chore(ci): report web-app coverage to SonarCloud

.github/workflows/reusable_build-and-test.yaml

@@ -59,8 +59,6 @@ jobs:
     timeout-minutes: 5
     steps:
       - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 #v4.2.2
-        with:
-          fetch-depth: ${{ !fromJSON(env.do_sonarscan) && 1 || 0 }}
       - uses: actions/setup-node@a0853c24544627f65ddf259abe73b1d18a591444 #v5.0.0
         with:
           node-version: '24'
@@ -84,12 +82,12 @@ jobs:
         with:
           name: opentdf-sdk-lib
           path: ./lib/opentdf-sdk-*.tgz
-      - name: SonarCloud Scan
+      - uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f #v7.0.0
         if: fromJSON(env.do_sonarscan)
-        uses: SonarSource/sonarqube-scan-action@1a6d90ebcb0e6a6b1d87e37ba693fe453195ae25 #v5.3.1
-        env:
-          GITHUB_TOKEN: ${{ github.token }}
-          SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }}
+        with:
+          name: coverage-lib
+          path: ./lib/coverage/lcov.info
+          retention-days: 1
 
   cli:
     needs:
@@ -151,8 +149,46 @@ jobs:
       - run: npm run lint
       - run: npx playwright install
       - run: npm test
+      - uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f #v7.0.0
+        if: fromJSON(env.do_sonarscan)
+        with:
+          name: coverage-web-app
+          path: ./web-app/coverage/lcov.info
+          retention-days: 1
       - run: npm pack
 
+  # Split out from `lib` because sonar-project.properties covers web-app/src
+  # too, and the web-app job that produces its coverage `needs: lib`. Every step
+  # is guarded rather than the job, because job-level `if` cannot read `env`.
+  sonarscan:
+    needs:
+      - lib
+      - web-app
+    runs-on: ubuntu-latest
+    timeout-minutes: 5
+    steps:
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 #v4.2.2
+        if: fromJSON(env.do_sonarscan)
+        with:
+          # Sonar wants full history to attribute new code to this branch.
+          fetch-depth: 0
+      - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c #v8.0.1
+        if: fromJSON(env.do_sonarscan)
+        with:
+          name: coverage-lib
+          path: lib/coverage/
+      - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c #v8.0.1
+        if: fromJSON(env.do_sonarscan)
+        with:
+          name: coverage-web-app
+          path: web-app/coverage/
+      - name: SonarCloud Scan
+        if: fromJSON(env.do_sonarscan)
+        uses: SonarSource/sonarqube-scan-action@1a6d90ebcb0e6a6b1d87e37ba693fe453195ae25 #v5.3.1
+        env:
+          GITHUB_TOKEN: ${{ github.token }}
+          SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }}
+
   scripts:
     runs-on: ubuntu-latest
     defaults:
@@ -243,6 +279,9 @@ jobs:
       - web-app
       - scripts
       - platform-xtest
+      # Kept here so a failed scan still fails CI, as it did when the scan was
+      # a step of `lib`. Skipped steps report success, so forks stay green.
+      - sonarscan
     runs-on: ubuntu-22.04
     if: ${{ !cancelled() }}
     steps:

sonar-project.properties

@@ -4,13 +4,18 @@ sonar.projectKey=opentdf_client-web
 # Path is relative to the sonar-project.properties file. Replace "\" by "/" on Windows.
 # This property is optional if sonar.modules is set.
 sonar.sources=lib/src,lib/tdf3,web-app/src,web-app/public
-sonar.exclusions=lib/src/platform/**
+# web-app keeps its tests beside the code they cover, so without the second
+# pattern every *.test.ts counts as main source with no coverage report behind
+# it -- adding tests would push the new-code coverage ratio down.
+sonar.exclusions=lib/src/platform/**,**/*.{test,spec}.{ts,tsx}
 
 sonar.host.url=https://sonarcloud.io
 sonar.organization=opentdf
 
-# code coverage
-sonar.javascript.lcov.reportPaths=lib/coverage/lcov.info
+# code coverage. web-app/coverage is produced by `npm test` there (vitest v8);
+# both are downloaded as artifacts by the sonarscan job, since the jobs that
+# generate them run separately.
+sonar.javascript.lcov.reportPaths=lib/coverage/lcov.info,web-app/coverage/lcov.info
 # sonar.tests=tests
 
 # Encoding of the source code. Default is default system encoding