From a8ab3970414b63487a641d9199f34f7c61865f58 Mon Sep 17 00:00:00 2001
From: Lorenz Walthert <10477073+lorenzwalthert@users.noreply.github.com>
Date: Fri, 2 Oct 2026 20:15:19 +0200
Subject: [PATCH 01/13] feat: add Linux runner to end-to-end and pin
 .pre-commit-config.yaml in dependency update

---
 .github/workflows/end-to-end.yml              | 28 ++++++++++++++++---
 .../workflows/hook-dependencies-update.yml    | 18 ++++++++++++
 .pre-commit-config.yaml                       |  2 +-
 3 files changed, 43 insertions(+), 5 deletions(-)

diff --git a/.github/workflows/end-to-end.yml b/.github/workflows/end-to-end.yml
index 586b3250e..d5f2daecb 100644
--- a/.github/workflows/end-to-end.yml
+++ b/.github/workflows/end-to-end.yml
@@ -7,7 +7,10 @@ name: end-2-end
 
 jobs:
   end-2-end:
-    runs-on: macOS-latest
+    strategy:
+      matrix:
+        os: [macOS-latest, ubuntu-latest]
+    runs-on: ${{ matrix.os }}
     env:
       GITHUB_PAT: ${{ secrets.GITHUB_TOKEN }}
     steps:
@@ -53,19 +56,36 @@ jobs:
           fs::file_delete(config_name)
           fs::file_copy(ref_config, config_name)
         shell: Rscript {0}
-      - name: Update Hook revision to current push
+      - name: Update Hook revision to current push (macOS)
+        if: runner.os == 'macOS'
         run: |
           # hacky, maybe can use pre-commit try-repo?
           # https://stackoverflow.com/questions/30871868/sed-replace-first-occurence-in-place-with-big-files
-          sed -i ''  -e "1,/rev:.*/{s/rev:.*/rev: $GITHUB_SHA/;}" .pre-commit-config.yaml
+          sed -i '' -e "1,/rev:.*/{s/rev:.*/rev: $GITHUB_SHA/;}" .pre-commit-config.yaml
           git config --local user.email "github-actions[bot]@users.noreply.github.com"
           git config --local user.name "github-actions[bot]"
           git add .
           git commit -m 'current hash must be head'
 
+      - name: Update Hook revision to current push (Linux)
+        if: runner.os == 'Linux'
+        run: |
+          sed -i -e "1,/rev:.*/{s/rev:.*/rev: $GITHUB_SHA/;}" .pre-commit-config.yaml
+          git config --local user.email "github-actions[bot]@users.noreply.github.com"
+          git config --local user.name "github-actions[bot]"
+          git add .
+          git commit -m 'current hash must be head'
+
+      - name: Install pre-commit (macOS)
+        if: runner.os == 'macOS'
+        run: brew install pre-commit
+
+      - name: Install pre-commit (Linux)
+        if: runner.os == 'Linux'
+        run: pip install pre-commit
+
       - name: Run pre-commit
         run: | 
-          brew install pre-commit
           pre-commit install --install-hooks
           
           echo 'running R/test.R'
diff --git a/.github/workflows/hook-dependencies-update.yml b/.github/workflows/hook-dependencies-update.yml
index a1209b063..255d8140f 100644
--- a/.github/workflows/hook-dependencies-update.yml
+++ b/.github/workflows/hook-dependencies-update.yml
@@ -52,6 +52,24 @@ jobs:
           ref: ${{ steps.cpr.outputs['pull-request-head-sha'] }}
           fetch-depth: 0  # good practice if you need history
 
