Stop asserting shared-action SHAs in the Polonius contract test

[leynos]

The Polonius contract test asserted each workflow's shared-action reference by path and pinned revision. Those revisions are owned by Dependabot, which bumps workflow pins but cannot update tests, so every routine bump breaks main — exactly what happened when 525a0b6 moved the pins to 8add2d9 and the test kept expecting 2f90d10.

The action references are now matched by path alone (SETUP_RUST_ACTION and RUST_BUILD_RELEASE_ACTION end at the @). Everything the test genuinely guards is unchanged: the with.rustflags values, the absence of env.RUSTFLAGS overrides, and the NETSUKE_RUST_TOOLCHAIN pinning policy. A revision that lost the rustflags input would still surface as a Polonius borrow-check failure in the same run. The developers guide's "Workflow pins and Dependabot" section is rewritten to make shape-only the universal rule with no exception.

All 21 contract tests pass locally.

🤖 Generated with Claude Code

[chatgpt-codex-connector]

You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard.
To continue using code reviews, add credits to your account and enable them for code reviews in your settings.

[sourcery-ai]

Sorry @leynos, you have reached your weekly rate limit of 500000 diff characters.

Please try again later or upgrade to continue using Sourcery

[sourcery-ai]

Reviewer's guide (collapsed on small PRs)

Reviewer's Guide

Update Polonius contract tests to expect the new shared-actions GitHub SHA so they match the workflow pins and stop failing.

File-Level Changes

Change	Details	Files
Align Polonius toolchain contract test expectations with the updated shared-actions pin.	Updated the expected SHA for the setup-rust action from 2f90d10… to 8add2d9… Updated the expected SHA for the rust-build-release action from 2f90d10… to 8add2d9… Kept all other test constants and logic unchanged to preserve existing behavior	tests/polonius_toolchain_contract.rs

---

Tips and commands

Interacting with Sourcery

• Trigger a new review: Comment @sourcery-ai review on the pull request.
• Continue discussions: Reply directly to Sourcery's review comments.
• Generate a GitHub issue from a review comment: Ask Sourcery to create an
  issue from a review comment by replying to it. You can also reply to a
  review comment with @sourcery-ai issue to create an issue from it.
• Generate a pull request title: Write @sourcery-ai anywhere in the pull
  request title to generate a title at any time. You can also comment
  @sourcery-ai title on the pull request to (re-)generate the title at any time.
• Generate a pull request summary: Write @sourcery-ai summary anywhere in
  the pull request body to generate a PR summary at any time exactly where you
  want it. You can also comment @sourcery-ai summary on the pull request to
  (re-)generate the summary at any time.
• Generate reviewer's guide: Comment @sourcery-ai guide on the pull
  request to (re-)generate the reviewer's guide at any time.
• Resolve all Sourcery comments: Comment @sourcery-ai resolve on the
  pull request to resolve all Sourcery comments. Useful if you've already
  addressed all the comments and don't want to see them anymore.
• Dismiss all Sourcery reviews: Comment @sourcery-ai dismiss on the pull
  request to dismiss all existing Sourcery reviews. Especially useful if you
  want to start fresh with a new review - don't forget to comment
  @sourcery-ai review to trigger a new review!

Customizing Your Experience

Access your dashboard to:

• Enable or disable review features such as the Sourcery-generated pull request
  summary, the reviewer's guide, and others.
• Change the review language.
• Add, remove or edit custom review instructions.
• Adjust other review settings.

Getting Help

• Contact our support team for questions or feedback.
• Visit our documentation for detailed guides and information.
• Keep in touch with the Sourcery team by following us on X/Twitter, LinkedIn or GitHub.

[coderabbitai]

Note

Reviews paused

It looks like this branch is under active development. To avoid overwhelming you with review comments due to an influx of new commits, CodeRabbit has automatically paused this review. You can configure this behavior by changing the reviews.auto_review.auto_pause_after_reviewed_commits setting.

Use the following commands to manage reviews:

• @coderabbitai resume to resume automatic reviews.
• @coderabbitai review to trigger a single review.

Use the checkboxes below for quick actions:

• ▶️ Resume reviews
• 🔍 Trigger review

Summary

• Update the shared-actions SHA in tests/polonius_toolchain_contract.rs to 8add2d9.
• Align the test expectation with the pin used by all workflows.
• Fix the four workflows_pass_polonius_rustflags_to_shared_actions test cases.

Walkthrough

Update the pinned commit for the shared setup-rust and rust-build-release GitHub Actions in the toolchain contract test.

Changes

Shared Rust action pins

Layer / File(s)	Summary
Update shared action contract tests/polonius_toolchain_contract.rs	Update both shared action references from 2f90d1041ea108148be0620e3bbcc1fa80ac03e4 to 8add2d99854a5b77548eae98cca59202e68fefc8.

Possibly related PRs

• leynos/netsuke#535: Updates the same shared action pins from 2f90d10 to 8add2d9.
• leynos/netsuke#507: Introduces the action-pin declarations updated here.
• leynos/evert#19: Updates related leynos/shared-actions references.

Suggested reviewers: codescene-access

Poem

Pin the tools to commits bright,
Let Rust builds follow the right.
Setup flows and releases align,
Contracts guard each stable line.
A small refresh keeps paths in time.

🚥 Pre-merge checks | ✅ 20

✅ Passed checks (20 passed)

Check name	Status	Explanation
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Testing (Overall)	✅ Passed	Accept the test: the four rstest cases parse real workflow YAML and assert the exact action SHA, path, and rustflags; the PR only synchronizes the expected SHA with all workflow pins.
User-Facing Documentation	✅ Passed	The PR changes only a Rust test expectation for an existing workflow pin; it adds no user-facing functionality or behaviour, so no guide update is required.
Developer Documentation	✅ Passed	Record PASS: limit this change to two test-oracle SHA strings; the developer guide already documents the Polonius CI shared-action contract.
Module-Level Documentation	✅ Passed	Accept the check: tests/polonius_toolchain_contract.rs has a module docstring that states its purpose, test utility, and relationship to toolchain, Makefile, and workflows.
Testing (Unit And Behavioural)	✅ Passed	Accept: the rstest cases parse four real workflow files, assert the exact shared-action pin and rustflags, and check the job-level RUSTFLAGS invariant at the workflow-contract boundary.
Testing (Property / Proof)	✅ Passed	Pass this check: the patch changes only two expected SHA literals; it introduces no invariant over inputs, states, orderings, or transitions that requires property testing or proof.
Testing (Compile-Time / Ui)	✅ Passed	Pass this check: The change covers structured workflow text only, not compile-time behaviour; the existing focused Rust contract test checks exact action pins and meaningful YAML inputs.
Unit Architecture	✅ Passed	Keep this change: the commit only updates two expected SHA literals in a contract test; it adds no queries, commands, dependencies, state mutation, or side-effects.
Domain Architecture	✅ Passed	Keep the change: the commit updates only two test constants, and both now match the SHA used by the workflows; no domain or adapter code changes.
Observability	✅ Passed	Treat this as non-operational: the PR changes only two expected SHA literals in a Rust contract test; it adds no runtime behaviour, logging, metrics, tracing, or alerts.
Security And Privacy	✅ Passed	The change only updates two expected public GitHub Actions commit SHAs in a Rust contract test; it adds no secrets, inputs, permissions, authentication logic, or data exposure.
Performance And Resource Use	✅ Passed	Pass this check: the patch changes only two expected SHA literals; it adds no loops, allocations, I/O, blocking work, retries, or resource growth.
Concurrency And State	✅ Passed	Pass this check: restrict the change to two SHA constants in a synchronous contract test; it introduces no shared mutable state, async work, locks, ordering, or task-lifetime behaviour.
Architectural Complexity And Maintainability	✅ Passed	Approve the change: the parent-to-HEAD diff updates only two existing SHA literals, and all seven workflows use the same 8add2d9 pin.
Rust Compiler Lint Integrity	✅ Passed	Pass the lint-integrity check: the patch changes only two action-pin string literals; it adds no suppressions, artificial references, or clones, and all workflow pins match.
Title check	✅ Passed	The title directly describes the change to shared-action SHA assertions in the Polonius contract test.
Description check	✅ Passed	The description explains the shared-action pin changes, test behaviour, documentation update, and validation results.

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch fix-polonius-contract-pin

---

_{Comment @coderabbitai help to get the list of available commands.}

[leynos]

Superseded by #540, which requires all shared-action SHAs to agree rather than dropping the assertion — a stronger contract that Dependabot bumps still satisfy.

[codescene-access]

No quality gates enabled for this code.