Update shared-actions pins to 2f90d10

[leynos]

Summary

Advances every leynos/shared-actions reference in .github/workflows/ from the two pins previously in tree (4d696e7 and 18bed1c) to the single SHA 2f90d1041ea108148be0620e3bbcc1fa80ac03e4. That upstream commit is "Skip inapplicable CodeScene coverage checks and surface diagnostics (#395) (#399)", which stops the changed-line coverage gate from failing on pull requests whose base is not the analysed default branch — stacked pull requests, most notably.

Files touched

Workflow	References updated
build-and-package.yml	rust-build-release, stage-release-artefacts, linux-packages, windows-package, macos-package
ci.yml	setup-rust (×2), generate-coverage, upload-codescene-coverage
coverage-main.yml	setup-rust, generate-coverage, upload-codescene-coverage
dependabot-automerge.yml	dependabot-automerge.yml reusable workflow
mutation-testing.yml	mutation-cargo.yml reusable workflow
netsukefile-test.yml	setup-rust
release.yml	determine-release-modes, ensure-cargo-version, export-cargo-metadata, upload-release-assets

Compatibility

The intervening upstream changes to the consumed action definitions are additive, so no caller-side input changes are needed:

• setup-rust gains an optional rustflags input defaulting to -D warnings, matching the behaviour the previous pin hard-coded.
• generate-coverage gains an optional language input defaulting to auto, which preserves the existing manifest-based detection, and hardens its artefact-upload step against empty artefact names.
• upload-codescene-coverage short-circuits its check mode with a warning annotation, rather than a failure, when the pull request base is not the repository default branch. This is the behaviour change motivating the bump.

Verification

• make test-workflow-contracts — 6 passed. This is the gate that asserts the mutation-testing caller matches the reusable workflow contract.
• The target SHA was confirmed to exist on leynos/shared-actions via the GitHub API.
• No other gates were run: the diff is confined to CI workflow pins and touches no Rust, Markdown, or Mermaid sources.

References

• Lody session: https://lody.ai/leynos/sessions/e52c07e4-3d4b-403e-b22d-312a85bb5dfd
• Upstream commit: leynos/shared-actions@2f90d10

🤖 Generated with Claude Code

Summary by Sourcery

CI:

• Bump all leynos/shared-actions references in CI workflows to SHA 2f90d1041ea108148be0620e3bbcc1fa80ac03e4, replacing older mixed pins for build, coverage, release, mutation testing, Dependabot automerge, and Netsukefile tests.

[coderabbitai]

Note

Reviews paused

It looks like this branch is under active development. To avoid overwhelming you with review comments due to an influx of new commits, CodeRabbit has automatically paused this review. You can configure this behavior by changing the reviews.auto_review.auto_pause_after_reviewed_commits setting.

Use the following commands to manage reviews:

• @coderabbitai resume to resume automatic reviews.
• @coderabbitai review to trigger a single review.

Use the checkboxes below for quick actions:

• ▶️ Resume reviews
• 🔍 Trigger review

Summary

• Update all .github/workflows/ leynos/shared-actions pins to 2f90d1041ea108148be0620e3bbcc1fa80ac03e4.
• Enable CodeScene coverage checks to skip pull requests with an unanalyzed base branch, including stacked pull requests.
• Preserve existing workflow defaults and require no caller-side changes.
• Cover build, CI, coverage, release, mutation-testing, Dependabot, and Netsukefile workflows.
• Verify the changes with make test-workflow-contracts (6 tests passed).

Walkthrough

Changes

Workflow pin refresh

Layer / File(s)	Summary
Build and release action pins .github/workflows/build-and-package.yml, .github/workflows/release.yml	Update pinned revisions for build, packaging, staging, Cargo metadata, release mode, and release asset upload actions.
CI and coverage action pins .github/workflows/ci.yml, .github/workflows/coverage-main.yml	Update pinned revisions for Rust setup, coverage generation, and CodeScene coverage upload actions.
Reusable workflow and test pins .github/workflows/dependabot-automerge.yml, .github/workflows/mutation-testing.yml, .github/workflows/netsukefile-test.yml	Update reusable workflow and setup-rust references to the new pinned commit.

