fix(providers): detect and reject ARG-substituted FROM targets

When a Dockerfile uses ARG substitution in FROM lines (e.g.
FROM ${BASE_IMAGE}), parseFromImage now throws a clear error
instead of passing the unresolved variable to downstream functions.

TC-4978

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Assisted-by: Claude Code

Author: a-oren

src/providers/oci_dockerfile.js

@@ -55,6 +55,9 @@ export function parseFromImage(manifestContent) {
 	if (!lastFrom) {
 		throw new Error('No FROM line found in Dockerfile')
 	}
+	if (lastFrom.includes('${')) {
+		throw new Error('Dockerfile uses ARG substitution in FROM line — cannot resolve variable references')
+	}
 	return lastFrom
 }
 

test/providers/oci_dockerfile.test.js

@@ -77,6 +77,12 @@ suite('testing the Dockerfile/Containerfile data provider', () => {
 			expect(parseFromImage(content)).to.equal('httpd@sha256:abc123')
 		})
 
+		/** Verifies that ARG-substituted FROM targets are rejected with a clear error. */
+		test('throws when FROM target uses ARG substitution', () => {
+			const content = 'ARG BASE_IMAGE=ubuntu:22.04\nFROM ${BASE_IMAGE}\n'
+			expect(() => parseFromImage(content)).to.throw('Dockerfile uses ARG substitution in FROM line')
+		})
+
 		/** Verifies that an error is thrown when no FROM line is present. */
 		test('throws when no FROM line found', () => {
 			const content = 'RUN echo hello\n'