perf(ci): split the CI build into lint, test and scan jobs

[kthy]

Description of PR

Emulates the CI layout adopted elsewhere. The single serial build job becomes three:

• lint — one job, Python 3.12 only, runs just lint-ci. No longer waits behind (or repeats across) the test matrix, so a lint failure surfaces fast.
• test — the 3.12/3.13/3.14 matrix, runs just test. The 3.12 job uploads coverage.xml as an artifact (1 day retention).
• scan — needs: test, downloads that coverage artifact instead of recomputing it, caches ~/.sonar/cache, then runs Sonar and the DefectDojo push. fetch-depth: 0 now applies only here, where Sonar needs it.

The scan job is skipped on draft PRs, and ready_for_review is added to the pull_request trigger types so marking a draft ready re-runs the workflow (including Sonar).

Link to the Jira ticket

No ticket — tooling chore, aligning this repo's CI with Utiligize/assetlife-api.

How to verify that it worked

Verified with a workflow_dispatch run on this branch: https://github.com/Utiligize/configator-op/actions/runs/30077530190 — Lint 10s, the three test jobs in parallel (16–20s each), Scan 52s afterwards consuming the uploaded coverage artifact.

Note that pushes to branches containing a / do not match the existing branches: ['*'] push filter, so branch CI here runs via the pull_request trigger (or dispatch). That pre-existing quirk is untouched by this PR.

Locally validated with actionlint and zizmor --persona=auditor (no findings).

Are the changes in this PR covered by tests run by the CI workflow? - If no, then describe how it was tested below the checkboxes.

• No
• Yes

🤖 Generated with Claude Code

Summary by CodeRabbit

• CI Improvements
  • CI now reruns when a draft pull request is marked ready for review.
  • Linting, tests, and code scanning run as separate jobs.
  • Tests run across Python 3.12, 3.13, and 3.14.
  • Code scanning uses test coverage results and is skipped for draft pull requests.
• Documentation
  • Updated the changelog to describe the revised CI pipeline.

[coderabbitai]

📝 Walkthrough

Walkthrough

The CI workflow now separates linting, matrix testing, and scanning. Python 3.12 coverage is passed to a dependent scan job, which skips draft pull requests. The changelog documents the updated pipeline.

Changes

CI pipeline restructuring

Layer / File(s)	Summary
Lint and test job split .github/workflows/ci.yml	The workflow responds to ready_for_review, adds a dedicated lint job, and runs tests across Python 3.12, 3.13, and 3.14.
Coverage-driven scan orchestration .github/workflows/ci.yml, CHANGELOG.md	Python 3.12 uploads coverage for a dependent scan job, which skips draft pull requests, runs SonarQube, pushes results to DefectDojo, and is documented in the changelog.

Estimated code review effort: 3 (Moderate) | ~20 minutes

Sequence Diagram(s)

sequenceDiagram
  participant PullRequest
  participant TestMatrix
  participant CoverageArtifact
  participant ScanJob
  participant SonarQube
  participant DefectDojo
  PullRequest->>TestMatrix: trigger CI on ready_for_review
  TestMatrix->>CoverageArtifact: upload Python 3.12 coverage.xml
  TestMatrix->>ScanJob: complete test job
  ScanJob->>CoverageArtifact: download coverage.xml
  ScanJob->>SonarQube: run analysis
  ScanJob->>DefectDojo: push scan results

Loading

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Title check	✅ Passed	The title clearly summarizes the main change: splitting CI into lint, test, and scan jobs.
Description check	✅ Passed	All required sections are present, including description, Jira note, verification steps, and CI test coverage status.

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch feature/ci-split-jobs

---

_{Comment @coderabbitai help to get the list of available commands.}

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud