[vibgrate-team]

Summary

vg scan only treated five exact filenames as Docker manifests (Dockerfile, docker-compose.yml, docker-compose.yaml, compose.yml, compose.yaml), and it stopped after the first Compose file in a directory. Common layouts were skipped.

The scanner now recognises:

• Dockerfile, Containerfile, Dockerfile.<suffix> (Dockerfile.prod), and <name>.Dockerfile (api.Dockerfile)
• docker-compose.yml / .yaml, compose.yml / .yaml, and overrides docker-compose.<name>.yml / .yaml and compose.<name>.yml / .yaml

Every matching file in a directory is parsed. Image rows stay deduplicated on name and tag, so the same image and tag in two files is one row and two tags stay two rows. The recognised names are listed in DOCS.md.

Related issues

Fixes #580

Checklist

• pnpm test passes
• pnpm lint is clean
• pnpm typecheck is clean
• Docs updated (README / DOCS / ARCHITECTURE) where behavior changed
• Determinism preserved — identical input still produces identical graph.json / report output (content-hashed IDs, stable sorts; no time, randomness, or filesystem-order dependence)
• No proprietary or internal references — public, Apache-2.0 content only
• Commits use Conventional Commits and are signed off (git commit -s, DCO)

Notes for reviewers

Project directories are sorted by path before they are scanned, so a tree with several Docker projects reports them in a stable order. Names are matched with the capitalisation above (Containerfile, not containerfile).