Finish the gha migration and fix the Claude workflow startup failure

[d-morrison]

Closes #32

1. Fixes the Claude Code startup failure

Every Claude Code run on main since #30 concluded startup_failure --- nine
of them, most recently
33132530926.

Both Claude caller stubs pass an ANTHROPIC_API_KEY secret while pinned
@v1, and Morrison-Lab/gha only declares that secret at @v2. GitHub
rejects a workflow_call that passes a secret the callee does not declare,
before any job starts --- which is why the failure has no logs, no annotations,
and no check runs.

Repinned claude.yml, claude-code-review.yml, and news.yaml to @v2,
which is what the gha README says all three should be on anyway.

2. Migrates the remaining workflows gha models

removed	replacement
check-spelling.yaml (insightsengineering action in a rocker container)	spellcheck.yml@v2
lint-changed-files.yaml (hand-rolled lintr over whole changed files)	lint-changed-lines.yml@v2 (changed lines)
version-check.yaml (hand-rolled desc comparison)	version-check.yml@v2 + bump-dev-version.yml@v2

version-check inverts the old convention deliberately. A PR must now
leave DESCRIPTION's Version: alone, and bump-dev-version bumps it after
each merge to main --- two PRs both required to bump the same line are
guaranteed to collide. Bypass on a release PR with the no version increment
label (created in this pass, along with no changelog for the bump PR).

The repo already has the two settings that pair needs ("Allow GitHub Actions
to create and approve pull requests", "Allow auto-merge"), and main has no
required status checks, so no WORKFLOW_TOKEN is needed.

Unchanged, because gha models no equivalent: R-CMD-check.yaml,
R-check-docs.yml, check-readme.yaml, pkgdown.yaml, pr-commands.yaml,
copilot-setup-steps.yml, phase0-debug.yaml.

3. Adds the gha capabilities the repo was missing

lint-workflows, lint-yaml, lint-markdown, check-junk-files,
check-typos, check-secrets, check-links, check-phi,
check-new-line-breaks.

The three whole-tree linters start fail: false because this repo has
pre-existing drift; flipping them to blocking is tracked in #32. The rest are
diff-scoped or already clean against the current tree.

Verification

• actionlint over all 24 workflows: no errors (three pre-existing
  info-level shellcheck notes in copilot-setup-steps.yml and
  phase0-debug.yaml, untouched here).
• yamllint over every new file: clean.
• spelling::spell_check_package("."): No spelling errors found after
  adding PHI and gha to inst/WORDLIST.
• Every uses:, with: input, and secrets: entry checked against the
  Morrison-Lab/gha tree at the current v2 tag (d519c8b).

Deferred to #32

• test-coverage.yaml migration --- blocked on its CmdStan install/cache
  steps, which gha does not model. Those steps look vestigial (no .stan
  file is tracked on main, cmdstanr is not in DESCRIPTION), but Chapter 2: Stan Model 2 Kronecker simulation (restructure) #13 is
  an open Stan PR, so that is worth settling first.
• check-non-standard-chars.yml --- would fail today on em-dashes in
  .claude/skills/reprexes/SKILL.md (24 lines) and
  .github/copilot-instructions.md (16 lines), and the workflow has no
  paths-ignore input.
• check-ai-tells --- needs threshold tuning against this repo's research
  prose.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.

[d-morrison]

Adversarial review (codex CLI, GPT-5.1)

Reviewed commit: 69fb691 (before ca61080).
Dispatched headless against git diff origin/main...HEAD, with the
Morrison-Lab/gha checkout available for verification. Published as received;
findings and verdict are the reviewer's wording.

Findings

1. .github/workflows/check-junk-files.yml:14 --- check-junk-files.yml does
   not exist anywhere in Morrison-Lab/gha at tag v2; when triggered, GitHub
   rejects the reusable-workflow call and the junk-file check never runs.
2. .github/workflows/check-typos.yml:17 --- check-typos.yml does not exist
   anywhere in Morrison-Lab/gha at tag v2; every push, pull request, or
   manual invocation fails before performing typo detection.
3. .github/workflows/check-new-line-breaks.yml:7 --- the push and
   workflow_dispatch triggers cannot supply the PR base SHA required by the
   callee, whose implementation explicitly skips with exit code 0 when
   base-ref is empty; a direct push to main containing malformed semantic
   line breaks therefore reports success without checking anything.

Verdict: needs work

Posted by Claude Code (AI agent) --- not written by a human.

[d-morrison]

Dispositions

1 and 2 --- Rebutted. Both workflows do exist at v2. The reviewer read a
stale local tag; v2 had moved and needed git fetch --tags --force. Against
the current v2 (d519c8b, 2026-08-27), all sixteen reusable workflows this
PR calls resolve:

$ for w in check-junk-files check-typos check-secrets check-phi check-links \
    check-new-line-breaks lint-workflows lint-yaml lint-markdown \
    lint-changed-lines spellcheck version-check bump-dev-version check-news \
    claude claude-code-review; do
    git cat-file -e "v2:.github/workflows/$w.yml" && echo "OK $w"
  done
OK check-junk-files
OK check-typos
... (16/16)

Every with: input and secrets: entry the callers pass was re-derived
against that same tag.

3 --- Addressed, in ca61080, and extended to check-typos.yml, which has
the same shape. Both are now pull_request-only. The reviewer is right that a
push run reports success having examined nothing --- gha's own callee comment
says so explicitly ("on push there's no base to diff against, so the check is
skipped") --- so the push trigger was adding a green check on main that
measured nothing. This deviates from gha's example stub deliberately; a push
trigger becomes meaningful once base-ref: all is viable, which needs the
existing tree cleaned first.

Posted by Claude Code (AI agent) --- not written by a human.

[github-actions]

Claude finished review — View run

---

This confirms the PR's technical claim exactly: roxygen2 8.1.0 released 2026-08-04, matching the commit message's stated root cause for the docs-check failure. Nothing hallucinated here.

I have enough to finalize the review.

Code Review — UCD-SERG/shigella PR #33

Prior verdict: Ready for merge posted 2026-08-28T01:38:29Z, reviewing commit ca61080. That round found no defects and confirmed the migration's core claims (v1→v2 secret-declaration fix, all 16 reusable-workflow paths resolving at gha@v2, the diff-only-check trigger fix).

What changed since that round

One additional commit landed after ca61080: f2a328f ("Fix docs-check and the NEWS list-item splice"), touching only DESCRIPTION and NEWS.md:

• DESCRIPTION: replaces RoxygenNote: 8.0.0 with Config/roxygen2/version: 8.1.0.
• NEWS.md: inserts a blank line before the "Moved the Claude, Claude-review..." bullet (fixing a list-item splice) and adds a new bullet documenting the roxygen2 change.

Verification performed on the new commit

• roxygen2 field-rename claim. Verified via web search against Posit's official roxygen2 8.0.0 and 8.1.0 release notes: roxygen2 8.0.0 introduced Config/roxygen2/version to replace RoxygenNote (issue Plan transition from RoxygenNote to Config/Roxygen/... r-lib/roxygen2#1328), and roxygen2 auto-migrates the field on the next document()/roxygenise() run. roxygen2 8.1.0 was released 2026-08-04 — three weeks before this PR, and after this session's knowledge cutoff, which is why it wasn't already known; it is a real release, not a hallucination. This exactly matches the PR's stated root cause ("roxygen2 8.1.0 records its version in Config/roxygen2/version... roxygenise() rewrote DESCRIPTION on every run and docs-check went red").
• NEWS.md fix correctness. Diffed ca61080 → f2a328fd directly (git diff ca61080 f2a328fd -- NEWS.md) to confirm the actual single-commit change rather than inferring it from the cumulative PR diff: a blank line was inserted between the two multi-line bullets, which is the correct CommonMark fix for a list-item continuation immediately followed by a new item marker.
• Live CI confirmation, not just static review: gh pr checks 33 at the current head shows docs-check and lint / lint-markdown both passing, along with every other check (spellcheck, all three new lint-* callers, check-junk-files, check-typos, check-secrets, check-phi, check-new-line-breaks, link-checker, version-check, Check Changelog Action). This confirms both claimed fixes actually work, not merely that they look plausible.
• Re-read the full cumulative diff (.claude-review-pr.diff) end to end to make sure no other file changed in this round beyond the two above — confirmed.

Findings

None. The new commit is a small, correctly-targeted fix for two CI failures that were introduced by the previously-reviewed commit, both fixes are technically accurate (verified against upstream roxygen2 release notes) and confirmed working by passing CI, and no new workflow, input, or permissions concern was introduced.

Verdict

Ready for merge — the prior round's "Ready for merge" verdict (comment posted 2026-08-28T01:38:29Z, reviewing ca61080) stands and is reinforced: the one commit added since then fixes two real CI failures with a correct and verified change, all checks are now green, and no new issues were found.

Reviewed commit: f2a328f

[github-actions]

💰 Cost: $0.7219 (review) — run

[d-morrison]

Fully clean at f2a328f

• 27/27 checks green, including review / claude-review and require-review.
• Review verdict: Ready for merge, at this exact head. Two rounds; the
  second independently re-verified the first rather than inheriting it.
• mergeable: MERGEABLE, mergeStateStatus: CLEAN, zero unresolved threads.

The motivating bug is confirmed fixed by observation, not just by argument:
review / claude-review ran on this PR. Every Claude Code run on main
since #30 had concluded startup_failure before any job started.

Two failures surfaced on the first pushed head and were fixed in f2a328f:

• docs-check --- roxygen2 8.1.0 (2026-08-04) records its version in
  Config/roxygen2/version rather than RoxygenNote, so roxygenise()
  rewrote DESCRIPTION on every run. Pre-existing environmental drift, not
  this branch's doing (it last passed on main on 2026-07-28), but it blocked
  this PR, so it is fixed here.
• lint / lint-markdown --- the newly-added linter caught a real list-item
  merge splice in this branch's own NEWS.md entry. Note that fail: false
  does not cover it: the splice, long-code-block, and table-split companion
  checks each have their own toggle.

Not merging --- that is the repository owner's call.

Posted by Claude Code (AI agent) --- not written by a human.