From 87565b2ffc9a9d4afed9e4dcf9a5b5d27cecb0ed Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Sun, 26 Jul 2026 18:02:32 +0000
Subject: [PATCH 1/4] chore(deps): bump actions/checkout from 6.0.2 to 7.0.1

Bumps [actions/checkout](https://github.com/actions/checkout) from 6.0.2 to 7.0.1.
- [Release notes](https://github.com/actions/checkout/releases)
- [Changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md)
- [Commits](https://github.com/actions/checkout/compare/de0fac2e4500dabe0009e67214ff5f5447ce83dd...3d3c42e5aac5ba805825da76410c181273ba90b1)

---
updated-dependencies:
- dependency-name: actions/checkout
  dependency-version: 7.0.1
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>
---
 .github/workflows/code-quality.yml   | 2 +-
 .github/workflows/r.yml              | 2 +-
 .github/workflows/security-audit.yml | 2 +-
 3 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/.github/workflows/code-quality.yml b/.github/workflows/code-quality.yml
index e58bb33..613078f 100644
--- a/.github/workflows/code-quality.yml
+++ b/.github/workflows/code-quality.yml
@@ -20,7 +20,7 @@ jobs:
           egress-policy: audit
 
       - name: Checkout
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
 
       - name: Lint workflow YAML
         run: |
diff --git a/.github/workflows/r.yml b/.github/workflows/r.yml
index cf2e656..d75eb08 100644
--- a/.github/workflows/r.yml
+++ b/.github/workflows/r.yml
@@ -27,7 +27,7 @@ jobs:
           egress-policy: audit
 
       - name: Checkout
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
 
       - name: Set up R
         uses: r-lib/actions/setup-r@d3c5be51b12e724e68f33216ca3c148b66d5f0b6
diff --git a/.github/workflows/security-audit.yml b/.github/workflows/security-audit.yml
index b6e46e2..c826a92 100644
--- a/.github/workflows/security-audit.yml
+++ b/.github/workflows/security-audit.yml
@@ -20,7 +20,7 @@ jobs:
           egress-policy: audit
 
       - name: Checkout
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
 
       - name: Install gitleaks
         run: |

From 3798326838f5427fe6aa6e3a2e7917a7f9ea7d4f Mon Sep 17 00:00:00 2001
From: Seongho Bae <me@seonghobae.me>
Date: Wed, 12 Aug 2026 06:08:14 +0900
Subject: [PATCH 2/4] ci: rebuild R dependencies against pinned runtime

---
 .github/workflows/r.yml | 39 ++++++++++++++++++++++++++++++++++++++-
 1 file changed, 38 insertions(+), 1 deletion(-)

diff --git a/.github/workflows/r.yml b/.github/workflows/r.yml
index d75eb08..d0ab160 100644
--- a/.github/workflows/r.yml
+++ b/.github/workflows/r.yml
@@ -29,10 +29,15 @@ jobs:
       - name: Checkout
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
 
+      - name: Install build dependencies
+        run: |
+          sudo apt-get update
+          sudo apt-get install -y cmake make
+
       - name: Set up R
         uses: r-lib/actions/setup-r@d3c5be51b12e724e68f33216ca3c148b66d5f0b6
         with:
-          r-version: release
+          r-version: '4.5.3'
           use-public-rspm: true
 
       - name: Set up R package dependencies
@@ -41,6 +46,38 @@ jobs:
           extra-packages: any::rcmdcheck
           needs: check
 
+      - name: Build verified ABI-compatible R dependencies
+        shell: bash
+        run: |
+          set -euo pipefail
+
+          install_verified_source() {
+            local package="$1"
+            local version="$2"
+            local url="$3"
+            local expected_sha256="$4"
+            local archive
+            archive="$(mktemp --suffix=.tar.gz)"
+
+            curl --fail --show-error --silent --location \
+              --proto '=https' --tlsv1.2 "$url" --output "$archive"
+            printf '%s  %s\n' "$expected_sha256" "$archive" |
+              sha256sum --check --strict
+            R CMD INSTALL "$archive"
+            rm -f "$archive"
+
+            Rscript -e "stopifnot(as.character(packageVersion('$package')) == '$version'); cat(normalizePath(find.package('$package')), '\n')"
+          }
+
+          install_verified_source \
+            RcppParallel 6.2.0 \
+            https://cran.r-project.org/src/contrib/RcppParallel_6.2.0.tar.gz \
+            3b6eaf73a696059552186292c79233916267f8e2b5c9a309519391d16c5a8bbe
+          install_verified_source \
+            qs2 0.2.2 \
+            https://cran.r-project.org/src/contrib/qs2_0.2.2.tar.gz \
+            c59ff879e858aef0afb13de25127239624e65b20179c8631fa1f62edea25f48f
+
       - name: Run R CMD check
         uses: r-lib/actions/check-r-package@6f6e5bc62fba3a704f74e7ad7ef7676c5c6a2590
         with:

