Revert "integrate with Snyk"

This reverts commit 6c4fa43.

.github/workflows/pr-merge-main.yml

@@ -56,31 +56,4 @@ jobs:
       - name: Update version
         uses: gradle/gradle-build-action@749f47bda3e44aa060e82d7b3ef7e40d953bd629
         with:
-          arguments: release -Prelease.useAutomaticVersion=true
-
-  vulnerability-report:
-    if: github.event.pull_request.merged == true
-    runs-on: ubuntu-latest
-
-    env:
-      SNYK_TOKEN: ${{ secrets.SNYK_TOKEN }}
-      SNYK_ORG: legal-aid-agency
-      SNYK_TEST_EXCLUDE: build,generated
-
-    steps:
-      - uses: actions/checkout@v3
-      - name: Generate Snyk report and upload to LAA Dashboard
-        uses: snyk/actions/[email protected]
-        continue-on-error: true
-        with:
-          command: monitor
-          args: --org=${SNYK_ORG} --all-projects --exclude=$SNYK_TEST_EXCLUDE
-      - name: Generate sarif Snyk report
-        uses: snyk/actions/[email protected]
-        continue-on-error: true
-        with:
-          args: --org=${SNYK_ORG} --all-projects --exclude=$SNYK_TEST_EXCLUDE --sarif-file-output=snyk-report.sarif
-      - name: Upload result to GitHub Code Scanning
-        uses: github/codeql-action/upload-sarif@v2
-        with:
-          sarif_file: snyk-report.sarif
+          arguments: release -Prelease.useAutomaticVersion=true

.github/workflows/push-branch.yml

@@ -54,35 +54,3 @@ jobs:
           arguments: publish
         env:
             GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-
-  vulnerability-scan:
-    runs-on: ubuntu-latest
-
-    env:
-      SNYK_TOKEN: ${{ secrets.SNYK_TOKEN }}
-      SNYK_ORG: legal-aid-agency
-      SNYK_TEST_EXCLUDE: build,generated
-
-    steps:
-      - uses: actions/checkout@v3
-      - name: Set up JDK 21
-        uses: actions/setup-java@v3
-        with:
-          java-version: '21'
-          distribution: 'temurin'
-      - uses: snyk/actions/[email protected]
-      - name: Install snyk-delta
-        run: |
-          npm config set prefix '~/.local/'
-          mkdir -p ~/.local/bin
-          export PATH="$HOME/.local/bin/:$PATH"
-          npm install -g snyk-delta
-      - name: Identify new vulnerabilities
-        run: ./snyk/snyk_delta_all_projects.sh --org=$SNYK_ORG --exclude=$SNYK_TEST_EXCLUDE
-        env:
-          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-      - name: Run code test
-        uses: snyk/actions/[email protected]
-        with:
-          command: code test
-          args: --org=${SNYK_ORG}

.gitignore

@@ -93,5 +93,3 @@ test-results/
 
 .idea
 
-# Snyk
-.dccache

README.md

@@ -6,46 +6,3 @@ This API uses components from the [LAA CCMS Common Library](https://github.com/m
 
 - [laa-ccms-spring-boot-plugin](https://github.com/ministryofjustice/laa-ccms-spring-boot-common?tab=readme-ov-file#laa-ccms-spring-boot-gradle-plugin-for-java--spring-boot-projects)
 - [laa-ccms-spring-boot-starter-auth](https://github.com/ministryofjustice/laa-ccms-spring-boot-common/tree/main/laa-ccms-spring-boot-starters/laa-ccms-spring-boot-starter-auth)
-
-### Running Snyk locally
-To run Snyk locally, you will need to [install the Snyk CLI](https://docs.snyk.io/snyk-cli/install-or-update-the-snyk-cli).
-
-Once installed, you will be able to run the following commands:
-
-```shell
-snyk test
-```
-For open-source vulnerabilies and licence issues. See [`snyk test`](https://docs.snyk.io/snyk-cli/commands/test).
-
-```shell
-snyk code test
-```
-For Static Application Security Testing (SAST) - known security issues. See [`snyk code test`](https://docs.snyk.io/snyk-cli/commands/code-test).
-
-A [JetBrains Plugin](https://plugins.jetbrains.com/plugin/10972-snyk-security) is also available to integrate with your IDE. In addition to
-vulnerabilities, this plugin will also report code quality issues.
-
-### Configuration (`.snyk`)
-
-The [.snyk](.snyk) file is used to configure exclusions for scanning. If a vulnerability is not
-deemed to be a threat, or will be dealt with later, it can be added here to stop the pipeline
-failing. See [documentation](https://docs.snyk.io/manage-risk/policies/the-.snyk-file) for more details.
-
-### False Positives
-
-Snyk may report that new vulnerabilities have been introduced on a feature branch and fail the
-pipeline, even if this is not the case. As newly identified vulnerabilities are always being
-published, the report for the main branch may become outdated when a new vulnerability is published.
-
-If you think this may be the case, simply re-run the `monitor` command against the `main` branch
-to update the report on the Snyk server, then re-run your pipeline.
-
-Please ensure this matches the command used by the [pr-merge-main](.github/workflows/pr-merge.yml)
-workflow to maintain consistency.
-
-```shell
-snyk monitor --org=legal-aid-agency --all-projects --exclude=build,generated
-```
-
-You should then see the new vulnerability in the LAA Dashboard, otherwise it is a new
-vulnerability introduced on the feature branch that needs to be resolved.