dev gdal-bin libgdal-dev libglu1-mesa libxi-dev
+          sudo apt-get install -y \
+            libcurl4-openssl-dev libssl-dev libxml2-dev libicu-dev zlib1g-dev \
+            libglpk-dev \
+            libudunits2-dev gdal-bin libgdal-dev libgeos-dev libproj-dev \
+            libsqlite3-dev libabsl-dev \
+            libcairo2-dev libfontconfig1-dev libfreetype6-dev libfribidi-dev \
+            libharfbuzz-dev \
+            libjpeg-dev libpng-dev libtiff-dev libwebp-dev \
+            libnode-dev libuv1-dev libx11-dev \
+            libglu1-mesa libxi-dev
       - name: Put pandoc in PATH
         run: |
           mkdir -p ~/.local/bin

.github/workflows/pull_request_action.yml

@@ -11,7 +11,10 @@ name: Test Rendering
 
 jobs:
   build-deploy:
-    runs-on: ubuntu-latest
+    # Pinned deliberately: setup-renv keys its package cache on the OS string,
+    # so a floating ubuntu-latest silently invalidates every cache when GitHub
+    # migrates the image (this is what broke CI in July 2026).
+    runs-on: ubuntu-24.04
     env:
       GITHUB_PAT: ${{ secrets.GITHUB_TOKEN }}
       R_KEEP_PKG_SOURCE: yes
@@ -29,10 +32,23 @@ jobs:
       - run: pip install -r requirements.txt
 
 
-      - name: Install libcurl
+      - name: Install system dependencies
+        # Derived from Posit Package Manager's sysreqs API for the packages in
+        # renv.lock on ubuntu-24.04. Regenerate with:
+        #   https://packagemanager.posit.co/__api__/repos/cran/sysreqs?all=false&distribution=ubuntu&release=24.04&pkgname=<pkg>&...
+        # We install binaries, so these are needed as runtime shared libraries.
         run: |
           sudo apt-get update
-          sudo apt-get install -y libcurl4-openssl-dev libudunits2-dev gdal-bin libgdal-dev libglu1-mesa libxi-dev
+          sudo apt-get install -y \
+            libcurl4-openssl-dev libssl-dev libxml2-dev libicu-dev zlib1g-dev \
+            libglpk-dev \
+            libudunits2-dev gdal-bin libgdal-dev libgeos-dev libproj-dev \
+            libsqlite3-dev libabsl-dev \
+            libcairo2-dev libfontconfig1-dev libfreetype6-dev libfribidi-dev \
+            libharfbuzz-dev \
+            libjpeg-dev libpng-dev libtiff-dev libwebp-dev \
+            libnode-dev libuv1-dev libx11-dev \
+            libglu1-mesa libxi-dev
 
       - name: Put pandoc in PATH
         run: |
@@ -56,6 +72,19 @@ jobs:
         run: |
           quarto render
 
+      # TEMPORARY (remove before merge): the lockfile refresh invalidates most of
+      # the freeze cache, so this run regenerates it. Upload it so it can be
+      # committed, which returns build times to ~12 min instead of ~65.
+      - name: Upload regenerated freeze cache
+        uses: actions/upload-artifact@v4
+        with:
+          name: freeze-cache
+          path: |
+            _freeze
+            data/quarto_pkg_dependencies.csv
+          retention-days: 5
+          if-no-files-found: error
+
       - name: Deploy preview 🔍
         # Ensure this step only runs if we aren't on a fork, as otherwise it will fail with permissions errors
         if: ${{ github.event.pull_request.head.repo.full_name == github.event.pull_request.base.repo.full_name }}

contribution/get_started.qmd

@@ -106,6 +106,32 @@ renv::restore()
 
 These function calls help to record and update the `renv.lock` file with the package and associated dependencies in a reproducible manner.
 
+::: {.callout-warning}
+## Check your `renv::snapshot()` diff before committing
+
+`renv::snapshot()` records your *local* environment, not just the package you added, so it can quietly sweep unrelated changes into the lockfile. Before committing, run `git diff renv.lock requirements.txt` and confirm the only changes are the ones you meant to make. Two in particular catch people out:
+
+-   **`requirements.txt` and the `Python` block of `renv.lock`.** `renv` rewrites both from whichever Python environment is active. If that is not the project's Python 3.12 virtualenv, `requirements.txt` is replaced by whatever your interpreter happens to have installed — on one occasion this cut it from 124 packages down to one. Unless you deliberately intended to change the Python environment, undo those with `git checkout -- requirements.txt` and restore the original `Python` block.
+-   **The recorded R version.** CI installs the R version named in `renv.lock`, and a snapshot sets it to whatever R *you* are running.
+
+Commit only the R package records unless a wider change is the point of your pull request.
+:::
+
+::: {.callout-note}
+## The package repository is pinned to a fixed date
+
+`renv.lock` points at a dated [Posit Package Manager](https://packagemanager.posit.co) snapshot rather than `latest`. This is deliberate: it means every recorded version still has a prebuilt binary available on Linux, macOS and Windows, so nobody needs a working compiler toolchain to run `renv::restore()`. Pointing at `latest` breaks this, because `latest` only ever serves the *current* version of each package, and anything pinned to an older version then has to be built from source.
+
+Two consequences when adding a package:
+
+-   `renv::install("package_name")` installs the version that was current on the snapshot date, not today's version.
+-   A package published to CRAN *after* the snapshot date cannot be installed until the date is moved forward.
+
+Moving the date means re-snapshotting the whole lockfile, which shifts many package versions at once and invalidates most of the Quarto freeze cache. Please raise that as its own pull request rather than folding it into a content change.
+
+Packages that ship with R itself — `mgcv`, `Matrix`, `survival`, `lattice` and friends — are deliberately left out of the lockfile via `ignored.packages` in `renv/settings.json`. Their versions follow your R installation rather than CRAN, so they can never be pinned reliably, and recording them causes `renv::restore()` to fail.
+:::
+
 At this point, it is assumed that your system in RStudio is connected to Git and GitHub, and that the `renv` environment is successfully activated. Now every time you close RStudio and reopen the CAMIS project on your computer, you should see the option:
 
 ```{r}