Align CI workflow with bancr: multi-OS matrix, secret file write, CRANT_ON_CI

- Rewrite R-CMD-check.yaml to match bancr's structure: multi-OS/R-version
  matrix (macOS, Windows, Ubuntu), permissions, build args
- Write CAVE secret to crantr-specific file paths
  (proofreading.zetta.ai-cave-secret.json) instead of old env var approach
- Set CRANT_ON_CI env var so testthat.R CI setup block executes
- Remove stale Python/fafbseg install and token-via-R steps
- Update testthat.R secret path to match crantr's CAVE server
- Fix test-urls.R test name from "banc_scene" to "crant_scene"
- Add .claude to .Rbuildignore

Note: requires CRANT_CHUNKEDGRAPH_SECRET_JSON GitHub secret to be configured.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

Author: alexanderbates

.Rbuildignore

@@ -5,3 +5,4 @@
 ^LICENSE\.md$
 ^pkgdown$
 ^\.github$
+^\.claude$

.github/workflows/R-CMD-check.yaml

@@ -1,87 +1,78 @@
-# For help debugging build failures open an issue on the RStudio community with the 'github-actions' tag.
-# https://community.rstudio.com/new-topic?category=Package%20development&tags=github-actions
+# Workflow derived from https://github.com/r-lib/actions/tree/v2/examples
+# Need help debugging build failures? Start at https://github.com/r-lib/actions#where-to-find-help
 on:
   push:
-    branches:
-      - main
-      - master
+    branches: [main, master]
   pull_request:
-    branches:
-      - main
-      - master
 
-name: R-CMD-check
+name: R-CMD-check.yaml
+
+permissions: read-all
 
 jobs:
   R-CMD-check:
-    runs-on: ubuntu-latest
+    runs-on: ${{ matrix.config.os }}
+
+    name: ${{ matrix.config.os }} (${{ matrix.config.r }})
+
+    strategy:
+      fail-fast: false
+      matrix:
+        config:
+          - {os: macos-latest,   r: 'release'}
+          - {os: windows-latest, r: 'release'}
+          - {os: ubuntu-latest,   r: 'devel', http-user-agent: 'release'}
+          - {os: ubuntu-latest,   r: 'release'}
+          - {os: ubuntu-latest,   r: 'oldrel-1'}
+
     env:
-      R_REMOTES_NO_ERRORS_FROM_WARNINGS: true
       GITHUB_PAT: ${{ secrets.GITHUB_TOKEN }}
-      CHUNKEDGRAPH_SECRET: ${{ secrets.CHUNKEDGRAPH_SECRET }}
-      CODECOV_TOKEN: ${{ secrets.CODECOV_TOKEN }}
-      FLYTABLE_TOKEN: ${{ secrets.FLYTABLE_TOKEN }}
-      RETICULATE_MINICONDA_PYTHON_VERSION: 3.8
-      RGL_USE_NULL: TRUE
-      _R_CHECK_DONTTEST_EXAMPLES_: FALSE
-      _R_CHECK_TESTS_NLINES_: 0
-      _R_CHECK_CRAN_INCOMING_REMOTE_: false
+      R_KEEP_PKG_SOURCE: yes
+      RGL_USE_NULL: "TRUE"
+      CRANT_ON_CI: "true"
 
