Refactor GHA to use composite action instead of workflow

.Rbuildignore

@@ -15,6 +15,8 @@
 \.lintr$
 \.travis\.yml$
 ^.*\.Rproj$
+^.*\.db$
+^.*\.db.bz2$
 ^README\.Rmd$
 ^\.Rproj\.user$
 ^\.apt$

.github/actions/prepare-ptaxsim/action.yaml

@@ -0,0 +1,69 @@
+name: Prepare PTAXSIM database
+description: Downloads and extracts the PTAXSIM database file from S3
+inputs:
+  PTAXSIM_DB_BASE_URL:
+    required: false
+    type: string
+    default: "s3://ccao-data-public-us-east-1/ptaxsim"
+  ASSUMED_ROLE:
+    description: "AWS role used for S3"
+outputs:
+  PTAXSIM_VERSION:
+    description: "PTAXSIM database version"
+    value: ${{ steps.version_db.outputs.PTAXSIM_VERSION }}
+
+runs:
+  using: composite
+  steps:
+    - name: Checkout
+      uses: actions/checkout@v3
+
+    - name: Get database version
+      id: version_db
+      run: |
+        DESCRIPTION_PATH=$(echo "${{ github.workspace }}/DESCRIPTION" | sed 's/\\/\//g')
+        echo "PTAXSIM_VERSION=$(sed -n 's/.*Wants_DB_Version: \([0-9]*\.[0-9]*\.[0-9]\).*/\1/p' $DESCRIPTION_PATH)" >> $GITHUB_ENV
+        echo "PTAXSIM_VERSION=${{ env.PTAXSIM_VERSION }}" >> $GITHUB_OUTPUT
+      shell: bash
+
+    - name: Cache database
+      uses: actions/[email protected]
+      id: cache_db
+      with:
+        path: ptaxsim.db.bz2
+        key: ${{ format('{0}-{1}', env.PTAXSIM_VERSION, hashFiles('DESCRIPTION')) }}
+        enableCrossOsArchive: true
+
+    - name: Configure AWS credentials
+      if: steps.cache_db.outputs.cache-hit != 'true'
+      uses: aws-actions/configure-aws-credentials@v2
+      with:
+        role-to-assume: ${{ inputs.ASSUMED_ROLE }}
+        aws-region: us-east-1
+
+    - name: Fetch database file
+      id: fetch_db
+      if: steps.cache_db.outputs.cache-hit != 'true'
+      run: |
+        aws s3 cp ${{ inputs.PTAXSIM_DB_BASE_URL }}/ptaxsim-${{ env.PTAXSIM_VERSION }}.db.bz2 ${{ github.workspace }}/ptaxsim.db.bz2 --quiet
+      shell: bash
+
+    - name: Unpack database (Linux)
+      if: runner.os == 'Linux'
+      run: |
+        sudo apt-get install -y pbzip2
+        pbzip2 -dk ${{ github.workspace }}/ptaxsim.db.bz2
+      shell: bash
+
+    - name: Unpack database (macOS)
+      if: runner.os == 'macOS'
+      run: |
+        brew install pbzip2
+        pbzip2 -dk ${{ github.workspace }}/ptaxsim.db.bz2
+      shell: bash
+
+    - name: Unpack database (Windows)
+      if: runner.os == 'Windows'
+      run: |
+        7z x ${{ github.workspace }}/ptaxsim.db.bz2
+      shell: cmd

.github/workflows/R-CMD-check.yaml

@@ -6,14 +6,9 @@ on:
 name: R-CMD-check
 
 jobs:
-  prepare-ptaxsim:
-    uses: ./.github/workflows/prepare-ptaxsim.yaml
-    secrets: inherit
-
   R-CMD-check:
-    needs: prepare-ptaxsim
-    runs-on: ${{ matrix.config.os }}
     name: ${{ matrix.config.os }} (${{ matrix.config.r }})
+    runs-on: ${{ matrix.config.os }}
     strategy:
       fail-fast: false
       matrix:
@@ -26,6 +21,12 @@ jobs:
     env:
       PTAXSIM_DB_PATH: ${{ github.workspace }}/ptaxsim.db
       R_KEEP_PKG_SOURCE: yes
+
+    # Required for OIDC access to S3
+    permissions:
+      id-token: write
+      contents: read
+
     steps:
       - name: Checkout
         uses: actions/checkout@v3
@@ -46,32 +47,10 @@ jobs:
           extra-packages: any::rcmdcheck
           needs: check
 
