refactor(artifacts): timezone-aware UTC timestamps (Sonar S6903)

apps/backend/cli/artifacts.py

@@ -10,7 +10,7 @@
 import logging
 import shutil
 import sys
-from datetime import datetime
+from datetime import UTC, datetime
 from pathlib import Path
 from typing import Any
 
@@ -27,6 +27,11 @@
 _ALLOWED_VERDICTS = ("approved", "rejected", "error")
 
 
+def _utc_timestamp() -> str:
+    """Timezone-aware UTC timestamp in ISO-8601 with a trailing ``Z``."""
+    return datetime.now(UTC).isoformat().replace("+00:00", "Z")
+
+
 class ArtifactManager:
     """
     Manages build artifacts for CI/CD pipelines.
@@ -104,7 +109,7 @@ def save_build_log(self, build_data: dict[str, Any]) -> Path | None:
             # Add metadata timestamp if not present (use a copy to avoid mutating caller's dict)
             if "timestamp" not in build_data:
                 build_data = dict(build_data)
-                build_data["timestamp"] = datetime.utcnow().isoformat() + "Z"
+                build_data["timestamp"] = _utc_timestamp()
 
             # Write build log with pretty formatting
             with open(artifact_path, "w", encoding="utf-8") as f:
@@ -154,7 +159,7 @@ def save_test_report(
             # Add metadata timestamp if not present (use a copy to avoid mutating caller's dict)
             if "timestamp" not in test_data:
                 test_data = dict(test_data)
-                test_data["timestamp"] = datetime.utcnow().isoformat() + "Z"
+                test_data["timestamp"] = _utc_timestamp()
 
             # Write test report with pretty formatting
             with open(artifact_path, "w", encoding="utf-8") as f:
@@ -204,7 +209,7 @@ def save_coverage_report(
             # Add metadata timestamp if not present (use a copy to avoid mutating caller's dict)
             if "timestamp" not in coverage_data:
                 coverage_data = dict(coverage_data)
-                coverage_data["timestamp"] = datetime.utcnow().isoformat() + "Z"
+                coverage_data["timestamp"] = _utc_timestamp()
 
             # Write coverage report with pretty formatting
             with open(artifact_path, "w", encoding="utf-8") as f:
@@ -250,7 +255,7 @@ def save_verification_report(
             # Add timestamp if not present (copy to avoid mutating caller's dict)
             if "timestamp" not in verification_data:
                 verification_data = dict(verification_data)
-                verification_data["timestamp"] = datetime.utcnow().isoformat() + "Z"
+                verification_data["timestamp"] = _utc_timestamp()
 
             with open(artifact_path, "w", encoding="utf-8") as f:
                 json.dump(verification_data, f, indent=2)
@@ -317,7 +322,7 @@ def save_custom_artifact(
                 # Add timestamp if not present (use a copy to avoid mutating caller's dict)
                 if "timestamp" not in data:
                     data = dict(data)
-                    data["timestamp"] = datetime.utcnow().isoformat() + "Z"
+                    data["timestamp"] = _utc_timestamp()
 
                 # Write JSON data
                 with open(artifact_path, "w", encoding="utf-8") as f: