Repin install-whitaker to the 0.2.11 revision

.github/workflows/audit.yml

@@ -39,7 +39,7 @@ jobs:
       # cache-provider stays "github": this job mounts no cache of its own, so
       # the shared action is the single owner of the Cargo paths it uses.
       - name: Install Rust toolchain
-        uses: leynos/shared-actions/.github/actions/setup-rust@6cec89bac47a21cf756d68d638a9a510998e57f8
+        uses: leynos/shared-actions/.github/actions/setup-rust@5a99aed78ce68dcebd3052b75c31e6f173162b1e
       - name: Install cargo-audit
         env:
           GITHUB_TOKEN: ${{ github.token }}

.github/workflows/ci.yml

@@ -39,14 +39,9 @@ env:
   # Earlier releases pin 6.0.1, whose dylint_driver build script clones
   # rust-lang/rust-clippy at "master"; that repository now has only "main", so
   # the driver build fails with `revspec 'master' not found` before any lint
-  # runs. The failure is independent of the code under review.
+  # runs. The pinned install-whitaker action carries 0.2.11's digests, so no
+  # digest is supplied here.
   WHITAKER_INSTALLER_VERSION: '0.2.11'
-  # The pinned install-whitaker commit predates 0.2.11, so its digest manifest
-  # has no entry for it. Both runner labels this job can select are x86_64
-  # Linux, so one digest covers every arm. This is the published release
-  # digest, matching the `.sha256` sidecar published beside the archive:
-  # https://github.com/leynos/whitaker/releases/download/v0.2.11/whitaker-installer-x86_64-unknown-linux-gnu-v0.2.11.tgz.sha256
-  WHITAKER_INSTALLER_SHA256: 'a32a665d01c4a2eb03a87c584d57329fc72a3aac421c8c2b15bbdb19e5410236'
   YAMLLINT_VERSION: '1.35.1'
 
 # Default GITHUB_TOKEN to no access; each job re-grants only what it needs.
@@ -123,7 +118,6 @@ jobs:
             nixie=${{ env.NIXIE_VERSION }}
             uv=${{ env.UV_VERSION }}
             whitaker-installer=${{ env.WHITAKER_INSTALLER_VERSION }}
-            whitaker-installer-sha256=${{ env.WHITAKER_INSTALLER_SHA256 }}
             yamllint=${{ env.YAMLLINT_VERSION }}
           # The Makefile pins every `uv tool run` version, so its digest owns
           # the repository-local uv layers, and dylint.toml selects the
@@ -266,7 +260,7 @@ jobs:
       # become a second owner of them.
       - name: Install Rust toolchain
         id: setup-rust
-        uses: leynos/shared-actions/.github/actions/setup-rust@6cec89bac47a21cf756d68d638a9a510998e57f8
+        uses: leynos/shared-actions/.github/actions/setup-rust@5a99aed78ce68dcebd3052b75c31e6f173162b1e
         with:
           cache-provider: external
           # `setup-rust` owns sccache: it selects the backend by runner, starts the
@@ -323,7 +317,7 @@ jobs:
       # distribution; replaces the former `cargo binstall merman-cli` and
       # bare `uv tool install nixie-cli` steps.
       - name: Install Nixie and Merman
-        uses: leynos/shared-actions/.github/actions/install-nixie@6cec89bac47a21cf756d68d638a9a510998e57f8
+        uses: leynos/shared-actions/.github/actions/install-nixie@5a99aed78ce68dcebd3052b75c31e6f173162b1e
         with:
           nixie-version: ${{ env.NIXIE_VERSION }}
           merman-version: ${{ env.MERMAN_VERSION }}
@@ -429,7 +423,7 @@ jobs:
       - name: Install mdtablefix
         # `make check-fmt` runs `mdtablefix --check --git`; 0.6.0 is the
         # first release with `--check` and `--git`.
-        uses: leynos/shared-actions/.github/actions/install-mdtablefix@6cec89bac47a21cf756d68d638a9a510998e57f8
+        uses: leynos/shared-actions/.github/actions/install-mdtablefix@5a99aed78ce68dcebd3052b75c31e6f173162b1e
         with:
           version: "0.6.1"
 
@@ -458,10 +452,9 @@ jobs:
         run: make lint-clippy
 
       - name: Install Whitaker
-        uses: leynos/shared-actions/.github/actions/install-whitaker@6cec89bac47a21cf756d68d638a9a510998e57f8
+        uses: leynos/shared-actions/.github/actions/install-whitaker@5a99aed78ce68dcebd3052b75c31e6f173162b1e
         with:
           installer-version: ${{ env.WHITAKER_INSTALLER_VERSION }}
-          installer-sha256: ${{ env.WHITAKER_INSTALLER_SHA256 }}
           # This job's tool cache owns ~/.cargo/bin and ~/.local/share/whitaker.
           cache-provider: external
       - name: Whitaker lint
@@ -726,7 +719,7 @@ jobs:
           # workflow one, so it is read here in the shell.
           RUNNER_SCOPE: ${{ runner.os }}-${{ runner.arch }}-${{ runner.environment }}
           CARGO_LOCK_HASH: ${{ hashFiles('rust-toolchain.toml', '**/Cargo.lock') }}
-          SHARED_ACTIONS_PIN: 6cec89bac47a21cf756d68d638a9a510998e57f8
+          SHARED_ACTIONS_PIN: 5a99aed78ce68dcebd3052b75c31e6f173162b1e
           # The Makefile pins pg-embed-setup-unpriv, whose pg_worker binary
           # lands in the cargo bin directory this archive carries.
           MAKEFILE_HASH: ${{ hashFiles('Makefile') }}
@@ -782,7 +775,7 @@ jobs:
 
       - name: Install Rust toolchain
         id: setup-rust
-        uses: leynos/shared-actions/.github/actions/setup-rust@6cec89bac47a21cf756d68d638a9a510998e57f8
+        uses: leynos/shared-actions/.github/actions/setup-rust@5a99aed78ce68dcebd3052b75c31e6f173162b1e
         with:
           cache-provider: external
           # `setup-rust` owns sccache: it selects the backend by runner, starts the
@@ -806,7 +799,7 @@ jobs:
           POSTGRESQL_RELEASES_URL: https://github.com/theseus-rs/postgresql-binaries
         run: bash scripts/warm-pg-embedded-cache.sh
       - name: Generate Rust coverage
-        uses: leynos/shared-actions/.github/actions/generate-coverage@6cec89bac47a21cf756d68d638a9a510998e57f8
+        uses: leynos/shared-actions/.github/actions/generate-coverage@5a99aed78ce68dcebd3052b75c31e6f173162b1e
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
           POSTGRESQL_VERSION: =${{ env.PG_VERSION }}

.github/workflows/coverage-main.yml

@@ -63,7 +63,7 @@ jobs:
           # workflow one, so it is read here in the shell.
           RUNNER_SCOPE: ${{ runner.os }}-${{ runner.arch }}-${{ runner.environment }}
           CARGO_LOCK_HASH: ${{ hashFiles('rust-toolchain.toml', '**/Cargo.lock') }}
-          SHARED_ACTIONS_PIN: 6cec89bac47a21cf756d68d638a9a510998e57f8
+          SHARED_ACTIONS_PIN: 5a99aed78ce68dcebd3052b75c31e6f173162b1e
           # The Makefile pins pg-embed-setup-unpriv, whose pg_worker binary
           # lands in the cargo bin directory this archive carries.
           MAKEFILE_HASH: ${{ hashFiles('Makefile') }}
@@ -119,7 +119,7 @@ jobs:
 
       - name: Install Rust toolchain
         id: setup-rust
-        uses: leynos/shared-actions/.github/actions/setup-rust@6cec89bac47a21cf756d68d638a9a510998e57f8
+        uses: leynos/shared-actions/.github/actions/setup-rust@5a99aed78ce68dcebd3052b75c31e6f173162b1e
         with:
           # This job owns ~/.cargo/registry, ~/.cargo/bin, and the uv layers.
           cache-provider: external
@@ -144,7 +144,7 @@ jobs:
           POSTGRESQL_RELEASES_URL: https://github.com/theseus-rs/postgresql-binaries
         run: bash scripts/warm-pg-embedded-cache.sh
       - name: Generate Rust coverage
-        uses: leynos/shared-actions/.github/actions/generate-coverage@6cec89bac47a21cf756d68d638a9a510998e57f8
+        uses: leynos/shared-actions/.github/actions/generate-coverage@5a99aed78ce68dcebd3052b75c31e6f173162b1e
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
           POSTGRESQL_VERSION: =${{ env.PG_VERSION }}
@@ -188,7 +188,7 @@ jobs:
         # be uploaded as the trunk's and become the baseline every pull
         # request is ratcheted against.
         if: steps.codescene_token.outputs.available == 'true' && github.ref == 'refs/heads/main'
-        uses: leynos/shared-actions/.github/actions/upload-codescene-coverage@6cec89bac47a21cf756d68d638a9a510998e57f8
+        uses: leynos/shared-actions/.github/actions/upload-codescene-coverage@5a99aed78ce68dcebd3052b75c31e6f173162b1e
         with:
           # mode defaults to "upload", which is the only mode this estate
           # uses: under CV-005 no pull-request lane talks to CodeScene, so

.github/workflows/dependabot-automerge.yml

@@ -4,7 +4,7 @@
 # Safe because the reusable workflow never checks out or executes PR code;
 # it only reads event metadata and makes GitHub API calls.
 
 on:
   pull_request_target:
     branches: [main]
     types: [opened, reopened, synchronize, labeled, ready_for_review]
@@ -28,6 +28,6 @@
       # The token is not used for any external cloud auth.
       id-token: write
     if: ${{ github.event_name == 'workflow_dispatch' || github.actor == 'dependabot[bot]' }}
-    uses: leynos/shared-actions/.github/workflows/dependabot-automerge.yml@6cec89bac47a21cf756d68d638a9a510998e57f8
+    uses: leynos/shared-actions/.github/workflows/dependabot-automerge.yml@5a99aed78ce68dcebd3052b75c31e6f173162b1e
     with:
       pull-request-number: ${{ inputs.pull-request-number || github.event.pull_request.number }}

.github/workflows/mutation-testing.yml

@@ -18,7 +18,7 @@ jobs:
     permissions:
       contents: read
       id-token: write  # OIDC workflow-source resolution
-    uses: leynos/shared-actions/.github/workflows/mutation-cargo.yml@6cec89bac47a21cf756d68d638a9a510998e57f8
+    uses: leynos/shared-actions/.github/workflows/mutation-cargo.yml@5a99aed78ce68dcebd3052b75c31e6f173162b1e
     with:
       # `allow-no-mutants` is left at the action's default of false, so a
       # run that reaches cargo-mutants and enumerates nothing fails rather

tests/workflow_contracts/codescene_uploader_test.py

@@ -33,7 +33,7 @@
 #: The uploader revision this repository trusts. Named as an allowlist rather
 #: than matched as "any full SHA": the pin is the manifest, so a different
 #: revision is a different trust anchor whatever the shape of its identifier.
-UPLOADER_PIN: typ.Final = "6cec89bac47a21cf756d68d638a9a510998e57f8"
+UPLOADER_PIN: typ.Final = "5a99aed78ce68dcebd3052b75c31e6f173162b1e"
 UPLOADER_ACTION: typ.Final = (
     "leynos/shared-actions/.github/actions/upload-codescene-coverage"
 )

tests/workflow_contracts/compiler_cache_test.py

@@ -18,7 +18,7 @@
 #: The shared-actions commit `setup-rust` must pin: #546, which sits on #523.
 #: Asserted by value, so a bump has to update it and someone has to confirm the
 #: new revision still leaves this repository the sole owner of its caches.
-SETUP_RUST_PIN = "6cec89bac47a21cf756d68d638a9a510998e57f8"
+SETUP_RUST_PIN = "5a99aed78ce68dcebd3052b75c31e6f173162b1e"
 
 #: The one `uses` value every Rust job must carry: the exact repository, action
 #: path and pin. A suffix match would accept another repository's, or another