CLI-471 allow env vars for OIDC urls

[sophio-japharidze-sonarsource]

In order to make the plugin work for SonarQube Cloud US region as well, we should not keep hardcoding the OIDC exchange URLs. Instead, they should be populated through Env variables.

[sonar-review-alpha]

Summary

This PR replaces three hardcoded OIDC configuration values with environment variables to support multiple SonarQube Cloud regions (US, EU, etc.). Specifically:

• OIDC audience: Changed from https://sonarcloud.io to ${{ vars.COPILOT_MCP_SONARQUBE_URL }}
• OIDC token exchange endpoint: Changed from https://api.sonarcloud.io/authentication/token to ${{ vars.COPILOT_MCP_SONARQUBE_OIDC_EXCHANGE_URL }}
• SONARQUBE_URL is now passed as an environment variable to the container

The changes are minimal and focused only on making these region-specific URLs configurable via GitHub repository variables.

What reviewers should know

What changed: Only agents/main.agent.md was modified — the agent configuration file that defines the OIDC settings and container environment.

Key areas to review:

1. Verify the three variable names match what's configured in GitHub Actions vars
2. Confirm the OIDC endpoints are correctly mapped (audience and exchange URL for each region)
3. Check that SONARQUBE_URL env var is used consistently (both in container env and OIDC audience)

Non-obvious aspects:

• The SONARQUBE_URL is referenced twice: once as a container env var and once as the OIDC audience, which is intentional for region flexibility
• The COPILOT_MCP_SONARQUBE_OIDC_EXCHANGE_URL variable name suggests it's specifically for the token exchange endpoint, not a general URL
• No code changes are needed in the actual plugin; this configuration change alone enables multi-region support

---

• Generate Walkthrough
• Generate Diagram

🗣️ Give feedback

[sonar-review-alpha]

Good direction for multi-region support. There is one breaking-change issue in the agent config and the README needs to catch up with the new variables — both need to be addressed before this is safe to merge.

README.md still describes the OIDC audience as the hardcoded https://sonarcloud.io string (line 31) and the setup table only lists COPILOT_MCP_SONARQUBE_ORG and COPILOT_MCP_SONARQUBE_PROJECT_KEY. The three new variables (COPILOT_MCP_SONARQUBE_URL, COPILOT_MCP_SONARQUBE_OIDC_EXCHANGE_URL, and SONARQUBE_URL as a container env) are completely absent from the docs, so any user following the README will be missing required config with no error message to guide them.

🗣️ Give feedback