Measure coverage in CI and add SECURITY.md

.github/workflows/pythonapp.yml

@@ -47,7 +47,7 @@ jobs:
         python-version: ${{ matrix.python-version }}
     - name: Test
       if: ${{ matrix.markdown == 'locked' }}
-      run: uv run pytest -v
+      run: uv run pytest -v --cov
     - name: Test with lowest Markdown
       if: ${{ matrix.markdown != 'locked' }}
       run: uv run --isolated --with "markdown==${{ matrix.markdown }}" pytest -v

CLAUDE.md

@@ -6,7 +6,7 @@ This file provides guidance to Claude Code (claude.ai/code) when working with co
 
 `python` on this machine is the Windows Store stub, not a real interpreter. Run everything through `uv` (dev deps live in the `dev` dependency group of `pyproject.toml`):
 
-- Tests: `uv run pytest` (single test: `-k single_else`)
+- Tests: `uv run pytest` (single test: `-k single_else`). CI runs `--cov` with `fail_under = 100` (branch coverage), so new code needs tests for every branch.
 - Lowest supported Markdown: `uv run --isolated --python 3.10 --with "markdown==3.2.*" pytest`
 - Lint/format (CI fails on either): `uv run ruff check .` and `uv run ruff format --check .`
 - Workflow audit (also in CI): `GH_TOKEN=$(gh auth token) uv run zizmor .`. Config in `.github/zizmor.yml` (its Dependabot cooldown must match `.github/dependabot.yml`).

MANIFEST.in

@@ -1,4 +1,4 @@
 # setuptools-scm adds every git-tracked file to the sdist; keep repo tooling out
 prune .claude
 prune .github
-exclude .gitignore CLAUDE.md uv.lock
+exclude .gitignore CLAUDE.md SECURITY.md uv.lock

SECURITY.md

@@ -0,0 +1,11 @@
+# Security Policy
+
+## Supported versions
+
+Only the latest release on [PyPI](https://pypi.org/project/md-condition/) receives fixes.
+
+## Reporting a vulnerability
+
+Please report vulnerabilities privately via
+[GitHub's private vulnerability reporting](https://github.com/cssho/md-condition/security/advisories/new),
+not in a public issue. You should get a response within a week.

pyproject.toml

@@ -26,6 +26,7 @@ Homepage = "https://github.com/cssho/md-condition"
 dev = [
     "mypy>=2.4.0",
     "pytest>=8",
+    "pytest-cov>=7.1.0",
     "ruff>=0.14",
     "types-markdown>=3.10.2.20261007",
     "zizmor>=1.30.1",
@@ -49,3 +50,11 @@ testpaths = ["tests"]
 [tool.mypy]
 strict = true
 files = ["md_condition", "tests"]
+
+[tool.coverage.run]
+source = ["md_condition"]
+branch = true
+
+[tool.coverage.report]
+fail_under = 100
+show_missing = true