ci: let @claude run R and file follow-up issues

[d-morrison]

Summary

Two capabilities for the @claude (Claude Code workflow) so it can do work that previously had to be hand-patched or trailed in PR comments.

R toolchain

• Install JAGS (apt-get) → r-lib/actions/setup-r@v2 → setup-r-dependencies@v2 with any::devtools, any::roxygen2, any::rjags.
• Extend claude_args --allowed-tools with Bash(Rscript:*), Bash(R:*), Bash(R CMD:*).

Motivation: @claude requests like "rerun devtools::document()" on PR #207 failed because the runner had no R toolchain and the Bash allowlist was git-only. Claude resorted to editing man/*.Rd by hand and the maintainer had to verify manually. See this thread.

Cost: ~1–3 min of extra setup time per @claude invocation when the dependency cache is warm; slower on cold cache. Acceptable for the tasks that need it.

Follow-up issue filing

• Bump permissions: issues: read → issues: write.
• Add Bash(gh issue:*) to the allowlist.

So Claude can open a tracking issue for deferred work instead of burying it in a PR comment that gets lost.

Out of scope

• The same expansion for claude-code-review.yml (auto-trigger on pull_request). Reviews are review-only and shouldn't be filing issues or running long install steps on every push.

Test plan

• After merge, @claude on a PR with a request like "regenerate the Rd for X" and confirm Claude runs devtools::document() rather than hand-editing the Rd.
• Ask @claude to "file a follow-up issue for $thing" and confirm the issue lands.
• Confirm cold-cache invocation time is acceptable (< 5 min added).

🤖 Generated with Claude Code

[claude]

Claude finished @d-morrison's task in 2m 0s —— View job

---

Code Review: PR #218 — ci: let @claude run R and file follow-up issues

Overall: The motivation is solid and the implementation is mostly clean. A few items worth addressing before merge.

---

Issues

1. Bash(R CMD:*) is redundant and potentially misleading

.github/workflows/claude.yml, line 136:

claude_args: '--allowed-tools "Bash(Rscript:*)" "Bash(R:*)" "Bash(R CMD:*)" "Bash(gh issue:*)"'

When a user runs R CMD check ., the executable is R and the arguments are CMD check .. Claude Code's tool allowlist matches against the command being executed, so Bash(R:*) already covers every R CMD ... invocation. The Bash(R CMD:*) entry either never matches (if the action does prefix-matching on just the executable name), or it's a strict subset of Bash(R:*) (if it does full-string prefix matching). Either way, it adds no coverage and may confuse readers who assume the three entries are non-overlapping.

Fix this →

---

2. R version is not pinned

.github/workflows/claude.yml, line 59–61:

- uses: r-lib/actions/setup-r@v2
  with:
    use-public-rspm: true

No r-version is specified, so this floats to whatever setup-r@v2 defaults to. Other workflows (test-coverage.yaml, copilot-setup-steps.yml) also don't pin it, but it's worth being intentional: a future R minor release could break something in the middle of a @claude run. Consider adding r-version: "release" (explicit float) or a specific version to match the other workflows, especially since this workflow installs packages from source.

---

3. Every @claude invocation pays the full R setup cost

As acknowledged in the PR description, all four setup steps (apt install, pandoc, R, dependencies) run unconditionally on every trigger — including simple tasks like updating a PR description or answering a question. On a cold cache this could add 5+ minutes to something that never touches R.

This is an accepted trade-off per the PR description ("Acceptable for the tasks that need it"), so not a blocker — just confirming it's intentional and flagging that the 5-min bound in the test plan may be optimistic on truly cold caches.

---

Looks Good

• Bash(gh issue:*) scope: Allowing gh issue (and only gh issue, not gh pr or gh repo) is appropriately scoped. Combined with issues: write, Claude can file/comment on issues without gaining broader repo write access.

• issues: write permission: The bump from read → write is minimal and the comment explaining the reason is helpful.

• findjags() case fix: Correct. The runjags function is findjags() (all lowercase), not findJAGS(). The fix in both test-coverage.yaml and copilot-setup-steps.yml is accurate.

• System lib list: Mirrors copilot-setup-steps.yml as stated. Good for reproducibility.

• needs: check in setup-r-dependencies: Appropriate if you want R CMD check to work; the extra-packages list (lintr, spelling, rcmdcheck) is well-chosen for the stated use cases.

• NEWS.md and WORDLIST: Both updated correctly.

---

Summary

One substantive fix (remove the redundant Bash(R CMD:*) entry) and one optional improvement (pin R version). The findjags() fixes and the follow-up-issue capability are clean additions.