The second half of #178. That issue's scope lists both claude-code-review.yml (migrated in #181, which closes #178) and claude.yml; splitting the claude.yml half here so it isn't silently dropped when #181 closes #178.
Migrate rpt's bespoke anthropics/claude-code-action@v1 @claude agent workflow to a thin caller of Morrison-Lab/gha/.github/workflows/claude.yml@v2, matching serodynamics / ai-config.
Two behavior changes this migration makes (flagged for a decision at review)
- Read-only -> write-capable. rpt's current
claude.yml grants contents: read, so @claude can comment but not push commits. The reusable agent is write-capable (push branches, open PRs). This is an intentional capability upgrade; veto here if @claude on the template should stay advisory-only.
- Adds a trusted-author gate. The current workflow gates only on
contains(@claude) with no author_association check, so any commenter can invoke it. The reusable stub gates on OWNER/MEMBER/COLLABORATOR --- which is what makes the contents: write upgrade safe. (These two are coupled: write access without the author gate would be a hole.)
Reviewer-toggling difference (the issue's Gap 2, for claude.yml)
Bespoke: removes d-morrison while Claude works, re-adds after. Reusable: re-requests the reviewer (default d-morrison) when Claude pushes commits (and dispatches a fresh review). Not identical, but the closest thin-caller equivalent; adding remove-while-working caller-side jobs would defeat the point of migrating. rme deliberately kept its bespoke claude.yml, so there's precedent for not migrating too.
Planned inputs
setup-r: true (default; DESCRIPTION-based deps, matching rpt CI's setup-r-dependencies), install-quarto: true (rpt uses Quarto for vignettes/website), use-renv: false (default; rpt CI is DESCRIPTION-based despite the lockfile), reviewer: d-morrison, and rpt's R-package pre-commit checklist via prompt-addendum.
The second half of #178. That issue's scope lists both
claude-code-review.yml(migrated in #181, which closes #178) andclaude.yml; splitting theclaude.ymlhalf here so it isn't silently dropped when #181 closes #178.Migrate rpt's bespoke
anthropics/claude-code-action@v1@claudeagent workflow to a thin caller ofMorrison-Lab/gha/.github/workflows/claude.yml@v2, matching serodynamics / ai-config.Two behavior changes this migration makes (flagged for a decision at review)
claude.ymlgrantscontents: read, so@claudecan comment but not push commits. The reusable agent is write-capable (push branches, open PRs). This is an intentional capability upgrade; veto here if@claudeon the template should stay advisory-only.contains(@claude)with noauthor_associationcheck, so any commenter can invoke it. The reusable stub gates onOWNER/MEMBER/COLLABORATOR--- which is what makes thecontents: writeupgrade safe. (These two are coupled: write access without the author gate would be a hole.)Reviewer-toggling difference (the issue's Gap 2, for claude.yml)
Bespoke: removes
d-morrisonwhile Claude works, re-adds after. Reusable: re-requests thereviewer(defaultd-morrison) when Claude pushes commits (and dispatches a fresh review). Not identical, but the closest thin-caller equivalent; adding remove-while-working caller-side jobs would defeat the point of migrating. rme deliberately kept its bespokeclaude.yml, so there's precedent for not migrating too.Planned inputs
setup-r: true(default; DESCRIPTION-based deps, matching rpt CI'ssetup-r-dependencies),install-quarto: true(rpt uses Quarto for vignettes/website),use-renv: false(default; rpt CI is DESCRIPTION-based despite the lockfile),reviewer: d-morrison, and rpt's R-package pre-commit checklist viaprompt-addendum.