+      - name: Update .pre-commit-config.yaml rev to PR head SHA
+        if: steps.cpr.outputs['pull-request-operation'] != 'none'
+        run: |
+          SHA="${{ steps.cpr.outputs['pull-request-head-sha'] }}"
+          sed -i '' -e "1,/rev:.*/{s/rev:.*/rev: $SHA/;}" .pre-commit-config.yaml
+
+      - name: Commit .pre-commit-config.yaml update
+        if: steps.cpr.outputs['pull-request-operation'] != 'none'
+        run: |
+          git config --local user.email "github-actions[bot]@users.noreply.github.com"
+          git config --local user.name "github-actions[bot]"
+          git add .pre-commit-config.yaml
+          git commit -m 'Pin .pre-commit-config.yaml rev to PR head SHA'
+
+      - name: Push .pre-commit-config.yaml update to PR branch
+        if: steps.cpr.outputs['pull-request-operation'] != 'none'
+        run: git push origin hook-dependencies-update
+
       - name: Push latest tag
         run: |
           Rscript -e "install.packages('desc')"
diff --git a/.pre-commit-config.yaml b/.pre-commit-config.yaml
index b38bc12e5..04e9f8730 100644
--- a/.pre-commit-config.yaml
+++ b/.pre-commit-config.yaml
@@ -2,7 +2,7 @@
 # R specific hooks: https://github.com/lorenzwalthert/precommit
 repos:
 -   repo: https://github.com/lorenzwalthert/precommit
-    rev: v0.4.3.9029
+    rev: v0.4.3.9030
     hooks: 
     -   id: style-files
         args: [--style_pkg=styler, --style_fun=tidyverse_style, --cache-root=styler-perm]

From 997417c3b6540832d7bcf548371352d8d1a5af39 Mon Sep 17 00:00:00 2001
From: Lorenz Walthert <10477073+lorenzwalthert@users.noreply.github.com>
Date: Fri, 2 Oct 2026 20:29:31 +0200
Subject: [PATCH 02/13] simplify

---
 .github/workflows/end-to-end.yml              | 18 ++++-------
 .../workflows/hook-dependencies-update.yml    | 30 +++----------------
 2 files changed, 9 insertions(+), 39 deletions(-)

diff --git a/.github/workflows/end-to-end.yml b/.github/workflows/end-to-end.yml
index d5f2daecb..c17345daf 100644
--- a/.github/workflows/end-to-end.yml
+++ b/.github/workflows/end-to-end.yml
@@ -56,21 +56,13 @@ jobs:
           fs::file_delete(config_name)
           fs::file_copy(ref_config, config_name)
         shell: Rscript {0}
-      - name: Update Hook revision to current push (macOS)
-        if: runner.os == 'macOS'
+      - name: Update Hook revision to current push
         run: |
           # hacky, maybe can use pre-commit try-repo?
           # https://stackoverflow.com/questions/30871868/sed-replace-first-occurence-in-place-with-big-files
-          sed -i '' -e "1,/rev:.*/{s/rev:.*/rev: $GITHUB_SHA/;}" .pre-commit-config.yaml
-          git config --local user.email "github-actions[bot]@users.noreply.github.com"
-          git config --local user.name "github-actions[bot]"
-          git add .
-          git commit -m 'current hash must be head'
-
-      - name: Update Hook revision to current push (Linux)
-        if: runner.os == 'Linux'
-        run: |
-          sed -i -e "1,/rev:.*/{s/rev:.*/rev: $GITHUB_SHA/;}" .pre-commit-config.yaml
+          # sed -i '' is BSD (macOS); sed -i is GNU (Linux) — use a temp file for portability
+          sed "1,/rev:.*/{s/rev:.*/rev: $GITHUB_SHA/;}" .pre-commit-config.yaml > .pre-commit-config.yaml.tmp
+          mv .pre-commit-config.yaml.tmp .pre-commit-config.yaml
           git config --local user.email "github-actions[bot]@users.noreply.github.com"
           git config --local user.name "github-actions[bot]"
           git add .
@@ -82,7 +74,7 @@ jobs:
 
       - name: Install pre-commit (Linux)
         if: runner.os == 'Linux'
-        run: pip install pre-commit
+        run: pipx install pre-commit
 
