Stop pinning the exact CodeScene action SHA in the coverage contract

[leynos]

Unblocks #254.

The CodeScene coverage contract test asserted the exact commit SHA of the upload-codescene-coverage shared action, so every dependabot bump of that action (currently #254) failed make test-workflow-contracts until a human edited the constant. #245 already established the policy for the mutation workflow contract: contract tests verify that the caller pins a full 40-hex commit SHA — the shape — while dependabot owns the value.

This applies the same pattern to tests/workflow_contracts/codescene_coverage_test.py. All nine workflow contract tests pass locally.

🤖 Generated with Claude Code

[sourcery-ai]

Sorry @leynos, you have reached your weekly rate limit of 500000 diff characters.

Please try again later or upgrade to continue using Sourcery

[coderabbitai]

Note

Reviews paused

It looks like this branch is under active development. To avoid overwhelming you with review comments due to an influx of new commits, CodeRabbit has automatically paused this review. You can configure this behavior by changing the reviews.auto_review.auto_pause_after_reviewed_commits setting.

Use the following commands to manage reviews:

• @coderabbitai resume to resume automatic reviews.
• @coderabbitai review to trigger a single review.

Use the checkboxes below for quick actions:

• ▶️ Resume reviews
• 🔍 Trigger review

Walkthrough

The CodeScene workflow contract test now extracts the action reference after @ and verifies it is a full 40-character hexadecimal commit SHA, replacing the previous hard-coded SHA assertion.

Changes

CodeScene pin validation

Layer / File(s)	Summary
Validate CodeScene commit pins tests/workflow_contracts/codescene_coverage_test.py	Add SHA_RE and validate the extracted CodeScene action reference against the full commit-SHA format while retaining the surrounding workflow assertions.

Possibly related PRs

• leynos/wildside#431: Updates workflow contract tests to validate 40-hex action SHAs rather than exact pins.
• leynos/cuprum#204: Applies the same flexible uses: SHA-format validation.
• leynos/ddlint#287: Updates CodeScene-related action pinning alongside similar contract validation.

Suggested labels: Issue

Poem

A pinned SHA takes flight,
Forty hexes, sharp and bright.
Fixed old checks drift away,
Regex guards the workflow’s way,
CodeScene stays locked in sight.

🚥 Pre-merge checks | ✅ 18 | ❌ 2

❌ Failed checks (2 warnings)

Check name	Status	Explanation	Resolution
Title check	⚠️ Warning	Link issue #254 in the title; the current wording omits the required issue reference for a fix.	Rename it to include "(#254)" and keep the scope aligned with the CodeScene coverage contract test change.
Description check	⚠️ Warning	Fill the repository template; the current description is a free-form summary and omits most required sections.	Add the Summary bullets, Change Type, Linked Issue, Validation, Security Impact, Database Impact, Blast Radius, Rollback Plan, and Review track sections.

✅ Passed checks (18 passed)

Check name	Status	Explanation
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Testing (Overall)	✅ Passed	The contract test reads the real workflow YAML and checks trigger, ordering, secret scope, inputs, and SHA shape, so it would fail on realistic regressions.
User-Facing Documentation	✅ Passed	Only a workflow contract test changed; no user-facing behaviour or users-guide content was added.
Developer Documentation	✅ Passed	The PR only updates a workflow contract test; no internal API, architecture, roadmap, or execplan change needs developer-guide or design-doc updates.
Module-Level Documentation	✅ Passed	Keep the module docstring: it states the workflow’s purpose, utility, function, and relation to the main coverage workflow.
Testing (Unit And Behavioural)	✅ Passed	PASS — The change updates a workflow contract test that exercises the YAML workflow boundary and asserts the external action pin shape plus surrounding guards and inputs.
Testing (Property / Proof)	✅ Passed	Only a static workflow contract test changed; it checks one YAML pin, not a new range-based behaviour, so property/proof testing is inapplicable.
Testing (Compile-Time / Ui)	✅ Passed	No compile-time or UI surface appears here: the PR only tightens a Python workflow-contract assertion, so no trybuild or snapshot test is required.
Unit Architecture	✅ Passed	The change stays in a read-only workflow contract test, with no writes, side-effects, ambient state, or hidden dependencies; it only widens one assertion seam.
Domain Architecture	✅ Passed	PASS: The PR only updates a workflow contract test to validate a SHA shape; it does not touch domain, adapter, persistence, transport, or infrastructure code.
Observability	✅ Passed	PASS: The patch only changes a workflow contract test in tests/workflow_contracts, so no production observability surface is introduced.
Security And Privacy	✅ Passed	Keep the scope test-only: the diff only validates a pinned action SHA and introduces no secrets, permissions changes, or data exposure.
Performance And Resource Use	✅ Passed	The edit is test-only and does constant-time regex/string checks over one workflow entry; no new loops, I/O, allocations, or unbounded growth appear.
Concurrency And State	✅ Passed	The PR only relaxes a test assertion to validate a pinned SHA; it adds no shared state, locks, async tasks, ordering, or cancellation logic.
Architectural Complexity And Maintainability	✅ Passed	Keep the change at test-level: it adds only a regex guard in an existing contract test and introduces no new layers, indirection, or dependencies.
Rust Compiler Lint Integrity	✅ Passed	PASS: The PR changes only a Python workflow contract test; it adds no Rust lint suppressions, dead-code allowances, or suspicious clone workarounds.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch fix-codescene-contract-sha-pin

---

_{Comment @coderabbitai help to get the list of available commands.}

[coderabbitai]

Actionable comments posted: 2

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@tests/workflow_contracts/codescene_coverage_test.py`:
- Around line 176-180: Update the SHA validation in the coverage-check assertion
to use SHA_RE.fullmatch() instead of SHA_RE.match(), ensuring codescene_ref
contains exactly the required 40-hex commit SHA with no trailing characters.
- Line 18: Annotate the SHA_RE regular-expression constant with the
re.Pattern[str] type while preserving its existing compiled pattern and matching
behavior.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Pro Plus

Run ID: b905c2ba-ca2b-4d73-b4c2-b6a779e23d80

📥 Commits

Reviewing files that changed from the base of the PR and between 5d8322a and 22a7008.

📒 Files selected for processing (1)

• tests/workflow_contracts/codescene_coverage_test.py

🔗 Linked repositories identified

CodeRabbit considers these linked repositories for cross-repo context during reviews:

• leynos/ironclaw (auto-detected)
• leynos/memoryd (auto-detected)

[leynos]

Both findings addressed in the follow-up commit: SHA_RE is annotated re.Pattern[str] and both contract checks now use fullmatch() (the same trailing-newline hardening is applied to the mutation contract's USES_RE, which had the identical match() pattern). All nine contract tests pass.

[leynos]

@coderabbitai resolve

[coderabbitai]

✅ Action performed

Comments resolved and changes approved.

[codescene-access]

No quality gates enabled for this code.