[leynos]

Part of DF12-89

Repins leynos/shared-actions/.github/actions/install-whitaker to 5a99aed78ce68dcebd3052b75c31e6f173162b1e (shared-actions #651, approved by concordat #331). That revision defaults whitaker-installer to 0.2.11, which builds the Dylint driver from a verified Clippy snapshot; upstream Dylint 6.0.1 clones Clippy's deleted master branch, so every cold Whitaker driver build was failing and the lint lane was red.

• Pin-only change to the workflow files; no trailing version comment is added (it broke exact-match contracts elsewhere).
• Any explicit installer-version / WHITAKER_INSTALLER_VERSION is set to 0.2.11.
• Other Whitaker paths outside the action (cargo dylint, binstall whitaker, whitaker-installer, DYLINT_*): none that install or run Dylint outside the action and wrappers, unless listed below.
• Also includes the lock-only advisory bump (uv.lock only) for the filelock (twelve CVEs), msgpack (CVE-2026-114613) and certifi (PYSEC-2026-4320) advisories: the dependency audit step was failing every PR here, and the lint lane cannot go green without this repin, so the two land together.

Summary by Sourcery

Repin Whitaker installation and refresh locked dependencies so CI lint and security checks can pass reliably.

Bug Fixes:

• Restore successful Whitaker lint and dependency-audit workflow runs by repinning the shared install action to a revision using Whitaker installer 0.2.11.

CI:

• Update the CI workflow to use the approved shared Whitaker installation revision.

Chores:

• Refresh uv.lock with the required advisory dependency updates.

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-10-30T05:14:43.642493Z	8032ce4	PR opened
🔒 Security Review	✅ Completed 2026-10-30T05:15:28.490857Z	8032ce4	PR opened

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[coderabbitai]

Note

Reviews paused

It looks like this branch is under active development. To avoid overwhelming you with review comments due to an influx of new commits, CodeRabbit has automatically paused this review. You can configure this behavior by changing the reviews.auto_review.auto_pause_after_reviewed_commits setting.

• Last reviewed commit: 8032ce4
• Latest commit, not reviewed: 0ea61d2

Use the following commands to manage reviews:

• @coderabbitai resume to resume automatic reviews.
• @coderabbitai review to trigger a single review.

Use the checkboxes below for quick actions:

• ▶️ Resume reviews
• 🔍 Trigger review

Summary

• Pin install-whitaker in .github/workflows/ci.yml to revision 5a99aed78ce68dcebd3052b75c31e6f173162b1e.
• Keep the action inputs and surrounding workflow unchanged.

Walkthrough

The CI workflow now pins install-whitaker to a different revision. Its inputs and the surrounding workflow remain unchanged.

Changes

Whitaker action pin

Layer / File(s)	Summary
Update the CI action pin .github/workflows/ci.yml	The install-whitaker step now uses revision 5a99aed78ce68dcebd3052b75c31e6f173162b1e instead of 6dea5677a84fec60ca51b07202570e3af12ffdb4. Its inputs remain unchanged.

Possibly related issues

• Link leynos/whitaker#523: this change updates a downstream workflow to a shared action revision associated with the installer release.

Possibly related PRs

• Compare leynos/corbusier#249: it pins install-whitaker to the same shared-actions revision.
• Compare leynos/netsuke#1042: it updates install-whitaker and the related installer implementation.
• Compare leynos/agent-template-rust#152: it pins the action to the same revision and retains the existing inputs.

Suggested labels: Issue

Priority: Normal

Change: Bug fix

Merge Risk: Minimal · up to 8032c

No merge-blocking risk is established by this pin-only workflow change.

Pre-merge checks: 12 · 2

Failed checks: 2 warnings

Check name	Status	Explanation	Resolution
Title check		The title accurately describes the workflow repin, but it omits the issue reference DF12-89 stated in the description.	Add the applicable issue reference to the title in the required format, for example Repin install-whitaker to the 0.2.11 revision (#123). Replace #123 with the actual GitHub issue number if DF12-89 maps to one.
Developer Documentation		Document the changed CI tooling. The pull request changes .github/workflows/ci.yml from install-whitaker@6dea5677... to install-whitaker@5a99aed7.... The new revision changes the Whitaker instal…	Add or update docs/developers-guide.md. Record the pinned install-whitaker revision, the whitaker-installer 0.2.11 requirement, and the reason for the verified Clippy snapshot. Keep the documentation aligned with the workflow pin.

Passed checks: 12 passed

Check name	Status	Explanation
Linked Issues check		Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check		Check skipped because no linked issues were found for this pull request.
Testing (Overall)		The pull request changes only the pinned revision of the third-party install-whitaker GitHub Action. It does not add repository functionality or local configuration logic. The workflow already runs …
User-Facing Documentation		PASS: The pull request changes only the pinned revision of the install-whitaker GitHub Actions step in .github/workflows/ci.yml. It changes CI tooling behaviour only and introduces no user-facing …
Module-Level Documentation		Pass this check. The pull request changes only the GitHub Actions workflow pin in .github/workflows/ci.yml; it adds or changes no source module. The module-level documentation requirement is therefo…
Testing (Unit And Behavioural)		The pull request changes only the pinned revision of the existing install-whitaker GitHub Action. It does not change application behaviour, unit-test targets, or behavioural interfaces. The existing…
Testing (Property / Proof)		Pass the testing check. The pull request changes only one immutable install-whitaker action revision in .github/workflows/ci.yml; it introduces no input-dependent logic, state transition, ordering…
Testing (Compile-Time / Ui)		Treat this check as not applicable. The pull request changes only one GitHub Actions revision in .github/workflows/ci.yml; it changes no Rust or TypeScript source, compile-time behaviour, structured…
Unit Architecture		PASS. The pull request changes only one GitHub Actions reference in .github/workflows/ci.yml. It replaces the install-whitaker revision and leaves its inputs, workflow steps, cache configuration, …
Domain Architecture		Pass the check. The reviewed range changes only the pinned revision of the external install-whitaker GitHub Action in .github/workflows/ci.yml. It changes no domain code, adapter boundary, reposit…
Observability		Pass. The pull request changes only the pinned revision of the existing install-whitaker step in .github/workflows/ci.yml; its inputs and workflow structure remain unchanged. This CI dependency pi…
Description check		The description clearly explains the shared install-whitaker action repin and its purpose, which matches the CI workflow change.

Full details: Testing (Overall)

Explanation

The pull request changes only the pinned revision of the third-party install-whitaker GitHub Action. It does not add repository functionality or local configuration logic. The workflow already runs lint and test steps after installation. The check does not require tests for third-party tool behaviour in this case.

Full details: User-Facing Documentation

Explanation

PASS: The pull request changes only the pinned revision of the install-whitaker GitHub Actions step in .github/workflows/ci.yml. It changes CI tooling behaviour only and introduces no user-facing functionality or product behaviour. No user-guide update is required.

Full details: Module-Level Documentation

Explanation

Pass this check. The pull request changes only the GitHub Actions workflow pin in .github/workflows/ci.yml; it adds or changes no source module. The module-level documentation requirement is therefore not applicable.

Full details: Testing (Unit And Behavioural)

Explanation

The pull request changes only the pinned revision of the existing install-whitaker GitHub Action. It does not change application behaviour, unit-test targets, or behavioural interfaces. The existing CI workflow still exercises the action before make lint, make typecheck, make audit, and the coverage test step. No explicit testing failure condition is introduced.

Full details: Testing (Property / Proof)

Explanation

Pass the testing check. The pull request changes only one immutable install-whitaker action revision in .github/workflows/ci.yml; it introduces no input-dependent logic, state transition, ordering invariant, lemma, or proof assumption. Do not add a property test or exhaustive proof for this pin-only change.

Full details: Testing (Compile-Time / Ui)

Explanation

Treat this check as not applicable. The pull request changes only one GitHub Actions revision in .github/workflows/ci.yml; it changes no Rust or TypeScript source, compile-time behaviour, structured output, or UI-adjacent output. Do not require a trybuild or snapshot test for this pin-only change.

Full details: Unit Architecture

Explanation

PASS. The pull request changes only one GitHub Actions reference in .github/workflows/ci.yml. It replaces the install-whitaker revision and leaves its inputs, workflow steps, cache configuration, and local code unchanged. The change introduces no query, command, fallible API, dependency, or responsibility boundary issue.

Full details: Domain Architecture

Explanation

Pass the check. The reviewed range changes only the pinned revision of the external install-whitaker GitHub Action in .github/workflows/ci.yml. It changes no domain code, adapter boundary, repository, command, or business rule. No domain-architecture failure is introduced.

Full details: Observability

Explanation

Pass. The pull request changes only the pinned revision of the existing install-whitaker step in .github/workflows/ci.yml; its inputs and workflow structure remain unchanged. This CI dependency pin does not introduce a production service, request path, queue, storage boundary, or new runtime failure mode. Installation failures remain visible at the named CI step, so no new logs, metrics, traces, or alerts are required by this check.

