From c8981e5aec9d675aea5a507d4d912e535d08ee55 Mon Sep 17 00:00:00 2001
From: Leynos <leynos@troubledskies.net>
Date: Tue, 29 Jul 2025 16:53:45 +0100
Subject: [PATCH 1/2] fix ratchet step ordering in generate-coverage action

---
 .../actions/generate-coverage/CHANGELOG.md    |  4 ++
 .github/actions/generate-coverage/action.yml  | 53 ++++++++++---------
 2 files changed, 31 insertions(+), 26 deletions(-)

diff --git a/.github/actions/generate-coverage/CHANGELOG.md b/.github/actions/generate-coverage/CHANGELOG.md
index 1f021636..934f5ad0 100644
--- a/.github/actions/generate-coverage/CHANGELOG.md
+++ b/.github/actions/generate-coverage/CHANGELOG.md
@@ -1,5 +1,9 @@
 # Changelog
 
+## v1.3.5
+
+- Fix ratchet step ordering so coverage is checked after Python results are available.
+
 ## v1.3.4
 
 - Force reinstall of `cargo-llvm-cov` so cached binaries don't cause the
diff --git a/.github/actions/generate-coverage/action.yml b/.github/actions/generate-coverage/action.yml
index d8cbccc6..17c023f1 100644
--- a/.github/actions/generate-coverage/action.yml
+++ b/.github/actions/generate-coverage/action.yml
@@ -94,32 +94,6 @@ runs:
         INPUT_FEATURES: ${{ inputs.features }}
         INPUT_WITH_DEFAULT_FEATURES: ${{ inputs.with-default-features }}
       shell: bash
-    - name: Ratchet coverage
-      if: inputs.with-ratchet == 'true'
-      run: |
-        ratchet() {
-          uv run --script "${{ github.action_path }}/scripts/ratchet_coverage.py" \
-            --baseline-file "$1" \
-            --current "$2"
-        }
-
-        lang="${{ steps.detect.outputs.lang }}"
-        if [[ "$lang" == "rust" || "$lang" == "mixed" ]]; then
-          ratchet "${{ inputs.baseline-rust-file }}" "${{ steps.rust.outputs.percent }}"
-        fi
-        if [[ "$lang" == "python" || "$lang" == "mixed" ]]; then
-          ratchet "${{ inputs.baseline-python-file }}" "${{ steps.python.outputs.percent }}"
-        fi
-      shell: bash
-    - name: Save baselines
-      if: success() && inputs.with-ratchet == 'true'
-      uses: actions/cache@v4
-      with:
-        path: |
-          ${{ inputs.baseline-rust-file }}
-          ${{ inputs.baseline-python-file }}
-        key: ratchet-baseline-${{ runner.os }}-${{ github.run_id }}
-        restore-keys: ratchet-baseline-${{ runner.os }}-
 
     - name: Cache Python deps
       if: steps.detect.outputs.lang == 'python' || steps.detect.outputs.lang == 'mixed'
@@ -150,6 +124,33 @@ runs:
         PYTHON_FILE: ${{ steps.python.outputs.file }}
         OUTPUT_PATH: ${{ inputs.output-path }}
       shell: bash
+    - name: Ratchet coverage
+      if: inputs.with-ratchet == 'true'
+      run: |
+        ratchet() {
+          uv run --script "${{ github.action_path }}/scripts/ratchet_coverage.py" \
+            --baseline-file "$1" \
+            --current "$2"
+        }
+
+        lang="${{ steps.detect.outputs.lang }}"
+        if [[ "$lang" == "rust" || "$lang" == "mixed" ]]; then
+          ratchet "${{ inputs.baseline-rust-file }}" "${{ steps.rust.outputs.percent }}"
+        fi
+        if [[ "$lang" == "python" || "$lang" == "mixed" ]]; then
+          ratchet "${{ inputs.baseline-python-file }}" "${{ steps.python.outputs.percent }}"
+        fi
+      shell: bash
+    - name: Save baselines
+      if: success() && inputs.with-ratchet == 'true'
+      uses: actions/cache@v4
+      with:
+        path: |
+          ${{ inputs.baseline-rust-file }}
+          ${{ inputs.baseline-python-file }}
+        key: ratchet-baseline-${{ runner.os }}-${{ github.run_id }}
+        restore-keys: ratchet-baseline-${{ runner.os }}-
+
     - id: out
       run: uv run --script "${{ github.action_path }}/scripts/set_outputs.py"
       env:

From 965053cae27b933042ff9439d0c7980baf20320c Mon Sep 17 00:00:00 2001
From: Leynos <leynos@troubledskies.net>
Date: Wed, 30 Jul 2025 00:40:20 +0100
Subject: [PATCH 2/2] fix cache handling and script safety

---
 .github/actions/generate-coverage/action.yml | 10 ++++++----
 1 file changed, 6 insertions(+), 4 deletions(-)

diff --git a/.github/actions/generate-coverage/action.yml b/.github/actions/generate-coverage/action.yml
index 17c023f1..e33ffddf 100644
--- a/.github/actions/generate-coverage/action.yml
+++ b/.github/actions/generate-coverage/action.yml
@@ -49,13 +49,15 @@ runs:
         INPUT_FORMAT: ${{ inputs.format }}
       shell: bash
     - name: Restore baselines
+      id: restore-baselines
       if: inputs.with-ratchet == 'true'
       uses: actions/cache@v4
       with:
         path: |
           ${{ inputs.baseline-rust-file }}
           ${{ inputs.baseline-python-file }}
-        key: ratchet-baseline-${{ runner.os }}
+        key: ratchet-baseline-${{ runner.os }}-${{ github.run_id }}
+        restore-keys: ratchet-baseline-${{ runner.os }}-
     - name: Ensure baseline files
       if: inputs.with-ratchet == 'true'
       run: |
@@ -127,6 +129,7 @@ runs:
     - name: Ratchet coverage
       if: inputs.with-ratchet == 'true'
       run: |
+        set -euo pipefail
         ratchet() {
           uv run --script "${{ github.action_path }}/scripts/ratchet_coverage.py" \
             --baseline-file "$1" \
@@ -142,14 +145,13 @@ runs:
         fi
       shell: bash
     - name: Save baselines
-      if: success() && inputs.with-ratchet == 'true'
+      if: success() && inputs.with-ratchet == 'true' && steps.restore-baselines.outputs.cache-hit != 'true'
       uses: actions/cache@v4
       with:
         path: |
           ${{ inputs.baseline-rust-file }}
           ${{ inputs.baseline-python-file }}
-        key: ratchet-baseline-${{ runner.os }}-${{ github.run_id }}
-        restore-keys: ratchet-baseline-${{ runner.os }}-
+        key: ratchet-baseline-${{ runner.os }}
 
     - id: out
       run: uv run --script "${{ github.action_path }}/scripts/set_outputs.py"