coverage 7.13.4__tar.gz → 7.14.0__tar.gz

{coverage-7.13.4 → coverage-7.14.0}/.github/workflows/codeql-analysis.yml

@@ -20,7 +20,7 @@ on:
     branches:
       - main
   schedule:
-    - cron: '30 20 * * 6'
+    - cron: "30 20 * * 6"
 
 permissions:
   contents: read
@@ -31,7 +31,7 @@ concurrency:
 
 jobs:
   analyze:
-    name: Analyze
+    name: "Analyze"
     runs-on: ubuntu-latest
     permissions:
       actions: read           # CodeQL wrote this action.
@@ -48,14 +48,14 @@ jobs:
         # Learn more about CodeQL language support at https://git.io/codeql-language-support
 
     steps:
-      - name: Checkout repository
+      - name: "Check out the repo"
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         with:
           persist-credentials: false
 
       # Initializes the CodeQL tools for scanning.
       - name: Initialize CodeQL
-        uses: github/codeql-action/init@5d4e8d1aca955e8d8589aabd499c5cae939e33c7 # v4.31.9
+        uses: github/codeql-action/init@95e58e9a2cdfd71adc6e0353d5c52f41a045d225 # v4.35.2
         with:
           languages: ${{ matrix.language }}
           # If you wish to specify custom queries, you can do so here or in a config file.
@@ -66,7 +66,7 @@ jobs:
       # Autobuild attempts to build any compiled languages  (C/C++, C#, or Java).
       # If this step fails, then you should remove it and run the build manually (see below)
       - name: Autobuild
-        uses: github/codeql-action/autobuild@5d4e8d1aca955e8d8589aabd499c5cae939e33c7 # v4.31.9
+        uses: github/codeql-action/autobuild@95e58e9a2cdfd71adc6e0353d5c52f41a045d225 # v4.35.2
 
       # ℹ️ Command-line programs to run using the OS shell.
       # 📚 https://git.io/JvXDl
@@ -80,4 +80,4 @@ jobs:
       #   make release
 
       - name: Perform CodeQL Analysis
-        uses: github/codeql-action/analyze@5d4e8d1aca955e8d8589aabd499c5cae939e33c7 # v4.31.9
+        uses: github/codeql-action/analyze@95e58e9a2cdfd71adc6e0353d5c52f41a045d225 # v4.35.2

{coverage-7.13.4 → coverage-7.14.0}/.github/workflows/coverage.yml

@@ -45,7 +45,7 @@ jobs:
           persist-credentials: false
 
       - name: "Examine changed files"
-        uses: dorny/paths-filter@de90cc6fb38fc0963ad72b210f1f284cd68cea36 # v3.0.2
+        uses: dorny/paths-filter@fbd0ab8f3e69293af611ebaee6363fc25e6d187d # v4.0.1
         id: filter
         with:
           filters: |
@@ -110,6 +110,9 @@ jobs:
           # skip them for now.
           - os: windows
             python-version: "pypy-3.10"
+          # Windows 3.13t often fails during installation.
+          - os: windows
+            python-version: "3.13t"
         # If we need to tweak the os version we can do it with an include like
         # this:
         #  include:
@@ -140,7 +143,7 @@ jobs:
       - name: "Show environment"
         run: |
           set -xe
-          echo matrix id: $MATRIX_ID
+          echo matrix id: "$MATRIX_ID"
           python -VV
           python -m site
           env | sort
@@ -163,10 +166,10 @@ jobs:
           COVERAGE_RCFILE: "metacov.ini"
         run: |
           python -m coverage combine
-          mv .metacov .metacov.$MATRIX_ID
+          mv .metacov ".metacov.$MATRIX_ID"
 
       - name: "Upload coverage data"
-        uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6.0.0
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
         with:
           name: metacov-${{ env.MATRIX_ID }}
           path: .metacov.*
@@ -211,7 +214,7 @@ jobs:
           python igor.py zip_mods
 
       - name: "Download coverage data"
-        uses: actions/download-artifact@37930b1c2abaa49bbe596cd826c3c89aef350131 # v7.0.0
+        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
         with:
           pattern: metacov-*
           merge-multiple: true
@@ -224,17 +227,8 @@ jobs:
           set -xe
           python igor.py combine_html
 
-      - name: "Check targets"
-        run: |
-          # Maybe someday goals will be a real feature
-          python -m pip install wcmatch
-          # Very crude check that nothing catastrophic has happened.
-          python lab/goals.py --group 90 "coverage/*.py" "tests/*.py"
-          # Absolutely all of our test code should be covered.
-          python lab/goals.py --file 100 "tests/test_*.py"
-
       - name: "Upload HTML report"
-        uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6.0.0
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
         with:
           name: html_report
           path: htmlcov
@@ -243,20 +237,32 @@ jobs:
       - name: "Show text report"
         run: |
           set -xe
-          echo "## Coverage: $(python -m coverage report --format=total)%" >> $GITHUB_STEP_SUMMARY
-          echo '```' >> $GITHUB_STEP_SUMMARY
-          python -m coverage report --skip-covered >> $GITHUB_STEP_SUMMARY
-          echo '```' >> $GITHUB_STEP_SUMMARY
+          echo "## Coverage: $(python -m coverage report --format=total)%" >> "$GITHUB_STEP_SUMMARY"
+          echo '```' >> "$GITHUB_STEP_SUMMARY"
+          python -m coverage report --skip-covered >> "$GITHUB_STEP_SUMMARY"
+          echo '```' >> "$GITHUB_STEP_SUMMARY"
 
       - name: "Get total"
         id: total
         run: |
-          echo "total=$(python -m coverage report --format=total)" >> $GITHUB_OUTPUT
+          echo "total=$(python -m coverage report --format=total)" >> "$GITHUB_OUTPUT"
+
+      - name: "Check targets"
+        run: |
+          # Maybe someday goals will be a real feature
+          python -m pip install wcmatch
+          # Very crude check that nothing catastrophic has happened.
+          python lab/goals.py --group 90 "coverage/*.py" "tests/*.py"
+          # Absolutely all of our test code should be covered.
+          python lab/goals.py --file 100 "tests/test_*.py"
 
   publish:
     name: "Publish coverage report"
     needs: combine
     runs-on: ubuntu-latest
+    environment:
+      name: "publish report"
+      deployment: false
 
     steps:
       - name: "Show environment"
@@ -270,21 +276,24 @@ jobs:
           REF: ${{ github.ref }}
           SHA: ${{ github.sha }}
         run: |
-          export SHA10=$(echo $SHA | cut -c 1-10)
-          export SLUG=$(date +'%Y%m%d')_$SHA10
-          echo "sha10=$SHA10" >> $GITHUB_ENV
-          echo "slug=$SLUG" >> $GITHUB_ENV
-          echo "report_dir=reports/$SLUG/htmlcov" >> $GITHUB_ENV
-          echo "url=https://coveragepy.github.io/metacov-reports/reports/$SLUG/htmlcov" >> $GITHUB_ENV
-          echo "branch=${REF#refs/heads/}" >> $GITHUB_ENV
+          SHA10=$(echo "$SHA" | cut -c 1-10)
+          export SHA10
+          SLUG=$(date +'%Y%m%d')_$SHA10
+          export SLUG
+          echo "sha10=$SHA10" >> "$GITHUB_ENV"
+          echo "slug=$SLUG" >> "$GITHUB_ENV"
+          echo "report_dir=reports/$SLUG/htmlcov" >> "$GITHUB_ENV"
+          echo "url=https://coveragepy.github.io/metacov-reports/reports/$SLUG/htmlcov" >> "$GITHUB_ENV"
+          echo "branch=${REF#refs/heads/}" >> "$GITHUB_ENV"
 
       - name: "Checkout reports repo"
         if: ${{ github.ref == 'refs/heads/main' }}
         env:
+          # Fine-grained, with write access to coveragepy/metacov-reports
           TOKEN: ${{ secrets.COVERAGE_REPORTS_TOKEN }}
         run: |
           set -xe
-          git clone --depth=1 --no-checkout https://${TOKEN}@github.com/coveragepy/metacov-reports reports_repo
+          git clone --depth=1 --no-checkout "https://$TOKEN@github.com/coveragepy/metacov-reports" reports_repo
           cd reports_repo
           git sparse-checkout init --cone
           git sparse-checkout set --skip-checks '/*' '!/reports'
@@ -294,7 +303,7 @@ jobs:
 
