feat(providers): add Dockerfile/Containerfile provider for image analysis (#569)

* feat(providers): add Dockerfile/Containerfile provider for image analysis

Add a new provider that recognizes Dockerfile and Containerfile manifests
for component and stack analysis. The provider parses FROM lines to extract
the base image reference, then reuses generateImageSBOM to produce a
CycloneDX SBOM. Multi-stage Dockerfiles use the final stage's FROM image.

Implements TC-4937

Assisted-by: Claude Code

* fix(providers): strip all leading flags from Dockerfile FROM lines

The parseFromImage function previously only stripped a single --flag
token using a regex. Dockerfile syntax allows multiple flags before
the image reference. Replace the single regex with a loop that skips
all leading --flag tokens.

TC-4977

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Assisted-by: Claude Code

* fix(providers): detect and reject ARG-substituted FROM targets

When a Dockerfile uses ARG substitution in FROM lines (e.g.
FROM ${BASE_IMAGE}), parseFromImage now throws a clear error
instead of passing the unresolved variable to downstream functions.

TC-4978

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Assisted-by: Claude Code

* feat(oci): normalize Docker Hub refs and use tree-sitter for Dockerfile parsing

Normalize Docker Hub image references in PURL generation so all FROM
formats (node:22, docker.io/node:22, docker.io/library/node:22) produce
the same repository_url=docker.io/node qualifier, matching the Hummingbird
hardened image index. Migrate Dockerfile FROM parsing from regex to
tree-sitter-containerfile for robust AST-based extraction. Rename
TRUSTIFY_DA_RECOMMENDATIONS_ENABLED to TRUSTIFY_DA_RECOMMEND and use
getCustom() for consistent env/option lookup. Support suffixed Dockerfile
variants (e.g. Dockerfile.dev).

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

---------

Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>

Author: a-oren

CONVENTIONS.md

@@ -8,7 +8,8 @@
 - **TypeScript**: Configuration present but code is primarily JavaScript with JSDoc
 - **Node.js**: Requires Node >= 20.0.0, npm >= 11.5.1
 - **CLI**: `yargs` for command-line argument parsing
-- **Parsing Libraries**: `fast-xml-parser`, `fast-toml`, `smol-toml`, `tree-sitter-requirements`
+- **Parsing Libraries**: `fast-xml-parser`, `fast-toml`, `smol-toml`, `web-tree-sitter` with grammar packages (`tree-sitter-requirements`, `tree-sitter-gomod`, `tree-sitter-containerfile`)
+- **Prefer proper parsers over regex**: When parsing structured file formats (e.g., go.mod, requirements.txt, Dockerfile), use tree-sitter grammars rather than hand-written regex. Tree-sitter grammars already exist for several formats and provide a well-defined AST that handles edge cases. Follow the existing pattern: add the grammar package, create a `*_parser.js` module under `src/providers/`, copy the `.wasm` file in `pretest`/`postcompile` scripts, and use queries to extract data from the syntax tree.
 
 ## Code Style
 

README.md

@@ -695,7 +695,7 @@ By default, The API algorithm will use native commands of PIP installer as data
 It's also possible to use the lightweight Python PIP utility [pipdeptree](https://pypi.org/project/pipdeptree/) as data source instead. In order to activate this, you need to set the environment variable/option `TRUSTIFY_DA_PIP_USE_DEP_TREE` to 'true'.
 
 #### Toggle Red Hat Trusted Content recommendations
-Both the HTML-based report and JSON response will by default contain recommendations for migrating to Red Hat-based Trusted Content repositories. This feature can be disabled by setting `TRUSTIFY_DA_RECOMMENDATIONS_ENABLED` to 'false' via environment variables or options.
+Both the HTML-based report and JSON response will by default contain recommendations for migrating to Red Hat-based Trusted Content repositories. This feature can be disabled by setting `TRUSTIFY_DA_RECOMMEND` to 'false' via environment variables or options.
 
 #### Additional CLI arguments
 For some ecosystems we support passing additional CLI arguments to the underlying tools. The following table outlines the supported ecosystems and the environment variable/option that configures this. Note that the arguments are expected to be in the format of a JSON array.