Update renv workflow for branch and PR permissions

Signed-off-by: Diogo Ribeiro <[email protected]>

Author: DiogoRibeiro7

.github/workflows/renv-update.yml

@@ -1,17 +1,24 @@
-# .github/workflows/renv-bootstrap-or-restore.yml
 name: Bootstrap or Restore renv
 
 on:
   workflow_dispatch:
   schedule:
     - cron: "0 6 * * 1"   # Mondays 06:00 UTC
 
+# ✅ allow the workflow to push a branch and open a PR
+permissions:
+  contents: write
+  pull-requests: write
+
 jobs:
   renv:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v5
-        with: { fetch-depth: 0 }
+      - uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+          # ✅ let create-pull-request manage its own credentials
+          persist-credentials: false
 
       - uses: r-lib/actions/setup-r@v2
         with:
@@ -22,14 +29,25 @@ jobs:
 
       - name: Bootstrap or restore
         id: renv
+        shell: bash
         run: |
           Rscript - <<'RSCRIPT'
           if (!file.exists("renv.lock")) {
             message("No renv.lock found — bootstrapping…")
             renv::init(bare = TRUE)
-            # Optionally install dev deps here, e.g.:
+            # Optionally install dev deps here:
             # renv::install(c("devtools","roxygen2","testthat"))
             renv::snapshot(prompt = FALSE)
+            # keep renv out of package tarballs
+            rb <- ".Rbuildignore"
+            add_line <- function(pat) {
+              if (!file.exists(rb) || !any(grepl(pat, readLines(rb), perl=TRUE))) {
+                cat(pat, file = rb, sep = "\n", append = TRUE)
+              }
+            }
+            add_line("^renv($|/)")
+            add_line("^renv\\.lock$")
+            add_line("^\\.Rprofile$")
             cat("BOOTSTRAPPED=1\n", file = Sys.getenv("GITHUB_OUTPUT"), append = TRUE)
           } else {
             message("renv.lock found — restoring…")
@@ -40,13 +58,14 @@ jobs:
 
       - name: Create PR with initial lockfile
         if: steps.renv.outputs.BOOTSTRAPPED == '1'
-        uses: peter-evans/create-pull-request@v7
+        uses: peter-evans/create-pull-request@v6
         with:
           commit-message: "chore(renv): initialize renv and add lockfile"
           title: "chore(renv): bootstrap renv"
           body: "Initial `renv` setup: adds `.Rprofile`, `renv/activate.R`, and `renv.lock`."
           branch: "chore/renv-bootstrap"
           labels: dependencies,R
           reviewers: diogoribeiro7
-
+          signoff: false
+          # uses the workflow GITHUB_TOKEN automatically; no PAT needed