     steps:
       - uses: actions/checkout@v4
 
+      # Unix (macOS + Linux) – bash + heredoc
+      - name: Write CRANT cave secret (Unix)
+        if: runner.os != 'Windows'
+        shell: bash
+        run: |
+          mkdir -p ~/.cloudvolume/secrets
+          cat << 'EOF' > ~/.cloudvolume/secrets/proofreading.zetta.ai-cave-secret.json
+          ${{ secrets.CRANT_CHUNKEDGRAPH_SECRET_JSON }}
+          EOF
+          cp ~/.cloudvolume/secrets/proofreading.zetta.ai-cave-secret.json \
+             ~/.cloudvolume/secrets/data.proofreading.zetta.ai-cave-secret.json
+
+      # Windows – PowerShell + Set-Content
+      - name: Write CRANT cave secret (Windows)
+        if: runner.os == 'Windows'
+        shell: pwsh
+        run: |
+          $secretDir = Join-Path $env:USERPROFILE ".cloudvolume\secrets"
+          New-Item -ItemType Directory -Force -Path $secretDir | Out-Null
+          $secret = '${{ secrets.CRANT_CHUNKEDGRAPH_SECRET_JSON }}'
+          $path1 = Join-Path $secretDir "proofreading.zetta.ai-cave-secret.json"
+          $path2 = Join-Path $secretDir "data.proofreading.zetta.ai-cave-secret.json"
+          Set-Content -Path $path1 -Value $secret -NoNewline
+          Set-Content -Path $path2 -Value $secret -NoNewline
+
+      - uses: r-lib/actions/setup-pandoc@v2
+
       - uses: r-lib/actions/setup-r@v2
         with:
+          r-version: ${{ matrix.config.r }}
+          http-user-agent: ${{ matrix.config.http-user-agent }}
           use-public-rspm: true
 
-      - uses: r-lib/actions/setup-pandoc@v2
-
       - uses: r-lib/actions/setup-r-dependencies@v2
         with:
-          extra-packages: any::rcmdcheck, any::pkgdown, catmaid=natverse/rcatmaid
+          extra-packages: any::rcmdcheck
           needs: check
 
-      - name: Fix Conda permissions on macOS
-        if: runner.os == 'macOS'
-        run: sudo chown -R $UID $CONDA
-
-      - name: Install fafbseg + python
-        run: |
-          pak::local_install()
-          library(crantr)
-          library(fafbseg)
-          simple_python()
-          simple_python('none', pkgs='cloud-volume~=8.32.1')
-          dr_fafbseg()
-        shell: Rscript {0}
-
-      - name: writetoken
-        run: |
-          if(nzchar(Sys.getenv("CHUNKEDGRAPH_SECRET"))) {
-            fafbseg::flywire_set_token(token = Sys.getenv("CHUNKEDGRAPH_SECRET"))
-          } else {
-            message("CHUNKEDGRAPH_SECRET not set, skipping token configuration")
-          }
-        shell: Rscript {0}
-
       - uses: r-lib/actions/check-r-package@v2
-
-      - name: Upload check results
-        if: failure()
-        uses: actions/upload-artifact@v4
         with:
-          name: ${{ runner.os }}-r${{ matrix.config.r }}-results
-          path: check
-
-      - name: Upload check log results
-        if: failure()
-        uses: actions/upload-artifact@v4
-        with:
-          name: ${{ matrix.config.tag }}-results
-          path: ${{ github.event.repository.name }}.Rcheck/00check.log
-
-      - name: Test coverage
-        # if: runner.os == 'macOS'
-        if: ${{ runner.os == 'Linux' && matrix.config.r == 'release'}}
-        run: covr::codecov(errorsAreFatal=FALSE)
-        shell: Rscript {0}
+          upload-snapshots: true
+          build_args: 'c("--no-manual","--compact-vignettes=gs+qpdf")'

tests/testthat.R

@@ -1,4 +1,16 @@
 library(testthat)
 library(crantr)
-
+if (identical(Sys.getenv("CRANT_ON_CI"), "true")) {
+  # Only run this on CI
+  simple_python("basic")
+  # Token file is written by the GitHub Actions workflow;
+  # only call crant_set_token() if it is missing
+  secret_path <- file.path(Sys.getenv("HOME"), ".cloudvolume", "secrets", "proofreading.zetta.ai-cave-secret.json")
+  if (!file.exists(secret_path) || file.size(secret_path) == 0) {
+    message("No chunkedgraph secret found at: ", secret_path)
+  }
+  tryCatch(fafbseg::dr_fafbseg(), error = function(e) {
+    message("dr_fafbseg() failed: ", e$message)
+  })
+}
 test_check("crantr")

tests/testthat/test-urls.R

@@ -1,4 +1,4 @@
-test_that("banc_scene works", {
+test_that("crant_scene works", {
   skip_if_offline()
   skip_if_not(crant_token_available(),
               message="Unable to obtain a crant access token")