[dem-extra1]

Adds a caller for gha's check-caller-permissions workflow (@v3). It fails a pull request when a job calls a Morrison-Lab/gha reusable workflow without granting the permissions the callee's jobs request. GitHub rejects such a call at startup with no log, as it did for lds's preview cleanup (Morrison-Lab/lds#1468).

Correction: an earlier revision also added permission grants and said the check found them missing. That came from running the check against gha main, not the refs this repository pins. At the pinned refs the check reports no missing grant, so those grants are removed.

🤖 Generated with Claude Code

https://claude.ai/code/session_01Dmqa3hWsgjovnGyT7qANYK

[dem-extra1]

🤖 Antigravity agent report

Cross-harness review (Argon: Gemini 4 Argon (Medium) via Antigravity agy 1.3.5, read-only plan mode) at 157bfde

Checked for correctness, Quarto syntax and crossrefs, consistency with the PR description, lost or duplicated content, and style, from the diff alone. Not checked: the rendered page.

Verdict

VERDICT: CLEAN

Reviewed-Commit: 157bfde

Posted by Claude Code (AI agent) --- not written by a human.

[github-actions]

Claude finished review — View run

---

Review of #1417

Summary: Adds .github/workflows/check-caller-permissions.yml, a thin caller for Morrison-Lab/gha's reusable check-caller-permissions workflow (pinned @v3). It fails CI when a job in this repo calls a Morrison-Lab/gha reusable workflow without granting a permission the callee's jobs request — the kind of mismatch that otherwise fails silently at GitHub's job-startup stage (cited precedent: Morrison-Lab/lds#1468). This is the only file touched; an earlier commit on the branch also added a speculative actions: read grant to cleanup-pr-previews.yml, but the author later ran the check against the pinned callee refs, found it wasn't actually required, and reverted it (171f7058) — the final diff is just the one new file.

Verification performed:

• Confirmed the referenced reusable workflow (Morrison-Lab/gha/.github/workflows/check-caller-permissions.yml@v3) and its underlying composite action (Morrison-Lab/gha/check-caller-permissions@v3) both exist and are reachable at the pinned tag — not a hallucinated reference.
• Confirmed the callee's own job requests only contents: read, exactly matching the grant in the new caller file — self-consistent, no mismatch.
• Validated the YAML parses correctly.
• Diffed the file against the sibling check-dependency-graph.yml, which follows the identical pattern (job named check, permissions: contents: read, uses: a pinned @vN tag of a Morrison-Lab/gha reusable workflow) — this PR matches established repo convention exactly.
• Checked live CI on this PR head: check / check-caller-permissions and lint / lint-workflows both pass, so the new workflow is syntactically valid and (fittingly) doesn't flag itself.
• Could not independently resolve Morrison-Lab/lds#1468 via gh (repo not resolvable with this token — likely a private sibling notes repo, consistent with other Morrison-Lab/<3-letter> repos named in CLAUDE.md like pds/sds). Not flagging as fabricated — it reads as a genuine cross-repo incident reference the token simply can't access, not an invented one.
• A cross-harness Antigravity/Gemini review already posted "CLEAN" at commit 157bfdea. I diffed 157bfdea..d75ad56f (the current head) and confirmed the only changes since are comment-text clarifications (qualifying the issue reference and explaining the push trigger's lack of a path filter) plus the permission-grant revert in 171f7058 — nothing that would change that verdict.

CLAUDE.md / lab-manual compliance:

• Pure .github/ infra change, not mixed with book content — satisfies "Workflow / .github/ / CI / infra changes go in their own dedicated PRs."
• No .qmd/.R/math changes, so the pre-commit render/lint/spellcheck checklist, LaTeX macro checks, and SERG R-style rules don't apply here.
• No _subfiles/ touched, so no "clear freezer" label needed.

No bugs, security issues, or convention violations found.

Verdict

Ready for merge

Structured Review Data (JSON)

{
  "schema_version": "1.1",
  "reviewer": "claude",
  "commit_sha": "d75ad56f035abbe179ca9d9558773bf2f4bde5af",
  "verdict": "CLEAN",
  "findings": [],
  "detailed_assessment": "The sole changed path, .github/workflows/check-caller-permissions.yml, mirrors check-dependency-graph.yml's established caller pattern exactly and grants only the contents:read permission its pinned v3 callee actually requests, so no permission-mismatch or syntax defect exists.",
  "holistic_assessment": "Scope stays confined to infra per the dedicated-PR requirement, integration with the pinned Morrison-Lab/gha v3 reusable workflow and action is verified live, and CI on this exact head already passed both check-caller-permissions and lint-workflows, satisfying validation."
}

Reviewed commit: d75ad56

[github-actions]

💰 Cost: $0.4655 (review) — run

[dem-extra1]

🤖 Antigravity agent report

Cross-harness review (Argon: Gemini 4 Argon (Medium) via Antigravity agy 1.3.5, read-only plan mode) at d75ad56

Checked for correctness, Quarto syntax and crossrefs, consistency with the PR description, lost or duplicated content, and style, from the diff alone. Not checked: the rendered page.

Verdict

VERDICT: CLEAN

Reviewed-Commit: d75ad56

Posted by Claude Code (AI agent) --- not written by a human.