Retry coverage publication after concurrent pushes

[brandonganem]

No linked issue.

Summary

Concurrent publishers can advance the coverage branch between checkout and push. Retry only the exact branch's porcelain fetch first or non-fast-forward rejection, with at most three push attempts.

• Keep both publication histories without force-pushing, including simultaneous creation of an orphan report branch.
• Restore each operation's complete committed snapshot. Preserve independent remote paths, remove stale directory contents, and avoid replaying already-consumed ReplaceDir sources.
• Do not merge individual JSON fields from coupled reports. The last successful publication supplies a same-path snapshot; earlier reports remain in Git history.
• Propagate authentication, policy, fetch, inspection, and exhausted-retry failures. Clear failed report changes before returning to the original checkout so cleanup does not mask an inspection error.

Validation

• uv run --no-sync --offline pytest tests/unit tests/integration — passed: 328 tests on Python 3.14.8.
• uv run --no-sync --offline prek run --all-files — passed: all configured formatting, lint, type, README, workflow, and security-lint checks.
• Built the production Docker action for Linux amd64. Four offline, synthetic real-Git publication scenarios passed in that image on Python 3.14.8. These checks were emulated on an ARM host, not native Linux CI.
• Hosted CI passed: Run linters, Run tests & display coverage, and Autofix. See the CI run.
• GitHub-hosted end-to-end tests were not run. They require maintainer-controlled accounts and can delete repositories or change Git configuration.

Checklist:

• Tests
  • (not applicable?)
• Documentation
  • (not applicable?)

[github-actions]

Coverage report

Click to see where and how coverage changed

File	Statements	Missing	Coverage	Coverage (new stmts)	Lines missing
coverage_comment
storage.py
Project Total

This report was generated by python-coverage-comment-action