Add submissions/shared SonarCloud scans

[snesm]

This PR adds a build action for /submissions and add /shared and /submissions to sonarcloud testing.

Note that /submissions does not have coverage statistics which may skew results.

If you are suggesting a fix for a currently exploitable issue, please disclose the issue to the prime-reportstream team directly outside of GitHub instead of filing a PR, so we may immediately patch the affected systems before a disclosure. See SECURITY.md/Reporting a Vulnerability for more information.

Test Steps:

1. Include steps to test these changes

Changes

• Include a comprehensive list of changes in this PR
• (For web UI changes) Include screenshots/video of changes

Checklist

Testing

• Tested locally?
• Ran ./prime test or ./gradlew testSmoke against local Docker ReportStream container?
• (For Changes to /frontend-react/...) Ran npm run lint:write?
• Added tests?

Process

• Are there licensing issues with any new dependencies introduced?
• Includes a summary of what a code reviewer should test/verify?
• Updated the release notes?
• Database changes are submitted as a separate PR?
• DevOps team has been notified if PR requires ops support?

Linked Issues

• Fixes SonarCloud scan /shared and /submissions #15442

To Be Done

Create GitHub issues to track the work remaining, if any

• #issue

Specific Security-related subjects a reviewer should pay specific attention to

• Does this PR introduce new endpoints?
  • new endpoint A
  • new endpoint B
• Does this PR include changes in authentication and/or authorization of existing endpoints?
• Does this change introduce new dependencies that need vetting?
• Does this change require changes to our infrastructure?
• Does logging contain sensitive data?
• Does this PR include or remove any sensitive information itself?

If you answered 'yes' to any of the questions above, conduct a detailed Review that addresses at least:

• What are the potential security threats and mitigations? Please list the STRIDE threats and how they are mitigated
  • Spoofing (faking authenticity)
    • Threat T, which could be achieved by A, is mitigated by M
  • Tampering (influence or sabotage the integrity of information, data, or system)
  • Repudiation (the ability to dispute the origin or originator of an action)
  • Information disclosure (data made available to entities who should not have it)
  • Denial of service (make a resource unavailable)
  • Elevation of Privilege (reduce restrictions that apply or gain privileges one should not have)
• Have you ensured logging does not contain sensitive data?
• Have you received any additional approvals needed for this change?

[github-actions]

Dependency Review

✅ No vulnerabilities or license issues or OpenSSF Scorecard issues found.

OpenSSF Scorecard

Package	Version	Score	Details

Scanned Manifest Files

[github-actions]

Test Results

1 209 tests  ±0   1 205 ✅ ±0   6m 25s ⏱️ -2s
  158 suites ±0       4 💤 ±0 
  158 files   ±0       0 ❌ ±0 

Results for commit 80d918b. ± Comparison against base commit 3be35cf.

♻️ This comment has been updated with latest results.

[github-actions]

Integration Test Results

 63 files   63 suites   29m 26s ⏱️
436 tests 427 ✅ 9 💤 0 ❌
439 runs  430 ✅ 9 💤 0 ❌

Results for commit 80d918b.

♻️ This comment has been updated with latest results.

[snesm]

requires build action/workflow for /submissions and /shared to generate supporting files for SonarCloud

[github-actions]

Branch deployed to Chromatic 🚀.

• ⚠️ Detected 0 tests with visual changes.
• ✅ All tests passed.

View via:

• Chromatic: https://www.chromatic.com/build?appId=6419b81d4a47163c3050f14a&number=855
• Storybook: https://6419b81d4a47163c3050f14a-eollszgmeg.chromatic.com/

[github-actions]

⚠️ Broken Links ⚠️

❌ https://www.cdph.ca.gov/Programs/CID/DCDC/Pages/CalREDIE.aspx

Error: timeout of 10000ms exceeded

---

[sonarcloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarCloud