action.yml

# Generate code coverage badge and push it to the 'coverage' branch.
# Reference it in your README.md like this:
#
#  [![coverage](https://github.com/USERNAME/REPO/blob/coverage/BRANCH/badge.svg)](#)
#
# If you submitted a detailed HTML report of the coverage, replace the '#' with:
#
#  https://html-preview.github.io/?url=https://github.com/USERNAME/REPO/blob/coverage/BRANCH/report.html
#
# You need to have given write permissions for the for the workflow:
#
#   permissions:
#     contents: write

name: "gitcoverage"
branding:
  icon: "percent"
  color: "green"
description: "Create/update <branch>/badge.svg (+ optional report.html) on the 'coverage' branch."
author: "johan@linkdata.se"
inputs:
  coverage:
    description: "Coverage percentage (e.g. 83 or 83%)"
    required: true
  branch:
    description: "Optional source branch name override (recommended for tag-triggered workflows)"
    required: false
  report:
    description: "Optional path to an HTML coverage report file to publish as report.html"
    required: false
runs:
  using: "composite"
  steps:
    - name: Sanity / git identity
      shell: bash
      run: |
        set -euo pipefail
        to_posix_path() {
          local p="$1"
          if command -v cygpath >/dev/null 2>&1; then
            cygpath -u "$p"
          else
            printf '%s\n' "${p//\\//}"
          fi
        }
        detect_and_store_repo_depth_mode() {
          local shallow
          if ! shallow="$(git rev-parse --is-shallow-repository 2>/dev/null)"; then
            echo "gitcoverage requires Git 2.15.0 or newer (missing 'git rev-parse --is-shallow-repository')." >&2
            exit 1
          fi
          if [[ "$shallow" != "true" && "$shallow" != "false" ]]; then
            echo "Unexpected result from 'git rev-parse --is-shallow-repository': '$shallow'" >&2
            exit 1
          fi
          echo "GITCOVERAGE_IS_SHALLOW_REPOSITORY=$shallow" >> "$GITHUB_ENV"
        }

        detect_and_store_repo_depth_mode

        WORKSPACE_PATH="${GITHUB_WORKSPACE:-$PWD}"
        WORKSPACE_PATH="$(to_posix_path "$WORKSPACE_PATH")"
        # Trust only this workspace. If the default global config is not writable,
        # use a temporary global config file and persist it for subsequent steps.
        if ! git config --global --add safe.directory "$WORKSPACE_PATH" >/dev/null 2>&1; then
          if [[ -n "${RUNNER_TEMP:-}" ]]; then
            SAFE_ROOT="$(to_posix_path "$RUNNER_TEMP")"
            SAFE_GLOBAL="${SAFE_ROOT}/gitcoverage-global.gitconfig"
          else
            SAFE_GLOBAL="${WORKSPACE_PATH}/.gitcoverage-global.gitconfig"
          fi
          touch "$SAFE_GLOBAL"
          export GIT_CONFIG_GLOBAL="$SAFE_GLOBAL"
          echo "GIT_CONFIG_GLOBAL=$SAFE_GLOBAL" >> "$GITHUB_ENV"
          if ! git config --global --add safe.directory "$WORKSPACE_PATH"; then
            echo "Failed to configure safe.directory for '$WORKSPACE_PATH'." >&2
            exit 1
          fi
        fi
        git config --local user.email "action@github.com"
        git config --local user.name  "GitHub Action"

    - name: Detect current branch (handles tags; fetches tags; robust)
      id: branch
      shell: bash
      env:
        INPUT_BRANCH: ${{ inputs.branch }}
        GITHUB_DEFAULT_BRANCH: ${{ github.event.repository.default_branch }}
        CTX_HEAD_REF: ${{ env.GITCOVERAGE_HEAD_REF }}
        CTX_REF_TYPE: ${{ env.GITCOVERAGE_REF_TYPE }}
        CTX_REF_NAME: ${{ env.GITCOVERAGE_REF_NAME }}
        CTX_REF: ${{ env.GITCOVERAGE_REF }}
      run: |
        set -euo pipefail