Possibly related PRs

• leynos/ddlint#287: Updates shared-action pins in the same workflow set.
• leynos/mdast-check#28: Updates overlapping CI, coverage, and Dependabot workflow pins.
• leynos/axinite#272: Updates overlapping shared-action references, including mutation testing and CodeScene coverage.

Suggested reviewers: codescene-access

Poem

Pin by pin, the workflows align,
Rust and coverage follow the line.
Packages wait in ordered streams,
Releases carry refreshed schemes.
One commit steadies every sign.

---

Caution

Pre-merge checks failed

Please resolve all errors before merging. Addressing warnings is optional.

• Ignore

❌ Failed checks (1 error, 1 warning, 2 inconclusive)

Check name	Status	Explanation	Resolution
Testing (Overall)	❌ Error	The PR changes behaviour through the shared action pin, but adds no tests; existing tests only check SHA shape and the mutation caller contract, not CodeScene skip behaviour.	Add a substantive test for the non-default pull-request base case, or link and verify an upstream test that exercises this exact behaviour.
Testing (Unit And Behavioural)	⚠️ Warning	The patch changes external workflow behaviour but adds no tests; existing checks only validate YAML pin shape and caller configuration, not the new CodeScene skip behaviour.	Add an integration test or workflow harness that exercises a non-default-base pull request and verifies the pinned action emits a warning and skips the coverage failure.
Observability	❓ Inconclusive	Investigation is still in progress; no verdict submitted.	Gather the workflow diff and inspect the pinned upstream action behaviour before deciding.
Security And Privacy	❓ Inconclusive	I am still checking workflow permissions, secrets, and the pinned upstream action contents.	Wait for the workflow and upstream action review to complete.

✅ Passed checks (16 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title clearly describes the update to all shared action pins and matches the main change.
Description check	✅ Passed	The description accurately explains the shared action pin updates, affected workflows, compatibility, and verification.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
User-Facing Documentation	✅ Passed	Pass this check: the commit changes only pinned GitHub Actions SHAs; it adds no product or user-facing behaviour that requires an update to docs/users-guide.md.
Developer Documentation	✅ Passed	Accept this check: the patch changes only pinned workflow references; no API, architecture, or build requirement changed, and the developer guide documents shared-action pinning and CI workflows.
Module-Level Documentation	✅ Passed	The patch changes only seven .github/workflows/*.yml files, and every change is an action pin. No source module was added or modified, so this check is not applicable.
Testing (Property / Proof)	✅ Passed	Pass: the tip changes only 19 fixed workflow pins; it introduces no input/state invariant or proof assumption that requires proptest, Hypothesis, fast-check, or formal proof.
Testing (Compile-Time / Ui)	✅ Passed	Pass: the diff changes only shared-action SHAs in seven workflow YAML files; it adds no Rust/TypeScript compile-time behaviour or text/UI output requiring trybuild or snapshots.
Unit Architecture	✅ Passed	Accept this check: the commit changes only 19 workflow pin lines, with no application units, queries, commands, dependencies, or tests added or modified.
Domain Architecture	✅ Passed	Pass this check: HEAD^..HEAD changes only 38 shared-action pin lines in seven workflow files; no domain or adapter source files changed.
Performance And Resource Use	✅ Passed	Pass this check: HEAD changes only 19 workflow action-pin substitutions across seven YAML files; no loops, allocations, I/O, retries, or other performance-sensitive code changed.
Concurrency And State	✅ Passed	Verify that the diff only replaces 19 pinned shared-action SHAs; no locks, mutable state, task lifetimes, concurrency, cancellation, ordering, or parallelism declarations changed.
Architectural Complexity And Maintainability	✅ Passed	All 20 existing leynos/shared-actions workflow references use the same pinned SHA, with no new architectural concepts introduced.
Rust Compiler Lint Integrity	✅ Passed	Pass this check: the patch changes only seven YAML workflow files, with 19 SHA replacements; it adds no Rust files, lint suppressions, artificial references, or clone calls.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch update-shared-action-sha-for-skipable-cs-checks

---

_{Comment @coderabbitai help to get the list of available commands.}

[sourcery-ai]

Reviewer's guide (collapsed on small PRs)

Reviewer's Guide

Updates all leynos/shared-actions workflow references under .github/workflows/ to a single new pinned SHA, aligning build, coverage, release, Dependabot, mutation testing, and Netsukefile workflows to the same upstream revision that relaxes CodeScene coverage gating for non-default-branch PRs.

Sequence diagram for updated upload-codescene-coverage behavior in CI

sequenceDiagram
  actor Developer
  participant GitHubActions
  participant generate-coverage
  participant upload-codescene-coverage
  participant CodeScene

  Developer->>GitHubActions: push pull_request
  GitHubActions->>generate-coverage: run generate-coverage
  generate-coverage-->>GitHubActions: lcov.info
  GitHubActions->>upload-codescene-coverage: run upload-codescene-coverage mode check
  upload-codescene-coverage->>CodeScene: upload coverage
  CodeScene-->>upload-codescene-coverage: coverage result

  alt base is default branch
    upload-codescene-coverage-->>GitHubActions: fail job on gate violation
  else base is not default branch
    upload-codescene-coverage-->>GitHubActions: emit warning annotation
    upload-codescene-coverage-->>GitHubActions: succeed job
  end

Loading

File-Level Changes

Change	Details	Files
Align all leynos/shared-actions action references in CI workflows to a single new shared pin.	Advance rust-build-release, stage-release-artefacts, linux-packages, windows-package, and macos-package actions to SHA 2f90d1041ea108148be0620e3bbcc1fa80ac03e4 in build-and-package workflow. Update setup-rust, generate-coverage, and upload-codescene-coverage action references in CI and coverage-main workflows to the new shared-actions SHA. Point release workflow helpers (determine-release-modes, ensure-cargo-version, export-cargo-metadata, upload-release-assets) to the new shared-actions SHA. Retarget reusable workflows dependabot-automerge.yml and mutation-cargo.yml pins to the new shared-actions SHA. Update Netsukefile Rust setup workflow to use the new setup-rust action pin.	.github/workflows/build-and-package.yml .github/workflows/ci.yml .github/workflows/release.yml .github/workflows/coverage-main.yml .github/workflows/dependabot-automerge.yml .github/workflows/mutation-testing.yml .github/workflows/netsukefile-test.yml

---

Tips and commands

Interacting with Sourcery

• Trigger a new review: Comment @sourcery-ai review on the pull request.
• Continue discussions: Reply directly to Sourcery's review comments.
• Generate a GitHub issue from a review comment: Ask Sourcery to create an
  issue from a review comment by replying to it. You can also reply to a
  review comment with @sourcery-ai issue to create an issue from it.
• Generate a pull request title: Write @sourcery-ai anywhere in the pull
  request title to generate a title at any time. You can also comment
  @sourcery-ai title on the pull request to (re-)generate the title at any time.
• Generate a pull request summary: Write @sourcery-ai summary anywhere in
  the pull request body to generate a PR summary at any time exactly where you
  want it. You can also comment @sourcery-ai summary on the pull request to
  (re-)generate the summary at any time.
• Generate reviewer's guide: Comment @sourcery-ai guide on the pull
  request to (re-)generate the reviewer's guide at any time.
• Resolve all Sourcery comments: Comment @sourcery-ai resolve on the
  pull request to resolve all Sourcery comments. Useful if you've already
  addressed all the comments and don't want to see them anymore.
• Dismiss all Sourcery reviews: Comment @sourcery-ai dismiss on the pull
  request to dismiss all existing Sourcery reviews. Especially useful if you
  want to start fresh with a new review - don't forget to comment
  @sourcery-ai review to trigger a new review!

Customizing Your Experience

Access your dashboard to:

• Enable or disable review features such as the Sourcery-generated pull request
  summary, the reviewer's guide, and others.
• Change the review language.
• Add, remove or edit custom review instructions.
• Adjust other review settings.

Getting Help

• Contact our support team for questions or feedback.
• Visit our documentation for detailed guides and information.
• Keep in touch with the Sourcery team by following us on X/Twitter, LinkedIn or GitHub.

[codescene-access]

No quality gates enabled for this code.

[chatgpt-codex-connector]

You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard.
To continue using code reviews, add credits to your account and enable them for code reviews in your settings.

[sourcery-ai]

Sorry @leynos, you have reached your weekly rate limit of 500000 diff characters.

Please try again later or upgrade to continue using Sourcery