[brunodam]

Description

Snyk is being decommissioned across the hiero-ledger, hashgraph, and swirldslabs organizations. This removes it from CI here.

This pull request changes the following:

• Delete zxf-snyk-monitor.yaml
• Remove the Snyk Scan job from flow-pull-request-checks.yaml
• Remove the Snyk steps, the enable-snyk-scan input, and the snyk-token secret from zxc-code-analysis.yaml; Sonar and CodeCov analysis are unchanged
• Stop passing enable-snyk-scan and SNYK_TOKEN from flow-build-application.yaml, and drop its enable-snyk-scan dispatch input

Edited workflows parse as YAML, and actionlint reports no new findings on them. No ruleset requires a Snyk check in this repository.

Related Issues

• Closes Remove Snyk from CI #1141

[codacy-production]

Up to standards ✅

🟢 Issues 0 issues

Results:
0 new issues

View in Codacy

_{NEW Get contextual insights on your PRs based on Codacy's metrics, along with PR and Jira context, without leaving GitHub. Enable AI reviewer
TIP This summary will be updated as you push new changes.}

[Copilot]

🟢 Approval recommended

Repository-wide searches confirm every Snyk job, input, secret, and caller reference was fully removed with no orphaned references and all edited workflows parse as valid YAML.

No open issues 🎉

What changed in this PR

This PR removes Snyk from CI as part of its decommissioning across the hiero-ledger, hashgraph, and swirldslabs organizations (closes #1141). It deletes the standalone Snyk monitor workflow and strips all Snyk-related jobs, steps, inputs, and secrets from the reusable code-analysis workflow and its callers, leaving Sonar and CodeCov analysis intact.

Changes:

• Delete the ZXF: Snyk Monitor workflow entirely.
• Remove the Snyk Scan job from PR checks and the Snyk steps/enable-snyk-scan input/snyk-token secret from the reusable code-analysis workflow.
• Stop passing enable-snyk-scan and SNYK_TOKEN from the build workflow and drop its enable-snyk-scan dispatch input.

File	Description
.github/​workflows/​zxf-snyk-monitor.yaml	Deleted; removes the scheduled/push-triggered Snyk monitor job.
.github/​workflows/​zxc-code-analysis.yaml	Removes the enable-snyk-scan input, snyk-token secret, all Snyk steps, and updates the Node setup comment.
.github/​workflows/​flow-pull-request-checks.yaml	Removes the Snyk Scan job that invoked the analysis workflow with Snyk enabled.
.github/​workflows/​flow-build-application.yaml	Drops the enable-snyk-scan dispatch input and stops passing it plus SNYK_TOKEN to the analysis workflow.

_{Review effort: Balanced}