refactor(docker): use CLI as direct entrypoint

[a-oren]

Summary

• Removes the trustify-da.sh shell wrapper from the container image
• Sets ENTRYPOINT ["trustify-da"] to invoke the CLI directly
• Updates README.md with usage examples for all subcommands
• Restores Yarn variant auto-detection (classic vs berry) in the JavaScript provider to maintain backward compatibility

The CLI already handles subcommand routing via yargs (stack, remediate, image, sbom, license, etc.), making the 120-line shell wrapper redundant. This enables all CLI subcommands to work directly through the container entrypoint.

The Yarn auto-detection logic (previously in the removed wrapper) is now implemented in javascript_yarn.js. When TRUSTIFY_DA_YARN_PATH is not explicitly set, the provider auto-detects the Yarn variant from manifest signals (packageManager field, .yarnrc.yml presence, or defaults to classic for bare v1 yarn.lock). Detection only runs for Yarn projects (package.json + sibling yarn.lock), preventing cross-ecosystem behavior.

Test plan

• Build Docker image locally
• Verify docker run <image> --help shows CLI usage
• Verify docker run <image> stack --help shows stack subcommand help
• Confirm image size is not significantly larger
• Yarn auto-detection tests pass for all scenarios (classic, berry, with/without packageManager field, with/without .yarnrc.yml)

Implements TC-5614
Implements TC-6104

🤖 Generated with Claude Code

Summary by Sourcery

Use the Trustify CLI directly as the container entrypoint while preserving automatic Yarn variant selection and documenting container usage.

New Features:

• Enable direct execution of all Trustify Dependency Analytics CLI subcommands through the container image entrypoint.
• Restore automatic Yarn Classic and Berry selection based on project metadata when no Yarn path is configured.

Enhancements:

• Remove the redundant container shell wrapper and document direct Docker CLI usage, including subcommand examples and Yarn configuration.

Build:

• Update the container image to use trustify-da directly as its entrypoint and omit the wrapper and implicit Yarn path.

Documentation:

• Add container usage guidance for CLI commands, remediation exit codes, and Yarn version selection.

Tests:

• Add coverage for Yarn variant detection across manifest metadata, configuration files, non-Yarn projects, and malformed manifests.

[sourcery-ai]

Reviewer's Guide

The container now invokes the installed trustify-da CLI directly instead of routing through a shell wrapper, enabling native subcommand and argument handling while documenting representative Docker usage patterns.

File-Level Changes

Change	Details	Files
Replaces the container’s shell wrapper with the JavaScript CLI as the direct Docker entrypoint.	Removes the wrapper script from builder and runtime image stages. Retains executable permissions for the installed CLI binary. Configures ENTRYPOINT ["trustify-da"] so Docker arguments route directly to CLI subcommands.	docker-image/Dockerfiles/Dockerfile
Documents direct container usage across the CLI’s primary workflows.	Adds examples for global help, stack analysis, remediation, and SBOM generation with volume mounts. Documents per-subcommand help and Yarn version selection through TRUSTIFY_DA_YARN_PATH. Corrects Markdown table separator formatting.	docker-image/README.md

---

Tips and commands

Interacting with Sourcery

• Trigger a new review: Comment @sourcery-ai review on the pull request.
• Continue discussions: Reply directly to Sourcery's review comments.
• Generate a GitHub issue from a review comment: Ask Sourcery to create an
  issue from a review comment by replying to it. You can also reply to a
  review comment with @sourcery-ai issue to create an issue from it.
• Generate a pull request title: Write @sourcery-ai anywhere in the pull
  request title to generate a title at any time. You can also comment
  @sourcery-ai title on the pull request to (re-)generate the title at any time.
• Generate a pull request summary: Write @sourcery-ai summary anywhere in
  the pull request body to generate a PR summary at any time exactly where you
  want it. You can also comment @sourcery-ai summary on the pull request to
  (re-)generate the summary at any time.
• Generate reviewer's guide: Comment @sourcery-ai guide on the pull
  request to (re-)generate the reviewer's guide at any time.
• Resolve all Sourcery comments: Comment @sourcery-ai resolve on the
  pull request to resolve all Sourcery comments. Useful if you've already
  addressed all the comments and don't want to see them anymore.
• Dismiss all Sourcery reviews: Comment @sourcery-ai dismiss on the pull
  request to dismiss all existing Sourcery reviews. Especially useful if you
  want to start fresh with a new review - don't forget to comment
  @sourcery-ai review to trigger a new review!

Customizing Your Experience

Access your dashboard to:

• Enable or disable review features such as the Sourcery-generated pull request
  summary, the reviewer's guide, and others.
• Change the review language.
• Add, remove or edit custom review instructions.
• Adjust other review settings.

Getting Help

• Contact our support team for questions or feedback.
• Visit our documentation for detailed guides and information.
• Keep in touch with the Sourcery team by following us on X/Twitter, LinkedIn or GitHub.

