Bump shared-actions pins to 18bed1ca

[leynos]

Summary

Bumps every leynos/shared-actions workflow and action reference to
18bed1ca49a6de3d8882bd72635a32ae3f023d57 (current upstream main at
the time of the estate sweep).

This picks up the coverage-ratchet fix from shared-actions#353: the
baseline can now advance (cache save-key fix) and a symmetric ±1pp
dead-band absorbs coverage measurement noise. It also carries the
whitaker-installer 0.2.6 bump and the mutation-run workspace
relocation.

Review walkthrough

Mechanical SHA substitution in .github/workflows/ only. References
already at or beyond the fix commit are left untouched. Dependabot
retains ownership of future bumps; contract tests assert shape (path @
40-hex SHA), not the value.

Validation

CI on this pull request exercises the bumped references directly.

Summary by Sourcery

Update GitHub workflows to use a newer pinned revision of the shared leynos actions.

CI:

• Bump leynos/shared-actions setup-rust and generate-coverage action references in CI and coverage workflows to commit 18bed1ca49a6de3d8882bd72635a32ae3f023d57.
• Update dependabot automerge reusable workflow reference to the same shared-actions commit.

[chatgpt-codex-connector]

You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard.
To continue using code reviews, add credits to your account and enable them for code reviews in your settings.

[sourcery-ai]

Reviewer's guide (collapsed on small PRs)

Reviewer's Guide

Updates GitHub workflow references to the latest pinned commit of leynos/shared-actions to pick up coverage-ratchet fixes and other upstream improvements, while keeping all workflow shapes unchanged.

File-Level Changes

Change	Details	Files
Update all leynos/shared-actions action and workflow pins in CI-related GitHub workflows to commit 18bed1ca49a6de3d8882bd72635a32ae3f023d57.	Retarget setup-rust action pin in CI workflow to the new shared-actions commit. Retarget generate-coverage action pin in CI workflow to the new shared-actions commit so coverage-ratchet fixes and baseline advancement behavior are picked up. Retarget setup-rust and generate-coverage action pins in the coverage-main workflow to the new shared-actions commit. Retarget the shared dependabot-automerge reusable workflow pin to the new shared-actions commit while preserving Dependabot ownership of future bumps.	.github/workflows/ci.yml .github/workflows/coverage-main.yml .github/workflows/dependabot-automerge.yml

---

Tips and commands

Interacting with Sourcery

• Trigger a new review: Comment @sourcery-ai review on the pull request.
• Continue discussions: Reply directly to Sourcery's review comments.
• Generate a GitHub issue from a review comment: Ask Sourcery to create an
  issue from a review comment by replying to it. You can also reply to a
  review comment with @sourcery-ai issue to create an issue from it.
• Generate a pull request title: Write @sourcery-ai anywhere in the pull
  request title to generate a title at any time. You can also comment
  @sourcery-ai title on the pull request to (re-)generate the title at any time.
• Generate a pull request summary: Write @sourcery-ai summary anywhere in
  the pull request body to generate a PR summary at any time exactly where you
  want it. You can also comment @sourcery-ai summary on the pull request to
  (re-)generate the summary at any time.
• Generate reviewer's guide: Comment @sourcery-ai guide on the pull
  request to (re-)generate the reviewer's guide at any time.
• Resolve all Sourcery comments: Comment @sourcery-ai resolve on the
  pull request to resolve all Sourcery comments. Useful if you've already
  addressed all the comments and don't want to see them anymore.
• Dismiss all Sourcery reviews: Comment @sourcery-ai dismiss on the pull
  request to dismiss all existing Sourcery reviews. Especially useful if you
  want to start fresh with a new review - don't forget to comment
  @sourcery-ai review to trigger a new review!

Customizing Your Experience

Access your dashboard to:

• Enable or disable review features such as the Sourcery-generated pull request
  summary, the reviewer's guide, and others.
• Change the review language.
• Add, remove or edit custom review instructions.
• Adjust other review settings.

Getting Help

• Contact our support team for questions or feedback.
• Visit our documentation for detailed guides and information.
• Keep in touch with the Sourcery team by following us on X/Twitter, LinkedIn or GitHub.

[coderabbitai]

Note

Reviews paused

It looks like this branch is under active development. To avoid overwhelming you with review comments due to an influx of new commits, CodeRabbit has automatically paused this review. You can configure this behavior by changing the reviews.auto_review.auto_pause_after_reviewed_commits setting.

Use the following commands to manage reviews:

• @coderabbitai resume to resume automatic reviews.
• @coderabbitai review to trigger a single review.

Use the checkboxes below for quick actions:

• ▶️ Resume reviews
• 🔍 Trigger review

Walkthrough

Update pinned leynos/shared-actions revisions across CI, coverage, and Dependabot automerge workflows while preserving existing workflow structure and configuration.

Changes

Workflow revision pins

Layer / File(s)	Summary
Rust and coverage action pins .github/workflows/ci.yml, .github/workflows/coverage-main.yml	Update the pinned setup-rust and generate-coverage action revisions used by CI and coverage generation.
Dependabot automerge pin .github/workflows/dependabot-automerge.yml	Update the pinned reusable Dependabot automerge workflow revision.

Possibly related PRs

• leynos/shared-actions#350: Updates the shared actions used for Rust setup and coverage generation.
• leynos/axinite#272: Pins the Dependabot automerge workflow to the same commit.
• leynos/corbusier#149: Updates the same shared workflow references across the three workflow files.

Poem

Pin the actions, fresh and bright,
Guide Rust through its nightly flight.
Let coverage rise and automerge flow,
With trusted commits in ordered rows.
Keep every workflow step aglow.

---

Caution

Pre-merge checks failed

Please resolve all errors before merging. Addressing warnings is optional.

• Ignore

❌ Failed checks (1 error, 1 warning)

Check name	Status	Explanation	Resolution
Testing (Overall)	❌ Error	The bumped setup-rust/generate-coverage SHAs in ci.yml and coverage-main.yml are unasserted; existing workflow-contract tests cover other steps only.	Add contract tests that pin and exercise the changed shared-action refs, or justify why these external-action bumps need no behavioural oracle.
Testing (Unit And Behavioural)	⚠️ Warning	No unit, behavioural, or E2E tests cover the updated shared-action pins; the existing workflow contract tests only assert YAML shape, not the changed workflow behaviour.	Add workflow-level behavioural checks or CI verification that executes the bumped actions and asserts the expected outputs; keep the shape contracts, but cover the changed boundary.

✅ Passed checks (18 passed)

Check name	Status	Explanation
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
User-Facing Documentation	✅ Passed	Only GitHub Actions pin bumps changed; no user-facing behaviour was added or altered, so users-guide updates are not required.
Developer Documentation	✅ Passed	Only reusable-workflow SHAs changed; no new APIs, architecture, roadmap, or locale docs needed.
Module-Level Documentation	✅ Passed	This PR only changes GitHub Actions workflows; no code modules were added or edited, so the module docstring rule is not applicable.
Testing (Property / Proof)	✅ Passed	PASS: these workflow-only SHA bumps introduce no new input/state invariant or proof obligation, so property/proof tests are not required.
Testing (Compile-Time / Ui)	✅ Passed	Only workflow SHA pins changed; no Rust/TypeScript compile-time or UI code changed, so trybuild/snapshot coverage is not required here.
Unit Architecture	✅ Passed	Only GitHub Actions workflow SHAs changed; no application queries, commands, dependencies, or tests were altered, so unit architecture is unaffected.
Domain Architecture	✅ Passed	Keep the change confined to workflow pin updates; only .github/workflows files changed, so domain logic stays untouched.
Observability	✅ Passed	Only GitHub Actions SHA pins changed; no runtime, production, or async behaviour was altered, so no new observability is required.
Security And Privacy	✅ Passed	PASS: only repinned shared-action SHAs; no new permissions, secrets, auth flows, or data sinks were added.
Performance And Resource Use	✅ Passed	Only workflow SHA pins changed; no repo code, loops, collections, retries, or I/O paths were added or altered.
Concurrency And State	✅ Passed	Accept: only pinned GitHub Actions SHAs changed; no shared state, locks, async lifetimes, or ordering logic were introduced.
Architectural Complexity And Maintainability	✅ Passed	Keep it mechanical: the PR only retargets three existing workflow/action SHAs and introduces no new abstractions, layers, or indirection.
Rust Compiler Lint Integrity	✅ Passed	PASS: The diff only retargets GitHub Actions SHAs in workflow YAML; no Rust sources, lint suppressions, or clone-heavy code changed.
Title check	✅ Passed	The title matches the shared-actions pin bump across the workflow updates.
Description check	✅ Passed	The description clearly relates to the GitHub Actions pin updates in the changeset.

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch bump-shared-actions-pin

---

_{Comment @coderabbitai help to get the list of available commands.}

[sourcery-ai]

Hey - I've reviewed your changes and they look great!

---

Sourcery is free for open source - if you like our reviews please consider sharing them ✨

• X
• Mastodon
• LinkedIn
• Facebook

_{Help me be more useful! Please click 👍 or 👎 on each comment and I'll use the feedback to improve your reviews.}

[codescene-access]

No quality gates enabled for this code.