Review: one local name is still a local name; a local name is unique; recovery knows it; recipes read as instructions; a tag before a digest; ask fails at once when nothing serves

A secrets object with one local name delivered no file. Two requirements could share
a local name. secret recover and the export could not tell two locals apart. The
recipe check missed continued lines and read heredoc bodies as bases. repo:tag@digest
kept the tag in the repository. ask now publishes mandatory, so a tool nothing serves
is said at once rather than after the wait.

internal/builder/builder.go

@@ -831,11 +831,7 @@ func undeclaredFetches(recipe string, declared map[string]bool) (bases, copies [
 			*out = append(*out, ref)
 		}
 	}
-	for _, raw := range strings.Split(recipe, "\n") {
-		line := strings.TrimSpace(raw)
-		if line == "" || strings.HasPrefix(line, "#") {
-			continue
-		}
+	for _, line := range instructions(recipe) {
 		fields := strings.Fields(line)
 		switch strings.ToUpper(fields[0]) {
 		case "FROM":
@@ -860,7 +856,64 @@ func undeclaredFetches(recipe string, declared map[string]bool) (bases, copies [
 					note(strings.TrimPrefix(f, "--from="))
 				}
 			}
+		case "RUN":
+			// RUN --mount=type=bind,from=<image>,… reaches for an image exactly as COPY --from does.
+			out = &copies
+			for _, f := range fields[1:] {
+				if !strings.HasPrefix(f, "--mount=") {
+					continue
+				}
+				for _, opt := range strings.Split(strings.TrimPrefix(f, "--mount="), ",") {
+					if from, found := strings.CutPrefix(opt, "from="); found {
+						note(from)
+					}
+				}
+			}
 		}
 	}
 	return bases, copies
 }
+
+// instructions is a recipe as its instructions, one per line: continuations joined, comments and
+// blank lines dropped, and heredoc bodies (`COPY <<EOF … EOF`) skipped — a Python file written into
+// an image is not a list of images to fetch. The review found a `COPY \` continued onto the next
+// line slip past the check, and a stage named on a continuation line refused as a fetch.
+func instructions(recipe string) []string {
+	var out []string
+	var current strings.Builder
+	var heredoc string
+	flush := func() {
+		if line := strings.TrimSpace(current.String()); line != "" && !strings.HasPrefix(line, "#") {
+			out = append(out, line)
+		}
+		current.Reset()
+	}
+	for _, raw := range strings.Split(recipe, "\n") {
+		if heredoc != "" {
+			if strings.TrimSpace(raw) == heredoc {
+				heredoc = ""
+			}
+			continue
+		}
+		line := strings.TrimRight(raw, " \t")
+		if strings.HasPrefix(strings.TrimSpace(line), "#") && current.Len() == 0 {
+			continue
+		}
+		if strings.HasSuffix(line, "\\") {
+			current.WriteString(strings.TrimSuffix(line, "\\"))
+			current.WriteString(" ")
+			continue
+		}
+		current.WriteString(line)
+		if at := strings.Index(current.String(), "<<"); at >= 0 {
+			// `<<EOF`, `<<-EOF`, `<<'EOF'`, `<<"EOF"`: the body runs to a line that is the word.
+			word := strings.Fields(current.String()[at+2:])
+			if len(word) > 0 {
+				heredoc = strings.Trim(strings.TrimPrefix(word[0], "-"), `'"`)
+			}
+		}
+		flush()
+	}
+	flush()
+	return out
+}

internal/builder/mirror.go

@@ -52,6 +52,11 @@ func parseReference(ref string) (upstream, error) {
 	name, reference := ref, "latest"
 	if at := strings.Index(ref, "@"); at >= 0 {
 		name, reference = ref[:at], ref[at+1:]
+		// `repo:tag@digest` is what a runtime prints; the digest names the image and the tag is
+		// only what it was called. The tag is not part of the repository.
+		if colon := strings.LastIndex(name, ":"); colon > strings.LastIndex(name, "/") {
+			name = name[:colon]
+		}
 	} else if colon := strings.LastIndex(ref, ":"); colon > strings.LastIndex(ref, "/") {
 		name, reference = ref[:colon], ref[colon+1:]
 	}

internal/builder/mirror_test.go

@@ -208,3 +208,14 @@ func TestAReferenceIsReadTheWayARuntimeReadsIt(t *testing.T) {
 		}
 	}
 }
+
+// `repo:tag@digest` is what a runtime prints; the tag is not part of the repository (review C6).
+func TestATagBeforeTheDigestIsNotPartOfTheRepository(t *testing.T) {
+	got, err := parseReference("quay.io/minio/mc:RELEASE.2025@sha256:abc")
+	if err != nil {
+		t.Fatal(err)
+	}
+	if got.repository != "minio/mc" || got.reference != "sha256:abc" {
+		t.Fatalf("got %+v", got)
+	}
+}

internal/builder/standing_on_test.go

@@ -133,3 +133,22 @@ FROM golang:1.25-alpine AS go
 		t.Fatalf("declared arguments are not fetches: %v", copies)
 	}
 }
+
+// Continued lines are one instruction, heredoc bodies are not instructions, and a RUN --mount reaches
+// for an image as a COPY --from does (review C4, C5).
+func TestARecipeIsReadAsInstructions(t *testing.T) {
+	recipe := "ARG RUNTIME_BASE\n" +
+		"FROM ${RUNTIME_BASE} \\\n  AS build\n" +
+		"COPY \\\n  --from=docker.io/vendor/one:latest /a /a\n" +
+		"COPY --from=build /out /out\n" +
+		"COPY <<EOF /app/x.py\nfrom os import path\nEOF\n" +
+		"RUN --mount=type=bind,from=docker.io/vendor/two:1,target=/t cp /t/x /x\n" +
+		"FROM scratch\n"
+	bases, copies := undeclaredFetches(recipe, map[string]bool{"RUNTIME_BASE": true})
+	if strings.Join(copies, "|") != "docker.io/vendor/one:latest|docker.io/vendor/two:1" {
+		t.Fatalf("copies: %v", copies)
+	}
+	if len(bases) != 0 {
+		t.Fatalf("a heredoc line or a continued stage was read as a base: %v", bases)
+	}
+}