Please address the comments from this code review:

## Overall Comments
- The `parseFromImage` implementation assumes a relatively simple `FROM` syntax and only strips a single leading `--flag`; consider making this parsing more robust (e.g., handling multiple flags, comments, and more complex whitespace) or delegating to a Dockerfile parser to avoid mis-extracting the base image.
- In `getImageSBOM`, synchronous `fs.readFileSync` is used; if other providers are asynchronous or this runs in a performance-sensitive path, consider aligning with the existing I/O pattern to avoid blocking the event loop on large Dockerfiles.

## Individual Comments

### Comment 1
<location path="src/providers/oci_dockerfile.js" line_range="39-44" />
<code_context>
+ * @returns {string} the image reference from the last FROM line
+ * @throws {Error} when no FROM line is found in the Dockerfile
+ */
+export function parseFromImage(manifestContent) {
+	const lines = manifestContent.split(/\r?\n/)
+	let lastFrom = null
+	for (const line of lines) {
+		const trimmed = line.trim()
+		if (/^FROM\s+/i.test(trimmed)) {
+			// Extract image ref: FROM [--platform=...] image [AS name]
+			const withoutFrom = trimmed.replace(/^FROM\s+/i, '')
</code_context>
<issue_to_address>
**issue (bug_risk):** Dockerfiles that use ARG substitution in FROM lines may not be handled correctly.

This implementation only works when the FROM image is a literal value. In cases like `ARG BASE_IMAGE` followed by `FROM ${BASE_IMAGE}`, `parseFromImage` will return `${BASE_IMAGE}`, which will not be a valid reference for `parseImageRef`/`generateImageSBOM`. If these patterns should be supported, you’ll need to resolve ARGs (including defaults/env), or detect non-literal FROM targets and fail fast with a clear error.
</issue_to_address>

### Comment 2
<location path="src/providers/oci_dockerfile.js" line_range="44-52" />
<code_context>
+		if (/^FROM\s+/i.test(trimmed)) {
+			// Extract image ref: FROM [--platform=...] image [AS name]
+			const withoutFrom = trimmed.replace(/^FROM\s+/i, '')
+			// Skip optional --platform flag
+			const withoutFlags = withoutFrom.replace(/^--\S+\s+/, '')
+			// Take only the image part (before AS alias)
+			const parts = withoutFlags.split(/\s+/)
</code_context>
<issue_to_address>
**suggestion (bug_risk):** Flag stripping on FROM lines only removes a single leading flag, which may miss valid Dockerfile syntax.

The Dockerfile syntax allows multiple flags before the image (e.g. `FROM --platform=$BUILDPLATFORM --some-flag image AS name`), but the current regex only removes a single leading `--...` token. With additional flags, `parts[0]` could still be a flag instead of the image. Consider stripping all leading `--...` tokens (e.g. in a loop) or splitting and filtering out `--*` tokens before selecting the image reference.

```suggestion
		if (/^FROM\s+/i.test(trimmed)) {
			// Extract image ref: FROM [--platform=...] [--flags...] image [AS name]
			const withoutFrom = trimmed.replace(/^FROM\s+/i, '')
			// Split into tokens and drop all leading flag tokens (starting with "--")
			const tokens = withoutFrom.split(/\s+/).filter(Boolean)
			let imageIndex = 0
			while (imageIndex < tokens.length && tokens[imageIndex].startsWith('--')) {
				imageIndex++
			}
			if (imageIndex < tokens.length) {
				// The first non-flag token is the image; ignore any following AS alias
				lastFrom = tokens[imageIndex]
			}
		}
```
</issue_to_address>