ci(deps): Bump mamba-org/setup-micromamba from 3.1.0 to 3.2.1 in /.github/actions/setup-env in the actions-composite group across 1 directory - #445

Review lane — Codex leg

• Final head SHA: ca1cddd (see below for the full 40-hex in the merge binding).

• Opened ready rather than as a draft — not a choice made here; Dependabot opens ready. The
  order the draft rule protects was still kept: the unmetered provider read the diff first, and no
  metered provider has been asked yet.

• Codex — first, on the green diff, and not optional: reviewed, nothing blocking. Run locally
  with codex review --base origin/main (CLI 0.147.0, gpt-5.6-sol) in a worktree at this PR's
  head. Its verdict, quoted:

  The patch updates the action to the verified v3.2.1 tag SHA while retaining the pinned
  micromamba binary version. Relevant CI consumers, including the three-OS test matrix,
  completed successfully with no evident regression.

  It verified f457c30a868e4760d3a6fcea5f25dc655b8edf39 against the upstream repository rather
  than trusting the # v3.2.1 comment — which is the one thing worth checking on a SHA-pin bump,
  since the comment is the only human-readable half and nothing enforces that it matches.

• Greptile: skipped (say why) — a one-line uses: SHA bump with no src/, schema, lock or
  logic change. The seat's budget is better spent elsewhere; recording the reason rather than the
  spend, as the lane requires.

• Findings: 0 serious, 0 below the floor on this PR.

One cross-PR note, tracked rather than fixed here

Codex raised on the sibling PR #446 (P2, below the blocking floor) that this pair splits the
setup-micromamba pin across two PRs: .github/actions/setup-env/action.yml moves here, while
packaging.yml and release.yml move there. Landing only one leaves the repository on two
different versions of the same action across seven workflows, including required checks — and
tests/test_marker_contract.py compares only micromamba-version, never the action SHA, so CI
would not say so.

The disposition is land both, which closes it directly rather than deferring it. The missing
guard itself is real and outlives this pair, so it is tracked in #448.

@coderabbitai full review

Final head ca1cddd797f67b007dfb09c031e2e1547d2400e3. All required checks are green there
(CodeQL reads skipping — this diff touches no code it analyses, which is neutral, not a failure).

The unmetered leg is done and recorded above: Codex read this diff first and reported nothing
blocking, having verified f457c30a868e4760d3a6fcea5f25dc655b8edf39 against the upstream repository
rather than trusting the # v3.2.1 comment. Greptile is recorded as skipped with its reason.

One thing worth your attention specifically, since it is not visible from this diff alone: this is
one half of a Dependabot pair. #446 moves the same action to the same SHA in packaging.yml and
release.yml; this PR moves it in the .github/actions/setup-env composite. Both are being merged,
because landing only one leaves seven workflows — including required checks — on two different
versions of the same action, and tests/test_marker_contract.py compares only micromamba-version,
never the action SHA, so CI would stay green through the split. That missing guard is tracked in #448.

@bioedca I will perform a full review of the final head. I will consider the paired update in #446 and the tracked guard in #448.

Learnt from: bioedca
Repo: bioedca/tether PR: 427
File: CONTRIBUTING.md:392-395
Timestamp: 2026-08-08T21:33:13.669Z
Learning: In bioedca/tether review-governance documentation, do not describe the review lane as having a fixed provider count. Greptile is optional and can be skipped when its seat has no credits, while draft-phase Codex is uncounted. For the ADR-0064 drop-rule rationale, state that a follow-up issue re-enters the same review lane.

No actionable comments were generated in the recent review. 🎉

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

_{Comment @coderabbitai help to get the list of available commands.}

Gate closed — merging

• Final head SHA: ca1cddd797f67b007dfb09c031e2e1547d2400e3
• Codex (first, unmetered, uncapped): reviewed, nothing blocking. Quoted above.
• Greptile: skipped, reason recorded above. Seat budget untouched.
• CodeRabbit — the last metered gate: no actionable comments. One completed full review, asked
  with the full-review command, at the final head:
  • Permalink: ci(deps): Bump mamba-org/setup-micromamba from 3.1.0 to 3.2.1 in /.github/actions/setup-env in the actions-composite group across 1 directory #445 (comment)
  • Head read: ca1cddd797f67b007dfb09c031e2e1547d2400e3 — stated in its own Commits block as
    the range e70a12c41dc504c4205bf3004a1ff7633ed1afc8 … ca1cddd797f67b007dfb09c031e2e1547d2400e3,
    with .github/actions/setup-env/action.yml as the one file selected for processing.
  • submitted_at: 2026-08-12T02:19:00Z, with the acknowledgement at 02:18:51Z reading
    "Full review finished."
  • What it said: "No actionable comments were generated in the recent review. 🎉"
  • It carries a walkthrough, which is what separates a real review here from the adaptive-limit
    refusal that leaves a green status check and an empty body behind.
• Provider that did not review: none.
• Findings: 0 serious, 0 below the floor on this PR.
• Human sign-off: n/a — no release, tag, signing, or scientific claim.

On the recording shape, since it is not the usual one: this review posted no inline comments,
so GitHub created no review object and the verdict lives on the issue comment linked above rather
than at a #pullrequestreview- permalink with a COMMENTED state. The evidence the gate actually
asks for — which provider, which head, when, and what it found — is all present; it is the container
that differs.

The pair, deliberately not held: #446 moves the same action to the same SHA in packaging.yml
and release.yml and has not closed its gate yet, so merging this leaves .github/actions/setup-env
on v3.2.1 while those two sit on v3.1.0 for as long as that takes. That window is real and named
rather than glossed: nothing is being released through it, only setup-env restores a conda-lock,
and #446 is next in the same lane. Holding a gate-closed PR to chase simultaneity is not something
the contract asks for, and the missing guard that would make such a split visible is tracked in #448.