check-code-coverage - npm Package Compare versions

Comparing version 1.9.0 to 1.9.1

bin/set-gh-status.js

@@ -127,3 +127,5 @@ #!/usr/bin/env node
   repository: process.env.GITHUB_REPOSITORY,
-  sha: process.env.GITHUB_SHA
+  // allow overriding the commit SHA, useful in pull requests
+  // where we want a merged commit SHA from GH event
+  sha: process.env.GH_SHA || process.env.GITHUB_SHA
 }
@@ -130,0 +132,0 @@ setGitHubCommitStatus(options, envOptions).catch(e => {

package.json

 {
   "name": "check-code-coverage",
-  "version": "1.9.0",
+  "version": "1.9.1",
   "description": "Utilities for checking the coverage produced by NYC against extra or missing files",
@@ -5,0 +5,0 @@ "main": "src/index.js",

README.md

@@ -112,2 +112,14 @@ # check-code-coverage [![ci status][ci image]][ci url] ![check-code-coverage](https://img.shields.io/badge/code--coverage-100%25-brightgreen)
 
+### Pull requests
+
+When setting a status on a GitHub pull request, you need to use SHA of the merged commit. You can pass it as `GH_SHA` environment variable.
+
+```yaml
+- name: Ensure coverage has not dropped 📈
+  run: npx set-gh-status --check-against-readme
+  env:
+    GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+    GH_SHA: ${{ github.event.after }}
+```
+
 ## Debug
@@ -114,0 +126,0 @@

New alerts

Environment variable access

Supply chain risk

Package accesses environment variables, which may be a sign of credential stuffing or data theft.

Found 1 instance in 1 package

Improved metrics

Total package byte prevSize

19031

2.66%

Lines of code

406

0.5%

Number of lines in readme file

130

10.17%

Worsened metrics

Number of low supply chain risk alerts

11

10%

No dependency changes