Bump shared-actions pins to 18bed1ca

[leynos]

Summary

• Bump every leynos/shared-actions reference in .github/workflows/ to 18bed1ca49a6de3d8882bd72635a32ae3f023d57 (shared-actions main HEAD)
• This pin carries the coverage-ratchet baseline-freeze cache-key fix and symmetric ±1pp dead-band (shared-actions#353), plus routine follow-ups (Build(deps): bump rstest from 0.18.2 to 0.26.1 #354, Build(deps): bump tokio-util from 0.7.17 to 0.7.18 #356 whitaker-installer 0.2.6, Build(deps): bump the cargo group across 1 directory with 2 updates #344)

Review walkthrough

• audit.yml (1 ref), ci.yml (6), coverage-main.yml (4), release.yml (4), build-and-package.yml (2), dependabot-automerge.yml (1) — pins only, no other content changed

Validation

• grep -rE "shared-actions/.+@" in .github/workflows/ shows only the new pin
• CI green on this PR

[sourcery-ai]

Sorry @leynos, you have reached your weekly rate limit of 500000 diff characters.

Please try again later or upgrade to continue using Sourcery

[coderabbitai]

Note

Reviews paused

It looks like this branch is under active development. To avoid overwhelming you with review comments due to an influx of new commits, CodeRabbit has automatically paused this review. You can configure this behavior by changing the reviews.auto_review.auto_pause_after_reviewed_commits setting.

Use the following commands to manage reviews:

• @coderabbitai resume to resume automatic reviews.
• @coderabbitai review to trigger a single review.

Use the checkboxes below for quick actions:

• ▶️ Resume reviews
• 🔍 Trigger review

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Pro Plus

Run ID: 35bc75c0-465b-4fc5-82d0-66a7aefd3288

📥 Commits

Reviewing files that changed from the base of the PR and between 58e035f and 7492ca4.

📒 Files selected for processing (6)

• .github/workflows/audit.yml
• .github/workflows/build-and-package.yml
• .github/workflows/ci.yml
• .github/workflows/coverage-main.yml
• .github/workflows/dependabot-automerge.yml
• .github/workflows/release.yml

🔗 Linked repositories identified

CodeRabbit considers these linked repositories for cross-repo context during reviews:

• leynos/wireframe (auto-detected)
• leynos/nixie (auto-detected)

---

Summary

• Updated all leynos/shared-actions references in .github/workflows/ to commit 18bed1ca49a6de3d8882bd72635a32ae3f023d57.
• Applied the pin updates across audit, CI, coverage, release, packaging, and Dependabot workflows.
• No workflow logic or configuration changed; grep validation confirms only the new pin is used.
• CI validation remains pending.

Walkthrough

Update pinned leynos/shared-actions references across audit, packaging, CI, coverage, Dependabot, and release workflows. Preserve all existing workflow steps, inputs, conditions, environment variables, and commands.

Changes

Shared action pin refresh

Layer / File(s)	Summary
Refresh audit and packaging pins .github/workflows/audit.yml, .github/workflows/build-and-package.yml	Update Rust setup, release build, and Linux packaging action commits.
Refresh CI coverage pins .github/workflows/ci.yml	Repin Rust setup, SQLite and Postgres coverage generation, and CodeScene upload actions.
Refresh main coverage pins .github/workflows/coverage-main.yml	Repin the four shared coverage workflow actions to the new shared-action commit.
Refresh automation and release pins .github/workflows/dependabot-automerge.yml, .github/workflows/release.yml	Update the reusable Dependabot workflow and release metadata and asset-upload action commits while retaining their existing wiring.

Possibly related PRs

• leynos/axinite#272: Updates the same shared-action references to the 18bed1ca... commit.
• leynos/ddlint#287: Repins shared coverage-generation and CodeScene-upload actions.
• leynos/mdast-check#28: Changes shared-action pins in the same coverage workflows.

Poem

Pin by pin, the workflows align,
Rust and coverage march in time.
Release ships on steadier rails,
Dependabot follows updated trails.
Keep every step, but refresh the sign.

🚥 Pre-merge checks | ✅ 20

✅ Passed checks (20 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title accurately summarises the workflow pin bumps to the shared-actions commit.
Description check	✅ Passed	The description matches the workflow pin updates and validation notes.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Testing (Overall)	✅ Passed	Treat this as a pin-only workflow change: it updates shared-action SHAs and adds no new behaviour or tests to exercise.
User-Facing Documentation	✅ Passed	No user-facing functionality changed: the PR only repins GitHub workflow actions, so no users’ guide update is required.
Developer Documentation	✅ Passed	Only .github/workflows files changed; docs/developers-guide.md, roadmap.md, and execplans were untouched, so no documentation update was required.
Module-Level Documentation	✅ Passed	Only .github/workflows YAML files changed; no modules were touched, so the module-level docstring rule is not applicable here.
Testing (Unit And Behavioural)	✅ Passed	Only workflow action pins changed; no local behaviour, contracts, or test files changed, so unit or behavioural tests were not applicable.
Testing (Property / Proof)	✅ Passed	PASS: The PR only repins reusable workflow actions in .github/workflows; it adds no new invariant, state transition, or proof obligation, so property/proof tests are not required.
Testing (Compile-Time / Ui)	✅ Passed	PASS: the PR only repins GitHub workflow actions; it adds no Rust/TypeScript compile-time paths or text/UI output, so trybuild/snapshot tests are not applicable.
Unit Architecture	✅ Passed	Only GitHub Actions pin updates changed; no application/query/command code, dependencies, or tests were modified, so the architecture rules are unaffected.
Domain Architecture	✅ Passed	Latest commit only changes six .github/workflows files, repinning leynos/shared-actions; no domain code or business logic moved.
Observability	✅ Passed	Only workflow action pins changed to a new shared-actions SHA; no runtime logic, logging, metrics, tracing, or alerting was added or altered.
Security And Privacy	✅ Passed	Only workflow action pins changed; no secrets, permissions, auth logic, or data exposure were introduced.
Performance And Resource Use	✅ Passed	Approve it: only workflow action pins changed; no runtime code, loops, allocations, or I/O changed.
Concurrency And State	✅ Passed	Only workflow action SHAs changed; no shared state, locks, async tasks, or ordering logic were introduced or altered.
Architectural Complexity And Maintainability	✅ Passed	PASS: The diff only repins existing shared-actions in workflow files; it adds no new abstractions, layers, or orchestration mechanisms.
Rust Compiler Lint Integrity	✅ Passed	PASS: The PR only repins GitHub workflow actions under .github/workflows/; no Rust sources, lint suppressions, or clone-heavy code changed.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch bump-shared-actions-pin

---

_{Comment @coderabbitai help to get the list of available commands.}

[codescene-access]

No application code in the PR — skipped Code Health checks.

See analysis details in CodeScene

Quality Gate Profile: Pay Down Tech Debt
Install CodeScene MCP: safeguard and uplift AI-generated code. Catch issues early with our IDE extension and CLI tool.

[codescene-access]

No quality gates enabled for this code.