v1.1.1 — delegates riskratchet v0.3.7

Delegates to riskratchet@v0.3.7.

The floating v1 tag has been moved here, so uses: KayhanB21/riskratchet-action@v1 now runs 0.3.7.

The usage workflow in this repo's README was wrong, and is fixed here. It pasted a checkout
step and the action with coverage: coverage.json — and nothing in between that writes
coverage.json. A path you name must exist, so that workflow was exit 2 for anyone who copied it.
The snippet now installs the project and runs pytest --cov first, and the coverage input
description no longer claims auto-coverage covers you when the input is absent: auto-coverage shells
out to pytest, which is not on the PATH of the uv tool install environment the action creates.

No new inputs. All eleven are unchanged and still pure passthrough.

What you get from 0.3.7

Say what you know. Scoped from an audit rather than the backlog, and the heaviest finding was the
one above — the documented workflow could not work as pasted, and when it failed the Action hid the
reason: the setup error raised before the CLI rendered, so the comment body was empty, gh rejected
it 422, set -e killed the job, and the step that would have printed ::error::riskratchet exited 2
never ran. What the adopter saw was a gh: Validation Failed traceback.

Also in this release: baselines now record what scored them and warn on a mismatch at all three
doors; the nine JSON schemas ship in the wheel and sdist and every $schema/$id resolves; churn
scoring zero in a nested config directory is no longer silent, and doctor no longer vouches for it;
an OSError from git no longer exits 1; and every setting config can turn on now has a flag that
turns it back off.

No score moves anywhere in 0.3.7, and nothing is renamed or removed — a green gate stays green.

Full notes: https://github.com/KayhanB21/riskratchet/releases/tag/v0.3.7

v1.1.0 — TypeScript passthrough; delegates riskratchet v0.3.6

Delegates to riskratchet@v0.3.6.

Minor, not patch: this release adds three wrapper inputs. typescript, ts-coverage, and
ts-entry are now passed through to the root action, so a repo whose [tool.riskratchet] sets
typescript = true gates its TypeScript through @v1 too:

- uses: KayhanB21/riskratchet-action@v1
  with:
    typescript: 'true'
    ts-coverage: coverage/lcov.info

The floating v1 tag was moved here when this was cut.

What you get from 0.3.6

TypeScript through every door. The backend has scored TypeScript since 0.2.12, but the
officially shipped CI path could not use it: typescript was not a config key, the Action had no
way to pass --typescript, and its install step never installed the [typescript] extra. 0.3.6
makes the switch a config key, teaches every entrance to honour it, and makes check say what it
did not check.

Config-driven TypeScript needs the wrapper at v1.1.0 or later and riskratchet 0.3.6+.

Full notes: https://github.com/KayhanB21/riskratchet/releases/tag/v0.3.6

v1.0.12 — delegates riskratchet v0.3.5

Delegates to riskratchet@v0.3.5.

The floating v1 tag was moved here when this was cut, so uses: KayhanB21/riskratchet-action@v1
ran 0.3.5 from this release until the next one.

What you get from 0.3.5

The gate has more than one door. 0.3.3 and 0.3.4 hardened the main check path; 0.3.5
closes the same class of failure at the other entrances — the coverage inputs, the pytest plugin,
explain, init --with-baseline, the TypeScript backend, and the report emitters.

The one that matters most in CI: a typo'd coverage: path fell through to auto-coverage and gated
against a file riskratchet generated itself, turning a real exit-1 regression into a green 0 — while
doctor called the same setup FAIL.

Full notes: https://github.com/KayhanB21/riskratchet/releases/tag/v0.3.5

v1.0.11 — delegates riskratchet v0.3.4

Delegates to riskratchet@v0.3.4.

The floating v1 tag was moved here when this was cut, so uses: KayhanB21/riskratchet-action@v1
ran 0.3.4 from this release until the next one.

What you get from 0.3.4

A gate that checks nothing now says so. check reported "No risk regressions detected" and
exited 0 whenever the scan produced zero functions. A nonexistent scan path was already exit 2;
an existing path matching nothing was not — so a typo'd paths, a src/ → lib/ restructure, an
over-broad exclude, or allow patterns that swallowed everything switched the ratchet off and
passed green forever. Same class of silent disengagement 0.3.3 fixed for the baseline file, one
layer out in the config and the scan inputs.

Full notes: https://github.com/KayhanB21/riskratchet/releases/tag/v0.3.4

v1.0.10 — delegates riskratchet v0.3.3

Delegates to riskratchet@v0.3.3.

The floating v1 tag has been moved here, so uses: KayhanB21/riskratchet-action@v1 now runs 0.3.3.

What you get from 0.3.3

An unreadable baseline is no longer a silent pass. If your .riskratchet.json was corrupt,
truncated, or written by a newer riskratchet, it used to load as zero entries — and an empty
baseline passes every gate. Your Action reported "No risk regressions detected" and exited 0 while
ratcheting nothing. That is now a hard error (exit 2) with a remediation command, and a baseline from
a newer riskratchet tells you to upgrade rather than to regenerate.

Individually malformed entries still let the run continue, but now warn with a count instead of
vanishing silently.

Also: riskratchet fixed a 7.6-point error in how it measured its own test coverage. That one is
internal — it has no effect on your repository's scores.

Full notes: https://github.com/KayhanB21/riskratchet/blob/master/CHANGELOG.md

v1.0.9 — delegate to riskratchet v0.3.2

Delegates to KayhanB21/riskratchet@v0.3.2 —
"the adopter's first hour". The floating v1 tag now points here.

This upgrade matters if you use the Action. 0.3.2 fixes two defects that hit adopters directly:

• The Action could fail on first adoption. With no baseline yet it runs
  check --fail-above --format pr-comment, which emitted every function above the threshold with no
  cap. Past GitHub's 65,536-character comment limit the upsert step got a 422 and failed the job
  instead of posting a report. The comment is now collapsed and hard-capped.
• Churn was silently scoring zero. The quickstart snippet used a bare actions/checkout, which
  defaults to a depth-1 clone — git log --since then sees only HEAD, so CI disagreed with a
  locally-generated baseline with no error anywhere. The README snippet now sets fetch-depth: 0;
  add it to your workflow if you copied the old one.

Note: the delegated ref had drifted — it sat at v0.3.0 through the whole 0.3.1 cycle, so anyone
on floating v1 was running 0.3.0. Fixed here.

v1.0.8 — delegate to riskratchet v0.3.0

Bumps the delegated KayhanB21/riskratchet ref to v0.3.0, the first breaking minor (sprawl scoring recalibration + first-class scored TypeScript). Wrapper inputs are unchanged (passthrough-only). Floating v1 now points here.

v1.0.7 — delegate to riskratchet v0.2.16

Bumps the delegated ref to KayhanB21/riskratchet@v0.2.16 (LCOV coverage support for the TypeScript backend).

@v1 and @v1.0.7 both resolve to riskratchet 0.2.16. No input or behavior changes — this is a passthrough wrapper; the delegated ref is the only release-time change.

v1.0.6 — delegate to riskratchet v0.2.15

Bumps the composite delegation to KayhanB21/riskratchet@v0.2.15, which brings TypeScript slices 4–5 (cyclomatic complexity, barrel-aware public surface, and native JSON/SARIF output with token-stable identity groundwork). TypeScript remains informational-only and opt-in; the Python path is unchanged.

This wrapper stays a thin passthrough — action.yml in the main repo is the single source of truth for inputs and behavior.

Usage

on: [pull_request]

jobs:
  riskratchet:
    runs-on: ubuntu-latest
    permissions:
      contents: read
      pull-requests: write
    steps:
      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683  # v4.2.2
      - uses: KayhanB21/riskratchet-action@v1
        with:
          coverage: coverage.json

See the main repository for the full inputs table.

---

v1.0.3–v1.0.5 were tag-only delegation bumps (v0.2.12 → v0.2.14) with no formal release; this release resumes cutting Release notes. The floating v1 tag now points here.

v1.0.2 — action.yml manifest fix

Initial Marketplace release of riskratchet-action — a maintainability ratchet for AI-assisted Python.

This is a thin composite-action wrapper that delegates to KayhanB21/riskratchet@v0.2.8 with input passthrough. Both shapes share action.yml as their source of truth.

Usage

on: [pull_request]

jobs:
  riskratchet:
    runs-on: ubuntu-latest
    permissions:
    permissions:
      contents: read
      pull-requests: write
    steps:
      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683  # v4.2.2
      - uses: KayhanB21/riskratchet-action@v1
        with:
          coverage: coverage.json

See the main repository (https://github.com/KayhanB21/riskratchet#github-action) for the full inputs table.

Fixes in this release

- inputs.github-token.default no longer carries the ${{ github.token }} expression literal — composite manifests do not evaluate the github context inside input defaults. Default is now empty; the fallback applies at the passthrough site (callers who omit the input still get github.token automatically).
- Same literal removed from the description: prose, which also gets evaluated.

v1.0.0 and v1.0.1 are left in place as historical record but will fail to load — pin to @v1, @v1.0.2, or later.