Flaky test: R workflows fail when Launchpad cannot serve the xtradeb PPA key

[jat255]

All three R workflows (R-CMD-check, pkgdown, citation-browser) fail intermittently in setup-r-dependencies, before any R code runs.

The package's system requirements resolve to chromium, so pak's pre_install runs add-apt-repository -y ppa:xtradeb/apps. That fetches the PPA signing key from Launchpad, and when Launchpad's API returns HTTP 500 the step dies with GPGKeyTemporarilyNotFoundError.

Because the three workflows share the step, one Launchpad hiccup fails all three at once, in about 90 seconds. The jobs look like a code failure but nothing was compiled or tested.

Seen on #163 (2026-08-25): all three failed, two passed on retry, pkgdown then failed the same way on two further retries.

Worth considering: install chromium without the PPA, ship or pin the signing key, or retry the sysreqs step. Whichever way, the goal is that a Launchpad outage stops blocking every PR that touches pkg-r/ or tests/shared/.

[jat255]

AI-generated analysis, brief and partly unverified. Treat as a starting point, not a conclusion.

The sysreq installs a browser the runner already has: the ubuntu-24.04 image ships Google Chrome 151 and Chromium 151.

Chain: Suggests: chromote, shinytest2 (shinytest2 imports chromote), chromote declares sysreq chrome, noble maps that to apt chromium, and its pre_install adds the PPA. Because pre_install runs for the whole sysreq set, one failed key fetch also blocks libcurl, libxml2 and the rest.

Possible fix, in two parts:

1. Move chromote and shinytest2 from Suggests to Config/Needs/browser, so only citation-browser requests them. R-CMD-check and pkgdown would then never resolve chrome. Both packages are used only in test-citation-browser.R, always via ::, and each block already calls skip_if_not_installed(), so the tests should skip cleanly.
2. In citation-browser, point CHROMOTE_CHROME at the runner's Chrome rather than installing one.

Retrying the step is weaker: it failed three times in a row over roughly 15 minutes on #163.

Unverified: the right knob to disable pak's sysreqs per job, and whether pre-seeding the PPA key would help at all (the traceback suggests getSigningKeyData() is called unconditionally). After any change, the workflow log prints the resolved sysreqs JSON, so confirm chrome is gone.