[LarsLaskowski]

Pull Request

📖 Description

A registered image reference whose registry part was ., .. or another non-host value became the host of the OCI client's request URI, where UriBuilder threw a UriFormatException that no caller caught, so the scan ended as failed. The OCI client now accepts only a registry that is a host with an optional port (Docker's host grammar, at most 200 characters, port 1-65535) and answers every other value as not found without sending a request or logging. The same change fixes registries with a port (localhost:5000, registry.example.com:5000), which previously failed in the URI step and in DockerHubClient.IsSupportedRegistry, and GetTagsAsync now checks the registry before normalizing it. Decision record 0014 and the registries, image-catalog and architecture documents describe the behavior.

🎫 Issues

Closes #364. Follow-up: #367 (Trivy scan target can begin with a dash).

💬 Reviewer Notes

Security area: Registry and Docker Hub calls. The guard is OciRegistryClient.CreateRegistryUri; DockerHubClient.IsSupportedRegistry only stops throwing for host-less URI forms and serves the same hosts as before.

📑 Test Plan

New tests in OciRegistryClientTests cover the refused forms for GetTagAsync, GetTagsAsync, GetImageConfigurationAsync and ResolveBaseImagesAsync, the 201-character and port 0 cases, and registries with a port; DockerHubClientTests covers host-less values. All tests pass (994 + 21), new and changed code is 100 % covered.

✅ Checklist

• I have added or updated Unit Tests for the change.
• I have tested my changes.
• I have run Format and Build from .squad/stack.md, and the Analyzer gate reports no diagnostic in a changed file.
• The Coverage gate in .squad/stack.md passes (line coverage on new or changed production code and overall).
• I have updated the project documentation (README.md, ARCHITECTURE.md) to reflect my changes.
• I have read the CONTRIBUTING documentation and followed the project's code style guidelines.
• New dependencies, if any, were added the way Dependencies in .squad/stack.md prescribes.
• The C# rules in csharp.instructions.md are followed.

⏭ Next Steps

• Trivy scan target can begin with a dash #367

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
98.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud