[leynos]

Repins install-whitaker to shared-actions 5a99aed78ce68dcebd3052b75c31e6f173162b1e (leynos/shared-actions#651, approved as a QG-002 root by leynos/concordat#331). That revision defaults to whitaker-installer 0.2.11, which builds the Dylint driver from a verified Clippy snapshot instead of cloning Clippy's deleted master branch, so cold lint lanes work again. Part of DF12-89.

• Pin only, with no trailing version comment.
• A cache-restored driver rebuilds once (about a minute); that is expected.

Summary by Sourcery

Repin Whitaker installation to the approved shared action revision and installer version so Rust lint workflows build successfully on cold environments.

Bug Fixes:

• Update Whitaker installation in CI workflows to use installer version 0.2.11, restoring cold lint lane compatibility with the current Clippy source layout.

Enhancements:

• Repin the shared install-whitaker action consistently across validation, CI, and generated workflow templates.

CI:

• Update the shared install-whitaker action reference used by CI and validation workflows.

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-10-30T05:08:07.228447Z	0d5a4af	PR opened
🔒 Security Review	✅ Completed 2026-10-30T05:10:05.022968Z	0d5a4af	PR opened

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[coderabbitai]

Note

Reviews paused

It looks like this branch is under active development. To avoid overwhelming you with review comments due to an influx of new commits, CodeRabbit has automatically paused this review. You can configure this behavior by changing the reviews.auto_review.auto_pause_after_reviewed_commits setting.

• Last reviewed commit: 0d5a4af
• Latest commit, not reviewed: 5e1e570

Use the following commands to manage reviews:

• @coderabbitai resume to resume automatic reviews.
• @coderabbitai review to trigger a single review.

Use the checkboxes below for quick actions:

• ▶️ Resume reviews
• 🔍 Trigger review

No actionable comments were generated in the recent review.

Recent review info

Run configuration

• Source mode: Auto
• Repository: Unavailable
• Branch: Unavailable
• File: No configuration file from this repository applied
• Commit: Unavailable
• Layers: Organization UI
• Review profile: ASSERTIVE
• Plan: Team
• Run ID: 29bd8e9a-7ae6-4c85-a0e9-61c39c1f3085

Commits

Reviewing files that changed from the base of the PR and between 308dbe7 and 0d5a4af.

Files selected for processing: 2

• .github/workflows/act-validation.yml
• .github/workflows/ci.yml

Included review availability: This review used your included allowance. 0 included reviews remain after this review. Your included PR review attempts over the past 7 days set your current allowance at 1 review per hour.

Pin install-whitaker in both workflows to shared-actions revision 5a99aed78ce68dcebd3052b75c31e6f173162b1e. Keep the existing cranelift: true inputs unchanged.

The PR objectives state that this revision uses whitaker-installer 0.2.11 to build the Dylint driver from a verified Clippy snapshot. The change is part of DF12-89. No test results were provided.

Walkthrough

The CI and act-validation workflows now pin the shared install-whitaker action to revision 5a99aed78ce68dcebd3052b75c31e6f173162b1e. Both retain the existing cranelift: true input.

Changes

Whitaker action pin

Layer / File(s)	Summary
Update workflow action pins .github/workflows/act-validation.yml, .github/workflows/ci.yml	Both workflows use the new install-whitaker revision. The cranelift: true input is unchanged.

Possibly related issues

• leynos/whitaker#530 — The workflows adopt the shared install-whitaker action; this change does not include the separate verification evidence described in the issue.
• leynos/whitaker#529 — The updated action pin relates to the Clippy-snapshot bootstrap, but this change does not implement the proposed separation of snapshot policy from infrastructure adapters.

Possibly related PRs

• leynos/mapsplice#189 — Both changes pin install-whitaker to the same shared-actions revision.
• leynos/netsuke#1042 — Both changes update consumers of install-whitaker to the same revision.
• leynos/cabochon#74 — Both changes update the action pin and retain the cranelift: true input.

Priority: Normal

Change: Bug fix

Merge Risk: Minimal · previous review 0d5a4

The workflow-only pin update introduces no identified correctness, security, or availability risk and is ready to merge.

