Repin shared-actions to 6b5cdc2d

[leynos]

Summary

Moves every leynos/shared-actions reference in .github/workflows/ to
6b5cdc2d4c0bb72cafd5a66d24d248ac25827db9, the estate's current pin.

Upstream: leynos/shared-actions#470, merged at
6b5cdc2d.

Replaced pin	References
e0d9b652b137eb15314fff188f09e1ba18d3cc5b	1

Table 1: Pins replaced in this repository and how many references each had.

The single reference is the reusable dependabot-automerge.yml workflow.

Open pull requests

The dependabot group pull request #53 also edited
.github/workflows/dependabot-automerge.yml, bumping it to a SHA older
than this one. Since this repository runs the shared automerge
workflow, that pull request could have walked the pin back without a
human in the loop, so it was closed as superseded by this one at
2026-09-08T10:19Z. Dependabot re-raises if anything newer exists.

Validation

Pin lines only: gh pr diff --name-only lists
.github/workflows/dependabot-automerge.yml and nothing else. The
repository has no pin-contract constant to update.

Gates that read workflows: tests/docs-gate-contract.test.ts passes, 21
of 21, and make spelling is clean.

[sourcery-ai]

Sorry @leynos, you've used your own review budget of 250,000 diff characters for the last 7 days.

You can request another review in 1 day and 11 hours by commenting @sourcery-ai review. Upgrade to get a review now.

[sourcery-ai]

Reviewer's guide (collapsed on small PRs)

Reviewer's Guide

Updates the repository’s only leynos/shared-actions workflow reference to the approved commit 6b5cdc2d, with no functional workflow changes beyond the dependency pin.

File-Level Changes

Change	Details	Files
Repin the reusable Dependabot automerge workflow to the estate’s current shared-actions commit.	Replace the outdated shared-actions SHA with 6b5cdc2d4c0bb72cafd5a66d24d248ac25827db9. Leave workflow inputs, permissions, and conditional execution unchanged.	.github/workflows/dependabot-automerge.yml

---

Tips and commands

Interacting with Sourcery

• Trigger a new review: Comment @sourcery-ai review on the pull request.
• Continue discussions: Reply directly to Sourcery's review comments.
• Generate a GitHub issue from a review comment: Ask Sourcery to create an
  issue from a review comment by replying to it. You can also reply to a
  review comment with @sourcery-ai issue to create an issue from it.
• Generate a pull request title: Write @sourcery-ai anywhere in the pull
  request title to generate a title at any time. You can also comment
  @sourcery-ai title on the pull request to (re-)generate the title at any time.
• Generate a pull request summary: Write @sourcery-ai summary anywhere in
  the pull request body to generate a PR summary at any time exactly where you
  want it. You can also comment @sourcery-ai summary on the pull request to
  (re-)generate the summary at any time.
• Generate reviewer's guide: Comment @sourcery-ai guide on the pull
  request to (re-)generate the reviewer's guide at any time.
• Resolve all Sourcery comments: Comment @sourcery-ai resolve on the
  pull request to resolve all Sourcery comments. Useful if you've already
  addressed all the comments and don't want to see them anymore.
• Dismiss all Sourcery reviews: Comment @sourcery-ai dismiss on the pull
  request to dismiss all existing Sourcery reviews. Especially useful if you
  want to start fresh with a new review - don't forget to comment
  @sourcery-ai review to trigger a new review!

Customizing Your Experience

Access your dashboard to:

• Enable or disable review features such as the Sourcery-generated pull request
  summary, the reviewer's guide, and others.
• Change the review language.
• Add, remove or edit custom review instructions.
• Adjust other review settings.

Getting Help

• Contact our support team for questions or feedback.
• Visit our documentation for detailed guides and information.
• Keep in touch with the Sourcery team by following us on X/Twitter, LinkedIn or GitHub.

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-09-08T10:14:44.723389Z	230a8f1	PR opened

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[coderabbitai]

Note

Reviews paused

It looks like this branch is under active development. To avoid overwhelming you with review comments due to an influx of new commits, CodeRabbit has automatically paused this review. You can configure this behavior by changing the reviews.auto_review.auto_pause_after_reviewed_commits setting.

Use the following commands to manage reviews:

• @coderabbitai resume to resume automatic reviews.
• @coderabbitai review to trigger a single review.

Use the checkboxes below for quick actions:

• ▶️ Resume reviews
• 🔍 Trigger review

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Advanced

Run ID: 366ce3e7-012d-477d-9ed9-b96597b39dcd

📥 Commits

Reviewing files that changed from the base of the PR and between 57e4e2c and 230a8f1.

📒 Files selected for processing (1)

• .github/workflows/dependabot-automerge.yml

Included review availability: Your plan provides up to 1 included review per hour; 0 remain after this review.

---

Summary

• Update the leynos/shared-actions pin in .github/workflows/dependabot-automerge.yml to 6b5cdc2d4c0bb72cafd5a66d24d248ac25827db9 (#470).
• Preserve all workflow logic, permissions, triggers, and inputs.
• Validate with tests/docs-gate-contract.test.ts and make spelling.

Walkthrough

Update the Dependabot automerge workflow reference to a new commit hash. Preserve its triggers, permissions, inputs, and workflow logic.

Changes

Dependabot workflow

Layer / File(s)	Summary
Update reusable workflow pin .github/workflows/dependabot-automerge.yml	Pin leynos/shared-actions/.github/workflows/dependabot-automerge.yml to commit 6b5cdc2d4c0bb72cafd5a66d24d248ac25827db9.

Change: Other

Merge Risk: ⚪ Minimal · up to 230a8

This updates the pinned shared Dependabot automerge workflow revision without changing this repository's workflow configuration. No current merge-blocking risk remains.

---

Caution

Pre-merge checks failed

Please resolve all errors before merging. Addressing warnings is optional.

• Ignore

❌ Failed checks (1 error)

Check name	Status	Explanation	Resolution
Testing (Unit And Behavioural)	❌ Error	Fail the check because the PR changes an externally observable GitHub Actions workflow but adds no end-to-end or behavioural coverage. The diff changes .github/workflows/dependabot-automerge.yml fro…	Add an end-to-end test at the GitHub Actions boundary. Trigger the workflow through workflow_dispatch with a representative pull-request number, or use the repository's supported Actions test harness, and assert that the pinned reusable w…

✅ Passed checks (19 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title clearly identifies the main change: repinning shared-actions to commit 6b5cdc2d. No roadmap item or repository issue requires inclusion.
Description check	✅ Passed	The description directly explains the pin update, identifies the affected workflow, links the upstream change, and records validation results.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0…
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Testing (Overall)	✅ Passed	PASS — The pull request changes one line in .github/workflows/dependabot-automerge.yml: the commit pin for the third-party leynos/shared-actions reusable workflow. Triggers, permissions, condition…
User-Facing Documentation	✅ Passed	Pass the check. The pull request changes only the pinned commit for the reusable Dependabot workflow in .github/workflows/dependabot-automerge.yml. It does not change product functionality, public i…
Developer Documentation	✅ Passed	The pull request changes only the pinned commit of the existing leynos/shared-actions reusable workflow in .github/workflows/dependabot-automerge.yml. The diff changes no internal API, architectur…
Module-Level Documentation	✅ Passed	Pass the check. The pull request changes only .github/workflows/dependabot-automerge.yml, a YAML workflow, and changes only the reusable workflow commit pin. It adds or modifies no source module, so…
Testing (Property / Proof)	✅ Passed	PASS — The change only replaces one pinned reusable-workflow commit in .github/workflows/dependabot-automerge.yml. The diff is one line added and one line removed; triggers, permissions, conditions,…
Testing (Compile-Time / Ui)	✅ Passed	Pass the check. The committed diff changes only the reusable workflow pin in .github/workflows/dependabot-automerge.yml from e0d9b652b137eb15314fff188f09e1ba18d3cc5b to `6b5cdc2d4c0bb72cafd5a66d24…
Unit Architecture	✅ Passed	Pass the Unit Architecture check. The commit changes one line in .github/workflows/dependabot-automerge.yml: the pinned leynos/shared-actions commit. It does not add or modify queries, commands, d…
Domain Architecture	✅ Passed	Pass the Domain Architecture check. The commit changes only the pinned leynos/shared-actions reusable workflow reference in .github/workflows/dependabot-automerge.yml. The diff changes no domain c…
Observability	✅ Passed	Pass the Observability check. Treat this as a pin-only update. The repository diff changes one uses reference and leaves triggers, inputs, permissions, and local workflow logic unchanged. Compare th…
Security And Privacy	✅ Passed	Pass this check. The committed diff changes only the reusable-workflow pin in .github/workflows/dependabot-automerge.yml; the job permissions, trigger, condition, inputs, and existing `contents: wri…
Performance And Resource Use	✅ Passed	The pull request changes one GitHub Actions reference only: it replaces the immutable leynos/shared-actions pin. It adds no loops, searches, allocations, I/O, retries, polling, blocking work, or col…
Concurrency And State	✅ Passed	Pass this check. The pull request changes one immutable workflow reference only. The caller workflow keeps the same triggers, permissions, inputs, and job structure. The upstream old and new reusable …
Architectural Complexity And Maintainability	✅ Passed	Pass this check. The commit changes one line in .github/workflows/dependabot-automerge.yml: it replaces the reusable workflow pin and leaves all workflow structure unchanged. The diff is 1 insertion…
Rust Compiler Lint Integrity	✅ Passed	Pass: the pull request changes only .github/workflows/dependabot-automerge.yml, replacing one leynos/shared-actions commit pin. The committed diff contains no Rust files, Rust code, ownership chan…

Full details: Testing (Unit And Behavioural)

Explanation

Fail the check because the PR changes an externally observable GitHub Actions workflow but adds no end-to-end or behavioural coverage. The diff changes .github/workflows/dependabot-automerge.yml from reusable workflow commit e0d9b652b137eb15314fff188f09e1ba18d3cc5b to 6b5cdc2d4c0bb72cafd5a66d24d248ac25827db9. The automerge job calls that remote workflow for pull_request_target and workflow_dispatch events, so the pin selects the implementation that performs the integration behaviour. The only changed file is the workflow; existing tests cover the documentation gate and do not exercise this workflow boundary.

Resolution

Add an end-to-end test at the GitHub Actions boundary. Trigger the workflow through workflow_dispatch with a representative pull-request number, or use the repository's supported Actions test harness, and assert that the pinned reusable workflow resolves and completes the expected auto-merge behaviour. Cover the relevant input and failure outcome without replacing the boundary test with a unit test of a parser or helper.

---

_{Pin the workflow, steady and bright
Dependabot follows the right commit
Triggers stay still through day and night
Permissions remain exactly fit
One small change completes the kit}

_{Comment @coderabbitai help to get the list of available commands.}