[vibgrate-team]

Summary

Dockerfiles that parameterise a base image with ARG defaults were recorded as a literal image name such as library/${BASE} with unknown drift. FROM now substitutes $NAME and ${NAME} from ARG name=default values that appear earlier in the file, including a default that itself references an earlier argument.

ARG NODE_VERSION=20
ARG BASE=node:${NODE_VERSION}-alpine
FROM ${BASE}

That file yields one library/node row at 20-alpine. FROM $UNSET with no default yields no row. Unresolved ${...} text is never written into an image name or tag.

Related issues

Fixes #577

Checklist

• pnpm test passes
• pnpm lint is clean
• pnpm typecheck is clean
• Docs updated (README / DOCS / ARCHITECTURE) where behavior changed
• Determinism preserved — identical input still produces identical graph.json / report output (content-hashed IDs, stable sorts; no time, randomness, or filesystem-order dependence)
• No proprietary or internal references — public, Apache-2.0 content only
• Commits use Conventional Commits and are signed off (git commit -s, DCO)

Notes for reviewers

No public docs describe Dockerfile FROM parsing, so none were changed. A variable with no default drops that FROM rather than inventing an image. Defaults are expanded when the ARG is seen, so a later ARG does not rewrite an earlier default that already used it.