fix(ci): run coverage with full test suite after E2E

[diego64]

Summary

• Move cobertura job to run after testes-e2e (sequential, not parallel)
• Add MongoDB + Redis service containers to the cobertura job
• Change coverage command from vitest run --coverage src/testes/unitarios → pnpm test:coverage (full suite)

Root Cause

vitest run --coverage src/testes/unitarios runs only the 28 unit test files, but Vitest's coverage provider (v8) still instruments all files matching coverage.include in vitest.config.ts:

coverage: {
  include: ['src/modulos/**/*.ts', 'src/compartilhado/**/*.ts'],
}

This includes infrastructure files — MongoDB repositories, Fastify routes, controllers, DTOs — that are never imported during a unit test run. Those files report 0% coverage, pulling the global numbers down:

Metric	Unit tests only	Full suite
Lines	71.62% ❌	99.61% ✅
Functions	63.84% ❌	99.53% ✅
Branches	85.20% ✅	95.51% ✅

The 80% global threshold failed on lines and functions.

Fix

The coverage job now:

1. Depends on testes-e2e (unit tests → E2E tests → coverage)
2. Has the same MongoDB 8.0 + Redis 8 service containers as the E2E job
3. Runs pnpm test:coverage — all 349 tests (unit + E2E) with coverage instrumentation

Pipeline order:

qualidade → testes-unitarios → testes-e2e → cobertura

This matches the local pnpm test:coverage output: 99.31% statements, 95.51% branches, 99.53% functions, 99.61% lines.

🤖 Generated with Claude Code

[gitguardian]

⚠️ GitGuardian has uncovered 1 secret following the scan of your pull request.

Please consider investigating the findings and remediating the incidents. Failure to do so may lead to compromising the associated services or software components.

🔎 Detected hardcoded secret in your pull request

GitGuardian id	GitGuardian status	Secret	Commit	Filename
33202264	Triggered	Username Password	2bf4d5b	.github/workflows/ci.yml	View secret

🛠 Guidelines to remediate hardcoded secrets

1. Understand the implications of revoking this secret by investigating where it is used in your code.
2. Replace and store your secret safely. Learn here the best practices.
3. Revoke and rotate this secret.
4. If possible, rewrite git history. Rewriting git history is not a trivial act. You might completely break other contributing developers' workflow and you risk accidentally deleting legitimate data.

To avoid such incidents in the future consider

• following these best practices for managing and storing secrets including API keys and other credentials
• install secret detection on pre-commit to catch secret before it leaves your machine and ease remediation.

---

^{🦉 GitGuardian detects secrets in your source code to help developers and security teams secure the modern development process. You are seeing this because you or someone else with access to this repository has authorized GitGuardian to scan your pull request.}