feat: Sonar + coverage + CI hardening (PR-A)

[ericsocrat]

Summary

Adds unit test infrastructure with coverage reporting, wires it into SonarCloud, and hardens CI — so Sonar's quality gate becomes actionable instead of always-failing at 0% coverage.

Changes

Test Framework

• Vitest + React Testing Library + @vitest/coverage-v8 installed
• vitest.config.ts with jsdom environment, path aliases, v8 coverage (lcov + text)
• 4 test files, 56 unit tests covering:
  • validation.ts — sanitizeRedirect, isValidEan, stripNonDigits, formatSlug (25 tests)
  • rpc.ts — isAuthError auth-code/message detection (10 tests)
  • query-keys.ts — deterministic cache key factories + stale times (13 tests)
  • constants.ts — structural assertions on allergens, countries, score bands, etc. (8 tests)

Extracted Pure Helpers (src/lib/validation.ts)

• sanitizeRedirect(raw, fallback) — open-redirect prevention (extracted from LoginForm.tsx)
• isValidEan(code) — EAN-8/EAN-13 validation (extracted from scan/page.tsx)
• stripNonDigits(value) — input sanitization (extracted from scan/page.tsx)
• formatSlug(slug) — _ → space conversion (extracted from categories/[slug]/page.tsx)

Sonar Configuration

• sonar.javascript.lcov.reportPaths=frontend/coverage/lcov.info
• sonar.tests=frontend/src,frontend/e2e (includes unit + e2e test dirs)
• Added coverage/ to exclusions
• PL/SQL warning fix: sonar.plsql.file.suffixes=plsql,pkb,pks,pkg + db/migrations/** exclusion
• Added frontend/vitest.config.ts to exclusions

CI Workflow (.github/workflows/build.yml)

• Renamed to "CI" (was "SonarQube")
• Added Node 20 setup with npm cache
• Full pipeline: npm ci → type-check → lint → build → test:coverage → Sonar scan → Quality Gate

Documentation

• docs/SONAR.md — quality gate strategy, coverage howto, SQL exclusion rationale, known accepted issues

Verification

✓ Type-check: clean
✓ ESLint: 0 warnings/errors
✓ Build: 16 routes, all ok
✓ Tests: 56/56 passed
✓ Coverage: lcov.info generated (validation 100%, constants 100%, query-keys 89%)

Acceptance Criteria

• Coverage > 0% and reported to Sonar via lcov
• CI pipeline includes type-check, lint, build, tests, Sonar
• PL/SQL warning silenced via exclusions + file suffix restriction
• Quality gate configured for new-code-only
• docs/SONAR.md documents configuration

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
poland-food-db	Ready	Preview, Comment	Feb 14, 2026 3:51pm

[Copilot]

Pull request overview

This PR introduces comprehensive unit testing infrastructure with SonarCloud integration for the frontend codebase. It establishes a foundation for test coverage reporting and quality gate enforcement by adding Vitest with React Testing Library, extracting pure helper functions for testability, and hardening the CI pipeline.

Changes:

• Added Vitest test framework with v8 coverage reporting configured to generate lcov reports for SonarCloud
• Extracted 4 pure helper functions (sanitizeRedirect, isValidEan, stripNonDigits, formatSlug) to validation.ts with 56 comprehensive unit tests across 4 test files
• Updated CI workflow to run full pipeline (type-check → lint → build → tests → coverage → SonarCloud scan) and configured SonarCloud quality gate for new-code-only enforcement

Reviewed changes

Copilot reviewed 14 out of 16 changed files in this pull request and generated no comments.

Show a summary per file

File	Description
sonar-project.properties	Added coverage path, updated exclusions (coverage/, db/migrations/, vitest.config.ts), configured PL/SQL file suffixes, included frontend/src in test paths
frontend/vitest.config.ts	New Vitest configuration with jsdom environment, path aliases, v8 coverage provider targeting lcov+text output
frontend/src/lib/validation.ts	Extracted pure validation helpers (open-redirect prevention, EAN validation, digit stripping, slug formatting)
frontend/src/lib/validation.test.ts	25 unit tests covering all validation helper edge cases
frontend/src/lib/rpc.test.ts	10 unit tests for auth error detection logic
frontend/src/lib/query-keys.test.ts	13 unit tests verifying deterministic cache key generation and stale times
frontend/src/lib/constants.test.ts	8 structural assertion tests for constants (allergens, countries, score bands)
frontend/src/__tests__/setup.ts	Test setup file importing jest-dom matchers for Vitest
frontend/src/app/auth/login/LoginForm.tsx	Refactored to use extracted sanitizeRedirect helper
frontend/src/app/app/scan/page.tsx	Refactored to use extracted isValidEan and stripNonDigits helpers
frontend/src/app/app/categories/[slug]/page.tsx	Refactored to use extracted formatSlug helper
frontend/package.json	Added test scripts and 7 dev dependencies (vitest, @vitest/coverage-v8, @testing-library/*, jsdom, @vitejs/plugin-react)
frontend/package-lock.json	Lock file updates for all new dependencies
docs/SONAR.md	Comprehensive documentation of SonarCloud strategy, coverage reporting, SQL exclusions, CI integration
.gitignore	Added coverage/ directory exclusion
.github/workflows/build.yml	Renamed to "CI", added Node 20 setup with npm cache, full pipeline steps (install → type-check → lint → build → test:coverage → Sonar)

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
83.7% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud