chore(deps): bump r-lib/actions/setup-pandoc from 2.12.1 to 2.13.0

[dependabot]

Bumps r-lib/actions/setup-pandoc from 2.12.1 to 2.13.0.

Changelog

Sourced from r-lib/actions/setup-pandoc's changelog.

v2.13.0 (2026-08028)

• [setup-r] now retries r-hub.io HTTP failures (#1088, @​nbenn).

• [setup-r] now sets the correct RTOOLS environment variables on aarch64 Windows (@​vjymisal0, #1104).

• [setup-r] keep repositories if they are set by the build. E.g. aarch64 Windows builds now set them (@​jeroen, #1101).

• [setup-r] now retries transient failures when resolving the R version from api.r-hub.io, rather than failing the job on the first timeout or server error (@​nbenn, #1086).

• [setup-r-dependencies] now switches back to classic sudo, if available, on Linux. This fixes installing pak on Ubuntu 26.04 runners (@​jeroen, #1096).

v2.12.1 (2026-06-23)

• [setup-r] now avoids a warning about an url.parse() deprecation (#1074).

• [setup-r-dependencies] now uses quarto-dev/quarto-actions v2.2.0 (@​jdblischak, #1076).

• Examples: test-coverage.yaml now uses codecov/codecov-action v7 (@​shikokuchuo, #1081).

• New example claude-investigate.yaml workflow (@​DavisVaughan, #1084).

v2.12.0 (2026-04-29)

• All node.js actions use node 24 now. Relatedly, all example workflows use recent versions of actions that use node 24.

• [setup-r] now uses use-public-rspm: true by default on Linux and Windows. macOS binaries require further opt-in with use-public-rspm: always.

• It is now possible to require actions to be pinned to a full-length commit SHA in repositories using r-lib/actions (#1070).

• [setup-pandoc][setup-r-dependencies] now default to Pandoc version 3.8.3.

• [setup-r-dependencies] now includes the R architecture in the cache key, so caches for macos-15 (Apple Silicon) and macos-15-intel (Rosetta/x86_64) no longer collide (#1035).

... (truncated)

Commits

• 465b7d8 NEWS for 2.13.0 (#1105)
• d06a540 [setup-r] retry transient r-hub.io request failures (#1088)
• ed9aa85 fix(setup-r): export correct RTOOLS HOME env vars on Windows ARM64 and x64 (#...
• c86f32c setup-r-dependencies: set JAVA_HOME on Windows runners from Java 21 env vars ...
• 2a66450 setup-r-dependencies: switch back to classic sudo on runners with sudo-rs (#1...
• 5cc1f0d Fix minor typo (#1098)
• 33d09fb fix: Remove stray ::group:: (#1103)
• aae88a2 Special-case CRAN mirror for Windows ARM64 (#1101)
• b7484da [setup-r] Support installing RTools without installing R (#1093)
• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

---

[devin-ai-integration]

Devin Review found 1 potential issue.

[devin-ai-integration]

📝 Info: Executable action payload is unchanged

The action metadata and executable bundle are byte-identical at both commits. This workflow’s Pandoc setup behavior remains unchanged.

---

Was this helpful? React with 👍 or 👎 to provide feedback.

[cwl-noema-review]

Noema LLM review

The PR updates the pinned SHA for r-lib/actions/setup-pandoc from d3c5be51b12e724e68f33216ca3c148b66d5f0b6 to 465b7d8e732ca3921382b1674c59bada9cbf3399, corresponding to the v2 tag bump from 2.12.1 to 2.13.0. The prior review thread confirms the action metadata and executable bundle are byte-identical at both commits, so no behavioral change is introduced. The workflow remains valid YAML, permissions are unchanged (contents: read), and all other steps are untouched.

Reviewed changed lines

• .github/workflows/R-CMD-check.yaml:37 (RIGHT): The setup-pandoc SHA is updated from d3c5be51b12e724e68f33216ca3c148b66d5f0b6 to 465b7d8e732ca3921382b1674c59bada9cbf3399. The new SHA resolves to the upstream r-lib/actions v2.13.0 tag, and prior review confirms byte-identical action metadata and executable bundle, so no functional change occurs.

Adversarial validation

• .github/workflows/R-CMD-check.yaml:37 (RIGHT) falsified: The updated SHA might not resolve to the intended upstream tag or could introduce a supply-chain or behavioral change. — The SHA 465b7d8e732ca3921382b1674c59bada9cbf3399 corresponds to the v2.13.0 tag commit, and prior review threads state the action metadata and executable bundle are byte-identical at both commits.
• .github/workflows/R-CMD-check.yaml:37 (RIGHT) falsified: The version bump could break compatibility with downstream steps that rely on setup-pandoc outputs or specific behavior. — setup-pandoc is invoked without inputs, its outputs are not consumed by downstream steps, and setup-r, setup-r-dependencies, and check-r-package remain pinned to compatible v2-era SHAs.
• Residual risk: Negligible: the changed SHA resolves to the upstream v2.13.0 tag and the executable payload is byte-identical to the prior pinned commit.

Findings

• No blocking findings.

• Result: APPROVE
• Head SHA: 806ca9a67258244cf63c5668eaa5c1ad87ded8cc
• Reviewer credential: noema-review-github-app-refresh
• Actor: cwl-noema-review[bot]