sf cli docker image (full and slim) do not contain the code-analyzer plugin

[salesforcexland]

Summary

The full and slim docker images for SF CLI only contain sfdx-scanner (which is v4.x, and now retired), rather than code-analyzer (v5.x) which has been around for several months now and is the plugin everyone should be using.

This means an extra 20-25s of plugin installation is required on top of bringing down the docker image when used in CI pipelines

Steps To Reproduce

https://hub.docker.com/r/salesforce/cli/tags

No docker images contain the code analyzer plugin https://www.npmjs.com/package/@salesforce/plugin-code-analyzer

Expected result

We would expect code-analyzer plugin @latest to be installed

Actual result

Only sfdx-scanner is installed which is now retired

[github-actions]

Hello @salesforcexland 👋 It looks like you didn't include the full Salesforce CLI version information in your issue.
Please provide the output of version --verbose --json for the CLI you're using (sf or sfdx).

A few more things to check:

• Make sure you've provided detailed steps to reproduce your issue.
  • A repository that clearly demonstrates the bug is ideal.
• Make sure you've installed the latest version of Salesforce CLI. (docs)
  • Better yet, try the rc or nightly versions. (docs)
• Try running the doctor command to diagnose common issues.
• Search GitHub for existing related issues.

Thank you!

[github-actions]

Thank you for filing this issue. We appreciate your feedback and will review the issue as soon as possible. Remember, however, that GitHub isn't a mechanism for receiving support under any agreement or SLA. If you require immediate assistance, contact Salesforce Customer Support.

[salesforcexland]

Latest version of SF CLI is 2.13.6, which is fine in the image, but we're missing the key plugin for code-analyzer (v5)

[iowillhoit]

Can you confirm the version of sf you have inside of your docker container? These images should not contain either code-analyzer or sfdx-scanner by default. They are "Just In Time" (JIT) plugins, meaning they are installed automatically the first time you run the command.

I pulled latest-full 2.113.6 and it shows code-analyzer as a JIT plugin. The sfdx-scanner plugin should no longer be in the JIT list (see screenshot)

[salesforcexland]

Thanks for coming back @iowillhoit . Yes it's 2.113.6 and I can see the code-analyzer 5.6.1 JIT plugin listed.

I was working off the comment here and list on the status repo that mentions sfdx-scanner, but not plugins-code-analyzer at all.

Are there no ways of having a pre installed code-analyzer plugin then without creating a custom image entirely? Instead of needing to wait for the 20-30s install time each time. The context for this is trying to speed up CI usage for PR reviewing using code analyzer.

Thanks in advance.

[github-actions]

This issue has not received a response in 7 days. It will auto-close in 7 days unless a response is posted.

[iowillhoit]

Sorry for the delay @salesforcexland.

Our status repo is out of date. We will update it to remove sfdx-scanner and add plugin-code-analyzer

You would need to create a custom image if you want the CA plugin installed by default. Only a small percentage of our users use code analyzer in CI. If we bundled it by default, it would slow down CI for everyone else because of the increased container size.

[git2gus]

This issue has been linked to a new work item: W-20408066