fix(detail): ensure workingDirectory is taken into account

.github/dependabot.yml

@@ -0,0 +1,13 @@
+version: 2
+updates:
+  - package-ecosystem: "github-actions"
+    directory: "/"
+    schedule:
+      interval: "monthly"
+      day: "saturday"
+
+  - package-ecosystem: "npm"
+    directory: "/"
+    schedule:
+      interval: "weekly"
+      day: "saturday"

.github/workflows/ci.yml

@@ -0,0 +1,51 @@
+name: CI
+
+on:
+  pull_request:
+    branches:
+      - main
+
+jobs:
+  security_hardening:
+    name: Check security hardening
+    runs-on: ubuntu-latest
+    steps:
+    - name: Clone the repository
+      uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683
+    - name: Ensure SHA pinned actions
+      uses: zgosalvez/github-actions-ensure-sha-pinned-actions@ed00f72a3ca5b6eff8ad4d3ffdcacedb67a21db1
+
+  build_test:
+    name: Build & Test
+    needs: security_hardening
+    runs-on: ubuntu-latest
+    steps:
+    - name: Clone the repository
+      uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683
+      with:
+        ref: ${{ github.head_ref }} # https://github.com/stefanzweifel/git-auto-commit-action#checkout-the-correct-branch
+    - name: Get runs.using version
+      id: get-runs-using-version
+      uses: zgosalvez/github-actions-get-action-runs-using-version@49044afc8bfe8dfccd7840b828a7cc4019f08717
+    - name: Set up Node
+      uses: actions/setup-node@39370e3970a6d050c480ffad4ff0ed4d3fdee5af
+      with:
+        node-version: v${{ steps.get-runs-using-version.outputs.version }}
+    - name: Cache Node Packages
+      id: node-cache
+      uses: actions/cache@6849a6489940f00c2f30c0fb92c6274307ccb58a
+      with:
+        path: ~/.npm
+        key: node-cache-${{ steps.get-runs-using-version.outputs.prop }}-${{ hashFiles('**/package-lock.json') }}
+        restore-keys: |
+          node-cache-${{ steps.get-runs-using-version.outputs.prop }}-
+          node-cache-
+    - name: Get Node packages
+      run: npm ci
+    - name: Run linter tool
+      run: npm run lint
+    - name: Prepare
+      run: npm run prepare
+    - uses: stefanzweifel/git-auto-commit-action@8621497c8c39c72f3e2a999a26b4ca1b5058a842
+      with:
+        commit_message: Apply `npm run prepare` changes

.github/workflows/version.yml

@@ -0,0 +1,13 @@
+name: Update Major Version Tag
+
+on:
+  push:
+    tags:
+      - "v*"
+
+jobs:
+  update-majorver:
+    name: Update Major Version Tag
+    runs-on: ubuntu-latest
+    steps:
+      - uses: nowactions/update-majorver@f2014bbbba95b635e990ce512c5653bd0f4753fb

README.md

@@ -5,6 +5,8 @@ This GitHub Action (written in JavaScript) allows you to leverage GitHub Actions
 - Commenting on a pull request (if the workflow was triggered by this event)
 - Failing if a minimum coverage is not met
 
+Based on the code from [zgosalvez/github-actions-report-lcov](https://github.com/zgosalvez/github-actions-report-lcov).
+
 ## Usage
 ### Pre-requisites
 Create a workflow `.yml` file in your `.github/workflows` directory. An [example workflow](#common-workflow) is available below. For more information, reference the GitHub Help Documentation for [Creating a workflow file](https://help.github.com/en/articles/configuring-a-workflow#creating-a-workflow-file).
@@ -13,13 +15,16 @@ Create a workflow `.yml` file in your `.github/workflows` directory. An [example
 For more information on these inputs, see the [Workflow syntax for GitHub Actions](https://docs.github.com/actions/reference/workflow-syntax-for-github-actions#jobsjob_idstepswith)
 
