Migrate claude.yml, claude-code-review.yml, and publish.yml to Morrison-Lab/gha reusable workflows

[d-morrison]

Refs #81. First of two legs; the preview leg is #82, blocked on Morrison-Lab/gha#607.

Replaces three stock hand-rolled workflow templates with caller stubs targeting Morrison-Lab/gha's reusable workflows at @v2.

What changes

File	Before	After
claude.yml	stock anthropics/claude-code-action@v1 template	gha/.github/workflows/claude.yml@v2
claude-code-review.yml	stock template, auto-review on every PR sync	gha/.github/workflows/claude-code-review.yml@v2
publish.yml	hand-rolled render + JamesIves/github-pages-deploy-action	gha/.github/workflows/quarto-publish.yml@v2 + report-failure.yml@v2

preview.yml is untouched — see the blocker below.

Notable decisions

setup-r: false on claude.yml. The input defaults to true, and with use-renv false it runs setup-r-dependencies, whose default local::. spec resolves against a DESCRIPTION. This repo is a Quarto site, not an R package, so that step would fail on every agent run. Rendering is CI's job.

No pull_request trigger on claude-code-review.yml. claude.yml re-dispatches a review after the agent pushes commits, so an agent-authored PR is still reviewed automatically. Keeping a synchronize trigger alongside that dispatch would race it, and the reusable workflow's cancel-in-progress concurrency would cancel one of the two. A human-authored PR gets a review via /review.

tinytex: true kept on publish.yml. The input defaults to false, and _quarto.yml declares format: html only, so dropping it looks safe. It is not: demo-shortcode.qmd and demo-include-in-header.qmd each override the project format with their own pdf: front matter, and demonstrating the macros reaching the LaTeX preamble is the entire point of those two pages.

Secrets passed explicitly everywhere. This repo is d-morrison-owned and gha is Morrison-Lab-owned. GitHub only inherits secrets into a reusable workflow owned by the same org/user, so secrets: inherit would hand each workflow an empty token.

What this buys

• A trusted-author gate on the agent. The stock claude.yml fired on an @claude mention from anyone, with no author_association check.
• Write permissions for the agent, which currently holds contents: read and so cannot push a branch or open a PR at all.
• The Morrison-Lab/ai-config plugin in both agent workflows, so the bot follows lab conventions.
• Pinned action SHAs throughout, versus floating @v4/@v2 tags.
• Serialized gh-pages deploys, and an auto-filed issue when a publish breaks.

Blocker on the remaining leg

gha's preview composite installs R but has no r-packages input, so a Quarto site that is neither an renv project nor an R package cannot get knitr/rmarkdown/DT onto the runner. Filed as Morrison-Lab/gha#607; the preview migration and check-equation-renders.yml (a headless-browser MathJax check, which is the single most relevant check available to this repo) are tracked in #82 behind it.

Verification

• actionlint clean on all four workflow files.
• YAML parses; every referenced input, secret, and job name checked against the reusable workflows at the v2 tag (9ad1cde).
• CLAUDE_CODE_OAUTH_TOKEN confirmed present on this repo.

Note that the review path for this PR itself runs from main's workflows, since the new stubs are not on the default branch yet.

[d-morrison]

Self-review

Posted as a fallback: this PR removes the pull_request trigger from claude-code-review.yml, and for pull_request events GitHub runs the workflow file from the PR's own branch, so no Claude review can fire on this PR. The repo's main ruleset does carry a copilot_code_review rule with review_on_push: true, so a cross-vendor review is expected here independently.

Performed inline rather than by an independent reviewer subagent — no adversarial-reviewer agent type is available in this session — so weight it accordingly.

Findings

1. tinytex: true was dropped, then restored (fixed in e79686f). The project-level _quarto.yml declares format: html only, which made the TinyTeX install look cargo-culted. It is not: demo-shortcode.qmd and demo-include-in-header.qmd each override the project format with their own pdf: front matter. Publishing would have started failing on the first push to main after merge.

2. gh-pages deploys become force pushes (non-blocking). The old publish.yml passed force: false to JamesIves/github-pages-deploy-action. gha's quarto-publish.yml sets clean: true and clean-exclude: pr-preview/ but leaves force at the action's default of true.

clean-exclude preserves whatever pr-preview/ content existed as of the deploy job's checkout, so the ordinary case is unaffected. The exposure is a preview deploy landing on gh-pages between that checkout and the force push, which would be discarded rather than rebased over. The two workflows do not share a concurrency group — quarto-publish.yml uses gh-pages, preview-deploy.yml uses a per-branch group — so nothing serializes them.

This is how every gha consumer already behaves, so it is a property of the shared workflow rather than of this migration, and it is out of scope for this PR under the adjacent-work boundary. Filed rather than deferred silently: Morrison-Lab/gha#611.

Verified

• Every caller permissions: block matches the reusable workflow's own job declarations exactly: claude.yml (contents/pull-requests/issues/id-token/actions all write), claude-code-review.yml's review job (contents read, pull-requests/issues/id-token write, actions read, plus the subsets gather-context needs and require-review's empty set), publish.yml (contents write for the deploy job, issues write for report-failure).
• Every secret is declared required: false upstream, so passing only CLAUDE_CODE_OAUTH_TOKEN does not hard-fail at the call gate.
• quarto-publish's composite passes r-packages to setup-r-dependencies as packages:, not extra-packages:, so it replaces the default deps::. spec rather than adding to it. That is what makes setup-r: true work without a DESCRIPTION.
• review-workflow-file defaults to claude-code-review.yml, matching this repo's filename, so claude.yml's post-push review dispatch resolves.
• reviewer already defaults to d-morrison upstream, so no caller override is needed.
• actionlint 1.7.12 clean on all four workflow files; all parse as YAML.
• The v2 tag resolves to 9ad1cde, and both referenced composite actions (parse-workflow-ref, detect-review-request) exist under .github/actions/ there.
• No required status checks on main (the ruleset requires zero approvals and thread resolution only), so dropping the pull_request review trigger does not strand this or any future PR.

[github-actions]

PR Preview Action v1.8.1
Preview removed because the pull request was closed.