Pre-merge checks: 15

Check name	Status	Explanation
Title check		The title clearly describes the main change: repinning install-whitaker to the specified shared-actions revision and installer version. No roadmap or GitHub issue reference is required by the supplied…
Description check		The description directly explains the repin, target revision, installer version, operational effect, and expected cache behaviour. It is fully related to the changeset.
Docstring Coverage		No eligible functions found in the changed files. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff with cyclomatic complexity of at least 2. Documentat…
Linked Issues check		Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check		Check skipped because no linked issues were found for this pull request.
Testing (Overall)		Pass the testing check. The pull request only repins the third-party install-whitaker action in two workflows. It keeps cranelift: true unchanged and adds no repository functionality or local beha…
User-Facing Documentation		Pass this check. The pull request changes only the pinned revision of the CI install-whitaker action in two workflow files. It does not introduce or change user-facing functionality, user interfaces…
Developer Documentation		Pass the developer documentation check. The pull request changes only the pinned revision of the existing install-whitaker action in two CI workflows. It introduces no new internal API, architectura…
Module-Level Documentation		Pass. The pull request changes only two GitHub Actions workflow references. It adds or modifies no source module, so the module-level documentation requirement is not applicable.
Testing (Unit And Behavioural)		The pull request changes only the pinned revision of install-whitaker in two workflows. It does not change local application behaviour, test logic, or action inputs. Both workflows still exercise th…
Testing (Property / Proof)		The pull request changes only the pinned revision of the existing install-whitaker action in two workflows. The cranelift: true input and workflow structure remain unchanged. It introduces no inva…
Testing (Compile-Time / Ui)		PASS — The pull request changes only the pinned revision of install-whitaker in two workflow files. It introduces no Rust or TypeScript compile-time behaviour and no text, structured, or UI output. …
Unit Architecture		PASS. The pull request changes only the pinned revision of install-whitaker in two workflow files. It keeps cranelift: true unchanged and introduces no queries, commands, fallible APIs, dependenci…
Domain Architecture		Pass. Restrict the change to two GitHub Actions pins in .github/workflows/act-validation.yml and .github/workflows/ci.yml. Keep the existing cranelift: true input unchanged. The pull request doe…
Observability		Pass the observability check. The pull request changes only the pinned revision of the install-whitaker GitHub Action in two CI workflows. It does not add or alter production services, requests, que…

Full details: Title check

Explanation

The title clearly describes the main change: repinning install-whitaker to the specified shared-actions revision and installer version. No roadmap or GitHub issue reference is required by the supplied context.

Full details: Docstring Coverage

Explanation

No eligible functions found in the changed files. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff with cyclomatic complexity of at least 2. Documentation-only edits and deletions within surviving functions are included; unchanged diff context and fully deleted functions are excluded. Analyzed 0 functions across 0 files. (2 skipped: 2 unsupported.)

Full details: Testing (Overall)

Explanation

Pass the testing check. The pull request only repins the third-party install-whitaker action in two workflows. It keeps cranelift: true unchanged and adds no repository functionality or local behavioural logic. The check does not require tests to verify that a third-party tool works as advertised. Existing make test steps remain in both workflows.

Full details: User-Facing Documentation

Explanation

Pass this check. The pull request changes only the pinned revision of the CI install-whitaker action in two workflow files. It does not introduce or change user-facing functionality, user interfaces, or usage instructions. No update to docs/users-guide.md is required.

Full details: Developer Documentation

Explanation

Pass the developer documentation check. The pull request changes only the pinned revision of the existing install-whitaker action in two CI workflows. It introduces no new internal API, architectural boundary, abstraction, or developer build requirement. docs/developers-guide.md already documents Whitaker in the Rust integration section and documents workflow pin management, including full commit-SHA pins and Dependabot ownership. No roadmap or new execplan change is present.

Full details: Testing (Unit And Behavioural)

Explanation

The pull request changes only the pinned revision of install-whitaker in two workflows. It does not change local application behaviour, test logic, or action inputs. Both workflows still exercise the integration boundary after installation: CI runs make test, and Act Validation runs make test WITH_ACT=1. Repository contract tests also validate the workflow shape and full-SHA pin format, while the documented policy avoids asserting a specific dependency SHA. No additional unit or behavioural test is required for this pin-only change.

Full details: Testing (Property / Proof)

Explanation

The pull request changes only the pinned revision of the existing install-whitaker action in two workflows. The cranelift: true input and workflow structure remain unchanged. It introduces no invariant over a range of inputs, states, orderings or transitions, and it introduces no lemma or proof assumption. A property test or exhaustive proof is therefore not required.

Full details: Testing (Compile-Time / Ui)

Explanation

PASS — The pull request changes only the pinned revision of install-whitaker in two workflow files. It introduces no Rust or TypeScript compile-time behaviour and no text, structured, or UI output. The trybuild and snapshot requirements therefore do not apply.

Full details: Unit Architecture

Explanation

PASS. The pull request changes only the pinned revision of install-whitaker in two workflow files. It keeps cranelift: true unchanged and introduces no queries, commands, fallible APIs, dependencies, state mutation, or application units. The change does not reduce architectural visibility or alter a unit boundary.

Full details: Domain Architecture

Explanation

Pass. Restrict the change to two GitHub Actions pins in .github/workflows/act-validation.yml and .github/workflows/ci.yml. Keep the existing cranelift: true input unchanged. The pull request does not modify domain logic or introduce adapter, transport, persistence, framework, infrastructure, or vendor-specific concerns into the domain model.

Full details: Observability

Explanation

Pass the observability check. The pull request changes only the pinned revision of the install-whitaker GitHub Action in two CI workflows. It does not add or alter production services, requests, queues, storage, metrics, alerts, or tracing. The named installation step and the subsequent make test and lint steps expose installation and lint failures through standard GitHub Actions logs and step status. No new observability signal is required by this change.

_{Pin the action, update the flow,
Keep cranelift set to go.
CI and act-validation align,
One revision in each line.
Whitaker starts with pins in place.}

_{Comment @coderabbitai help to get the list of available commands.}

[sourcery-ai]

Sorry @leynos, you've used your own review budget of 250,000 diff characters for the last 7 days.

You can request another review in 6 days and 16 hours by commenting @sourcery-ai review. Upgrade to get a review now.

[sourcery-ai]

Reviewer's guide (collapsed on small PRs)

Reviewer's Guide

Both CI workflows now use shared-actions install-whitaker commit 5a99aed7, bringing in whitaker-installer 0.2.11 and its verified Clippy snapshot build path so cold lint lanes can install the Dylint driver without relying on Clippy’s deleted master branch.

File-Level Changes

Change	Details	Files
Repin the Whitaker installer action to the shared-actions revision that defaults to whitaker-installer 0.2.11.	Update the immutable shared-actions commit used by both CI workflows. Retain Cranelift-enabled installation configuration. Avoid adding a trailing version comment or other workflow changes.	.github/workflows/act-validation.yml .github/workflows/ci.yml

---

Tips and commands

Interacting with Sourcery

• Trigger a new review: Comment @sourcery-ai review on the pull request.
• Continue discussions: Reply directly to Sourcery's review comments.
• Generate a GitHub issue from a review comment: Ask Sourcery to create an
  issue from a review comment by replying to it. You can also reply to a
  review comment with @sourcery-ai issue to create an issue from it.
• Generate a pull request title: Write @sourcery-ai anywhere in the pull
  request title to generate a title at any time. You can also comment
  @sourcery-ai title on the pull request to (re-)generate the title at any time.
• Generate a pull request summary: Write @sourcery-ai summary anywhere in
  the pull request body to generate a PR summary at any time exactly where you
  want it. You can also comment @sourcery-ai summary on the pull request to
  (re-)generate the summary at any time.
• Generate reviewer's guide: Comment @sourcery-ai guide on the pull
  request to (re-)generate the reviewer's guide at any time.
• Resolve all Sourcery comments: Comment @sourcery-ai resolve on the
  pull request to resolve all Sourcery comments. Useful if you've already
  addressed all the comments and don't want to see them anymore.
• Dismiss all Sourcery reviews: Comment @sourcery-ai dismiss on the pull
  request to dismiss all existing Sourcery reviews. Especially useful if you
  want to start fresh with a new review - don't forget to comment
  @sourcery-ai review to trigger a new review!

Customizing Your Experience

Access your dashboard to:

• Enable or disable review features such as the Sourcery-generated pull request
  summary, the reviewer's guide, and others.
• Change the review language.
• Add, remove or edit custom review instructions.
• Adjust other review settings.

Getting Help

• Contact our support team for questions or feedback.
• Visit our documentation for detailed guides and information.
• Keep in touch with the Sourcery team by following us on X/Twitter, LinkedIn or GitHub.

[pandalump]

@coderabbitai Is there anything blocking in this change at the current head: are all pre-merge rows free of failures, and does the version bump leave any other reference to the old installer version?

[coderabbitai]

Tip

For best results, initiate chat on the files or code changes.

🧩 Analysis chain

🏁 Script executed:

#!/bin/bash
set -euo pipefail
printf '\n--- Current PR metadata and checks ---\n'
gh pr view 110 --repo leynos/agent-template-python --json headRefOid,baseRefOid,mergeable,mergeStateStatus,reviewDecision,statusCheckRollup,reviews
printf '\n--- Local revision ---\n'
git rev-parse HEAD
printf '\n--- PR diff ---\n'
gh pr diff 110 --repo leynos/agent-template-python
printf '\n--- Published comments ---\n'
gh api --paginate repos/leynos/agent-template-python/issues/110/comments --jq '.[] | {user:.user.login,updated_at,body}'
printf '\n--- Tracked installer references ---\n'
git grep -n -i -E 'whitaker|8e6a325765ba382691d1b1c65fcccf1fc1d1b00c|5a99aed78ce68dcebd3052b75c31e6f173162b1e' || true
printf '\n--- Installer defaults at old and new action revisions ---\n'
for rev in 8e6a325765ba382691d1b1c65fcccf1fc1d1b00c 5a99aed78ce68dcebd3052b75c31e6f173162b1e; do
  printf '\nRevision: %s\n' "$rev"
  gh api "repos/leynos/shared-actions/contents/install-whitaker/action.yml?ref=$rev" --jq '.content' | base64 --decode
done

Length of output: 39014

---

🏁 Script executed:

#!/bin/bash
set -u
printf '\n--- Template structure ---\n'
ast-grep outline template/.github/workflows/ci.yml.jinja || true
printf '\n--- Template installer and cache configuration ---\n'
sed -n '1,85p' template/.github/workflows/ci.yml.jinja
printf '\n--- Literal old-version references in tracked files ---\n'
git grep -n -F '0.2.6'
result=$?
printf 'git grep exit status: %s (1 means no matches)\n' "$result"
printf '\n--- Correct upstream action metadata ---\n'
gh api 'repos/leynos/shared-actions/contents/.github/actions/install-whitaker/action.yml?ref=5a99aed78ce68dcebd3052b75c31e6f173162b1e' --jq '.content' | base64 --decode
printf '\n--- Review threads ---\n'
gh api graphql -f query='query { repository(owner:"leynos",name:"agent-template-python") { pullRequest(number:110) { reviewThreads(first:100) { nodes { isResolved comments(first:10) { nodes { author { login } body url } } } pageInfo { hasNextPage } } } } }'
printf '\n--- Confirm head unchanged ---\n'
gh pr view 110 --repo leynos/agent-template-python --json headRefOid

Length of output: 62077

---

@pandalump No current CI failure or remaining old installer reference was found at head 5e1e570.

• Pre-merge rows: All 15 published rows show Passed. None shows a failure. Treat these as saved results, not fresh current-head assessments: the last full review covered 0d5a4af.
• Current-head checks: test, act-validation, and Gecko Security Review succeeded. CodeRabbit, Sourcery, and Dependabot automerge were skipped. GitHub reports CLEAN and MERGEABLE. No review threads remain open.
• Installer references: template/.github/workflows/ci.yml.jinja, Line 18, now specifies 0.2.11. A search of all tracked files found no remaining 0.2.6 reference. Both install-whitaker action pins use 5a99aed…, whose installer default is confirmed as 0.2.11.
• Other old SHA references: The remaining 8e6a325… pins belong to other shared actions and workflows. They do not select the old Whitaker installer.

No blocker was identified by this focused check. Before treating the pre-merge assessment as current-head coverage, request a fresh review. The existing GitHub approval also belongs to 0d5a4af, not the current head.

_{You are interacting with an AI system.}