[leynos]

Part of DF12-89

Repins leynos/shared-actions/.github/actions/install-whitaker to 5a99aed78ce68dcebd3052b75c31e6f173162b1e (shared-actions #651, approved by concordat #331). That revision defaults whitaker-installer to 0.2.11, which builds the Dylint driver from a verified Clippy snapshot; upstream Dylint 6.0.1 clones Clippy's deleted master branch, so every cold Whitaker driver build was failing and the lint lane was red.

• Pin-only change to the workflow files; no trailing version comment is added (it broke exact-match contracts elsewhere).
• Any explicit installer-version / WHITAKER_INSTALLER_VERSION is set to 0.2.11.
• Other Whitaker paths outside the action (cargo dylint, binstall whitaker, whitaker-installer, DYLINT_*): none that install or run Dylint outside the action and wrappers, unless listed below.
• Also includes the lock-only advisory bump (Cargo.lock only) for RUSTSEC-2026-0385, -0387, -0346 to -0349, -0382 and -0383 (ctutils, crypto-bigint, rustls, rustls-webpki, webpki-root-certs): the cargo audit step was failing every PR here, and the lint lane cannot go green without this repin, so the two have to land together. RUSTSEC-2023-0071 (rsa) has no fixed release and stays in the existing ignore list.

Summary by Sourcery

Repin Whitaker installation and refresh affected dependency locks so the lint and audit CI lanes can pass reliably.

Bug Fixes:

• Restore successful Whitaker/Dylint driver builds by repinning the shared install-whitaker action to a revision using Whitaker installer 0.2.11.

CI:

• Update the CI workflow to use the verified shared install-whitaker action revision.

Chores:

• Refresh Cargo.lock advisories to allow dependency auditing to pass alongside the Whitaker action repin.

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-10-30T05:15:07.923353Z	4d2c57e	PR opened
🔒 Security Review	✅ Completed 2026-10-30T05:16:19.950774Z	4d2c57e	PR opened

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[coderabbitai]

Note

Reviews paused

It looks like this branch is under active development. To avoid overwhelming you with review comments due to an influx of new commits, CodeRabbit has automatically paused this review. You can configure this behavior by changing the reviews.auto_review.auto_pause_after_reviewed_commits setting.

• Last reviewed commit: 4d2c57e
• Latest commit, not reviewed: a7c9a2b

Use the following commands to manage reviews:

• @coderabbitai resume to resume automatic reviews.
• @coderabbitai review to trigger a single review.

Use the checkboxes below for quick actions:

• ▶️ Resume reviews
• 🔍 Trigger review

No actionable comments were generated in the recent review.

Recent review info

Run configuration

• Source mode: Auto
• Repository: Unavailable
• Branch: Unavailable
• File: No configuration file from this repository applied
• Commit: Unavailable
• Layers: Organization UI
• Review profile: ASSERTIVE
• Plan: Team
• Run ID: 70fced6e-e05f-4d7a-b757-a193c261e69d

Commits

Reviewing files that changed from the base of the PR and between 855046b and 4d2c57e.

Files selected for processing: 1

• .github/workflows/ci.yml

Included review availability: This review used your included allowance. 0 included reviews remain after this review. Your included PR review attempts over the past 7 days set your current allowance at 1 review per hour.

Summary

• Pin the Install Whitaker step in .github/workflows/ci.yml to shared-action revision 5a99aed78ce68dcebd3052b75c31e6f173162b1e.
• Keep the cranelift: true input unchanged.

Testing

• Test results were not provided.

Walkthrough

The CI workflow now pins the Install Whitaker step to revision 5a99aed78ce68dcebd3052b75c31e6f173162b1e. The cranelift: true input is unchanged.

Changes

Whitaker CI installation

Layer / File(s)	Summary
Update the Whitaker action revision .github/workflows/ci.yml	The Install Whitaker step uses the new shared-action revision. The cranelift: true input remains unchanged.

Possibly related issues

• leynos/whitaker#530 — The issue covers adoption of the released Whitaker installer and bootstrap.
• leynos/whitaker#529 — The issue covers the Clippy snapshot bootstrap used by the action revision.

Possibly related PRs

• leynos/corbusier#249 — Updates the same action to the same revision.
• leynos/agent-template-python#110 — Updates the same action revision and retains cranelift: true.
• leynos/netsuke#1042 — Updates the same action revision and its related workflow contract.

Suggested labels: Issue

Priority: Normal

Change: Bug fix

Merge Risk: Minimal · previous review 4d2c5

The workflow pin is compatible with the existing Whitaker installation contract and is ready to merge.

Pre-merge checks: 14

Check name	Status	Explanation
Title check		Accept the title because it clearly identifies the main change: repinning the Whitaker installation action to the 0.2.11 revision.
Linked Issues check		Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check		Check skipped because no linked issues were found for this pull request.
Testing (Overall)		Pass the testing check. The pull request changes only the pinned revision of the third-party install-whitaker action in .github/workflows/ci.yml; cranelift: true remains unchanged. The check doe…
User-Facing Documentation		Pass the documentation check. The pull request changes only the pinned revision of the CI install-whitaker action. It does not change application, API, CLI, or other user-facing behaviour, and the e…
Developer Documentation		PASS — The pull request changes only the CI action revision for the existing Whitaker installation. It does not add or change an internal API, architectural boundary, abstraction, local build requirem…
Module-Level Documentation		The check is inapplicable. The pull request changes only the Install Whitaker action revision in .github/workflows/ci.yml; it adds or modifies no modules. No module-level documentation failure was…
Testing (Unit And Behavioural)		The pull request changes only one immutable GitHub Actions reference in .github/workflows/ci.yml; it adds no application code or local behaviour. The existing CI boundary installs Whitaker and then …
Testing (Property / Proof)		PASS: The pull request changes one GitHub Actions revision in .github/workflows/ci.yml and preserves cranelift: true. It introduces no code invariant over inputs, states, orderings, or transitions…
Testing (Compile-Time / Ui)		Pass. The pull request changes only the pinned revision of the install-whitaker GitHub Action. It introduces no Rust or TypeScript compile-time behaviour and no text-based or UI-adjacent output. No …
Unit Architecture		The pull request changes only .github/workflows/ci.yml. It replaces one pinned install-whitaker action revision and keeps cranelift: true unchanged. It adds no query, command, fallible operation…
Domain Architecture		The pull request changes only the GitHub Actions pin for install-whitaker in .github/workflows/ci.yml. It does not change domain code, domain interfaces, commands, repositories, adapters, or busin…
Observability		PASS: The pull request changes only the pinned revision of the Install Whitaker GitHub Actions step. It does not change production code or introduce a production operational failure mode, throughput…
Description check		The description directly explains the workflow pin update and its purpose. It also identifies related installer and audit changes, which match the changeset objectives.

Full details: Testing (Overall)

Explanation

Pass the testing check. The pull request changes only the pinned revision of the third-party install-whitaker action in .github/workflows/ci.yml; cranelift: true remains unchanged. The check does not require tests to prove that a third-party tool works as advertised. The existing workflow still runs make lint after installation, and the repository’s workflow contract tests remain in CI.

Full details: User-Facing Documentation

Explanation

Pass the documentation check. The pull request changes only the pinned revision of the CI install-whitaker action. It does not change application, API, CLI, or other user-facing behaviour, and the existing cranelift input remains unchanged. No update to docs/users-guide.md is required.

Full details: Developer Documentation

Explanation

PASS — The pull request changes only the CI action revision for the existing Whitaker installation. It does not add or change an internal API, architectural boundary, abstraction, local build requirement, or developer-facing tool. The developer guide already documents that make lint runs Whitaker, and the Makefile invocation is unchanged. No design, ADR, roadmap, or execplan update is required.

Full details: Module-Level Documentation

Explanation

The check is inapplicable. The pull request changes only the Install Whitaker action revision in .github/workflows/ci.yml; it adds or modifies no modules. No module-level documentation failure was introduced.

Full details: Testing (Unit And Behavioural)

Explanation

The pull request changes only one immutable GitHub Actions reference in .github/workflows/ci.yml; it adds no application code or local behaviour. The existing CI boundary installs Whitaker and then runs make lint, which exercises the pinned action in the workflow that it changes. No separate unit or end-to-end test is required for this pin-only change.

Full details: Testing (Property / Proof)

Explanation

PASS: The pull request changes one GitHub Actions revision in .github/workflows/ci.yml and preserves cranelift: true. It introduces no code invariant over inputs, states, orderings, or transitions, and it introduces no lemma or proof assumption. Property testing or exhaustive proof is therefore not applicable.

Full details: Testing (Compile-Time / Ui)

Explanation

Pass. The pull request changes only the pinned revision of the install-whitaker GitHub Action. It introduces no Rust or TypeScript compile-time behaviour and no text-based or UI-adjacent output. No trybuild or snapshot test is required by this check.

Full details: Unit Architecture

Explanation

The pull request changes only .github/workflows/ci.yml. It replaces one pinned install-whitaker action revision and keeps cranelift: true unchanged. It adds no query, command, fallible operation, dependency, state mutation, or test unit. The Unit Architecture conditions are therefore not triggered.

Full details: Domain Architecture

Explanation

The pull request changes only the GitHub Actions pin for install-whitaker in .github/workflows/ci.yml. It does not change domain code, domain interfaces, commands, repositories, adapters, or business rules. The Domain Architecture failure conditions are not applicable.

Full details: Observability

Explanation

PASS: The pull request changes only the pinned revision of the Install Whitaker GitHub Actions step. It does not change production code or introduce a production operational failure mode, throughput path, service boundary, or state transition that requires new logs, metrics, traces, or alerts. The workflow step remains an explicit failure boundary for CI diagnosis.

_{Pin the action to a newer track
Keep cranelift: true intact
CI follows the updated ref
Whitaker steps along the path
One small change in the workflow file}

_{Comment @coderabbitai help to get the list of available commands.}

[sourcery-ai]

Sorry @leynos, you've used your own review budget of 250,000 diff characters for the last 7 days.

You can request another review in 6 days and 16 hours by commenting @sourcery-ai review. Upgrade to get a review now.

[sourcery-ai]

Reviewer's guide (collapsed on small PRs)

Reviewer's Guide

Updates the CI workflow’s pinned Whitaker installation action from the failing revision to the approved shared-actions commit, whose installer defaults to whitaker-installer 0.2.11 and avoids the deleted Clippy master branch.

File-Level Changes

Change	Details	Files
Repin the CI Whitaker installation action to a revision that uses whitaker-installer 0.2.11.	Replace the existing shared action commit SHA with the approved shared-actions revision. Retain the existing Cranelift-enabled installation configuration.	.github/workflows/ci.yml

---

Tips and commands

Interacting with Sourcery

• Trigger a new review: Comment @sourcery-ai review on the pull request.
• Continue discussions: Reply directly to Sourcery's review comments.
• Generate a GitHub issue from a review comment: Ask Sourcery to create an
  issue from a review comment by replying to it. You can also reply to a
  review comment with @sourcery-ai issue to create an issue from it.
• Generate a pull request title: Write @sourcery-ai anywhere in the pull
  request title to generate a title at any time. You can also comment
  @sourcery-ai title on the pull request to (re-)generate the title at any time.
• Generate a pull request summary: Write @sourcery-ai summary anywhere in
  the pull request body to generate a PR summary at any time exactly where you
  want it. You can also comment @sourcery-ai summary on the pull request to
  (re-)generate the summary at any time.
• Generate reviewer's guide: Comment @sourcery-ai guide on the pull
  request to (re-)generate the reviewer's guide at any time.
• Resolve all Sourcery comments: Comment @sourcery-ai resolve on the
  pull request to resolve all Sourcery comments. Useful if you've already
  addressed all the comments and don't want to see them anymore.
• Dismiss all Sourcery reviews: Comment @sourcery-ai dismiss on the pull
  request to dismiss all existing Sourcery reviews. Especially useful if you
  want to start fresh with a new review - don't forget to comment
  @sourcery-ai review to trigger a new review!

Customizing Your Experience

Access your dashboard to:

• Enable or disable review features such as the Sourcery-generated pull request
  summary, the reviewer's guide, and others.
• Change the review language.
• Add, remove or edit custom review instructions.
• Adjust other review settings.

Getting Help

• Contact our support team for questions or feedback.
• Visit our documentation for detailed guides and information.
• Keep in touch with the Sourcery team by following us on X/Twitter, LinkedIn or GitHub.