Adopt region coverage and safe Markdown rendering.

.github/workflows/test.yml

@@ -48,5 +48,5 @@ jobs:
         run: cargo install cargo-llvm-cov --locked
       - run: cargo fmt --all --check
       - run: cargo clippy --workspace --all-targets --locked -- -D warnings
-      - name: Run tests and require complete line coverage
+      - name: Run tests and require complete source-region coverage
         run: cargo bake --locked test:coverage --all-targets true

Cargo.toml

@@ -1,6 +1,6 @@
 [package]
 name = "bake-agent-context"
-version = "0.3.0"
+version = "0.3.1"
 edition = "2024"
 license = "MIT"
 repository = "https://github.com/socketry/bake-agent-context-rust"
@@ -26,7 +26,7 @@ bake = "0"
 serde = { version = "1.0", features = ["derive"] }
 serde_json = "1.0"
 serde_yaml_ng = "0.10"
-socketry-markdown = "0.1.0"
+socketry-markdown = "0.2.0"
 
 [patch.crates-io]
 bake-agent-context = { path = "." }

bake/Cargo.toml

@@ -7,7 +7,7 @@ publish = false
 [dependencies]
 socketry-project = ">=0.3.3"
 bake = "0"
-bake-agent-context = { version = "0.3.0", path = ".." }
+bake-agent-context = { version = "0.3.1", path = ".." }
 bake-cargo = { version = "0.4.0" }
 bake-license = { version = "0.2.0" }
 bake-releases = { version = "0.3.0" }

bake/src/bake_generated_tasks/mod.rs

@@ -1,5 +1,7 @@
-// Generated by `cargo bake --regenerate`; do not edit.
+// Released under the MIT License.
+// Copyright, 2026, by Samuel Williams.
 
+// Generated by `cargo bake --regenerate`; do not edit.
 use bake_agent_context as _;
 use bake_cargo as _;
 use bake_license as _;

readme.md

@@ -81,6 +81,11 @@ for the standard process.
 <!-- bake-readme:releases:start -->
 See [releases.md](releases.md) for the full release history.
 
+### v0.3.1
+
+- Require `socketry-markdown` 0.2.0 or newer for safe inline Markdown
+  serialization.
+
 ### v0.3.0
 
 - Expose the context API and Bake task adapters from the crate root, removing
@@ -91,11 +96,6 @@ See [releases.md](releases.md) for the full release history.
 
 - Declare compatibility with the Bake 0.x API so task libraries can share one task registry
   when upgrading to crate-derived task namespaces.
-
-### v0.2.1
-
-- Use the shared `socketry-project` Releasing skill for the standard release
-  process and remove references to the duplicate Bake Cargo publishing context.
 <!-- bake-readme:releases:end -->
 
 ## Contributing

releases.md

@@ -1,5 +1,10 @@
 # Releases
 
+## v0.3.1
+
+- Require `socketry-markdown` 0.2.0 or newer for safe inline Markdown
+  serialization.
+
 ## v0.3.0
 
 - Expose the context API and Bake task adapters from the crate root, removing

src/exclude.rs

@@ -1,9 +1,12 @@
 // Released under the MIT License.
 // Copyright, 2026, by Samuel Williams.
 
+#[cfg(test)]
+use super::test_filesystem as fs;
 use bake::{Error, Result};
 use std::collections::BTreeSet;
 use std::ffi::OsStr;
+#[cfg(not(test))]
 use std::fs;
 use std::path::{Path, PathBuf};
 use std::process::Command;
@@ -42,7 +45,33 @@ pub(crate) fn prepare(
     root: &Path,
     skill_names: impl IntoIterator<Item = String>,
 ) -> Result<Option<Update>> {
-    let Some(path) = local_exclude_path(root)? else {
+    prepare_with_locator(root, skill_names, local_exclude_path)
+}
+
+#[cfg(all(test, unix))]
+fn prepare_with_executable(
+    root: &Path,
+    skill_names: impl IntoIterator<Item = String>,
+    executable: &OsStr,
+) -> Result<Option<Update>> {
+    prepare_with_locator(root, skill_names, |root| {
+        local_exclude_path_with(root, executable)
+    })
+}
+
+fn prepare_with_locator(
+    root: &Path,
+    skill_names: impl IntoIterator<Item = String>,
+    locate: impl FnOnce(&Path) -> Result<Option<PathBuf>>,
+) -> Result<Option<Update>> {
+    prepare_from_path(locate(root)?, skill_names)
+}
+
+fn prepare_from_path(
+    path: Option<PathBuf>,
+    skill_names: impl IntoIterator<Item = String>,
+) -> Result<Option<Update>> {
+    let Some(path) = path else {
         return Ok(None);
     };
 
@@ -315,6 +344,41 @@ mod tests {
         assert!(error.to_string().contains("cannot read"));
     }
 
+    #[test]
+    fn propagates_git_lookup_and_managed_block_errors_from_prepare() {
+        let directory = tempdir().unwrap();
+        #[cfg(unix)]
+        {
+            let executable = directory.path().join("not-executable");
+            fs::write(&executable, "not a command").unwrap();
+            let error = prepare_with_executable(
+                directory.path(),
+                Vec::<String>::new(),
+                executable.as_os_str(),
+            )
+            .err()
+            .unwrap();
+            assert!(error.to_string().contains("cannot locate Git exclude file"));
+        }
+
+        let error = prepare_with_locator(directory.path(), Vec::<String>::new(), |_| {
+            Err(Error::new("injected Git lookup failure"))
+        })
+        .err()
+        .unwrap();
+        assert!(error.to_string().contains("injected Git lookup failure"));
+
+        let repository = tempdir().unwrap();
+        let output = Command::new("git")
+            .args(["init", "--quiet"])
+            .current_dir(repository.path())
+            .output()
+            .unwrap();
+        assert!(output.status.success());
+        fs::write(repository.path().join(".git/info/exclude"), BEGIN_MARKER).unwrap();
+        assert!(prepare(repository.path(), Vec::<String>::new()).is_err());
+    }
+
     #[cfg(unix)]
     #[test]
     fn handles_git_command_start_errors() {