From 69c5785d4805c1b9f4f1f0f3696f34d0614c23a3 Mon Sep 17 00:00:00 2001
From: Shane da Silva <shane@dasilva.io>
Date: Tue, 10 Nov 2026 21:57:54 -0800
Subject: [PATCH 1/2] Enable SimpleCov branch coverage

---
 README.md                    |  2 +-
 spec/coverage_config.rb      |  2 ++
 spec/coverage_config_spec.rb | 59 ++++++++++++++++++++++++++++++++++++
 3 files changed, 62 insertions(+), 1 deletion(-)
 create mode 100644 spec/coverage_config_spec.rb

diff --git a/README.md b/README.md
index c23e5acf..5b040651 100644
--- a/README.md
+++ b/README.md
@@ -6,7 +6,7 @@
   <p>
     <a href="https://badge.fury.io/rb/overcommit"><img alt="Gem version" src="https://badge.fury.io/rb/overcommit.svg" /></a>
     <a href="https://github.com/sds/overcommit/actions/workflows/tests.yml/badge.svg?branch=main"><img alt="Build status" src="https://github.com/sds/overcommit/actions/workflows/tests.yml/badge.svg?branch=main" /></a>
-    <a href="https://github.com/sds/overcommit/actions/workflows/tests.yml/badge.svg?branch=main"><img alt="Build status" src="https://coveralls.io/repos/github/sds/overcommit/badge.svg?branch=main" /></a>
+    <a href="https://coveralls.io/github/sds/overcommit?branch=main"><img alt="Coverage status" src="https://coveralls.io/repos/github/sds/overcommit/badge.svg?branch=main" /></a>
     <a href="http://inch-ci.org/github/sds/overcommit"><img alt="Build status" src="https://inch-ci.org/github/sds/overcommit.svg?branch=main" /></a>
   </p>
 </div>
diff --git a/spec/coverage_config.rb b/spec/coverage_config.rb
index 2ecea20f..bfe0bef7 100644
--- a/spec/coverage_config.rb
+++ b/spec/coverage_config.rb
@@ -3,6 +3,8 @@
 require 'simplecov'
 
 SimpleCov.configure do
+  enable_coverage :branch
+
   add_filter 'bin/'
   add_filter 'libexec/'
   add_filter 'spec/'
diff --git a/spec/coverage_config_spec.rb b/spec/coverage_config_spec.rb
new file mode 100644
index 00000000..4c0c21a1
--- /dev/null
+++ b/spec/coverage_config_spec.rb
@@ -0,0 +1,59 @@
+# frozen_string_literal: true
+
+require 'spec_helper'
+require 'json'
+
+describe 'coverage configuration' do
+  let(:config) { File.expand_path('coverage_config.rb', __dir__) }
+  let(:worker) do
+    <<~RUBY
+      SimpleCov.start do
+        coverage_dir ARGV.fetch(0)
+        command_name ARGV.fetch(0)
+        formatter SimpleCov::Formatter::MultiFormatter.new([])
+      end
+      require './decision'
+      decision(ARGV.fetch(1) == 'yes')
+    RUBY
+  end
+
+  def run_coverage(code, *args)
+    result = shell([Gem.ruby, '-r', config, '-e', code] + args)
+    expect(result.status).to eq(0), result.stderr
+  end
+
+  before do
+    @ci = ENV['CI']
+  end
+
+  after do
+    ENV['CI'] = @ci
+  end
+
+  it 'records covered and uncovered branches alongside lines locally' do
+    ENV.delete('CI')
+    directory do
+      File.write('decision.rb', "def decision(value)\n  value ? :yes : :no\nend\n")
+      run_coverage(worker, 'worker', 'yes')
+
+      report = JSON.parse(File.read('worker/.resultset.json')).fetch('worker').fetch('coverage')
+      coverage = report.fetch(File.expand_path('decision.rb'))
+      expect(coverage.fetch('lines')).to eq([1, 1, nil])
+      expect(coverage.fetch('branches').values.first.values.sort).to eq([0, 1])
+    end
+  end
+
+  it 'preserves branch hits when collating worker reports for CI uploads' do
+    ENV['CI'] = 'true'
+    directory do
+      File.write('decision.rb', "def decision(value)\n  value ? :yes : :no\nend\n")
+      run_coverage(worker, 'worker-yes', 'yes')
+      run_coverage(worker, 'worker-no', 'no')
+      run_coverage("SimpleCov.collate(Dir['worker-*/.resultset.json'])")
+
+      report = File.read('coverage/lcov.info')
+      expect(report).to include("SF:./decision.rb\n", "DA:2,2\n", "BRF:2\n", "BRH:2\n")
+      expect(report.scan(/^BRDA:\d+,\d+,\d+,1$/).size).to eq(2)
+    end
+  end
+end

From 57790421170d15664588465e65ffe45e5426e761 Mon Sep 17 00:00:00 2001
From: Shane da Silva <shane@dasilva.io>
Date: Tue, 10 Nov 2026 22:00:31 -0800
Subject: [PATCH 2/2] Pin CI actions to satisfy repository policy

---
 .github/workflows/tests.yml | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/.github/workflows/tests.yml b/.github/workflows/tests.yml
index 1b78237c..272e1dd1 100644
--- a/.github/workflows/tests.yml
+++ b/.github/workflows/tests.yml
@@ -48,7 +48,7 @@ jobs:
           key: dependency-lock-v1-${{ runner.os }}-ruby${{ matrix.ruby-version }}-${{ steps.dependency-cache-date.outputs.date }}-${{ hashFiles('Gemfile', '*.gemspec', 'lib/overcommit/version.rb') }}
 
       - name: Set up Ruby ${{ matrix.ruby-version }}
-        uses: ruby/setup-ruby@v1
+        uses: ruby/setup-ruby@b3aaceaef7e0ee231b499e7b5f49c03fc1d32199  # v1
         with:
           ruby-version: ${{ matrix.ruby-version }}
           bundler-cache: true
@@ -86,7 +86,7 @@ jobs:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
 
       - name: Set up Ruby
-        uses: ruby/setup-ruby@v1
+        uses: ruby/setup-ruby@b3aaceaef7e0ee231b499e7b5f49c03fc1d32199  # v1
         with:
           ruby-version: 3.3
           bundler-cache: true
@@ -128,7 +128,7 @@ jobs:
       # Shard assignments shift when examples are added. Compare the complete
       # suite's coverage rather than unrelated fractions from individual shards.
       - name: Report combined code coverage
-        uses: coverallsapp/github-action@v2
+        uses: coverallsapp/github-action@8d6379e14d29928660c4ba802d8e85393440b329  # v2
         with:
           github-token: ${{ secrets.github_token }}
           files: coverage/*/lcov.info