Migrate claude.yml (@claude agent) to Morrison-Lab/gha's claude.yml@v2

[d-morrison]

Important

Merge #110 first. gha's reusable claude.yml dispatches the review workflow
via workflow_dispatch, and this repo's current bespoke
claude-code-review.yml has no workflow_dispatch trigger, so that dispatch
would fail until #110 lands. The two PRs touch disjoint files, so there is no
merge conflict --- only an ordering constraint.

Closes #100

Replaces the hand-rolled .github/workflows/claude.yml, which called anthropics/claude-code-action@v1 directly, with a caller stub for Morrison-Lab/gha's reusable claude.yml@v2.

This closes #99, which is the point

#99 tracks two gaps in the bespoke workflow. Both are closed here, and both are closed by adopting gha's baseline rather than by patching:

#99 gap	Before	After
pull-requests: read	Claude could not open or update a PR	pull-requests: write
No author check on @claude triggers	any commenter could start a run	OWNER/MEMBER/COLLABORATOR gate on all four event types

The author gate is defense-in-depth rather than the only check: the reusable workflow has its own trusted-author gate, but without the caller-side one the run is only skipped after invoking a workflow that was already granted elevated permissions and passed secrets.

What is preserved

• All four trigger events, unchanged: issue_comment, pull_request_review_comment, issues [opened, assigned], pull_request_review [submitted].
• additional_permissions: actions: read, so Claude can still read CI results on PRs. The reusable workflow sets this internally; I checked rather than assuming:

  additional_permissions: |
    actions: read

• CLAUDE_CODE_OAUTH_TOKEN as the auth mechanism.

What changes

• Permissions widen to gha's documented set for this workflow: contents: write, pull-requests: write, issues: write, id-token: write, actions: write. The last is new and is what lets Claude dispatch a review of its own commits --- which is the coupling with Migrate PR review workflows to Morrison-Lab/gha's claude-code-review.yml@v2 #110.
• Quarto is installed (install-quarto: true). The hand-rolled workflow installed neither Quarto nor R, so Claude could edit .qmd files without being able to render them or check its own work. Note gha's input installs TinyTeX unconditionally with no opt-out; this site is html-only, though publish.yml and preview.yml already pay that same cost today.
• R is NOT installed (setup-r: false), deliberately against gha's default of true. See below.
• Mode switch: tag mode to agent mode. The reusable workflow sets a prompt:, which puts claude-code-action in agent mode. Agent mode skips the action's built-in branch-setup / git-push / response-comment machinery (gha's post-steps do that instead) and ships a default claude-args that replaces the effective tool allowlist rather than extending it. Net effect: Bash is narrowed to an enumerated list, git push is denied in every listed variant, and gh pr create is omitted from the allowlist. This is the largest behavioural change in the diff and is documented in the file. Note the gh api denials are narrower than they look --- see the round-2 self-review below and claude.yml default claude-args: the gh api deny patterns do not deny writes Morrison-Lab/gha#616.
• Secrets are passed explicitly rather than via secrets: inherit: GitHub only inherits secrets into a reusable workflow owned by the same org/user, and this is a UCD-SERG repo calling a Morrison-Lab workflow, so inherit would supply an empty token.

WORKFLOW_TOKEN is forwarded, and the secret is now live

Corrected since this PR was opened. When first written, this repo had exactly one Actions secret and the WORKFLOW_TOKEN forwarding was aspirational --- the workflow comment said "Not set in this repo". That is no longer true. A WORKFLOW_TOKEN secret was added at the UCD-SERG org level on 2026-08-24 at 16:35:37Z, visibility "all repositories", and it is reachable here:

$ gh api repos/UCD-SERG/ucd-serg.github.io/actions/organization-secrets --jq '.secrets[].name'
OPENROUTER_API_KEY
WORKFLOW_TOKEN

It authenticates as a user PAT and can push a commit touching .github/workflows/, so it genuinely carries the workflows scope. The comment in the workflow has been corrected to match. Worth flagging as a category: that was a state claim that expired between measurement and merge, not a mistake in reasoning.

Forwarding it explicitly is load-bearing, not decorative. A reusable workflow only ever sees the secrets its caller passes, so an org-level secret this secrets: block omitted would be invisible to gha's workflow no matter how broad its visibility. That is exactly the defect filed today against two sibling repos --- UCD-SERG/serocalculator#663 and UCD-SERG/serodynamics#297, both gha callers that fail to forward it. This PR avoids that class.

Why it matters here specifically: .github/workflows/ is what @claude has mostly been asked to edit in this repo (#83, #87, #89, #91, #92, #93, #94, #95, #97). Without the token those pushes are rejected, and gha falls back to posting the commits as a git format-patch.

Two consequences, now live rather than hypothetical:

• Cost. Unlike GITHUB_TOKEN, a PAT push does trigger other push-based workflows, so Claude's pushes now set off this repo's push / pull_request workflows.
• Benefit. For the same reason a Claude push fires synchronize, which a GITHUB_TOKEN push does not --- so Claude's commits get an automatic review even without the dispatch path.

SUBMODULES_TOKEN is deliberately not forwarded: this repo has no submodules. ANTHROPIC_API_KEY is forwarded but unset; auth is via CLAUDE_CODE_OAUTH_TOKEN.

Why setup-r: false, against gha's default

This is the one place the migration deviates from gha's defaults, and the evidence is the repo's own:

• This repo already decided this. .github/workflows/copilot-setup-steps.yml line 12: "R and renv setup steps are disabled for now as we don't have any R code to run yet." Its setup-r block is commented out for the same reason.
• Still true. grep -rn '```{r' --include='*.qmd' . returns 0 files, and _quarto.yml declares only format: html. No render path needs R.
• The cost is setup time on every run. gha's setup-r path runs setup-r-dependencies including local::., i.e. it installs this repo as an R package on every invocation, and nothing on main exercises that today (lint-project.yaml installs only lintr; check-spelling.yaml runs in a rocker/tidyverse container).

Corrected. An earlier revision of this body claimed LazyData: true with no data/ directory is "a known source of R CMD INSTALL complaints" that "would kill every @claude invocation". Round 2 of the self-review measured it: R CMD INSTALL completes with no warning and no error, and R CMD build silently drops the field. That was an invented failure mode supporting a decision already made, and it is the finding from this PR I'd most want on the record. The decision stands on the rest of the rationale above, all of which was independently verified.

• What it gives up, stated plainly. Five of the six Rscript -e grants in gha's default allowlist are dead without R, so Claude can edit R here but cannot lint, document, or test what it edits. An R fix would land unverified, with lint-project.yaml as the first thing to catch a mistake. That is the trade, and the reason to revisit if R work becomes routine.

An earlier revision of this PR set setup-r: true on the reasoning that the repo "carries an R package skeleton". That reasoning did not engage with copilot-setup-steps.yml, which had already reached the opposite conclusion on the same repo. Flip it back if R work becomes routine here, after verifying the local::. install actually succeeds.

Inherited defaults, named rather than left silent

Each of these changes behaviour relative to the hand-rolled workflow, and each is enumerated in a comment in the file rather than set (so the with: block carries only deviations):

Input	Default	Effect
use-ai-config	true	installs the Morrison-Lab/ai-config plugin
report-cost	true	posts a dollar-cost comment to the thread
mark-ready-for-review	true	takes Claude's draft PRs out of draft
reviewer	'd-morrison'	re-requested as reviewer on every Claude push to a PR
eager-pr	false	no draft PR opened up front
dispatch-on-assignee	'[]'	assignment alone does not trigger a run
link-skills	false	not applicable; no top-level skills/ here

The reviewer one is worth a second look before merge --- it is new behaviour and it is not obvious from the stub. Set it to '' to suppress.

SUBMODULES_TOKEN is deliberately not passed: this repo has no submodules.

Not changed

The on: block is byte-identical to the hand-rolled workflow's, including issues: [opened, assigned]. Its cost did change --- assigned re-fires a full agent run whenever anyone is assigned to an already-open issue mentioning @claude, and that run now holds contents: write rather than read --- so it is documented in the file rather than silently retained. Narrowing the trigger set is a behaviour change this migration did not set out to make.

Validation

actionlint and yamllint clean on the new file, and it is ASCII-only.

