[newhoggy]

Closes #130

What changed and why

patchcov recommends action-works/patchcov-action but never ran it on its own PRs. This adds a Coverage job to ci.yml that does:

• On pull requests: a sticky comment with patch coverage and the uncovered new lines, a fail-under-patch: 90 gate and a fail-under-lines: 95 gate (the project measures 99.1% lines locally; the action's default line gate is 30).
• On push to main: publishes the baseline artifact. The job is in ci.yml because the action looks for the baseline in ci.yml by default.
• timeout-minutes: 15, like the other jobs that run tests; the header comment on timeouts is updated.

Decisions the issue left open, all recorded in the plan comment:

• Advisory, not blocking. Coverage is not in .github/rulesets/main.json or the required-checks list, so a red run cannot block a merge or eject a queue entry. Making it required later is a one-line change.
• merge_group. The job is skipped there (if: github.event_name != 'merge_group'): the comment, patch gate and baseline are pull_request/push-only, so the queue run would only repeat the instrumented tests. A skipped job counts as passing if it is ever required.
• Pin @v1. It is the only tag on the action repo. The action's README on main documents @v2, which has not been tagged, so @v2 would not resolve. v1 defaults to patchcov 0.1.1, so the job passes version: latest.
• actions: read on top of the issue's permissions: the baseline lookup downloads another run's artifact, and a job-level permissions: block drops everything it does not list. I could not confirm that the download fails without it, so treat it as precaution; the first run on main will show. The README example gains it too.
• No toolchain/cache steps: the action installs the toolchain, rust-cache and cargo-llvm-cov itself.
• Fork PRs: comment is turned off for them (read-only token); gates still apply.
• Docs: CONTRIBUTING.md describes the job; the README and troubleshooting checkout examples move @v4 to @v7 to match CI, as the issue asked to consider.

Verification

• cargo fmt --check, cargo clippy --locked --all-targets -- -D warnings, cargo run --locked -- lint-markers: clean.
• cargo test --locked --all-targets (540 passed, 0 failed, includes the markdown link check) and cargo test --locked --doc: pass.
• ci.yml parses; every job has timeout-minutes; required-check names are unchanged.
• cargo llvm-cov --all-features --workspace locally: 99.14% lines, ~28 s.
• Not verified locally: the job itself only runs on GitHub. This PR's own Coverage run is the test; the baseline publish can only be seen after merge.

Review findings not acted on

• version: latest tests the last release, not the PR's code, and is not reproducible. Deliberate: the issue is to run the shipped action. A new release could redden the advisory job, which is the rough edge dogfooding should show.
• Thresholds duplicated in workflow and CONTRIBUTING. Accepted; one sentence in CONTRIBUTING, advisory job.
• Baseline found by the ci.yml filename; no concurrency group. The filename dependency is noted in the workflow comment. No other job uses concurrency, so adding one only here is out of keeping; follow-up if runs pile up.
• Checkout bump is scope creep. The issue asked to check it; kept as a separate doc line.

Follow-ups

• Make Coverage required (ruleset + CONTRIBUTING list) once it has run stably.
• The action repo's README documents @v2 but no v2 tag exists.

[github-actions]

Coverage

Total: 99.4% ⚪ 0 pp vs main

Comparing d0ebccc..85b3235 (merge-base → PR head)

No per-file coverage changes vs main.

Touched files absent from every coverage report (4)

• .github/workflows/ci.yml
• CONTRIBUTING.md
• README.md
• docs/troubleshooting.md

These files may contain no executable code or may have been omitted from the coverage run.

Patch coverage

No new executable lines added by this diff.

_{📦 Full per-file coverage summary · run summary}