From 188d1275d6311a7195b35f62ead6099c45bc7320 Mon Sep 17 00:00:00 2001
From: Alex Skrypnyk <alex@drevops.com>
Date: Tue, 21 Jul 2026 17:12:03 +1000
Subject: [PATCH 1/4] [#2816] Fixed Docker build check warnings in CLI and
 database Dockerfiles.

Skipped the name-based 'SecretsUsedInArgOrEnv' check on the containers where the package token and the local database password are handled safely, and declared 'PHP_INI_SCAN_DIR' as an argument to satisfy the 'UndefinedVar' check while preserving the leading-colon default-scan-dir behaviour.
---
 .docker/cli.dockerfile      | 10 +++++++++-
 .docker/database.dockerfile |  5 +++++
 2 files changed, 14 insertions(+), 1 deletion(-)

diff --git a/.docker/cli.dockerfile b/.docker/cli.dockerfile
index bcd7d30f2..bada8f918 100644
--- a/.docker/cli.dockerfile
+++ b/.docker/cli.dockerfile
@@ -1,7 +1,12 @@
+# check=skip=SecretsUsedInArgOrEnv
 # CLI container.
 #
 # All CLI operations performed in this container.
 #
+# The `PACKAGE_TOKEN` argument below is flagged by name by the
+# `SecretsUsedInArgOrEnv` build check, but the token is passed as a build
+# secret and never written to an image layer, so that check is skipped.
+#
 # hadolint global ignore=DL3018,SC2174
 #
 # @see https://hub.docker.com/r/uselagoon/php-8.4-cli-drupal/tags
@@ -42,8 +47,11 @@ ENV COMPOSER_ALLOW_SUPERUSER=1 \
     COMPOSER_CACHE_DIR=/tmp/.composer/cache
 
 # Allow custom PHP runtime configuration for Drush CLI commands.
-# The leading colon appends to the default scan directories.
+# The argument is declared so the reference resolves cleanly; when the base
+# image does not set it, the value stays empty and the leading colon appends
+# to the default scan directories.
 # @see https://github.com/drevops/vortex/issues/1913
+ARG PHP_INI_SCAN_DIR=""
 ENV PHP_INI_SCAN_DIR="${PHP_INI_SCAN_DIR}:/app/drush/php-ini"
 
 # Starting from this line, Docker adds the result of each command as a
diff --git a/.docker/database.dockerfile b/.docker/database.dockerfile
index b7a439fe9..83ba67546 100644
--- a/.docker/database.dockerfile
+++ b/.docker/database.dockerfile
@@ -1,5 +1,10 @@
+# check=skip=SecretsUsedInArgOrEnv
 # Database container.
 #
+# The `MYSQL_PASSWORD` variable below is flagged by name by the
+# `SecretsUsedInArgOrEnv` build check. This is a local development database
+# with a non-secret default credential, so that check is skipped.
+#
 # @see https://hub.docker.com/r/uselagoon/mysql-8.4/tags
 # @see https://github.com/uselagoon/lagoon-images/tree/main/images/mysql
 #

From ac845dfe886ae9f19b4c8719ed68047d567fd519 Mon Sep 17 00:00:00 2001
From: Alex Skrypnyk <alex@drevops.com>
Date: Tue, 21 Jul 2026 17:12:28 +1000
Subject: [PATCH 2/4] Updated snapshots.

---
 .../handler_process/_baseline/.docker/cli.dockerfile   | 10 +++++++++-
 .../_baseline/.docker/database.dockerfile              |  5 +++++
 .../hosting_acquia/.docker/cli.dockerfile              |  2 +-
 .../.docker/cli.dockerfile                             |  2 +-
 .../handler_process/names/.docker/cli.dockerfile       |  2 +-
 .../handler_process/theme_claro/.docker/cli.dockerfile |  4 ++--
 .../theme_custom/.docker/cli.dockerfile                |  2 +-
 .../theme_olivero/.docker/cli.dockerfile               |  4 ++--
 .../handler_process/theme_stark/.docker/cli.dockerfile |  4 ++--
 .../.docker/cli.dockerfile                             |  4 ++--
 .../.docker/cli.dockerfile                             |  4 ++--
 .../tools_no_eslint_no_theme/.docker/cli.dockerfile    |  4 ++--
 .../tools_no_stylelint_no_theme/.docker/cli.dockerfile |  4 ++--
 13 files changed, 32 insertions(+), 19 deletions(-)

diff --git a/.vortex/installer/tests/Fixtures/handler_process/_baseline/.docker/cli.dockerfile b/.vortex/installer/tests/Fixtures/handler_process/_baseline/.docker/cli.dockerfile
index 97e2f240e..7181ff576 100644
--- a/.vortex/installer/tests/Fixtures/handler_process/_baseline/.docker/cli.dockerfile
+++ b/.vortex/installer/tests/Fixtures/handler_process/_baseline/.docker/cli.dockerfile
@@ -1,7 +1,12 @@
+# check=skip=SecretsUsedInArgOrEnv
 # CLI container.
 #
 # All CLI operations performed in this container.
 #
+# The `PACKAGE_TOKEN` argument below is flagged by name by the
+# `SecretsUsedInArgOrEnv` build check, but the token is passed as a build
+# secret and never written to an image layer, so that check is skipped.
+#
 # hadolint global ignore=DL3018,SC2174
 #
 # @see https://hub.docker.com/r/uselagoon/php-8.4-cli-drupal/tags
@@ -42,8 +47,11 @@ ENV COMPOSER_ALLOW_SUPERUSER=1 \
     COMPOSER_CACHE_DIR=/tmp/.composer/cache
 
 # Allow custom PHP runtime configuration for Drush CLI commands.
-# The leading colon appends to the default scan directories.
+# The argument is declared so the reference resolves cleanly; when the base
+# image does not set it, the value stays empty and the leading colon appends
+# to the default scan directories.
 # @see https://github.com/drevops/vortex/issues/1913
+ARG PHP_INI_SCAN_DIR=""
 ENV PHP_INI_SCAN_DIR="${PHP_INI_SCAN_DIR}:/app/drush/php-ini"
 
 # Starting from this line, Docker adds the result of each command as a
diff --git a/.vortex/installer/tests/Fixtures/handler_process/_baseline/.docker/database.dockerfile b/.vortex/installer/tests/Fixtures/handler_process/_baseline/.docker/database.dockerfile
index b21f8f9be..7c9d86e8c 100644
--- a/.vortex/installer/tests/Fixtures/handler_process/_baseline/.docker/database.dockerfile
+++ b/.vortex/installer/tests/Fixtures/handler_process/_baseline/.docker/database.dockerfile
@@ -1,5 +1,10 @@
+# check=skip=SecretsUsedInArgOrEnv
 # Database container.
 #
+# The `MYSQL_PASSWORD` variable below is flagged by name by the
+# `SecretsUsedInArgOrEnv` build check. This is a local development database
+# with a non-secret default credential, so that check is skipped.
+#
 # @see https://hub.docker.com/r/uselagoon/mysql-8.4/tags
 # @see https://github.com/uselagoon/lagoon-images/tree/main/images/mysql
 #
diff --git a/.vortex/installer/tests/Fixtures/handler_process/hosting_acquia/.docker/cli.dockerfile b/.vortex/installer/tests/Fixtures/handler_process/hosting_acquia/.docker/cli.dockerfile
index 399d0eee7..a39f0f434 100644
--- a/.vortex/installer/tests/Fixtures/handler_process/hosting_acquia/.docker/cli.dockerfile
+++ b/.vortex/installer/tests/Fixtures/handler_process/hosting_acquia/.docker/cli.dockerfile
@@ -1,4 +1,4 @@
-@@ -16,7 +16,7 @@
+@@ -21,7 +21,7 @@
  ARG LAGOON_PR_HEAD_SHA=""
  ENV LAGOON_PR_HEAD_SHA=${LAGOON_PR_HEAD_SHA}
  
