[averissimo]

Changes description

• Update deploy CI
• Use newer version of container image
• Update renv.lock files to allow for deployment

[Copilot]

One or more custom setup steps configured for this repository failed during this Copilot code review run:

Install R dependencies

Setup steps run before each review. If the review above is missing context, or no review was posted at all, the failing step above may be the cause. See the workflow run for failure details, fix your setup steps configuration, and re-request a review.

Note

You can configure setup steps for Copilot code review separately from Copilot cloud agent with a copilot-code-review.yml file. Read the docs for details.

[Copilot]

🟡 Changes recommended

The deployment workflow contains a guaranteed R failure, an unsafe privileged PR trigger, and incorrect manual-dispatch channel selection.

3 open findings

• Prevent write credentials exposure in pull request jobs · New
• Derive deployment channel correctly for direct main dispatch · New
• Define package reference inside vapply callback · New

What changed in this PR

Updates deployment CI, R dependency bootstrapping, and Cypress tooling across gallery applications.

Changes:

• Splits stable/dev deployment entry points and refreshes CI actions/container.
• Upgrades renv bootstrap files and RNA-seq Bioconductor settings.
• Upgrades Cypress to 15.21.0.

File	Description
teal-as-shiny-module/​renv/​activate.R	Upgrades renv bootstrap.
safety/​tests/​package.json	Upgrades Cypress.
safety/​renv/​activate.R	Upgrades renv bootstrap.
RNA-seq/​tests/​package.json	Upgrades Cypress.
RNA-seq/​renv/​settings.json	Updates Bioconductor and snapshot settings.
RNA-seq/​renv/​activate.R	Upgrades renv bootstrap.
python/​renv/​activate.R	Upgrades renv bootstrap.
patient-profile/​tests/​package.json	Upgrades Cypress.
patient-profile/​renv/​activate.R	Upgrades renv bootstrap.
longitudinal/​tests/​package.json	Upgrades Cypress.
longitudinal/​renv/​activate.R	Upgrades renv bootstrap.
exploratory/​tests/​package.json	Upgrades Cypress.
exploratory/​renv/​activate.R	Upgrades renv bootstrap.
efficacy/​tests/​package.json	Upgrades Cypress.
efficacy/​tests/​package-lock.json	Refreshes Cypress dependencies.
efficacy/​renv/​activate.R	Upgrades renv bootstrap.
early-dev/​renv/​activate.R	Upgrades renv bootstrap.
delayed-data/​tests/​package.json	Upgrades Cypress.
delayed-data/​renv/​activate.R	Upgrades renv bootstrap.
custom-transform/​tests/​package.json	Upgrades Cypress.
custom-transform/​tests/​package-lock.json	Refreshes Cypress dependencies.
custom-transform/​renv/​activate.R	Upgrades renv bootstrap.
basic-teal/​renv/​activate.R	Upgrades renv bootstrap.
.github/​workflows/​deploy.yml	Refactors shared testing and deployment logic.
.github/​workflows/​deploy-main.yml	Adds stable deployment entry point.
.github/​workflows/​deploy-dev.yml	Adds development deployment entry point.

Files not reviewed (3)

• custom-transform/tests/package-lock.json: Generated file
• delayed-data/tests/package-lock.json: Generated file
• efficacy/tests/package-lock.json: Generated file

🧠 Review effort: Balanced

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[llrs-roche]

I like that the GHA are reused by splitting the core part of installing the dependencies into one action. Also I like that we update renv to the latest version.

I see you updated the version of some actions. Given some past security incidents, it is recommended to pin by hash commit and add a comment about which version is that.

I tried to run the longitudinal app, as expected I had to restore but here is what I saw:

The following package(s) were not installed successfully:
- [goshawk]: error downloading 'https://api.github.com/repos/insightsengineering/goshawk/tarball/00f117185c72f15187230ea8ecd8d81391bf7d04' ['CreateProcess' failed to run 'C:\WINDOWS\SYSTEM32\curl.exe --ssl-revoke-best-effort --config "C:/Users/sanchosl/AppData/Local/Temp/RtmpERRhoS/renv-download-config-545c7eee2241"']
- [nestcolor]: failed to find binary for 'nestcolor 0.1.3' in package repositories
- [random.cdisc.data]: failed to find binary for 'random.cdisc.data 0.3.16' in package repositories
- [rlistings]: failed to find binary for 'rlistings 0.2.13' in package repositories
- [rtables.officer]: failed to find binary for 'rtables.officer 0.1.2' in package repositories
- [teal.code]: failed to find binary for 'teal.code 0.7.2' in package repositories
- [teal.data]: failed to find binary for 'teal.data 0.8.1' in package repositories
- [teal.goshawk]: error downloading 'https://api.github.com/repos/insightsengineering/teal.goshawk/tarball/1d08610cad3870a4516ef258116a4cfd754a8d3c' ['CreateProcess' failed to run 'C:\WINDOWS\SYSTEM32\curl.exe --ssl-revoke-best-effort --config "C:/Users/sanchosl/AppData/Local/Temp/RtmpERRhoS/renv-download-config-545c263167bd"']
- [teal.logger]: failed to find binary for 'teal.logger 0.4.2' in package repositories
- [teal.slice]: failed to find binary for 'teal.slice 0.8.2' in package repositories
You may need to manually download and install these packages.

Would you like to try installing the latest available versions of these packages? [y/N]: y

...

The following package(s) were not installed successfully:
- [goshawk]: failed to download
- [nestcolor]: failed to download
- [random.cdisc.data]: failed to download
- [rlistings]: failed to download
- [rtables.officer]: failed to download
- [teal.code]: failed to download
- [teal.data]: failed to download
- [teal.goshawk]: failed to download
- [teal.logger]: failed to download
- [teal.slice]: failed to download
You may need to manually download and install these packages.

One of the messages I got while updating the packages was that the github PAT was missing. Will be this a problem? I guess not but users might get that idea.

See also copilot comments as both of the remaining ones make sense for me.

Last, I see one app is failing the cypress: https://github.com/insightsengineering/teal.gallery/actions/runs/38542255424/job/115779629603?pr=298

Active module changed: app="Safety Analysis Teal Demo App", module="Line Plot"
    1) Navigates to all tabs without error


  2 passing (3m)
  1 failing

  1) app
       Navigates to all tabs without error:
     Error: Timed out waiting for Shiny to become idle

[Copilot]

One or more custom setup steps configured for this repository failed during this Copilot code review run:

Install R dependencies

Setup steps run before each review. If the review above is missing context, or no review was posted at all, the failing step above may be the cause. See the workflow run for failure details, fix your setup steps configuration, and re-request a review.

Note

You can configure setup steps for Copilot code review separately from Copilot cloud agent with a copilot-code-review.yml file. Read the docs for details.

[Copilot]

🟡 Changes recommended

The safety selectors resolve to empty choices, GitHub packages are not excluded from updates, and utility documentation exposes unsupported parameters.

3 open findings

• Read renv package records from Packages, not Package · New
• Use grepl() without unsupported value argument · New
• Remove or implement undocumented restore_and_run arguments · New

3 resolved since last review

• Define package reference inside vapply callback
• Derive deployment channel correctly for direct main dispatch
• Prevent write credentials exposure in pull request jobs

Files not reviewed (4)

• basic-teal/tests/package-lock.json: Generated file
• custom-transform/tests/package-lock.json: Generated file
• delayed-data/tests/package-lock.json: Generated file
• efficacy/tests/package-lock.json: Generated file

🧠 Review effort: Balanced

[averissimo]

@llrs-roche

I like that the GHA are reused by splitting the core part of installing the dependencies into one action. Also I like that we update renv to the latest version.

👍

I see you updated the version of some actions. Given some past security incidents, it is recommended to pin by hash commit and add a comment about which version is that.

Good idea, I'll do that on deploy-main and deploy-dev workflows.

Let's just not forget to update those as time goes by :-)

I tried to run the longitudinal app, as expected I had to restore but here is what I saw:

One of the messages I got while updating the packages was that the github PAT was missing. Will be this a problem? I guess not but users might get that idea.

I'm assuming you did the following:

restore_and_run("longitudinal", ref = "update_main")

It is working with me, but that depends on the github pat. We say it many times in the README.md, but do you want to warn as well in the function?

We get around this for most of the stable apps as it now uses CRAN versions as much as possible

See also copilot comments as both of the remaining ones make sense for me.

👍

Last, I see one app is failing the cypress: https://github.com/insightsengineering/teal.gallery/actions/runs/38542255424/job/115779629603?pr=298

No longer failling.. I had to increase the timeout 🤷

[llrs-roche]

I see this PR mixes a bit some fixes on the apps (like custom-transform, early-dev, efficacy, exploratory, longitudinal, patient-profile python and safety) and on the infrastructure. Some of the improvements remove the random dataset this is a great improvement to make it faster and use the teal.picks as expected.

• Update deploy CI
• Use newer version of container image
• Update renv.lock files to allow for deployment

I see it does all the three points above and and I don't see any major problem with the workflow.

It is working with me, but that depends on the github pat. We say it many times in the README.md, but do you want to warn as well in the function?

I don't think it is needed, just that currently the recommendation is to avoid .Renviron in favor of gitcreds and users might not have it for authentication purposes that don't use git. But that can be part of the refinement option

[llrs-roche]

Sorry, forgot to push the comments on Friday.