Update with current v7.0-dev

.Rbuildignore

@@ -23,5 +23,5 @@
 ^\.circleci$
 ^\.circleci/config\.yml$
 ^\.github$
-^REFACTOR_GUIDE\.md$
 ^man-roxygen$
+^codecov\.yml$

.github/actions/setup-armadillo-with-dsbase/action.yaml

@@ -0,0 +1,118 @@
+name: Setup Armadillo with dsBase
+description: >
+  Starts a fresh Armadillo instance via docker-compose, with the "default"
+  Rock profile as a static sibling container. Installs R and system
+  dependencies, waits for readiness, uploads test datasets, and installs
+  dsBase. Assumes the caller has already checked out dsBaseClient at
+  ./dsBaseClient. Shared by the Armadillo dsbase shard workflow and the
+  Armadillo dsdanger job, so this setup only needs fixing in one place.
+
+inputs:
+  dsbase-ref:
+    description: dsBase GitHub ref to build and install
+    required: true
+
+runs:
+  using: composite
+  steps:
+    - name: Start Armadillo docker-compose
+      shell: bash
+      run: docker compose -f docker-compose_armadillo.yml up -d
+      working-directory: dsBaseClient
+
+    - uses: ./dsBaseClient/.github/actions/setup-r-with-dsbase-deps
+      with:
+        additional-packages: cran::covr
+
+    - name: Wait for Armadillo to be ready
+      shell: bash
+      run: |
+        for i in $(seq 1 60); do
+          if curl -fsS http://localhost:8080/actuator/health 2>/dev/null | grep -q '"status":"UP"'; then
+            echo "Armadillo is ready"
+            exit 0
+          fi
+          sleep 5
+        done
+        echo "Armadillo did not become ready in time"
+        docker compose -f docker-compose_armadillo.yml logs armadillo || true
+        exit 1
+      working-directory: dsBaseClient
+
+    - name: Install test datasets to Armadillo
+      shell: bash
+      run: R -q -f "molgenis_armadillo-upload_testing_datasets.R"
+      working-directory: dsBaseClient/tests/testthat/data_files
+
+    - name: Check out dsBase
+      uses: actions/checkout@v5
+      with:
+        repository: datashield/dsBase
+        ref: ${{ inputs.dsbase-ref }}
+        path: dsBase
+
+    - name: Build dsBase tarball
+      id: build-dsbase
+      shell: bash
+      run: |
+        R CMD build dsBase
+        echo "tarball=$GITHUB_WORKSPACE/$(ls dsBase_*.tar.gz)" >> "$GITHUB_OUTPUT"
+
+    - name: Install dsBase to Armadillo
+      shell: bash
+      run: |
+        installed=false
+        for i in $(seq 1 30); do
+          if Rscript -e "
+            library(MolgenisArmadillo)
+            armadillo.login_basic('http://localhost:8080', 'admin', 'admin')
+            armadillo.install_packages('${{ steps.build-dsbase.outputs.tarball }}', profile = 'default')
+          "; then
+            installed=true
+            break
+          fi
+          sleep 10
+        done
+        if [ "$installed" != "true" ]; then
+          echo "dsBase install via armadillo.install_packages() failed (default profile may not have started in time)"
+          exit 1
+        fi
+      working-directory: dsBaseClient
+
+    - name: Verify installed dsBase version
+      shell: bash
+      run: |
+        expected_version=$(sed -n 's/^Version: //p' "$GITHUB_WORKSPACE/dsBase/DESCRIPTION" | tr -d '\r')
+        if [ -z "$expected_version" ]; then
+          echo "Could not determine expected dsBase version from dsBase@${{ inputs.dsbase-ref }}"
+          exit 1
+        fi
+        echo "Expected dsBase version: $expected_version"
+
+        actual_version=""
+        for i in $(seq 1 30); do
+          packages_json=$(curl -sf -u admin:admin -X GET http://localhost:8080/packages || true)
+          actual_version=$(echo "$packages_json" | jq -r '.[] | select(.name == "dsBase") | .version' 2>/dev/null || true)
+          if [ "$actual_version" == "$expected_version" ]; then
+            break
+          fi
+          sleep 10
+        done
+        echo "Installed dsBase version: $actual_version"
+        if [ "$actual_version" != "$expected_version" ]; then
+          echo "dsBase version mismatch: expected $expected_version, found '$actual_version'"
+          exit 1
+        fi
+        echo "$actual_version" > dsbase_version.txt
+      working-directory: dsBaseClient
+
+    - name: Whitelist dsBase
+      shell: bash
+      run: curl -u admin:admin -X POST http://localhost:8080/whitelist/dsBase
+      working-directory: dsBaseClient
+
+    - name: Dump Armadillo server log
+      if: failure()
+      shell: bash
+      run: docker compose -f docker-compose_armadillo.yml logs armadillo | grep "Caused by:" | sort -u || true
+      working-directory: dsBaseClient

