chore: generate coverage report so sonarqube coverage gate is valid (#393)

# Pull Request

## 🧾 Ticket Link

<!-- Add the Jira ticket link here -->

https://nhsd-jira.digital.nhs.uk/browse/NPA-XXXX

---

## 📄 Description/Summary of Changes

<!-- Describe the changes made in this PR. Include the
purpose/scope/impact of the changes -->

- Any change to sandbox code was failing the sonarqube test coverage
check because it has no coverage report to check. This PR adds a test
run to the pipeline, which generates the coverage report. It this
updates the sonar config to tell it where to look for the coverage
report to check the change in covered lines.

---

## 🧪 Developer Testing Carried Out

<!-- Describe what tests (automated/unit/manual etc.) have been done for
the ticket. Include: -->
<!-- - Any tests added/updated -->
<!-- - Evidence that each acceptance criterion from the Jira ticket is
met -->
<!-- - Evidence of tests running eg. link to github workflow with tests
passing or screenshot of tests running locally -->

- <!-- Briefly describe the testing carried out in this PR -->

---

## 📋 PR Principles

<!-- Principles we as a team follow when conducting a PR -->

- Keep PRs Small and Focused: Ensure the PR addresses a single task or
feature to make it easier to review.
- Multiple PRs for one Ticket: When splitting work into multiple PRs,
clearly describe what this PR addresses and outline the remaining work
to complete the ticket.
- Ensure Tests Are Included: Add or update unit, integration, or
end-to-end tests to cover the changes made.
- Follow Coding Standards: Ensure the code adheres to the team's coding
guidelines and best practices.
- Resolve Comments Promptly: If you raise a comment, ensure you follow
up and resolve it before approving the PR to maintain clarity and ensure
comments are addressed.
- Foster Learning: PR reviews are an opportunity to share knowledge,
provide constructive feedback, and encourage a collaborative
environment.

## 🏷️ Naming Conventions Reminder

Please ensure the following naming conventions are followed:

- PR title follows the format: `NPA-XXXX: <short-description>`
- Branch name follows the convention:
`<type>/NPA-XXXX/<short-description>`
- Commit messages follow the template: `NPA-XXXX: <short-description>`

Author: hatwell

.github/workflows/sonarcloud.yml

@@ -17,6 +17,20 @@ jobs:
       - uses: actions/checkout@v4
         with:
           fetch-depth: 0
+      - name: Install poetry
+        run: pipx install poetry
+      - uses: actions/setup-python@v5
+        with:
+          python-version: "3.13"
+          cache: "poetry"
+      - name: Install Sandbox dependencies
+        working-directory: sandbox
+        run: poetry install
+      - name: Generate Sandbox coverage report
+        run: |
+          VENV_PATH=$(cd sandbox && poetry env info --path)
+          "$VENV_PATH/bin/pytest" --cov=sandbox/api --cov-config=sandbox/.coveragerc \
+            --cov-report=xml:sandbox/coverage.xml sandbox/api/tests
       - name: SonarCloud Scan
         uses: SonarSource/sonarqube-scan-action@fd88b7d7ccbaefd23d8f36f73b59db7a3d246602 # v6
         env:

.gitignore

@@ -29,3 +29,11 @@ sandbox/archive/
 sandbox/.hypothesis/
 
 .tool-versions
+
+
+# unit test coverage reports
+.coverage
+sandbox/.coverage
+sandbox/coverage.xml
+htmlcov
+lambdas/htmlcov

sandbox/.coveragerc

@@ -0,0 +1,2 @@
+[run]
+relative_files = True

sonar-project.properties

@@ -2,4 +2,5 @@ sonar.projectKey=NHSDigital_validated-relationships-service-api
 sonar.organization=nhsdigital
 sonar.exclusions=**/node_modules/**,**/dist/**,**/tests/**
 sonar.sources=sandbox
-sonar.python.version=3.13
+sonar.python.version=3.13
+sonar.python.coverage.reportPaths=sandbox/coverage.xml