test(ci): pin the sonar job structurally, allowing the merge-queue skip

The sonar caller check matched the literal text 'needs: pytest' followed by
'uses:', so adding the merge_group skip between them failed it. Parse the job
instead: it still must need this run's pytest job and call the local reusable
workflow, and its only condition may be the merge_group skip, so a status
function such as always() cannot run analysis without same-run coverage.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Signed-off-by: song <22676124+songoow@users.noreply.github.com>

Author: songoow

tests/test_sonarcloud_workflow.py

@@ -4,6 +4,7 @@
 from pathlib import Path
 
 import pytest
+import yaml
 
 WORKFLOW = Path(__file__).resolve().parents[1] / ".github" / "workflows" / "sonarcloud.yml"
 
@@ -71,6 +72,12 @@ def test_sonar_reuses_same_run_coverage_without_a_privileged_trigger() -> None:
     assert "name: python-coverage-xml" in workflow
     assert "run-id:" not in workflow
     assert "github-token:" not in workflow
-    assert "needs: pytest\n    uses: ./.github/workflows/sonarcloud.yml" in caller
+    sonar = yaml.safe_load(caller)["jobs"]["sonar"]
+    # Coverage comes from this run's pytest job, handed to the local reusable
+    # workflow. The only condition may skip merge-queue refs; a status function
+    # such as always() would let analysis run without that coverage.
+    assert sonar["needs"] == "pytest"
+    assert sonar["uses"] == "./.github/workflows/sonarcloud.yml"
+    assert sonar.get("if") == "github.event_name != 'merge_group'"
     assert '"apps/**"' in caller
     assert '"sonar-project.properties"' in caller