       - name: Run pre-commit
         run: | 
diff --git a/.github/workflows/hook-dependencies-update.yml b/.github/workflows/hook-dependencies-update.yml
index 255d8140f..051875146 100644
--- a/.github/workflows/hook-dependencies-update.yml
+++ b/.github/workflows/hook-dependencies-update.yml
@@ -30,7 +30,10 @@ jobs:
           brew install pipx
           pipx install pre-commit
       - name: auto-release
-        run: Rscript -e 'source("renv/activate.R"); renv::restore(); renv::install("."); precommit:::auto_release()' 
+        run: Rscript -e 'source("renv/activate.R"); renv::restore(); renv::install("."); precommit:::auto_release()'
+      - name: Pin .pre-commit-config.yaml rev to current SHA
+        run: |
+          sed -i '' -e "1,/rev:.*/{s/rev:.*/rev: $GITHUB_SHA/;}" .pre-commit-config.yaml
       - name: Create Pull Request
         id: cpr
         uses: peter-evans/create-pull-request@v8.1.1
@@ -45,31 +48,6 @@ jobs:
             This PR updates the hook dependencies in `renv.lock`, auto-generated by [create-pull-request][1]. Close and re-open this to trigger `on: pull_request` events to circumvent [limitation of GitHub actions](https://github.com/peter-evans/create-pull-request/blob/master/docs/concepts-guidelines.md#push-pull-request-branches-to-a-fork).
 
             [1]: https://github.com/peter-evans/create-pull-request
-      - name: Checkout PR head SHA
-        if: steps.cpr.outputs['pull-request-operation'] != 'none'
-        uses: actions/checkout@v7
-        with:
-          ref: ${{ steps.cpr.outputs['pull-request-head-sha'] }}
-          fetch-depth: 0  # good practice if you need history
-
-      - name: Update .pre-commit-config.yaml rev to PR head SHA
-        if: steps.cpr.outputs['pull-request-operation'] != 'none'
-        run: |
-          SHA="${{ steps.cpr.outputs['pull-request-head-sha'] }}"
-          sed -i '' -e "1,/rev:.*/{s/rev:.*/rev: $SHA/;}" .pre-commit-config.yaml
-
-      - name: Commit .pre-commit-config.yaml update
-        if: steps.cpr.outputs['pull-request-operation'] != 'none'
-        run: |
-          git config --local user.email "github-actions[bot]@users.noreply.github.com"
-          git config --local user.name "github-actions[bot]"
-          git add .pre-commit-config.yaml
-          git commit -m 'Pin .pre-commit-config.yaml rev to PR head SHA'
-
-      - name: Push .pre-commit-config.yaml update to PR branch
-        if: steps.cpr.outputs['pull-request-operation'] != 'none'
-        run: git push origin hook-dependencies-update
-
       - name: Push latest tag
         run: |
           Rscript -e "install.packages('desc')"

From 1a88ef7de9ed69f780c2bd704127dc12e2a480e4 Mon Sep 17 00:00:00 2001
From: Lorenz Walthert <10477073+lorenzwalthert@users.noreply.github.com>
Date: Fri, 2 Oct 2026 20:37:07 +0200
Subject: [PATCH 03/13] revert: removal of the dependency of cpr

---
 .github/workflows/hook-dependencies-update.yml | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/.github/workflows/hook-dependencies-update.yml b/.github/workflows/hook-dependencies-update.yml
index 051875146..de6e1167f 100644
--- a/.github/workflows/hook-dependencies-update.yml
+++ b/.github/workflows/hook-dependencies-update.yml
@@ -48,6 +48,12 @@ jobs:
             This PR updates the hook dependencies in `renv.lock`, auto-generated by [create-pull-request][1]. Close and re-open this to trigger `on: pull_request` events to circumvent [limitation of GitHub actions](https://github.com/peter-evans/create-pull-request/blob/master/docs/concepts-guidelines.md#push-pull-request-branches-to-a-fork).
 
             [1]: https://github.com/peter-evans/create-pull-request
+      - name: Checkout PR head SHA
+        if: steps.cpr.outputs['pull-request-operation'] != 'none'
+        uses: actions/checkout@v4
+        with:
+          ref: ${{ steps.cpr.outputs['pull-request-head-sha'] }}
+          fetch-depth: 0  # good practice if you need history
       - name: Push latest tag
         run: |
           Rscript -e "install.packages('desc')"

From 4fd92daee6e2997e92ff48e240724129f751bdfa Mon Sep 17 00:00:00 2001
From: Lorenz Walthert <10477073+lorenzwalthert@users.noreply.github.com>
Date: Sat, 3 Oct 2026 19:32:53 +0200
Subject: [PATCH 04/13] fix: only replace line for one repo instead all revs

---
 .github/workflows/hook-dependencies-update.yml | 14 +++++++++++++-
 1 file changed, 13 insertions(+), 1 deletion(-)

diff --git a/.github/workflows/hook-dependencies-update.yml b/.github/workflows/hook-dependencies-update.yml
index de6e1167f..5598a6f55 100644
--- a/.github/workflows/hook-dependencies-update.yml
+++ b/.github/workflows/hook-dependencies-update.yml
@@ -33,7 +33,19 @@ jobs:
         run: Rscript -e 'source("renv/activate.R"); renv::restore(); renv::install("."); precommit:::auto_release()'
       - name: Pin .pre-commit-config.yaml rev to current SHA
         run: |
-          sed -i '' -e "1,/rev:.*/{s/rev:.*/rev: $GITHUB_SHA/;}" .pre-commit-config.yaml
+          f=.pre-commit-config.yaml
+
+          sed -i.bak '\#repo: https://github.com/lorenzwalthert/precommit$#,/rev:/ s/\(rev: \).*/\1'"$GITHUB_SHA"'/' "$f"
+
+          stat=$(git diff --no-index --numstat "$f.bak" "$f" || true)
+
+          if echo "$stat" | awk '{ exit !($1 == 1 && $2 == 1) }'; then
+            rm "$f.bak"
+          else
+            echo "Expected exactly one changed line, got:" >&2
+            git diff --no-index --unified=0 "$f.bak" "$f" >&2 || true
+            exit 1
+          fi
       - name: Create Pull Request
         id: cpr
         uses: peter-evans/create-pull-request@v8.1.1

From 41eca20068b08eeb6d32c10c5675969ac2d6ef12 Mon Sep 17 00:00:00 2001
From: Lorenz Walthert <10477073+lorenzwalthert@users.noreply.github.com>
Date: Sat, 3 Oct 2026 19:51:35 +0200
Subject: [PATCH 05/13] feat: need two commits

---
 .../workflows/hook-dependencies-update.yml    | 50 +++++++++++++++----
 1 file changed, 39 insertions(+), 11 deletions(-)

diff --git a/.github/workflows/hook-dependencies-update.yml b/.github/workflows/hook-dependencies-update.yml
index 5598a6f55..a73e3d8aa 100644
--- a/.github/workflows/hook-dependencies-update.yml
+++ b/.github/workflows/hook-dependencies-update.yml
@@ -14,6 +14,13 @@ jobs:
     steps:
       - uses: actions/checkout@v7
 
+      - name: Configure git identity and record starting commit
+        id: start
+        run: |
+          git config user.name "github-actions[bot]"
+          git config user.email "41898282+github-actions[bot]@users.noreply.github.com"
+          echo "sha=$(git rev-parse HEAD)" >> "$GITHUB_OUTPUT"
+
       - uses: r-lib/actions/setup-r@v2
         with:
           use-public-rspm: true
@@ -31,11 +38,32 @@ jobs:
           pipx install pre-commit
       - name: auto-release
         run: Rscript -e 'source("renv/activate.R"); renv::restore(); renv::install("."); precommit:::auto_release()'
-      - name: Pin .pre-commit-config.yaml rev to current SHA
+
+      - name: Commit dependency updates (commit A)
+        id: deps
+        env:
+          START_SHA: ${{ steps.start.outputs.sha }}
+        run: |
+          git add -A
+          if ! git diff --cached --quiet; then
+            git commit -m "Update renv dependencies"
+          fi
+          head_sha=$(git rev-parse HEAD)
+          if [ "$head_sha" = "$START_SHA" ]; then
+            echo "changed=false" >> "$GITHUB_OUTPUT"
+          else
+            echo "changed=true" >> "$GITHUB_OUTPUT"
+            echo "sha=$head_sha" >> "$GITHUB_OUTPUT"
+          fi
+
+      - name: Pin .pre-commit-config.yaml rev to commit A (commit B)
+        if: steps.deps.outputs.changed == 'true'
+        env:
+          SHA: ${{ steps.deps.outputs.sha }}
         run: |
           f=.pre-commit-config.yaml
 
-          sed -i.bak '\#repo: https://github.com/lorenzwalthert/precommit$#,/rev:/ s/\(rev: \).*/\1'"$GITHUB_SHA"'/' "$f"
+          sed -i.bak '\#repo: https://github.com/lorenzwalthert/precommit$#,/rev:/ s/\(rev: \).*/\1'"$SHA"'/' "$f"
 
           stat=$(git diff --no-index --numstat "$f.bak" "$f" || true)
 
@@ -46,12 +74,14 @@ jobs:
             git diff --no-index --unified=0 "$f.bak" "$f" >&2 || true
             exit 1
           fi
+          git commit -am "Pin hooks rev to ${SHA::7}"
+
       - name: Create Pull Request
+        if: steps.deps.outputs.changed == 'true'
         id: cpr
         uses: peter-evans/create-pull-request@v8.1.1
         with:
           token: ${{ secrets.PRECOMMIT_HOOK_DEPENDENCY_UPDATE }}
-          commit-message: Update renv dependencies
           branch: hook-dependencies-update
           delete-branch: true
           assignees: lorenzwalthert
@@ -60,15 +90,13 @@ jobs:
             This PR updates the hook dependencies in `renv.lock`, auto-generated by [create-pull-request][1]. Close and re-open this to trigger `on: pull_request` events to circumvent [limitation of GitHub actions](https://github.com/peter-evans/create-pull-request/blob/master/docs/concepts-guidelines.md#push-pull-request-branches-to-a-fork).
 
             [1]: https://github.com/peter-evans/create-pull-request
-      - name: Checkout PR head SHA
-        if: steps.cpr.outputs['pull-request-operation'] != 'none'
-        uses: actions/checkout@v4
-        with:
-          ref: ${{ steps.cpr.outputs['pull-request-head-sha'] }}
-          fetch-depth: 0  # good practice if you need history
+
       - name: Push latest tag
+        if: steps.deps.outputs.changed == 'true'
+        env:
+          SHA: ${{ steps.deps.outputs.sha }}
         run: |
           Rscript -e "install.packages('desc')"
           TAG="v$(Rscript -e 'cat(as.character(desc::desc_get_version()))')"
-          git tag $TAG
-          git push origin $TAG
+          git tag "$TAG" "$SHA"
+          git push origin "$TAG"

From 99fae9be9acca4de6265f72836c893f6e86ec14b Mon Sep 17 00:00:00 2001
From: Lorenz Walthert <10477073+lorenzwalthert@users.noreply.github.com>
Date: Sun, 4 Oct 2026 19:26:16 +0200
Subject: [PATCH 06/13] fix: install system dependencies

---
 .github/workflows/end-to-end.yml | 11 +++++++++++
 1 file changed, 11 insertions(+)

diff --git a/.github/workflows/end-to-end.yml b/.github/workflows/end-to-end.yml
index c17345daf..2854cfce9 100644
--- a/.github/workflows/end-to-end.yml
+++ b/.github/workflows/end-to-end.yml
@@ -34,6 +34,17 @@ jobs:
           key: ${{ runner.os }}-${{ hashFiles('.github/R-version') }}-1-${{ hashFiles('.github/depends.Rds') }}
           restore-keys: ${{ runner.os }}-${{ hashFiles('.github/R-version') }}-1-
 
+      - name: Install system dependencies
+        run: |
+          install.packages('pak')
+          sysreqs <- pak::pkg_sysreqs('local::.', dependencies = TRUE)
+          for (script in c(sysreqs[['pre_install']], sysreqs[['install']], sysreqs[['post_install']])) {
+            if (length(script) > 0L && nzchar(script)) {
+              system(script)
+            }
+          }
+        shell: Rscript {0}
+
       - name: Install dependencies
         run: |
           remotes::install_deps(dependencies = TRUE)

From 03fdfad2e62915bb270da8b478b8b3345a41dab7 Mon Sep 17 00:00:00 2001
From: Lorenz Walthert <10477073+lorenzwalthert@users.noreply.github.com>
Date: Sun, 4 Oct 2026 19:34:43 +0200
Subject: [PATCH 07/13] fix: only install sys deps for linux

---
 .github/workflows/end-to-end.yml | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/.github/workflows/end-to-end.yml b/.github/workflows/end-to-end.yml
index 2854cfce9..8c0e9f5e0 100644
--- a/.github/workflows/end-to-end.yml
+++ b/.github/workflows/end-to-end.yml
@@ -8,6 +8,7 @@ name: end-2-end
 jobs:
   end-2-end:
     strategy:
+      fail-fast: false
       matrix:
         os: [macOS-latest, ubuntu-latest]
     runs-on: ${{ matrix.os }}
@@ -34,7 +35,8 @@ jobs:
           key: ${{ runner.os }}-${{ hashFiles('.github/R-version') }}-1-${{ hashFiles('.github/depends.Rds') }}
           restore-keys: ${{ runner.os }}-${{ hashFiles('.github/R-version') }}-1-
 
-      - name: Install system dependencies
+      - name: Install system dependencies (Linux only)
+        if: runner.os == 'Linux'
         run: |
           install.packages('pak')
           sysreqs <- pak::pkg_sysreqs('local::.', dependencies = TRUE)

From e990235e5c33f841aea7e64e50d032b72c1f2121 Mon Sep 17 00:00:00 2001
From: Lorenz Walthert <10477073+lorenzwalthert@users.noreply.github.com>
Date: Sun, 4 Oct 2026 19:41:20 +0200
Subject: [PATCH 08/13] fix: permissions

---
 .github/workflows/end-to-end.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/workflows/end-to-end.yml b/.github/workflows/end-to-end.yml
index 8c0e9f5e0..16f6688e5 100644
--- a/.github/workflows/end-to-end.yml
+++ b/.github/workflows/end-to-end.yml
@@ -42,7 +42,7 @@ jobs:
           sysreqs <- pak::pkg_sysreqs('local::.', dependencies = TRUE)
           for (script in c(sysreqs[['pre_install']], sysreqs[['install']], sysreqs[['post_install']])) {
             if (length(script) > 0L && nzchar(script)) {
-              system(script)
+              system2('sudo', c('bash', '-lc', script))
             }
           }
         shell: Rscript {0}

From 9e0c16da5be4ff0516ba145c91930c9307fd71f0 Mon Sep 17 00:00:00 2001
From: Lorenz Walthert <10477073+lorenzwalthert@users.noreply.github.com>
Date: Sun, 4 Oct 2026 19:49:16 +0200
Subject: [PATCH 09/13] fix: linux pak sysreq execution

---
 .github/workflows/end-to-end.yml | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/.github/workflows/end-to-end.yml b/.github/workflows/end-to-end.yml
index 16f6688e5..c25630e0e 100644
--- a/.github/workflows/end-to-end.yml
+++ b/.github/workflows/end-to-end.yml
@@ -40,8 +40,11 @@ jobs:
         run: |
           install.packages('pak')
           sysreqs <- pak::pkg_sysreqs('local::.', dependencies = TRUE)
-          for (script in c(sysreqs[['pre_install']], sysreqs[['install']], sysreqs[['post_install']])) {
+          scripts <- c(sysreqs[['pre_install']], sysreqs[['install']], sysreqs[['post_install']])
+          for (script in scripts) {
+            script <- paste(unlist(script), collapse = ' ')
             if (length(script) > 0L && nzchar(script)) {
+              message('Running: ', script)
               system2('sudo', c('bash', '-lc', script))
             }
           }

From 4d3d2dd267e454202e355f5d39ab07e90d6f7d05 Mon Sep 17 00:00:00 2001
From: Lorenz Walthert <10477073+lorenzwalthert@users.noreply.github.com>
Date: Sun, 4 Oct 2026 19:52:41 +0200
Subject: [PATCH 10/13] fix: use file-based pak sysreq execution

