get-images-from-files/action.yaml

@@ -28,8 +28,12 @@ runs:
         images=$(
           for f in $file_list; do
             [ -f "$f" ] || continue
-            # Dockerfile: FROM [--platform=...] <image>
+            # Dockerfile: FROM [--platform=...] <image> [AS <name>]
-            awk '/^[[:space:]]*FROM[[:space:]]/ { print $NF }' "$f" 2>/dev/null || true
+            awk '/^[[:space:]]*FROM[[:space:]]/ {
+              for (i = 2; i <= NF; i++) {
+                if ($i !~ /^--/) { print $i; break }
+              }
+            }' "$f" 2>/dev/null || true
             # Kubernetes / Docker Compose: image: <ref>
             grep -E '[[:space:]]image:[[:space:]]' "$f" 2>/dev/null | sed 's/.*image:[[:space:]]*//' | awk '{ print $1 }' || true
             # Helmfile values: repository + tag (both required, by indent); tag without repo is skipped

get-images-from-files/test.Dockerfile

@@ -4,7 +4,7 @@ FROM example.com/library/nginx:v1
 # Registry path with tag — shared with K8s to test deduplication
 FROM example.com/distroless/static:nonroot
 # Registry with digest (Dockerfile)
-FROM example.com/library/base@sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa
+FROM example.com/library/base@sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa AS base
 
 # Ignored tags
 ## Short repo:tag (ignored by design; only registry refs are extracted)