fix(sonar): Batch 11 maintainability + coverage CI wiring

.github/workflows/coverage.yml

@@ -38,6 +38,20 @@ jobs:
         # the floor check, so it exists even if the floor trips.
         run: make coverage
 
+      - name: Coverage summary
+        if: always()
+        run: go tool cover -func=cover.out | tee coverage-summary.txt
+
+      - name: Upload coverage artifact
+        if: always()
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        with:
+          name: coverage
+          path: |
+            cover.out
+            coverage-summary.txt
+          if-no-files-found: error
+
       - name: Upload Coverage to Codecov
         if: always()
         uses: codecov/codecov-action@57e3a136b779b570ffcdbf80b3bdc90e7fab3de2 # v6
@@ -46,3 +60,42 @@ jobs:
           files: cover.out
           flags: unittests
           fail_ci_if_error: false
+
+  # SonarCloud: needs repo secret SONAR_TOKEN. Disable Automatic Analysis on the
+  # SonarCloud project first (mutually exclusive with CI-based analysis + Go coverage).
+  # Not a protect-main required check — advisory until the quality gate is tuned.
+  sonarcloud:
+    name: sonarcloud
+    runs-on: ubuntu-24.04
+    needs: [coverage]
+    continue-on-error: true
+    permissions:
+      contents: read
+    steps:
+      - name: Checkout
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        with:
+          fetch-depth: 0
+
+      - name: Download coverage artifact
+        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+        with:
+          name: coverage
+
+      - name: Gate on SONAR_TOKEN
+        id: sonar
+        env:
+          SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }}
+        run: |
+          if [ -z "${SONAR_TOKEN}" ]; then
+            echo "has_token=false" >> "${GITHUB_OUTPUT}"
+            echo "::warning::SONAR_TOKEN secret is unset; SonarCloud scan skipped. Add the org analysis token under Settings → Secrets → Actions, and disable Automatic Analysis on the SonarCloud project (see sonar-project.properties header)."
+          else
+            echo "has_token=true" >> "${GITHUB_OUTPUT}"
+          fi
+
+      - uses: SonarSource/sonarqube-scan-action@22918119ff8e1ca75a623e15c8296b6ea4fbe28f # v8.2.1
+        if: steps.sonar.outputs.has_token == 'true'
+        env:
+          SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }}
+

.github/workflows/sonarcloud.yaml

@@ -0,0 +1,49 @@
+# SonarCloud — manual re-scan shim. Canonical analysis is the `sonarcloud` job in
+# coverage.yml (after `make coverage` produces cover.out). Keep this workflow for
+# on-demand re-analysis of a ref.
+name: SonarCloud
+
+on:
+  workflow_dispatch: {}
+
+permissions:
+  contents: read
+
+jobs:
+  sonarcloud:
+    name: sonarcloud
+    runs-on: ubuntu-24.04
+    permissions:
+      contents: read
+    steps:
+      - name: Checkout
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        with:
+          fetch-depth: 0
+          submodules: true
+
+      - name: Setup Go
+        uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6.4.0
+        with:
+          go-version: '1.25'
+          check-latest: true
+
+      - name: Run Coverage
+        run: make coverage
+
+      - name: Gate on SONAR_TOKEN
+        id: sonar
+        env:
+          SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }}
+        run: |
+          if [ -z "${SONAR_TOKEN}" ]; then
+            echo "has_token=false" >> "${GITHUB_OUTPUT}"
+            echo "::warning::SONAR_TOKEN secret is unset; SonarCloud scan skipped. Add the org analysis token under Settings → Secrets → Actions, and disable Automatic Analysis on the SonarCloud project."
+          else
+            echo "has_token=true" >> "${GITHUB_OUTPUT}"
+          fi
+
+      - uses: SonarSource/sonarqube-scan-action@22918119ff8e1ca75a623e15c8296b6ea4fbe28f # v8.2.1
+        if: steps.sonar.outputs.has_token == 'true'
+        env:
+          SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }}

.gitignore

@@ -23,3 +23,6 @@ cover.out
 !agent-context/
 !agent-context/**
 # .claude/ (local coordination + worktrees) remains ignored by the global rule.
+
+# Sonar scanner local working directory
+.scannerwork/

.sonarcloud.properties

@@ -2,10 +2,14 @@
 #
 # SPDX-License-Identifier: CC0-1.0
 
-# SonarCloud Automatic Analysis configuration.
+# SonarCloud Automatic Analysis configuration (legacy while Autoscan is still on).
 #
-# NOTE: Automatic Analysis reads THIS file (.sonarcloud.properties) and ignores
-# any sonar-project.properties. See:
+# Go coverage requires CI-based analysis: see sonar-project.properties and the
+# `sonarcloud` job in .github/workflows/coverage.yml. Disable Automatic Analysis
+# (Administration → Analysis Method) so CI scans + cover.out are accepted.
+#
+# NOTE: While Automatic Analysis is enabled it reads THIS file and ignores
+# sonar-project.properties. See:
 # https://docs.sonarsource.com/sonarqube-cloud/analyzing-source-code/automatic-analysis/
 #
 # The new-code duplication gate (new_duplicated_lines_density <= 3%) was tripping

apis/cluster/v1alpha1/register.go

@@ -19,4 +19,7 @@ var (
 	SchemeBuilder = &scheme.Builder{GroupVersion: SchemeGroupVersion}
 )
 
-func init() {}
+func init() {
+	// Intentionally empty: CRD types register via SchemeBuilder and generated zz_*.go,
+	// not from this Upjet scaffold stub. Do not call AddToScheme here (double-register risk).
+}

apis/namespaced/v1alpha1/register.go

@@ -19,4 +19,7 @@ var (
 	SchemeBuilder = &scheme.Builder{GroupVersion: SchemeGroupVersion}
 )
 
-func init() {}
+func init() {
+	// Intentionally empty: CRD types register via SchemeBuilder and generated zz_*.go,
+	// not from this Upjet scaffold stub. Do not call AddToScheme here (double-register risk).
+}

cluster/images/provider-gridscale/Dockerfile

@@ -24,19 +24,19 @@ ENV PLUGIN_DIR=/terraform/provider-mirror/registry.terraform.io/${TERRAFORM_PROV
 ENV TF_CLI_CONFIG_FILE=/terraform/.terraformrc
 ENV TF_FORK=0
 
-RUN mkdir -p ${PLUGIN_DIR}
+RUN mkdir -p "${PLUGIN_DIR}"
 
-ADD https://releases.hashicorp.com/terraform/${TERRAFORM_VERSION}/terraform_${TERRAFORM_VERSION}_${TARGETOS}_${TARGETARCH}.zip /tmp
-ADD ${TERRAFORM_PROVIDER_DOWNLOAD_URL_PREFIX}/${TERRAFORM_PROVIDER_DOWNLOAD_NAME}_${TERRAFORM_PROVIDER_VERSION}_${TARGETOS}_${TARGETARCH}.zip /tmp
-COPY terraformrc.hcl ${TF_CLI_CONFIG_FILE}
+ADD "https://releases.hashicorp.com/terraform/${TERRAFORM_VERSION}/terraform_${TERRAFORM_VERSION}_${TARGETOS}_${TARGETARCH}.zip" /tmp
+ADD "${TERRAFORM_PROVIDER_DOWNLOAD_URL_PREFIX}/${TERRAFORM_PROVIDER_DOWNLOAD_NAME}_${TERRAFORM_PROVIDER_VERSION}_${TARGETOS}_${TARGETARCH}.zip" /tmp
+COPY terraformrc.hcl "${TF_CLI_CONFIG_FILE}"
 
-RUN unzip /tmp/terraform_${TERRAFORM_VERSION}_${TARGETOS}_${TARGETARCH}.zip -d /usr/local/bin \
+RUN unzip "/tmp/terraform_${TERRAFORM_VERSION}_${TARGETOS}_${TARGETARCH}.zip" -d /usr/local/bin \
   && chmod +x /usr/local/bin/terraform \
-  && rm /tmp/terraform_${TERRAFORM_VERSION}_${TARGETOS}_${TARGETARCH}.zip \
-  && unzip /tmp/${TERRAFORM_PROVIDER_DOWNLOAD_NAME}_${TERRAFORM_PROVIDER_VERSION}_${TARGETOS}_${TARGETARCH}.zip -d ${PLUGIN_DIR} \
-  && chmod +x ${PLUGIN_DIR}/* \
-  && rm /tmp/${TERRAFORM_PROVIDER_DOWNLOAD_NAME}_${TERRAFORM_PROVIDER_VERSION}_${TARGETOS}_${TARGETARCH}.zip \
-  && chown -R ${USER_ID}:${USER_ID} /terraform
+  && rm "/tmp/terraform_${TERRAFORM_VERSION}_${TARGETOS}_${TARGETARCH}.zip" \
+  && unzip "/tmp/${TERRAFORM_PROVIDER_DOWNLOAD_NAME}_${TERRAFORM_PROVIDER_VERSION}_${TARGETOS}_${TARGETARCH}.zip" -d "${PLUGIN_DIR}" \
+  && chmod +x "${PLUGIN_DIR}"/* \
+  && rm "/tmp/${TERRAFORM_PROVIDER_DOWNLOAD_NAME}_${TERRAFORM_PROVIDER_VERSION}_${TARGETOS}_${TARGETARCH}.zip" \
+  && chown -R "${USER_ID}:${USER_ID}" /terraform
 # End of - Setup Terraform environment
 
 # Provider controller needs these environment variable at runtime