TheKevJames / coveralls-python / 35343766197

97%

push

github

refactor(ci): merge test/build into ci.yml and isolate PyPI OIDC to publish job

Consolidate the lint, test, and release workflows into a single ci.yml so
linting and the full test matrix gate every release.

Split the former single publish job into separate build and publish jobs
following the principle of least privilege: build produces the distribution
artifact with no elevated permissions, and publish holds id-token: write while
only downloading the artifact and invoking gh-action-pypi-publish. The OIDC
token is no longer exposed to the runtime of untrusted transitive build
dependencies.

Closes #605

178 of 186 branches covered (95.7%)

Branch coverage included in aggregate %.

636 of 657 relevant lines covered (96.8%)

4.83 hits per line