From 72a63e35748142691118c386e0e2278df2d542b3 Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Wed, 2 Sep 2026 19:06:39 +0900 Subject: [PATCH 1/4] ci: call the shared reusable R-CMD-check workflow Replaces the hand-copied r-lib check sequence with a thin caller of ContextualWisdomLab/.github's new r-package-check.yml reusable workflow. Behavior is preserved: same 5-leg OS/R-version matrix, same extra-packages (rcmdcheck + testthat), same check args (--no-manual --no-tests), same pre-check regression test step. The r-lib/actions/setup-pandoc pin changes from d3c5be51b1... to 6f6e5bc62fba... to match this file's own other r-lib step pins (an inconsistency within this file, not a behavior change) -- see ContextualWisdomLab/.github#1716, docs/adr/0023-r-cmd-check-reusable-workflow-consolidation.md and docs/doctoring/r-cmd-check-reusable-workflow-consolidation.md there. Co-Authored-By: Claude Sonnet 5 --- .github/workflows/R-CMD-check.yaml | 76 ++++++++++-------------------- 1 file changed, 24 insertions(+), 52 deletions(-) diff --git a/.github/workflows/R-CMD-check.yaml b/.github/workflows/R-CMD-check.yaml index 2fd552b..3380fa4 100644 --- a/.github/workflows/R-CMD-check.yaml +++ b/.github/workflows/R-CMD-check.yaml @@ -1,62 +1,34 @@ # Workflow derived from https://github.com/r-lib/actions/tree/v2/examples # Need help debugging build failures? Start at https://github.com/r-lib/actions#where-to-find-help +# +# Thin caller: shared R-CMD-check logic lives in the org-wide reusable +# workflow. See ContextualWisdomLab/.github#1716, +# ContextualWisdomLab/.github's docs/adr/0023-r-cmd-check-reusable-workflow-consolidation.md +# and docs/doctoring/r-cmd-check-reusable-workflow-consolidation.md. +name: R-CMD-check + on: push: branches: [main, master, develop] pull_request: branches: [main, master, develop] -name: R-CMD-check - -permissions: - contents: read - jobs: R-CMD-check: - runs-on: ${{ matrix.config.os }} - - name: ${{ matrix.config.os }} (${{ matrix.config.r }}) - - strategy: - fail-fast: false - matrix: - config: - - {os: macos-latest, r: 'release'} - - {os: windows-latest, r: 'release'} - - {os: ubuntu-latest, r: 'devel', http-user-agent: 'release'} - - {os: ubuntu-latest, r: 'release'} - - {os: ubuntu-latest, r: 'oldrel-1'} - - env: - GITHUB_PAT: ${{ secrets.GITHUB_TOKEN }} - R_KEEP_PKG_SOURCE: yes - - steps: - - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - - - uses: r-lib/actions/setup-pandoc@d3c5be51b12e724e68f33216ca3c148b66d5f0b6 # v2 - - - uses: r-lib/actions/setup-r@6f6e5bc62fba3a704f74e7ad7ef7676c5c6a2590 # v2 - with: - r-version: ${{ matrix.config.r }} - http-user-agent: ${{ matrix.config.http-user-agent }} - use-public-rspm: true - - - uses: r-lib/actions/setup-r-dependencies@6f6e5bc62fba3a704f74e7ad7ef7676c5c6a2590 # v2 - with: - extra-packages: | - any::rcmdcheck - any::testthat - needs: check - - - name: Run Zh formula regression tests - run: | - Rscript -e 'install.packages(".", repos = NULL, type = "source")' - Rscript -e 'library(kaefa); testthat::test_file("tests/testthat/test-zh-misfit-decision-rule.R")' - - - uses: r-lib/actions/check-r-package@6f6e5bc62fba3a704f74e7ad7ef7676c5c6a2590 # v2 - with: - error-on: '"error"' - upload-snapshots: true - args: 'c("--no-manual", "--no-tests")' - build_args: 'c("--no-manual")' + uses: ContextualWisdomLab/.github/.github/workflows/r-package-check.yml@main + with: + r_matrix: | + [ + {"os": "macos-latest", "r": "release"}, + {"os": "windows-latest", "r": "release"}, + {"os": "ubuntu-latest", "r": "devel", "http-user-agent": "release"}, + {"os": "ubuntu-latest", "r": "release"}, + {"os": "ubuntu-latest", "r": "oldrel-1"} + ] + extra_packages: | + any::rcmdcheck + any::testthat + check_args: 'c("--no-manual", "--no-tests")' + pre_check_script: | + Rscript -e 'install.packages(".", repos = NULL, type = "source")' + Rscript -e 'library(kaefa); testthat::test_file("tests/testthat/test-zh-misfit-decision-rule.R")' From d1a2b89b2f23fe5e3a34142876bf419e7a398b15 Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Wed, 2 Sep 2026 21:03:26 +0900 Subject: [PATCH 2/4] fix(ci): match the reusable workflow's renamed pre-check inputs pre_check_script (free-form shell interpolated directly into run:) was removed from ContextualWisdomLab/.github's r-package-check.yml after a security review found it let a caller supply arbitrary shell source to a centrally trusted job (see .github's docs/adr/0023-r-cmd-check-reusable- workflow-consolidation.md). Replaced with the two bounded-data inputs the reusable workflow now exposes: install_package_before_pre_check (true) and pre_check_test_file (the same test file path, now passed as data, not interpolated as shell source). Still references @main, which does not resolve until .github#1716 merges (the reusable workflow does not exist on .github's main yet) -- this PR cannot pass its own checks until then. Re-pin to the exact merge commit SHA once #1716 lands, per this org's pinned-reusable-workflow-caller convention (see docs/doctoring/dependency-review-reusable-workflow- consolidation.md's "Post-merge corrections" section for why). Co-Authored-By: Claude Sonnet 5 --- .github/workflows/R-CMD-check.yaml | 5 ++--- 1 file changed, 2 insertions(+), 3 deletions(-) diff --git a/.github/workflows/R-CMD-check.yaml b/.github/workflows/R-CMD-check.yaml index 3380fa4..3a74409 100644 --- a/.github/workflows/R-CMD-check.yaml +++ b/.github/workflows/R-CMD-check.yaml @@ -29,6 +29,5 @@ jobs: any::rcmdcheck any::testthat check_args: 'c("--no-manual", "--no-tests")' - pre_check_script: | - Rscript -e 'install.packages(".", repos = NULL, type = "source")' - Rscript -e 'library(kaefa); testthat::test_file("tests/testthat/test-zh-misfit-decision-rule.R")' + install_package_before_pre_check: true + pre_check_test_file: tests/testthat/test-zh-misfit-decision-rule.R From ff16c9a42cbbb9e4132256e01140cf33e080d623 Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Fri, 4 Sep 2026 14:44:48 +0900 Subject: [PATCH 3/4] ci: pin reusable R package check workflow Signed-off-by: Seongho Bae --- .github/workflows/R-CMD-check.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/R-CMD-check.yaml b/.github/workflows/R-CMD-check.yaml index 3a74409..a1575cd 100644 --- a/.github/workflows/R-CMD-check.yaml +++ b/.github/workflows/R-CMD-check.yaml @@ -15,7 +15,7 @@ on: jobs: R-CMD-check: - uses: ContextualWisdomLab/.github/.github/workflows/r-package-check.yml@main + uses: ContextualWisdomLab/.github/.github/workflows/r-package-check.yml@816e3e4970fde4450585de2a7b8df7e2c5f82fe4 with: r_matrix: | [ From db093e1fdf7eb4fb71f3a96d7a4cb5b416df95d6 Mon Sep 17 00:00:00 2001 From: Seongho Bae Date: Fri, 4 Sep 2026 14:47:26 +0900 Subject: [PATCH 4/4] ci: bound reusable workflow permissions --- .github/workflows/R-CMD-check.yaml | 2 ++ 1 file changed, 2 insertions(+) diff --git a/.github/workflows/R-CMD-check.yaml b/.github/workflows/R-CMD-check.yaml index a1575cd..1a88c64 100644 --- a/.github/workflows/R-CMD-check.yaml +++ b/.github/workflows/R-CMD-check.yaml @@ -16,6 +16,8 @@ on: jobs: R-CMD-check: uses: ContextualWisdomLab/.github/.github/workflows/r-package-check.yml@816e3e4970fde4450585de2a7b8df7e2c5f82fe4 + permissions: + contents: read with: r_matrix: | [