chore(ci): retire security-snyk.yml and merge duplicate security-codeql.yml

[williaby]

Two security workflow cleanups:

• security-snyk.yml: removed -- Snyk requires paid account; free tier is insufficient for SAST/container scanning
• security-codeql.yml: removed -- duplicate of standard codeql.yml already present in repo

Summary by CodeRabbit

• Chores
  • Removed CodeQL and Snyk security scanning workflows from the CI/CD pipeline. These automated checks previously performed code quality analysis, detected security vulnerabilities, scanned open-source dependencies, and analyzed container images on code pushes and pull requests. Automated security scanning is no longer active in the repository.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro

Run ID: d8c5a31d-e6cc-4f9d-9c8e-7a5c7afc5273

📥 Commits

Reviewing files that changed from the base of the PR and between dd37ec0 and 3d34bfa.

📒 Files selected for processing (2)

• .github/workflows/security-codeql.yml
• .github/workflows/security-snyk.yml

💤 Files with no reviewable changes (2)

• .github/workflows/security-codeql.yml
• .github/workflows/security-snyk.yml

---

📝 Walkthrough

Walkthrough

This pull request removes two GitHub Actions security scanning workflows from the repository. The CodeQL security analysis workflow and the unified Snyk security pipeline (covering code, OSS, and container scanning with SARIF upload) are deleted from the CI configuration.

Changes

Security Workflow Removal

Layer / File(s)	Summary
Workflow Deletions .github/workflows/security-codeql.yml, .github/workflows/security-snyk.yml	CodeQL analysis workflow (115 lines) and Snyk scanning pipeline with matrix execution and SARIF uploads (89 lines) are deleted.

Estimated code review effort

🎯 1 (Trivial) | ⏱️ ~3 minutes

Poem

🐰 Two sentinels exit stage left,
CodeQL, Snyk—our shield bereft,
Security workflows fade to black,
The CI pipeline trims its pack.
✨

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly and specifically describes the main changes: removing security-snyk.yml and merging duplicate security-codeql.yml, which aligns perfectly with the PR objectives.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch chore/retire-snyk-merge-codeql

---

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[Copilot]

🔵 Needs a closer look

It leaves broken/stale repository documentation (e.g., README badge and UML diagram still referencing the removed Snyk workflow) and the “duplicate CodeQL” rationale doesn’t match the current repo CodeQL coverage.

Pull request overview

This PR cleans up GitHub Actions security workflows by removing two workflows that are no longer desired (Snyk due to account limitations, and a custom CodeQL workflow believed to be redundant) to reduce CI maintenance overhead.

Changes:

• Removed .github/workflows/security-snyk.yml (Snyk-based security scanning).
• Removed .github/workflows/security-codeql.yml (custom multi-language CodeQL scanning workflow).

File summaries

File	Description
.github/workflows/security-snyk.yml	Deletes the Snyk security workflow from the CI pipeline.
.github/workflows/security-codeql.yml	Deletes a CodeQL workflow that previously scanned multiple languages (python, javascript-typescript, actions).

Review details

Suppressed comments (2)

.github/workflows/security-snyk.yml:1

• Removing this workflow will leave stale references in repo docs: README has a Security Workflow Status badge pointing at actions/workflows/security-snyk.yml, and docs/uml/workflows-overview.puml lists security-snyk.yml. After this deletion those links/diagrams will be broken; please update/remove those references in the same PR.
  .github/workflows/security-codeql.yml:1
• PR description says security-codeql.yml is a duplicate of the repo’s standard codeql.yml, but codeql.yml only runs CodeQL for Python whereas this workflow also analyzed javascript-typescript and actions. Deleting it reduces CodeQL coverage (including GitHub Actions workflow scanning); please either update codeql.yml to cover the removed languages or clarify in the PR description that this is an intentional reduction.

• Files reviewed: 2/2 changed files
• Comments generated: 0
• Review effort level: Lite

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.