        HEAD_REF="${CTX_HEAD_REF:-${GITHUB_HEAD_REF:-}}"
        REF_TYPE="${CTX_REF_TYPE:-${GITHUB_REF_TYPE:-}}"
        REF_NAME="${CTX_REF_NAME:-${GITHUB_REF_NAME:-}}"
        REF_FULL="${CTX_REF:-${GITHUB_REF:-}}"

        resolve_default_branch() {
          local d=""
          d="$(git symbolic-ref --quiet --short refs/remotes/origin/HEAD 2>/dev/null | sed 's@^origin/@@' || true)"
          if [[ -n "$d" ]] && is_valid_branch_name "$d"; then
            echo "$d"
            return 0
          fi

          # If local origin/HEAD is absent or stale, query remote HEAD directly.
          d="$(git ls-remote --symref origin HEAD 2>/dev/null | awk '/^ref:/ { sub("^refs/heads/", "", $2); print $2; exit }' || true)"
          if [[ -n "$d" ]] && is_valid_branch_name "$d"; then
            echo "$d"
            return 0
          fi

          # Use GitHub event metadata when available.
          d="${GITHUB_DEFAULT_BRANCH:-}"
          if [[ -n "$d" ]] && is_valid_branch_name "$d"; then
            echo "$d"
            return 0
          fi

          # Last-resort heuristics for common repo defaults.
          if git show-ref --verify --quiet refs/remotes/origin/main; then
            echo "main"
            return 0
          fi
          if git show-ref --verify --quiet refs/remotes/origin/master; then
            echo "master"
            return 0
          fi
          echo ""
        }
        is_detached_marker() {
          local b="$1"
          [[ "$b" == "HEAD" || "$b" == "(no branch)" || "$b" == "(HEAD detached at "* || "$b" == "(HEAD detached from "* ]]
        }
        is_valid_branch_name() {
          local b="$1"
          git check-ref-format --branch "$b" >/dev/null 2>&1
        }
        validate_windows_safe_branch_path_or_fail() {
          local b="$1"
          # Only enforce this compatibility check on Windows runners.
          if [[ "${RUNNER_OS:-}" == "Windows" ]]; then
            # Keep this intentionally strict and simple for filesystem safety.
            if ! [[ "$b" =~ ^[A-Za-z0-9._/+-]+$ ]]; then
              echo "On Windows runners, branch '$b' must match: [A-Za-z0-9._/+-]+" >&2
              return 1
            fi
          fi
        }
        ensure_tag_resolution_refs() {
          # Only tag-triggered auto-mapping needs full remote-branch refs.
          if [[ "$GITCOVERAGE_IS_SHALLOW_REPOSITORY" == "true" ]]; then
            # Fully unshallow if possible so --contains works reliably.
            git fetch --prune --tags --unshallow origin || git fetch --prune --tags --depth=1000 origin
          else
            git fetch --prune --tags origin
          fi
          if ! git fetch origin +refs/heads/*:refs/remotes/origin/* --prune; then
            echo "Failed to fetch remote branches needed for tag-triggered branch resolution." >&2
            echo "Set input 'branch' to the intended source branch." >&2
            exit 1
          fi
        }

        # --- Ensure 'origin' exists ---
        # Ensure 'origin' exists but never rewrite an existing remote URL/config.
        if ! git remote get-url origin >/dev/null 2>&1; then
          git remote add origin "${GITHUB_SERVER_URL:-https://github.com}/${GITHUB_REPOSITORY}.git"
        fi
        REPO_ROOT="$(git rev-parse --show-toplevel)"
        echo "GITCOVERAGE_REPO_ROOT=$REPO_ROOT" >> "$GITHUB_ENV"

