Weekly harvest workflow that opens a pull request

[larnsce]

Goal

.github/workflows/harvest.yaml: a weekly harvest whose output arrives as one pull request for the maintainer to merge.

Rewritten 2026-09-04 per dev/decisions-2026-09.md. Start from .github/workflows-pending/harvest.yaml on the closed PR #15 branch, minus the direct push, the registry sync and the failure issue.

Workflow

• Triggers: schedule cron 0 3 * * 1 and workflow_dispatch
• Steps: checkout main; r-lib/actions setup-r and setup-r-dependencies with needs: harvest; Rscript data-raw/harvest.R with the GitHub backend and LANG=C.UTF-8; roxygen2::roxygenise(); testthat::test_local(stop_on_failure = TRUE) as the gate; if anything under R/sysdata.rda, inst/extdata/, data-raw/packages.json, data-raw/harvest_report.md, man/ or DESCRIPTION changed, open or update a pull request on a fixed branch harvest (for example with peter-evans/create-pull-request), body from harvest_report.md
• The built-in GITHUB_TOKEN is enough. A pull request opened with it triggers no pull_request workflows, so the gate runs inside this job and R-CMD-check plus pkgdown run on main after the merge. Do not make R-CMD-check a required status on main, or the harvest PR can never merge.
• Failure surfacing: a failed run is red in the Actions tab and opens no PR. No issue automation.

Acceptance criteria

• A workflow_dispatch run opens a pull request with a bumped version and date, or reports no changes
• Merging that pull request rebuilds the site through the pkgdown workflow
• A forced gate failure (temporarily break a schema test) leaves the run red and opens no PR

[larnsce]

Premortem findings for this issue (advisory, non-blocking)

From the 2026-07-18 premortem (report in docs/ on branch claude/implementation-premortem-jd5udn):

The gate is schema tests, and schema tests assert names, types, and non-emptiness, never values. NA is a valid entry, so a run that half-parses several packages into blank DOIs and wrong tiers passes the gate, commits to main, and publishes to the site. The failure-surfacing path (auto-opened harvest-failure issues) only works if a human sees the issue; in a repo with one part-time maintainer that is not guaranteed, and the org PAT for the registry sync expires silently.

Suggestions:

• Add content-level checks to the gate: fail or at least alert on week-over-week increases in problems-tibble rows, NA rates in doi, tier, or description columns, and unexplained tier changes.
• Route harvest failures to a channel a human actually reads (an email step, or GitHub notification settings verified for the harvest-failure label), and treat a harvest-failure issue that is open more than 14 days with only bot comments as its own alarm.
• Put the PAT expiry date on a calendar, or replace the PAT with a GitHub App installation token.
• After the sync step, assert the registry repo's packages.json equals the harvester's copy; a non-empty diff for more than a week means the sync is broken.

---

Generated by Claude Code