[r-heller]

Pilot for the shared-workflow rollout (CTTIR/.github#2). hexmakR was chosen because it is green and measured 0 house-linter findings, so anything that goes red here is the shared workflow's fault rather than pre-existing debt.

119 lines of copied YAML → 3 caller stubs.

What comes with the shared versions:

• R-CMD-check gains an oldrel-3 job, so the R version DESCRIPTION claims to support is actually built, and passes --as-cran.
• test-coverage computes its gate with covr and an explicit exit instead of delegating to Codecov, with an absolute floor of 90% — the old config used target: auto, threshold: 1%, which compares only to the base commit and permits unlimited decay in 1% steps.
• lint is new, and blocking here because the count is already zero.

⚠️ Pinned to @feat/org-infrastructure so it can be validated before that PR merges. Merge CTTIR/.github#2 first, then change the three refs to @main — three one-word edits.

If this goes green, the remaining rollout is file creation and whole-file replacement across the other repos, which is the only kind of scripted change CONTRIBUTING.md permits.

[r-heller]

Correction: hexmakR has 15 house-linter findings, not 0.

I opened this PR saying hexmakR measured zero and set blocking: true on that basis. hexmakR was never in the set I measured — I conflated it with themakR, which is the package with zero. Switched to blocking: false.

Actual findings: 14 stop()/warning() calls that should be cli::cli_abort()/cli_warn() (in R/export.R and R/hex_canvas.R), plus one multi-entry utils::globalVariables() in R/hex_canvas.R:6. Local and CI counts agree exactly, which is a useful check that the shared workflow reproduces a local run.

What the pilot established, which was its purpose:

Caller-stub pattern	works — 119 lines of YAML → 3 stubs
R-CMD-check incl. new oldrel-3	pass on all 6 platforms
Coverage gate computed in-workflow	pass at floor 90
lint	runs, reports real findings, correctly non-blocking

Two design bugs it caught, both now fixed in CTTIR/.github#2:

1. The reusable workflow cannot discover its own ref, so the shared-config checkout always resolved to main — a branch-pinned caller failed outright. Added a config-ref input.
2. The workflow ran lintr's full default style set alongside the house rules, producing 624 findings on hexmakR — 534 of them infix_spaces. Restyling the estate is a separate decision from holding its vocabulary, and mixing them buries the signal. Defaults are now opt-in via with-defaults: true.