[AAASM-3962] 🔧 (ci): Align Codecov & SonarCloud coverage report set

[Chisanan232]

Description

Align the Codecov and SonarCloud coverage measurement scope for python-sdk.

Both tools already consume the same coverage report set — the pytest-cov
coverage_*.xml files produced from .coveragerc. In CI, the sonarcloud_finish
job scans the downloaded coverage_all-test.xml (matched by
sonar.python.coverage.reportPaths=coverage*.xml), and the external reusable
workflow uploads the same per-suite coverage_*.xml files to Codecov. The report
source was therefore already aligned; the only gap was that codecov.yml had no
ignore while sonar.coverage.exclusions=agent_assembly/types.py excludes that
path, so the two tools measured different denominators.

Changes:

• 🔧 (config): add ignore: ["agent_assembly/types.py"] to codecov.yml,
  mirroring sonar.coverage.exclusions.
• 📝 (config): document in sonar-project.properties that both tools consume the
  same coverage_*.xml report set, and that any residual coverage-% delta is
  engine-level (SonarCloud analyzer vs coverage.py line counting), not a regression.

No report-path-alignment commit was needed: the produced report files are already
the shared source both sides read.

Type of Change

• 🔧 Bug fix

Breaking Changes

• No

Related Issues

• Related JIRA ticket: AAASM-3962

Closes AAASM-3962

Testing

• No tests required (explain why)

Config-only change to CI coverage tooling scope. Validated both files parse
(yaml.safe_load for codecov.yml; properties file is comment/value edits only).

Checklist

• Code follows project style guidelines
• Self-review completed
• Documentation updated if needed

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.

📢 Thoughts on this report? Let us know!

[Chisanan232]

Claude Code — PR review

CI state: 🟢 GREEN. 17/17 checks passed, 0 failed (unit + integration builds, both CodeQL analyses, sonarcloud_finish, all *_codecov_finish uploads, SonarCloud Code Analysis, codecov/patch, pip-audit, CI Success). e2e jobs SKIPPED as designed. No RED, nothing to fix. mergeStateStatus=BLOCKED is the required-approval gate only (mergeable=MERGEABLE).

Scope vs AAASM-3962 (Epic AAASM-3959): All AC met.

• Same coverage report set — confirmed by tracing what each tool actually consumes: SonarCloud's sonarcloud_finish job downloads the all-test_coverage_xml_report artifact → coverage_all-test.xml and scans it via sonar.python.coverage.reportPaths=coverage*.xml; the external reusable workflow (rw_upload_test_cov_report.yaml) uploads the same pytest-cov coverage_*.xml files (from .coveragerc) to Codecov per-suite, and its all flag uploads the same all-test report. Both sides read one shared coverage source, so the implementing agent's decision to skip a 3rd report-path-alignment commit is correct — there was no report-source mismatch to fix.

• codecov ignore mirrors sonar exclusions — codecov.yml ignore: ["agent_assembly/types.py"] exactly mirrors sonar.coverage.exclusions=agent_assembly/types.py. ✅

  Minor note (non-blocking, outside this ticket's AC): sonar.exclusions=agent_assembly/proto/** (a general-analysis exclusion for generated protobuf) drops proto from Sonar's coverage denominator, while .coveragerc (include=./agent_assembly) still lets Codecov count it. That is a distinct residual denominator source from coverage.exclusions and is not in scope for "mirror coverage exclusions" — flagging only as a possible Epic-level follow-up.

Side effects: None. codecov.yml parses as valid YAML (ignore=['agent_assembly/types.py']); the added ignore key only narrows Codecov's denominator to match Sonar. sonar-project.properties change is comment-only — the sonar.coverage.exclusions value is unchanged. No test/source/workflow logic touched. Two granular, correctly-emoji'd commits; clean tree.

Ready to merge? YES — CI fully green, both AC satisfied, config-only change with no behavioral risk. (Pending the required ≥1 Pioneer-team approval, which is the only remaining gate.)