 - `coverage-files`: The coverage files to scan. For example, `coverage/lcov.*.info`
-- `artifact-name`: The GitHub artifact name of the generated HTML report. For example, `code-coverage-report`. _Note:_ When downloading, it will be extracted in an `html` directory
+- `artifact-name`: The GitHub artifact name of the generated HTML report. For example, `code-coverage-report`. _Note:_ When downloading, it will be extracted in an `html` directory. Optional. Default: `` (Skips uploading of artifacts)
 - `minimum-coverage`: The minimum coverage to pass the check. Optional. Default: `0` (always passes)
 - `github-token`: Set the `${{ secrets.GITHUB_TOKEN }}` token to have the action comment the coverage summary in the pull request. This token is provided by Actions, you do not need to create your own token. Optional. Default: ``
 - `working-directory`: The working directory containing the source files referenced in the LCOV files. Optional. Default: `./`
+- `title-prefix`: A prefix before the title "LCOV of commit...". Optional. Default: ``
+- `additional-message`: Custom text appended to the code coverage comment in the pull request. Optional. Default: ``
+- `update-comment`: Set to `true` to update the previous code coverage comment if such exists. When set to `false`, a new comment is always created. Optional. Default: `false`
 
 ### Outputs
-None.
+- `total-coverage`: The total coverage from scanned files.
 
 Sample comment:
 ![Screenshot](assets/comment.png)
@@ -40,19 +45,25 @@ jobs:
     - name: Checkout code
       uses: actions/checkout@v2
     # ... Generate LCOV files or download it from a different job
+    - name: Setup LCOV
+      uses: hrishikesh-kadam/setup-lcov@v1
     - name: Report code coverage
-      uses: zgosalvez/github-actions-report-lcov@v1
+      uses: mbta/github-actions-report-lcov@v4
       with:
         coverage-files: coverage/lcov.*.info
         minimum-coverage: 90
         artifact-name: code-coverage-report
         github-token: ${{ secrets.GITHUB_TOKEN }}
         working-directory: apps/my-first-app
+        update-comment: true
 ```
+*Note:* Only the following events are supported:
 
-### Flutter Workflows
+- `pull_request`
+- `pull_request_target`
+- `workflow_run` (when triggered by a PR)
 
-This is used in my opinionated [GitHub Actions: Flutter Workflows](https://github.com/zgosalvez/github-actions-flutter-workflows) repository along with other actions for a complete end-to-end DevOps experience.
+This action does nothing when triggered by other event types.
 
 ## License
-The scripts and documentation in this project are released under the [MIT License](LICENSE)
+The scripts and documentation in this project are released under the [MIT License](LICENSE.md)

SECURITY.md

@@ -0,0 +1,14 @@
+# Security Policy
+
+## Supported Versions
+
+The following versions of the project are currently being supported with security updates.
+
+| Version | Supported          |
+| ------- | ------------------ |
+| 4.0.x   | :white_check_mark: |
+| < 4     | :x:                |
+
+## Reporting a Vulnerability
+
+Please file an issue.

action.yml

@@ -8,19 +8,32 @@ inputs:
     description: 'The coverage files to scan. For example, `coverage/lcov.*.info`'
     required: true
   artifact-name:
-    description: 'The GitHub artifact name of the generated HTML report. For example, `code-coverage-report`. _Note:_ When downloading, it will be extracted in an `html` directory'
-    required: true
+    description: 'The GitHub artifact name of the generated HTML report. For example, `code-coverage-report`. _Note:_ When downloading, it will be extracted in an `html` directory. Optional. Default: `` (Skips uploading of artifacts)'
   minimum-coverage:
     description: 'The minimum coverage to pass the check. Optional. Default: `0` (always passes)'
     default: 0
   github-token:
     description: 'Set the GitHub token to have the action comment the coverage summary in the pull request. This token is provided by Actions, you do not need to create your own token. Optional. Default: ``'
   working-directory:
     description: 'The working directory containing the source files referenced in the LCOV files. Optional. Default: `./`'
+  title-prefix:
+    description: 'A prefix before the title "LCOV of commit...". Optional. Default: ``'
+    required: false
+  additional-message:
+    description: 'Custom text appended to the code coverage comment in the pull request. Optional. Default: ``'
+    required: false
+  update-comment:
+    description: 'Set to `true` to update the previous code coverage comment if such exists. When set to `false`, a new comment is always created. Optional. Default: `false`'
+    required: false
+    default: "false"
+outputs:
+  total-coverage:
+      description: 'The total coverage from scanned files.'
+
 runs:
-  using: 'node12'
+  using: 'node20'
   main: 'dist/main/index.js'
   post: 'dist/post/index.js'
 branding:
   icon: umbrella
-  color: purple
+  color: purple