From 4b9296ad4187094f75a1a10f3a876ae8cafb6186 Mon Sep 17 00:00:00 2001
From: Seongho Bae <me@seonghobae.me>
Date: Wed, 12 Aug 2026 06:20:43 +0900
Subject: [PATCH 3/4] ci: satisfy workflow line-length gate

---
 .github/workflows/r.yml | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/.github/workflows/r.yml b/.github/workflows/r.yml
index d0ab160..82a5a44 100644
--- a/.github/workflows/r.yml
+++ b/.github/workflows/r.yml
@@ -66,7 +66,8 @@ jobs:
             R CMD INSTALL "$archive"
             rm -f "$archive"
 
-            Rscript -e "stopifnot(as.character(packageVersion('$package')) == '$version'); cat(normalizePath(find.package('$package')), '\n')"
+            Rscript -e \
+              "stopifnot(as.character(packageVersion('$package')) == '$version'); cat(normalizePath(find.package('$package')), '\n')"
           }
 
           install_verified_source \

From 5bdae48079183edfeecdf46f420a9fe846c88c82 Mon Sep 17 00:00:00 2001
From: Seongho Bae <me@seonghobae.me>
Date: Fri, 14 Aug 2026 17:29:03 +0900
Subject: [PATCH 4/4] chore(ci): keep checkout update independent of ABI repair

---
 .github/workflows/r.yml | 40 +---------------------------------------
 1 file changed, 1 insertion(+), 39 deletions(-)

diff --git a/.github/workflows/r.yml b/.github/workflows/r.yml
index 82a5a44..d75eb08 100644
--- a/.github/workflows/r.yml
+++ b/.github/workflows/r.yml
@@ -29,15 +29,10 @@ jobs:
       - name: Checkout
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1
 
-      - name: Install build dependencies
-        run: |
-          sudo apt-get update
-          sudo apt-get install -y cmake make
-
       - name: Set up R
         uses: r-lib/actions/setup-r@d3c5be51b12e724e68f33216ca3c148b66d5f0b6
         with:
-          r-version: '4.5.3'
+          r-version: release
           use-public-rspm: true
 
       - name: Set up R package dependencies
@@ -46,39 +41,6 @@ jobs:
           extra-packages: any::rcmdcheck
           needs: check
 
-      - name: Build verified ABI-compatible R dependencies
-        shell: bash
-        run: |
-          set -euo pipefail
-
-          install_verified_source() {
-            local package="$1"
-            local version="$2"
-            local url="$3"
-            local expected_sha256="$4"
-            local archive
-            archive="$(mktemp --suffix=.tar.gz)"
-
-            curl --fail --show-error --silent --location \
-              --proto '=https' --tlsv1.2 "$url" --output "$archive"
-            printf '%s  %s\n' "$expected_sha256" "$archive" |
-              sha256sum --check --strict
-            R CMD INSTALL "$archive"
-            rm -f "$archive"
-
-            Rscript -e \
-              "stopifnot(as.character(packageVersion('$package')) == '$version'); cat(normalizePath(find.package('$package')), '\n')"
-          }
-
-          install_verified_source \
-            RcppParallel 6.2.0 \
-            https://cran.r-project.org/src/contrib/RcppParallel_6.2.0.tar.gz \
-            3b6eaf73a696059552186292c79233916267f8e2b5c9a309519391d16c5a8bbe
-          install_verified_source \
-            qs2 0.2.2 \
-            https://cran.r-project.org/src/contrib/qs2_0.2.2.tar.gz \
-            c59ff879e858aef0afb13de25127239624e65b20179c8631fa1f62edea25f48f
-
       - name: Run R CMD check
         uses: r-lib/actions/check-r-package@6f6e5bc62fba3a704f74e7ad7ef7676c5c6a2590
         with: