fix(providers): analyze all FROM lines in multi-stage Dockerfiles via batch analysis (#577)

* fix(providers): analyze all FROM lines in multi-stage Dockerfiles via batch analysis

Change the Dockerfile/Containerfile provider to parse every FROM instruction
instead of only the last one. Each image gets its own SBOM in a purl-keyed map
that is routed to the /api/v5/batch-analysis endpoint via requestStackBatch().

- Rename parseFromImage() to parseAllFromImages() returning an array
- Build sbomByPurl map in getImageSBOM() following requestImages() pattern
- Add batch flag to provider result for routing in analysis.js
- Resolve ARG substitutions using declared defaults (matching VS Code extension)
- FROM lines with unresolvable ARGs (no default) are skipped without failing

Implements TC-5070

Assisted-by: Claude Code

* fix(providers): handle quoted ARG defaults and skip duplicate image SBOMs

Broaden the tree-sitter ARG query to match any node type (not just
unquoted_string) so quoted defaults like ARG FOO="bar" are captured.
Strip surrounding quotes in collectArgs. Also skip redundant
generateImageSBOM calls when the same image appears in multiple FROM lines.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

---------

Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>

Author: a-oren

src/analysis.js

@@ -24,6 +24,9 @@ async function requestStack(provider, manifest, url, html = false, opts = {}) {
 	opts["source-manifest"] = Buffer.from(fs.readFileSync(manifest).toString()).toString('base64')
 	opts["manifest-type"] = path.parse(manifest).base
 	let provided = await provider.provideStack(manifest, opts) // throws error if content providing failed
+	if (provided.batch) {
+		return requestStackBatch(JSON.parse(provided.content), url, html, opts)
+	}
 	opts["source-manifest"] = ""
 	opts[TRUSTIFY_DA_OPERATION_TYPE_HEADER.toUpperCase().replaceAll("-", "_")] = "stack-analysis"
 	let startTime = new Date()
@@ -88,6 +91,9 @@ async function requestComponent(provider, manifest, url, opts = {}) {
 	opts["source-manifest"] = Buffer.from(fs.readFileSync(manifest).toString()).toString('base64')
 
 	let provided = await provider.provideComponent(manifest, opts) // throws error if content providing failed
+	if (provided.batch) {
+		return requestStackBatch(JSON.parse(provided.content), url, false, opts)
+	}
 	opts["source-manifest"] = ""
 	opts[TRUSTIFY_DA_OPERATION_TYPE_HEADER.toUpperCase().replaceAll("-", "_")] = "component-analysis"
 	if (process.env["TRUSTIFY_DA_DEBUG"] === "true") {

src/providers/containerfile_parser.js

@@ -19,3 +19,8 @@ export async function getFromQuery() {
 	const language = await init();
 	return new Query(language, '(from_instruction (image_spec) @image)');
 }
+
+export async function getArgQuery() {
+	const language = await init();
+	return new Query(language, '(arg_instruction (arg_pair name: (_) @name default: (_) @default))');
+}

src/providers/oci_dockerfile.js

@@ -2,7 +2,7 @@ import fs from 'node:fs'
 
 import { generateImageSBOM, parseImageRef } from '../oci_image/utils.js'
 
-import { getFromQuery, getParser } from './containerfile_parser.js'
+import { getArgQuery, getFromQuery, getParser } from './containerfile_parser.js'
 
 export default { isSupported, validateLockFile, provideComponent, provideStack, readLicenseFromManifest, packageManagerName() { return 'oci' } }
 
