ci: publish Go coverage and import it into Sonar

[jamessawle]

Problem

CI does not currently generate or publish a Go coverage report. Sonar therefore reports 0.0% coverage on new code, and contributors cannot inspect a coverage artifact from the workflow.

Scope

• Generate a Go coverage profile in CI.
• Publish a human-readable coverage summary.
• Retain the coverage profile as a downloadable workflow artifact.
• Where supported by the selected Sonar analysis mode, import the Go coverage profile so the Sonar new-code coverage measure is meaningful.
• Document the coverage checks in CONTRIBUTING.md.

Acceptance criteria

• CI publishes a Go coverage summary.
• CI retains the coverage profile as a downloadable artifact.
• Sonar shows imported Go coverage when the project plan and analysis mode support it.
• CONTRIBUTING.md documents the coverage workflow.
• mise run validate passes.

Context

• Split from ci: fail pull requests with new Sonar issues #88 so coverage reporting can be delivered independently from Sonar issue enforcement.
• The repository currently has no SONAR_TOKEN Actions secret and uses Sonar automatic analysis.

[jamessawle]

We have agreed to use this issue to move from SonarQube Cloud automatic analysis to CI-based analysis so that Sonar receives the Go coverage profile. We will keep the existing four workflow boundaries (CI, Release, Dependabot auto-merge, and OpenSSF Scorecard); this change belongs in the existing CI workflow.

Implementation

• Change the existing test invocation in mise run validate to generate coverage:

  go test -race -covermode=atomic -coverprofile=coverage.out ./...

• Add coverage.out to .gitignore.
• Extend .github/workflows/ci.yml after repository validation to:
  • append go tool cover -func=coverage.out to the GitHub job summary;
  • upload coverage.out as a short-lived workflow artifact;
  • run a commit-pinned SonarQube Cloud scan action;
  • check out full Git history as required for accurate Sonar analysis.
• Add sonar-project.properties with the project identity and:

  sonar.go.coverage.reportPaths=coverage.out

• Update CONTRIBUTING.md to document local coverage generation, the CI summary/artifact, Sonar import, and the restrictions on token-backed analysis for untrusted PRs.

SonarQube Cloud and GitHub configuration

Sequence the migration carefully so automatic and CI-based analysis do not run concurrently:

1. Create a suitably scoped Sonar token.
2. Store it as the repository's SONAR_TOKEN GitHub Actions secret.
3. Make the CI scanner configuration available.
4. Disable Automatic Analysis in the SonarQube Cloud project settings. There is no automatic-analysis runner in this repository to remove.
5. Run the CI workflow on main and confirm that CI-based analysis is authoritative.
6. Confirm the Sonar quality-gate status check is still correctly represented in branch protection; update a stale check name if necessary.

Keep the Sonar GitHub App/repository binding because CI-based analysis still uses it for pull-request decoration and quality-gate reporting.

Security boundaries

• Do not use pull_request_target or otherwise expose SONAR_TOKEN to untrusted code.
• Sonar scanning will not run for fork PRs or Dependabot PRs because Actions secrets are unavailable to those runs.
• Those PRs will still run the complete repository validation and generate coverage locally within the job.
• Do not introduce another coverage service.
• Do not move Sonar scanning into the release workflow.
• No OpenSpec workflow is needed for this change.

Validation

Repository validation:

• mise run fmt
• mise run validate
• Confirm coverage.out is generated and ignored by Git.
• Confirm go tool cover -func=coverage.out produces the expected package and total coverage.

GitHub/Sonar validation:

• Confirm CI publishes the human-readable coverage job summary.
• Confirm CI retains coverage.out as a downloadable artifact.
• Confirm a main analysis imports Go coverage and Sonar no longer reports an unpopulated 0.0% measure.
• Confirm an ordinary same-repository pull request receives Sonar analysis and the expected quality-gate result.
• Confirm fork and Dependabot PRs safely skip the token-backed scan while repository validation continues to pass.
• Confirm the Release, Dependabot auto-merge, and Scorecard workflows remain unaffected.