[vibgrate-team]

Summary

scanDocker deduplicated images by name and kept only the first tag. A Dockerfile that pins golang:1.21 in a builder stage and golang:1.23 in a test stage, or a Compose file with services on postgres:13 and postgres:16, produced one row. The other pin never appeared, so its drift was missing from the scan.

Rows are now unique on name and tag. They are sorted by name, then tag, so order does not follow the file and stays the same across runs. The registry version lookup still runs once per image name; each row computes its own drift from that shared latest version.

parseDockerfile is unchanged.

Tests

test/docker-image-tags.test.ts covers:

• two tags of one image produce two rows, each with its own drift (minor-behind vs current, major-behind vs current)
• an identical name:tag used twice produces one row
• row order is stable across two scans, and the same when the file lists tags in the opposite order
• the same behavior for a Dockerfile and for Compose image: lines, with and without a file cache

pnpm test, pnpm lint, and pnpm typecheck pass.

Related issues

Closes #579

Checklist

• pnpm test passes
• pnpm lint is clean
• pnpm typecheck is clean
• Docs updated (README / DOCS / ARCHITECTURE) where behavior changed — no doc edit; the docs already describe one row per image tag and do not describe first-tag-only dedupe
• Determinism preserved — identical input still produces identical graph.json / report output (content-hashed IDs, stable sorts; no time, randomness, or filesystem-order dependence)
• No proprietary or internal references — public, Apache-2.0 content only
• Commits use Conventional Commits and are signed off (git commit -s, DCO)

Notes for reviewers

Dedup and row building in scanDocker are the only scanner changes. The registry lookup list is the sorted unique image names, not one entry per tag.