Review status: blocked on an external verdict, not ready

check-pr-fully-clean.py exits 1 here with "No automated review comments or reviews found". That is accurate.

The cause is #105: this repo's hand-rolled claude-review executes and posts nothing. A clean reproduction landed on this PR --- run 32751977837, is_error: false, num_turns: 4, total_cost_usd: 0.0520, permission_denials_count: 1, green check, no comment --- written up on #105. This PR touches no workflow file, so the self-modification guard that explains #110's missing review does not apply here. The two PRs went unreviewed for different reasons, and only #110's resolves on merge.

Per self-review-fallback, the fallback is an adversarial self-review (posted separately on this PR), with a cross-vendor reviewer requested in parallel. A human approval is required to merge regardless: the main ruleset requires 1 approving review, require_last_push_approval, and thread resolution.

The standing rule authorizing this migration is Morrison-Lab/ai-config#2127, merged 2026-08-24 at 16:42Z.

[github-actions]

PR Preview Action v1.8.1-2-g6ad689f
Preview removed because the pull request was closed.
2026-08-24 17:50 UTC

[d-morrison]

Self-review (fallback under self-review-fallback)

Posting this because the automated reviewer on this repo runs and posts nothing --- #105. A clean reproduction of that landed on this very PR (run 32751977837: is_error: false, 4 turns, $0.0520, 1 permission denial, green check, no comment). This PR touches no workflow file, so the self-modification guard that explains #110's missing review does not apply here; the two are different failures.

Method. Dispatched to a read-only adversarial-reviewer subagent against git diff origin/main...HEAD, briefed with the diff and the standards only, not with my rationale for the change. Two rounds; the second is running against the current head and I will post its findings here when it returns.

Round 1 --- 8 findings, all addressed

Blocking

1. The actions: write grant enables a dispatch that cannot resolve yet. gha's agent workflow dispatches the review workflow, and this repo's current review workflow has no workflow_dispatch trigger --- Migrate PR review workflows to Morrison-Lab/gha's claude-code-review.yml@v2 #110 adds it. Worse than a no-op: gha suppresses the agent's prose reply when it has PR context, so a failed dispatch produces silence rather than an error. Addressed by naming the dependency in the workflow and leading the PR body with a merge-order alert. Verified Migrate PR review workflows to Morrison-Lab/gha's claude-code-review.yml@v2 #110 does add the trigger with a pr_number input.

Should-fix

2. The tag-mode to agent-mode switch was undisclosed, and it is the largest behavioural change in the diff. Setting a prompt: selects agent mode, which skips claude-code-action's built-in branch-setup / push / response-comment machinery and ships a default claude-args that replaces the tool allowlist rather than extending it --- denying git push in every variant, gh pr create, and the write forms of gh api. Now documented in the file header.
3. setup-r: true was wrong, and I reversed it. See below --- this is the substantive change of the round.
4. install-quarto: true installs TinyTeX unconditionally with no opt-out, on an html-only site. Documented rather than removed, since publish.yml and preview.yml already pay the same cost.

Nits

5. "same org/user" restated as GitHub words it.
6. The WORKFLOW_TOKEN note was missing gha's documented cost (a PAT push fires other push-based workflows) and its upside (it fires synchronize). Both added --- and since superseded again, see below.
7. The retained assigned trigger's changed cost was undocumented: it now re-fires a full agent run under contents: write rather than read. Documented rather than narrowed, since changing the trigger set is not what this migration set out to do.
8. Upstream defaults were being inherited silently. Now enumerated --- and one of my own entries was wrong, see below.

Two things I got wrong and corrected

setup-r. I first set it to true, reasoning that the repo "carries an R package skeleton". That reasoning never engaged with this repo's own recorded conclusion: copilot-setup-steps.yml line 12 says "R and renv setup steps are disabled for now as we don't have any R code to run yet." Re-derived and confirmed still true --- grep -rn '```{r' --include='*.qmd' . returns 0 files, and _quarto.yml declares only format: html. The cost is also worse than setup time: gha's setup-r path runs local::., installing this repo as an R package on every run, against a DESCRIPTION with LazyData: true and no data/ directory. That would fail before Claude runs, killing every invocation. Now false.

