ci: add SonarQube coverage workflow

[omarluq]

Summary

• add SonarQube/SonarCloud GitHub Actions workflow
• run Go test coverage before scanning
• pass coverage.out to Sonar via sonar.go.coverage.reportPaths

Validation

• mise exec -- go test ./...
• mise exec -- task build
• mise exec -- task ci

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro

Run ID: bf58cb02-253f-4c6d-86be-2a43f7cfe9ec

📥 Commits

Reviewing files that changed from the base of the PR and between 9c3d64e and a851cac.

📒 Files selected for processing (2)

• .github/workflows/ci.yml
• codecov.yml

✅ Files skipped from review due to trivial changes (1)

• codecov.yml

---

📝 Walkthrough

Summary by CodeRabbit

• Chores
  • Added automated SonarCloud analysis to CI, running on pushes to main and on pull requests.
  • Standardized and pinned third‑party workflow actions to immutable revisions for test, build, and release pipelines.
  • Added Codecov configuration with coverage targets/thresholds and ignore rules; adjusted coverage upload behavior in CI.

Walkthrough

Adds a SonarQube/SonarCloud GitHub Actions workflow that runs test coverage and a Sonar scan, pins GitHub Action references to exact SHAs in CI and release workflows, and adds a Codecov configuration.

Changes

CI workflows + SonarQube

Layer / File(s)	Summary
SonarQube Analysis Setup ​.github/workflows/sonarqube.yml	Adds a workflow that triggers on pushes to main and PR events, checks out full history, sets up Go from go.mod with caching, installs Task and runs task test-coverage, then runs SonarSource/sonarqube-scan-action configured for SonarCloud with coverage path, source/test settings, and include/exclude globs.
CI workflow action pinning & Codecov config ​.github/workflows/ci.yml, codecov.yml	Replaces tag-based action references with SHA-pinned commits across CI test and build jobs, updates the Codecov upload step inputs/conditions, and adds codecov.yml with status thresholds and ignore globs.
Release workflow action pinning ​.github/workflows/release.yml	Pins actions/checkout, actions/setup-go, and goreleaser/goreleaser-action to exact commit SHAs in the release workflow.

Sequence Diagram(s)

sequenceDiagram
  participant Runner as GitHub Actions Runner
  participant Checkout as actions/checkout (fetch-depth: 0)
  participant SetupGo as actions/setup-go (from go.mod, cache)
  participant Task as arduino/setup-task
  participant SonarAction as SonarSource/sonarqube-scan-action
  participant SonarCloud as SonarCloud

  Runner->>Checkout: checkout repository (full history)
  Runner->>SetupGo: setup Go environment
  Runner->>Task: install Task & run `task test-coverage`
  Runner->>SonarAction: invoke Sonar scan (SONAR_TOKEN, -Dsonar.* args, coverage.out)
  SonarAction->>SonarCloud: upload analysis and coverage

Loading

Estimated code review effort

🎯 3 (Moderate) | ⏱️ ~20 minutes

Poem

🐰 Pins kissed the branches, tests in tow,

Coverage whispered where the reports grow,
Sonar peeks, its beak so bright,
CI hums softly through the night,
I hop, I merge — the pipeline's a-go!

🚥 Pre-merge checks | ✅ 4

✅ Passed checks (4 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title accurately and concisely summarizes the main change—adding a SonarQube coverage workflow to the CI configuration.
Description check	✅ Passed	The description is directly related to the changeset, explaining the SonarQube workflow addition, coverage test execution, and coverage reporting configuration.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch chore/sonarqube-coverage

---

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[coderabbitai]

Actionable comments posted: 2

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In @.github/workflows/sonarqube.yml:
- Around line 38-43: The SonarQube Scan step ("SonarQube Scan" using
SonarSource/sonarqube-scan-action@v7) must be skipped for forked PRs because
secrets.SONAR_TOKEN won't be available; add an if: guard that only runs the step
when it's not a pull_request or when the PR head repo matches the base repo
(e.g. if: github.event_name != 'pull_request' ||
github.event.pull_request.head.repo.full_name == github.repository) so the step
runs in normal branches/owner PRs but is skipped for forked PRs that lack the
SONAR_TOKEN env var.
- Around line 22-23: Replace mutable action tags with immutable commit SHAs:
locate every "uses: actions/checkout@v6" (and the other "uses:" entries in this
workflow and the other CI/release workflows) and change the tag to the
corresponding full commit SHA for that action release; ensure you update all
occurrences (the checkout action and any other referenced actions) to their
pinned SHAs, run a quick CI lint to validate the YAML, and commit the updated
workflow files so the workflows reference immutable, auditable action SHAs
instead of major-version tags.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro

Run ID: 05e1796e-c2e5-459e-89d0-9fcd20f9dc52

📥 Commits

Reviewing files that changed from the base of the PR and between 1732d8d and 81a428e.

📒 Files selected for processing (1)

• .github/workflows/sonarqube.yml

[codecov-commenter]

Welcome to Codecov 🎉

Once you merge this PR into your default branch, you're all set! Codecov will compare coverage reports and display results in all future pull requests.

Thanks for integrating Codecov - We've got you covered ☂️

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud