carpentries-incubator · carpentries-bot · Apr 21, 2026
diff --git a/.github/workflows/README.md b/.github/workflows/README.md
diff --git a/.github/workflows/docker_apply_cache.yaml b/.github/workflows/docker_apply_cache.yaml
@@ -132,7 +132,7 @@ jobs:
         - ${{ github.workspace }}:/home/rstudio/lesson
       options: --cpus 2
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v6
 
       - name: "Debugging Info"
         run: |
@@ -187,15 +187,15 @@ jobs:
           steps.validate-org-workflow.outputs.is_valid == 'true' &&
           env.role-to-assume != '' &&
           env.aws-region != ''
-        uses: aws-actions/configure-aws-credentials@v5.0.0
+        uses: aws-actions/configure-aws-credentials@v6
         with:
           role-to-assume: ${{ env.role-to-assume }}
           aws-region: ${{ env.aws-region }}
           output-credentials: true
 
       - name: "Upload cache object to S3"
         id: upload-cache
-        uses: carpentries/actions-cache@frog-matchedkey-1
+        uses: tespkg/actions-cache@v1.10.0
         with:
           accessKey: ${{ steps.aws-creds.outputs.aws-access-key-id }}
           secretKey: ${{ steps.aws-creds.outputs.aws-secret-access-key }}
@@ -208,20 +208,22 @@ jobs:
           restore-keys:
             ${{ github.repository }}/${{ steps.wb-vers.outputs.container-version }}_renv-
 
-  trigger-build-deploy:
-    name: "Trigger Build and Deploy Workflow"
+  record-cache-result:
+    name: "Record Caching Status"
     runs-on: ubuntu-latest
-    needs: update-renv-cache
-    if: |
-      needs.update-renv-cache.result == 'success' ||
-      needs.check-renv.outputs.renv-cache-available == 'true'
+    needs: [check-renv, update-renv-cache]
+    if: always()
+    env:
+      GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
     steps:
-      - uses: actions/checkout@v4
+      - name: "Record cache result"
 
-      - name: "Trigger Build and Deploy Workflow"
-        env:
-          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
         run: |
-          gh workflow run docker_build_deploy.yaml --ref main
+          echo "${{ needs.update-renv-cache.result == 'success' || needs.check-renv.outputs.renv-cache-available == 'true' || 'false' }}" > ${{ github.workspace }}/apply-cache-result
         shell: bash
-        continue-on-error: true
+
+      - name: "Upload cache result"
+        uses: actions/upload-artifact@v7
+        with:
+          name: apply-cache-result
+          path: ${{ github.workspace }}/apply-cache-result
diff --git a/.github/workflows/docker_build_deploy.yaml b/.github/workflows/docker_build_deploy.yaml
@@ -4,11 +4,16 @@ on:
   push:
     branches:
       - 'main'
+      - 'l10n_main'
     paths-ignore:
       - '.github/workflows/**.yaml'
       - '.github/workbench-docker-version.txt'
   schedule:
     - cron: '0 0 * * 2'
+  workflow_run:
+    workflows: ["03 Maintain: Apply Package Cache"]
+    types:
+      - completed
   workflow_dispatch:
     inputs:
       name:
@@ -56,7 +61,7 @@ jobs:
 
       - name: "Checkout Lesson"
         if: steps.build-check.outputs.do-build == 'true'
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6
 
       - name: "Get container version info"
         id: wb-vers
@@ -72,7 +77,6 @@ jobs:
     runs-on: ubuntu-latest
     needs: preflight
     if: |
-      always() &&
       needs.preflight.outputs.do-build == 'true' &&
       needs.preflight.outputs.workbench-update != 'true'
     env:
@@ -95,7 +99,7 @@ jobs:
         - ${{ github.workspace }}:/home/rstudio/lesson
       options: --cpus 1
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v6
 
       - name: "Debugging Info"
         run: |
@@ -129,6 +133,7 @@ jobs:
         with:
           reset: ${{ vars.BUILD_RESET || github.event.inputs.reset || 'false' }}
           skip-manage-deps: ${{ github.event.inputs.force-skip-manage-deps == 'true' || steps.build-container-deps.outputs.renv-cache-available || steps.build-container-deps.outputs.backup-cache-used || 'false' }}
+          lang-code: ${{ vars.LANG_CODE || '' }}
 
   update-container-version:
     name: "Update container version used"

diff --git a/.github/workflows/docker_pr_receive.yaml b/.github/workflows/docker_pr_receive.yaml
@@ -19,15 +19,14 @@ permissions:
   pull-requests: write
 
 jobs:
-
   preflight:
     name: "Preflight: md-outputs exists?"
     runs-on: ubuntu-latest
     outputs:
       branch-exists: ${{ steps.check.outputs.exists }}
     steps:
       - name: "Checkout Lesson"
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6
 
       - name: "Check if md-outputs branch exists"
         id: check
@@ -49,7 +48,9 @@ jobs:
 
   test-pr:
     name: "Record PR number"
-    if: ${{ github.event.action != 'closed' }} && ${{ needs.preflight.outputs.branch-exists == 'true' }}
+    if: |
+      github.event.action != 'closed' &&
+      needs.preflight.outputs.branch-exists == 'true'
     runs-on: ubuntu-latest
     needs: preflight
     outputs:
@@ -75,7 +76,7 @@ jobs:
       - name: "Upload PR number"
         id: upload
         if: always()
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v7
         with:
           name: pr
           path: ${{ github.workspace }}/NR
@@ -108,7 +109,7 @@ jobs:
       renv-cache-hashsum: ${{ steps.renv-check.outputs.renv-cache-hashsum }}
     steps:
       - name: "Checkout Lesson"
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6
 
       - name: "Is renv required?"
         id: renv-check
@@ -135,6 +136,7 @@ jobs:
       checks: write
       contents: write
       pages: write
+      id-token: write
     container:
       image: ghcr.io/carpentries/workbench-docker:${{ vars.WORKBENCH_TAG || 'latest' }}
       env:
@@ -151,10 +153,10 @@ jobs:
       workbench-update: ${{ steps.wb-vers.outputs.workbench-update }}
       build-site: ${{ steps.build-site.outcome }}
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v6
 
       - name: "Check Out Staging Branch"
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6
         with:
           ref: md-outputs
           path: ${{ env.GHWMD }}
@@ -203,15 +205,15 @@ jobs:
           needs.check-renv.outputs.renv-needed == 'true' &&
           env.role-to-assume != '' &&
           env.aws-region != ''
-        uses: aws-actions/configure-aws-credentials@v5.0.0
+        uses: aws-actions/configure-aws-credentials@v6
         with:
           role-to-assume: ${{ env.role-to-assume }}
           aws-region: ${{ env.aws-region }}
           output-credentials: true
 
       - name: Get cache object from S3
         id: s3-cache
-        uses: carpentries/actions-cache/restore@frog-matchedkey-1
+        uses: tespkg/actions-cache/restore@v1.10.0
         if: needs.check-renv.outputs.renv-needed == 'true'
         with:
           # insecure: false # optional, use http instead of https. default false
@@ -256,21 +258,21 @@ jobs:
         shell: Rscript {0}
 
       - name: "Upload PR"
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v7
         with:
           name: pr
           path: ${{ env.PR }}
           overwrite: true
 
       - name: "Upload Diff"
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v7
         with:
           name: diff
           path: ${{ env.CHIVE }}
           retention-days: 1
 
       - name: "Upload Build"
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v7
         with:
           name: built
           path: ${{ env.GHWMD }}
@@ -279,24 +281,3 @@ jobs:
       - name: "Teardown"
         run: sandpaper::reset_site()
         shell: Rscript {0}
-
-  pr-checks:
-    name: "Trigger PR Checks?"
-    needs:
-      - test-pr
-      - build-md-source
-    runs-on: ubuntu-latest
-    if: needs.test-pr.outputs.is_valid == 'true'
-    permissions:
-      actions: write
-      checks: write
-    steps:
-      - name: "Checkout Lesson"
-        uses: actions/checkout@v4
-
-      - name: "Trigger PR Checks"
-        env:
-          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-        run: |
-          gh workflow run pr-comment.yaml --ref main --field workflow_id=${{ github.run_id }}
-        shell: bash
diff --git a/.github/workflows/pr-close-signal.yaml b/.github/workflows/pr-close-signal.yaml
@@ -16,7 +16,7 @@ jobs:
           mkdir -p ./pr
           printf ${{ github.event.number }} > ./pr/NUM
       - name: Upload Diff
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v7
         with:
           name: pr
           path: ./pr
diff --git a/.github/workflows/pr-comment.yaml b/.github/workflows/pr-comment.yaml
@@ -1,14 +1,10 @@
 name: "Bot: Comment on the Pull Request"
 description: "Comment on the pull request with the results of the markdown generation"
 on:
-  workflow_dispatch:
-    inputs:
-      workflow_id:
-        required: true
-
-concurrency:
-  group: pr-${{ github.event.workflow_run.pull_requests[0].number }}
-  cancel-in-progress: true
+  workflow_run:
+    workflows: ["Bot: Receive Pull Request"]
+    types:
+      - completed
 
 jobs:
   # Pull requests are valid if:
@@ -18,16 +14,6 @@ jobs:
   test-pr:
     name: "Test if pull request is valid"
     runs-on: ubuntu-latest
-    if: >
-      github.event_name == 'workflow_dispatch' ||
-      (
-        github.event_name == 'workflow_run' &&
-        (
-          github.event.workflow_run.event == 'pull_request' ||
-          github.event.workflow_run.event == 'workflow_dispatch'
-        ) &&
-        github.event.workflow_run.conclusion == 'success'
-      )
     outputs:
       is_valid: ${{ steps.check-pr.outputs.VALID }}
       payload: ${{ steps.check-pr.outputs.payload }}
@@ -38,7 +24,7 @@ jobs:
         id: dl
         uses: carpentries/actions/download-workflow-artifact@main
         with:
-          run: ${{ github.event.workflow_run.id || inputs.workflow_id }}
+          run: ${{ github.event.workflow_run.id }}
           name: 'pr'
 
       - name: "Get PR Number"
@@ -56,7 +42,7 @@ jobs:
           exit 1
 
       - name: "Checkout Lesson"
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6
 
       - name: "Verify committed files"
         id: changed-files
@@ -79,11 +65,9 @@ jobs:
 
       - name: "Skip checks for Workbench version file updates"
         if: steps.changed-files.outputs.only_version_file == 'true'
-        env:
-          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
         run: |
-          echo "Only workbench-docker-version.txt changed, skipping preflight checks and running cache update"
-          gh workflow run update-cache.yaml --ref main
+          echo "# 🔧 Wait for Next Cache Update #"
+          echo "Only workbench-docker-version.txt changed."
           exit 0
         shell: bash
 
@@ -128,7 +112,7 @@ jobs:
       contents: write
     steps:
       - name: "Checkout md outputs"
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6
         with:
           ref: md-outputs
           path: built
@@ -138,7 +122,7 @@ jobs:
         id: dl
         uses: carpentries/actions/download-workflow-artifact@main
         with:
-          run: ${{ github.event.workflow_run.id || inputs.workflow_id }}
+          run: ${{ github.event.workflow_run.id }}
           name: 'built'
 
       - if: steps.dl.outputs.success == 'true'
@@ -177,7 +161,7 @@ jobs:
         id: dl
         uses: carpentries/actions/download-workflow-artifact@main
         with:
-          run: ${{ github.event.workflow_run.id || inputs.workflow_id }}
+          run: ${{ github.event.workflow_run.id }}
           name: 'diff'
 
       - if: steps.dl.outputs.success == 'true'
@@ -210,7 +194,7 @@ jobs:
         id: dl
         uses: carpentries/actions/download-workflow-artifact@main
         with:
-          run: ${{ github.event.workflow_run.id || inputs.workflow_id }}
+          run: ${{ github.event.workflow_run.id }}
           name: 'built'
 
       - name: "Alert if spoofed"

diff --git a/.github/workflows/sandpaper-version.txt b/.github/workflows/sandpaper-version.txt