fix(dockerfile): guard nil deref in parseUser/parseArg

[devsy-app]

Package reviewed

pkg/dockerfile

Issue found

parseUser and parseArg dereferenced instruction.Next without a nil check. When a Dockerfile contains a bare directive with no value (e.g. FROM ubuntu followed by a malformed USER or ARG with no argument), the buildkit parser still emits the directive node with Next == nil, causing Parse to panic with a nil-pointer dereference instead of returning a parsed (valueless) entry. This crashes any caller that parses untrusted/malformed Dockerfile content.

Change

Guard the instruction.Next access in parseUser and parseArg and return an empty key-value pair when the directive carries no value (mirroring the nil-safe patterns already used by parseEnv and parseStage). Two tests were added to parse_test.go covering the USER-with-no-value and ARG-with-no-value cases, confirming the parser no longer panics.

• pkg/dockerfile/parse.go: nil-guard added to parseUser and parseArg.
• pkg/dockerfile/parse_test.go: TestValuelessUserDoesNotPanic, TestValuelessArgDoesNotPanic.

Verification performed

• task cli:format — clean (no formatting changes to touched files).
• task cli:lint:ci — 0 issues.
• task cli:test — pkg/dockerfile passes (all tests including the two new ones). The only failing package is pkg/git (TestRepoClone*), a known pre-existing failure on origin/main unrelated to this change (no pkg/git files touched).

This PR was created by an AI agent as part of an automated daily package review job.

[netlify]

✅ Deploy Preview for devsydev canceled.

Name	Link
🔨 Latest commit	f5f0c78
🔍 Latest deploy log	https://app.netlify.com/projects/devsydev/deploys/6a83fb8e6b2965000834ef7b

[netlify]

✅ Deploy Preview for images-devsy-sh canceled.

Name	Link
🔨 Latest commit	f5f0c78
🔍 Latest deploy log	https://app.netlify.com/projects/images-devsy-sh/deploys/6a83fb8e9b6e8400083fa04b

[codacy-production]

Up to standards ✅

🟢 Issues 0 issues

Results:
0 new issues

View in Codacy

🟢 Metrics 0 complexity · 0 duplication

Metric	Results
Complexity	0
Duplication	0

View in Codacy

AI Reviewer: run a review on demand. To trigger the first review automatically, go to your organization or repository integration settings. AI can make mistakes. Always validate suggestions.

_{TIP This summary will be updated as you push new changes.}