The One That Got Away

Fix: Baseline retrieval pages back through default-branch runs

The action found the baseline by inspecting only the single most recent successful default-branch run for the lcov-baseline artifact. But a successful run doesn't guarantee a baseline — the coverage job is often conditional (path filters, matrix skips, flaky reruns), so the latest run can complete without one while an older run still holds a perfectly valid baseline.

When that happened, the action silently fell back to summary-only mode: ratcheting wasn't enforced (passed=true hardcoded) and no PR comparison comment was posted. Coverage could regress behind a green check, intermittently, depending only on what the most recent default-branch commit happened to touch.

Retrieval now pages back through recent successful default-branch runs (newest first) and uses the first that still holds a non-expired lcov-baseline[-<label>] artifact, only falling back to summary-only mode when none of the inspected runs has one. Pagination follows the Link: rel="next" header (per_page=100, 50-page cap). (#15)

Also

• Hardened the per-run artifact query so a transient failure (or malformed response) for one run skips that run and keeps paging, instead of aborting the whole search.
• mktemp calls now use a ${TMPDIR:-/tmp}/… template, matching the rest of the codebase (portable; the previous bare mktemp -d ignored $TMPDIR on macOS).

No workflow changes needed. Existing setups pick up the fix automatically.