[sourcery-ai]

Hey - I've found 1 issue

Prompt for AI Agents

Please address the comments from this code review:

## Individual Comments

### Comment 1
<location path="docker-image/Dockerfiles/Dockerfile" line_range="131-133" />
<code_context>

-# Copy trustify-da-javascript-client executable script from the builder stage
-COPY --from=builder /trustify-da.sh /trustify-da.sh
+# Use the trustify-da CLI directly as the entrypoint; any subcommand (stack,
+# remediate, sbom, image, license, ...) can be passed as `docker run <image> <command> [args]`
+ENTRYPOINT ["trustify-da"]
</code_context>
<issue_to_address>
**issue (broader_impact):** The direct CLI entrypoint removes the wrapper's automatic Yarn-version detection. A Yarn Classic project with `package.json` and `yarn.lock`, no `packageManager` field, and no manually supplied `TRUSTIFY_DA_YARN_PATH` is analyzed with the image's default `/usr/local/corepack/bin/yarn` instead of `/usr/local/bin/yarn-classic`, so dependency extraction runs with the wrong Yarn version and can fail or produce an incorrect dependency set.

**Triggers:** When analyzing Yarn Classic projects that do not declare `packageManager` and do not explicitly set `TRUSTIFY_DA_YARN_PATH`.

**Suggested fix:** Move the wrapper's manifest-based Yarn selection into the CLI/provider path, or retain a thin entrypoint wrapper that sets `TRUSTIFY_DA_YARN_PATH` before invoking `trustify-da`.
</issue_to_address>

Sourcery assessment

Approval pending. 1 finding to address first.

Blocking findings: docker-image/Dockerfiles/Dockerfile:133

---

Sourcery is free for open source - if you like our reviews please consider sharing them ✨

• X
• Mastodon
• LinkedIn
• Facebook

[codecov-commenter]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 92.07%. Comparing base (efdc87d) to head (b2360e4).

Additional details and impacted files

@@            Coverage Diff             @@
##             main     #628      +/-   ##
==========================================
+ Coverage   92.02%   92.07%   +0.04%     
==========================================
  Files          45       45              
  Lines       10602    10665      +63     
  Branches     1921     1935      +14     
==========================================
+ Hits         9757     9820      +63     
  Misses        845      845              

Flag	Coverage Δ
unit-tests	92.07% <100.00%> (+0.04%)	⬆️

Flags with carried forward coverage won't be shown. Click here to find out more.

Files with missing lines	Coverage Δ
src/providers/javascript_yarn.js	94.97% <100.00%> (+2.32%)	⬆️

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[a-oren]

[sdlc-workflow/verify-pr] Re: @sourcery-ai review — Classified as code change request — sub-task TC-6104 created to address this feedback (the Yarn Classic/Berry auto-detection regression). Same finding as inline comment on docker-image/Dockerfiles/Dockerfile:133; confirmed accurate by verification.

[a-oren]

Verification Report for TC-5614 (commit ded6d3b)

Check	Result	Details
Review Feedback	WARN	1 code change request (Yarn detection regression, flagged inline + review body); sub-task TC-6104 created
Root-Cause Investigation	DONE	plan-feature gap; root-cause task TC-6105 created
Scope Containment	PASS	Exactly the 2 task files changed (Dockerfile, README.md)
Diff Size	PASS	Proportionate: 2 files, ~34 insertions / 8 deletions
Commit Traceability	FAIL	Sole commit ded6d3b does not reference TC-5614
Sensitive Patterns	PASS	No secrets/keys/credentials in added lines
CI Status	PASS	All 5 checks pass (lint/test 22 & 24, sourcery, PR title, commit messages)
Acceptance Criteria	WARN	4 of 5 met; AC#2 (backward-compat stack) has a confirmed Yarn Classic regression, mitigated only by the documented TRUSTIFY_DA_YARN_PATH workaround
Test Quality	N/A	No test files in diff; Eval Quality: N/A
Test Change Classification	N/A	No test files modified or deleted
Verification Commands	N/A	Docker build/run not executable here; CI exercises the build (PASS)

Overall: FAIL

Issues requiring attention:

1. Commit Traceability (FAIL) — the commit message refactor(docker): use CLI as direct entrypoint contains no TC-5614 reference. Add a trailer or amend to reference the task.
2. Yarn Classic regression (WARN, tracked in TC-6104) — removing trustify-da.sh dropped automatic Yarn-variant detection, which is not replicated in the provider code. A genuine Yarn Classic project (v1 yarn.lock, no packageManager, no .yarnrc.yml) with TRUSTIFY_DA_YARN_PATH unset now runs under the corepack default (yarn@4.9.1 → Berry processor), producing a wrong/failed dependency set. A manual TRUSTIFY_DA_YARN_PATH workaround is documented, but the automatic behavior is gone. Fix tracked in TC-6104; root cause (plan-feature offered documentation as an equivalent to behavior preservation) tracked in TC-6105.

Security is clean and CI is green. This report is informational — a human reviewer decides whether to merge.

---

This comment was AI-generated by sdlc-workflow/verify-pr v0.13.9.

[sourcery-ai]

Sourcery assessment

Approved.

Sourcery withdrew this approval because the latest commits introduced blocking findings.

[sourcery-ai]

Sourcery assessment

Approved.

[Strum355]

These yarn changes should be done in a separate PR in my opinion 😄 Ill review both PRs when theyre separate