Full details: Developer Documentation

Explanation

Document the changed CI tooling. The pull request changes .github/workflows/ci.yml from install-whitaker@6dea5677... to install-whitaker@5a99aed7.... The new revision changes the Whitaker installer behaviour to version 0.2.11, so this is a tooling change. No docs/developers-guide.md exists, and no developer-guide update is included in the pull request.

Resolution

Add or update docs/developers-guide.md. Record the pinned install-whitaker revision, the whitaker-installer 0.2.11 requirement, and the reason for the verified Clippy snapshot. Keep the documentation aligned with the workflow pin.

_{Pin the action to its new revision.
Keep each input in place.
Let the workflow run its steps.
Check the commit as it passes.
Send the old pin on its way.}

_{Comment @coderabbitai help to get the list of available commands.}

[coderabbitai]

Additional comments: 1

.github/workflows/ci.yml-59-59: 1

59-59: Minor · Security & Privacy · Quick win

Unverified finding
Verification ran but could not confirm this finding. It is shown for review, not as a verified issue.

Restrict permissions before running the new action revision.

The workflow has no explicit permissions block, so this newly selected third-party action uses the repository's default token permissions. Those permissions can exceed this job's requirements. Add an explicit least-privilege block, such as contents: read if sufficient, and confirm that later steps need no additional scopes.

Source: Linters/SAST tools

---

Review info

Run configuration

• Source mode: Auto
• Repository: Unavailable
• Branch: Unavailable
• File: No configuration file from this repository applied
• Commit: Unavailable
• Layers: Organization UI
• Review profile: ASSERTIVE
• Plan: Team
• Run ID: 893692e4-56b2-47f0-a9c5-c0e87f6a8da2

Commits

Reviewing files that changed from the base of the PR and between 273e80f and 8032ce4.

Files selected for processing: 1

• .github/workflows/ci.yml

Included review availability: This review used your included allowance. 0 included reviews remain after this review. Your included PR review attempts over the past 7 days set your current allowance at 1 review per hour.

[sourcery-ai]

Sorry @leynos, you've used your own review budget of 250,000 diff characters for the last 7 days.

You can request another review in 6 days and 16 hours by commenting @sourcery-ai review. Upgrade to get a review now.

[sourcery-ai]

Reviewer's guide (collapsed on small PRs)

Reviewer's Guide

The CI workflow now pins the shared install-whitaker action to shared-actions revision 5a99aed..., which defaults to whitaker-installer 0.2.11 and avoids cold-build failures caused by upstream Dylint 6.0.1 referencing Clippy’s deleted master branch.

File-Level Changes

Change	Details	Files
Repin the shared Whitaker installation action to a revision that uses whitaker-installer 0.2.11.	Replace the action SHA used by the CI lint/test-tools setup. Retain the existing Cranelift configuration while relying on the pinned action revision for the installer default. No changes to other Whitaker or Dylint installation paths.	.github/workflows/ci.yml

---

Tips and commands

Interacting with Sourcery

• Trigger a new review: Comment @sourcery-ai review on the pull request.
• Continue discussions: Reply directly to Sourcery's review comments.
• Generate a GitHub issue from a review comment: Ask Sourcery to create an
  issue from a review comment by replying to it. You can also reply to a
  review comment with @sourcery-ai issue to create an issue from it.
• Generate a pull request title: Write @sourcery-ai anywhere in the pull
  request title to generate a title at any time. You can also comment
  @sourcery-ai title on the pull request to (re-)generate the title at any time.
• Generate a pull request summary: Write @sourcery-ai summary anywhere in
  the pull request body to generate a PR summary at any time exactly where you
  want it. You can also comment @sourcery-ai summary on the pull request to
  (re-)generate the summary at any time.
• Generate reviewer's guide: Comment @sourcery-ai guide on the pull
  request to (re-)generate the reviewer's guide at any time.
• Resolve all Sourcery comments: Comment @sourcery-ai resolve on the
  pull request to resolve all Sourcery comments. Useful if you've already
  addressed all the comments and don't want to see them anymore.
• Dismiss all Sourcery reviews: Comment @sourcery-ai dismiss on the pull
  request to dismiss all existing Sourcery reviews. Especially useful if you
  want to start fresh with a new review - don't forget to comment
  @sourcery-ai review to trigger a new review!

Customizing Your Experience

Access your dashboard to:

• Enable or disable review features such as the Sourcery-generated pull request
  summary, the reviewer's guide, and others.
• Change the review language.
• Add, remove or edit custom review instructions.
• Adjust other review settings.

Getting Help

• Contact our support team for questions or feedback.
• Visit our documentation for detailed guides and information.
• Keep in touch with the Sourcery team by following us on X/Twitter, LinkedIn or GitHub.