ci: schedule NVIDIA OpenCode maintenance agent

.github/workflows/ci.yml

@@ -28,8 +28,17 @@ jobs:
         os: [ubuntu-latest, macos-latest, windows-latest]
     runs-on: ${{ matrix.os }}
     steps:
-      - name: Checkout
+      - name: Checkout exact source revision
         uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        with:
+          ref: ${{ github.event.pull_request.head.sha || github.sha }}
+          persist-credentials: false
+
+      - name: Verify exact source revision
+        shell: bash
+        run: |
+          set -euo pipefail
+          test "$(git rev-parse HEAD)" = "${{ github.event.pull_request.head.sha || github.sha }}"
 
       - name: Set up Java
         uses: actions/setup-java@1bcf9fb12cf4aa7d266a90ae39939e61372fe520 # v5.4.0
@@ -46,12 +55,100 @@ jobs:
         if: runner.os == 'Windows'
         run: .\\mvnw.cmd -B test
 
+      - name: Report uncovered JaCoCo branches
+        if: failure()
+        shell: bash
+        run: |
+          python_command="python3"
+          if ! command -v "${python_command}" >/dev/null 2>&1; then
+            python_command="python"
+          fi
+          "${python_command}" - <<'PY'
+          from pathlib import Path
+          import xml.etree.ElementTree as ElementTree
+
+          coverage_targets = {
+              "com/xtrmetl/etl/job/EtlJobService": "EtlJobService.java",
+              "com/xtrmetl/etl/controller/EtlJobController": "EtlJobController.java",
+              "com/xtrmetl/etl/service/Sha256Digest": "Sha256Digest.java",
+          }
+          reports = sorted(Path(".").glob("**/target/site/jacoco/jacoco.xml"))
+          if not reports:
+              raise SystemExit("No JaCoCo XML report was produced")
+
+          found_classes = {class_name: False for class_name in coverage_targets}
+          for report_path in reports:
+              report_root = ElementTree.parse(report_path).getroot()
+              for class_name, source_name in coverage_targets.items():
+                  for class_element in report_root.findall(
+                      f".//class[@name='{class_name}']"
+                  ):
+                      found_classes[class_name] = True
+                      print(f"JaCoCo branch diagnostics for {class_name} from {report_path}:")
+                      for method_element in class_element.findall("method"):
+                          for counter in method_element.findall("counter"):
+                              if counter.get("type") != "BRANCH":
+                                  continue
+                              missed = int(counter.get("missed", "0"))
+                              if missed > 0:
+                                  print(
+                                      "  method="
+                                      f"{method_element.get('name')}{method_element.get('desc')} "
+                                      f"first_line={method_element.get('line')} "
+                                      f"missed_branches={missed} "
+                                      f"covered_branches={counter.get('covered', '0')}"
+                                  )
+
+                  for source_element in report_root.findall(
+                      f".//sourcefile[@name='{source_name}']"
+                  ):
+                      for line_element in source_element.findall("line"):
+                          missed = int(line_element.get("mb", "0"))
+                          if missed > 0:
+                              print(
+                                  f"  source={source_name} "
+                                  f"source_line={line_element.get('nr')} "
+                                  f"missed_branches={missed} "
+                                  f"covered_branches={line_element.get('cb', '0')}"
+                              )
+
+          missing_classes = [
+              class_name
+              for class_name, was_found in found_classes.items()
+              if not was_found
+          ]
+          if missing_classes:
+              raise SystemExit(
+                  "Strict coverage targets absent from JaCoCo XML: "
+                  + ", ".join(missing_classes)
+              )
+          PY
+
   test_self_hosted:
     if: ${{ github.event_name == 'workflow_dispatch' && inputs.use_self_hosted == true }}
     runs-on: self-hosted
     steps:
-      - name: Checkout
+      - name: Checkout exact source revision
         uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        with:
+          ref: ${{ github.event.pull_request.head.sha || github.sha }}
+          persist-credentials: false
+
+      - name: Verify exact source revision (Unix)
+        if: runner.os != 'Windows'
+        shell: bash
+        run: |
+          set -euo pipefail
+          test "$(git rev-parse HEAD)" = "${{ github.event.pull_request.head.sha || github.sha }}"
+
+      - name: Verify exact source revision (Windows)
+        if: runner.os == 'Windows'
+        shell: pwsh
+        run: |
+          $actualHead = git rev-parse HEAD
+          if ($actualHead -ne "${{ github.event.pull_request.head.sha || github.sha }}") {
+            throw "Checked-out revision does not match the expected source SHA."
+          }
 
       - name: Set up Java
         uses: actions/setup-java@1bcf9fb12cf4aa7d266a90ae39939e61372fe520 # v5.4.0