Finish the gha migration and fix the Claude workflow startup failure

.github/workflows/bump-dev-version.yml

@@ -0,0 +1,24 @@
+# Calls Morrison-Lab/gha's bump-dev-version workflow: bumps DESCRIPTION's
+# dev-version counter after every merge to main and auto-merges the one-line
+# PR that carries it. Pairs with version-check.yml, which fails a PR that
+# touches Version: itself.
+#
+# The repo already has both settings this needs: Settings -> Actions ->
+# General -> "Allow GitHub Actions to create and approve pull requests", and
+# Settings -> General -> "Allow auto-merge". No WORKFLOW_TOKEN is needed
+# because main has no required status checks -- add one if that changes.
+name: Bump dev version
+
+on:
+  push:
+    branches: [main]
+
+jobs:
+  bump:
+    permissions:
+      contents: write
+      pull-requests: write
+    uses: Morrison-Lab/gha/.github/workflows/bump-dev-version.yml@v2
+    with:
+      # Keeps news.yaml from demanding a NEWS.md entry on the automation PR.
+      pr-labels: 'no changelog'

.github/workflows/check-junk-files.yml

@@ -0,0 +1,14 @@
+# Fails when the repository tracks OS or editor detritus (.DS_Store,
+# AppleDouble ._*, .Rhistory, .RData, Thumbs.db). The tree is clean of these
+# today; this keeps it that way.
+name: Check Junk Files
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+    branches: [main]
+
+jobs:
+  check:
+    uses: Morrison-Lab/gha/.github/workflows/check-junk-files.yml@v2

.github/workflows/check-links.yml

@@ -0,0 +1,21 @@
+# lychee link check, with a weekly cron to catch link rot and an auto-filed
+# issue when links break on main.
+name: Check Links
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+    types: [opened, synchronize, reopened, labeled, unlabeled]
+  schedule:
+    # Weekly, Mondays at 9:00 UTC.
+    - cron: '0 9 * * 1'
+  workflow_dispatch:
+
+jobs:
+  check:
+    permissions:
+      contents: read
+      issues: write
+      pull-requests: read
+    uses: Morrison-Lab/gha/.github/workflows/check-links.yml@v2

.github/workflows/check-new-line-breaks.yml

@@ -0,0 +1,16 @@
+# Diff-scoped check: flags newly-added Markdown lines packing more than one
+# sentence or clause onto a single source line, so new prose lands with
+# semantic line breaks.
+#
+# pull_request only, deliberately, for the same reason as check-typos.yml:
+# gha derives the base from the pull_request event and skips (reporting
+# success) when there is none, so a push trigger would add a green check on
+# main that examined nothing.
+name: Check new markdown lines for missing semantic breaks
+
+on:
+  pull_request:
+
+jobs:
+  check:
+    uses: Morrison-Lab/gha/.github/workflows/check-new-line-breaks.yml@v2

.github/workflows/check-phi.yml

@@ -0,0 +1,21 @@
+# Scans for content that looks like Protected Health Information -- SSNs,
+# medical record numbers, dates of birth, study/participant identifier
+# literals, PHI column headers in data files. On PRs only the added lines are
+# scanned; on push the whole tree is.
+#
+# Worth having here specifically: this repo carries Shigella serology data and
+# grows chapter-level analysis code on long-lived branches.
+#
+# Suppress a synthetic-data false positive with a `phi-allow` comment on the
+# line, or a regex in .github/phi-allowlist.txt.
+name: Check for PHI
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+  workflow_dispatch:
+
+jobs:
+  check:
+    uses: Morrison-Lab/gha/.github/workflows/check-phi.yml@v2

.github/workflows/check-secrets.yml

@@ -0,0 +1,17 @@
+# Scans the repository's git HISTORY for committed credentials with gitleaks.
+# History rather than the diff: a secret committed and later removed is still
+# exposed, because the orphaned commit stays fetchable until GC.
+#
+# Complements GitHub's own secret scanning rather than replacing it, and
+# neither substitutes for ROTATING an exposed credential.
+name: Check for secrets
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+  workflow_dispatch:
+
+jobs:
+  check:
+    uses: Morrison-Lab/gha/.github/workflows/check-secrets.yml@v2

.github/workflows/check-typos.yml

@@ -0,0 +1,16 @@
+# Diff-scoped spellcheck of the files spellcheck.yml cannot see: Quarto pages,
+# CONTRIBUTING.md-class Markdown, YAML, and code comments. Uses crate-ci/typos,
+# a corrections-list checker, so it needs no curated wordlist.
+#
+# pull_request only, deliberately. The workflow diffs against the PR base, and
+# a push run has no base to diff against -- gha skips it and reports success,
+# which would put a green check on main that examined nothing. Pass
+# `base-ref: all` and re-add a push trigger once the existing tree is clean.
+name: Check typos
+
+on:
+  pull_request:
+
+jobs:
+  check:
+    uses: Morrison-Lab/gha/.github/workflows/check-typos.yml@v2

.github/workflows/claude-code-review.yml

@@ -28,7 +28,7 @@
       issues: write
       id-token: write
       actions: read   # lets the reviewer read CI status (github_ci MCP server)
-    uses: Morrison-Lab/gha/.github/workflows/claude-code-review.yml@v1
+    uses: Morrison-Lab/gha/.github/workflows/claude-code-review.yml@v2
     secrets:
       CLAUDE_CODE_OAUTH_TOKEN: ${{ secrets.CLAUDE_CODE_OAUTH_TOKEN }}   # Max-plan OAuth; empty when using API key
       ANTHROPIC_API_KEY: ${{ secrets.ANTHROPIC_API_KEY }}               # direct API key; empty when using OAuth
@@ -37,7 +37,7 @@
       # Wires the workflow_dispatch input through so claude.yml can re-dispatch
       # a review on Claude's commits; empty (and ignored) for pull_request runs.
       pr-number: ${{ inputs.pr_number }}
     # with:
     #   checkout-submodules: true   # SUBMODULES_TOKEN secret only for private submodules
     #   allowed-bots: 'github-actions[bot],claude'   # accept more bot actors (default: github-actions[bot])
     #   prompt-addendum: |

.github/workflows/claude.yml

@@ -38,13 +38,13 @@
       issues: write
       id-token: write
       actions: write       # dispatch the review workflow via `gh workflow run`
-    uses: Morrison-Lab/gha/.github/workflows/claude.yml@v1
+    uses: Morrison-Lab/gha/.github/workflows/claude.yml@v2
     secrets:
       CLAUDE_CODE_OAUTH_TOKEN: ${{ secrets.CLAUDE_CODE_OAUTH_TOKEN }}   # Max-plan OAuth; empty when using API key
       ANTHROPIC_API_KEY: ${{ secrets.ANTHROPIC_API_KEY }}               # direct API key; empty when using OAuth
       SUBMODULES_TOKEN: ${{ secrets.SUBMODULES_TOKEN }}   # optional; empty when unset
       WORKFLOW_TOKEN: ${{ secrets.WORKFLOW_TOKEN }}       # optional; for editing .github/workflows
     # with:
     #   setup-r: true               # default; set false for non-R repos
     #   install-quarto: true        # for Quarto books
     #   use-renv: true              # restore deps with renv instead of DESCRIPTION

.github/workflows/lint-changed-lines.yml

@@ -0,0 +1,17 @@
+# Calls Morrison-Lab/gha's lint-changed-lines workflow. Replaces the
+# hand-maintained lint-changed-files.yaml, which linted whole changed files;
+# this lints only the lines a PR adds or modifies, so lint rules can be
+# tightened incrementally without a whole-repo cleanup first.
+#
+# The old workflow's `R CMD INSTALL .` step is the workflow's own
+# `install-package` default, so no inputs are needed here.
+#
+# Must be triggered by pull_request -- the changed-line set comes from the PR.
+name: lint-changed-lines
+
+on:
+  pull_request:
+
+jobs:
+  lint:
+    uses: Morrison-Lab/gha/.github/workflows/lint-changed-lines.yml@v2

.github/workflows/lint-markdown.yml

@@ -0,0 +1,21 @@
+# Lints tracked Markdown with markdownlint-cli2, plus companion checks for
+# long fenced code blocks, list-item merge splices, and blank lines that split
+# a table.
+#
+# Warn-only for now, for the same pre-existing-backlog reason as
+# lint-workflows.yml (tracked in #32).
+name: Lint Markdown
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+  workflow_dispatch:
+
+jobs:
+  lint:
+    uses: Morrison-Lab/gha/.github/workflows/lint-markdown.yml@v2
+    with:
+      fail: false
+      # Diff-scopes the list-item splice check to what a PR actually adds.
+      base-ref: ${{ github.event.pull_request.base.sha }}

.github/workflows/lint-workflows.yml

@@ -0,0 +1,19 @@
+# Audits GitHub Actions workflows and composite actions with actionlint
+# (syntax/semantics) and zizmor (security).
+#
+# Warn-only for now: this repo carries a pre-existing backlog of workflow
+# findings, and a blocking check would go red on unrelated PRs. Flip
+# `fail: true` once that backlog is cleared (tracked in #32).
+name: Lint Workflows
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+  workflow_dispatch:
+
+jobs:
+  lint:
+    uses: Morrison-Lab/gha/.github/workflows/lint-workflows.yml@v2
+    with:
+      fail: false

.github/workflows/lint-yaml.yml

@@ -0,0 +1,18 @@
+# Lints tracked YAML with yamllint, plus a companion check that flags long
+# `run:` script blocks as decomposition candidates.
+#
+# Warn-only for now, for the same pre-existing-backlog reason as
+# lint-workflows.yml (tracked in #32).
+name: Lint YAML
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+  workflow_dispatch:
+
+jobs:
+  lint:
+    uses: Morrison-Lab/gha/.github/workflows/lint-yaml.yml@v2
+    with:
+      fail: false

.github/workflows/news.yaml

@@ -9,6 +9,6 @@ on:
 
 jobs:
   check:
-    uses: Morrison-Lab/gha/.github/workflows/check-news.yml@v1
+    uses: Morrison-Lab/gha/.github/workflows/check-news.yml@v2
     # with:
     #   changelog: NEWS.md

.github/workflows/spellcheck.yml

@@ -0,0 +1,21 @@
+# Calls Morrison-Lab/gha's spellcheck workflow. Replaces the hand-maintained
+# check-spelling.yaml, which ran insightsengineering/r-spellcheck-action in a
+# rocker/tidyverse container.
+#
+# Reference:
+# https://morrison-lab.github.io/gha/reference/spellcheck.html
+name: Spellcheck
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+
+concurrency:
+  group: spellcheck-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  spellcheck:
+    uses: Morrison-Lab/gha/.github/workflows/spellcheck.yml@v2
+    # Accepts this package's own inst/WORDLIST.