---
 .github/workflows/end-to-end.yml | 29 ++++++++++++++++++++++-------
 1 file changed, 22 insertions(+), 7 deletions(-)

diff --git a/.github/workflows/end-to-end.yml b/.github/workflows/end-to-end.yml
index c25630e0e..f8f6719fe 100644
--- a/.github/workflows/end-to-end.yml
+++ b/.github/workflows/end-to-end.yml
@@ -35,21 +35,36 @@ jobs:
           key: ${{ runner.os }}-${{ hashFiles('.github/R-version') }}-1-${{ hashFiles('.github/depends.Rds') }}
           restore-keys: ${{ runner.os }}-${{ hashFiles('.github/R-version') }}-1-
 
-      - name: Install system dependencies (Linux only)
+      - name: Generate system dependency commands (Linux only)
         if: runner.os == 'Linux'
         run: |
           install.packages('pak')
           sysreqs <- pak::pkg_sysreqs('local::.', dependencies = TRUE)
           scripts <- c(sysreqs[['pre_install']], sysreqs[['install']], sysreqs[['post_install']])
-          for (script in scripts) {
-            script <- paste(unlist(script), collapse = ' ')
-            if (length(script) > 0L && nzchar(script)) {
-              message('Running: ', script)
-              system2('sudo', c('bash', '-lc', script))
+          commands <- vapply(scripts, function(x) {
+            if (length(x) == 0L || !any(nzchar(x))) {
+              return(NA_character_)
             }
-          }
+            paste(unlist(x), collapse = ' ')
+          }, character(1))
+          commands <- commands[!is.na(commands)]
+          writeLines(commands, 'sysreqs.sh')
+          cat(commands, sep = '\n')
         shell: Rscript {0}
 
+      - name: Run system dependency commands (Linux only)
+        if: runner.os == 'Linux'
+        shell: bash
+        run: |
+          set -euo pipefail
+          if [[ -f sysreqs.sh ]]; then
+            while IFS= read -r cmd; do
+              [[ -z "$cmd" ]] && continue
+              echo "Running: $cmd"
+              sudo bash -lc "$cmd"
+            done < sysreqs.sh
+          fi
+
       - name: Install dependencies
         run: |
           remotes::install_deps(dependencies = TRUE)

From 151168dd7c75010901468137aa066981f497bd0f Mon Sep 17 00:00:00 2001
From: Lorenz Walthert <10477073+lorenzwalthert@users.noreply.github.com>
Date: Sun, 4 Oct 2026 19:56:18 +0200
Subject: [PATCH 11/13] fix: use pak install_scripts field

---
 .github/workflows/end-to-end.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/workflows/end-to-end.yml b/.github/workflows/end-to-end.yml
index f8f6719fe..6638fce0c 100644
--- a/.github/workflows/end-to-end.yml
+++ b/.github/workflows/end-to-end.yml
@@ -40,7 +40,7 @@ jobs:
         run: |
           install.packages('pak')
           sysreqs <- pak::pkg_sysreqs('local::.', dependencies = TRUE)
-          scripts <- c(sysreqs[['pre_install']], sysreqs[['install']], sysreqs[['post_install']])
+          scripts <- c(sysreqs[['pre_install']], sysreqs[['install_scripts']], sysreqs[['post_install']])
           commands <- vapply(scripts, function(x) {
             if (length(x) == 0L || !any(nzchar(x))) {
               return(NA_character_)

From 8c67547667f29ae88392e13b3ce876743f4c359b Mon Sep 17 00:00:00 2001
From: Lorenz Walthert <10477073+lorenzwalthert@users.noreply.github.com>
Date: Sun, 4 Oct 2026 20:08:06 +0200
Subject: [PATCH 12/13] fix: simplify pak sysreq execution

---
 .github/workflows/end-to-end.yml | 30 ++++++++----------------------
 1 file changed, 8 insertions(+), 22 deletions(-)

diff --git a/.github/workflows/end-to-end.yml b/.github/workflows/end-to-end.yml
index 6638fce0c..a5ca2db8d 100644
--- a/.github/workflows/end-to-end.yml
+++ b/.github/workflows/end-to-end.yml
@@ -35,36 +35,22 @@ jobs:
           key: ${{ runner.os }}-${{ hashFiles('.github/R-version') }}-1-${{ hashFiles('.github/depends.Rds') }}
           restore-keys: ${{ runner.os }}-${{ hashFiles('.github/R-version') }}-1-
 
