CI: resolve the environment fresh weekly, and test pull requests

.github/dependabot.yml

@@ -0,0 +1,28 @@
+version: 2
+
+# Why this exists: the workflow's actions had drifted three majors behind - `actions/checkout` sat
+# on v4 while v7 was current - and nobody noticed until GitHub started warning that the Node 20
+# runtime those versions target is being force-migrated to Node 24. Pinning without a bump
+# mechanism only postpones that discovery to the day the fallback disappears.
+#
+# Deliberately limited to `github-actions`. The Docker ecosystem is *not* enabled: the App
+# `Dockerfile` pulls its base from a private GitLab registry that Dependabot cannot authenticate
+# against, so enabling it would produce recurring failures rather than updates. The base tag in
+# `test/Dockerfile` is pinned on purpose (see the comment there) and is reviewed by hand.
+updates:
+  - package-ecosystem: github-actions
+    directory: /
+    schedule:
+      interval: weekly
+      day: monday
+      # just after the weekly fresh-resolution run at 04:17 UTC, so all CI housekeeping for the
+      # week surfaces in one place instead of trickling in on random days
+      time: '04:30'
+      timezone: Etc/UTC
+    # one pull request for all action bumps, not one per action - each PR costs a full CI run
+    groups:
+      actions:
+        patterns:
+          - '*'
+    commit-message:
+      prefix: ci

.github/workflows/test.yml

@@ -1,26 +1,59 @@
 name: test
 
-on: [push]
+on:
+  push:
+    branches: [main]
+  pull_request:
+  schedule:
+    # Mondays, 04:17 UTC. Off the hour on purpose: GitHub's scheduler is congested at :00 and
+    # delays or silently drops runs queued there.
+    - cron: '17 4 * * 1'
+  # so a fresh resolution can be checked after a suspected break, instead of waiting for Monday
+  workflow_dispatch:
+
+# `true` exactly for the runs that must resolve the conda environment from scratch.
+# `test/Dockerfile` resolves the environment in its own layer - correctly, it is what keeps a
+# source-only change cheap - but since v2.2.0 that environment is deliberately open: only `pandas`
+# carries a floor and a ceiling. So a cached layer lets this suite report green against a
+# resolution nobody has re-checked, and nothing evicts it on its own, because every push's
+# `cache-from` resets GitHub's seven-day idle timer.
+env:
+  FRESH: ${{ github.event_name == 'schedule' || github.event_name == 'workflow_dispatch' }}
 
 jobs:
   test:
     name: Unit tests
     runs-on: ubuntu-latest
     permissions:
       contents: read
+    # GitHub's default is 360 minutes. That was harmless while every run was a cache hit and
+    # finished in seconds, but the weekly run now resolves conda for real - and a solver that
+    # hangs would otherwise burn six hours of runner time, once a week, unattended.
+    timeout-minutes: 30
 
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@v7
 
       - name: Setup Docker buildx
-        uses: docker/setup-buildx-action@v3
+        uses: docker/setup-buildx-action@v4
 
       - name: Test via build
-        uses: docker/build-push-action@v6
+        uses: docker/build-push-action@v7
         with:
           context: .
           file: ./test/Dockerfile
           push: false
-          cache-from: type=gha
-          cache-to: type=gha,mode=max
+          # `no-cache` alone ought to outrank an imported cache, but that precedence is documented
+          # nowhere, and it is the one assumption this whole guard rests on - so the fresh runs
+          # drop `cache-from` as well and the question stops mattering.
+          no-cache: ${{ env.FRESH == 'true' }}
+          # Do NOT "simplify" this to `env.FRESH == 'true' && '' || 'type=gha'`. `''` is falsy in
+          # GitHub expressions, so the `||` branch would always win and both paths would quietly
+          # get the cache back - reinstating the exact false green this exists to prevent.
+          cache-from: ${{ env.FRESH != 'true' && 'type=gha' || '' }}
+          # `ignore-error`: a pull request from a fork runs with a read-only token and cannot write
+          # the Actions cache, so the export 403s. Without this the run fails at the very end,
+          # after the tests have already passed. Import is unaffected - a PR may read the cache of
+          # its own branch, the base branch and the default branch - so fork PRs stay warm.
+          cache-to: type=gha,mode=max,ignore-error=true

.gitignore

@@ -359,7 +359,12 @@ vignettes/*.pdf
 .Renviron
 
 # pkgdown site
-docs/
+# `docs/*` rather than `docs/`: the rule covers *generated* pkgdown output, and this repo has no
+# pkgdown site at all - it inherits the rule from the R gitignore template. Ignoring the directory
+# itself would stop git descending into it, and the negation below could never take effect.
+docs/*
+# hand-written design docs, which are sources and belong in the repo
+!docs/superpowers/
 
 # translation temp files
 po/*~