diff --git a/.vortex/installer/tests/Fixtures/handler_process/hosting_project_name___acquia/.docker/cli.dockerfile b/.vortex/installer/tests/Fixtures/handler_process/hosting_project_name___acquia/.docker/cli.dockerfile
index 399d0eee7..a39f0f434 100644
--- a/.vortex/installer/tests/Fixtures/handler_process/hosting_project_name___acquia/.docker/cli.dockerfile
+++ b/.vortex/installer/tests/Fixtures/handler_process/hosting_project_name___acquia/.docker/cli.dockerfile
@@ -1,4 +1,4 @@
-@@ -16,7 +16,7 @@
+@@ -21,7 +21,7 @@
  ARG LAGOON_PR_HEAD_SHA=""
  ENV LAGOON_PR_HEAD_SHA=${LAGOON_PR_HEAD_SHA}
  
diff --git a/.vortex/installer/tests/Fixtures/handler_process/names/.docker/cli.dockerfile b/.vortex/installer/tests/Fixtures/handler_process/names/.docker/cli.dockerfile
index 83d2a9130..20c5a59d5 100644
--- a/.vortex/installer/tests/Fixtures/handler_process/names/.docker/cli.dockerfile
+++ b/.vortex/installer/tests/Fixtures/handler_process/names/.docker/cli.dockerfile
@@ -1,4 +1,4 @@
-@@ -32,7 +32,7 @@
+@@ -37,7 +37,7 @@
  ARG DRUPAL_TEMPORARY_FILES="${TMP:-/tmp}"
  ENV DRUPAL_TEMPORARY_FILES=${DRUPAL_TEMPORARY_FILES}
  
diff --git a/.vortex/installer/tests/Fixtures/handler_process/theme_claro/.docker/cli.dockerfile b/.vortex/installer/tests/Fixtures/handler_process/theme_claro/.docker/cli.dockerfile
index c7e9c2daa..c6e5e90e0 100644
--- a/.vortex/installer/tests/Fixtures/handler_process/theme_claro/.docker/cli.dockerfile
+++ b/.vortex/installer/tests/Fixtures/handler_process/theme_claro/.docker/cli.dockerfile
@@ -1,4 +1,4 @@
-@@ -32,7 +32,7 @@
+@@ -37,7 +37,7 @@
  ARG DRUPAL_TEMPORARY_FILES="${TMP:-/tmp}"
  ENV DRUPAL_TEMPORARY_FILES=${DRUPAL_TEMPORARY_FILES}
  
@@ -7,7 +7,7 @@
  ENV DRUPAL_THEME=${DRUPAL_THEME}
  
  ARG VORTEX_FRONTEND_BUILD_SKIP="0"
-@@ -86,12 +86,5 @@
+@@ -94,12 +94,5 @@
  
  # Create file directories and set correct permissions.
  RUN mkdir -p -m 2775 "/app/${WEBROOT}/${DRUPAL_PUBLIC_FILES}" "/app/${WEBROOT}/${DRUPAL_PRIVATE_FILES}" "${DRUPAL_TEMPORARY_FILES}"
diff --git a/.vortex/installer/tests/Fixtures/handler_process/theme_custom/.docker/cli.dockerfile b/.vortex/installer/tests/Fixtures/handler_process/theme_custom/.docker/cli.dockerfile
index f6f4d14f9..cf9161fb9 100644
--- a/.vortex/installer/tests/Fixtures/handler_process/theme_custom/.docker/cli.dockerfile
+++ b/.vortex/installer/tests/Fixtures/handler_process/theme_custom/.docker/cli.dockerfile
@@ -1,4 +1,4 @@
-@@ -32,7 +32,7 @@
+@@ -37,7 +37,7 @@
  ARG DRUPAL_TEMPORARY_FILES="${TMP:-/tmp}"
  ENV DRUPAL_TEMPORARY_FILES=${DRUPAL_TEMPORARY_FILES}
  
diff --git a/.vortex/installer/tests/Fixtures/handler_process/theme_olivero/.docker/cli.dockerfile b/.vortex/installer/tests/Fixtures/handler_process/theme_olivero/.docker/cli.dockerfile
index c7e9c2daa..c6e5e90e0 100644
--- a/.vortex/installer/tests/Fixtures/handler_process/theme_olivero/.docker/cli.dockerfile
+++ b/.vortex/installer/tests/Fixtures/handler_process/theme_olivero/.docker/cli.dockerfile
@@ -1,4 +1,4 @@
-@@ -32,7 +32,7 @@
+@@ -37,7 +37,7 @@
  ARG DRUPAL_TEMPORARY_FILES="${TMP:-/tmp}"
  ENV DRUPAL_TEMPORARY_FILES=${DRUPAL_TEMPORARY_FILES}
  
@@ -7,7 +7,7 @@
  ENV DRUPAL_THEME=${DRUPAL_THEME}
  
  ARG VORTEX_FRONTEND_BUILD_SKIP="0"
-@@ -86,12 +86,5 @@
+@@ -94,12 +94,5 @@
  
  # Create file directories and set correct permissions.
  RUN mkdir -p -m 2775 "/app/${WEBROOT}/${DRUPAL_PUBLIC_FILES}" "/app/${WEBROOT}/${DRUPAL_PRIVATE_FILES}" "${DRUPAL_TEMPORARY_FILES}"
diff --git a/.vortex/installer/tests/Fixtures/handler_process/theme_stark/.docker/cli.dockerfile b/.vortex/installer/tests/Fixtures/handler_process/theme_stark/.docker/cli.dockerfile
index c7e9c2daa..c6e5e90e0 100644
--- a/.vortex/installer/tests/Fixtures/handler_process/theme_stark/.docker/cli.dockerfile
+++ b/.vortex/installer/tests/Fixtures/handler_process/theme_stark/.docker/cli.dockerfile
@@ -1,4 +1,4 @@
-@@ -32,7 +32,7 @@
+@@ -37,7 +37,7 @@
  ARG DRUPAL_TEMPORARY_FILES="${TMP:-/tmp}"
  ENV DRUPAL_TEMPORARY_FILES=${DRUPAL_TEMPORARY_FILES}
  
@@ -7,7 +7,7 @@
  ENV DRUPAL_THEME=${DRUPAL_THEME}
  
  ARG VORTEX_FRONTEND_BUILD_SKIP="0"
-@@ -86,12 +86,5 @@
+@@ -94,12 +94,5 @@
  
  # Create file directories and set correct permissions.
  RUN mkdir -p -m 2775 "/app/${WEBROOT}/${DRUPAL_PUBLIC_FILES}" "/app/${WEBROOT}/${DRUPAL_PRIVATE_FILES}" "${DRUPAL_TEMPORARY_FILES}"
diff --git a/.vortex/installer/tests/Fixtures/handler_process/tools_groups_no_fe_lint_no_theme/.docker/cli.dockerfile b/.vortex/installer/tests/Fixtures/handler_process/tools_groups_no_fe_lint_no_theme/.docker/cli.dockerfile
index c7e9c2daa..c6e5e90e0 100644
--- a/.vortex/installer/tests/Fixtures/handler_process/tools_groups_no_fe_lint_no_theme/.docker/cli.dockerfile
+++ b/.vortex/installer/tests/Fixtures/handler_process/tools_groups_no_fe_lint_no_theme/.docker/cli.dockerfile
@@ -1,4 +1,4 @@
-@@ -32,7 +32,7 @@
+@@ -37,7 +37,7 @@
  ARG DRUPAL_TEMPORARY_FILES="${TMP:-/tmp}"
  ENV DRUPAL_TEMPORARY_FILES=${DRUPAL_TEMPORARY_FILES}
  
