fix(action): use explicit refs/heads for git ls-remote and fetch

Replace implicit branch name arguments with explicit `refs/heads/` prefixes
in `git ls-remote` and `git fetch` commands to ensure consistent behavior
across different Git versions and remote configurations.

Also move `detect_and_store_repo_depth_mode` call to after workspace
initialization and add test cases for partial branch name matching.

Author: linkdata

.github/workflows/self-test.yml

@@ -62,6 +62,12 @@ jobs:
           git branch 'feat=compat'
           git push origin 'feat=compat'
 
+          # Branches used to verify exact remote branch checks.
+          git branch 'foo/coverage'
+          git push origin 'foo/coverage'
+          git branch 'only/partial'
+          git push origin 'only/partial'
+
           # Detached/tag-only commit (not contained by any remote branch)
           git checkout --detach
           echo "detached-only" > detached-only.txt
@@ -102,6 +108,20 @@ jobs:
             test "${{ steps.windows_branch.outcome }}" = "success"
           fi
 
+      - name: Run action with partial branch-name match (should fail)
+        id: partial_branch
+        continue-on-error: true
+        uses: ./action-src
+        with:
+          coverage: "80%"
+          branch: "partial"
+
+      - name: Verify partial branch-name match failed
+        shell: bash
+        run: |
+          set -euo pipefail
+          test "${{ steps.partial_branch.outcome }}" = "failure"
+
       - name: Verify explicit branch run
         shell: bash
         run: |

README.md

@@ -35,6 +35,7 @@ If you submitted a detailed HTML report of the coverage to the action, replace t
 - `branch` (optional): Source branch override. Recommended for tag-triggered workflows where multiple branches may contain the same tag commit.
   Also recommended for very large or restricted repos to avoid scanning all remote branches during tag-triggered branch resolution.
   On Windows runners, the action applies a strict compatibility filter and requires branch names to match `[A-Za-z0-9._/+-]+`.
+  This filter does not reject Windows-reserved path components such as `CON`, `NUL`, `AUX`, `COM1`, or `LPT9`; avoid those names on Windows runners.
 
 ## Examples
 

action.yml

@@ -56,8 +56,6 @@ runs:
           echo "GITCOVERAGE_IS_SHALLOW_REPOSITORY=$shallow" >> "$GITHUB_ENV"
         }
 
-        detect_and_store_repo_depth_mode
-
         WORKSPACE_PATH="${GITHUB_WORKSPACE:-$PWD}"
         WORKSPACE_PATH="$(to_posix_path "$WORKSPACE_PATH")"
         # Trust only this workspace. If the default global config is not writable,
@@ -77,6 +75,9 @@ runs:
             exit 1
           fi
         fi
+
+        detect_and_store_repo_depth_mode
+
         git config --local user.email "action@github.com"
         git config --local user.name  "GitHub Action"
 
@@ -158,7 +159,7 @@ runs:
           else
             git fetch --prune --tags origin
           fi
-          if ! git fetch origin +refs/heads/*:refs/remotes/origin/* --prune; then
+          if ! git fetch origin '+refs/heads/*:refs/remotes/origin/*' --prune; then
             echo "Failed to fetch remote branches needed for tag-triggered branch resolution." >&2
             echo "Set input 'branch' to the intended source branch." >&2
             exit 1
@@ -181,7 +182,7 @@ runs:
             echo "Invalid explicit branch input: '$BRANCH'" >&2
             exit 1
           fi
-          if ! git ls-remote --exit-code --heads origin "$BRANCH" >/dev/null 2>&1; then
+          if ! git ls-remote --exit-code origin "refs/heads/${BRANCH}" >/dev/null 2>&1; then
             echo "Explicit branch '$BRANCH' was not found on origin." >&2
             exit 1
           fi
@@ -299,7 +300,7 @@ runs:
           fi
         }
         # Does 'coverage' branch exist on origin?
-        if git ls-remote --exit-code --heads origin coverage >/dev/null 2>&1; then
+        if git ls-remote --exit-code origin refs/heads/coverage >/dev/null 2>&1; then
           echo "'coverage' branch exists."
         else
           echo "Creating orphan 'coverage' branch..."
@@ -339,7 +340,7 @@ runs:
             else
               echo "Initial push failed; checking whether 'coverage' was created concurrently..."
               git -C "$GITCOVERAGE_REPO_ROOT" fetch origin +refs/heads/coverage:refs/remotes/origin/coverage >/dev/null 2>&1 || true
-              if git -C "$GITCOVERAGE_REPO_ROOT" ls-remote --exit-code --heads origin coverage >/dev/null 2>&1; then
+              if git -C "$GITCOVERAGE_REPO_ROOT" ls-remote --exit-code origin refs/heads/coverage >/dev/null 2>&1; then
                 echo "'coverage' branch was created by another run."
               else
                 echo "Failed to create 'coverage' branch." >&2