.github/actions/setup-opal-with-dsbase/action.yaml

@@ -0,0 +1,82 @@
+name: Setup Opal with dsBase
+description: >
+  Starts a fresh Opal instance via docker-compose, installs R and system
+  dependencies, uploads test datasets, and installs dsBase with disclosure
+  test options. Assumes the caller has already checked out dsBaseClient at
+  ./dsBaseClient. Shared by the Opal dsbase shard workflow and the Opal
+  dsdanger job, so this setup only needs fixing in one place.
+
+inputs:
+  dsbase-ref:
+    description: dsBase GitHub ref to install
+    required: true
+
+runs:
+  using: composite
+  steps:
+    - name: Start Opal docker-compose
+      shell: bash
+      run: docker compose -f docker-compose_opal.yml up -d --build
+      working-directory: dsBaseClient
+
+    - uses: ./dsBaseClient/.github/actions/setup-r-with-dsbase-deps
+
+    - name: Install test datasets to Opal
+      shell: bash
+      run: |
+        for i in $(seq 1 18); do
+          if curl -sf -o /dev/null http://localhost:8080/; then
+            echo "Opal is responding"
+            break
+          fi
+          sleep 5
+        done
+        R -q -f "obiba_opal-upload_testing_datasets.R"
+      working-directory: dsBaseClient/tests/testthat/data_files
+
+    - name: Install dsBase to Opal
+      shell: bash
+      run: |
+        R -q -e "library(opalr); opal <- opal.login(username = 'administrator', password = 'datashield_test&', url = 'http://localhost:8080/'); opal.put(opal, 'system', 'conf', 'general', '_rPackage'); opal.logout(opal)"
+        R -q -e "library(opalr); opal <- opal.login('administrator','datashield_test&', url='http://localhost:8080/'); dsadmin.install_github_package(opal, 'dsBase', username = 'datashield', ref = '${{ inputs.dsbase-ref }}'); opal.logout(opal)"
+      working-directory: dsBaseClient/tests/testthat/data_files
+
+    - name: Verify installed dsBase version
+      shell: bash
+      run: |
+        expected_version=$(curl -sf "https://raw.githubusercontent.com/datashield/dsBase/${{ inputs.dsbase-ref }}/DESCRIPTION" | sed -n 's/^Version: //p' | tr -d '\r')
+        if [ -z "$expected_version" ]; then
+          echo "Could not determine expected dsBase version from GitHub"
+          exit 1
+        fi
+        echo "Expected dsBase version: $expected_version"
+        echo "$expected_version" > dsbase_version.txt
+
+        ok=false
+        for i in $(seq 1 18); do
+          if Rscript -e "
+            library(opalr)
+            opal <- opal.login('administrator', 'datashield_test&', url = 'http://localhost:8080/')
+            desc <- dsadmin.package_description(opal, 'dsBase')
+            opal.logout(opal)
+            installed <- desc[['Version']]
+            cat('Installed dsBase version:', if (is.null(installed)) '(none yet)' else installed, '\n')
+            quit(status = if (!is.null(installed) && installed == '$expected_version') 0 else 1)
+          "; then
+            ok=true
+            break
+          fi
+          sleep 10
+        done
+        if [ "$ok" != "true" ]; then
+          echo "dsBase version mismatch or install not detected after polling: expected $expected_version"
+          exit 1
+        fi
+      working-directory: dsBaseClient/tests/testthat/data_files
+
+    - name: Initialize default profile and set disclosure test options
+      shell: bash
+      run: |
+        R -q -e "library(opalr); opal <- opal.login('administrator', 'datashield_test&', url='http://localhost:8080/'); dsadmin.profile_init(opal, name = 'default', packages = c('dsBase', 'dsTidyverse', 'resourcer')); opal.logout(opal)"
+        R -q -e "library(opalr); opal <- opal.login('administrator', 'datashield_test&', url='http://localhost:8080/'); dsadmin.set_option(opal, 'default.datashield.privacyControlLevel', 'permissive'); opal.logout(opal)"
+      working-directory: dsBaseClient/tests/testthat/data_files

.github/actions/setup-r-with-dsbase-deps/action.yaml

@@ -0,0 +1,61 @@
+name: Setup R with dsBaseClient dependencies
+description: >
+  Installs the system libraries, R, and R package dependencies shared by the
+  Opal and Armadillo setup actions. Assumes the caller has already checked
+  out dsBaseClient at ./dsBaseClient.
+
+inputs:
+  additional-packages:
+    description: Extra pak package specs (one per line) to install beyond the common set
+    required: false
+    default: ''
+
+runs:
+  using: composite
+  steps:
+    - name: Install system libraries
+      shell: bash
+      env:
+        SYSTEM_LIBRARIES: >-
+          libxml2-dev libcurl4-openssl-dev libssl-dev libgsl-dev libgit2-dev
+          libharfbuzz-dev libfribidi-dev libmagick++-dev libudunits2-dev libuv1-dev
+      run: |
+        sudo apt-get update -qq
+        sudo apt-get install -qq $SYSTEM_LIBRARIES -y
+
+    - uses: r-lib/actions/setup-r@v2
+      with:
+        r-version: release
+        http-user-agent: release
+        use-public-rspm: true
+
+    - uses: r-lib/actions/setup-r-dependencies@v2
+      env:
+        # RSPM doesn't always have a binary for every package/R-version combo; when it
+        # falls back to source, pak needs LinkingTo deps present to compile it.
+        PKG_INCLUDE_LINKINGTO: true
+        R_PACKAGES: |
+          cran::devtools
+          cran::fields
+          cran::meta
+          cran::metafor
+          cran::ggplot2
+          cran::gridExtra
+          cran::data.table
+          cran::DSI
+          cran::opalr
+          cran::DSOpal
+          cran::DSLite
+          cran::MolgenisAuth
+          cran::MolgenisArmadillo
+          cran::DSMolgenisArmadillo
+          cran::DescTools
+          cran::e1071
+          github::datashield/dsDangerClient
+      with:
+        working-directory: dsBaseClient
+        dependencies: 'c("Depends", "Imports", "LinkingTo")'
+        extra-packages: |
+          ${{ env.R_PACKAGES }}
+          ${{ inputs.additional-packages }}
+        needs: check