Heredocs in Dockerfiles are not recognized

[BartSchuurmans]

When using here-documents in Dockerfiles, this action cannot correctly parse them:

time="2025-08-20 15:59:42" level=warning msg="Dockerfile: Problem parsing 'comp-1.Dockerfile' line 6 expecting to read instruction as single line command, but read 'apt-get update -y --allow-releaseinfo-change'" file="dockerfileparser.go:142:"

[bluesentinelsec]

Hello @BartSchuurmans, we are confirming receipt of your issue.
We are presently investigating and will report back when we have pertinent updates.

[bluesentinelsec]

@BartSchuurmans can you please share more information for us to reproduce your issue?

1. What version of the Inspector-GitHub Action are you using? (latest is 1.3.0)
2. What version of Inspector SBOM generator is being used? If set to latest, that should be 1.8.1.
3. Can you share with us a Dockerfile known to trigger this behavior?

[BartSchuurmans]

1. We are using v1.3.0 of the action
2. We are indeed using v1.8.1 of the Inspector SBOM generator
3. I created the following minimal reproducer:

FROM debian:latest

RUN <<-EOF
  echo "foo"
  echo "bar"
EOF

time="2025-08-21 15:53:07" level=info msg="analyzing artifact" file="coreV1.go:92:"
time="2025-08-21 15:53:07" level=warning msg="Dockerfile: Problem parsing 'comp-1.Dockerfile' line 2 expecting to read instruction as single line command, but read 'echo \"bar\"'" file="dockerfileparser.go:142:"

[bluesentinelsec]

Confirming that we can reproduce the issue.
We are presently working on a solution.
I will report back when we are confident on resolution and next steps.

[bluesentinelsec]

Small update: the solution for this issue is presently undergoing detailed review and testing.
I will report back once the solution is approved and we have a estimated release date.

[bluesentinelsec]

The fix for this issue will be shipped in our next inspector-sbomgen release, likely towards end of September or early October. I will report back as we get closer to the firm release date.