[anurag-stepsecurity]

py-cov-action/python-coverage-comment-action@v4.3...v4.5

[anurag-stepsecurity]

📦 Target Release Version: v4.5
📋 Previous Release Version: v4.3

[github-actions]

🔍 Cherry-Pick Verification Report

📦 Upstream Changes: v4.3...v4.5

📋 File-by-File Analysis:

.github/renovate.json5

• Upstream has changes: ✅ Yes
• File exists in PR: ❌ No
• Status: 🔴 Missing - File missing in PR (upstream has 1 additions, 1 deletions)

.github/workflows/autofix.yml

• Upstream has changes: ✅ Yes
• File exists in PR: ❌ No
• Status: 🔴 Missing - File missing in PR (upstream has 1 additions, 1 deletions)

.github/workflows/ci.yml

• Upstream has changes: ✅ Yes
• File exists in PR: ❌ No
• Status: 🔴 Missing - ❌ No PR patch available (+7 -7)

.github/workflows/e2e-external-phase-2.yml

• Upstream has changes: ✅ Yes
• File exists in PR: ❌ No
• Status: 🔴 Missing - File missing in PR (upstream has 1 additions, 1 deletions)

.pre-commit-config.yaml

• Upstream has changes: ✅ Yes
• File exists in PR: ❌ No
• Status: 🔴 Missing - File missing in PR (upstream has 0 additions, 1 deletions)

coverage_comment/files.py

• Upstream has changes: ✅ Yes
• File exists in PR: ✅ Yes
• Changes match: ✅ Yes
• Status: 🟢 Perfect - ✅ All changes applied correctly (+21 -7)

coverage_comment/main.py

• Upstream has changes: ✅ Yes
• File exists in PR: ✅ Yes
• Changes match: ✅ Yes
• Status: 🟢 Perfect - ✅ All changes applied correctly (+2 -1)

coverage_comment/template_files/comment.md.j2

• Upstream has changes: ✅ Yes
• File exists in PR: ✅ Yes
• Changes match: ✅ Yes
• Status: 🟢 Perfect - ✅ All changes applied correctly (+2 -2)

tests/end_to_end/test_all.py

• Upstream has changes: ✅ Yes
• File exists in PR: ✅ Yes
• Changes match: ✅ Yes
• Status: 🟢 Perfect - ✅ All changes applied correctly (+10 -2)

tests/unit/test_files.py

• Upstream has changes: ✅ Yes
• File exists in PR: ✅ Yes
• Changes match: ✅ Yes
• Status: 🟢 Perfect - ✅ All changes applied correctly (+61 -2)

tests/unit/test_template.py

• Upstream has changes: ✅ Yes
• File exists in PR: ✅ Yes
• Changes match: ✅ Yes
• Status: 🟢 Perfect - ✅ All changes applied correctly (+31 -6)

---

📊 Summary:

• Total files changed upstream: 11
• Files present in PR: 6/11
• Files with matching changes: 6/11

❌ Overall Status: 🔴 INCOMPLETE - Missing files or changes

[anurag-stepsecurity]

Sync verification

Warning

1 item needs review: 1 conflict resolved by hand.

Upstream	Versions	Files	dist/ reproducible	config.json
py-cov-action/python-coverage-comment-action	v4.3 → v4.5 · compare	9	-	✅

Review these

• ✋ uv.lock: conflict resolved by hand, check it against upstream's change

✅ 3 files: exactly upstream's version

• coverage_comment/files.py
• tests/end_to_end/test_all.py
• tests/unit/test_files.py

✅ 3 files: upstream's changes alongside StepSecurity's

• coverage_comment/main.py
• coverage_comment/template_files/comment.md.j2
• tests/unit/test_template.py

✅ 1 file: StepSecurity-specific changes only

• action.yml

✅ 1 file: checked field by field

• config.json

✋ 1 file: conflicts resolved by hand

• uv.lock

✅ config.json checks

Check	Result
config.json is valid	✅
upstream.repository	✅
upstream.synced_tag is an upstream release	✅
upstream.synced_commit matches the tag	✅
upstream.synced_tag is the newest release	✅
upstream.archived	✅
onboarding_type	✅
action_type	✅

✅ Integrity checks

Check	Result
every action's type is supported	✅
docker actions run our image, pinned by digest	✅
the subscription check is still there	✅
our workflows are unchanged	✅
removed upstream files stay removed	✅
files upstream deleted are gone	✅
no workflow gains write permissions	✅
the PR description is the upstream compare link	✅

[github-actions]

PR Review

Action Type

Docker-based action — uses runs: docker in action.yml pointing to ghcr.io/step-security/python-coverage-comment-action.

---

Passed Checks

• License: Present with copyright for both the original author (Joachim Jablon) and StepSecurity.
• action.yml author field: author: step-security is correctly added by this PR.
• SECURITY.md: Present with contact email security@stepsecurity.io.
• FUNDING.yml: Not present.
• Workflows: Both .github/workflows/auto_cherry_pick.yml and .github/workflows/actions_release.yml are present.
• renovate.json: Not present.
• PULL_REQUEST.md: Not present.
• ISSUE_TEMPLATE folder: Not present.
• CHANGELOG.md: Not present.
• .vscode folder: Not present.
• README version tags: All usage examples correctly use the major version tag @v4 (no full semver tags in examples).
• README banner: StepSecurity Maintained Action banner is present at the top of the README.
• Subscription check URL: Correctly calls https://agent.api.stepsecurity.io/v1/github/$GITHUB_REPOSITORY/actions/maintained-actions-subscription.
• Upstream variable: upstream = "py-cov-action/python-coverage-comment-action" in main.py correctly matches original-owner: "py-cov-action" and repo-name: "python-coverage-comment-action" from auto_cherry_pick.yml.
• Docker image org: Image is published to the step-security org on GHCR (ghcr.io/step-security/python-coverage-comment-action).

---

Failed Checks

• Docker image not tagged with major version: action.yml line 177 uses the full semver tag v4.3.0 instead of the required major version tag v4. The image reference should be docker://ghcr.io/step-security/python-coverage-comment-action:v4@sha256:<digest>.
• Docker image version stale vs synced upstream: This PR syncs upstream changes through v4.5 but action.yml still references the v4.3.0 Docker image. A new Docker image must be built, published to GHCR, and the image: field in action.yml updated to reflect the new version.

---

Warnings

• assert used for runtime type validation (coverage_comment/files.py line 124): assert isinstance(stored_rate, int | float) is silently disabled when Python runs with the -O optimize flag. Replace with an explicit if ... raise TypeError(...) check to ensure malformed datafiles always produce a clear error. See inline comment for a suggested fix.

---

Security Findings

No critical security vulnerabilities found. Token handling uses env vars (not command-line args), the subscription check is correctly scoped, and no hardcoded credentials or injection sinks were identified in the changed files.

Minor: the assert type check noted above could mask unexpected input if Python is invoked with -O, though the risk is low in a controlled Docker container environment.

---

Summary

The PR correctly syncs upstream logic improvements (float precision fix for coverage rate comparison, Unicode arrow in badges, --allow-escape-sequences for gh api calls) and adds thorough test coverage. The two blocking issues are: the Docker image in action.yml was not updated to match the synced v4.5 upstream tag, and the image is tagged with a full semver (v4.3.0) rather than the required major version tag (v4).

[github-actions]

Coverage report

Click to see where and how coverage changed

File	Statements	Missing	Coverage	Coverage (new stmts)	Lines missing
coverage_comment
files.py
main.py
Project Total

This report was generated by python-coverage-comment-action