[vsimko]

What this changes

Both workflows in .github/workflows/ were last touched in 2021, and since then
every action they pin has been superseded and one of the runner labels they
target no longer exists. Neither workflow can currently complete a single job.

R-CMD-check.yml:

• ubuntu-20.04 no longer exists. GitHub announced the deprecation of the
  image in December 2024 and retired it on 15 April 2025. A job aimed at a
  retired label never gets a runner: it waits out the 24-hour job timeout and
  is then cancelled — that is what the 1d 0h runs in this repository are.
  ubuntu-latest replaces it.
• macos-latest is arm64 since late 2024. r-lib/actions/setup-r@v1
  predates Apple Silicon runners and has no arm64 R build to fetch.
  setup-r@v2 handles the architecture natively.
• The pinned actions ran on Node 12/16. actions/checkout@v2,
  actions/cache@v2, r-lib/actions/setup-r@v1 and setup-pandoc@v1 are
  forced onto Node 20 by GitHub now and are no longer maintained. Bumped to
  checkout@v4 and r-lib/actions@v2.
• The hand-rolled dependency steps are redundant. setup-r-dependencies@v2
  and check-r-package@v2 replace the manual remotes::dev_package_deps()
  caching, the system_requirements("ubuntu", "20.04") call (which installs
  focal packages on a jammy/noble runner) and the direct rcmdcheck call, and
  they install system libraries through pak.
• Added permissions: read-all, a workflow_dispatch trigger so the workflow
  can be started by hand on any branch, and devel / oldrel-1 on Ubuntu —
  what usethis::use_github_action("check-standard") generates today.

test-coverage.yaml:

• actions/cache@v2 in this file is a hard failure, not a warning — the cache
  service for v1/v2 was shut down in February 2025, so the run dies before the
  first step with "This request has been automatically failed because it uses a
  deprecated version of actions/cache: v2". Same fix: the r-lib/actions@v2
  stack, which caches through pak.
• codecov/codecov-action@v4 needs a CODECOV_TOKEN secret. fail_ci_if_error
  is set to false so a missing token produces a warning rather than failing
  the job after the package has already been tested; flip it back once the
  secret exists.
• Moved to ubuntu-latest (it was running Windows only) and added the testthat
  log dump and failure-artifact upload from the r-lib example.

No package code is touched — .github/workflows/ only.

Verification

All five jobs green in the author's fork, where Actions are not blocked:
https://github.com/vsimko/corrplot/actions/runs/40426424436

windows-latest (release)   success
macos-latest (release)     success
ubuntu-latest (release)    success
ubuntu-latest (devel)      success
ubuntu-latest (oldrel-1)   success

Note for the maintainer: at the time of writing, jobs in taiyun/corrplot fail
with The job was not started because your account is locked due to a billing issue. That affects unrelated PRs in this repository too (#288), so the runs on
this PR may show that same failure rather than a result of the patch — the
billing issue needs resolving on the account before any workflow here can run.

[vsimko]

the checks are expected to be red here.
once this PR is merged, all other pipelines should start working again.