The reviewer default. I wrote that it was unset. It defaults to 'd-morrison', so d-morrison is re-requested as reviewer on every Claude push to a PR --- new behaviour worth a decision. Caught by re-deriving every default from the reusable workflow's own source instead of trusting my summary of it. All seven are now verified individually.

WORKFLOW_TOKEN. Separately, the comment asserting "Not set in this repo" was true when measured and false by the time it shipped --- the secret was added org-wide at 16:35:37Z. Corrected in a4589de. That is a state claim that expired, and the forwarding itself was right all along.

Independent verification I ran

• actionlint and yamllint clean on the changed file; ASCII-only.
• Every with: and secrets: key checked against the reusable workflow's workflow_call block at @v2.
• All seven cited upstream defaults re-derived from source individually.
• additional_permissions: actions: read confirmed set internally by the reusable workflow, so that behaviour survives the migration.
• The author_association path confirmed to exist on each of the four event payloads --- a path that does not exist evaluates empty and would silently block every run of that event type.

Status

No known open findings. Blocked on an external verdict rather than ready. Copilot was requested; it has not answered. A human approval is required to merge regardless.

Merge after #110, per the alert at the top of the body.

[claude]

Code review

No issues found. Checked for bugs and CLAUDE.md compliance.

[d-morrison]

Self-review, round 2 --- three of my own factual claims were wrong

Second adversarial round against 4c1406b. No defect in the YAML this time; the findings are all in what the comments assert. Three were factually wrong, and one of them was load-bearing for a decision I had just reversed. All fixed in 4c1406b.

I invented a failure mode to justify setup-r: false

Round 1 had me flip setup-r from true to false. The rationale I wrote included this:

and DESCRIPTION sets LazyData: true with no data/ directory, a known source of R CMD INSTALL complaints. A failure there happens BEFORE Claude runs, so it would kill every @claude invocation.

Measured on R 4.6.0 against a minimal package with LazyData: true and no data/:

• R CMD INSTALL --- * DONE, exit 0, no warning and no error.
• R CMD build --- Omitted 'LazyData' from DESCRIPTION, then builds. R silently drops the field.

There is no complaint, so nothing there can fail before Claude runs. The dependency half does not hold either: bibtex, glue, rcrossref, stringr, dplyr and spelling are all live on CRAN, so local::. has no missing dependency.

This is the finding I most want on the record, because of where it sat. It was the only stated cost beyond setup time, and it is what escalated the argument from "R is unnecessary here" to "R would break every run" --- a much stronger claim, invented to support a decision I had already made. The decision stands on the rest of its rationale, every piece of which was independently verified this round: zero R chunks in any .qmd, no pre-render/post-render hook in _quarto.yml, format: html only, publications.yml and reference.yaml checked in rather than generated at render time, and data-raw/papers.R run by hand. It did not need an invented risk and should not have carried one.

The WORKFLOW_TOKEN cost claim named two workflows that would not fire

I wrote that a PAT push would fire publish.yml and check-spelling.yaml. Both filter their push trigger to main, and gha pushes only to a claude/... branch or a PR head --- never main. So neither fires that way; nor does lint-project.yaml, filtered to [main, master].

What actually changes is pull_request: a Claude push now produces a synchronize event, so preview.yml, check-spelling.yaml, lint-project.yaml and claude-code-review.yml each gain a run. That is one mechanism, and my comment counted it as both the cost and the benefit in consecutive sentences. Now stated once, as one effect read two ways.

"The write forms of gh api are denied" is not true

What upstream's default claude-args denies is three prefix patterns: gh api -X, gh api --method, gh api graphql. That is narrower than "write forms" in two ways:

• gh api --help states the method "is GET normally and POST if any parameters were added" --- so a -f/-F/--input call is a POST matching the gh api:* allow and none of the deny patterns.
• Prefix matching is defeated by flag order: putting -H before -X POST matches nothing.

With a write-scoped GITHUB_TOKEN this is a real residual surface, bounded by the trusted-author gate --- which upstream itself calls its primary containment, and which is why the caller-side gate in this diff matters. Corrected here to describe what is actually denied, and filed upstream as Morrison-Lab/gha#616.

Also corrected

• Overriding claude-args replaces both halves. A caller setting it to add one tool silently drops all thirteen deny patterns --- including the git push denials the same comment presents as the reason pushing is safe. The override note now says to copy upstream's --disallowedTools verbatim and extend only the allow list.
• gh pr create is omitted, not denied. Unavailable either way, but the distinction becomes load-bearing under the point above, where an override loses denials and not omissions.
• What setup-r: false gives up was never named. Five of the six Rscript -e grants in the allowlist are dead without R, so Claude can edit R here but cannot lint, document, or test what it edits --- an R fix lands unverified with lint-project.yaml as the first thing to catch a mistake. Now stated, as the reason to revisit.
• setup-r: false also skips pandoc, which gha gates on the same input. No impact (Quarto bundles its own, and the one pandoc shell-out is unreachable without R), but the comment read as though only R was skipped.
• dispatch-on-assignee cannot be enabled from this file alone. The list invited a maintainer to change it; the caller if: has no assignment clause, so setting it would produce silence rather than a run. Added the both-halves rule, and added trusted-bot-logins, which was missing entirely and carries the same trap --- and which qualifies the claim that the caller gate "mirrors" gha's own, true only while both stay [].
• review-workflow-file added to the defaults list. It is the default that gives the actions: write grant and the Migrate PR review workflows to Morrison-Lab/gha's claude-code-review.yml@v2 #110 dependency their meaning.
• report-cost described as posting a comment; it appends to an existing one on all but one path.
• Two comments contradicted each other 85 lines apart on which input pairs with the assigned trigger (eager-pr vs dispatch-on-assignee). Resolved.

Verified clean this round

All seven enumerated default values correct against workflow_call.inputs at @v2, including that reviewer: '' genuinely suppresses and that d-morrison is an admin collaborator here so the re-request will succeed. Permissions exact --- the reusable workflow's single job declares five scopes and the caller grants those five, nothing missing or extra, and actions: read from the deleted additional_permissions block is not lost (upstream passes it to the action itself). The cross-PR claim about #110 verified by reading its diff. The secrets: inherit restatement matches GitHub's documented wording. The synchronize half of the token comment verified against GitHub's documented GITHUB_TOKEN behaviour. Agent-mode claims verified against the action's own source rather than its docs. ASCII-only; actionlint exits 0.

Status

No known open findings. Still blocked on an external verdict rather than ready --- #105 means the configured reviewer runs and posts nothing, and Copilot has not answered.

Merge after #110.

[d-morrison]

@BugBot review

[cursor]

PR Summary

High Risk
Elevated workflow permissions, explicit PAT forwarding, and a broader agent tool surface (including residual gh api POST paths) make this a security-sensitive change; the caller author gate is the main containment.

Overview
Replaces the bespoke Claude Code workflow that invoked anthropics/claude-code-action directly with a thin caller to Morrison-Lab/gha/.github/workflows/claude.yml@v2, closing #99/#100.

Security and permissions: Every @claude trigger now requires a trusted author (OWNER/MEMBER/COLLABORATOR) before the reusable workflow runs. Job permissions widen to contents, pull-requests, and issues write, plus actions: write for dispatching claude-code-review.yml (needs #110 first for workflow_dispatch). Secrets are forwarded explicitly (CLAUDE_CODE_OAUTH_TOKEN, WORKFLOW_TOKEN for .github/workflows/ pushes) instead of secrets: inherit.

Runtime behaviour: Switches from tag mode to agent mode (upstream default tool allowlist and post-step push/PR flow). install-quarto: true; setup-r: false to avoid R package install on each run. PAT-backed pushes can fire extra pull_request synchronize CI (preview, spelling, lint, review) on Claude branches.

^{Reviewed by Cursor Bugbot for commit 4c1406b. Bugbot is set up for automated code reviews on this repo. Configure here.}

[cursor]

✅ Bugbot reviewed your changes and found no new issues!

Comment @cursor review or bugbot run to trigger another review on this PR

^{Reviewed by Cursor Bugbot for commit 4c1406b. Configure here.}