[sbalci]

Summary

• Add one Ubuntu / R release validation job for pull requests, master pushes and manual dispatch.
• Install module-local dependencies with public binaries where available and preserve the dependency cache even when validation fails.
• Run a real R CMD check (including examples and tests), then source-tree testthat tests so dependency audits can inspect R/ sources and NAMESPACE.
• Retain package-check artifacts, cancel superseded runs and use read-only repository permissions.
• Leave analyses, exports, existing tests and skips, documentation and release workflows unchanged.

Validation

• Passed actionlint 1.7.12, YAML/behavior assertions and git diff --check.
• R/Rscript are unavailable in the preparation workspace; the first GitHub Actions run will provide runtime validation.
• Based on master commit 609b641ce29942937686e78d69c230701d76d45a.

This draft intentionally exposes the package's current baseline. Source-tree tests run after a failed package check when dependency setup succeeded, and neither failure is suppressed. Existing skips remain in place, including the test for pending umbrella-only analyses. Manual generation, vignettes and broader --as-cran checks are omitted to keep this initial validation focused.

[sbalci]

Verdict: approve the workflow. The red run is a pre-existing false positive in a test, not a problem with this file.

• R CMD check passed (1 NOTE).
• The only failure is the dependency guard that the umbrella generates (test-zzz-dependency-declaration.R:527).
  • It flags atop in as.expression(bquote(atop(.(expr), .(text)))) at R/utils-ggstatsplot.R:157.
  • That is plotmath inside bquote(): R never evaluates it, and nothing exports it. So the suggested importFrom fix is impossible.
• Fix it in the umbrella's _updateModules_test_dependency_guard.R and regenerate.
  • Prefer exempting plotmath tokens over skipping quote()/bquote() bodies wholesale.
  • Skipping those bodies would also stop checking evaluated templates such as eval(bquote(.(d) %>% head())). That is exactly the bare-%>% shape this guard exists to catch.
  • The updater's verify_module() evaluates the same guard, so it would likely stop jjstatsplot too.
• Merging before that fix makes master red.
• About the NOTE. V8 and concaveman are in Imports but used only through requireNamespace(), which is deliberate for jamovi. A possible follow-up for hullplot: ggforce 0.5.0 no longer needs concaveman for geom_mark_hull().

Optional polish (same file in all five submodule PRs)

• Failure output is truncated. reporter = "summary" prints details for only the first 10 failures (testthat.summary.max_reports); OncoPath's red run printed 10 of 38. reporter = "check" prints every failure plus the [ FAIL | WARN | SKIP | PASS ] totals line.
• Master runs can cancel each other. cancel-in-progress: true combined with the github.ref fallback in the group key also cancels master runs, so a quick second merge leaves the first commit with no result. Key non-PR runs on github.run_id, or use cancel-in-progress: ${{ github.event_name == 'pull_request' }}.
• Two inputs do nothing. The dependencies: input equals the default here (no module declares Enhances), and needs: check has no Config/Needs/check to read. Both can go.
• actions/checkout@v4 runs on the deprecated Node 20. v5 and later use Node 24.
• Worth stating in the PR text:
  • Nearly every example is \dontrun, so "checking examples … OK" covers almost nothing.
  • A green run does not mean the module loads in jamovi, because jamovi/ is .Rbuildignored and jmvtools::prepare() does not run.

---

🤖 Reviewed with Claude Code. The workflow inputs were checked against the r-lib/actions v2 sources and the CI logs were triaged; each claim was re-checked by an independent verifier. GitHub does not let an author approve their own pull request, so this approval is posted as a comment.

[sbalci]

Follow-up: the review's polish is pushed. The workflow now uses testthat's check reporter, which prints every failure (the summary reporter stopped at 10) plus a totals line. Only superseded PR runs are cancelled, so push and dispatch runs no longer cancel each other. The two no-op inputs are gone, and it runs on actions/checkout@v5 (Node 24).

• CI: R CMD check passes. The source-tree step fails on one test only: the dependency guard reporting the plotmath token atop.
• Fixed at the source: the umbrella template _updateModules_test_dependency_guard.R now exempts plotmath keywords, but only inside quoting calls. eval(bquote(.(d) %>% head())) and a bare %>% are still flagged, and new regression tests pin both behaviours.
• To go green: commit the regenerated tests/testthat/test-zzz-dependency-declaration.R to this repo.
• Also ready in the regenerated copy:
  • hullplot uses ggforce 0.5.0's own concave hulls, so concaveman and V8 leave Imports and ggforce (>= 0.5.0) is floored. That clears this check's one NOTE.
  • The jjarcdiagram, jjhistostats, jjridges and jjsegmentedtotalbar panels had enable: bindings written with ==/!=, which jamovi's client grammar lacks. The affected checkboxes were frozen at their defaults; the fixed bindings let them respond.
  • jjhistostats: a control event on the dotted option conf.level aborted the client's initializeAll(), which disabled every later binding. It is removed.

Not merged from the review session: the automation's permission policy blocks merging. This is ready to squash-merge.

---

🤖 Follow-up by Claude Code.