GitHub actions improvements with code coverage

[kamdubiel]

RELATED HANDBOOK PR: https://github.com/infinum/frontend-handbook-private/pull/89
HANDBOOK STAGING CHAPTER: https://beta.infinum.com/handbook/frontend/react/testing/visible-test-coverage

Summary

This PR refactors GitHub Actions workflows, improves security, and adds visible test coverage reporting.

Changes

🔄 GitHub Actions Refactoring

• Split workflows: Replaced single code-analysis.yml with modular ci.yml workflow containing separate parallel jobs:
  • lint: Code analysis (Prettier + ESLint)
  • licenses: License compliance checks
  • build: Package builds
• Reusable composite actions: Extracted common logic into reusable actions:
  • node-setup: Node.js environment setup with caching
  • code-analysis: Linting and formatting checks
  • check-licenses: License validation
• Separated coverage: Moved test coverage to dedicated coverage.yml workflow

🔒 Security Improvements

• Pinned action versions: Replaced all version tags (e.g., @v4, @v7) with commit SHA hashes to prevent supply chain attacks from compromised version tags
  • actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5
  • actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020
  • actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830
  • actions/github-script@f28e40c7f34bde8b3046d885e986cb6290c5673b
  • actions/download-artifact@634f93cb2916e3fdff6788551b99b062d0335ce0
  • actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02
• Increased minimumReleaseAge to 10 days

📊 Test Coverage Visibility

• New coverage workflow (coverage.yml):
  • Runs tests with coverage on PRs and main branch
  • Aggregates monorepo coverage results
  • Posts coverage diff comments on PRs comparing against base branch
  • Generates GitHub Actions job summaries with detailed coverage metrics
• Enhanced scripts:
  • aggregate-coverage-results.js: Generates combined coverage summaries and GitHub Actions job summaries
  • comment-coverage-diff.js: Posts/updates PR comments with coverage comparisons (total + per-package for monorepos)

📦 Additional Changes

• Updated .gitignore to exclude coverage artifacts
• Added @actions/core dependency for GitHub Actions integration
• Updated pnpm-workspace.yaml configuration

[github-actions]

Coverage diff

Metric	PR	main	Δ
Statements	28.16%	N/A	N/A
Branches	44.07%	N/A	N/A
Functions	46.03%	N/A	N/A
Lines	26.83%	N/A	N/A

Base coverage artifact missing; only PR coverage is shown.

🧮 Per-package delta

Package	Metric	PR	main	Δ
frontend	Statements	20.22%	N/A	N/A
	Branches	35.41%	N/A	N/A
	Functions	21.62%	N/A	N/A
	Lines	20.22%	N/A	N/A
ui	Statements	80.00%	N/A	N/A
	Branches	81.81%	N/A	N/A
	Functions	80.76%	N/A	N/A
	Lines	82.47%	N/A	N/A