From 8fecb5bb46b471c703101d6f12a746078c14d410 Mon Sep 17 00:00:00 2001
From: Thomas Neidhart <thomas.neidhart@eclipse-foundation.org>
Date: Thu, 3 Sep 2026 14:53:11 +0200
Subject: [PATCH] chore: remove codeql and sonar workflows

---
 .github/workflows/codeql.yml | 68 ------------------------------------
 .github/workflows/sonar.yml  | 41 ----------------------
 sonar-project.properties     | 16 ---------
 3 files changed, 125 deletions(-)
 delete mode 100644 .github/workflows/codeql.yml
 delete mode 100644 .github/workflows/sonar.yml
 delete mode 100644 sonar-project.properties

diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml
deleted file mode 100644
index 2ea159889..000000000
--- a/.github/workflows/codeql.yml
+++ /dev/null
@@ -1,68 +0,0 @@
-name: "CodeQL Advanced"
-
-on:
-  push:
-    branches: [ "main" ]
-  schedule:
-    - cron: '21 1 * * 1'
-
-jobs:
-  analyze:
-    name: Analyze (${{ matrix.language }})
-    runs-on: 'ubuntu-latest'
-    if: github.repository == 'eclipse-openvsx/openvsx'
-    permissions:
-      # required for all workflows
-      security-events: write
-
-      # required to fetch internal or private CodeQL packs
-      packages: read
-
-      # only required for workflows in private repositories
-      actions: read
-      contents: read
-
-    strategy:
-      fail-fast: false
-      matrix:
-        include:
-        - language: actions
-          build-mode: none
-        - language: java-kotlin
-          build-mode: none # This mode only analyzes Java. Set this to 'autobuild' or 'manual' to analyze Kotlin too.
-        - language: javascript-typescript
-          build-mode: none
-    steps:
-    - name: Checkout repository
-      uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
-      with:
-        persist-credentials: false
-
-    # Initializes the CodeQL tools for scanning.
-    - name: Initialize CodeQL
-      uses: github/codeql-action/init@db488ddef3bf6cb639b32c2e9a7c0a7ea8271d28 # v4
-      with:
-        languages: ${{ matrix.language }}
-        build-mode: ${{ matrix.build-mode }}
-
-    # If the analyze step fails for one of the languages you are analyzing with
-    # "We were unable to automatically build your code", modify the matrix above
-    # to set the build mode to "manual" for that language. Then modify this step
-    # to build your code.
-    # ℹ️ Command-line programs to run using the OS shell.
-    # 📚 See https://docs.github.com/en/actions/using-workflows/workflow-syntax-for-github-actions#jobsjob_idstepsrun
-    - name: Run manual build steps
-      if: matrix.build-mode == 'manual'
-      shell: bash
-      run: |
-        echo 'If you are using a "manual" build mode for one or more of the' \
-          'languages you are analyzing, replace this with the commands to build' \
-          'your code, for example:'
-        echo '  make bootstrap'
-        echo '  make release'
-        exit 1
-
-    - name: Perform CodeQL Analysis
-      uses: github/codeql-action/analyze@db488ddef3bf6cb639b32c2e9a7c0a7ea8271d28 # v4
-      with:
-        category: "/language:${{matrix.language}}"
diff --git a/.github/workflows/sonar.yml b/.github/workflows/sonar.yml
deleted file mode 100644
index dbb90d6b8..000000000
--- a/.github/workflows/sonar.yml
+++ /dev/null
@@ -1,41 +0,0 @@
-name: Sonar
-on:
-  push:
-    branches:
-      - main
-jobs:
-  sonar:
-    name: Sonar
-    permissions:
-      contents: read
-    runs-on: ubuntu-latest
-    if: github.repository == 'eclipse-openvsx/openvsx'
-    steps:
-    - name: Checkout
-      uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
-      with:
-          persist-credentials: false
-          fetch-depth: 0
-    - name: Cache SonarCloud packages
-      uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9  # v6.1.0
-      with:
-        path: ~/.sonar/cache
-        key: ${{ runner.os }}-sonar
-        restore-keys: ${{ runner.os }}-sonar
-    - name: Set up JDK
-      uses: actions/setup-java@b6effb05e454b25005698d916606bdc6ffcbf961  # v5.7.0
-      with:
-        distribution: 'temurin'
-        java-version: 25
-    - name: Setup Gradle
-      uses: gradle/actions/setup-gradle@9c971963bec38e04b3d30dcc455b5382be2fdbfb # v6.3.0
-    - name: Generate JaCoCo test report
-      run: server/gradlew --no-daemon -p server jacocoTestReport
-    - name: Make server libraries directory
-      run: mkdir server/libraries
-    - name: Copy server libraries
-      run: find ~/.gradle/caches -type f -name '*.jar' -exec cp {} server/libraries \;
-    - name: SonarCloud Scan
-      uses: SonarSource/sonarqube-scan-action@22918119ff8e1ca75a623e15c8296b6ea4fbe28f  # v8.2.1
-      env:
-        SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }}
diff --git a/sonar-project.properties b/sonar-project.properties
deleted file mode 100644
index d9cad0642..000000000
--- a/sonar-project.properties
+++ /dev/null
@@ -1,16 +0,0 @@
-sonar.projectKey=open-vsx_openvsx
-sonar.organization=open-vsx
-sonar.sources=cli,webui,server/scripts,server/Dockerfile,server/src/dev,server/src/gatling,server/src/main/java,server/src/main/resources,.gitpod.dockerfile,.gitpod.yml
-sonar.tests=server/src/test
-sonar.java.binaries=server/build/classes/java/main
-sonar.java.libraries=server/libraries/*.jar
-sonar.java.test.binaries=server/build/classes/java/test
-sonar.java.test.libraries=server/libraries/*.jar
-sonar.coverage.jacoco.xmlReportPaths=server/build/reports/jacoco/test/jacocoTestReport.xml
-
-# This is the name and version displayed in the SonarCloud UI.
-#sonar.projectName=openvsx
-#sonar.projectVersion=1.0
-
-# Encoding of the source code. Default is default system encoding
-#sonar.sourceEncoding=UTF-8