[davidbudzynski]

Closes #104.

What changed

	before	after
workflows	5	4
R-CMD-check jobs	9	5
coverage service	Codecov (never worked)	covr threshold in R
YAML lines	~259	~131

Coverage. The upload has never reached master: every run ended in HTTP 400 {"message":"Token required because branch is protected"} because no CODECOV_TOKEN exists, and fail_ci_if_error: false kept the job green. It is now a 90% floor enforced in R, printed to the job summary:

### Coverage: 96.68%

Measured locally on this branch. codecov.yml and the README badge are gone; nothing external is involved.

R-CMD-check. Matrix cut to the r-lib check-standard set (macOS, Windows, Ubuntu devel/release/oldrel-1). windows-latest oldrel-4 was the only old-R Windows job, and oldrel-4 is ~R 4.2 against Depends: R (>= 3.5.0), so the extra spread tested nothing the remaining jobs don't. --as-cran is unchanged (it comes from the action's args default, not build_args).

knitr workaround removed. Verified rather than assumed: macos-latest is now macos-26-arm64, PPM serves knitr 1.52 for R 4.6 at bin/macosx/sonoma-arm64/contrib/4.6, and that tarball is plain gzip again (1f 8b) — the zstd/unreadable-binary condition the comment described is gone.

upload-snapshots: true removed. Tests are tinytest (inst/tinytest), so there are no testthat snapshots to upload.

Claude. claude-code-review.yml deleted: its only trigger is workflow_dispatch with a pr_number input, but the prompt interpolates github.event.pull_request.number, which is empty on a manual run — the pull_request trigger is commented out. @claude review this PR in claude.yml does the same job. claude.yml also drops the issues: [opened, assigned] trigger (assigned was dead without an assignee_trigger, and opened let anyone spend tokens by mentioning @claude in a new issue) and gains a timeout.

Housekeeping. checkout@v6, JamesIves@v4.9.0 pinned to SHA (v4.5.0 was on node20), concurrency: cancel-in-progress and timeout-minutes everywhere, GITHUB_PAT removed (r-lib template leftover), and a weekly github-actions Dependabot group so this drift doesn't recur.

Verification

• actionlint 1.7.12 clean on all four workflows.
• The coverage step body was run verbatim against this tree: exit 0, ### Coverage: 96.68% written to GITHUB_STEP_SUMMARY; with the percentage forced below 90 it exits 1 with the expected message.
• No remaining references to codecov anywhere in the repo.

Not in this PR

• Enabling the kit ruleset so the coverage floor blocks merges, and moving Pages to native deploy: both need admin rights.
• UBSAN/ASAN job, oldrel-2/3/4 coverage: deliberately deferred.

[davidbudzynski]

Reviewing the CI simplification. Goal is right (Codecov never worked, the matrix was oversized), but two things should change before this merges.

Should fix

1. Every R < 4.5 job is gone, so the old-R compile path is never built — .github/workflows/R-CMD-check.yaml:27-32, src/kit.h:29

• What this is: The matrix drops ubuntu-latest oldrel-2/3/4 and windows-latest oldrel-4, keeping macOS/Windows release plus Ubuntu devel/release/oldrel-1.
• Problem: Release is 4.6 and oldrel-1 is 4.5, so no surviving job compiles with R < 4.5 — exactly the branch guarded by #if R_VERSION < R_Version(4, 5, 0) #define isDataFrame(x) Rf_isFrame(x) (src/kit.h:29), used in dup.c, dupLen.c, fpos.c, utils.c. The R_VERSION < 3.5.0 block (kit.h:19-22) is likewise never built, and the declared floor Depends: R (>= 3.5.0) (which #103 raises to 4.2) is untested. The PR description's “tested nothing the remaining jobs don't” is not accurate — the remaining jobs never see those preprocessor paths.
• Fix: Keep one old job, - {os: ubuntu-latest, r: 'oldrel-4'}, and drop only the Windows old-R job and oldrel-2/3 (no version-specific code there).
• If we skip it: A break in the R 4.2–4.4 fallback installs fine in CI and fails for users on those versions.

2. NEWS still says the coverage floor is “via Codecov” — NEWS.md:50

• What this is: The PR description says “No remaining references to codecov anywhere in the repo”, but the development-section entry for #63 ends with “Coverage now requires > 90% via Codecov.”
• Problem: This PR replaces that mechanism with covr in test-coverage.yaml, so the changelog for the next release names a service the repo no longer uses, and the verification claim in the description is false.
• Fix: “Coverage now requires 90% in the test-coverage workflow.”
• If we skip it: Release notes describe a mechanism removed in the same release.

Nice to have

3. Dead .Rbuildignore entry after the rebase — .Rbuildignore:3

• What this is: #102 (merged after this branch was cut) added ^codecov\.yml$; this PR deletes the file.
• Problem: The pattern matches nothing; R CMD build is unaffected, but the line now documents something that no longer exists.
• Fix: Delete the line while rebasing.
• If we skip it: One misleading line, no functional effect.

What checked out

• No remaining codecov action/secret references outside NEWS.md:50.
• Pinned deploy action fa24774553152dd7873cd16ebd8d959b010c5445 exists and is the commit tagged v4.9.0.
• The repo ruleset is disabled and there is no branch protection, so removing matrix jobs cannot block merges.
• PR runs are green, which directly demonstrates that dropping the macOS knitr workaround and moving to checkout@v6 is safe.
• The covr floor step is correct (package_coverage(quiet=), percent_coverage, GITHUB_STEP_SUMMARY) and passed at 96.68%.

Verdict: Requesting changes for findings 1 and 2 (both one-liners), plus the one-line cleanup in 3. Rebase first — the branch is one merge behind master and the merge is clean (git merge-tree).