ci: switch to GitHub Actions

The goal is for the new setup to largely follow the Drone builds, but
there are some notable differences:

 * The Drone pipelines used custom images built to track Metworx's
   Ubuntu version and bake in many dependencies.

   The GitHub Actions use GitHub-hosted runners and test with the two
   most recent Ubuntu LTS releases.  r-lib/actions is used to install
   R and dependencies at the time of the run (with the built-in
   caching of r-lib/actions/setup-r-dependencies) and to execute 'R
   CMD check'.

 * The Drone pipelines automatically tracked the latest MPN via the
   images.  The new approach currently hard codes the MPN date.  The
   plan is to eventually avoid this by publishing the latest MPN
   version somewhere so that the workflows can query that.

 * The mpn-latest builds have been dropped.  It'd be possible to mimic
   that behavior by overriding the CRAN URL to MPN and setting a
   date-pinned RSPM.  However, the mpn-latest builds arguably don't
   provide much value, and any incompatibilities with MPN will be
   caught before release by our standard release process.  So let's
   avoid the extra complexity unless it becomes obvious the builds are
   useful.

 * 'R CMD check' is ran for the R versions matching the two most
   recent R versions on Metworx and on the latest R version.

   The new build checks against the two most recent R versions on
   Metworx and also the latest R version.

 * For a PR, the Drone setup had two builds, one triggered by the
   branch push (testing on branch tip) and another by the PR
   (testing on merge with base).

   For the new setup, there is just one build triggered by the PR.
   It's done on the merge of the PR branch and its base.

   This means that the tip of the PR branch isn't tested.  In general,
   that's fine because it's the merge is what ultimately will land.
   And for the cases where testing on the tip of the branch is useful
   (e.g., debugging a discrepancy due to a semantic merge conflict), a
   'scratch/*' branch pointing to the same spot can be pushed.

.Rbuildignore

@@ -3,8 +3,7 @@
 ^.*\.Rproj$
 ^\.Rproj\.user$
 ^LICENSE\.md$
-^.drone.yml$
-^.drone.jsonnet$
+^\.github$
 ^README\.Rmd$
 ^_pkgdown\.yml$
 ^docs$

.github/workflows/main.yaml

@@ -0,0 +1,88 @@
+name: CI
+on:
+  push:
+    branches:
+      - 'main'
+      - 'scratch/**'
+    tags:
+      - '[0-9]+.[0-9]+.[0-9]+'
+      - '[0-9]+.[0-9]+.[0-9]+.[0-9]+'
+  pull_request:
+
+env:
+  MPN: 2024-03-01
+
+jobs:
+  check:
+    runs-on: ${{ matrix.config.os }}
+    name: ${{ matrix.config.os }} (${{ matrix.config.r }})
+    strategy:
+      fail-fast: false
+      matrix:
+        config:
+          - os: ubuntu-20.04
+            r: 4.0.5
+          - os: ubuntu-20.04
+            r: 4.1.3
+          - os: ubuntu-latest
+            r: release
+    env:
+      R_KEEP_PKG_SOURCE: yes
+    steps:
+      - uses: actions/checkout@v4
+      - uses: r-lib/actions/setup-r@v2
+        with:
+          r-version: ${{ matrix.config.r }}
+          use-public-rspm: true
+          extra-repositories: 'https://mpn.metworx.com/snapshots/stable/${{ env.MPN }}'
+      - uses: r-lib/actions/setup-r-dependencies@v2
+        with:
+          extra-packages: |
+            any::pkgdown
+            any::rcmdcheck
+          upgrade: 'TRUE'
+      - uses: r-lib/actions/check-r-package@v2
+  release:
+    if: github.ref_type == 'tag'
+    name: Upload release
+    needs: check
+    runs-on: ubuntu-latest
+    permissions:
+      id-token: write
+      contents: read
+    steps:
+      - uses: actions/checkout@v4
+      - uses: r-lib/actions/setup-r@v2
+        with:
+          r-version: release
+          use-public-rspm: true
+          extra-repositories: 'https://mpn.metworx.com/snapshots/stable/${{ env.MPN }}'
+      - uses: r-lib/actions/setup-r-dependencies@v2
+        with:
+          extra-packages: any::pkgpub
+      - name: Configure Git
+        shell: bash
+        run: |
+          git config --global user.email CI
+          git config --global user.name ci@metrumrg
+      - name: Create output directory
+        shell: bash
+        run: echo "REPO_DIR=$(mktemp -d)" >>$GITHUB_ENV
+      - name: Create CRAN-like repo for release
+        run: pkgpub::create_tagged_repo("${{ env.REPO_DIR }}")
+        shell: Rscript {0}
+      - name: Configure AWS credentials
+        uses: aws-actions/configure-aws-credentials@v4
+        with:
+          role-to-assume: arn:aws:iam::906087756158:role/github-actions-mpn-s3-publish
+          aws-region: us-east-1
+      - name: 'Publish package: ${{ github.ref_name }}'
+        run: |
+          aws s3 sync \
+            '${{ env.REPO_DIR }}/${{ github.ref_name }}/' \
+            's3://mpn.metworx.dev/releases/${{ github.event.repository.name }}/${{ github.ref_name }}/'
+      - name: 'Publish package: latest_tag'
+        run: |
+          aws s3 sync \
+            '${{ env.REPO_DIR }}/${{ github.ref_name }}/' \
+            's3://mpn.metworx.dev/releases/${{ github.event.repository.name }}/latest_tag/'

README.Rmd

@@ -25,7 +25,7 @@ knitr::opts_chunk$set(
 
 <!-- badges: start -->
 
-[![Build Status](https://github-drone.metrumrg.com/api/badges/metrumresearchgroup/mpn.scorecard/status.svg)](https://github-drone.metrumrg.com/metrumresearchgroup/mpn.scorecard)
+[![Build Status](https://github.com/metrumresearchgroup/mpn.scorecard/actions/workflows/main.yaml/badge.svg)](https://github.com/metrumresearchgroup/mpn.scorecard/actions/workflows/main.yaml)
 <!-- badges: end -->
 
 `mpn.scorecard` is an R package designed to score other R packages on key attributes that help evaluate the risk of adding them to [MPN](https://mpn.metworx.com/docs/). `mpn.scorecard` leans heavily on the metrics developed by R Validation Hub's [riskmetric](https://github.com/pharmaR/riskmetric) R package, and has additional features related to the scoring and outputs. Each package is first evaluated based on code documentation, maintenance and sustainability, and transparency. Code coverage and `R CMD Check` results are then tabulated and saved out to a specified location. These metrics are summarized in a scorecard report.

README.md

@@ -9,7 +9,7 @@
 <!-- badges: start -->
 
 [![Build
-Status](https://github-drone.metrumrg.com/api/badges/metrumresearchgroup/mpn.scorecard/status.svg)](https://github-drone.metrumrg.com/metrumresearchgroup/mpn.scorecard)
+Status](https://github.com/metrumresearchgroup/mpn.scorecard/actions/workflows/main.yaml/badge.svg)](https://github.com/metrumresearchgroup/mpn.scorecard/actions/workflows/main.yaml)
 <!-- badges: end -->
 
 `mpn.scorecard` is an R package designed to score other R packages on