[PM-27903] feat: Remove Credential Exchange (CXF) dependency on f-droid builds

[vvolkgang]

🎟️ Tracking

PM-27903

📔 Objective

Remove the non-FOSS androidx.credentials.providerevents:providerevents-play-services dependency
from f-droid build variants. While Credential Exchange (CXP) was already gated off at runtime for f-droid via isFdroid
checks, the Play Services dependency was still compiled into the f-droid apk.

Confirmed the dependency was absent from the f-droid APK (and present in standard) using dexdump:

# f-droid -> expect 0
$ANDROID_HOME/build-tools/{version}/dexdump \
  app/build/intermediates/apk/fdroid/debug/com.x8bit.bitwarden.dev-fdroid.apk \
  | grep -c playservices

# Standard -> expect non-zero
$ANDROID_HOME/build-tools/{version}/dexdump \
  app/build/intermediates/apk/standard/debug/com.x8bit.bitwarden.dev.apk \
  | grep -c playservices

[github-actions]

🤖 Bitwarden Claude Code Review

Overall Assessment: APPROVE

Reviewed the split of the :cxf module into standard/fdroid product flavors to exclude the non-FOSS providerevents-play-services dependency from F-Droid builds. The flavor setup mirrors the existing :app module convention (standardImplementation), the F-Droid stubs degrade gracefully by returning handled failures rather than throwing, and callers already map these to result types. Tests cover both flavors, and the detekt config and Fastfile are updated to match the new source sets.

Code Review Details

No findings.

Notes from validation:

• The standardImplementation helper in cxf/build.gradle.kts matches the established pattern in app/build.gradle.kts for scoping non-FOSS Google dependencies away from F-Droid.
• The :cxf module now shares the same mode flavor dimension (standard/fdroid) as :app, so Gradle variant resolution matches automatically without a missingDimensionStrategy.
• The abandoned isSupported() experiment was reverted; the interface and both flavor implementations are internally consistent on the final branch state.
• No dependency was added or removed from the manifest (the play-services dependency already existed and was only re-scoped), so no AppSec approval concern applies.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 86.06%. Comparing base (36c892e) to head (e0ffc09).

Additional details and impacted files

@@            Coverage Diff             @@
##             main    #7154      +/-   ##
==========================================
+ Coverage   85.89%   86.06%   +0.16%     
==========================================
  Files         927      926       -1     
  Lines       66232    66087     -145     
  Branches     9640     9640              
==========================================
- Hits        56892    56877      -15     
+ Misses       5887     5757     -130     
  Partials     3453     3453              

Flag	Coverage Δ
app-data	17.27% <ø> (-0.04%)	⬇️
app-ui-auth-tools	18.78% <ø> (+0.11%)	⬆️
app-ui-platform	16.83% <ø> (+<0.01%)	⬆️
app-ui-vault	28.12% <ø> (+0.06%)	⬆️
authenticator	6.17% <ø> (+0.02%)	⬆️
lib-core-network-bridge	4.05% <ø> (+<0.01%)	⬆️
lib-data-ui	1.14% <ø> (+0.02%)	⬆️

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[david-livefront]

👍