[leynos]

Part of DF12-89

Repins leynos/shared-actions/.github/actions/install-whitaker to 5a99aed78ce68dcebd3052b75c31e6f173162b1e (shared-actions #651, approved as a root by concordat QG-002, leynos/concordat#331). The action then defaults to whitaker-installer 0.2.11, which builds the Dylint driver from a verified Clippy snapshot: upstream Dylint 6.0.1 clones Clippy's master, which no longer exists, so every cold Whitaker driver build fails.

Also installer-version: '0.2.9' to '0.2.11' in ci.yml and ci-windows.yml, WHITAKER_INSTALLER_VERSION in tests/workflow_ci.rs, and four statements in docs/developers-guide.md.

Other Whitaker paths

No bare cargo dylint, cargo binstall whitaker or hand-rolled installer outside the action and the whitaker wrapper.

Notes

A cache-restored driver rebuilds once (about a minute); that is expected. Gate: CI green on the lint lane at the head, with the lint job's log read for Whitaker's diagnostics.

Summary by Sourcery

Repin the CI Whitaker installation to the approved shared action revision and installer version 0.2.11.

Bug Fixes:

• Update Whitaker installation to version 0.2.11 to restore reliable cold driver builds from a verified Clippy snapshot.

CI:

• Repin the shared Whitaker installer action in Linux and Windows CI workflows and keep workflow validation aligned with the new installer version.

Documentation:

• Update developer guidance to document Whitaker installer version 0.2.11.

[sourcery-ai]

Sorry @leynos, you've used your own review budget of 250,000 diff characters for the last 7 days.

You can request another review in 6 days and 18 hours by commenting @sourcery-ai review. Upgrade to get a review now.

[sourcery-ai]

Reviewer's guide (collapsed on small PRs)

Reviewer's Guide

Repins Whitaker installation to the approved shared action revision and whitaker-installer 0.2.11, which uses a verified Clippy snapshot and avoids failures caused by upstream Dylint cloning the removed Clippy master branch. Workflow tests and developer documentation are updated to keep the version contract consistent across CI and local installation instructions.

File-Level Changes

Change	Details	Files
Repin the shared Whitaker installation action and explicitly select the fixed installer release in both CI lint workflows.	Update the action reference to the approved SHA. Change the installer input from 0.2.9 to 0.2.11. Retain existing cache ownership and platform-specific installation behavior.	.github/workflows/ci.yml .github/workflows/ci-windows.yml
Synchronize repository workflow validation with the new Whitaker installer version.	Update the expected installer version used by CI workflow tests.	tests/workflow_ci.rs
Update developer documentation so local installation instructions and CI descriptions match the new pinned release.	Replace documented 0.2.9 references with 0.2.11 across Linux and Windows guidance. Document the same version used by the SHA-pinned action.	docs/developers-guide.md

---

Tips and commands

Interacting with Sourcery

• Trigger a new review: Comment @sourcery-ai review on the pull request.
• Continue discussions: Reply directly to Sourcery's review comments.
• Generate a GitHub issue from a review comment: Ask Sourcery to create an
  issue from a review comment by replying to it. You can also reply to a
  review comment with @sourcery-ai issue to create an issue from it.
• Generate a pull request title: Write @sourcery-ai anywhere in the pull
  request title to generate a title at any time. You can also comment
  @sourcery-ai title on the pull request to (re-)generate the title at any time.
• Generate a pull request summary: Write @sourcery-ai summary anywhere in
  the pull request body to generate a PR summary at any time exactly where you
  want it. You can also comment @sourcery-ai summary on the pull request to
  (re-)generate the summary at any time.
• Generate reviewer's guide: Comment @sourcery-ai guide on the pull
  request to (re-)generate the reviewer's guide at any time.
• Resolve all Sourcery comments: Comment @sourcery-ai resolve on the
  pull request to resolve all Sourcery comments. Useful if you've already
  addressed all the comments and don't want to see them anymore.
• Dismiss all Sourcery reviews: Comment @sourcery-ai dismiss on the pull
  request to dismiss all existing Sourcery reviews. Especially useful if you
  want to start fresh with a new review - don't forget to comment
  @sourcery-ai review to trigger a new review!

Customizing Your Experience

Access your dashboard to:

• Enable or disable review features such as the Sourcery-generated pull request
  summary, the reviewer's guide, and others.
• Change the review language.
• Add, remove or edit custom review instructions.
• Adjust other review settings.

Getting Help

• Contact our support team for questions or feedback.
• Visit our documentation for detailed guides and information.
• Keep in touch with the Sourcery team by following us on X/Twitter, LinkedIn or GitHub.

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-10-30T03:14:48.251413Z	b8aa256	PR opened
🔒 Security Review	✅ Completed 2026-10-30T03:16:02.571734Z	b8aa256	PR opened

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[coderabbitai]

Note

Reviews paused

It looks like this branch is under active development. To avoid overwhelming you with review comments due to an influx of new commits, CodeRabbit has automatically paused this review. You can configure this behavior by changing the reviews.auto_review.auto_pause_after_reviewed_commits setting.

• Last reviewed commit: 226768b

Use the following commands to manage reviews:

• @coderabbitai resume to resume automatic reviews.
• @coderabbitai review to trigger a single review.

Use the checkboxes below for quick actions:

• ▶️ Resume reviews
• 🔍 Trigger review

Summary

• Repin the shared Whitaker installer action in the Linux and Windows CI workflows to revision 5a99aed78ce68dcebd3052b75c31e6f173162b1e.
• Set the installer version to 0.2.11 in both workflows, tests/workflow_ci.rs and the developer guide.
• Align the pin with the root approval under concordat QG-002 (concordat PR #331).

The supplied results do not establish CI status.

Walkthrough

Update the Windows and standard CI workflows to use a new shared Whitaker action revision and installer version 0.2.11. Update the developer guide and workflow test to match.

Changes

Whitaker installer pin update

Layer / File(s)	Summary
Align Whitaker installer pins .github/workflows/ci.yml, .github/workflows/ci-windows.yml, docs/developers-guide.md, tests/workflow_ci.rs	The CI workflows now use shared action revision 5a99aed78ce68dcebd3052b75c31e6f173162b1e and installer version 0.2.11. The guide and test expectation use version 0.2.11.

Possibly related issues

• Consume Whitaker’s reproducible Dylint bootstrap shared-actions#650 — The updated shared action revision is identified as providing the Clippy snapshot bootstrap associated with this issue.
• Record released snapshot evidence and adopt the bootstrap in shared-actions whitaker#530 — This PR updates the downstream shared action pin and installer version to 0.2.11.

Possibly related PRs

• leynos/shared-actions#651 — Implements the install-whitaker 0.2.11 bootstrap contract consumed by this PR.
• leynos/shared-actions#644 — Updates the install-whitaker default version that precedes this PR’s 0.2.11 pin.
• leynos/cuprum#670 — Applies the same shared action revision and installer version update in another repository.

Suggested labels: Roadmap

Suggested reviewers: codescene-access

Priority: Normal

Change: Bug fix

Merge Risk: Minimal · up to 22676

No material merge-blocking risk remains.

Pre-merge checks: 15

Check name	Status	Explanation
Title check		The title accurately identifies the main change: repinning the Whitaker installer action and updating the installer to version 0.2.11. No roadmap item or GitHub issue number is required by the provide…
Description check		The description directly explains the Whitaker action repin, version updates, affected workflows, tests, documentation, and the reason for the fix.
Docstring Coverage		No eligible functions found in the changed files. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff with cyclomatic complexity of at least 2. Documentat…
Linked Issues check		Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check		Check skipped because no linked issues were found for this pull request.
Testing (Overall)		Pass the testing check. The pull request changes only CI installer configuration and documentation. tests/workflow_ci.rs:433-452 parses each workflow and asserts the Whitaker action path, full SHA p…
User-Facing Documentation		Pass the check. The pull request changes only CI Whitaker installer pins, the workflow contract constant, and developer-facing installation guidance. It introduces no user-facing product functionality…
Developer Documentation		Accept this check. The PR changes the Whitaker installer tooling pin, and docs/developers-guide.md documents installer-version: '0.2.11' and matching local installation commands in both relevant g…
Module-Level Documentation		Keep the check passing. The pull request changes only workflow YAML, Markdown, and one existing Rust test module. tests/workflow_ci.rs retains its module-level //! documentation at line 1, and the…
Testing (Unit And Behavioural)		PASS. The pull request changes workflow pins and installer inputs, with no new application logic or local edge/error paths. Existing behavioural contract coverage reads both workflow files and verifie…
Testing (Property / Proof)		PASS: The pull request only updates the Whitaker action revision, installer version, documentation literals, and the matching workflow-test constant. It introduces no invariant over a broad input or s…
Testing (Compile-Time / Ui)		Pass this check. The PR changes only GitHub workflow pins, documentation version text, and the expected constant in tests/workflow_ci.rs; it introduces no Rust or TypeScript compile-time behaviour. …
Unit Architecture		Pass. The pull request changes only CI action pins, the Whitaker installer version, matching documentation, and the workflow contract constant. It does not add or alter query paths, command implementa…
Domain Architecture		Pass the Domain Architecture check. The pull request changes only Whitaker CI pins, developer documentation, and a workflow contract test. The diff contains no domain or application source changes, so…
Observability		The pull request only repins the Whitaker CI installer and updates matching documentation and contract-test data. It does not change production runtime behaviour. The Linux workflow runs Whitaker thro…

Full details: Title check

Explanation

The title accurately identifies the main change: repinning the Whitaker installer action and updating the installer to version 0.2.11. No roadmap item or GitHub issue number is required by the provided context.

