update to carpentry workflows from incubator example

.github/workbench-docker-version.txt

@@ -0,0 +1 @@
+v0.2.8

.github/workflows/docker_build_deploy.yaml

@@ -0,0 +1,150 @@
+name: "01 Maintain: Build and Deploy Site"
+description: "Build and deploy the lesson site using the carpentries/workbench-docker container"
+on:
+  push:
+    branches:
+      - 'main'
+      - 'l10n_main'
+    paths-ignore:
+      - '.github/workflows/**.yaml'
+      - '.github/workbench-docker-version.txt'
+  schedule:
+    - cron: '0 0 * * 2'
+  workflow_run:
+    workflows: ["03 Maintain: Apply Package Cache"]
+    types:
+      - completed
+  workflow_dispatch:
+    inputs:
+      name:
+        description: 'Who triggered this build?'
+        required: true
+        default: 'Maintainer (via GitHub)'
+      CACHE_VERSION:
+        description: 'Optional renv cache version override'
+        required: false
+        default: ''
+      reset:
+        description: 'Reset cached markdown files'
+        required: true
+        default: false
+        type: boolean
+      force-skip-manage-deps:
+        description: 'Skip build-time dependency management'
+        required: true
+        default: false
+        type: boolean
+
+# only one build/deploy at a time
+concurrency:
+  group: docker-build-deploy
+  cancel-in-progress: true
+
+jobs:
+  preflight:
+    name: "Preflight: Schedule, Push, or PR?"
+    runs-on: ubuntu-latest
+    outputs:
+      do-build: ${{ steps.build-check.outputs.do-build }}
+      renv-needed: ${{ steps.build-check.outputs.renv-needed }}
+      renv-cache-hashsum: ${{ steps.build-check.outputs.renv-cache-hashsum }}
+      dependency-image-ref: ${{ steps.build-check.outputs.dependency-image-ref }}
+      workbench-container-file-exists: ${{ steps.wb-vers.outputs.workbench-container-file-exists }}
+      wb-vers: ${{ steps.wb-vers.outputs.container-version }}
+      last-wb-vers: ${{ steps.wb-vers.outputs.last-container-version }}
+      workbench-update: ${{ steps.wb-vers.outputs.workbench-update }}
+    env:
+      GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+    steps:
+      - name: "Should we run build and deploy?"
+        id: build-check
+        uses: carpentries/actions/build-preflight@v1
+
+      - name: "Checkout Lesson"
+        if: steps.build-check.outputs.do-build == 'true'
+        uses: actions/checkout@v6
+
+      - name: "Get container version info"
+        id: wb-vers
+        if: steps.build-check.outputs.do-build == 'true'
+        uses: carpentries/actions/container-version@v1
+        with:
+          WORKBENCH_TAG: ${{ vars.WORKBENCH_TAG }}
+          renv-needed: ${{ steps.build-check.outputs.renv-needed }}
+          token: ${{ secrets.GITHUB_TOKEN }}
+
+  full-build:
+    name: "Build Full Site"
+    runs-on: ubuntu-latest
+    needs: preflight
+    if: |
+      needs.preflight.outputs.do-build == 'true' &&
+      needs.preflight.outputs.workbench-update != 'true'
+    env:
+      RENV_EXISTS: ${{ needs.preflight.outputs.renv-needed }}
+      RENV_HASH: ${{ needs.preflight.outputs.renv-cache-hashsum }}
+    permissions:
+      checks: write
+      contents: write
+      pages: write
+    container:
+      image: ${{ needs.preflight.outputs.dependency-image-ref }}
+      env:
+        WORKBENCH_PROFILE: "ci"
+        GITHUB_PAT: ${{ secrets.GITHUB_TOKEN }}
+        RENV_PATHS_ROOT: /home/rstudio/lesson/renv
+        RENV_PROFILE: "lesson-requirements"
+        RENV_CONFIG_EXTERNAL_LIBRARIES: "/usr/local/lib/R/site-library"
+      volumes:
+        - ${{ github.workspace }}:/home/rstudio/lesson
+      options: --cpus 1
+    steps:
+      - uses: actions/checkout@v6
+
+      - name: "Debugging Info"
+        run: |
+          cd /home/rstudio/lesson
+          echo "Current Directory: $(pwd)"
+          echo "RENV_HASH is $RENV_HASH"
+          ls -lah /home/rstudio/.workbench
+          ls -lah $(pwd)
+          Rscript -e 'sessionInfo()'
+        shell: bash
+
+      - name: "Mark Repository as Safe"
+        run: |
+          git config --global --add safe.directory $(pwd)
+        shell: bash
+
+      - name: "Run Container and Build Site"
+        id: build-and-deploy
+        uses: carpentries/actions/build-and-deploy@v1
+        with:
+          reset: ${{ vars.BUILD_RESET || github.event.inputs.reset || 'false' }}
+          skip-manage-deps: ${{ github.event.inputs.force-skip-manage-deps == 'true' || contains(needs.preflight.outputs.dependency-image-ref, '-deps:') }}
+          lang-code: ${{ vars.LANG_CODE || '' }}
+
+  update-container-version:
+    name: "Update container version used"
+    runs-on: ubuntu-latest
+    needs: [preflight]
+    permissions:
+      actions: write
+      contents: write
+      pull-requests: write
+      id-token: write
+    if: |
+      needs.preflight.outputs.do-build == 'true' &&
+      (
+        needs.preflight.outputs.workbench-container-file-exists == 'false' ||
+        needs.preflight.outputs.workbench-update == 'true'
+      )
+    steps:
+      - name: "Record container version used"
+        uses: carpentries/actions/record-container-version@v1
+        with:
+          CONTAINER_VER: ${{ needs.preflight.outputs.wb-vers }}
+          AUTO_MERGE: ${{ vars.AUTO_MERGE_CONTAINER_VERSION_UPDATE || 'true' }}
+          token: ${{ secrets.GITHUB_TOKEN }}
+          role-to-assume: ${{ secrets.AWS_GH_OIDC_ARN }}
+          aws-region: ${{ secrets.AWS_GH_OIDC_REGION }}

.github/workflows/docker_pr_receive.yaml

@@ -0,0 +1,221 @@
+name: "Bot: Receive Pull Request"
+description: "Receive a pull request and build the markdown source files"
+on:
+  pull_request:
+    types:
+      [opened, synchronize, reopened]
+  workflow_dispatch:
+    inputs:
+      pr_number:
+        type: number
+        required: true
+
+concurrency:
+  group: ${{ github.ref }}
+  cancel-in-progress: true
+
+permissions:
+  contents: read
+  pull-requests: write
+
+jobs:
+  preflight:
+    name: "Preflight: md-outputs exists?"
+    runs-on: ubuntu-latest
+    outputs:
+      branch-exists: ${{ steps.check.outputs.exists }}
+    steps:
+      - name: "Checkout Lesson"
+        uses: actions/checkout@v6
+
+      - name: "Check if md-outputs branch exists"
+        id: check
+        run: |
+          # 💡 Checking for md-outputs branch #
+          if [[ -n $(git ls-remote --exit-code --heads origin md-outputs) ]]; then
+            echo "exists=true" >> $GITHUB_OUTPUT
+          else
+            echo "exists=false" >> $GITHUB_OUTPUT
+            echo "::error::md-outputs branch required but does not exist."
+            echo "::error::Please merge any open package update PRs to trigger the '03 Maintain: Apply Package Cache' and '01: Maintain: Build and Deploy Site' workflows."
+
+            echo "## ❌ ERROR: md-outputs branch required" >> $GITHUB_STEP_SUMMARY
+            echo "Please merge any open package update PRs to trigger the '03 Maintain: Apply Package Cache' and '01: Maintain: Build and Deploy Site' workflows." >> $GITHUB_STEP_SUMMARY
+
+            exit 1
+          fi
+        shell: bash
+
+  test-pr:
+    name: "Record PR number"
+    if: |
+      github.event.action != 'closed' &&
+      needs.preflight.outputs.branch-exists == 'true'
+    runs-on: ubuntu-latest
+    needs: preflight
+    outputs:
+      is_valid: ${{ steps.check-pr.outputs.VALID }}
+      pr_number: ${{ env.NR }}
+      pr_branch: ${{ env.PR_BRANCH }}
+    steps:
+      - name: "Grab PR"
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        run: |
+          if [[ "${{ github.event_name }}" == "pull_request" ]] ; then
+            PR_NUMBER=${{ github.event.number }}
+          elif [[ "${{ github.event_name }}" == "workflow_dispatch" ]] ; then
+            PR_NUMBER=${{ inputs.pr_number }}
+          fi
+
+          echo $PR_NUMBER > ${{ github.workspace }}/NR
+          echo "NR=$PR_NUMBER" >> $GITHUB_ENV
+          echo "PR_BRANCH=$(gh -R ${{ github.repository }} pr view $PR_NUMBER --json headRefName --jq '.headRefName')" >> $GITHUB_ENV
+        shell: bash
+
+      - name: "Upload PR number"
+        id: upload
+        if: always()
+        uses: actions/upload-artifact@v7
+        with:
+          name: pr
+          path: ${{ github.workspace }}/NR
+
+      - name: "Get Invalid Hashes File"
+        id: hash
+        run: |
+          echo "json<<EOF
+          $(curl -sL https://files.carpentries.org/invalid-hashes.json)
+          EOF" >> $GITHUB_OUTPUT
+        shell: bash
+
+      - name: "Debug Hashes Output"
+        run: |
+          echo "${{ steps.hash.outputs.json }}"
+        shell: bash
+
+      - name: "Check PR"
+        id: check-pr
+        uses: carpentries/actions/check-valid-pr@v1
+        with:
+          pr: ${{ env.NR }}
+          invalid: ${{ fromJSON(steps.hash.outputs.json)[github.repository] }}
+
+  check-renv:
+    name: "Check If We Need {renv}"
+    runs-on: ubuntu-latest
+    outputs:
+      renv-needed: ${{ steps.renv-check.outputs.renv-needed }}
+      renv-cache-hashsum: ${{ steps.renv-check.outputs.renv-cache-hashsum }}
+      dependency-image-ref: ${{ steps.renv-check.outputs.dependency-image-ref }}
+    steps:
+      - name: "Checkout Lesson"
+        uses: actions/checkout@v6
+
+      - name: "Is renv required?"
+        id: renv-check
+        uses: carpentries/actions/renv-checks@v1
+        with:
+          CACHE_VERSION: ${{ inputs.CACHE_VERSION || '' }}
+          skip-cache-check: true
+
+  build-md-source:
+    name: "Build markdown source files if valid"
+    needs:
+      - test-pr
+      - check-renv
+    runs-on: ubuntu-latest
+    if: needs.test-pr.outputs.is_valid == 'true'
+    env:
+      CHIVE: ${{ github.workspace }}/site/chive
+      PR: ${{ github.workspace }}/site/pr
+      GHWMD: ${{ github.workspace }}/site/built
+      PR_BRANCH: ${{ needs.test-pr.outputs.pr_branch }}
+      PR_NUMBER: ${{ needs.test-pr.outputs.pr_number }}
+    permissions:
+      contents: read
+    container:
+      image: ${{ needs.check-renv.outputs.dependency-image-ref }}
+      env:
+        WORKBENCH_PROFILE: "ci"
+        GITHUB_PAT: ${{ secrets.GITHUB_TOKEN }}
+        GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        RENV_PATHS_ROOT: /home/rstudio/lesson/renv
+        RENV_PROFILE: "lesson-requirements"
+        RENV_CONFIG_EXTERNAL_LIBRARIES: "/usr/local/lib/R/site-library"
+      volumes:
+        - ${{ github.workspace }}:/home/rstudio/lesson
+      options: --cpus 2
+    outputs:
+      build-site: ${{ steps.build-site.outcome }}
+    steps:
+      - uses: actions/checkout@v6
+
+      - name: "Check Out Staging Branch"
+        uses: actions/checkout@v6
+        with:
+          ref: md-outputs
+          path: ${{ env.GHWMD }}
+
+      - name: Mark Repository as Safe
+        run: |
+          git config --global --add safe.directory $(pwd)
+          git config --global --add safe.directory /home/rstudio/lesson
+        shell: bash
+
+      - name: "Ensure sandpaper is loadable"
+        run: |
+          .libPaths()
+          library(sandpaper)
+        shell: Rscript {0}
+
+      - name: Setup Lesson Dependencies
+        run: |
+          Rscript /home/rstudio/.workbench/setup_lesson_deps.R
+        shell: bash
+
+      - name: "Validate and Build Markdown"
+        id: build-site
+        run: |
+          sandpaper::package_cache_trigger(TRUE)
+          sandpaper::validate_lesson(path = '/home/rstudio/lesson')
+          sandpaper:::build_markdown(path = '/home/rstudio/lesson', quiet = FALSE)
+        shell: Rscript {0}
+
+      - name: "Generate Artifacts"
+        id: generate-artifacts
+        run: |
+          sandpaper:::ci_bundle_pr_artifacts(
+            repo         = '${{ github.repository }}',
+            pr_number    = '${{ env.PR_NUMBER }}',
+            path_md      = '/home/rstudio/lesson/site/built',
+            path_pr      = '/home/rstudio/lesson/site/pr',
+            path_archive = '/home/rstudio/lesson/site/chive',
+            branch       = 'md-outputs'
+          )
+        shell: Rscript {0}
+
+      - name: "Upload PR"
+        uses: actions/upload-artifact@v7
+        with:
+          name: pr
+          path: ${{ env.PR }}
+          overwrite: true
+
+      - name: "Upload Diff"
+        uses: actions/upload-artifact@v7
+        with:
+          name: diff
+          path: ${{ env.CHIVE }}
+          retention-days: 1
+
+      - name: "Upload Build"
+        uses: actions/upload-artifact@v7
+        with:
+          name: built
+          path: ${{ env.GHWMD }}
+          retention-days: 1
+
+      - name: "Teardown"
+        run: sandpaper::reset_site()
+        shell: Rscript {0}

.github/workflows/pr-close-signal.yaml

@@ -16,7 +16,7 @@ jobs:
           mkdir -p ./pr
           printf ${{ github.event.number }} > ./pr/NUM
       - name: Upload Diff
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v7
         with:
           name: pr
           path: ./pr