chore: remove checkmarx and sonar from the project

[sognefej]

📔 Objective

Going through and removing all the Checkmarx and Sonar related code from the project.

⏰ Reminders before review

• Contributor guidelines followed
• All formatters and local linters executed and passed
• Written new unit and / or integration tests where applicable
• Protected functional changes with optionality (feature flags)
• Used internationalization (i18n) for all UI strings
• CI builds passed
• Communicated to DevOps any deployment requirements
• Updated any necessary documentation (Confluence, contributing docs) or informed the documentation team

🦮 Reviewer guidelines

• 👍 (:+1:) or similar for great changes
• 📝 (:memo:) or ℹ️ (:information_source:) for notes or general info
• ❓ (:question:) for questions
• 🤔 (:thinking:) or 💭 (:thought_balloon:) for more open inquiry that's not quite a confirmed issue and could potentially benefit from discussion
• 🎨 (:art:) for suggestions / improvements
• ❌ (:x:) or ⚠️ (:warning:) for more significant problems or concerns needing attention
• 🌱 (:seedling:) or ♻️ (:recycle:) for future improvements or indications of technical debt
• ⛏ (:pick:) for minor or nitpick changes

[github-actions]

🤖 Bitwarden Claude Code Review

Overall Assessment: REQUEST CHANGES

This PR removes Checkmarx and Sonar from the project: the .github/workflows/examples/scan.yaml template is deleted, and the checkmarx/ast-github-action and sonarsource/sonarqube-scan-action entries are dropped from default_actions.json. The example workflow deletion is self-contained — nothing in the repo, tests, or CI (ci.yml lints examples/example.yaml) references it. The default_actions.json change, however, is the org-wide pre-approved action allowlist distributed via PyPI and enforced at error level by RuleStepUsesApproved, so it has blast radius beyond this repository.

Code Review Details

• ⚠️ : Removing approved-action entries revokes org-wide approval; consumers still using these actions will fail lint at error level
  • src/bitwarden_workflow_linter/default_actions.json:207
• 🎨 : The added trailing newline diverges from save_actions() output (src/bitwarden_workflow_linter/actions.py:185), so the weekly automated update PR will silently revert it

PR Metadata Assessment

• ❓ QUESTION: No version:* label is applied; allowlist removals are breaking for consumers, so version:major looks warranted.

[sognefej]

Don't merge until these are landed:

• chore: remove checkmarx sast job ios#2924
• chore: remove checkmarx sast job android#7225

[fntyler]

Has this been formally announced? I expect a lot of cleanup is to come

[sognefej]

Has this been formally announced? I expect a lot of cleanup is to come

Yeah this was announced in Slack a few weeks ago by @mandreko-bitwarden, @fntyler

We are in the middle of transitioning everything to Aikido.

The @bitwarden/team-appsec has been submitting PRs to remove Checkmarx and Sonar from the Bitwarden codebase.