       - name: "Download coverage HTML report"
         if: ${{ github.ref == 'refs/heads/main' }}
-        uses: actions/download-artifact@37930b1c2abaa49bbe596cd826c3c89aef350131 # v7.0.0
+        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
         with:
           name: html_report
           path: reports_repo/${{ env.report_dir }}
@@ -319,20 +328,21 @@ jobs:
           echo "${sha10}: ${branch}" >> commit.txt
           # Commit.
           cd ./reports_repo
-          git sparse-checkout set --skip-checks '/*' ${report_dir}
-          rm ${report_dir}/.gitignore
-          git add ${report_dir} latest.html
+          git sparse-checkout set --skip-checks '/*' "$report_dir"
+          rm "$report_dir/.gitignore"
+          git add "$report_dir" latest.html
           git commit --file=../commit.txt
           git push
-          echo "[${url}](${url})" >> $GITHUB_STEP_SUMMARY
+          echo "[${url}](${url})" >> "$GITHUB_STEP_SUMMARY"
 
       - name: "Create badge"
         if: |
           github.repository_owner == 'coveragepy'
           && github.ref == 'refs/heads/main'
         # https://gist.githubusercontent.com/nedbat/8c6980f77988a327348f9b02bbaf67f5
-        uses: schneegans/dynamic-badges-action@e9a478b16159b4d31420099ba146cdc50f134483 # v1.7.0
+        uses: schneegans/dynamic-badges-action@0e50b8bad39e7e1afd3e4e9c2b7dd145fad07501 # v1.8.0
         with:
+          # Personal access token: gist access
           auth: ${{ secrets.METACOV_GIST_SECRET }}
           gistID: 8c6980f77988a327348f9b02bbaf67f5
           filename: metacov.json

{coverage-7.13.4 → coverage-7.14.0}/.github/workflows/dependency-review.yml

@@ -5,7 +5,8 @@
 # Source repository: https://github.com/actions/dependency-review-action
 # Public documentation: https://docs.github.com/en/code-security/supply-chain-security/understanding-your-software-supply-chain/about-dependency-review#dependency-review-enforcement
 
-name: 'Dependency Review'
+name: "Dependency Review"
+
 on:
   push:
     branches:
@@ -27,13 +28,13 @@ jobs:
     if: github.repository_owner == 'coveragepy'
     runs-on: ubuntu-latest
     steps:
-      - name: 'Checkout Repository'
+      - name: "Check out the repo"
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         with:
           persist-credentials: false
 
-      - name: 'Dependency Review'
-        uses: actions/dependency-review-action@3c4e3dcb1aa7874d2c16be7d79418e9b7efd6261 # v4.8.2
+      - name: "Dependency Review"
+        uses: actions/dependency-review-action@2031cfc080254a8a887f58cffee85186f0e49e48 # v4.9.0
         with:
           base-ref: ${{ github.event.pull_request.base.sha || 'main' }}
           head-ref: ${{ github.event.pull_request.head.sha || github.ref }}

{coverage-7.13.4 → coverage-7.14.0}/.github/workflows/kit.yml

@@ -68,9 +68,6 @@ jobs:
           # [[[cog
           #   #----- vvv Choices for the matrix vvv -----
           #
-          #   # Operating systems:
-          #   oss = ["ubuntu", "macos", "windows"]
-          #
           #   # For each OS, what arch to use with cibuildwheel:
           #   os_archs = {
           #       "ubuntu": ["x86_64", "i686", "aarch64", "riscv64", "ppc64le"],
@@ -94,8 +91,8 @@ jobs:
           #   #----- ^^^ ---------------------- ^^^ -----
           #
           #   import json
-          #   for the_os in oss:
-          #       for the_arch in os_archs[the_os]:
+          #   for the_os, archs in os_archs.items():
+          #       for the_arch in archs:
           #           for the_py in os_arch_pys.get((the_os, the_arch), pys):
           #               them = {
           #                   "os": the_os,
@@ -179,8 +176,8 @@ jobs:
         with:
           persist-credentials: false
 
-      - if: ${{ matrix.arch != 'ppc64le' }}
-        name: "Install Python"
+      - name: "Install Python"
+        if: ${{ matrix.arch != 'ppc64le' }}
         uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
         with:
           python-version: "${{ matrix.cipy }}"
@@ -190,8 +187,8 @@ jobs:
       # Rust toolchain is not currently installed on windows arm64 images.
       # We need it for nh3, needed by readme-renderer, needed by twine.
       # https://github.com/actions/partner-runner-images/issues/77
-      - if: ${{ matrix.os-version == '11-arm' }}
-        name: Setup rust
+      - name: "Setup Rust"
+        if: ${{ matrix.os-version == '11-arm' }}
         id: setup-rust
         shell: pwsh
         run: |
@@ -205,7 +202,7 @@ jobs:
 
       - name: "Set up QEMU"
         if: ${{ matrix.arch == 'riscv64' }}
-        uses: docker/setup-qemu-action@c7c53464625b32c7a7e944ae62b3e17d2b600130 # v3.7.0
+        uses: docker/setup-qemu-action@ce360397dd3f832beb865e1373c09c0e9f86d70a # v4.0.0
 
       - name: "Build binary wheels"
         env:
@@ -226,7 +223,7 @@ jobs:
           python -m twine check wheelhouse/*
 
       - name: "Upload binary wheels"
-        uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6.0.0
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
         with:
           name: dist-${{ env.MATRIX_ID }}
           path: wheelhouse/*.whl
@@ -267,7 +264,7 @@ jobs:
           python -m twine check dist/*
 
       - name: "Upload non-binary artifacts"
-        uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6.0.0
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
         with:
           name: dist-non-binary
           path: dist/*
@@ -285,7 +282,7 @@ jobs:
       id-token: write   # Needed for signing artifacts
     steps:
       - name: "Download artifacts"
-        uses: actions/download-artifact@37930b1c2abaa49bbe596cd826c3c89aef350131 # v7.0.0
+        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
         with:
           pattern: dist-*
           merge-multiple: true
@@ -294,11 +291,11 @@ jobs:
         run: |
           ls -alR
           echo "Number of dists, there should be $EXPECTED:"
-          ls -1 coverage-* | wc -l
-          files=$(ls coverage-* 2>/dev/null | wc -l) && [ "$files" -eq $EXPECTED ] || exit 1
+          find coverage-* | wc -l
+          files=$(find coverage-* 2>/dev/null | wc -l) && [ "$files" -eq "$EXPECTED" ] || exit 1
 
       - name: "Sign artifacts"
-        uses: sigstore/gh-action-sigstore-python@a5caf349bc536fbef3668a10ed7f5cd309a4b53d # v3.2.0
+        uses: sigstore/gh-action-sigstore-python@04cffa1d795717b140764e8b640de88853c92acc # v3.3.0
         with:
           inputs: coverage-*.*
 
@@ -307,7 +304,7 @@ jobs:
           ls -alR
 
       - name: "Upload signatures"
-        uses: actions/upload-artifact@b7c566a772e6b6bfb58ed0dc250532a479d7789f # v6.0.0
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
         with:
           name: signatures
           path: "*.sigstore.json"

{coverage-7.13.4 → coverage-7.14.0}/.github/workflows/publish.yml

@@ -29,26 +29,30 @@ concurrency:
 jobs:
   find-run:
     name: "Find latest kit.yml run"
-    runs-on: "ubuntu-latest"
+    runs-on: ubuntu-latest
     outputs:
       run-id: ${{ steps.run-id.outputs.run-id }}
 
     steps:
       - name: "Find latest kit.yml run"
         id: runs
-        uses: octokit/request-action@dad4362715b7fb2ddedf9772c8670824af564f0d # v2.4.0
+        uses: octokit/request-action@b91aabaa861c777dcdb14e2387e30eddf04619ae # v3.0.0
         with:
           route: GET /repos/coveragepy/coveragepy/actions/workflows/kit.yml/runs
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
 
-      - name: "Record run id" # zizmor: ignore[template-injection]
+      - name: "Record run id"
         id: run-id
+        env:
+          RUN_STATUS: ${{ fromJson(steps.runs.outputs.data).workflow_runs[0].status }}
+          RUN_CONCLUSION: ${{ fromJson(steps.runs.outputs.data).workflow_runs[0].conclusion }}
+          RUN_ID: ${{ fromJson(steps.runs.outputs.data).workflow_runs[0].id }}
         run: |
           # There must be a shorter way to write this...
-          [ "${{ fromJson(steps.runs.outputs.data).workflow_runs[0].status}}" = "completed" ] || exit 1
-          [ "${{ fromJson(steps.runs.outputs.data).workflow_runs[0].conclusion}}" = "success" ] || exit 1
-          echo "run-id=${{ fromJson(steps.runs.outputs.data).workflow_runs[0].id }}" >> "$GITHUB_OUTPUT"
+          [ "$RUN_STATUS" = "completed" ] || exit 1
+          [ "$RUN_CONCLUSION" = "success" ] || exit 1
+          echo "run-id=$RUN_ID" >> "$GITHUB_OUTPUT"
 
   publish-to-test-pypi:
     name: "Publish to Test PyPI"
@@ -56,15 +60,16 @@ jobs:
     permissions:
       id-token: write       # needed for actions/attest-build-provenance
       attestations: write   # needed for actions/attest-build-provenance
-    runs-on: "ubuntu-latest"
+    runs-on: ubuntu-latest
     environment:
       name: "testpypi"
+      deployment: false
     needs:
       - find-run
 
     steps:
       - name: "Download dists"
-        uses: actions/download-artifact@37930b1c2abaa49bbe596cd826c3c89aef350131 # v7.0.0
+        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
         with:
           repository: "coveragepy/coveragepy"
           run-id: ${{ needs.find-run.outputs.run-id }}
@@ -77,16 +82,16 @@ jobs:
         run: |
           ls -alR
           echo "Number of dists, should be $EXPECTED:"
-          ls -1 dist | wc -l
-          files=$(ls dist 2>/dev/null | wc -l) && [ "$files" -eq $EXPECTED ] || exit 1
+          find dist/* | wc -l
+          files=$(find dist/* 2>/dev/null | wc -l) && [ "$files" -eq "$EXPECTED" ] || exit 1
 
       - name: "Generate attestations"
-        uses: actions/attest-build-provenance@96278af6caaf10aea03fd8d33a09a777ca52d62f # v3.2.0
+        uses: actions/attest-build-provenance@a2bbfa25375fe432b6a289bc6b6cd05ecd0c4c32 # v4.1.0
         with:
           subject-path: "dist/*"
 
       - name: "Publish dists to Test PyPI"
-        uses: pypa/gh-action-pypi-publish@ed0c53931b1dc9bd32cbe73a98c7f6766f8a527e # v1.13.0
+        uses: pypa/gh-action-pypi-publish@cef221092ed1bacb1cc03d23a2d87d1d172e277b # v1.14.0
         with:
           repository-url: https://test.pypi.org/legacy/
 
@@ -96,15 +101,16 @@ jobs:
     permissions:
       id-token: write       # needed for actions/attest-build-provenance
       attestations: write   # needed for actions/attest-build-provenance
-    runs-on: "ubuntu-latest"
+    runs-on: ubuntu-latest
     environment:
       name: "pypi"
+      deployment: false
     needs:
       - find-run
 
     steps:
       - name: "Download dists"
-        uses: actions/download-artifact@37930b1c2abaa49bbe596cd826c3c89aef350131 # v7.0.0
+        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
         with:
           repository: "coveragepy/coveragepy"
           run-id: ${{ needs.find-run.outputs.run-id }}
@@ -117,13 +123,13 @@ jobs:
         run: |
           ls -alR
           echo "Number of dists, should be $EXPECTED:"
-          ls -1 dist | wc -l
-          files=$(ls dist 2>/dev/null | wc -l) && [ "$files" -eq $EXPECTED ] || exit 1
+          find dist/* | wc -l
+          files=$(find dist/* 2>/dev/null | wc -l) && [ "$files" -eq "$EXPECTED" ] || exit 1
 
       - name: "Generate attestations"
-        uses: actions/attest-build-provenance@96278af6caaf10aea03fd8d33a09a777ca52d62f # v3.2.0
+        uses: actions/attest-build-provenance@a2bbfa25375fe432b6a289bc6b6cd05ecd0c4c32 # v4.1.0
         with:
           subject-path: "dist/*"
 
       - name: "Publish dists to PyPI"
-        uses: pypa/gh-action-pypi-publish@ed0c53931b1dc9bd32cbe73a98c7f6766f8a527e # v1.13.0
+        uses: pypa/gh-action-pypi-publish@cef221092ed1bacb1cc03d23a2d87d1d172e277b # v1.14.0

{coverage-7.13.4 → coverage-7.14.0}/.github/workflows/python-nightly.yml

@@ -79,9 +79,9 @@ jobs:
           set -xe
           export PYENV_ROOT="$HOME/.pyenv"
           export PATH="$PYENV_ROOT/bin:$PATH"
-          echo "$PYENV_ROOT/shims:$PYENV_ROOT/bin" >> $GITHUB_PATH
-          pyenv install $PYVER -v
-          pyenv global $PYVER
+          echo "$PYENV_ROOT/shims:$PYENV_ROOT/bin" >> "$GITHUB_PATH"
+          pyenv install "$PYVER" -v
+          pyenv global "$PYVER"
 
       - name: "Show diagnostic info"
         run: |

{coverage-7.13.4 → coverage-7.14.0}/.github/workflows/quality.yml

@@ -43,7 +43,7 @@ jobs:
           persist-credentials: false
 
       - name: "Examine changed files"
-        uses: dorny/paths-filter@de90cc6fb38fc0963ad72b210f1f284cd68cea36 # v3.0.2
+        uses: dorny/paths-filter@fbd0ab8f3e69293af611ebaee6363fc25e6d187d # v4.0.1
         id: filter
         with:
           filters: |
@@ -146,7 +146,7 @@ jobs:
       - name: "Install Python"
         uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
         with:
-          python-version: "3.11" # Doc version from PYVERSIONS
+          python-version: "3.12" # Doc version from PYVERSIONS
           cache: pip
           cache-dependency-path: 'requirements/*.pip'
 
@@ -178,17 +178,17 @@ jobs:
       || needs.changed.outputs.workflow == 'true'
 
     steps:
-      - name: Checkout repository
+      - name: "Check out the repo"
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         with:
           persist-credentials: false
 
-      - name: Install the latest version of uv
-        uses: astral-sh/setup-uv@61cb8a9741eeb8a550a1b8544337180c0fc8476b #v7.2.0
+      - name: "Install uv"
+        uses: astral-sh/setup-uv@08807647e7069bb48b6ef5acd8ec9567f424441b # v8.1.0
         with:
           enable-cache: false
 
-      - name: Run zizmor
+      - name: "Run zizmor"
         env:
           GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
         run: uvx zizmor --pedantic .github/workflows

{coverage-7.13.4 → coverage-7.14.0}/.github/workflows/testsuite.yml

@@ -43,7 +43,7 @@ jobs:
           persist-credentials: false
 
       - name: "Examine changed files"
-        uses: dorny/paths-filter@de90cc6fb38fc0963ad72b210f1f284cd68cea36 # v3.0.2
+        uses: dorny/paths-filter@fbd0ab8f3e69293af611ebaee6363fc25e6d187d # v4.0.1
         id: filter
         with:
           filters: |
@@ -98,6 +98,11 @@ jobs:
           - "3.15t"
           - "pypy-3.10"
           - "pypy-3.11"
+        exclude:
+          # Windows 3.13t often fails during installation.
+          - os: windows
+            python-version: "3.13t"
+
         #
         # If we need to exclude any combinations, do it like this:
         #  exclude:
@@ -142,8 +147,8 @@ jobs:
           # Ideally, the system Python wouldn't have writable sitepackages so
           # try to make it not writable.  We can't always always change the
           # permissions (Ubuntu & Windows yes, Mac no), so be ready for it to fail.
-          chmod u-w $(python -c "import site; print(site.getsitepackages()[0])") || echo "Couldn't lock down site-packages"
-          ls -ld $(python -c "import site; print(site.getsitepackages()[0])")
+          chmod u-w "$(python -c "import site; print(site.getsitepackages()[0])")" || echo "Couldn't lock down site-packages"
+          ls -ld "$(python -c "import site; print(site.getsitepackages()[0])")"
           whoami
 
       - name: "Install dependencies"
@@ -165,12 +170,12 @@ jobs:
   # https://github.com/marketplace/actions/alls-green#why
   # https://github.com/orgs/community/discussions/33579
   success:
-    name: Tests successful
+    name: "Tests successful"
     needs:
       - tests
     runs-on: ubuntu-latest
     steps:
-      - name: Decide whether the needed jobs succeeded or failed
+      - name: "Decide success or failure"
         uses: re-actors/alls-green@05ac9388f0aebcb5727afa17fcccfecd6f8ec5fe # v1.2.2
         with:
           jobs: ${{ toJSON(needs) }}

{coverage-7.13.4 → coverage-7.14.0}/.pre-commit-config.yaml

@@ -16,7 +16,7 @@ repos:
         exclude: "stress_phystoken|\\.py,cover$"
 
   - repo: https://github.com/astral-sh/ruff-pre-commit
-    rev: v0.14.14
+    rev: v0.15.12
     hooks:
       - id: ruff-format
 

{coverage-7.13.4 → coverage-7.14.0}/.readthedocs.yaml

@@ -10,7 +10,7 @@ build:
   os: ubuntu-22.04
   tools:
     # PYVERSIONS: the version we use for building docs. Check tox.ini[doc] also.
-    python: "3.11"
+    python: "3.12"
 
 sphinx:
   builder: html

{coverage-7.13.4 → coverage-7.14.0}/CHANGES.rst

@@ -22,6 +22,65 @@ upgrading your version of coverage.py.
 
 .. start-releases
 
+.. _changes_7-14-0:
+
+Version 7.14.0 — 2026-05-10
+---------------------------
+
+- Feature: now when running one of the reporting commands, if there are
+  parallel data files that need combining, they will be implicitly combined
+  before creating the report. There is no option to avoid the combination; let
+  us know if you have a use case that requires it.  Thanks, `Tim Hatch
+  <pull 2162_>`_. Closes `issue 1781`_.
+
+- Fix: the output from ``combine`` was too verbose, listing each file
+  considered. Now it shows a single line with the counts of files combined,
+  files skipped, and files with errors. The ``-q`` flag suppresses this line.
+  The old detailed lines are available with the new ``--debug=combine`` option.
+
+- Fix: running a Python file through a symlink now sets the sys.path correctly,
+  matching regular Python behavior. Fixes `issue 2157`_.
+
+- Fix: ``Collector.flush_data`` could fail with "RuntimeError: Set changed
+  size during iteration" when a tracer in another thread added a line to the
+  per-file set that ``add_lines`` (or ``add_arcs``) was iterating. The values
+  passed to ``CoverageData`` are now snapshotted via ``dict.copy()`` and
+  ``set.copy()``, which are atomic under the GIL. Thanks, `Alex Vandiver <pull
+  2165_>`_.
+
+- Fix: the soft keyword ``lazy`` is now bolded in HTML reports.
+
+- We are no longer testing eventlet support. Eventlet started issuing stern
+  deprecation warnings that break our tests. Our support code is still there.
+
+.. _issue 1781: https://github.com/coveragepy/coveragepy/issues/1781
+.. _issue 2157: https://github.com/coveragepy/coveragepy/issues/2157
+.. _pull 2162: https://github.com/coveragepy/coveragepy/pull/2162
+.. _pull 2165: https://github.com/coveragepy/coveragepy/pull/2165
+
+
+.. _changes_7-13-5:
+
+Version 7.13.5 — 2026-03-17
+---------------------------
+
+- Fix: `issue 2138`_ describes a memory leak that happened when repeatedly
+  using the Coverage API with in-memory data. This is now fixed.
+
+- Fix: the markdown-formatted coverage report didn't fully escape special
+  characters in file paths (`issue 2141`_). This would be very unlikely to
+  cause a problem, but now it's done properly, thanks to `Ellie Ayla
+  <pull 2142_>`_.
+
+- Fix: the C extension wouldn't build on VS2019, but now it does (`issue
+  2145`_).
+
+.. _issue 2138: https://github.com/coveragepy/coveragepy/issues/2138
+.. _issue 2141: https://github.com/coveragepy/coveragepy/issues/2141
+.. _pull 2142: https://github.com/coveragepy/coveragepy/pull/2142
+.. _issue 2145: https://github.com/coveragepy/coveragepy/issues/2145
+
+
 .. _changes_7-13-4:
 
 Version 7.13.4 — 2026-02-09
@@ -232,7 +291,7 @@ Version 7.11.1 — 2025-11-07
 
 - Fix: some chanages to details of how the measurement core is chosen, and how
   conflicting settings are handled. The "sysmon" core cannot be used with some
-  conurrency settings, with dynamic context, and in Python 3.12/3.13, with
+  concurrency settings, with dynamic context, and in Python 3.12/3.13, with
   branch measurement.
 
   - If the core is not specified and defaults to "sysmon" (Python 3.14+), but