From 0822c46e22dfefd2987a1d26cf4ae5491dead7a6 Mon Sep 17 00:00:00 2001
From: John Lin <john.lin@ringcentral.com>
Date: Thu, 22 Oct 2026 20:23:31 +0800
Subject: [PATCH] fix(security): inherit JDK CVE-2026-91403 mitigation

---
 .github/workflows/build.yml | 1 +
 scripts/install-sonar.sh    | 3 +++
 2 files changed, 4 insertions(+)

diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
index 72b8ce1..88cbe3e 100644
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@@ -116,6 +116,7 @@ jobs:
           context: .
           file: ./Dockerfile
           platforms: linux/amd64,linux/arm64
+          pull: true
           push: ${{ github.ref == 'refs/heads/master' && github.event_name != 'pull_request' }}
           tags: ${{ steps.meta.outputs.tags }}
           build-args: |
diff --git a/scripts/install-sonar.sh b/scripts/install-sonar.sh
index 8df2ebe..aee3f6a 100644
--- a/scripts/install-sonar.sh
+++ b/scripts/install-sonar.sh
@@ -35,6 +35,9 @@ curl -sL "https://binaries.sonarsource.com/Distribution/sonar-scanner-cli/sonar-
     && ln -s /opt/sonar-scanner-${SONAR_VERSION}-${SONAR_ARCH}/bin/sonar-scanner /usr/local/bin/sonar-scanner \
     && sed -i 's/use_embedded_jre=true/use_embedded_jre=false/g' /opt/sonar-scanner-${SONAR_VERSION}-${SONAR_ARCH}/bin/sonar-scanner
 
+# The scanner uses the inherited JDK; do not retain its unpatched bundled JRE.
+rm -rf "/opt/sonar-scanner-${SONAR_VERSION}-${SONAR_ARCH}/jre"
+
 # Verify installation
 echo "=== Verifying Sonar Scanner ==="
 sonar-scanner --version