Monthly Climate Data Update workflow fails every scheduled run (devtools missing + read-only token); add dry-run QA + auto-file-issue-on-failure

[NewGraphEnvironment]

Problem

The Monthly Climate Data Update workflow (.github/workflows/climate-update.yml) has failed on every scheduled run (2026-05-01, 06-01, 07-01, 08-01). The only green runs were manual workflow_dispatch back in April. So the automated producer pipeline has effectively never worked on schedule, and the S3 climate data has not been auto-updated since April.

This is not the benign "no new data this month" case — the job dies at package load, before it ever checks for new data.

Two independent bugs, present on every run

Bug 1 — devtools is not installed on the runner. scripts/pipeline_update_edh.R:31:

if (requireNamespace("cd", quietly = TRUE)) library(cd) else devtools::load_all()

CI installs cd's dependencies but not cd itself, so the else branch runs → devtools::load_all() →

Error in loadNamespace(x) : there is no package called 'devtools'
Execution halted

The pipeline halts immediately; no EDH fetch, no catalog read, nothing.

Bug 2 — the workflow token is read-only. The Commit log step (if: always()) then runs and cannot push:

remote: Permission to NewGraphEnvironment/cd.git denied to github-actions[bot].
fatal: ... The requested URL returned error: 403   (exit code 128)

There is no permissions: block, so the default GITHUB_TOKEN is read-only. This would fail even on a legitimate no-op month, so the job can never go green as written.

Proposed fix

• Bug 1: provide devtools to setup-r-dependencies@v2 via extra-packages: any::devtools (matches the script's existing devtools::load_all() fallback). Alternative considered: extra-packages: local::. to install cd itself (takes the requireNamespace("cd") branch, no dev tooling) — more correct but rebuilds the package each run; decide in planning.
• Bug 2: add a job-level permissions: { contents: write } block so the log commit can push.

QA / monitoring — dry-run + auto-file-issue-on-failure

Two complementary mechanisms: a dry-run mode to actively confirm the plumbing (now and on a weekly heartbeat), and an auto-filed GitHub issue on failure as the durable, team-visible alarm.

We want to confirm the fix works without waiting for the Sept 1 cron and without a full S3 write (which incurs the EDH pull + COG rebuild + egress this producer is meant to minimize).

• Add a dry_run path to pipeline_update_edh.R: load the package, verify EDH + AWS auth, read the STAC catalog, compute the target year — then exit 0 before any COG write / S3 push. Prints what it would do. Driven by an env var / workflow_dispatch input (default dry-run true for manual triggers).
• Wire a workflow_dispatch input dry_run (default true) into the workflow so a manual run exercises the full plumbing (pkg load, secrets, catalog read, push permission) cheaply and repeatably.
• Ongoing QA: add a second weekly cron that runs in dry-run mode. This gives a regular "plumbing still works" signal, and keeps the scheduled workflow active so GitHub does not auto-disable it after 60 days of inactivity (a silent-failure mode that failure emails never catch). The monthly 1 * * cron continues to run the real (non-dry-run) pipeline.
  • Distinguish crons via github.event.schedule: weekly cron → dry_run=true, monthly cron → dry_run=false.
• Auto-file a GitHub issue on failure: add a final if: failure() step that opens a tracking issue (or comments on the existing open one, deduped by a label like climate-update-failure so it does not spam) with the run URL and failing step. Team-visible, durable, and independent of per-user email/notification settings — this is the primary failure-detection mechanism. Applies to both the monthly real run and the weekly dry-run, so a broken dry-run also self-reports.

Confirming the fix (acceptance)

• workflow_dispatch with dry_run=true completes green: package loads, secrets verified, STAC read, target year computed, exits before S3 write.
• The push path is exercised without a 403 (either the dry-run commits nothing, or a harmless log commit pushes successfully with the new contents: write permission).
• Document the verified run (link + summary) in the PWF findings.

References

• Failing runs: 30688521648 (2026-08-01), 28501189058 (2026-07-01)
• Workflow: .github/workflows/climate-update.yml
• Entry point: scripts/pipeline_update_edh.R