Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

sonar-scanner/Dockerfile (2)

6-6: ⚡ Quick win

Use the canonical registry-prefix pattern in FROM.

This uses ${DOCKER_REGISTRY_URL}${DOCKER_REGISTRY_URL:+/} while the rest of the repo (e.g. jdk/Dockerfile, oscript/Dockerfile) uses the standard form. Although functionally equivalent, aligning keeps the registry handling consistent across the image chain.

♻️ Align with the standard pattern

-FROM ${DOCKER_REGISTRY_URL}${DOCKER_REGISTRY_URL:+/}${BASE_IMAGE}:${BASE_TAG}
+FROM ${DOCKER_REGISTRY_URL:+"$DOCKER_REGISTRY_URL/"}${BASE_IMAGE}:${BASE_TAG}

As per coding guidelines: "Use registry URL pattern in base image: FROM ${DOCKER_REGISTRY_URL:+"$DOCKER_REGISTRY_URL/"}base-image:tag".

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@sonar-scanner/Dockerfile` at line 6, The FROM line uses a nonstandard
registry prefix pattern; replace the current pattern in the Dockerfile's FROM
statement with the canonical registry-prefix form so it matches other
Dockerfiles (use the ${DOCKER_REGISTRY_URL:+"$DOCKER_REGISTRY_URL/"} pattern)
while keeping BASE_IMAGE and BASE_TAG unchanged; update the FROM invocation (the
base image reference in the Dockerfile) accordingly so registry handling is
consistent across images.

---

19-32: ⚖️ Poor tradeoff

Consider a multi-stage download for the SonarScanner CLI.

The CLI is fetched and unzipped in the final image, requiring a transient unzip install (later purged) plus apt cache cleanup. A builder stage that downloads/extracts and a final stage that COPYs /opt/sonar-scanner would avoid touching apt in the runtime layer entirely. Optional given the cleanup already keeps the layer small.

As per coding guidelines: "Use multi-stage builds in Dockerfiles when downloading or building dependencies".

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@sonar-scanner/Dockerfile` around lines 19 - 32, Replace the single-stage RUN
download/unzip block with a multi-stage build: create a builder stage (e.g.,
FROM debian AS builder) that installs unzip, uses SONAR_SCANNER_VERSION to wget
and unzip to /opt/sonar-scanner-${SONAR_SCANNER_VERSION}, then in the final
stage remove apt install steps and instead COPY --from=builder
/opt/sonar-scanner-${SONAR_SCANNER_VERSION} ${SONAR_SCANNER_HOME}; drop the
transient unzip install and apt-get cleanup from the final stage so the runtime
layer never touches apt caches while still preserving SONAR_SCANNER_VERSION and
SONAR_SCANNER_HOME semantics.

build-sonar-scanner.sh (3)

56-56: 💤 Low value

Quote $SONAR_JDK_VERSION (SC2086).

Harmless today (value is 25), but quoting prevents word-splitting/globbing if the value is ever overridden with whitespace.

♻️ Quote the expansion

-    --build-arg OPENJDK_VERSION=$SONAR_JDK_VERSION \
+    --build-arg OPENJDK_VERSION="$SONAR_JDK_VERSION" \

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@build-sonar-scanner.sh` at line 56, The shell expansion of $SONAR_JDK_VERSION
in the Docker build argument (--build-arg OPENJDK_VERSION=$SONAR_JDK_VERSION) is
unquoted and can trigger word-splitting/globbing (SC2086); change the usage to
quote the variable (--build-arg OPENJDK_VERSION="$SONAR_JDK_VERSION") in
build-sonar-scanner.sh so the value is passed as a single token even if it
contains whitespace or special characters.

---

42-42: ⚡ Quick win

Also tag images with latest.

The built images are tagged only with $ONEC_VERSION. Per project convention, publish a latest tag alongside the version (e.g. add a second -t …onec-client:latest) so downstream BASE_TAG=latest references and consumers resolve correctly.

As per coding guidelines: "Tag Docker images with both specific version and 'latest' tags".

Also applies to: 57-57, 71-71

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@build-sonar-scanner.sh` at line 42, Add a second Docker tag for the `latest`
alias wherever images are built: when invoking `docker build` that currently
uses -t ${DOCKER_REGISTRY_URL:+"$DOCKER_REGISTRY_URL/"}onec-client:$ONEC_VERSION
(and the other similar -t usages at the other build sites mentioned), add an
additional -t argument using the same registry prefix but with
`onec-client:latest` (i.e. use the same DOCKER_REGISTRY_URL expansion and
replace $ONEC_VERSION with latest) so each image is pushed/tagged with both the
version and `latest`.

---

35-44: ⚡ Quick win

Validate required env vars before building.

ONEC_USERNAME, ONEC_PASSWORD, and ONEC_VERSION are consumed unvalidated. An empty ONEC_VERSION produces an invalid tag onec-client: and fails the build with a cryptic Docker error rather than a clear message.

🛡️ Add an early guard

 last_arg='.'
 if [ "${NO_CACHE}" = 'true' ] ; then
     last_arg='--no-cache .'
 fi
+
+for var in ONEC_USERNAME ONEC_PASSWORD ONEC_VERSION; do
+    if [ -z "${!var}" ]; then
+        echo "Required environment variable $var is not set" >&2
+        exit 1
+    fi
+done

As per coding guidelines: "Validate required environment variables in build scripts".

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@build-sonar-scanner.sh` around lines 35 - 44, Add an early guard in the build
script to validate ONEC_USERNAME, ONEC_PASSWORD and ONEC_VERSION are non-empty
before running the docker build; check the variables (ONEC_USERNAME,
ONEC_PASSWORD, ONEC_VERSION) and if any are missing print a clear error message
naming the missing var(s) and exit 1 so the build fails fast with a helpful
message rather than producing an invalid image tag like onec-client:. Keep
DOCKER_REGISTRY_URL optional as currently used for prefixing the tag.

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes