[17302513901yh-lang]

Fixes #578.

What changed

parseDockerfile and parseDockerCompose dropped parsed.registry when they built the row name, so every image was recorded as library/<image> or <namespace>/<image>. Non-Docker-Hub images were then looked up on Docker Hub under a path that belongs to a different image, and two registries with the same path collapsed into one row.

• New dockerRowName() in docker-cache.ts, used by both parsers, by the cache/manifest key in fetchDockerLatestVersion, and by its "only Docker Hub" guard. A registry is kept unless it is a Docker Hub alias (docker.io, index.docker.io, registry-1.docker.io), so Docker Hub names stay exactly as documented.
• docker-scanner.ts uses it in both parsers.

Root cause worth noting: fetchDockerLatestVersion already had if (parsed.registry && parsed.registry !== 'docker.io') return null, but it receives the row name, which no longer contained the registry, so the guard never fired. Keeping the registry in the name is what makes it work, so no extra filtering layer is needed.

Tests

test/docker-registry-host.test.ts, 6 cases:

• ghcr.io/acme/api, mcr.microsoft.com/dotnet/sdk, quay.io/prometheus/node-exporter keep the registry, stay drift: unknown, and none of them reaches the Docker Hub lookup.
• the same two references through docker-compose.yml.
• nginx:1.27.0 and bitnami/redis:7.4.1 behave exactly as before (library/nginx, bitnami/redis, drift current).
• docker.io/library/nginx and index.docker.io/bitnami/redis have the alias stripped.
• ghcr.io/acme/api and quay.io/acme/api stay two rows.
• localhost:5000/team/app keeps its port.

Note: the node_modules in this checkout was incomplete and the package manager install is blocked here, so CI is the first full run of the suite.

[crowers]

Thanks so much for this, @17302513901yh-lang — the write-up and tests are really clear, especially covering two registries that share a path and a registry with a port.

An equivalent fix is already in review in #599. It keeps the registry host on non-Docker-Hub names (including ghcr.io, mcr.microsoft.com, quay.io, and host:port registries), strips Docker Hub aliases such as docker.io, and stops those names being looked up on Hub. To avoid two overlapping changes to the same scanner, we'll land #599 for this one.

We'll leave this PR open so you can follow along. If you'd like to pick up something else, issues labelled good first issue are a great place to start, and we're happy to help.