Fix Sonar test-branch coverage gate

[CrimsonSoul]

What changed

• generates Cobertura XML instead of unsupported LCOV for Python coverage
• keeps the generated report path synchronized between GitHub Actions and sonar-project.properties
• ignores the generated XML report
• adds a workflow contract regression for the producer/consumer path and format

Root cause

The first protected test push revealed two integration-only mismatches: SonarQube Cloud had initialized master as the project main branch, and the Python analyzer could not parse pytest-cov LCOV output. The Sonar project main branch is now configured as test; this PR fixes the repository-side coverage format.

Validation

• 248 Python tests passed with 82% coverage
• 82 scanner tests passed
• generated coverage.xml parsed as valid Cobertura XML
• workflow YAML parsed successfully
• git diff --check clean

Summary by CodeRabbit

• Chores

  • Updated SonarQube coverage reporting to use Cobertura XML format.
  • Standardized coverage report configuration and cleanup rules.

• Tests

  • Added validation to ensure the security workflow generates and consumes the configured coverage report correctly.

[coderabbitai]

Caution

Review failed

The pull request is closed.

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro Plus

Run ID: 459102cd-6958-436f-8962-9fb91f7599ee

📥 Commits

Reviewing files that changed from the base of the PR and between 733eafb and 96a3f0d.

📒 Files selected for processing (4)

• .github/workflows/security.yml
• .gitignore
• scripts/security-workflow-contract.test.mjs
• sonar-project.properties

---

📝 Walkthrough

Walkthrough

The SonarQube workflow now generates Cobertura XML coverage at coverage.xml. SonarQube configuration, ignore rules, and contract tests now use and validate the same report path.

Changes

Sonar coverage reporting

Layer / File(s)	Summary
Align coverage generation and validation .github/workflows/security.yml, sonar-project.properties, .gitignore, scripts/security-workflow-contract.test.mjs	The workflow generates coverage.xml. SonarQube reads the configured XML report. Git ignores the new report, and the contract test validates the coverage format and path.

Estimated code review effort: 1 (Trivial) | ~5 minutes

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch codex/fix-sonar-test-gate

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud