From 6c6b77c8cea47ab7b8b319f52049c260517415e4 Mon Sep 17 00:00:00 2001
From: Torgny Bjers <torgny@bjers.org>
Date: Wed, 24 Jun 2026 14:30:53 -0400
Subject: [PATCH] Test threshold-breach and feature-branch-push matrix items
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Adds two new CI verification scenarios:

- Push trigger broadened to `test/**` so feature-branch pushes exercise
  the "Not on default branch — skipping ingest" early-return path.
- New `threshold-breach` job (PR-only): sets min-coverage=99, wraps the
  action step in continue-on-error, then asserts the step outcome is
  'failure' — confirming the breach was caught and not silently skipped
  by an OIDC early-return.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
---
 .github/workflows/action-test.yml | 29 ++++++++++++++++++++++++++++-
 1 file changed, 28 insertions(+), 1 deletion(-)

diff --git a/.github/workflows/action-test.yml b/.github/workflows/action-test.yml
index 938a1cf..1936065 100644
--- a/.github/workflows/action-test.yml
+++ b/.github/workflows/action-test.yml
@@ -2,7 +2,7 @@ name: Action self-test
 
 on:
   push:
-    branches: [main]
+    branches: [main, 'test/**']
   pull_request:
 
 permissions:
@@ -33,3 +33,30 @@ jobs:
           min-coverage: '20'
           max-coverage-drop: '5'
           coverage-report-js: .github/actions/report/coverage/coverage-summary.json
+
+  # Verifies that a min-coverage threshold above actual coverage causes the
+  # action to fail. The breach step is allowed to fail; the assert step
+  # confirms it actually did (not just an OIDC skip or other early return).
+  threshold-breach:
+    if: github.event_name == 'pull_request'
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Test Action runner
+        working-directory: .github/actions/report
+        run: npm ci && npm test
+
+      - id: breach
+        uses: ./.github/actions/report
+        continue-on-error: true
+        with:
+          worker-url: https://coverage-tracker.zerostash.org
+          min-coverage: '99'
+          coverage-report-js: .github/actions/report/coverage/coverage-summary.json
+
+      - name: Assert threshold breach failed the action
+        if: steps.breach.outcome != 'failure'
+        run: |
+          echo "Expected min-coverage 99 to fail, got '${{ steps.breach.outcome }}'"
+          exit 1