@@ -7,7 +7,7 @@
  ENV DRUPAL_THEME=${DRUPAL_THEME}
  
  ARG VORTEX_FRONTEND_BUILD_SKIP="0"
-@@ -86,12 +86,5 @@
+@@ -94,12 +94,5 @@
  
  # Create file directories and set correct permissions.
  RUN mkdir -p -m 2775 "/app/${WEBROOT}/${DRUPAL_PUBLIC_FILES}" "/app/${WEBROOT}/${DRUPAL_PRIVATE_FILES}" "${DRUPAL_TEMPORARY_FILES}"
diff --git a/.vortex/installer/tests/Fixtures/handler_process/tools_groups_no_fe_lint_no_theme_circleci/.docker/cli.dockerfile b/.vortex/installer/tests/Fixtures/handler_process/tools_groups_no_fe_lint_no_theme_circleci/.docker/cli.dockerfile
index c7e9c2daa..c6e5e90e0 100644
--- a/.vortex/installer/tests/Fixtures/handler_process/tools_groups_no_fe_lint_no_theme_circleci/.docker/cli.dockerfile
+++ b/.vortex/installer/tests/Fixtures/handler_process/tools_groups_no_fe_lint_no_theme_circleci/.docker/cli.dockerfile
@@ -1,4 +1,4 @@
-@@ -32,7 +32,7 @@
+@@ -37,7 +37,7 @@
  ARG DRUPAL_TEMPORARY_FILES="${TMP:-/tmp}"
  ENV DRUPAL_TEMPORARY_FILES=${DRUPAL_TEMPORARY_FILES}
  
@@ -7,7 +7,7 @@
  ENV DRUPAL_THEME=${DRUPAL_THEME}
  
  ARG VORTEX_FRONTEND_BUILD_SKIP="0"
-@@ -86,12 +86,5 @@
+@@ -94,12 +94,5 @@
  
  # Create file directories and set correct permissions.
  RUN mkdir -p -m 2775 "/app/${WEBROOT}/${DRUPAL_PUBLIC_FILES}" "/app/${WEBROOT}/${DRUPAL_PRIVATE_FILES}" "${DRUPAL_TEMPORARY_FILES}"
diff --git a/.vortex/installer/tests/Fixtures/handler_process/tools_no_eslint_no_theme/.docker/cli.dockerfile b/.vortex/installer/tests/Fixtures/handler_process/tools_no_eslint_no_theme/.docker/cli.dockerfile
index c7e9c2daa..c6e5e90e0 100644
--- a/.vortex/installer/tests/Fixtures/handler_process/tools_no_eslint_no_theme/.docker/cli.dockerfile
+++ b/.vortex/installer/tests/Fixtures/handler_process/tools_no_eslint_no_theme/.docker/cli.dockerfile
@@ -1,4 +1,4 @@
-@@ -32,7 +32,7 @@
+@@ -37,7 +37,7 @@
  ARG DRUPAL_TEMPORARY_FILES="${TMP:-/tmp}"
  ENV DRUPAL_TEMPORARY_FILES=${DRUPAL_TEMPORARY_FILES}
  
@@ -7,7 +7,7 @@
  ENV DRUPAL_THEME=${DRUPAL_THEME}
  
  ARG VORTEX_FRONTEND_BUILD_SKIP="0"
-@@ -86,12 +86,5 @@
+@@ -94,12 +94,5 @@
  
  # Create file directories and set correct permissions.
  RUN mkdir -p -m 2775 "/app/${WEBROOT}/${DRUPAL_PUBLIC_FILES}" "/app/${WEBROOT}/${DRUPAL_PRIVATE_FILES}" "${DRUPAL_TEMPORARY_FILES}"
diff --git a/.vortex/installer/tests/Fixtures/handler_process/tools_no_stylelint_no_theme/.docker/cli.dockerfile b/.vortex/installer/tests/Fixtures/handler_process/tools_no_stylelint_no_theme/.docker/cli.dockerfile
index c7e9c2daa..c6e5e90e0 100644
--- a/.vortex/installer/tests/Fixtures/handler_process/tools_no_stylelint_no_theme/.docker/cli.dockerfile
+++ b/.vortex/installer/tests/Fixtures/handler_process/tools_no_stylelint_no_theme/.docker/cli.dockerfile
@@ -1,4 +1,4 @@
-@@ -32,7 +32,7 @@
+@@ -37,7 +37,7 @@
  ARG DRUPAL_TEMPORARY_FILES="${TMP:-/tmp}"
  ENV DRUPAL_TEMPORARY_FILES=${DRUPAL_TEMPORARY_FILES}
  
@@ -7,7 +7,7 @@
  ENV DRUPAL_THEME=${DRUPAL_THEME}
  
  ARG VORTEX_FRONTEND_BUILD_SKIP="0"
-@@ -86,12 +86,5 @@
+@@ -94,12 +94,5 @@
  
  # Create file directories and set correct permissions.
  RUN mkdir -p -m 2775 "/app/${WEBROOT}/${DRUPAL_PUBLIC_FILES}" "/app/${WEBROOT}/${DRUPAL_PRIVATE_FILES}" "${DRUPAL_TEMPORARY_FILES}"

From 4945103ce039526a43d7e87d7ccf4d6782de0b12 Mon Sep 17 00:00:00 2001
From: Alex Skrypnyk <alex@drevops.com>
Date: Tue, 21 Jul 2026 18:12:07 +1000
Subject: [PATCH 3/4] [#2816] Scoped the build check fix to the CLI Dockerfile
 only.

The database container runs as a Lagoon-managed 'mariadb' service and is built only for local and CI use, and its 'MYSQL_PASSWORD' default is a real value baked into the image rather than a name-only false positive, so it is left outside this change.
---
 .docker/database.dockerfile | 5 -----
 1 file changed, 5 deletions(-)

diff --git a/.docker/database.dockerfile b/.docker/database.dockerfile
index 83ba67546..b7a439fe9 100644
--- a/.docker/database.dockerfile
+++ b/.docker/database.dockerfile
@@ -1,10 +1,5 @@
-# check=skip=SecretsUsedInArgOrEnv
 # Database container.
 #
-# The `MYSQL_PASSWORD` variable below is flagged by name by the
-# `SecretsUsedInArgOrEnv` build check. This is a local development database
-# with a non-secret default credential, so that check is skipped.
-#
 # @see https://hub.docker.com/r/uselagoon/mysql-8.4/tags
 # @see https://github.com/uselagoon/lagoon-images/tree/main/images/mysql
 #

From c8ac27e18b558c61a8837ee683afb87b8ba4bd28 Mon Sep 17 00:00:00 2001
From: Alex Skrypnyk <alex@drevops.com>
Date: Tue, 21 Jul 2026 18:12:23 +1000
Subject: [PATCH 4/4] Updated baseline.

---
 .../handler_process/_baseline/.docker/database.dockerfile    | 5 -----
 1 file changed, 5 deletions(-)

diff --git a/.vortex/installer/tests/Fixtures/handler_process/_baseline/.docker/database.dockerfile b/.vortex/installer/tests/Fixtures/handler_process/_baseline/.docker/database.dockerfile
index 7c9d86e8c..b21f8f9be 100644
--- a/.vortex/installer/tests/Fixtures/handler_process/_baseline/.docker/database.dockerfile
+++ b/.vortex/installer/tests/Fixtures/handler_process/_baseline/.docker/database.dockerfile
@@ -1,10 +1,5 @@
-# check=skip=SecretsUsedInArgOrEnv
 # Database container.
 #
-# The `MYSQL_PASSWORD` variable below is flagged by name by the
-# `SecretsUsedInArgOrEnv` build check. This is a local development database
-# with a non-secret default credential, so that check is skipped.
-#
 # @see https://hub.docker.com/r/uselagoon/mysql-8.4/tags
 # @see https://github.com/uselagoon/lagoon-images/tree/main/images/mysql
 #