👷 [ci] (coverage) Preserve repository paths in Codecov reports

[Nick2bad4u]

Summary

Fix Codecov provider processing for the Python security-alert skill report without weakening its coverage gate.

Changes

• emit repository-relative Cobertura filenames through coverage.py include configuration
• disable provider report-age rejection to avoid the upstream millisecond timestamp failure
• keep the 75 percent test threshold and add current Ruff-required copyright notices so fresh CI installs reach the upload step

Validation

• Codecov YAML validator: valid
• 51 pytest tests passed
• local branch coverage: 81.82 percent
• report preflight: 6 of 6 paths resolve inside the repository, current millisecond timestamp, ready for upload
• Ruff 0.16.4, mypy 2.3.1, Pyright 1.1.411, compileall, release verify, and production audit passed

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ All tests successful. No failed tests found.

@@           Coverage Diff           @@
##             main      #10   +/-   ##
=======================================
  Coverage        ?   80.68%           
=======================================
  Files           ?        6           
  Lines           ?      994           
  Branches        ?      141           
=======================================
  Hits            ?      802           
  Misses          ?      143           
  Partials        ?       49           

Flag	Coverage Δ
python	80.68% <ø> (?)

Flags with carried forward coverage won't be shown. Click here to find out more.

Files with missing lines	Coverage Δ
...age-security-alerts/scripts/github_security_api.py	93.90% <ø> (ø)
...age-security-alerts/scripts/github_security_cli.py	100.00% <ø> (ø)
...-security-alerts/scripts/github_security_common.py	100.00% <ø> (ø)
...urity-alerts/scripts/github_security_operations.py	56.88% <ø> (ø)
...-security-alerts/scripts/github_security_render.py	91.66% <ø> (ø)
...ty-alerts/scripts/manage_github_security_alerts.py	84.61% <ø> (ø)

🚀 New features to boost your workflow:

• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 92c32a7dfe

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

Preserve source discovery in the coverage gate

Replacing source with include weakens the coverage run used by the “Run coverage tests” step in .github/workflows/python-tests.yml: coverage.py uses include only to filter files it observed, whereas source also discovers eligible files that were never executed. If a new production module under this scripts directory is not imported by any test, it will now be omitted entirely instead of contributing zero-covered lines, allowing the 75% gate to pass despite the missing tests. Retain source discovery (for example from the repository root) and apply the production-path filter at report time so repository-relative XML paths are preserved without shrinking the denominator.

Useful? React with 👍 / 👎.