[BUG] Scanner commands are unusable depending on plugin installation order.

[ethan-sargent]

Describe the bug

We are installing multiple plugins into the Salesforce CLI including this plugin.

Currently, it seems that changing the order we install plugins in changes yarn's hoisting behaviour. The order we were originally installing in was causing this plugin to be completely unusable.

Bug has also been logged in @oclif/plugin-plugins at oclif/plugin-plugins#642.
Note: I am aware this issue may remain an upstream issue of @oclif/plugin-plugins, however I am unsure whether this plugin can mitigate the issue, for example by providing more specific dependency requirements.

To Reproduce
Success case Dockerfile:

FROM node:18
RUN npm install -g @salesforce/cli 
RUN sf plugins install @salesforce/sfdx-scanner && \
    sf plugins install @salesforce/plugin-packaging && \
    sf plugins install @salesforce/plugin-community && \
    echo y | sf plugins install sfdx-git-delta && \
    sf plugins install sfdmu && \
    sf plugins install @salesforce/plugin-signups

Failure case Dockerfile:

FROM node:18
RUN npm install -g @salesforce/cli 
RUN sf plugins install @salesforce/sfdx-scanner && \
    sf plugins install @salesforce/plugin-packaging && \
    sf plugins install @salesforce/plugin-community && \
    sf plugins install @salesforce/plugin-signups && \
    sf plugins install sfdmu && \
    echo y | sf plugins install sfdx-git-delta

Build the dockerfiles and run any command from the @salesforce/sfdx-scanner plugin.

Command used when debugging this was sfdx scanner:rule:add --language xml --path temp.xml.

Expected behavior

This plugin should work as expected regardless of whether other plugins are installed before it.

Screenshots
Failure case:

Success case:

Desktop (please complete the following information):

• OS: as per node:18 dockerfile
• Scanner Version: 3.15.0

"Workaround": Have you found any ways to sidestep the problem?
Changing plugin installation order enabled this plugin to continue working.

"Urgency": How severe is this problem? "Business stopping" vs "Not business-stopping".

Not business stopping, but severe impact to developer experience.

[johnbelosf]

Thank you @ethan-sargent - I'll let the CLI team review this in the first instance and then work with us as required.

[johnbelosf]

Resolved by the CLI team in forcedotcom/cli#2426