ask users to install suggested packages

Author: maRce10

.github/workflows/pkgcheck.yaml

@@ -22,24 +22,22 @@ jobs:
       R_KEEP_PKG_SOURCE: yes
       xc_api_key: ${{ secrets.XENO_CANTO_API_KEY }}
     steps:
-      - uses: actions/checkout@v4
-
-      # pkgcheck-action runs as a Docker container action, whose $HOME
-      # (typically /github/home) does not necessarily match the runner
-      # host's $HOME -- so a `git config --global --add safe.directory`
-      # step here is not guaranteed to be visible inside that container.
-      # Worse, libgit2 (which the R packages pkgcheck relies on for git
-      # operations use under the hood) does NOT support the
-      # GIT_CONFIG_COUNT/GIT_CONFIG_KEY_n/GIT_CONFIG_VALUE_n environment
-      # variable mechanism at all -- that is a git-CLI-only feature
-      # (added in git 2.31); libgit2 only reads actual config files.
+      # pkgcheck-action is a composite action that runs its own internal
+      # actions/checkout@v4 step, sharing this job's normal runner $HOME
+      # (it is NOT a Docker container action, so no container/$HOME
+      # mismatch is involved here). actions/checkout@v4's own
+      # safe.directory handling is scoped only to itself (it temporarily
+      # overrides $HOME while making that config change), so it does not
+      # persist for later steps -- specifically the R-level git operations
+      # pkgcheck performs afterwards via git2r/gert (which wrap libgit2),
+      # which then hit the "dubious ownership" check (CVE-2022-24765)
+      # under the job's real, persistent $HOME.
       #
-      # The container-agnostic fix is to change the checked-out repo's
-      # ownership to match what the container will run as (root, for
-      # most Docker container actions), sidestepping the "dubious
-      # ownership" check (CVE-2022-24765) entirely rather than trying to
-      # whitelist around it via config.
-      - name: Fix repo ownership for Docker container action
-        run: sudo chown -R root:root "$GITHUB_WORKSPACE"
+      # NOTE: do NOT `chown` the checkout to root here -- the job itself
+      # runs as the normal non-root runner user, so doing that makes the
+      # checkout unwritable to the job itself (this was tried and caused
+      # EACCES permission errors instead).
+      - name: Mark workspace as a safe git directory
+        run: git config --global --add safe.directory "$GITHUB_WORKSPACE"
 
       - uses: ropensci-review-tools/pkgcheck-action@main

R/access_wikiaves.R

@@ -79,7 +79,12 @@
 #' are listed under Suggests rather than Imports since this workflow is
 #' only needed for the WikiAves data source and depends on a local Chrome-
 #' or Chromium-based browser installation and a usable display (e.g. the
-#' `DISPLAY` environment variable on Linux).
+#' `DISPLAY` environment variable on Linux). If either package is missing,
+#' in an interactive session the function asks for permission before
+#' installing them via `install.packages()`; declining stops the function
+#' with instructions to install manually. In a non-interactive session
+#' (e.g. within `R CMD check`, CI, or `Rscript`), the function cannot
+#' prompt and instead stops immediately with the same instructions.
 #'
 #' **Browser auto-detection.** When `chrome_bin = NULL` (the default), the
 #' function first checks whether the **chromote** package happens to be
@@ -202,15 +207,65 @@ access_wikiaves <- function(
     return(invisible(NULL))
   }
 
-  if (
-    !requireNamespace("websocket", quietly = TRUE) ||
-      !requireNamespace("later", quietly = TRUE)
-  ) {
-    stop(
-      "Packages 'websocket' and 'later' are required for this function. ",
-      "Install them with: install.packages(c('websocket', 'later'))",
-      call. = FALSE
+  ## check for required optional packages, offering to install them
+  ## interactively rather than just stopping
+  required_pkgs <- c("websocket", "later")
+  missing_pkgs <- required_pkgs[
+    !vapply(required_pkgs, requireNamespace, logical(1), quietly = TRUE)
+  ]
+
+  if (length(missing_pkgs) > 0) {
+    install_cmd <- paste0(
+      "install.packages(c(",
+      paste(sprintf('"%s"', missing_pkgs), collapse = ", "),
+      "))"
     )
+
+    if (interactive()) {
+      ans <- utils::menu(
+        choices = c("Yes", "No"),
+        title = paste0(
+          "The following package(s) are required but not installed: ",
+          paste(missing_pkgs, collapse = ", "),
+          ".\nInstall them now?"
+        )
+      )
+
+      if (ans == 1) {
+        utils::install.packages(missing_pkgs)
+
+        # re-check in case installation failed silently for any of them
+        still_missing <- missing_pkgs[
+          !vapply(missing_pkgs, requireNamespace, logical(1), quietly = TRUE)
+        ]
+
+        if (length(still_missing) > 0) {
+          stop(
+            "Failed to install: ",
+            paste(still_missing, collapse = ", "),
+            ". Please install manually with:\n  ",
+            install_cmd,
+            call. = FALSE
+          )
+        }
+      } else {
+        stop(
+          "Cannot proceed without required package(s). Install them with:\n  ",
+          install_cmd,
+          call. = FALSE
+        )
+      }
+    } else {
+      # non-interactive sessions (CI, R CMD check, Rscript, etc.) cannot
+      # be prompted, so fail immediately with clear instructions instead
+      stop(
+        "Package(s) '",
+        paste(missing_pkgs, collapse = "', '"),
+        "' are required for this function. Install them with:\n  ",
+        install_cmd,
+        call. = FALSE
+      )
+    }
   }
 
   os_type <- .Platform$OS.type # "windows" or "unix"