        # Explicit override: useful for tag workflows where multiple branches may contain the tag.
        BRANCH="${INPUT_BRANCH:-}"
        BRANCH="$(echo "$BRANCH" | sed 's/^[[:space:]]*//; s/[[:space:]]*$//')"
        if [[ -n "$BRANCH" ]]; then
          if is_detached_marker "$BRANCH" || ! is_valid_branch_name "$BRANCH"; then
            echo "Invalid explicit branch input: '$BRANCH'" >&2
            exit 1
          fi
          if ! git ls-remote --exit-code --heads origin "$BRANCH" >/dev/null 2>&1; then
            echo "Explicit branch '$BRANCH' was not found on origin." >&2
            exit 1
          fi
          echo "Using explicit branch input: $BRANCH"
        fi

        # --- Fast paths: branch refs; never let PR head-ref override tag context ---
        if [[ -z "$BRANCH" ]]; then
          if [[ "$REF_TYPE" == "tag" || "$REF_FULL" == refs/tags/* ]]; then
            BRANCH=""
          elif [[ -n "$HEAD_REF" ]]; then
            BRANCH="${HEAD_REF}"
          elif [[ "$REF_TYPE" == "branch" && -n "$REF_NAME" ]]; then
            BRANCH="${REF_NAME}"
          else
            BRANCH=""
          fi
        fi

        # --- Tag path: map tag -> containing branch ---
        if [[ -z "$BRANCH" ]] && { [[ "$REF_TYPE" == "tag" ]] || [[ "$REF_FULL" == refs/tags/* ]]; }; then
          ensure_tag_resolution_refs
          TAG="${REF_NAME:-${REF_FULL#refs/tags/}}"
          TAG_REF="tags/$TAG"
          TAG_SHA="$(git rev-list -n1 "$TAG_REF")"
          echo "Ref is a tag (${TAG}); resolving containing branch..."

          # 1) Gather remote branches that contain the tag commit
          CANDIDATES=()
          while IFS= read -r r; do
            [[ -z "$r" || "$r" == origin/HEAD ]] && continue
            CANDIDATES+=("${r#origin/}")
          done < <(git branch -r --format "%(refname:short)" --contains "$TAG_REF" 2>/dev/null || true)

          # 2) Prefer branches whose TIP exactly matches the tagged commit.
          TIP_MATCHES=()
          while IFS= read -r rb; do
            [[ -z "$rb" || "$rb" == origin/HEAD ]] && continue
            b="${rb#origin/}"
            BR_SHA="$(git rev-parse "$rb" 2>/dev/null || true)"
            [[ -n "$BR_SHA" && "$BR_SHA" == "$TAG_SHA" ]] && TIP_MATCHES+=("$b")
          done < <(git for-each-ref --format='%(refname:short)' refs/remotes/origin/)
          if [[ ${#TIP_MATCHES[@]} -gt 0 ]]; then
            CANDIDATES=("${TIP_MATCHES[@]}")
          fi

          # 3) Choose nearest containing branch by smallest ahead distance from tag commit.
          # If still ambiguous, fail instead of silently picking the wrong branch.
          DEF="$(resolve_default_branch)"
          if [[ ${#CANDIDATES[@]} -eq 1 ]]; then
            BRANCH="${CANDIDATES[0]}"
          elif [[ ${#CANDIDATES[@]} -gt 1 ]]; then
            BEST_BRANCH=""
            BEST_DIST=""
            TIED=0
            for b in "${CANDIDATES[@]}"; do
              dist="$(git rev-list --count "${TAG_REF}..origin/${b}" 2>/dev/null || echo 999999)"
              [[ "$dist" =~ ^[0-9]+$ ]] || dist=999999
              if [[ -z "$BEST_DIST" || "$dist" -lt "$BEST_DIST" ]]; then
                BEST_DIST="$dist"
                BEST_BRANCH="$b"
                TIED=0
              elif [[ "$dist" -eq "$BEST_DIST" ]]; then
                if [[ -n "$DEF" && "$b" == "$DEF" ]]; then
                  BEST_BRANCH="$b"
                  TIED=0
                elif [[ -n "$DEF" && "$BEST_BRANCH" == "$DEF" ]]; then
                  :
                else
                  TIED=1
                fi
              fi
            done

            if [[ -n "$BEST_BRANCH" && "$TIED" -eq 0 ]]; then
              BRANCH="$BEST_BRANCH"
            else
              echo "Ambiguous tag-to-branch mapping for tag '${TAG}'." >&2
              echo "Candidates: ${CANDIDATES[*]}" >&2
              echo "Set input 'branch' to the intended source branch." >&2
              exit 1
            fi
          else
            echo "Tag '${TAG}' is not contained in any remote branch." >&2
            echo "Set input 'branch' to the intended source branch." >&2
            exit 1
          fi
        fi

        # --- Last resorts: never return a detached HEAD string ---
        if [[ -z "$BRANCH" ]] || is_detached_marker "$BRANCH" || ! is_valid_branch_name "$BRANCH"; then
          BRANCH="$(resolve_default_branch)"
        fi
        if [[ -z "$BRANCH" ]] || is_detached_marker "$BRANCH" || ! is_valid_branch_name "$BRANCH"; then
          echo "Could not determine branch (still detached at a tag). Consider actions/checkout with 'fetch-depth: 0'." >&2
          exit 1
        fi
        if ! validate_windows_safe_branch_path_or_fail "$BRANCH"; then
          exit 1
        fi

        echo "Resolved branch: $BRANCH"
        echo "branch=$BRANCH" >> "$GITHUB_OUTPUT"

    - name: Ensure 'coverage' branch exists (create orphan if needed)
      shell: bash
      run: |
        set -euo pipefail
        to_posix_path() {
          local p="$1"
          if command -v cygpath >/dev/null 2>&1; then
            cygpath -u "$p"
          else
            printf '%s\n' "${p//\\//}"
          fi
        }
        # Does 'coverage' branch exist on origin?
        if git ls-remote --exit-code --heads origin coverage >/dev/null 2>&1; then
          echo "'coverage' branch exists."
        else
          echo "Creating orphan 'coverage' branch..."
          if [[ -n "${RUNNER_TEMP:-}" ]]; then
            TMP_ROOT="$(to_posix_path "$RUNNER_TEMP")"
            BOOTSTRAP_DIR="$(mktemp -d "${TMP_ROOT%/}/gitcoverage-bootstrap.XXXXXX")"
          else
            BOOTSTRAP_DIR="$(mktemp -d "${PWD}/.gitcoverage-bootstrap.XXXXXX")"
          fi

          NEED_CLEANUP=1
          cleanup_bootstrap() {
            local rc=$?
            if [[ "$NEED_CLEANUP" == "1" ]]; then
              git worktree remove --force "$BOOTSTRAP_DIR" >/dev/null 2>&1 || true
              rm -rf -- "$BOOTSTRAP_DIR" || true
              NEED_CLEANUP=0
            fi
            return "$rc"
          }
          trap cleanup_bootstrap EXIT

          # Isolate bootstrap work from the caller's checkout to handle dirty tracked files safely.
          git worktree add --detach "$BOOTSTRAP_DIR" HEAD
          pushd "$BOOTSTRAP_DIR" >/dev/null
            git checkout --orphan coverage
            git rm -rf --cached . >/dev/null 2>&1 || true
            echo '# Coverage branch' > README.md
            # Force-add so bootstrap works even if README.md is ignored in source repo rules.
            git add -f README.md
            git -c commit.gpgsign=false commit -m 'Add README.md'
            # Push with auth via checkout action's token/remote config.
            # If another concurrent run creates 'coverage' first, treat that as success.
            COVERAGE_HEAD="$(git rev-parse HEAD)"
            if git -C "$GITCOVERAGE_REPO_ROOT" push origin "${COVERAGE_HEAD}:refs/heads/coverage"; then
              echo "Created 'coverage' branch."
            else
              echo "Initial push failed; checking whether 'coverage' was created concurrently..."
              git -C "$GITCOVERAGE_REPO_ROOT" fetch origin +refs/heads/coverage:refs/remotes/origin/coverage >/dev/null 2>&1 || true
              if git -C "$GITCOVERAGE_REPO_ROOT" ls-remote --exit-code --heads origin coverage >/dev/null 2>&1; then
                echo "'coverage' branch was created by another run."
              else
                echo "Failed to create 'coverage' branch." >&2
                exit 1
              fi
            fi
          popd >/dev/null

          cleanup_bootstrap
          trap - EXIT
        fi

        # Ensure local remote-tracking ref exists (actions/checkout often fetches only one branch).
        if ! git -C "$GITCOVERAGE_REPO_ROOT" fetch --no-tags origin +refs/heads/coverage:refs/remotes/origin/coverage; then
          echo "Failed to fetch refs/remotes/origin/coverage." >&2
          exit 1
        fi

    - name: Check out coverage branch (worktree)
      shell: bash
      run: |
        set -euo pipefail
        to_posix_path() {
          local p="$1"
          if command -v cygpath >/dev/null 2>&1; then
            cygpath -u "$p"
          else
            printf '%s\n' "${p//\\//}"
          fi
        }
        # Use an isolated worktree path so we don't clobber project dirs (e.g. ./coverage reports)
        if [[ -n "${RUNNER_TEMP:-}" ]]; then
          TMP_ROOT="$(to_posix_path "$RUNNER_TEMP")"
          WORKTREE_DIR="$(mktemp -d "${TMP_ROOT%/}/gitcoverage-worktree.XXXXXX")"
        else
          WORKTREE_DIR="$(mktemp -d "${PWD}/.gitcoverage-worktree.XXXXXX")"
        fi
        git worktree prune || true
        # Use detached HEAD to avoid branch-name collisions when current checkout is already 'coverage'.
        git worktree add --detach "$WORKTREE_DIR" refs/remotes/origin/coverage
        echo "WORKTREE_DIR=$WORKTREE_DIR" >> "$GITHUB_ENV"
        echo "Using worktree at $WORKTREE_DIR"

    - name: Prepare coverage/<branch> directory
      shell: bash
      env:
        BRANCH: ${{ steps.branch.outputs.branch }}
      run: |
        set -euo pipefail
        mkdir -p "${WORKTREE_DIR}/${BRANCH}"

    - name: Parse coverage input and generate SVG badge
      shell: bash
      env:
        BRANCH: ${{ steps.branch.outputs.branch }}
        INPUT_COVERAGE: ${{ inputs.coverage }}
      run: |
        set -euo pipefail

        # --- 1) Normalize and validate percentage ---
        RAW="$INPUT_COVERAGE"
        PCT="$(echo "$RAW" | sed 's/[[:space:]]//g; s/%$//')"
        if ! [[ "$PCT" =~ ^([0-9]+([.][0-9]+)?)$ ]]; then
          echo "Invalid coverage value: '$RAW' (expected a number like 83 or 83%)." >&2
          exit 1
        fi
        # Clamp and standardize to 0..100 with 2 decimals; display as integer
        PCT=$(awk -v v="$PCT" 'BEGIN{ if (v<0) v=0; if (v>100) v=100; printf("%.2f", v) }')
        VALUE="$(printf "%.0f" "$PCT")%"

        # --- 2) Compute color with 0->33->66->100 anchors (smooth) ---
        read -r HEX < <(awk -v p="$PCT" '
          function abs(v){ return v < 0 ? -v : v }
          function fmod(a,b){ return a - b * int(a / b) }
          function hsl2hex(h,s,l,   c,x,m,r,g,bv,R,G,B,hprime,phase) {
            c=(1 - abs(2*l-1)) * s
            hprime=h/60.0
            phase=fmod(hprime,2.0)
            x=c*(1 - abs(phase-1))
            if      (0<=hprime && hprime<1){r=c; g=x; bv=0}
            else if (1<=hprime && hprime<2){r=x; g=c; bv=0}
            else if (2<=hprime && hprime<3){r=0; g=c; bv=x}
            else if (3<=hprime && hprime<4){r=0; g=x; bv=c}
            else if (4<=hprime && hprime<5){r=x; g=0; bv=c}
            else if (5<=hprime && hprime<6){r=c; g=0; bv=x}
            else {r=0; g=0; bv=0}
            m=l - c/2.0
            R=int((r+m)*255+0.5); G=int((g+m)*255+0.5); B=int((bv+m)*255+0.5)
            return sprintf("#%02X%02X%02X", R,G,B)
          }
          function lerp(a,b,t){ return a + (b-a)*t }
          BEGIN{
            # Hue anchors (deg): 0=red, 30=orange, 60=yellow, 120=green
            if (p <= 33) {
              h = lerp(0,   30,  p/33.0)
            } else if (p <= 66) {
              h = lerp(30,  60, (p-33.0)/33.0)
            } else if (p < 100) {
              h = lerp(60, 120, (p-66.0)/34.0)
            } else {
              h = 120
            }
            s = 1.0
            l = 0.42    # constant lightness for smoothness/contrast
            print hsl2hex(h,s,l)
          }')
        echo "Computed color $HEX for ${PCT}%"

        # --- 3) Variable width calculation (approx text widths) ---
        LABEL="coverage"

        # crude width table (px) for Verdana/DejaVu Sans at 11px; good enough for badges
        calc_width() {
          local s="$1"
          awk -v s="$s" '
            BEGIN{
              # baseline
              for(i=0;i<=9;i++) w[sprintf("%d",i)]=7
              w["%"]=8; w["."]=3; w["-"]=5; w["_"]=7; w[" "]=4
              lower="abcdefghijklmnopqrstuvwxyz"
              for(i=1;i<=length(lower);i++) w[substr(lower,i,1)]=7
              upper="ABCDEFGHIJKLMNOPQRSTUVWXYZ"
              for(i=1;i<=length(upper);i++) w[substr(upper,i,1)]=8
              total=0
              for(i=1;i<=length(s);i++){
                ch=substr(s,i,1)
                if (ch in w) total+=w[ch]; else total+=7
              }
              print total
            }'
        }

        # paddings for each side
        PAD_L=6
        PAD_R=6

        LW=$(calc_width "$LABEL")
        RW=$(calc_width "$VALUE")

        LEFT_W=$((LW + PAD_L + PAD_R))
        RIGHT_W=$((RW + PAD_L + PAD_R))
        WIDTH=$((LEFT_W + RIGHT_W))

        LABEL_X=$(( LEFT_W / 2 ))
        LABEL_X_SHADOW=$(( LABEL_X + 1 ))
        VALUE_X=$(( LEFT_W + RIGHT_W / 2 ))
        VALUE_X_SHADOW=$(( VALUE_X + 1 ))

        # --- 4) Emit SVG ---
        SVG="$(cat <<EOF
        <svg xmlns="http://www.w3.org/2000/svg" width="${WIDTH}" height="20" role="img" aria-label="${LABEL}: ${VALUE}">
          <linearGradient id="s" x2="0" y2="100%">
            <stop offset="0" stop-opacity=".1" stop-color="#EEE"/>
            <stop offset="1" stop-opacity=".1"/>
          </linearGradient>
          <mask id="m"><rect width="${WIDTH}" height="20" rx="3" fill="#fff"/></mask>
          <g mask="url(#m)">
            <rect width="${LEFT_W}" height="20" fill="#555"/>
            <rect x="${LEFT_W}" width="${RIGHT_W}" height="20" fill="${HEX}"/>
            <rect width="${WIDTH}" height="20" fill="url(#s)"/>
          </g>
          <g fill="#fff" text-anchor="middle" font-family="Verdana,DejaVu Sans,sans-serif" font-size="11">
            <text x="${LABEL_X_SHADOW}" y="15" fill="#000" opacity="0.25">${LABEL}</text>
            <text x="${LABEL_X}" y="14">${LABEL}</text>
            <text x="${VALUE_X_SHADOW}" y="15" fill="#000" opacity="0.25">${VALUE}</text>
            <text x="${VALUE_X}" y="14">${VALUE}</text>
          </g>
        </svg>
        EOF
        )"

        echo "$SVG" > "${WORKTREE_DIR}/${BRANCH}/badge.svg"

    - name: Copy optional report.html
      if: ${{ inputs.report != '' }}
      env:
        BRANCH: ${{ steps.branch.outputs.branch }}
        INPUT_REPORT: ${{ inputs.report }}
      shell: bash
      run: |
        set -euo pipefail
        to_posix_path() {
          local p="$1"
          # Convert Windows absolute paths when possible.
          if [[ "$p" =~ ^[A-Za-z]:[\\/].* || "$p" =~ ^\\\\.* ]]; then
            if command -v cygpath >/dev/null 2>&1; then
              cygpath -u "$p"
              return 0
            fi
          fi
          # Keep relative paths relative but normalize separators.
          printf '%s\n' "${p//\\//}"
        }
        SRC="$(to_posix_path "$INPUT_REPORT")"
        if [[ ! -f "$SRC" ]]; then
          echo "Report file not found at: $SRC" >&2
          exit 1
        fi
        cp -f "$SRC" "${WORKTREE_DIR}/${BRANCH}/report.html"

    - name: Remove report.html when report input is omitted
      if: ${{ inputs.report == '' }}
      env:
        BRANCH: ${{ steps.branch.outputs.branch }}
      shell: bash
      run: |
        set -euo pipefail
        rm -f "${WORKTREE_DIR}/${BRANCH}/report.html"

    - name: Commit & push changes to coverage branch
      env:
        BRANCH: ${{ steps.branch.outputs.branch }}
      shell: bash
      run: |
        set -euo pipefail
        pushd "$WORKTREE_DIR" >/dev/null
          git config --local user.email "action@github.com"
          git config --local user.name  "GitHub Action"
          # Stage generated branch content (including deletions) without pathspec errors
          # when report.html has never existed.
          git add -A -- "${BRANCH}"
          # Only proceed when this step actually staged changes for the target path.
          if ! git diff --cached --quiet -- "${BRANCH}"; then
            git -c commit.gpgsign=false commit -m "update"

            max_attempts=5
            attempt=1
            while true; do
              WORKTREE_HEAD="$(git rev-parse HEAD)"
              if git -C "$GITCOVERAGE_REPO_ROOT" push origin "${WORKTREE_HEAD}:refs/heads/coverage"; then
                break
              fi

              if (( attempt >= max_attempts )); then
                echo "Failed to push coverage branch after ${max_attempts} attempts." >&2
                exit 1
              fi

              echo "Push rejected (attempt ${attempt}/${max_attempts}). Rebasing onto latest origin/coverage..."
              git -C "$GITCOVERAGE_REPO_ROOT" fetch origin +refs/heads/coverage:refs/remotes/origin/coverage
              # Prefer this run's regenerated files if both runs touched the same paths.
              if ! git rebase -X theirs refs/remotes/origin/coverage; then
                git rebase --abort || true
                echo "Automatic rebase failed due to conflicts in coverage branch updates." >&2
                exit 1
              fi
              attempt=$(( attempt + 1 ))
            done
          else
            echo "No changes to commit."
          fi
        popd >/dev/null

    - name: Summary
      env:
        BRANCH: ${{ steps.branch.outputs.branch }}
      shell: bash
      run: |
        set -euo pipefail
        echo "Published:"
        echo " - ${BRANCH}/badge.svg"
        if [[ -f "${WORKTREE_DIR}/${BRANCH}/report.html" ]]; then
          echo " - ${BRANCH}/report.html"
        fi

    - name: Cleanup worktree
      if: ${{ always() }}
      shell: bash
      run: |
        set -euo pipefail
        if [[ -n "${WORKTREE_DIR:-}" ]]; then
          git worktree remove --force "$WORKTREE_DIR" >/dev/null 2>&1 || true
          rm -rf -- "$WORKTREE_DIR" || true
        fi
        git worktree prune || true