[EquityBot]

Summary

Brings this repository's badges up to the maintainer's other account: Codecov coverage, a Snyk scan, SonarCloud and Codacy.

The unit tests run under coverage 7.17.0 and a separate codecov job uploads the report by OIDC. Snyk tests the 2 npm lockfiles used by CI load checks. .github/ci/pi overrides minimatch 10.2.6 to 11.0.3 for GHSA-g3hv-75wg-m249, because Pi 1.4.0 pins the vulnerable version. CONTRIBUTING gains a test policy.

Evidence

• 163 unit tests, the Pi load check and npm audit pass locally (Windows, Node 26).
• actionlint: clean.

Merge danger

Door: two-way. Blast radius: CI

The OIDC token is granted only to the separate codecov job, which continues on error, so a Codecov outage cannot turn the tests badge red.

Unverified

• The changed workflows have not run yet; this PR's own run is the first.
• Codecov has not yet received an OIDC upload for this repository.
• The Pi load check with minimatch 11 has not run on Linux Node 22.

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues
0 New dependency risks

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[codacy-production]

Up to standards ✅

🟢 Issues 0 issues

Results:
0 new issues

View in Codacy

🟢 Metrics 5 complexity · 0 duplication

Metric	Results
Complexity	5
Duplication	0

View in Codacy

AI Reviewer: first review requested successfully. AI can make mistakes. Always validate suggestions.

_{TIP This summary will be updated as you push new changes.}

[codacy-production]

Pull Request Overview

👀 Worth a closer look

The Snyk workflow has two dependency-scanning coverage gaps that should be reviewed before merge: Dependabot pull requests are excluded, and changes to package manifests do not trigger the workflow. The required CI and Codecov integration scenarios remain unverified.

About this PR

• The changed workflow integration and Linux Pi load check remain unverified; run the relevant CI scenarios before relying on the new automation.

Test suggestions

• Verify the Pi lockfile contains no minimatch version in the vulnerable range.
• Verify both npm lockfiles are passed to Snyk and each scan failure fails the job.
• Verify the tests job produces the coverage XML artifact and the separate Codecov job downloads and uploads it with OIDC.
• Verify the Codecov job is limited to trusted pull requests or pushes and cannot expose OIDC credentials while tests run.

Prompt proposal for missing tests

Consider implementing these tests if applicable:
1. Verify both npm lockfiles are passed to Snyk and each scan failure fails the job.
2. Verify the tests job produces the coverage XML artifact and the separate Codecov job downloads and uploads it with OIDC.
3. Verify the Codecov job is limited to trusted pull requests or pushes and cannot expose OIDC credentials while tests run.

_{TIP Improve review quality by adding custom instructions
TIP How was this review? Give us feedback}

[codacy-production]

_{🟡 MEDIUM RISK}

Add the dependency manifests to both the push and pull-request path filters, such as .github/ci/*/package.json, so manifest changes trigger Snyk scanning.

_{TIP React 👍 if this review is right, or reply with what's wrong and how it could be better to help improve the reviewer.}

[codacy-production]

_{🟡 MEDIUM RISK}

This workflow does not scan Dependabot pull requests, so dependency updates can merge without Snyk validating the proposed lockfiles. Provide a trusted-token path for these pull requests or revise the documented scanning coverage.

_{TIP React 👍 if this review is right, or reply with what's wrong and how it could be better to help improve the reviewer.}