[LarsLaskowski]

Pull Request

📖 Description

Remote base-image label references, Docker Engine container image references and Docker Hub repository names reached length-limited PostgreSQL columns unchecked, so one oversized value failed the final save of a whole scan or discovery run. They are now checked against Docker's reference grammar (registry ≤ 200, repository ≤ 255, tag ≤ 128, invalid digest becomes none), and display names (container name, Compose labels, discovered image name, relationship source reference) are cut to their column length, while container IDs over 200 characters are skipped. The grammar also rejects . and .. path segments, which keeps remote references from steering registry and Docker Hub request paths. A base-image label the parser rejects no longer fails the whole observed-image scan, and an invalid runtime container reference ends the run partial with Container '<name>' could not be processed: invalid image reference. Decision record 0014 is extended and the affected area documents are updated; a U+0000 in remote strings was already handled by #359.

🎫 Issues

Closes #355

💬 Reviewer Notes

Security area change (registry/Docker Hub calls, Docker Engine access, logging of external data); the dot-segment guard is RegistryReferenceValidator.IsValidRepository. Manual registration keeps its old parsing and is covered by the follow-up #360. The existing tests whose inputs the new grammar rejects were adapted to still prove control-character replacement.

📑 Test Plan

New unit tests per acceptance criterion in the validator, label reader, CutToLength, both registry clients, the Docker Hub discovery, DockerInstanceClient, ImageScanOrchestrator and RuntimeContainerScanOrchestrator; no reproduction against a live PostgreSQL, because the test databases do not enforce column lengths. Local run: 877 + 21 tests pass, new/changed code 100 % covered, overall 87.9 %.

✅ Checklist

• I have added or updated Unit Tests for the change.
• I have tested my changes.
• I have run Format and Build from .squad/stack.md, and the Analyzer gate reports no diagnostic in a changed file.
• The Coverage gate in .squad/stack.md passes (line coverage on new or changed production code and overall).
• I have updated the project documentation (README.md, ARCHITECTURE.md) to reflect my changes.
• I have read the CONTRIBUTING documentation and followed the project's code style guidelines.
• New dependencies, if any, were added the way Dependencies in .squad/stack.md prescribes.
• The C# rules in csharp.instructions.md are followed.

⏭ Next Steps

• Registry request paths pass . and .. repository segments #360 Registry request paths pass . and .. repository segments
• Remove the unused base-image chains of the registry clients #361 Remove the unused base-image chains of the registry clients

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
97.9% Coverage on New Code
0.1% Duplication on New Code

See analysis details on SonarQube Cloud