-      - name: Generate system dependency commands (Linux only)
+      - name: Install system dependencies (Linux only)
         if: runner.os == 'Linux'
         run: |
           install.packages('pak')
           sysreqs <- pak::pkg_sysreqs('local::.', dependencies = TRUE)
           scripts <- c(sysreqs[['pre_install']], sysreqs[['install_scripts']], sysreqs[['post_install']])
-          commands <- vapply(scripts, function(x) {
-            if (length(x) == 0L || !any(nzchar(x))) {
-              return(NA_character_)
+          for (script in scripts) {
+            if (length(script) == 0L || !any(nzchar(script))) {
+              next
             }
-            paste(unlist(x), collapse = ' ')
-          }, character(1))
-          commands <- commands[!is.na(commands)]
-          writeLines(commands, 'sysreqs.sh')
-          cat(commands, sep = '\n')
+            script <- paste(unlist(script), collapse = ' ')
+            message('Running: ', script)
+            system2('sudo', c('bash', '-lc', script))
+          }
         shell: Rscript {0}
 
-      - name: Run system dependency commands (Linux only)
-        if: runner.os == 'Linux'
-        shell: bash
-        run: |
-          set -euo pipefail
-          if [[ -f sysreqs.sh ]]; then
-            while IFS= read -r cmd; do
-              [[ -z "$cmd" ]] && continue
-              echo "Running: $cmd"
-              sudo bash -lc "$cmd"
-            done < sysreqs.sh
-          fi
-
       - name: Install dependencies
         run: |
           remotes::install_deps(dependencies = TRUE)

From e11dff8e52b98b35b660a114bcd8ecbbba136676 Mon Sep 17 00:00:00 2001
From: Lorenz Walthert <10477073+lorenzwalthert@users.noreply.github.com>
Date: Sun, 4 Oct 2026 20:12:17 +0200
Subject: [PATCH 13/13] revert: file-based pak sysreq execution

---
 .github/workflows/end-to-end.yml | 30 ++++++++++++++++++++++--------
 1 file changed, 22 insertions(+), 8 deletions(-)

diff --git a/.github/workflows/end-to-end.yml b/.github/workflows/end-to-end.yml
index a5ca2db8d..6638fce0c 100644
--- a/.github/workflows/end-to-end.yml
+++ b/.github/workflows/end-to-end.yml
@@ -35,22 +35,36 @@ jobs:
           key: ${{ runner.os }}-${{ hashFiles('.github/R-version') }}-1-${{ hashFiles('.github/depends.Rds') }}
           restore-keys: ${{ runner.os }}-${{ hashFiles('.github/R-version') }}-1-
 
-      - name: Install system dependencies (Linux only)
+      - name: Generate system dependency commands (Linux only)
         if: runner.os == 'Linux'
         run: |
           install.packages('pak')
           sysreqs <- pak::pkg_sysreqs('local::.', dependencies = TRUE)
           scripts <- c(sysreqs[['pre_install']], sysreqs[['install_scripts']], sysreqs[['post_install']])
-          for (script in scripts) {
-            if (length(script) == 0L || !any(nzchar(script))) {
-              next
+          commands <- vapply(scripts, function(x) {
+            if (length(x) == 0L || !any(nzchar(x))) {
+              return(NA_character_)
             }
-            script <- paste(unlist(script), collapse = ' ')
-            message('Running: ', script)
-            system2('sudo', c('bash', '-lc', script))
-          }
+            paste(unlist(x), collapse = ' ')
+          }, character(1))
+          commands <- commands[!is.na(commands)]
+          writeLines(commands, 'sysreqs.sh')
+          cat(commands, sep = '\n')
         shell: Rscript {0}
 
+      - name: Run system dependency commands (Linux only)
+        if: runner.os == 'Linux'
+        shell: bash
+        run: |
+          set -euo pipefail
+          if [[ -f sysreqs.sh ]]; then
+            while IFS= read -r cmd; do
+              [[ -z "$cmd" ]] && continue
+              echo "Running: $cmd"
+              sudo bash -lc "$cmd"
+            done < sysreqs.sh
+          fi
+
       - name: Install dependencies
         run: |
           remotes::install_deps(dependencies = TRUE)