[AndreasIgel]

Summary

Adds integrations-check.yml, a maintainer-only workflow_dispatch diagnostic that verifies the 3rd-party integration secrets and endpoints in seconds — without building or running any project/PR code. Motivated by the fork Sonar publish failing with HTTP 403 ... check SONAR_TOKEN, where a full CI run was a slow/noisy way to discover a token problem.

Fixes #208

Input

• target: all / sonarcloud / codecov.

What it checks

• SonarCloud — SONAR_TOKEN present + valid via GET https://sonarcloud.io/api/authentication/validate (token as basic-auth username; value never printed). Fails on 403 / "valid":false.
• Codecov — CODECOV_TOKEN (the repo upload token) present + accepted by the first step of Codecov's upload handshake: POST https://api.codecov.io/upload/github/<owner>::::<repo>/commits with Authorization: token … against the real GITHUB_SHA (the same create-commit call the uploader makes).

Codecov result mapping: 200/201 = token authenticates; 401/403 = token rejected; 404 = authenticated but repo not set up / not visible; other = reachability/service issue. Temp files use $RUNNER_TEMP.

Why it's safe

• workflow_dispatch is startable only by write-access users from the default branch → inherently maintainer-gated, never runs for fork PRs.
• No build, no PR-supplied code — only authenticated HTTP checks. Token values are never echoed (set -euo pipefail, tokens confined to env/auth header/basic-auth). The upload create-commit call targets the real HEAD commit, so it adds no spurious data.

Scope

Single new workflow file; nothing else touched. Diagnostic only — does not replace the fork-ci environment approval that gates the actual Sonar publish.

Maintainer TODOs

• After merge, run Actions → Integration connectivity check → Run workflow (only listable once on the default branch) to confirm SONAR_TOKEN/CODECOV_TOKEN — this should surface the current Sonar 403.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ All tests successful. No failed tests found.

📢 Thoughts on this report? Let us know!