From ee20919eb9b3eec3765774266ba097bbf5393652 Mon Sep 17 00:00:00 2001 From: Alex Colom Date: Mon, 3 Aug 2026 09:59:30 -0700 Subject: [PATCH] chore: remove checkmarx sast job (#7225) --- .checkmarx/config.yml | 11 ----------- .github/workflows/scan-ci.yml | 35 ---------------------------------- authenticator/build.gradle.kts | 1 - build.gradle.kts | 17 ----------------- buildscript-gradle.lockfile | 22 +++++++-------------- gradle/libs.versions.toml | 2 -- 6 files changed, 7 insertions(+), 81 deletions(-) delete mode 100644 .checkmarx/config.yml delete mode 100644 .github/workflows/scan-ci.yml diff --git a/.checkmarx/config.yml b/.checkmarx/config.yml deleted file mode 100644 index a84329edc2..0000000000 --- a/.checkmarx/config.yml +++ /dev/null @@ -1,11 +0,0 @@ -version: 1 - -# Checkmarx configuration file -# -# https://docs.checkmarx.com/en/34965-68549-configuring-projects-using-config-as-code-files.html -checkmarx: - scan: - configs: - sast: - # Exclude test directories - filter: "**/test/**,!**/androidTest/**,!**/commonTest/**,!**/jvmTest/**,!**/jsTest/**,!**/iosTest/**" diff --git a/.github/workflows/scan-ci.yml b/.github/workflows/scan-ci.yml deleted file mode 100644 index 11fe939e15..0000000000 --- a/.github/workflows/scan-ci.yml +++ /dev/null @@ -1,35 +0,0 @@ -name: Scan Protected Branches On Push - -on: - workflow_dispatch: - push: - branches: - - "main" - -permissions: {} - -jobs: - sast: - name: Checkmarx - uses: bitwarden/gh-actions/.github/workflows/_checkmarx.yml@main - secrets: - AZURE_SUBSCRIPTION_ID: ${{ secrets.AZURE_SUBSCRIPTION_ID }} - AZURE_TENANT_ID: ${{ secrets.AZURE_TENANT_ID }} - AZURE_CLIENT_ID: ${{ secrets.AZURE_CLIENT_ID }} - permissions: - contents: read - pull-requests: write - security-events: write - id-token: write - - quality: - name: Sonar - uses: bitwarden/gh-actions/.github/workflows/_sonar.yml@main - secrets: - AZURE_SUBSCRIPTION_ID: ${{ secrets.AZURE_SUBSCRIPTION_ID }} - AZURE_TENANT_ID: ${{ secrets.AZURE_TENANT_ID }} - AZURE_CLIENT_ID: ${{ secrets.AZURE_CLIENT_ID }} - permissions: - contents: read - pull-requests: write - id-token: write diff --git a/authenticator/build.gradle.kts b/authenticator/build.gradle.kts index 6a7336ecd4..27a586467d 100644 --- a/authenticator/build.gradle.kts +++ b/authenticator/build.gradle.kts @@ -17,7 +17,6 @@ plugins { alias(libs.plugins.ksp) alias(libs.plugins.google.protobuf) alias(libs.plugins.google.services) - alias(libs.plugins.sonarqube) } /** diff --git a/build.gradle.kts b/build.gradle.kts index 9805ebd3e6..16477d1997 100644 --- a/build.gradle.kts +++ b/build.gradle.kts @@ -11,7 +11,6 @@ plugins { alias(libs.plugins.kotlinx.kover) apply true alias(libs.plugins.ksp) apply false alias(libs.plugins.google.services) apply false - alias(libs.plugins.sonarqube) apply true } buildscript { @@ -135,23 +134,7 @@ kover { } } -sonar { - properties { - property("sonar.projectKey", "bitwarden_android") - property("sonar.organization", "bitwarden") - property("sonar.host.url", "https://sonarcloud.io") - property("sonar.sources", "*/src/") - property("sonar.tests", "*/src/") - property("sonar.test.inclusions", "*/src/test/") - property("sonar.exclusions", "*/src/test/") - } -} - tasks { - getByName("sonar") { - dependsOn("koverXmlReportMergedCoverage") - } - withType().configureEach { jvmTarget = libs.versions.jvmTarget.get() // If run as a precommit hook, only run on staged files. diff --git a/buildscript-gradle.lockfile b/buildscript-gradle.lockfile index f7cd413762..9296b11533 100644 --- a/buildscript-gradle.lockfile +++ b/buildscript-gradle.lockfile @@ -44,7 +44,7 @@ com.android:zipflinger:9.2.1=classpath com.google.android.gms:strict-version-matcher-plugin:1.2.4=classpath com.google.auto.value:auto-value-annotations:1.6.2=classpath com.google.code.findbugs:jsr305:3.0.2=classpath -com.google.code.gson:gson:2.13.2=classpath +com.google.code.gson:gson:2.11.0=classpath com.google.crypto.tink:tink:1.7.0=classpath com.google.dagger.hilt.android:com.google.dagger.hilt.android.gradle.plugin:2.60=classpath com.google.dagger:dagger:2.28.3=classpath @@ -53,7 +53,7 @@ com.google.devtools.ksp:com.google.devtools.ksp.gradle.plugin:2.3.9=classpath com.google.devtools.ksp:symbol-processing-api:2.3.9=classpath com.google.devtools.ksp:symbol-processing-common-deps:2.3.9=classpath com.google.devtools.ksp:symbol-processing-gradle-plugin:2.3.9=classpath -com.google.errorprone:error_prone_annotations:2.41.0=classpath +com.google.errorprone:error_prone_annotations:2.28.0=classpath com.google.flatbuffers:flatbuffers-java:1.12.0=classpath com.google.gms.google-services:com.google.gms.google-services.gradle.plugin:4.5.0=classpath com.google.gms:google-services:4.5.0=classpath @@ -69,12 +69,9 @@ com.squareup:javapoet:1.13.0=classpath com.squareup:javawriter:2.5.0=classpath com.sun.istack:istack-commons-runtime:3.0.8=classpath com.sun.xml.fastinfoset:FastInfoset:1.2.16=classpath -commons-codec:commons-codec:1.19.0=classpath -commons-io:commons-io:2.20.0=classpath +commons-codec:commons-codec:1.17.1=classpath +commons-io:commons-io:2.16.1=classpath commons-logging:commons-logging:1.2=classpath -de.siegmar:fastcsv:3.7.0=classpath -io.github.hakky54:ayza:10.0.3=classpath -io.github.hakky54:sude:2.0.2=classpath io.gitlab.arturbosch.detekt:detekt-gradle-plugin:1.23.8=classpath io.gitlab.arturbosch.detekt:io.gitlab.arturbosch.detekt.gradle.plugin:1.23.8=classpath jakarta.activation:jakarta.activation-api:1.2.1=classpath @@ -84,14 +81,14 @@ net.java.dev.jna:jna-platform:5.6.0=classpath net.java.dev.jna:jna:5.6.0=classpath net.sf.jopt-simple:jopt-simple:4.9=classpath net.sf.kxml:kxml2:2.3.0=classpath -org.apache.commons:commons-compress:1.28.0=classpath -org.apache.commons:commons-lang3:3.20.0=classpath +org.apache.commons:commons-compress:1.27.1=classpath +org.apache.commons:commons-lang3:3.16.0=classpath org.apache.httpcomponents:httpclient:4.5.14=classpath org.apache.httpcomponents:httpcore:4.4.16=classpath org.apache.httpcomponents:httpmime:4.5.6=classpath org.bitbucket.b_c:jose4j:0.9.5=classpath org.bouncycastle:bcpkix-jdk18on:1.79=classpath -org.bouncycastle:bcprov-jdk18on:1.84=classpath +org.bouncycastle:bcprov-jdk18on:1.79=classpath org.bouncycastle:bcutil-jdk18on:1.79=classpath org.checkerframework:checker-qual:3.43.0=classpath org.freemarker:freemarker:2.3.32=classpath @@ -140,10 +137,5 @@ org.ow2.asm:asm-tree:9.9=classpath org.ow2.asm:asm-util:9.9=classpath org.ow2.asm:asm:9.9=classpath org.slf4j:slf4j-api:1.7.30=classpath -org.sonarqube:org.sonarqube.gradle.plugin:7.3.1.8318=classpath -org.sonarsource.scanner.gradle:sonarqube-gradle-plugin:7.3.1.8318=classpath -org.sonarsource.scanner.lib:sonar-scanner-download-cache:4.1.1.1633=classpath -org.sonarsource.scanner.lib:sonar-scanner-java-library-batch-interface:4.1.1.1633=classpath -org.sonarsource.scanner.lib:sonar-scanner-java-library:4.1.1.1633=classpath org.tensorflow:tensorflow-lite-metadata:0.2.0=classpath empty= diff --git a/gradle/libs.versions.toml b/gradle/libs.versions.toml index bd881e21ea..84c99ee8ff 100644 --- a/gradle/libs.versions.toml +++ b/gradle/libs.versions.toml @@ -55,7 +55,6 @@ mockk = "1.14.11" okhttp = "5.4.0" retrofitBom = "3.0.0" robolectric = "4.16.1" -sonarqube = "7.3.1.8318" testng = "7.12.0" timber = "5.0.1" turbine = "1.2.1" @@ -156,4 +155,3 @@ kotlin-parcelize = { id = "org.jetbrains.kotlin.plugin.parcelize", version.ref = kotlin-serialization = { id = "org.jetbrains.kotlin.plugin.serialization", version.ref = "kotlin" } kotlinx-kover = { id = "org.jetbrains.kotlinx.kover", version.ref = "kotlinxKover" } ksp = { id = "com.google.devtools.ksp", version.ref = "ksp" } -sonarqube = { id = "org.sonarqube", version.ref = "sonarqube" }