Upkeep 2026-05 (#680)

* `use_tidy_github_actions()`
* `use_tidy_description()`
* `use_claude_code()`
* Test upkeep

Author: hadley

.claude/CLAUDE.md

@@ -44,6 +44,9 @@ air format .
 - All new code should have an accompanying test.
 - If there are existing tests, place new tests next to similar existing tests.
 - Strive to keep your tests minimal with few comments.
+- Avoid `expect_true()` and `expect_false()` in favour of a specific expectation which will give a better failure message. A few expectations in newer releases that you might not know about are `expect_all_true()`, `expect_all_equal()`, and `expect_r6_class()`.
+- When testing errors and warnings, don't us `expect_error()` or `expect_warning()`. Instead, use `expect_snapshot(error = TRUE)` for errors and `expect_snapshot()` for warnings because these allow the user to review the full text of the output.
+- Avoid the `.package` argument to `local_mocked_bindings()`; this modifies the namespace of another package which is not good practice. Instead create a mockable version of the function in the current package. See `?local_mocked_bindings` for more details.
 
 ### Documentation
 

.claude/settings.json

@@ -1,6 +1,6 @@
 {
+  "$schema": "https://json.schemastore.org/claude-code-settings.json",
   "permissions": {
-    "$schema": "https://json.schemastore.org/claude-code-settings.json",
     "defaultMode": "acceptEdits",
     "allow": [
       "Bash(air:*)",
@@ -18,13 +18,13 @@
       "Bash(rm:*)",
       "Bash(Rscript:*)",
       "Bash(sed:*)",
-      "Skill(*)",
+      "Skill",
       "WebFetch(domain:cran.r-project.org)",
       "WebFetch(domain:github.com)",
       "WebFetch(domain:raw.githubusercontent.com)"
     ],
     "deny": [
-      "Read(.Renviron)", 
+      "Read(.Renviron)",
       "Read(.env)"
     ]
   }

.github/workflows/R-CMD-check.yaml

@@ -24,11 +24,7 @@ jobs:
       matrix:
         config:
           - {os: macos-latest,   r: 'release'}
-
           - {os: windows-latest, r: 'release'}
-          # use 4.0 or 4.1 to check with rtools40's older compiler
-          - {os: windows-latest, r: 'oldrel-4'}
-
           - {os: ubuntu-latest,  r: 'devel', http-user-agent: 'release'}
           - {os: ubuntu-latest,  r: 'release'}
           - {os: ubuntu-latest,  r: 'oldrel-1'}
@@ -41,15 +37,14 @@ jobs:
       R_KEEP_PKG_SOURCE: yes
 
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v6
 
       - uses: r-lib/actions/setup-pandoc@v2
 
       - uses: r-lib/actions/setup-r@v2
         with:
           r-version: ${{ matrix.config.r }}
           http-user-agent: ${{ matrix.config.http-user-agent }}
-          use-public-rspm: true
 
       - uses: r-lib/actions/setup-r-dependencies@v2
         with:

.github/workflows/format-suggest.yaml

@@ -0,0 +1,46 @@
+# Workflow derived from https://github.com/posit-dev/setup-air/tree/main/examples
+
+on:
+  # Using `pull_request_target` over `pull_request` for elevated `GITHUB_TOKEN`
+  # privileges, otherwise we can't set `pull-requests: write` when the pull
+  # request comes from a fork, which is our main use case (external contributors).
+  #
+  # `pull_request_target` runs in the context of the target branch (`main`, usually),
+  # rather than in the context of the pull request like `pull_request` does. Due
+  # to this, we must explicitly checkout `ref: ${{ github.event.pull_request.head.sha }}`.
+  # This is typically frowned upon by GitHub, as it exposes you to potentially running
+  # untrusted code in a context where you have elevated privileges, but they explicitly
+  # call out the use case of reformatting and committing back / commenting on the PR
+  # as a situation that should be safe (because we aren't actually running the untrusted
+  # code, we are just treating it as passive data).
+  # https://securitylab.github.com/resources/github-actions-preventing-pwn-requests/
+  pull_request_target:
+
+name: format-suggest.yaml
+
+jobs:
+  format-suggest:
+    name: format-suggest
+    runs-on: ubuntu-latest
+
+    permissions:
+      # Required to push suggestion comments to the PR
+      pull-requests: write
+
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          ref: ${{ github.event.pull_request.head.sha }}
+
+      - name: Install
+        uses: posit-dev/setup-air@v1
+
+      - name: Format
+        run: air format .
+
+      - name: Suggest
+        uses: reviewdog/action-suggester@v1
+        with:
+          level: error
+          fail_level: error
+          tool_name: air

.github/workflows/pkgdown.yaml

@@ -23,13 +23,11 @@ jobs:
     permissions:
       contents: write
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v6
 
       - uses: r-lib/actions/setup-pandoc@v2
 
       - uses: r-lib/actions/setup-r@v2
-        with:
-          use-public-rspm: true
 
       - uses: r-lib/actions/setup-r-dependencies@v2
         with:
@@ -42,7 +40,7 @@ jobs:
 
       - name: Deploy to GitHub pages 🚀
         if: github.event_name != 'pull_request'
-        uses: JamesIves/github-pages-deploy-action@v4.5.0
+        uses: JamesIves/github-pages-deploy-action@d92aa235d04922e8f08b40ce78cc5442fcfbfa2f # v4.8.0
         with:
           clean: false
           branch: gh-pages

.github/workflows/test-coverage.yaml

@@ -16,11 +16,9 @@ jobs:
       GITHUB_PAT: ${{ secrets.GITHUB_TOKEN }}
 
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v6
 
       - uses: r-lib/actions/setup-r@v2
-        with:
-          use-public-rspm: true
 
       - uses: r-lib/actions/setup-r-dependencies@v2
         with:
@@ -38,7 +36,7 @@ jobs:
           covr::to_cobertura(cov)
         shell: Rscript {0}
 
-      - uses: codecov/codecov-action@v5
+      - uses: codecov/codecov-action@57e3a136b779b570ffcdbf80b3bdc90e7fab3de2 # v6
         with:
           # Fail if error if not on PR, or if on PR and token is given
           fail_ci_if_error: ${{ github.event_name != 'pull_request' || secrets.CODECOV_TOKEN }}
@@ -56,7 +54,7 @@ jobs:
 
       - name: Upload test results
         if: failure()
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v7
         with:
           name: coverage-test-failures
           path: ${{ runner.temp }}/package

DESCRIPTION

@@ -26,10 +26,10 @@ Imports:
     jsonlite,
     lifecycle,
     methods,
+    nanoparquet (>= 0.3.1),
     prettyunits,
     rlang (>= 1.1.0),
-    tibble,
-    nanoparquet (>= 0.3.1)
+    tibble
 Suggests:
     bigrquerystorage (>= 1.2.1),
     blob,
@@ -40,16 +40,16 @@ Suggests:
     readr,
     sodium,
     testthat (>= 3.1.5),
-    wk (>= 0.3.2),
-    withr
+    withr,
+    wk (>= 0.3.2)
 LinkingTo:
     cli,
     cpp11,
     rapidjsonr
 Config/Needs/website: tidyverse/tidytemplate
 Config/testthat/edition: 3
 Config/testthat/parallel: TRUE
-Config/testthat/start-first: bq-table, dplyr
+Config/testthat/start-first: bq-table, dplyr, dbi-connection
 Encoding: UTF-8
 Roxygen: list(markdown = TRUE)
 RoxygenNote: 7.3.3

tests/testthat/_snaps/bq-download.md

@@ -15,7 +15,7 @@
 
     Code
       . <- bq_table_download(tb, api = "arrow", page_size = 1, start_index = 1,
-        max_connections = 1)
+        max_connections = 1, quiet = TRUE)
     Condition
       Warning in `bq_table_download()`:
       `page_size` is ignored when `api == "arrow"`

tests/testthat/test-bq-download.R

@@ -87,7 +87,8 @@ test_that("warns if supplying unnused arguments", {
       api = "arrow",
       page_size = 1,
       start_index = 1,
-      max_connections = 1
+      max_connections = 1,
+      quiet = TRUE
     )
   )
 })

tests/testthat/test-bq-job.R

@@ -1,4 +1,5 @@
 test_that("can control chattiness of bq_job_wait", {
+  withr::local_options(cli.progress_show_after = Inf)
   job <- bq_perform_query("SELECT 1 + 1", bq_test_project())
 
   expect_snapshot({
@@ -8,7 +9,7 @@ test_that("can control chattiness of bq_job_wait", {
 })
 
 test_that("informative errors on failure", {
-  withr::local_options(cli.progress_show_after = 10)
+  withr::local_options(cli.progress_show_after = Inf)
   ds <- bq_test_dataset()
 
   tb <- bq_test_table()