Full details: Docstring Coverage

Explanation

No eligible functions found in the changed files. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff with cyclomatic complexity of at least 2. Documentation-only edits and deletions within surviving functions are included; unchanged diff context and fully deleted functions are excluded. Analyzed 0 functions across 1 files. (3 skipped: 3 unsupported.)

Full details: Testing (Overall)

Explanation

Pass the testing check. The pull request changes only CI installer configuration and documentation. tests/workflow_ci.rs:433-452 parses each workflow and asserts the Whitaker action path, full SHA pin, exact installer-version, and absence of an ad hoc install script. tests/workflow_ci.rs:477-489 invokes this contract for both Linux and Windows jobs. The changed constant at line 19 makes the test fail if either workflow retains 0.2.9 or uses a different version. Do not add tests for the third-party installer implementation itself.

Full details: User-Facing Documentation

Explanation

Pass the check. The pull request changes only CI Whitaker installer pins, the workflow contract constant, and developer-facing installation guidance. It introduces no user-facing product functionality or behaviour, so docs/users-guide.md and a migration document are not required.

Full details: Developer Documentation

Explanation

Accept this check. The PR changes the Whitaker installer tooling pin, and docs/developers-guide.md documents installer-version: '0.2.11' and matching local installation commands in both relevant guide sections (lines 2880-2894 and 3156-3167). The Windows guidance also records the new version at lines 8254-8255. The workflows and workflow contract use the same version (.github/workflows/ci.yml:216, .github/workflows/ci-windows.yml:168, tests/workflow_ci.rs:19). No architecture or system-design change requires an ADR, and no new execplan or roadmap item is introduced.

Full details: Module-Level Documentation

Explanation

Keep the check passing. The pull request changes only workflow YAML, Markdown, and one existing Rust test module. tests/workflow_ci.rs retains its module-level //! documentation at line 1, and the diff adds no module or undocumented module.

Full details: Testing (Unit And Behavioural)

Explanation

PASS. The pull request changes workflow pins and installer inputs, with no new application logic or local edge/error paths. Existing behavioural contract coverage reads both workflow files and verifies the shared Whitaker action, full commit-SHA pin, installer version, installation order, and the Windows PowerShell wrapper (tests/workflow_ci.rs:433-489). The pull request updates that contract's expected version to 0.2.11 (tests/workflow_ci.rs:17-20). The contract exercises the workflow boundary rather than private implementation seams, so no additional unit or end-to-end test is required for this configuration-only repin.

Full details: Testing (Property / Proof)

Explanation

PASS: The pull request only updates the Whitaker action revision, installer version, documentation literals, and the matching workflow-test constant. It introduces no invariant over a broad input or state space, and it introduces no lemma or proof assumption. A property test or exhaustive proof is therefore not required.

Full details: Testing (Compile-Time / Ui)

Explanation

Pass this check. The PR changes only GitHub workflow pins, documentation version text, and the expected constant in tests/workflow_ci.rs; it introduces no Rust or TypeScript compile-time behaviour. The workflow test already checks the structured YAML contract with focused semantic assertions at tests/workflow_ci.rs:433-450, so a trybuild test is not applicable. The documentation and workflow edits do not add text-based UI or user-output behaviour that requires snapshots.

Full details: Unit Architecture

Explanation

Pass. The pull request changes only CI action pins, the Whitaker installer version, matching documentation, and the workflow contract constant. It does not add or alter query paths, command implementations, fallible APIs, dependency boundaries, or unit responsibilities. The workflow test continues to verify the shared action and the updated installer version at tests/workflow_ci.rs:435-445. The changed workflows use the pinned action and installer-version: '0.2.11' in both Linux and Windows jobs.

Full details: Domain Architecture

Explanation

Pass the Domain Architecture check. The pull request changes only Whitaker CI pins, developer documentation, and a workflow contract test. The diff contains no domain or application source changes, so it introduces no adapter, transport, persistence, infrastructure, or domain-boundary violation.

Full details: Observability

Explanation

The pull request only repins the Whitaker CI installer and updates matching documentation and contract-test data. It does not change production runtime behaviour. The Linux workflow runs Whitaker through the named Lint step and the Makefile exposes both Whitaker invocations (.github/workflows/ci.yml:212-221; Makefile:401-405). The Windows workflow has a named install step, a named PowerShell lint step, explicit exit-code checks, and always-run sccache reporting (.github/workflows/ci-windows.yml:164-209). GitHub Actions therefore retains step output and failure diagnostics. No new production failure mode, metric, trace, or alert requirement is introduced.

_{Pins align across the gates
Version numbers match the guide
Tests record the same new pin
Windows follows in the line
Whitaker’s version reads 0.2.11}

_{Comment @coderabbitai help to get the list of available commands.}

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: b8aa256e83

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

Move the action-pin comments outside the folded scalars

Because uses: >- introduces a YAML block scalar, the appended # shared-actions ... text becomes part of the action reference rather than a comment. Parsing both changed workflows confirms this: Linux build-test and Windows lint-windows now request a revision containing the SHA plus the annotation, which cannot resolve to the intended commit and prevents those jobs from running. Move the annotation above uses: or remove it in both workflows.

Useful? React with 👍 / 👎.

[pandalump]

@coderabbitai This PR repins install-whitaker to shared-actions 5a99aed7 (whitaker-installer 0.2.11) in ci.yml and ci-windows.yml, moves installer-version from 0.2.9 to 0.2.11, and updates WHITAKER_INSTALLER_VERSION in tests/workflow_ci.rs and four statements in docs/developers-guide.md. All checks are green at the head. Does the change have any Error-level problem?

[coderabbitai]

Tip

For best results, initiate chat on the files or code changes.

🧩 Analysis chain

🏁 Script executed:

#!/bin/bash
set -euo pipefail
gh pr view 1042 --repo leynos/netsuke --json headRefOid,statusCheckRollup
gh pr diff 1042 --repo leynos/netsuke
ast-grep outline tests/workflow_ci.rs --match 'whitaker|WHITAKER' --view expanded
rg -n -C 5 'install-whitaker|installer-version' .github/workflows/ci.yml .github/workflows/ci-windows.yml
sed -n '1,28p;420,495p' tests/workflow_ci.rs
rg -n -C 4 '0\.2\.11|0\.2\.9' docs/developers-guide.md
rg -n -C 4 'install-whitaker|SHARED_ACTION_PIN_EXCEPTIONS' tests/support/workflow_estate.rs

Length of output: 22367

---

🏁 Script executed:

#!/bin/bash
set -euo pipefail
printf '\n--- Locate shared-action policy files ---\n'
fd -i 'workflow_estate|whitaker.*pin' . --hidden --exclude .git
printf '\n--- Current pin policy references ---\n'
rg -n -C 3 'SHARED_ACTION_PIN_EXCEPTIONS|5a99aed78ce68dcebd3052b75c31e6f173162b1e|compliant_install_whitaker_refs' . --hidden -g '!.git/**' || test "$?" -eq 1
printf '\n--- Linux Whitaker diagnostics ---\n'
gh run view 40996387237 --repo leynos/netsuke --job 123870481593 --log | grep -Ei 'whitaker|dylint|clippy.*snapshot' | tail -n 65
printf '\n--- Windows Whitaker diagnostics ---\n'
gh run view 40996387237 --repo leynos/netsuke --job 123870481589 --log | grep -Ei 'whitaker|dylint|clippy.*snapshot' | tail -n 65

Length of output: 21708

---

🏁 Script executed:

#!/bin/bash
set -euo pipefail
sed -n '173,210p' .github/workflows/ci-windows.yml
gh run view 40996387237 --repo leynos/netsuke --job 123870481589 --log | grep -E -B 8 -A 18 'command failed|Dylint rebuilt a ready driver|03:53:57'

Length of output: 11430

---

@pandalump No Error-level problem identified in the current diff at head 226768b7512beed787920121b610fd9a6767522b.

• Both workflows use the same full action SHA and installer-version: '0.2.11'.
• WHITAKER_INSTALLER_VERSION and the developer guide match those inputs.
• The existing workflow contract checks both installer steps and the Windows wrapper.
• Current Linux and Windows lint jobs passed. The logs show Whitaker ran against both packages.

Treat the Windows driver-probe warning as non-blocking for this PR. Dylint rebuilt the driver, and lint completed successfully. The PowerShell step explicitly propagates non-zero exit codes from both Whitaker invocations.

No additional test or code change is required for this repin based on this inspection.

_{You are interacting with an AI system.}