chore: remove checkmarx sast job

[acolom-bw]

📔 Objective

Going through the code and removing all instances of Checkmarx and SonarQube.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 85.67%. Comparing base (dc64c00) to head (935120e).

Additional details and impacted files

@@            Coverage Diff             @@
##             main    #7225      +/-   ##
==========================================
- Coverage   86.78%   85.67%   -1.12%     
==========================================
  Files         874     1035     +161     
  Lines       64389    67553    +3164     
  Branches     9703     9800      +97     
==========================================
+ Hits        55883    57878    +1995     
- Misses       5037     6180    +1143     
- Partials     3469     3495      +26     

Flag	Coverage Δ
app-data	17.71% <ø> (-0.07%)	⬇️
app-ui-auth-tools	19.05% <ø> (+0.31%)	⬆️
app-ui-platform	17.05% <ø> (+0.53%)	⬆️
app-ui-vault	27.84% <ø> (+0.53%)	⬆️
authenticator	6.10% <ø> (-0.05%)	⬇️
lib-core-network-bridge	4.11% <ø> (-0.03%)	⬇️
lib-data-ui	1.18% <ø> (-0.01%)	⬇️

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[github-actions]

🤖 Bitwarden Claude Code Review

Overall Assessment: APPROVE

This PR removes the Checkmarx SAST and SonarQube quality tooling: the .checkmarx/config.yml file, the scan-ci.yml workflow, the sonarqube Gradle plugin alias and version catalog entry, and the root sonar { } configuration block plus its koverXmlReportMergedCoverage task dependency. I verified the removal is complete — no remaining sonar/checkmarx references exist in workflows, Gradle scripts, Fastlane, docs, or any lock file. Kover coverage reporting is unaffected: fastlane generateCoverageReport invokes koverXmlReportMergedCoverage directly, so the codecov upload in test.yml still has its report. The deleted workflow only triggered on push to main and workflow_dispatch, so removing it cannot orphan a required pull-request status check.

Code Review Details

• ❓ : Lock file regeneration downgrades seven buildscript classpath dependencies (bcprov 1.84→1.79, commons-lang3 3.20.0→3.16.0, and others) now that the Sonar scanner is no longer hoisting them; build-time only, but worth a conscious sign-off
  • buildscript-gradle.lockfile:91

Dependency Changes

Package	Change	Ecosystem
org.sonarqube (Gradle plugin)	Removed	Gradle
org.sonarsource.scanner.gradle:sonarqube-gradle-plugin	Removed	Maven (buildscript)
org.sonarsource.scanner.lib:*	Removed	Maven (buildscript)
de.siegmar:fastcsv, io.github.hakky54:ayza, io.github.hakky54:sude	Removed (transitive)	Maven (buildscript)
org.bouncycastle:bcprov-jdk18on	1.84 → 1.79	Maven (buildscript)
org.apache.commons:commons-lang3	3.20.0 → 3.16.0	Maven (buildscript)
org.apache.commons:commons-compress	1.28.0 → 1.27.1	Maven (buildscript)
commons-io:commons-io	2.20.0 → 2.16.1	Maven (buildscript)
commons-codec:commons-codec	1.19.0 → 1.17.1	Maven (buildscript)
com.google.code.gson:gson	2.13.2 → 2.11.0	Maven (buildscript)
com.google.errorprone:error_prone_annotations	2.41.0 → 2.28.0	Maven (buildscript)

No new dependencies were introduced, so the AppSec dependency approval process does not apply.

[claude]

❓ QUESTION: Lock file regeneration downgrades several buildscript classpath dependencies — was the older bcprov/commons-lang3 acceptable?

Details

Removing the SonarQube plugin drops the transitive constraints it was hoisting, so the regenerated lock file resolves lower versions:

Dependency	Change
org.bouncycastle:bcprov-jdk18on	1.84 → 1.79
org.apache.commons:commons-lang3	3.20.0 → 3.16.0
org.apache.commons:commons-compress	1.28.0 → 1.27.1
commons-io:commons-io	2.20.0 → 2.16.1
commons-codec:commons-codec	1.19.0 → 1.17.1
com.google.code.gson:gson	2.13.2 → 2.11.0
com.google.errorprone:error_prone_annotations	2.41.0 → 2.28.0

These are build-time only (never shipped in the APK), and the downgrade is the expected result of the plugin removal rather than a mistake — bcprov at 1.79 now also matches the already-pinned bcpkix/bcutil 1.79. Flagging only so it's a conscious choice: if Dependabot/Renovate alerts fire on the build classpath (e.g. commons-lang3 < 3.18), the constraints would need to be re-added explicitly.