[d-morrison]

Requested by Ezra · project thread

Why

The workflows here called r-lib/actions/...@v2, a floating tag. A re-pointed tag would run in this repository with no review. Morrison-Lab/gha already pins every r-lib action to the v2.14.0 commit, and this change matches it.

Part of Morrison-Lab/gha#1594.

What

Each r-lib/actions/<action>@v2 reference becomes @f9a764fea8d5c63df6ef9a5c7795bf7deb5d7e05 # v2.14.0 (the commit gha uses). 3 workflow files, no other change.

Checks

• grep -rn 'r-lib/actions.*@v2' .github has no match.
• The SHA is the v2.14.0 commit in r-lib/actions (git rev-parse f9a764f).

---

Generated by Claude Code

[github-actions]

Claude finished review — View run

---

I read PR #686 live just now. It is open, not a draft, not merged, and its head is still e45b505ace78cb492dc9648ba1e1486250381476, the commit I reviewed.

The review stands. The diff only pins four r-lib/actions references to the v2.14.0 SHA, and I found nothing to fix.

Verdict

Ready for merge

Structured Review Data (JSON)

{
  "schema_version": "1.1",
  "reviewer": "claude",
  "commit_sha": "e45b505ace78cb492dc9648ba1e1486250381476",
  "verdict": "CLEAN",
  "findings": [],
  "detailed_assessment": "Checked the three workflow files; the pinned SHA f9a764fe resolves to the r-lib/actions v2.14.0 tag and both setup-r and setup-pandoc live in that repo.",
  "holistic_assessment": "A pure supply-chain pinning change with no input changes and no content or math edits, so there is little regression risk to the publish and preview pipelines."
}

Reviewed commit: e45b505

[github-actions]

💰 Cost: $0.2087 (review) — run

[github-actions]

PR Preview Action v1.8.2
🚀 Preview available at: https://Morrison-Lab.github.io/mds/pr-preview/pr-686/

_{Built to branch gh-pages at 2026-11-07 21:17 UTC.}