[dem-extra1]

Adds a caller for gha's check-caller-permissions workflow (@v3). The workflow fails when a job calls a Morrison-Lab/gha reusable workflow without granting the permissions that the called workflow's jobs request. It runs on pull requests that change workflow files, on pushes to main, and on manual dispatch. GitHub rejects such a call at startup with no log, as it did for lds's preview cleanup (Morrison-Lab/lds#1468).

The NEWS.md entry covers the repository's changelog check.

Correction: an earlier revision also added permission grants and said the check found them missing. That came from running the check against gha main, not the refs this repository pins. At the pinned refs the check reports no missing grant, so those grants are removed.

🤖 Generated with Claude Code

https://claude.ai/code/session_01Dmqa3hWsgjovnGyT7qANYK

[github-actions]

Claude finished review — View run

---

Both changes match the callee's needs. The new caller grants contents: read, which is all the callee requests. claude-code-review.yml now grants checks: read, which the reusable workflow says it reinstated for v3 (gha#833).

Findings

No blocking findings. I saw nothing to flag for this PR's changes. The checks were:

• New workflow: .github/workflows/check-caller-permissions.yml is new and calls Morrison-Lab/gha/.github/workflows/check-caller-permissions.yml@v3. That callee exists in the reference checkout. I did not check that the @v3 tag carries it.
• Permissions: the callee's only job requests contents: read, and the caller grants exactly that. The same tightening is what the new check enforces.
• Review workflow: claude-code-review.yml gains checks: read, which the callee's review job needs to read check runs.
• Not applicable: the diff touches no R code, math, or notes content. Neither workflow edit is user-facing, so no NEWS.md entry is needed.
• Not run: I did not run any workflows. The workflow files on disk are the default-branch copies, so I reviewed this from the saved diff.

Optional: the pull_request trigger filters on .github/workflows/**. A change to the @v3 tag wouldn't be caught by it. That's inherent to the design, and I'm not asking for a change.

Verdict

Ready for merge

Structured Review Data (JSON)

{
  "schema_version": "1.1",
  "reviewer": "claude",
  "commit_sha": "e12a19f41d252a3d00d04112c3c06a59db2880eb",
  "verdict": "CLEAN",
  "findings": [],
  "detailed_assessment": "The new check-caller-permissions.yml grants contents: read, matching the callee's single job permission, and claude-code-review.yml adds checks: read which the callee review job requires.",
  "holistic_assessment": "The change is small and scoped to CI permissions and one new caller workflow, with no R code, docs, or NEWS impact and no regression risk identified."
}

Reviewed commit: e12a19f

[github-actions]

💰 Cost: $0.1629 (review) — run

[dem-extra1]

🤖 Antigravity agent report

Cross-harness review (Argon: Gemini 4 Argon (Medium) via Antigravity agy 1.3.5, read-only plan mode) at e12a19f

These come from the other model and I have not independently verified each one against the files, so treat them as leads. The review used the diff only (long diffs are truncated at 24000 characters); nothing was rendered.
The PR head has moved since this review (reviewed e12a19f); a later read of the current head supersedes this one.

Findings

1. Unscoped push trigger vs. path-filtered pull_request trigger — pull_request restricts runs to .github/workflows/**, but push to main has no paths filter and runs on every commit to main even when no workflows changed:

   push: / branches: / - main / pull_request: / paths: / - '.github/workflows/**'

2. Cross-repo issue reference missing owner prefix in workflow comment — In Morrison-Lab/rpt, bare lds#1468 does not resolve to Morrison-Lab/lds#1468:

   # call at startup, so a scheduled caller stops silently (lds#1468); this catches

3. Ambiguous pronouns (this, it) in header comment — Bare this and it in # it at pull-request time. have multiple candidate antecedents (call, scheduled caller, or the missing permission grant); prefer # this workflow catches the missing permission at pull-request time.:

   # call at startup, so a scheduled caller stops silently (lds#1468); this catches / # it at pull-request time.

4. Unexplained checks: read alongside commented actions: read — actions: read documents why the reviewer needs it (# lets the reviewer read CI status (github_ci MCP server)), while checks: read is added right below for the same purpose without updating or sharing the comment:

   actions: read # lets the reviewer read CI status (github_ci MCP server) / + checks: read

Verdict

VERDICT: FINDINGS

Reviewed-Commit: e12a19f

Posted by Claude Code (AI agent) --- not written by a human.

[dem-extra1]

🤖 Antigravity agent report

Cross-harness review (Argon: Gemini 4 Argon (Medium) via Antigravity agy 1.3.5, read-only plan mode) at 8b2f3b7

These come from the other model and I have not independently verified each one against the files, so treat them as leads. The review used the diff only (long diffs are truncated at 24000 characters); nothing was rendered.

Findings

1. NEWS.md:3-5 — Ambiguous relative pronoun (which) with no clear noun antecedent:

   * Added a \check-caller-permissions` workflow that fails a pull request when a job calls a `Morrison-Lab/gha` reusable workflow without granting the permissions the called workflow's jobs request, which GitHub rejects at startup with no log. whichfollowsthe permissions the called workflow's jobs request, making requestorpermissions` the grammatical antecedent, whereas GitHub actually rejects the under-permissioned workflow call (cf. the YAML comment and PR body: "GitHub rejects such a call at startup").

2. NEWS.md:3 and PR body — Overly narrow description of when the workflow fails:

   * Added a \check-caller-permissions` workflow that fails a pull request when a job calls aBothNEWS.mdand the PR body ("It fails a pull request when...") state only that the workflow fails a pull request, but.github/workflows/check-caller-permissions.ymlalso triggers onpushtomain(specifically to catch a movedghatag) andworkflow_dispatch`.

Verdict

VERDICT: FINDINGS

Reviewed-Commit: 8b2f3b7

Posted by Claude Code (AI agent) --- not written by a human.

[github-actions]

PR Preview Action v1.8.1
🚀 View preview at https://Morrison-Lab.github.io/rpt/pr-preview/pr-206/
Built to branch gh-pages at 2026-10-27 05:12 UTC. Preview will be ready when the GitHub Pages deployment is complete.

[dem-extra1]

🤖 Antigravity agent report

Cross-harness review (Argon: Gemini 4 Argon (Medium) via Antigravity agy 1.3.5, read-only plan mode) at 785f1d8

Checked for correctness, Quarto syntax and crossrefs, consistency with the PR description, lost or duplicated content, and style, from the diff alone. Not checked: the rendered page.

Verdict

VERDICT: CLEAN

Reviewed-Commit: 785f1d8

Posted by Claude Code (AI agent) --- not written by a human.