Draft: ci: adopt go-test framework coverage, remove common-ci-tasks-patches

Draft — verifying CI before marking ready.

Work item: modular-feature-testing#9 — UAR: adopt go-test and remove the when:never patch (Epic 189). Coverage aggregation enabler: modular-feature-testing#4559 (merged).

Closes gitlab-org/quality/quality-engineering/modular-feature-testing#9

---

Removes .gitlab/ci/common-ci-tasks-patches.yml entirely. UAR now resolves go-test@v0.4.0 (via golang-build v4.29), which adds multi-job coverage aggregation (modular-feature-testing!36) — so the framework's integration + coverage jobs can be adopted instead of disabled.

What changed

• test:integration → test:go:integration (pg suite). It now overrides the framework's default integration job, so the default go test -tags=integration ./... (no services) never runs — which is why it was disabled.
• Coverage model: every integration job writes a distinct coverage-integration-${CI_JOB_NAME_SLUG}.txt profile (matches the framework's coverage-integration*.txt glob). Dropped each job's gocover-cobertura step, coverage_report artifact, and coverage: regex.
• post-test:go:coverage now needs all our integration jobs (via !reference [.go-coverage-needs, needs] + the extra jobs), so the framework merges every profile into one threshold gate.
• Deleted the patch file and its include: line.

Trade-off: per-job cobertura → single merged gate

We lose per-suite coverage percentages in the pipeline view; we gain one meaningful total (unit + all integration merged) with an enforced threshold. MR diff-coverage annotations are unaffected (the framework's merged cobertura drives them, more completely).

Security note — dropping the pinned gocover-cobertura

The gcs/s3-aws jobs run with live cloud credentials and pinned gocover-cobertura@v1.5.0 to prevent a compromised release from exfiltrating them. Removing it is a net improvement, not a regression:

• Those jobs no longer run gocover-cobertura at all — only first-party go test/go tool cover. No third-party binary executes alongside the live credentials, so the exfiltration vector the pin guarded is eliminated, not just mitigated.
• gocover-cobertura now runs only in the framework's post-test:go:coverage, which merges profiles and has no cloud credentials — nothing to exfiltrate.
• Caveat: that framework job installs the tool @latest (unpinned). Lower severity (non-credentialed), and tracked for pinning centrally in go-test (modular-feature-testing#11). UAR no longer needs per-job pins because the tool moved out of its credentialed jobs.

Validation

Pipeline green on the draft: composes, and post-test:go:coverage runs (no longer disabled) and merges unit + 7 distinct integration profiles into one total (Total coverage: 59.5%, gate passes). Three jobs (test:go:integration, s3-aws, gcs-instance-creds) are gated out by their changes: rules on a CI-only diff — a follow-up dummy-trigger run can exercise those before marking ready.

🤖 Generated with Claude Code