Skip to content

Repin install-whitaker to 5a99aed7 (whitaker-installer 0.2.11) - #189

Merged
leynos merged 2 commits into
mainfrom
repin-install-whitaker-0-2-11
Oct 30, 2026
Merged

leynos merged 2 commits into
mainfrom
repin-install-whitaker-0-2-11

Conversation

@leynos

@leynos leynos commented Oct 30, 2026 •

Copy link
Copy Markdown
Owner

Part of DF12-89

Repins leynos/shared-actions/.github/actions/install-whitaker to 5a99aed78ce68dcebd3052b75c31e6f173162b1e (shared-actions #651, approved as a root by concordat QG-002, leynos/concordat#331). The action then defaults to whitaker-installer 0.2.11, which builds the Dylint driver from a verified Clippy snapshot: upstream Dylint 6.0.1 clones Clippy's master, which no longer exists, so every cold Whitaker driver build fails.

Also the pinned ACTION and the wrong-pin mutation in tests/workflow_contracts/whitaker_provisioning_test.py and whitaker_provisioning_mutations_test.py.

Other Whitaker paths

No bare cargo dylint, cargo binstall whitaker or hand-rolled installer outside the action and the whitaker wrapper.

Notes

A cache-restored driver rebuilds once (about a minute); that is expected. Gate: CI green on the lint lane at the head, with the lint job's log read for Whitaker's diagnostics.

Summary by Sourcery

Repin the Whitaker CI installation action and its workflow contracts to restore reliable lint provisioning.

Bug Fixes:

  • Repin the Whitaker installation action to a version that uses whitaker-installer 0.2.11, restoring reliable cold driver builds.

CI:

  • Update the CI lint workflow to use the approved Whitaker action revision.

Tests:

  • Update Whitaker workflow contract tests and mutation coverage for the new action pin.

@sourcery-ai

sourcery-ai Bot commented Oct 30, 2026 •

Copy link
Copy Markdown
Reviewer's guide (collapsed on small PRs)

Reviewer's Guide

Repins Whitaker provisioning to shared-actions revision 5a99aed7, which defaults to whitaker-installer 0.2.11 and fixes cold Dylint driver builds by using a verified Clippy snapshot; associated workflow contract expectations and mutations are updated to match.

Sequence diagram for Whitaker provisioning and lint execution

sequenceDiagram
    participant CI as CI lint job
    participant Action as install-whitaker action
    participant Installer as whitaker-installer 0.2.11
    participant Driver as Dylint driver
    participant Clippy as Verified Clippy snapshot

    CI->>Action: Install Whitaker
    Action->>Installer: Provision Whitaker
    Installer->>Clippy: Use verified snapshot
    Clippy-->>Driver: Build driver
    Driver-->>CI: Provide Whitaker diagnostics
    CI->>CI: make lint
Loading

File-Level Changes

Change Details Files
Repin the shared Whitaker installation action to a verified revision that uses whitaker-installer 0.2.11.
  • Update the CI lint job’s immutable action SHA and document the shared-actions and installer versions.
  • Ensure the new installer builds Dylint from a verified Clippy snapshot, avoiding failures caused by the removed upstream Clippy master branch.
.github/workflows/ci.yml
Update workflow contract tests to recognize and validate the new Whitaker action pin.
  • Change the expected action reference to the new SHA.
  • Update the wrong-pin mutation to corrupt the new pin while preserving the test’s invalid-reference behavior.
tests/workflow_contracts/whitaker_provisioning_test.py
tests/workflow_contracts/whitaker_provisioning_mutations_test.py

Tips and commands

Interacting with Sourcery

  • Trigger a new review: Comment @sourcery-ai review on the pull request.
  • Continue discussions: Reply directly to Sourcery's review comments.
  • Generate a GitHub issue from a review comment: Ask Sourcery to create an
    issue from a review comment by replying to it. You can also reply to a
    review comment with @sourcery-ai issue to create an issue from it.
  • Generate a pull request title: Write @sourcery-ai anywhere in the pull
    request title to generate a title at any time. You can also comment
    @sourcery-ai title on the pull request to (re-)generate the title at any time.
  • Generate a pull request summary: Write @sourcery-ai summary anywhere in
    the pull request body to generate a PR summary at any time exactly where you
    want it. You can also comment @sourcery-ai summary on the pull request to
    (re-)generate the summary at any time.
  • Generate reviewer's guide: Comment @sourcery-ai guide on the pull
    request to (re-)generate the reviewer's guide at any time.
  • Resolve all Sourcery comments: Comment @sourcery-ai resolve on the
    pull request to resolve all Sourcery comments. Useful if you've already
    addressed all the comments and don't want to see them anymore.
  • Dismiss all Sourcery reviews: Comment @sourcery-ai dismiss on the pull
    request to dismiss all existing Sourcery reviews. Especially useful if you
    want to start fresh with a new review - don't forget to comment
    @sourcery-ai review to trigger a new review!

