[dem-extra1]

Adds a caller for the gha check-caller-permissions workflow (v3). A job that calls a reusable workflow without granting the permissions the callee's jobs request fails at startup with no log, which stopped lds's preview cleanup for a week (Morrison-Lab/lds#1468).

Run at the pinned refs, the check reports no missing grants in this repository today, so the PR adds only the guard.

---

Generated by Claude Code

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has insufficient remaining quota.

[github-actions]

Claude finished review — View run

---

No issues found. Checked for bugs and CLAUDE.md compliance.

The PR adds one caller workflow, .github/workflows/check-caller-permissions.yml. It has no math and no notes content, so the macro and Morrison-Lab content rules don't apply.

• Reusable workflow: Morrison-Lab/gha/.github/workflows/check-caller-permissions.yml exists in the local gha checkout and declares workflow_call.
• Inputs: every input has a default, so the bare uses: call works without a with: block.
• Permissions: the callee's job requests only contents: read, and the caller grants exactly that. This matches the purpose of the check.
• Pin: @v3 matches the other gha callers in this repo (check-dependency-graph.yml, claude-code-review.yml). The local gha checkout's git tag output didn't list v3, so I couldn't confirm the tag from that checkout. Since the other callers already use @v3, I treated it as fine.
• Triggers: the push-to-main, path-filtered pull_request and workflow_dispatch triggers are consistent with the header comment.
• Build hygiene: no _site/, _freeze/ or .quarto/ files are committed.

I didn't see the workflow in a live run; this comes from reading the diff and the gha source.

Verdict

Ready for merge

Structured Review Data (JSON)

{
  "schema_version": "1.1",
  "reviewer": "claude",
  "commit_sha": "cc1016258878cd0a908fc1a9dc32391b41355b71",
  "verdict": "CLEAN",
  "findings": [],
  "detailed_assessment": "The new caller workflow check-caller-permissions.yml grants contents: read, which matches the callee job's permissions, and relies on input defaults that exist in the gha reusable workflow.",
  "holistic_assessment": "A single-file addition consistent with the other gha v3 callers in this repo, with sensible triggers, no scope creep, and no build-artifact or regression concerns."
}

Reviewed commit: cc10162

[github-actions]

💰 Cost: $0.1562 (review) — run

[github-actions]

PR Preview Action v1.8.1-2-g6ad689f
🚀 View preview at https://Morrison-Lab.github.io/cie/pr-preview/pr-50/
Built to branch gh-pages at 2026-10-27 05:03 UTC. Preview will be ready when the GitHub Pages deployment is complete.

[dem-extra1]

🤖 Antigravity agent report

Cross-harness review (Argon: Gemini 4 Argon (Medium) via Antigravity agy 1.3.5, read-only plan mode) at cc10162

Checked for correctness, Quarto syntax and crossrefs, consistency with the PR description, lost or duplicated content, and style, from the diff alone. Not checked: the rendered page.

Verdict

VERDICT: CLEAN

Reviewed-Commit: cc10162

Posted by Claude Code (AI agent) --- not written by a human.