Bump shared-actions pins to 18bed1ca

[leynos]

Summary

• Move every leynos/shared-actions reusable workflow and action ref
  to 18bed1ca49a6de3d8882bd72635a32ae3f023d57, the current
  shared-actions main HEAD.
• Picks up the coverage-ratchet baseline-advance fix and symmetric
  +/-1pp dead-band (shared-actions#353), plus routine follow-ups
  (#354, #356 whitaker-installer 0.2.6, #344).
• Rebased on main after Stop pinning the exact CodeScene action SHA in the coverage contract #271 made the CodeScene coverage contract
  test shape-only, so this PR now touches workflows only.

Review walkthrough

• .github/workflows/codescene-coverage.yml:
  upload-codescene-coverage action pin bumped.
• .github/workflows/coverage.yml: upload-codescene-coverage
  action pin bumped.
• .github/workflows/dependabot-automerge.yml: reusable workflow pin
  bumped.
• .github/workflows/mutation-testing.yml: mutation-cargo.yml
  reusable workflow pin bumped.
• No other refs, inputs, or logic changed.

Validation

• grep -rE 'leynos/shared-actions/[^@]+@[0-9a-f]{40}' .github/workflows/ shows only the new pin.
• make test-workflow-contracts passes: 9 passed.
• CI green on this PR.

[sourcery-ai]

Sorry @leynos, you have reached your weekly rate limit of 500000 diff characters.

Please try again later or upgrade to continue using Sourcery

[coderabbitai]

Note

Reviews paused

It looks like this branch is under active development. To avoid overwhelming you with review comments due to an influx of new commits, CodeRabbit has automatically paused this review. You can configure this behavior by changing the reviews.auto_review.auto_pause_after_reviewed_commits setting.

Use the following commands to manage reviews:

• @coderabbitai resume to resume automatic reviews.
• @coderabbitai review to trigger a single review.

Use the checkboxes below for quick actions:

• ▶️ Resume reviews
• 🔍 Trigger review

Walkthrough

Update four GitHub Actions references to newer pinned revisions of shared CodeScene coverage, Dependabot automerge, and mutation-testing actions or reusable workflows. Existing inputs, conditions, triggers, permissions, and job wiring remain unchanged.

Changes

CI pin updates

Layer / File(s)	Summary
Coverage action pins .github/workflows/codescene-coverage.yml, .github/workflows/coverage.yml	Update the pinned CodeScene coverage upload action revision in both coverage workflows without changing surrounding configuration.
Reusable workflow pins .github/workflows/dependabot-automerge.yml, .github/workflows/mutation-testing.yml	Update the pinned shared reusable workflow revisions while preserving existing job inputs and configuration.

Possibly related PRs

• leynos/hecate#33: Updates the same shared workflow and CodeScene action pins.
• leynos/ghillie#97: Updates the pinned CodeScene coverage upload action.
• leynos/agent-template-rust#52: Updates the pinned mutation-testing reusable workflow.

Poem

Pins turn, workflows fly,
Coverage checks reach the sky.
Mutation paths march anew,
Automerge follows through.
Four small hashes, neatly aligned—
CI keeps its course in kind.

---

Caution

Pre-merge checks failed

Please resolve all errors before merging. Addressing warnings is optional.

• Ignore

❌ Failed checks (1 error, 1 warning)

Check name	Status	Explanation	Resolution
Testing (Overall)	❌ Error	Assert the exact SHA; the current regex only accepts any 40-hex commit and would pass old or wrong pins.	Add a regression assertion for the exact shared-actions commit in the workflow contract test, so any drift to an old, branch, or alternate SHA fails CI.
Description check	⚠️ Warning	The description includes summary and validation, but omits several required template sections and headings.	Add the missing Change Type, Linked Issue, Security Impact, Database Impact, Blast Radius, Rollback Plan, and Review track sections to match the template.

✅ Passed checks (18 passed)

Check name	Status	Explanation
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
User-Facing Documentation	✅ Passed	Pass: keep it scoped to internal workflow pin updates; no user-facing behaviour changed, so no users-guide update is required.
Developer Documentation	✅ Passed	The PR only bumps pinned workflow/action SHAs and a contract-test constant; no new APIs, architecture, tooling, roadmap, or execplan updates are required.
Module-Level Documentation	✅ Passed	The patch only updates four GitHub Actions workflow pins; no code modules were added or edited, so the module-docstring rule is not applicable.
Testing (Unit And Behavioural)	✅ Passed	Only pinned reusable-workflow/action refs changed; existing workflow-contract tests already verify the workflow boundary and SHA pin shape.
Testing (Property / Proof)	✅ Passed	Treat this as a pin-only workflow update; no new invariant, state space, or proof obligation is introduced.
Testing (Compile-Time / Ui)	✅ Passed	Only workflow pins and a focused YAML contract assertion changed; no Rust/TypeScript compile-time or UI surface is touched here.
Unit Architecture	✅ Passed	Only GitHub Actions pins changed; no application queries, commands, dependencies, or test boundaries were reworked.
Domain Architecture	✅ Passed	Only GitHub workflow pins changed; no domain, adapter, persistence, or transport code moved, so domain boundaries are unaffected.
Observability	✅ Passed	PASS: the PR only repins reusable workflows/actions and updates one contract test; it adds no logs, metrics, traces, or alerts.
Security And Privacy	✅ Passed	PASS: The diff only repins four shared-actions references; no new secrets, permissions, auth logic, or data paths were added.
Performance And Resource Use	✅ Passed	Only GitHub Actions pins changed; no runtime code, loops, allocations, retries, or I/O paths were altered, so no performance regression is introduced.
Concurrency And State	✅ Passed	Accept it: the diff only repins reusable workflows/actions; it introduces no shared state, locks, async lifetimes, or ordering changes.
Architectural Complexity And Maintainability	✅ Passed	Only four SHA pin updates changed; no new layers, abstractions, or dependency edges were introduced.
Rust Compiler Lint Integrity	✅ Passed	No Rust sources, Cargo files, or lint suppressions changed; the PR only retouches four workflow YAML pins.
Title check	✅ Passed	The title matches the PR's main change: updating shared-actions pins to a newer commit.

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch bump-shared-actions-pin

---

_{Comment @coderabbitai help to get the list of available commands.}

[codescene-access]

No quality gates enabled for this code.