Customizing Your Experience

Access your dashboard to:

  • Enable or disable review features such as the Sourcery-generated pull request
    summary, the reviewer's guide, and others.
  • Change the review language.
  • Add, remove or edit custom review instructions.
  • Adjust other review settings.

Getting Help

@chatgpt-codex-connector

chatgpt-codex-connector Bot commented Oct 30, 2026 •

Copy link
Copy Markdown

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review Status Commit Review trigger
📝 Code Review ✅ Completed 2026-10-30T03:14:51.493611Z 81a69d8 PR opened
🔒 Security Review ✅ Completed 2026-10-30T03:16:16.920197Z 81a69d8 PR opened
ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

  • Open a pull request for review
  • Mark a draft as ready
  • Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

@coderabbitai

coderabbitai Bot commented Oct 30, 2026 •

Copy link
Copy Markdown

Review in Change Stack →

Note

Reviews paused

It looks like this branch is under active development. To avoid overwhelming you with review comments due to an influx of new commits, CodeRabbit has automatically paused this review. You can configure this behavior by changing the reviews.auto_review.auto_pause_after_reviewed_commits setting.

Use the following commands to manage reviews:

  • @coderabbitai resume to resume automatic reviews.
  • @coderabbitai review to trigger a single review.

Use the checkboxes below for quick actions:

  • ▶️ Resume reviews
  • 🔍 Trigger review
  • Repin the Install Whitaker workflow step to shared-actions revision 5a99aed78ce68dcebd3052b75c31e6f173162b1e.
  • Update the workflow contract test and wrong-pin mutation to use the new revision.
  • The PR description cites Dylint 6.0.1’s attempt to clone Clippy’s unavailable master branch as the cause of cold Whitaker driver build failures.
  • The change is linked to shared-actions #651 and concordat QG-002, approved as a root in concordat PR #331. The stated lint CI gate is not reported as passed.

Walkthrough

The CI workflow now pins the Whitaker installation action to shared-actions revision 5a99aed78ce68dcebd3052b75c31e6f173162b1e. The provisioning contract tests and wrong-pin mutation use the updated revision.

Changes

Whitaker provisioning pin

Layer / File(s) Summary
Update the workflow pin and contract tests
.github/workflows/ci.yml, tests/workflow_contracts/whitaker_provisioning_test.py, tests/workflow_contracts/whitaker_provisioning_mutations_test.py
The workflow and provisioning contract test now use the new action commit. The wrong-pin mutation targets its 5a99aed7 prefix.

Possibly related issues

  • leynos/shared-actions issue 650 — It describes the Dylint 6.0.1 Clippy master clone failure during a cold Whitaker bootstrap. This PR updates the installer action pin associated with that failure.
  • leynos/whitaker issue 530 — It requests a released Whitaker installer/bootstrap and validation of cold driver builds. This PR updates the shared-actions pin, but the supplied context does not report completion of that validation.

Possibly related PRs

Priority: Normal

Change: Bug fix

Merge Risk: Minimal · up to 81a69

The Whitaker pin update is internally consistent and presents no identified merge-blocking risk.

Pre-merge checks: Passed 14 · Failed 1

Failed Failed checks: 1 warning

Check name Status Explanation Resolution
Developer Documentation Warning Document the changed Whitaker tooling requirement. The PR changes .github/workflows/ci.yml from shared-actions revision 2ddf19b3 to 5a99aed78ce68dcebd3052b75c31e6f173162b1e, which selects `whita… Update docs/developers-guide.md in the local tooling or workflow-pins section. Record the pinned install-whitaker revision, the resulting whitaker-installer 0.2.11 requirement, and the reason for the pin. State the required validation…
Passed Passed checks: 14 passed
Check name Status Explanation
Title check Passed The title names the change: repinning install-whitaker to commit 5a99aed7, which defaults to whitaker-installer 0.2.11. This matches the workflow and test-file changes. The title does not reference a …
Description check Passed The description states the purpose: repinning the install-whitaker action to 5a99aed7, the reason (Dylint 6.0.1 clones a Clippy master branch that no longer exists), and the test-file updates. It is r…
Docstring Coverage Passed No eligible functions found in the changed files. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff with cyclomatic complexity of at least 2. Documentat…
Linked Issues check Passed Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check Passed Check skipped because no linked issues were found for this pull request.
Testing (Overall) Passed The changed action pin is covered by the existing workflow contract. test_ci_provisions_whitaker_before_each_lint_route requires exactly one install-whitaker step with the full new SHA, before eve…
User-Facing Documentation Passed Pass. The diff changes only the CI Whitaker action pin and the matching workflow-contract test fixtures. It does not change mapsplice commands, outputs, or user-facing behaviour. No update to `docs/…
Module-Level Documentation Passed Pass the module-level documentation check. The pull request changes only action pins and the related mutation string. Both changed Python modules retain clear module docstrings, and the YAML workflow …
Testing (Unit And Behavioural) Passed Pass. Retain the workflow contract tests. test_ci_provisions_whitaker_before_each_lint_route parses the real GitHub Actions workflow and checks the exact pinned action, ordering, unconditional execu…
Testing (Property / Proof) Passed The change only repins one GitHub Action and updates the matching exact-pin fixture and wrong-pin mutation. It introduces no invariant over a range of inputs, states, orderings, or transitions. The ex…
Testing (Compile-Time / Ui) Passed Pass. Restrict the assessment to the actual diff: it changes one GitHub Actions pin and updates two Python workflow-contract fixtures. It introduces no Rust or TypeScript compile-time behaviour and no…
Unit Architecture Passed Accept this change. The pull request only repins the Whitaker GitHub Action and updates the matching contract-test fixture and wrong-pin mutation. It adds no query, command, fallible operation, depend…
Domain Architecture Passed Pass. The pull request changes only a GitHub Actions pin and two workflow contract test literals. It does not change domain code, domain policies, commands, repositories, adapters, or transport and pe…
Observability Passed Pass this check. The pull request changes only the pinned GitHub Actions revision for Whitaker and updates two contract-test literals. It changes CI dependency provisioning, not production runtime beh…
Full details: Title check

Explanation

The title names the change: repinning install-whitaker to commit 5a99aed7, which defaults to whitaker-installer 0.2.11. This matches the workflow and test-file changes. The title does not reference a roadmap item or issue number. The PR description links the work to DF12-89 and shared-actions #651, but the title requirements only call for roadmap or issue numbers where the PR description references them as roadmap or issue items. The title is specific and accurate, so it passes.

Full details: Description check

Explanation

The description states the purpose: repinning the install-whitaker action to 5a99aed7, the reason (Dylint 6.0.1 clones a Clippy master branch that no longer exists), and the test-file updates. It is related to the changeset and gives useful context. It also includes a CI gate note.

Full details: Docstring Coverage

Explanation

No eligible functions found in the changed files. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff with cyclomatic complexity of at least 2. Documentation-only edits and deletions within surviving functions are included; unchanged diff context and fully deleted functions are excluded. Analyzed 0 functions across 2 files. (1 skipped: 1 unsupported.)

Full details: Testing (Overall)

Explanation

The changed action pin is covered by the existing workflow contract. test_ci_provisions_whitaker_before_each_lint_route requires exactly one install-whitaker step with the full new SHA, before every reachable lint route. The parametrized wrong_pin mutation now changes the new pin and verifies that _validate rejects it. The tests therefore fail for the old pin and for a different pin. No test is required to verify the third-party installer itself.

Full details: User-Facing Documentation

Explanation

Pass. The diff changes only the CI Whitaker action pin and the matching workflow-contract test fixtures. It does not change mapsplice commands, outputs, or user-facing behaviour. No update to docs/users-guide.md or a migration document is required.

Full details: Module-Level Documentation

Explanation

Pass the module-level documentation check. The pull request changes only action pins and the related mutation string. Both changed Python modules retain clear module docstrings, and the YAML workflow is not a Python module.

Full details: Testing (Unit And Behavioural)

Explanation

Pass. Retain the workflow contract tests. test_ci_provisions_whitaker_before_each_lint_route parses the real GitHub Actions workflow and checks the exact pinned action, ordering, unconditional execution, and failure propagation. The mutation suite exercises wrong pins, missing provisioning, soft failures, masked exit status, ad hoc installation, and additional lint jobs. These tests cross the workflow boundary and cover the changed pin without relying only on private helpers.

Full details: Testing (Property / Proof)

Explanation

The change only repins one GitHub Action and updates the matching exact-pin fixture and wrong-pin mutation. It introduces no invariant over a range of inputs, states, orderings, or transitions. The existing small, parameterized regression table remains suitable. No property test or exhaustive proof is required.

Full details: Testing (Compile-Time / Ui)

Explanation

Pass. Restrict the assessment to the actual diff: it changes one GitHub Actions pin and updates two Python workflow-contract fixtures. It introduces no Rust or TypeScript compile-time behaviour and no text-based, structured, multi-variant, or UI-adjacent output. The existing Python contract tests assert the pinned action and reject the wrong pin, so trybuild or snapshot tests are not required by this check.

Full details: Unit Architecture

Explanation

Accept this change. The pull request only repins the Whitaker GitHub Action and updates the matching contract-test fixture and wrong-pin mutation. It adds no query, command, fallible operation, dependency boundary, state mutation, or unit responsibility. The changed tests preserve the existing explicit workflow contract.

Full details: Domain Architecture

Explanation

Pass. The pull request changes only a GitHub Actions pin and two workflow contract test literals. It does not change domain code, domain policies, commands, repositories, adapters, or transport and persistence boundaries. The Domain Architecture failure conditions do not apply.

Full details: Observability

Explanation

Pass this check. The pull request changes only the pinned GitHub Actions revision for Whitaker and updates two contract-test literals. It changes CI dependency provisioning, not production runtime behaviour, throughput, latency, storage, queues, or service boundaries. The existing Install Whitaker step and make lint step retain their normal action and command output for diagnosis. No new metric, trace, alert, or production log is required by this change.

Full details: Developer Documentation

Explanation

Document the changed Whitaker tooling requirement. The PR changes .github/workflows/ci.yml from shared-actions revision 2ddf19b3 to 5a99aed78ce68dcebd3052b75c31e6f173162b1e, which selects whitaker-installer 0.2.11. The developer's guide documents the Whitaker route and cold driver builds, but it does not record this installer version, action pin, or the Dylint master failure that motivates the change. No guide or design-document change is included.

Resolution

Update docs/developers-guide.md in the local tooling or workflow-pins section. Record the pinned install-whitaker revision, the resulting whitaker-installer 0.2.11 requirement, and the reason for the pin. State the required validation for a future pin change. Keep the workflow contract tests aligned with the documented pin.

A pin moves forward, neat and bright,
The workflow follows it outright.
Tests track the hash in every place,
A wrong-pin check keeps up the pace.
Whitaker starts with a newer trace.

Comment @coderabbitai help to get the list of available commands.

@sourcery-ai sourcery-ai Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Hey - I've found 1 issue

Prompt for AI Agents
Please address the comments from this code review:

## Individual Comments

### Comment 1
<location path=".github/workflows/ci.yml" line_range="93" />
<code_context>
           markdownlint-cli2 --version
       - name: Install Whitaker
-        uses: leynos/shared-actions/.github/actions/install-whitaker@2ddf19b3fd52c0f1089db0d57b015f859b80ab67
+        uses: leynos/shared-actions/.github/actions/install-whitaker@5a99aed78ce68dcebd3052b75c31e6f173162b1e # shared-actions 5a99aed7 (whitaker-installer 0.2.11)
       - name: Lint
         run: make lint
</code_context>
<issue_to_address>
**Installer decision goes undocumented**

When the CI Whitaker installer pin changes to 0.2.11, the workflow now selects whitaker-installer 0.2.11, but the developer guide only describes Whitaker's generic cold-driver bootstrap and does not record this version or why it was selected. Contributors therefore cannot use the project guidance to identify the installer behind the CI route or the Clippy snapshot fix.

Update the Whitaker tooling guidance to record the new installer choice and its cold-driver build behavior.
</issue_to_address>

Sourcery is free for open source - if you like our reviews please consider sharing them ✨

Comment thread .github/workflows/ci.yml
markdownlint-cli2 --version
- name: Install Whitaker
uses: leynos/shared-actions/.github/actions/install-whitaker@2ddf19b3fd52c0f1089db0d57b015f859b80ab67
uses: leynos/shared-actions/.github/actions/install-whitaker@5a99aed78ce68dcebd3052b75c31e6f173162b1e # shared-actions 5a99aed7 (whitaker-installer 0.2.11)

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚪ Low · Installer decision goes undocumented

When the CI Whitaker installer pin changes to 0.2.11, the workflow now selects whitaker-installer 0.2.11, but the developer guide only describes Whitaker's generic cold-driver bootstrap and does not record this version or why it was selected. Contributors therefore cannot use the project guidance to identify the installer behind the CI route or the Clippy snapshot fix.

Update the Whitaker tooling guidance to record the new installer choice and its cold-driver build behavior.

Prompt for AI agents
In `.github/workflows/ci.yml` at line 93:

**Installer decision goes undocumented**

When the CI Whitaker installer pin changes to 0.2.11, the workflow now selects whitaker-installer 0.2.11, but the developer guide only describes Whitaker's generic cold-driver bootstrap and does not record this version or why it was selected. Contributors therefore cannot use the project guidance to identify the installer behind the CI route or the Clippy snapshot fix.

Update the Whitaker tooling guidance to record the new installer choice and its cold-driver build behavior.

From AGENTS.md L38-41:

- **Update:** When new decisions are made, requirements change, libraries are
  added/removed, or architectural patterns evolve, **proactively update** the
  relevant file(s) in the `docs/` directory to reflect the latest state.
  **Ensure the documentation remains accurate and current.**

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant