[brunodam]

Description

Snyk is being decommissioned across the hiero-ledger, hashgraph, and swirldslabs organizations. This removes it from CI here.

This pull request changes the following:

• Delete zxf-snyk-monitor.yaml and .snyk
• Remove the Snyk Scan job from flow-pull-request-checks.yaml
• Remove the Snyk steps, the Setup Go step that only Snyk used, the enable-snyk-scan and snyk-org-identifier inputs, and the snyk-token secret from zxc-code-analysis.yaml; CodeCov and Codacy coverage are unchanged
• Stop passing the Snyk inputs and SNYK_TOKEN from flow-build-application.yaml, and drop its enable-snyk-scan dispatch input
• Drop Snyk from the PR checks row in CLAUDE.md

Edited workflows parse as YAML, and actionlint reports no new findings on them. No ruleset requires a Snyk check in this repository.

Related Issues

• Closes Remove Snyk from CI #1456

[Copilot]

🟢 Approval recommended

The review surfaced no outstanding problems, as the Snyk decommissioning is internally consistent with no dangling workflow references or broken dependencies remaining.

No open issues 🎉

What changed in this PR

This PR decommissions Snyk from the repository's CI/CD, in line with the organization-wide removal of Snyk across hiero-ledger, hashgraph, and swirldslabs. Since the Snyk token is being withdrawn, these jobs would otherwise start failing. The change removes the Snyk monitor workflow, the Snyk scan job in PR checks, all Snyk steps/inputs/secrets wired through the reusable code-analysis workflow, and the .snyk policy file, while leaving CodeCov and Codacy coverage reporting intact.

Changes:

• Delete the standalone Snyk monitor workflow (zxf-snyk-monitor.yaml) and the .snyk ignore policy file.
• Remove the Snyk Scan job and all Snyk steps/inputs (enable-snyk-scan, snyk-org-identifier) and the snyk-token secret from the PR-checks, build, and code-analysis workflows, including the Snyk-only Setup Go step.
• Update CLAUDE.md to drop Snyk from the PR checks description.

File	Description
.github/​workflows/​zxf-snyk-monitor.yaml	Deletes the scheduled/on-push Snyk monitor workflow entirely.
.snyk	Removes the Snyk vulnerability ignore policy file.
.github/​workflows/​zxc-code-analysis.yaml	Drops Snyk inputs, secret, the Snyk-only Setup Go step, and all Snyk scan/publish steps; CodeCov/Codacy retained.
.github/​workflows/​flow-pull-request-checks.yaml	Removes the Snyk Scan job (no dangling needs references remain).
.github/​workflows/​flow-build-application.yaml	Stops passing Snyk inputs/SNYK_TOKEN to the analyze job and drops the enable-snyk-scan dispatch input.
CLAUDE.md	Updates the PR checks workflow description to remove Snyk.

No issues found — the removal is complete, internally consistent, and satisfies both acceptance criteria from issue #1456 (no workflow references Snyk/SNYK_TOKEN/SNYK_ORG_IDENTIFIER, and .snyk is deleted). The remaining CodeCov/Codacy steps do not depend on the removed Setup Go step, and no other callers reference the deleted workflow.

_{Review effort: Balanced}