Stop pinning shared-actions commit SHAs in coverage contract tests

[leynos]

Summary

• Stop pinning the exact leynos/shared-actions commit SHA in the coverage
  contract test helpers (assert_ci_coverage_action_contract,
  assert_coverage_main_workflow_contract). Dependabot bumps that SHA
  routinely; asserting the literal value meant every bump PR failed CI until
  a human hand-edited the expected string to match.
• The contract still verifies the shape of the caller: the correct
  reusable-action path (generate-coverage, upload-codescene-coverage) and
  a full 40-hex commit SHA, guarding against repointing at a mutable branch
  such as main.
• Documents the policy in docs/developers-guide.md under a new "Workflow
  pins and Dependabot" subsection.

Review walkthrough

• tests/helpers/ci_contracts.py: replaces the two hard-coded
  ...@927edd45ae77be4251a8a18ca9eb5613a2e32cbd equality checks with regex
  shape assertions (_GENERATE_COVERAGE_USES_RE,
  _UPLOAD_CODESCENE_COVERAGE_USES_RE). All other assertions (checkout
  credential hygiene, guard conditions, coverage inputs, Rust manifest wiring)
  are unchanged.
• tests/test_helpers.py: adds regression coverage proving a workflow pinned
  to a different 40-hex SHA is still accepted (simulating a Dependabot
  bump), while a workflow pinned to @main is rejected, for both the CI and
  coverage-main contracts.
• docs/developers-guide.md: adds the canonical "Workflow pins and
  Dependabot" policy subsection.
• No workflow files were touched — the actual uses: pins in
  template/.github/workflows/*.yml.jinja and .github/workflows/*.yml are
  unchanged; Dependabot continues to own bumping them.
• .github/dependabot.yml already has a github-actions ecosystem entry
  with directory: "/" and a weekly schedule, so no change was needed there.

Validation

• make check-fmt — pass
• make lint — pass (Ruff + 100% docstring coverage)
• make typecheck — pass
• make test — 45 passed, 2 skipped (the 2 skips are the WITH_ACT=1-gated
  act-integration tests, expected without Docker locally)
• make spelling — pass, typos.toml unchanged (no regeneration drift)
• Reasoned through the regex: it matches today's pinned SHA and would match
  any future 40-hex SHA Dependabot substitutes, while rejecting non-SHA refs
  such as branch names — confirmed by the new negative-path tests.

[sourcery-ai]

Sorry @leynos, you have reached your weekly rate limit of 500000 diff characters.

Please try again later or upgrade to continue using Sourcery

[coderabbitai]

Warning

Review limit reached

You’ve reached a temporary PR review limit under our Fair Usage Limits Policy.

Your recent review volume is higher than typical usage, so adaptive limits are currently applied.

Next review available in: 9 minutes

Your organization has reached its usage spending cap. Adjust your spending cap in the billing tab.

How can I continue?

After more reviews become available, a review can be triggered using the @coderabbitai review command as a PR comment. Alternatively, push new commits to this PR.

To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews.

How do review limits work?

CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability.

For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window.

Please refer docs for additional details.

Review details

⚙️ Run configuration

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Pro Plus

Run ID: 6ce9ab29-f156-4ec7-8e9f-05c637f5ed17

📥 Commits

Reviewing files that changed from the base of the PR and between ab5ec28 and 64442d5.

📒 Files selected for processing (3)

• docs/developers-guide.md
• tests/helpers/ci_contracts.py
• tests/test_helpers.py

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch drop-sha-pinning-contract

---

_{Comment @coderabbitai help to get the list of available commands.}