[seanthimons]

Finishes the move to seanthimons/baseline: every workflow in this repo is now a thin caller pinned to baseline v2.0.0 (0a6e332d70f7a15520c62870221b35ef040ef933). Also closes two stale beans.

Fixes #16, fixes #17, fixes #18, fixes #19, fixes #21, fixes #22.

Every change

• .github/workflows/gitleaks.yaml, commit-lint.yaml, lint-workflows.yaml: repinned from v1.5.0 to v2.0.0. The gitleaks calling job now grants contents: read and pull-requests: read (v2.0.0's breaking change). Cron minute 53 kept.
• .github/workflows/r-cmd-check.yaml: baseline caller, quarto: true; keeps the NEWS.md / **/*.md paths-ignore; drops the .planning/** ignore (no such directory).
• .github/workflows/pkgdown.yaml: baseline caller, quarto: true.
• .github/workflows/release.yaml: baseline release-r-package caller, quarto: true (also implied by the default autonewsmd notes).
• .github/workflows/build-package.yaml: baseline caller, quarto: true.
• .github/zizmor.yml: deleted; its time-boxed artipacked ignores were for the old pkgdown.yaml and release.yaml.
• .beans/boosterpak-mt5x-*.md, .beans/boosterpak-83qe-*.md: marked completed with the evidence (the hook already uses try(); no failing tests).

Behavior changes

R CMD check:

• Warnings now fail the check (error-on: warning, the callee default).
• Runs on PRs to any branch (old: PRs to main only); the github-actions[bot] skip is gone (release commits still carry [skip ci]).
• 60-minute job timeout, serial testthat on Windows, R_PROFILE_USER=/dev/null, renv autoloader off. Same 3-OS matrix on R release.

pkgdown:

• PR runs only build, with a read-only token (fixes ci: remove contents: write from pkgdown pull_request runs #19). Deploys go through GitHub Pages actions (upload-pages-artifact + deploy-pages) instead of pushing to gh-pages; each deploy replaces the whole site.
• Releases made with RELEASE_PAT start the pkgdown run (fixes ci: pkgdown release trigger never fires because releases use GITHUB_TOKEN #18), given the Pages environment allows v* tags (see below).

Release:

• Dispatch inputs are now version-type (patch, minor, major, dev) and dry-run; the old version_type input and its none option are gone, so there is no re-release without a bump.
• main and the tag are pushed with git push --atomic; a failed publish can be rerun on its own (fixes ci: make release.yaml push atomic and recoverable after partial failure #16). RELEASE_PAT is used only by the push and publish steps; build and check run with a read-only token and no persisted credentials (fixes ci: scope the release push token to the push step in release.yaml #17).
• One chore: release vX.Y.Z [skip ci] commit replaces the separate bump and NEWS commits. NEWS.md headings change to the callee's format. devtools::document() no longer runs at release time. R CMD check runs on the built tarball. Releases must start from main unless dry-run is set. The release attaches the tarball and SHA256SUMS.

Build package: same artifact name and retention; 20-minute timeout.

All workflows: newer pinned actions inside the callees (checkout v7.0.1 and others), owned and bumped in baseline.

Check names

Checks now report as caller / callee, for example R CMD check / ubuntu-latest (release) and pkgdown / .... The protect-default-branch ruleset has no required status checks, so nothing blocks on the renamed checks.

Settings changes at merge (owner approved doing them through the API)

1. Pages source from "Deploy from a branch (gh-pages)" to "GitHub Actions", right before merging, so the merge's pkgdown run deploys.
2. Add a v* tag rule to the github-pages environment's deployment policy, so release-triggered pkgdown runs can deploy.
3. Delete the gh-pages branch after the first successful Actions deploy.

Other issues

• ci: align commit-lint scope regex with autonewsmd scope rule #20 was resolved by ci: adopt baseline gitleaks, commit-lint and lint-workflows callers #41 (shared scope regex [A-Za-z0-9_]+, no bot skip); closing separately.
• For EDA pack, attach base packages so they're immediately available. #13 is already satisfied: the EDA pack attaches all 15 of its packages by default (verified with a generated boosters/attach.R); closing separately.
• Dependabot PR ci: bump the actions group across 1 directory with 3 updates #43 bumps local action pins that this PR removes; it will be obsolete after merge.
• Preserve deferred roadmap and design decisions #1 (roadmap record) stays open.

Validation

Local actionlint clean and offline zizmor 1.32.0 reports no findings (with .github/zizmor.yml removed). Full testthat suite passes. Each commit had a separate diff audit. The CI on this PR runs the new callers; the pkgdown deploy, a release dry run, and the Pages switch can only be exercised after merge.