chore(ci): add SonarCloud scan job to the build-test workflow

[devin-ai-integration]

Summary

Adds a SonarCloud scan to CircleCI, mirroring Open-MBEE/flexo-mms-layer1-service so its existing SonarCloud context (which supplies SONAR_TOKEN) is reused with no new credential:

• orb sonarsource/sonarcloud@4.0.0 (pinned, same as layer1) and a scan job in the build-test workflow with requires: [build-and-test], context: [SonarCloud], and the same branch/tag filters as the workflow's other jobs.
• sonar-project.properties in the Go form (sonar.sources=. / sonar.tests=. / sonar.test.inclusions, per the current Sonar Go docs): hand-written Go and python/opensysml are source; **/*_test.go and python/tests/** are tests; fixture/corpus/generated trees are excluded (**/testdata/**, examples/** incl. the fetched OMG corpus, python/tests/golden/**, **/*.pb.go, generated internal/core/rdf/ontology/table.go). scripts/ and .github/workflows stay in scope on purpose. No vendor/ dir exists, so none is excluded.
• build-and-test already writes coverage.txt but only persisted bin/sysml-grpc; coverage.txt is now persisted too, and the scan job attaches the workspace at the checkout root (where sonar.go.coverage.reportPaths=coverage.txt resolves) and prints the file so an absent profile is visible rather than silently analysed as no coverage.
• Fork/PR safety: the scan job's first step halts successfully (circleci-agent step halt) when SONAR_TOKEN is empty, since forked PRs never receive the context. With a token present, a failing scan fails the job.
• The scan job un-shallows the clone (git rev-parse --is-shallow-repository guard) because SonarCloud needs full history for blame/new-code, and a when: on_fail step points at the setup doc.
• Docs: a "The SonarCloud scan" section in docs/project/releasing.md covering the context name, what the scan reads, fork behaviour, and the one-time project-provisioning step (already done for Open-MBEE_OpenSysML; kept because a CI-run scan cannot auto-create a project).

Scope corrections and coverage wiring only — no rule silencing, severity changes, or quality-gate overrides.

Baseline from the first scan of main @ a6544ed (public API, api/measures/component?component=Open-MBEE_OpenSysML&metricKeys=ncloc,coverage): ncloc=157022, no coverage/lines_to_cover measure at all, and the analysis included examples/, python/tests/golden, and api/proto. The exclusions above should drop the fixture/generated trees from the analysis, and coverage should appear — provable only on the first CI run of this config, since the scan needs the CI-side SONAR_TOKEN.

No existing job's commands, gates, or filters changed beyond the added workspace path.

Verification: circleci config validate .circleci/config.yml → valid; go build ./..., go vet ./..., gofmt -l . (empty), go test ./..., the training-corpus gate with OPENSYSML_REQUIRE_TRAINING_CORPUS=1, and python3 scripts/check-doc-links.py all pass. The scan itself was not exercised locally (no SONAR_TOKEN, context is CI-only).

Link to Devin session: https://nasa-jpl-demo.devinenterprise.com/sessions/6b0bcfcf8a4547b78190001d31c4e7b7
Requested by: @HuiJun

[devin-ai-integration]

Original prompt from Devin Bot

# Task: add a SonarCloud/SonarQube scan job to OpenSysML's CircleCI pipeline

Work in the GitHub repository JPL-Devin/OpenSysML (Go 1.23+). Read AGENTS.md first.
Branch as devin/$(date +%s)-circleci-sonar-scan off current main and open a PR into main.

#``# Why / what the target looks like

Open-MBEE/flexo-mms-layer1-service already runs this scan, and we want the same
CircleCI context reused so no new credential has to be provisioned. Its setup, which I
read from that repo directly, is the model to copy:

• orb sonarsource/sonarcloud@4.0.0

• a scan job that requires the build/test job, runs checkout, un-shallows the clone
  (git fetch --unshallow guarded by git rev-parse --is-shallow-repository, which
  SonarCloud needs for blame/new-code), and then the orb's sonarcloud/scan step

• the job references the CircleCI context named exactly SonarCloud (that context is
  what supplies SONAR_TOKEN)

• a sonar-project.properties at the repo root, which for layer1 reads:

  sonar.projectKey=Open-MBEE_flexo-mms-layer1-service
  sonar.organization=openmbee
  sonar.language=kotlin
  sonar.coverage.jacoco.xmlReportPaths=build/reports/jacoco/test/jacocoTestReport.xml
  sonar.sources=src/main/
  sonar.tests=src/test/
  

#``# What to implement here

1. sonar-project.properties at the OpenSysML repo root, the Go equivalent:
   • sonar.projectKey=Open-MBEE_OpenSysML, sonar.organization=openmbee
   • sources and tests split the way Sonar wants for Go: sonar.sources covering the Go
     tree and the test split expressed the way Sonar's Go analyzer actually reads it
     (sonar.tests / sonar.test.inclusions with **/*_test.go rather than a separate
     test directory) — check the current Sonar Go docs and use that form.
   • coverage from the profile the existing suite already writes: build-and-test runs
     go test -v -race -coverprofile=coverage.txt -covermode=atomic ./..., so wire
     `sonar.go.coverage.reportPaths=... (3294 chars truncated...)

[devin-ai-integration]

🤖 Devin AI Engineer

I'll be helping with this pull request! Here's what you should know:

✅ I will automatically:

• Address comments on this PR that start with 'DevinAI' or '@devin'.
• Look at CI failures and help fix them

Note: I can only respond to comments from users who have write access to this repository.

⚙️ Control Options:

• Disable automatic comment, CI, and merge conflict monitoring

[devin-ai-integration]

✅ Devin Review: No Issues Found

Devin Review analyzed this PR and found no potential bugs to report.

View in Devin Review to see 1 additional finding.