diff --git a/.codacy.yml b/.codacy.yml
index 1d245feed..6f91cf7a3 100644
--- a/.codacy.yml
+++ b/.codacy.yml
@@ -4,6 +4,10 @@ engines:
     exclude_paths:
       # CSSLint does not support CSS custom properties used by Docusaurus/Infima
       - 'website/src/css/custom.css'
+  eslint-8:
+    exclude_paths: []
+  opengrep:
+    exclude_paths: []
   remark-lint:
     exclude_paths:
       # Generated release notes contain markdown constructs (e.g. `[bot]`)
diff --git a/.sonarcloud.properties b/.sonarcloud.properties
new file mode 100644
index 000000000..fc3f30f7b
--- /dev/null
+++ b/.sonarcloud.properties
@@ -0,0 +1,29 @@
+# SonarQube Cloud Automatic Analysis configuration
+# https://docs.sonarsource.com/sonarqube-cloud/analyzing-source-code/automatic-analysis
+sonar.sources=.
+sonar.sourceEncoding=UTF-8
+
+# Scope the whole-repo scan to first-party code.
+# (Issue ignores such as S5332/S4721/S4036/S7637 must be configured in the
+# SonarCloud UI; sonar.issue.ignore.* is not honored by Automatic Analysis.)
+sonar.exclusions=\
+  bun.lock,\
+  CHANGELOG.md,\
+  **/node_modules/**,\
+  **/dist/**,\
+  **/coverage/**,\
+  **/tmp/**,\
+  **/.git/**,\
+  **/.nx/**,\
+  **/generated/**,\
+  .agents/**,\
+  .cursor/**,\
+  .windsurf/**,\
+  .claude/**
+
+sonar.cpd.exclusions=\
+  **/generated/**,\
+  **/*.test.ts,\
+  **/*.spec.ts,\
+  **/tests/**,\
+  **/fixtures/**
diff --git a/netlify.toml b/netlify.toml
index e4dfa1b94..60ee06727 100644
--- a/netlify.toml
+++ b/netlify.toml
@@ -30,3 +30,12 @@
 [build.environment]
   NODE_VERSION = "20"
   NX_DAEMON = "false"
+
+# Only run production deploys from the main branch.
+# Deploy previews for pull requests and branch deploys are disabled to save
+# Netlify build minutes; the ignore script above still applies to production.
+[context.deploy-preview]
+  ignore = "exit 0"
+
+[context.branch-deploy]
+  ignore = "exit 0"
diff --git a/sonar-project.properties b/sonar-project.properties
deleted file mode 100644
index f5217bfc1..000000000
--- a/sonar-project.properties
+++ /dev/null
@@ -1,102 +0,0 @@
-# SonarQube / SonarCloud configuration
-
-# Exclude from ALL analysis:
-#   - Generated schema files (auto-generated by ts-xsd codegen, duplication + http URI false positives)
-#   - AI agent skills/rules/workflows (documentation with embedded code examples, not application code)
-sonar.exclusions=\
-  **/generated/**,\
-  .agents/**,\
-  .cursor/**,\
-  .windsurf/**,\
-  .claude/**,\
-  .skills/**
-
-# Exclude from copy-paste detection (CPD):
-#   - Generated schema files (auto-generated)
-#   - Test files (test data & assertions are intentionally repetitive)
-sonar.cpd.exclusions=\
-  **/generated/**,\
-  **/*.test.ts,\
-  **/*.spec.ts,\
-  **/tests/**,\
-  **/fixtures/**
-
-# ── Security-hotspot scoping ──────────────────────────────────────────
-# Some rules fire hard on patterns that are structurally safe in this
-# repo (XML namespace URIs masquerading as http:// URLs, test harnesses
-# that spawn child processes with constant argv, PATH env manipulation
-# in test scripts, etc.). Rather than marking hundreds of hotspots SAFE
-# one by one in the UI, pin the rules to the contexts where they
-# actually provide signal.
-sonar.issue.ignore.multicriteria=h1,h2,h3,h4,h5,h6,h7,h8,h9,h10,h11,h12,h13
-
-# S5332 "clear-text http protocol" — the overwhelming majority of these
-# are XML namespace URIs (http://www.sap.com/…) which are identifiers,
-# not network endpoints. Scope the rule to runtime code only.
-sonar.issue.ignore.multicriteria.h1.ruleKey=typescript:S5332
-sonar.issue.ignore.multicriteria.h1.resourceKey=**/tests/**
-sonar.issue.ignore.multicriteria.h2.ruleKey=typescript:S5332
-sonar.issue.ignore.multicriteria.h2.resourceKey=**/*.test.ts
-sonar.issue.ignore.multicriteria.h3.ruleKey=typescript:S5332
-sonar.issue.ignore.multicriteria.h3.resourceKey=**/*.spec.ts
-sonar.issue.ignore.multicriteria.h4.ruleKey=typescript:S5332
-sonar.issue.ignore.multicriteria.h4.resourceKey=.github/**
-
-# S4721 "executing this OS command" — test harnesses, internal tools,
-# and CI scripts invoke child processes with constant argv (git, npm,
-# bun, etc.); the attack surface of user-controlled command injection
-# is runtime code, not our dev-tooling. `tools/**` is the set of
-# in-repo Nx plugins + scaffolding that never runs in production.
-sonar.issue.ignore.multicriteria.h5.ruleKey=typescript:S4721
-sonar.issue.ignore.multicriteria.h5.resourceKey=**/tests/**
-sonar.issue.ignore.multicriteria.h6.ruleKey=typescript:S4721
-sonar.issue.ignore.multicriteria.h6.resourceKey=scripts/**
-sonar.issue.ignore.multicriteria.h7.ruleKey=typescript:S4721
-sonar.issue.ignore.multicriteria.h7.resourceKey=tools/**
-
-# S4036 "PATH variable manipulation" — only triggered from test
-# harnesses, repo-local scripts, and in-repo tools (nx-npm-trust sets
-# PATH for scoped `npm trust` invocations).
-sonar.issue.ignore.multicriteria.h8.ruleKey=typescript:S4036
-sonar.issue.ignore.multicriteria.h8.resourceKey=**/tests/**
-sonar.issue.ignore.multicriteria.h9.ruleKey=typescript:S4036
-sonar.issue.ignore.multicriteria.h9.resourceKey=scripts/**
-sonar.issue.ignore.multicriteria.h10.ruleKey=typescript:S4036
-sonar.issue.ignore.multicriteria.h10.resourceKey=tools/**
-
-# S5852 "regex vulnerable to super-linear runtime" — in the codegen /
-# schema-generation path (@abapify/adt-codegen, tools/nx-npm-trust).
-# Inputs are OpenAPI specs, XSDs, and npm CLI output — none of which
-# is attacker-controlled. Scoped to codegen paths; runtime code
-# continues to be checked.
-sonar.issue.ignore.multicriteria.h11.ruleKey=typescript:S5852
-sonar.issue.ignore.multicriteria.h11.resourceKey=packages/adt-codegen/**
-sonar.issue.ignore.multicriteria.h12.ruleKey=typescript:S5852
-sonar.issue.ignore.multicriteria.h12.resourceKey=tools/**
-
-# githubactions:S7637 "use full commit SHA for action dependency" —
-# correct best-practice, but the org policy here is to trust verified
-# actions (actions/checkout, actions/setup-node, etc.) by version tag.
-# Disabling until we decide to switch the whole org to SHA pinning.
-sonar.issue.ignore.multicriteria.h13.ruleKey=githubactions:S7637
-sonar.issue.ignore.multicriteria.h13.resourceKey=.github/workflows/**
-
-sonar.organization=abapify
-sonar.projectKey=abapify_adt-cli
-
-# ── Test coverage ──────────────────────────────────────────────────────
-# TypeScript coverage for this monorepo (generated by `bunx nx test`
-# when a reporter writes out lcov / jacoco). Adjust the path if you
-# integrate a TS coverage reporter.
-sonar.coverage.jacoco.xmlReportPaths=coverage/jacoco.xml
-
-# ── Downstream ABAP projects ───────────────────────────────────────────
-# Projects that use this CLI to run AUnit tests on a SAP system and
-# produce JaCoCo coverage via `adt aunit --coverage --coverage-format jacoco`
-# should point Sonar at the emitted report, for example:
-#
-#   sonar.coverage.jacoco.xmlReportPaths=build/aunit-coverage.xml
-#
-# The <sourcefile name="..."/> entries in the JaCoCo report use the
-# abapGit on-disk filename convention (e.g. `zcl_foo.clas.abap`) so
-# they match a standard abapGit checkout under `src/`.