chore(codeql): readonly fields and TryGetValue cleanups

[rlorenzo]

What

Five small CodeQL cleanups, behavior-preserving:

• readonly on single-assignment static fields (verified never reassigned):
  • VMACSService.sharedClient
  • RolesTests._sqlLiteConnection, _sqlLiteContextOptions
• TryGetValue instead of ContainsKey + indexer (single lookup):
  • RotationsController.BuildRecentCliniciansList recent-clinicians map — used TryGetValue (not GetValueOrDefault) to preserve exact behavior, since PersonDisplayFullName is nullable
  • EmergencyContactControllerTests phone-validation assertion

Resolves cs/missed-readonly-modifier (#211, #212, #213) and cs/inefficient-containskey (#475, #479).

Scope notes

Other alerts in the same batch were dismissed rather than changed: cs/local-shadows-member ×3 (idiomatic configure-setters) and cs/missed-ternary-operator ×4 (subjective style / one not type-valid as a ternary).

The agy review surfaced a separate pre-existing URL-encoding concern in VMACSService.Search (DB-sourced loginID, low exploitability) — left out of this PR to keep it scoped; tracked as a follow-up.

[codecov-commenter]

Bundle Report

Bundle size has no change ✅

[codecov-commenter]

Codecov Report

❌ Patch coverage is 0% with 3 lines in your changes missing coverage. Please review.
✅ Project coverage is 44.51%. Comparing base (367fa0e) to head (1c007b7).

Files with missing lines	Patch %	Lines
...inicalScheduler/Controllers/RotationsController.cs	0.00%	2 Missing ⚠️
web/Areas/Directory/Services/VMACSService.cs	0.00%	1 Missing ⚠️

Additional details and impacted files

@@           Coverage Diff           @@
##             main     #224   +/-   ##
=======================================
  Coverage   44.51%   44.51%           
=======================================
  Files         895      895           
  Lines       51760    51760           
  Branches     4827     4827           
=======================================
  Hits        23041    23041           
  Misses      28149    28149           
  Partials      570      570           

Flag	Coverage Δ
backend	44.67% <0.00%> (ø)
frontend	41.32% <ø> (ø)

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

[Copilot]

Pull request overview

This PR applies small, behavior-preserving CodeQL cleanups across the web app and test suite by (1) marking single-assignment static fields as readonly and (2) replacing ContainsKey + indexer patterns with TryGetValue to avoid double lookups.

Changes:

• Marked static HttpClient and SQLite test fixtures as readonly where they are never reassigned.
• Replaced ContainsKey + indexer with TryGetValue in RotationsController and an emergency-contact unit test to avoid redundant dictionary lookups.

Reviewed changes

Copilot reviewed 4 out of 4 changed files in this pull request and generated no comments.

File	Description
web/Areas/Directory/Services/VMACSService.cs	Marks the shared static HttpClient as readonly.
web/Areas/ClinicalScheduler/Controllers/RotationsController.cs	Uses TryGetValue for the recent-clinicians lookup to avoid double dictionary access.
test/Students/EmergencyContactControllerTests.cs	Uses TryGetValue for a single-lookup assertion on validation errors.
test/RAPS/RolesTests.cs	Marks static SQLite connection/options as readonly.

[rlorenzo]

@coderabbitai full review

[coderabbitai]

✅ Action performed

Full review finished.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: ASSERTIVE

Plan: Pro

Run ID: 2e566f64-67e0-4ac9-accb-f1c20c3a92c8

📥 Commits

Reviewing files that changed from the base of the PR and between 367fa0e and 1c007b7.

📒 Files selected for processing (4)

• test/RAPS/RolesTests.cs
• test/Students/EmergencyContactControllerTests.cs
• web/Areas/ClinicalScheduler/Controllers/RotationsController.cs
• web/Areas/Directory/Services/VMACSService.cs

---

📝 Walkthrough

Walkthrough

The PR makes two static fields readonly and changes two dictionary lookups to TryGetValue in controller and test code.

Changes

Immutable static fields

Layer / File(s)	Summary
Readonly static fields test/RAPS/RolesTests.cs, web/Areas/Directory/Services/VMACSService.cs	The in-memory SQLite test fields and the shared VMACS HttpClient are declared readonly after initialization.

Safe dictionary lookup

Layer / File(s)	Summary
TryGetValue lookup web/Areas/ClinicalScheduler/Controllers/RotationsController.cs, test/Students/EmergencyContactControllerTests.cs	BuildRecentCliniciansList and the validation test read dictionary entries with TryGetValue while preserving the existing fallback and assertion checks.

Estimated code review effort

🎯 2 (Simple) | ⏱️ ~10 minutes

Suggested reviewers

• bsedwards

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Docstring Coverage	⚠️ Warning	Docstring coverage is 33.33% which is insufficient. The required threshold is 80.00%.	Write docstrings for the functions missing them to satisfy the coverage threshold.

✅ Passed checks (4 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title clearly summarizes the main behavior-preserving CodeQL cleanup changes.
Description check	✅ Passed	The description matches the changeset and accurately describes the readonly and TryGetValue cleanups.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch chore/codeql-minor-cleanups

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}