How were your test coverage and vulnerability checks organized in the CI pipeline?

In CI pipelines for Java projects, several stages are usually configured to check test coverage and vulnerabilities:

1. Test Coverage: Tools like JaCoCo or Cobertura are used, which integrate with Maven or Gradle. Unit tests are run in the pipeline, and a coverage report is generated. If coverage falls below a set threshold (e.g., 80%), the build is considered failed.

2. Vulnerability Check: Dependency analysis tools like OWASP Dependency-Check or Snyk scan libraries for known vulnerabilities. Static code analysis with SonarQube can also be run to identify potential security issues.

Example Maven configuration for JaCoCo and coverage check:

<plugin>
  <groupId>org.jacoco</groupId>
  <artifactId>jacoco-maven-plugin</artifactId>
  <version>0.8.7</version>
  <executions>
    <execution>
      <goals>
        <goal>prepare-agent</goal>
      </goals>
    </execution>
    <execution>
      <id>report</id>
      <phase>test</phase>
      <goals>
        <goal>report</goal>
      </goals>
    </execution>
  </executions>
</plugin>

After the build, a script is run in CI (e.g., Jenkins, GitLab CI) to check coverage metrics and vulnerability scan results, and if issues are found, the deployment is halted.