[NicoPiel]

CI already ran the unit tests with JaCoCo (-Pcoverage=true), but the data stayed inside the Docker builder image. This PR exports it, records coverage of the server while the smoke tests run, and merges both into a single report, published as the Coverage Report artifact. Coverage is off on main, as before.

Changes

• JaCoCo 0.8.8 → 0.8.14, now in the version catalog. The build stays on JDK 17, but the smoke-test images run Java 21, which 0.8.8 predates.
• stageCoverage gathers the unit-test .exec files, the JaCoCo agent and the CLI into build/coverage. The Dockerfile exports that folder with the test results.
• ci/coverage.compose.yml attaches the agent to the server when JACOCO_AGENT is set. configure-from-env splits VMOPTIONS on commas, so the agent gets only destfile and records every class. The report is limited to our own jars.
• ci/run-configuration.sh stops the server with a 120s timeout before down, so the agent can write its data on shutdown. Java is PID 1 through the exec chain, so it receives the SIGTERM.
• ci/coverage-report.sh merges all the data against the distribution jars the smoke tests ran. It fails if any of the inputs are missing.
• Workflow: the build job uploads the unit data, each integration job uploads its smoke data, and a new coverage job merges them.
• verification-metadata.xml regenerated on a cold cache with CI's flags.

Sonar

./gradlew sonar -Dsonar.host.url=... -Dsonar.token=... analyzes the project with the merged report (build/coverage/report/coverage.xml). The URL and token stay on the command line. Every module points at that report, because otherwise JaCoCo's per-module default overrides it. The project key defaults to oie and can be changed with -Dsonar.projectKey. SonarCloud also needs -Dsonar.organization.

ci/coverage-report.sh now works on the local build layout, so anyone can produce the report (steps in ci/README.md). The CI job lays its artifacts out the same way.

Testing

• A cold-cache build dist stageCoverage -PdisableSigning=true -Pcoverage=true passes dependency verification.
• Merging the unit data against the built jars gives zero class-ID mismatches.
• A local server with the agent attached the same way writes valid data on SIGTERM. Merged with the unit data, line coverage rises from 13,136 to 15,854 of 128,212 lines, from server startup alone.

🤖 Generated with Claude Code

[github-actions]

Test Results

130 files  ±0  130 suites  ±0   3m 22s ⏱️ +20s
789 tests ±0  789 ✅ ±0  0 💤 ±0  0 ❌ ±0 
915 runs  ±0  909 ✅ ±0  6 💤 ±0  0 ❌ ±0 

Results for commit d1abc13. ± Comparison against base commit a403039.

♻️ This comment has been updated with latest results.

[jonbartels]

Nico and I talked about this in chat.

Merging this PR doubles report coverage data:

LoC covered
Unit tests only = 13,140
Derby smoke tests only = 12,207
Merged = 20,658 

This data will show us un-covered classes and improve test coverage.

[NicoPiel]

I'll also add a sonar config to this PR.

[gibson9583]

Looks safe to merge.