fix(providers): handle quoted ARG defaults and skip duplicate image SBOMs

Broaden the tree-sitter ARG query to match any node type (not just
unquoted_string) so quoted defaults like ARG FOO="bar" are captured.
Strip surrounding quotes in collectArgs. Also skip redundant
generateImageSBOM calls when the same image appears in multiple FROM lines.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

Author: a-oren

src/providers/containerfile_parser.js

@@ -22,5 +22,5 @@ export async function getFromQuery() {
 
 export async function getArgQuery() {
 	const language = await init();
-	return new Query(language, '(arg_instruction (arg_pair name: (unquoted_string) @name default: (unquoted_string) @default))');
+	return new Query(language, '(arg_instruction (arg_pair name: (_) @name default: (_) @default))');
 }

src/providers/oci_dockerfile.js

@@ -50,6 +50,19 @@ function containsExpansion(node) {
 	return false
 }
 
+/**
+ * Strip surrounding single or double quotes from a string.
+ * @param {string} text
+ * @returns {string}
+ * @private
+ */
+function stripQuotes(text) {
+	if ((text.startsWith('"') && text.endsWith('"')) || (text.startsWith("'") && text.endsWith("'"))) {
+		return text.slice(1, -1)
+	}
+	return text
+}
+
 /**
  * Collect ARG key-value pairs from the Dockerfile AST.
  * Only ARGs with a default value are collected (ARGs without defaults cannot be resolved statically).
@@ -64,7 +77,7 @@ function collectArgs(tree, argQuery) {
 		const name = match.captures.find(c => c.name === 'name')?.node.text
 		const defaultValue = match.captures.find(c => c.name === 'default')?.node.text
 		if (name && defaultValue) {
-			args.set(name, defaultValue)
+			args.set(name, stripQuotes(defaultValue))
 		}
 	}
 	return args
@@ -141,7 +154,9 @@ async function getImageSBOM(manifest, opts = {}) {
 	const sbomByPurl = {}
 	for (const image of images) {
 		const imageRef = parseImageRef(image, opts)
-		sbomByPurl[imageRef.getPackageURL().toString()] = generateImageSBOM(imageRef, opts)
+		const purl = imageRef.getPackageURL().toString()
+		if (purl in sbomByPurl) continue
+		sbomByPurl[purl] = generateImageSBOM(imageRef, opts)
 	}
 	return {
 		ecosystem,

test/providers/oci_dockerfile.test.js

@@ -147,6 +147,20 @@ suite('testing the Dockerfile/Containerfile data provider', () => {
 			expect(result).to.deep.equal(['alpine:3.18'])
 		})
 
+		/** Verifies that ARG with double-quoted default is resolved correctly. */
+		test('resolves ARG with double-quoted default', async () => {
+			const content = 'ARG BASE_IMAGE="ubuntu:22.04"\nFROM ${BASE_IMAGE}\n'
+			const result = await parseAllFromImages(content)
+			expect(result).to.deep.equal(['ubuntu:22.04'])
+		})
+
+		/** Verifies that ARG with single-quoted default is resolved correctly. */
+		test('resolves ARG with single-quoted default', async () => {
+			const content = "ARG BASE_IMAGE='alpine:3.18'\nFROM ${BASE_IMAGE}\n"
+			const result = await parseAllFromImages(content)
+			expect(result).to.deep.equal(['alpine:3.18'])
+		})
+
 		/** Verifies that comment lines and blank lines are ignored. */
 		test('ignores comments and blank lines', async () => {
 			const content = [