Hi @grimbough, there are indeed two different versions of the XML package in RSPM (and also CRAN), but RSPM doesn't distinguish between them well on the packages page. We'll look into UI improvements to make that less confusing.
The difference is that the older XML package is under an /src/contrib/Older/ path, while the newer XML is under the default /src/contrib/ path. For example, on CRAN, you can find them at:
When you install a package from a repository with two different versions of that package, the higher version should win, so we're not sure why 3.99-0.3 was being installed over 3.99-0.8.
Are you still able to reproduce this now, outside of the GitHub Actions workflow, just running install.packages() or pak::pkg_install() in an R 4.2 session? And are you able to reproduce this with a different CRAN mirror like https://cran.r-project.org?