fix: Feature/sonarqube3 (#6)

* patch: code coverage

* fix: ci fix

* fix: ci fix

---------

Co-authored-by: sdine <sdine@sdine.com>

.github/workflows/AGENTS.md

@@ -37,6 +37,7 @@ GitHub Actions workflows for CI, release automation, and policy checks.
 
 - Prefer minimal, surgical edits; avoid large workflow rewrites unless requested.
 - Reusable workflows should declare explicit `workflow_call` inputs for required context (e.g., version, merge SHA).
+- Sonar coverage steps that use `gcovr` must exclude third-party build trees at discovery time with `--exclude-directories` (for example `build/_deps`) so gcov does not process dependency `.gcda` files.
 - Keep `permissions` least-privilege:
   - reusable build workflows: `contents: read`
   - release/tag orchestrator: `contents: write`

.github/workflows/feature-ci.yml

@@ -52,6 +52,7 @@ jobs:
           gcovr -r .
           --sonarqube build/sonarqube-coverage.xml
           --exclude "build/_deps/"
+          --exclude-directories "build/_deps"
 
       - name: SonarQube Cloud scan
         uses: SonarSource/sonarqube-scan-action@v5

.github/workflows/master-ci.yml

@@ -52,6 +52,7 @@ jobs:
           gcovr -r .
           --sonarqube build/sonarqube-coverage.xml
           --exclude "build/_deps/"
+          --exclude-directories "build/_deps"
 
       - name: SonarQube Cloud scan
         uses: SonarSource/sonarqube-scan-action@v5