[EquityBot]

Summary

Brings this repository's badges up to the maintainer's other account: Codecov coverage, a Snyk scan, SonarCloud and Codacy.

Rust tests now run under cargo llvm-cov on the Linux leg (Windows keeps cargo test), and a separate codecov job uploads the report by OIDC. The README gains Codecov, SonarCloud and Codacy badges; codecov.yml keeps statuses informational; CONTRIBUTING gains a test policy.

Evidence

• cargo fmt --check, cargo clippy --all-targets -- -D warnings and the full cargo test suite: pass.
• actionlint and zizmor: clean.

Merge danger

Door: two-way. Blast radius: CI

The Codecov job continues on error, so an outage there cannot turn the tests badge red. The OIDC token is granted only to that job, never to a job that runs tests.

Unverified

• The changed workflows have not run yet; this PR's own run is the first.
• Codecov has not yet received an OIDC upload for this repository, so the first upload is unconfirmed.

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues
0 New dependency risks

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[codacy-production]

Up to standards ✅

🟢 Issues 0 issues

Results:
0 new issues

View in Codacy

AI Reviewer: first review requested successfully. AI can make mistakes. Always validate suggestions.

_{TIP This summary will be updated as you push new changes.}

[codacy-production]

Pull Request Overview

⚠️ Resolve issues before merging

The Linux coverage workflow uses an invalid Rust component name, so the CI leg will fail before generating coverage or uploading it. This should be fixed before merging.

The SonarCloud badge still points to the former project, leaving the badge requirement unmet. Workflow behavior and badge resolution also remain unverified by automated tests.

Test suggestions

• Linux CI installs coverage tooling, runs tests under cargo-llvm-cov, and produces an LCOV artifact.
• The separate Codecov job downloads the artifact and performs an OIDC upload under the intended event and permission conditions.
• Windows CI runs the full test suite with the intended serial test-thread configuration.
• README service badges resolve to the current repository and corresponding service projects.

Prompt proposal for missing tests

Consider implementing these tests if applicable:
1. Linux CI installs coverage tooling, runs tests under cargo-llvm-cov, and produces an LCOV artifact.
2. The separate Codecov job downloads the artifact and performs an OIDC upload under the intended event and permission conditions.
3. Windows CI runs the full test suite with the intended serial test-thread configuration.
4. README service badges resolve to the current repository and corresponding service projects.

Low confidence findings

• Verify the updated workflow with a CI run covering coverage generation, artifact transfer, and the separate OIDC-authenticated upload job.

_{TIP Improve review quality by adding custom instructions
TIP How was this review? Give us feedback}

[codacy-production]

_{🔴 HIGH RISK}

Use the actual rustup component name, llvm-tools-preview, so the Linux CI leg can initialize coverage tooling.

_{TIP React 👍 if this review is right, or reply with what's wrong and how it could be better to help improve the reviewer.}

[codacy-production]

_{🟡 MEDIUM RISK}

Update the SonarCloud badge URL and link to the current project's SonarCloud identifier.

_{TIP React 👍 if this review is right, or reply with what's wrong and how it could be better to help improve the reviewer.}