@@ -51,43 +51,118 @@ function containsExpansion(node) {
 }
 
 /**
- * Parse the last FROM instruction from a Dockerfile using tree-sitter to extract the base image reference.
- * In multi-stage builds, the last FROM represents the final stage.
+ * Strip surrounding single or double quotes from a string.
+ * @param {string} text
+ * @returns {string}
+ * @private
+ */
+function stripQuotes(text) {
+	if ((text.startsWith('"') && text.endsWith('"')) || (text.startsWith("'") && text.endsWith("'"))) {
+		return text.slice(1, -1)
+	}
+	return text
+}
+
+/**
+ * Collect ARG key-value pairs from the Dockerfile AST.
+ * Only ARGs with a default value are collected (ARGs without defaults cannot be resolved statically).
+ * @param {import('web-tree-sitter').Tree} tree the parsed Dockerfile tree
+ * @param {import('web-tree-sitter').Query} argQuery the tree-sitter query for arg_instruction nodes
+ * @returns {Map<string, string>} map of ARG names to their default values
+ * @private
+ */
+function collectArgs(tree, argQuery) {
+	const args = new Map()
+	for (const match of argQuery.matches(tree.rootNode)) {
+		const name = match.captures.find(c => c.name === 'name')?.node.text
+		const defaultValue = match.captures.find(c => c.name === 'default')?.node.text
+		if (name && defaultValue) {
+			args.set(name, stripQuotes(defaultValue))
+		}
+	}
+	return args
+}
+
+/**
+ * Resolve ARG substitutions in an image spec text using the collected ARG map.
+ * Replaces ${VAR} and $VAR patterns with their ARG default values.
+ * @param {string} text the image spec text potentially containing variable references
+ * @param {Map<string, string>} args map of ARG names to their default values
+ * @returns {string|null} the resolved text, or null if any variable could not be resolved
+ * @private
+ */
+function resolveArgs(text, args) {
+	let resolved = text
+	let hasUnresolved = false
+	resolved = resolved.replace(/\$\{([^}]+)\}|\$([A-Za-z_]\w*)/g, (_match, braced, plain) => {
+		const key = braced || plain
+		if (args.has(key)) {
+			return args.get(key)
+		}
+		hasUnresolved = true
+		return _match
+	})
+	return hasUnresolved ? null : resolved
+}
+
+/**
+ * Parse all FROM instructions from a Dockerfile using tree-sitter to extract base image references.
+ * In multi-stage builds, every FROM line is returned so each image can be analyzed independently.
+ * ARG substitutions are resolved using declared default values. FROM lines with unresolvable
+ * variables (ARGs without defaults) are silently skipped.
  * @param {string} manifestContent the content of the Dockerfile
- * @returns {Promise<string>} the image reference from the last FROM instruction
- * @throws {Error} when no FROM instruction is found or when ARG substitution is used
+ * @returns {Promise<string[]>} array of image references from all resolvable FROM instructions
+ * @throws {Error} when no FROM instruction is found or when no FROM lines can be resolved
  */
-export async function parseFromImage(manifestContent) {
-	const [parser, fromQuery] = await Promise.all([getParser(), getFromQuery()])
+export async function parseAllFromImages(manifestContent) {
+	const [parser, fromQuery, argQuery] = await Promise.all([getParser(), getFromQuery(), getArgQuery()])
 	const tree = parser.parse(manifestContent)
 	const matches = fromQuery.matches(tree.rootNode)
 	if (matches.length === 0) {
 		throw new Error('No FROM line found in Dockerfile')
 	}
-	const lastMatch = matches[matches.length - 1]
-	const imageSpec = lastMatch.captures.find(c => c.name === 'image').node
-	if (containsExpansion(imageSpec)) {
-		throw new Error('Dockerfile uses ARG substitution in FROM line — cannot resolve variable references')
+	const args = collectArgs(tree, argQuery)
+	const images = []
+	for (const match of matches) {
+		const imageSpec = match.captures.find(c => c.name === 'image').node
+		if (containsExpansion(imageSpec)) {
+			const resolved = resolveArgs(imageSpec.text, args)
+			if (resolved != null) {
+				images.push(resolved)
+			}
+			continue
+		}
+		images.push(imageSpec.text)
 	}
-	return imageSpec.text
+	if (images.length === 0) {
+		throw new Error('Dockerfile uses ARG substitution in all FROM lines — cannot resolve variable references')
+	}
+	return images
 }
 
 /**
- * Generate an image SBOM from a Dockerfile manifest using syft.
+ * Generate image SBOMs for all FROM instructions in a Dockerfile manifest using syft.
+ * Returns a batch result with a purl-to-SBOM map suitable for the batch-analysis endpoint.
  * @param {string} manifest path to the Dockerfile
  * @param {{}} [opts={}] optional various options to pass along the application
- * @returns {Promise<{ecosystem: string, content: string, contentType: string}>}
+ * @returns {Promise<{ecosystem: string, content: string, contentType: string, batch: boolean}>}
  * @private
  */
 async function getImageSBOM(manifest, opts = {}) {
 	const manifestContent = fs.readFileSync(manifest, 'utf-8')
-	const image = await parseFromImage(manifestContent)
-	const imageRef = parseImageRef(image, opts)
-	const sbom = generateImageSBOM(imageRef, opts)
+	const images = await parseAllFromImages(manifestContent)
+	const sbomByPurl = {}
+	for (const image of images) {
+		const imageRef = parseImageRef(image, opts)
+		const purl = imageRef.getPackageURL().toString()
+		if (purl in sbomByPurl) continue
+		sbomByPurl[purl] = generateImageSBOM(imageRef, opts)
+	}
 	return {
 		ecosystem,
-		content: JSON.stringify(sbom),
-		contentType: 'application/vnd.cyclonedx+json'
+		content: JSON.stringify(sbomByPurl),
+		contentType: 'application/vnd.cyclonedx+json',
+		batch: true
 	}
 }