-      - name: Restore database cache
-        uses: actions/cache/[email protected]
+      - name: Prepare PTAXSIM database
+        uses: ./.github/actions/prepare-ptaxsim
         with:
-          path: ptaxsim.db.bz2
-          key: ${{ format('{0}-{1}', needs.prepare-ptaxsim.outputs.PTAXSIM_VERSION, hashFiles('DESCRIPTION')) }}
-          fail-on-cache-miss: true
-          enableCrossOsArchive: true
-
-      - name: Unpack database (Linux)
-        if: runner.os == 'Linux'
-        run: |
-          sudo apt-get install -y pbzip2
-          pbzip2 -d ptaxsim.db.bz2
-        shell: bash
-
-      - name: Unpack database (macOS)
-        if: runner.os == 'macOS'
-        run: |
-          brew install pbzip2
-          pbzip2 -d ptaxsim.db.bz2
-        shell: bash
-
-      - name: Unpack database (Windows)
-        if: runner.os == 'Windows'
-        run: 7z x ptaxsim.db.bz2
-        shell: cmd
+          ASSUMED_ROLE: ${{ secrets.AWS_IAM_ROLE_TO_ASSUME_ARN }}
 
       - name: Check R package
         uses: r-lib/actions/check-r-package@v2

.github/workflows/pkgdown.yaml

@@ -8,15 +8,16 @@ on:
 name: pkgdown
 
 jobs:
-  prepare-ptaxsim:
-    uses: ./.github/workflows/prepare-ptaxsim.yaml
-    secrets: inherit
-
   build-pkgdown-site:
-    needs: prepare-ptaxsim
     runs-on: ubuntu-latest
     env:
       PTAXSIM_DB_PATH: ${{ github.workspace }}/ptaxsim.db
+
+    # Required for OIDC access to S3
+    permissions:
+      id-token: write
+      contents: read
+
     steps:
       - name: Checkout
         uses: actions/checkout@v3
@@ -35,18 +36,10 @@ jobs:
           extra-packages: any::pkgdown, local::.
           needs: website
 
-      - name: Restore database cache
-        uses: actions/cache/restore@v3
+      - name: Prepare PTAXSIM database
+        uses: ./.github/actions/prepare-ptaxsim
         with:
-          path: ptaxsim.db.bz2
-          key: ${{ format('{0}-{1}', needs.prepare-ptaxsim.outputs.PTAXSIM_VERSION, hashFiles('DESCRIPTION')) }}
-          fail-on-cache-miss: true
-
-      - name: Unpack database
-        run: |
-          sudo apt-get install -y pbzip2
-          pbzip2 -d ptaxsim.db.bz2
-        shell: bash
+          ASSUMED_ROLE: ${{ secrets.AWS_IAM_ROLE_TO_ASSUME_ARN }}
 
       - name: Build pkgdown site
         run: pkgdown::build_site_github_pages(new_process = FALSE, install = FALSE)

.github/workflows/test-coverage.yaml

@@ -6,15 +6,16 @@ on:
 name: test-coverage
 
 jobs:
-  prepare-ptaxsim:
-    uses: ./.github/workflows/prepare-ptaxsim.yaml
-    secrets: inherit
-
   test-coverage:
-    needs: prepare-ptaxsim
     runs-on: ubuntu-latest
     env:
       PTAXSIM_DB_PATH: ${{ github.workspace }}/ptaxsim.db
+
+    # Required for OIDC access to S3
+    permissions:
+      id-token: write
+      contents: read
+
     steps:
       - name: Checkout
         uses: actions/checkout@v3
@@ -30,18 +31,10 @@ jobs:
           extra-packages: any::covr
           needs: coverage
 
-      - name: Restore database cache
-        uses: actions/cache/restore@v3
+      - name: Prepare PTAXSIM database
+        uses: ./.github/actions/prepare-ptaxsim
         with:
-          path: ptaxsim.db.bz2
-          key: ${{ format('{0}-{1}', needs.prepare-ptaxsim.outputs.PTAXSIM_VERSION, hashFiles('DESCRIPTION')) }}
-          fail-on-cache-miss: true
-
-      - name: Unpack database
-        run: |
-          sudo apt-get install -y pbzip2
-          pbzip2 -d ptaxsim.db.bz2
-        shell: bash
+          ASSUMED_ROLE: ${{ secrets.AWS_IAM_ROLE_TO_ASSUME_ARN }}
 
       - name: Test coverage
         run: |