chore(ci): refine SonarCloud config and coverage upload

[cidrblock]

Summary

Combines the SonarCloud-relevant improvements from #2977 and #2979 into a
focused, merge-ready PR, plus fixes Codecov carry-forward inflation discovered
during review. Credits @ssbarnea for the original SonarCloud work.

Changes

SonarCloud configuration (from #2977 / #2979)

• LCOV report paths: configure explicit comma-separated paths
  (coverage/lcov.info,coverage/wdio/lcov.info) instead of glob patterns —
  SonarScanner's wildcard handling for this property is inconsistent
  (Copilot review on #2977)
• Test scope: add packages/common/test/ to sonar.tests (was missing)
• Branch-analysis docs: document long-lived branch pattern for SonarCloud
  without hardcoding sonar.branch.name/sonar.branch.target, which would
  break PR scans
• Log verbosity: reduce from DEBUG/verbose=true to INFO/false —
  DEBUG is only useful when diagnosing scanner issues
• Coverage artifact upload: upload LCOV files from build-and-test and
  ui jobs via ansible/actions/upload-artifact@b2b0657c # v1.1.2
  (gitleaks-secured wrapper around actions/upload-artifact)
• .gitignore: ignore **/*.tgz packaging artifacts

Codecov carry-forward fix

After merging #2983 (honest coverage), we observed coverage jumping from an
honest ~39% to an inflated 87.67% after late-arriving WSL uploads triggered
re-computation. Root cause: Codecov's default carryforward: true was merging
stale (pre-#2983) inflated coverage data for flags that hadn't yet uploaded
fresh results.

• Disable carry-forward for all 5 flags (unit-node22/24/26, wdio,
  wsl-fedora) — each flag uploads fresh data on every CI run, so
  carry-forward is unnecessary and was actively harmful
• Increase after_n_builds from 3 to 5 to match actual upload count
  (3 build-and-test matrix + 1 wdio + 1 wsl)
• Enable wait_for_ci so Codecov waits for all uploads before computing
  the final merged report

What was NOT included from #2979

• Job consolidation (we intentionally have separate lint/test/integration/ui/package jobs)
• WSL workflow deletion (we recently added WSL CI with retry logic in ci: use parallel steps to speed up lint, ui, package, and WSL jobs #2981)
• package.json script changes
• prek.toml changes (disabling skillmark/actionlint)

Test plan

• CI passes (no source code changes — config only)
• Codecov reports honest coverage (~39%) after all 5 uploads complete
• SonarCloud scan on next picks up LCOV reports after merge
• Coverage artifacts appear in Actions run summary

Supersedes #2977.

Co-authored-by: Sorin Sbarnea ssbarnea@users.noreply.github.com

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on base/target branches other than the default branch.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Enterprise

Run ID: d5cb3f4b-4f96-4218-9b48-8e59d7c6d952

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 87.67%. Comparing base (0d4b51f) to head (9e431f2).

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.