Delegates to riskratchet@v0.3.7.
The floating v1 tag has been moved here, so uses: KayhanB21/riskratchet-action@v1 now runs 0.3.7.
The usage workflow in this repo's README was wrong, and is fixed here. It pasted a checkout
step and the action with coverage: coverage.json — and nothing in between that writes
coverage.json. A path you name must exist, so that workflow was exit 2 for anyone who copied it.
The snippet now installs the project and runs pytest --cov first, and the coverage input
description no longer claims auto-coverage covers you when the input is absent: auto-coverage shells
out to pytest, which is not on the PATH of the uv tool install environment the action creates.
No new inputs. All eleven are unchanged and still pure passthrough.
What you get from 0.3.7
Say what you know. Scoped from an audit rather than the backlog, and the heaviest finding was the
one above — the documented workflow could not work as pasted, and when it failed the Action hid the
reason: the setup error raised before the CLI rendered, so the comment body was empty, gh rejected
it 422, set -e killed the job, and the step that would have printed ::error::riskratchet exited 2
never ran. What the adopter saw was a gh: Validation Failed traceback.
Also in this release: baselines now record what scored them and warn on a mismatch at all three
doors; the nine JSON schemas ship in the wheel and sdist and every $schema/$id resolves; churn
scoring zero in a nested config directory is no longer silent, and doctor no longer vouches for it;
an OSError from git no longer exits 1; and every setting config can turn on now has a flag that
turns it back off.
No score moves anywhere in 0.3.7, and nothing is renamed or removed — a green gate stays green.
Full notes: https://github.com/KayhanB21/riskratchet/releases/tag/v0.3.7