Docker: a COPY --from carries an image reference in the grammar

[timtebeek]

• Follow-up to Docker: split an image reference in the grammar #8590, which gave FROM an IMAGE_REF lexer mode. COPY --from= never reached it, so it is the last of the "what could the grammar have owned" items about image references.

What changed

The lexer emits --name=value as a single FLAG token, so COPY --from=host:5000/img:1.2 was one flat literal and ImageReferences.split(List, Space) had to decide for itself which colon was a tag separator and which belonged to a registry port — the rule IMAGE_REF already knows. This is live: the docker-library corpus holds 72 --from=<image>:<tag>.

A FROM_FLAG token now pushes a FLAG_IMAGE_REF mode, and the value goes through the same imageReference rule a FROM does:

fromFlag
    : FROM_FLAG imageReference? FLAG_END?
    ;

Three things the mode needs:

• A predicate can only disable the longer rule, not beat it. Lexing is maximal munch, so a rule that stops at : always loses to FLAG. The predicate has to sit at the very start of the longer rule, turning it off:

  FLAG      : {!atFromFlag()}? FLAG_TOKEN;
  FROM_FLAG : {atFromFlag()}?  '--from=' -> pushMode(FLAG_IMAGE_REF);

  atFromFlag() is a copyAddFlags member set at COPY/ADD, cleared at UNQUOTED_TEXT and NEWLINE, plus an _input.LA() peek for --from=. --chown=1:2, RUN echo --from=a:b and --mount=type=cache,from=builder therefore stay single FLAG tokens.
• FLAG_IMAGE_REF differs from IMAGE_REF only in where it ends: at the whitespace before the paths rather than at AS or the end of the line.
• Popping a mode does not bound a parser rule. The shared imageName : textElement+ happily consumed past the pop, making --link part of the image name of COPY --from=build --link /target/ /. The pop has to emit a visible token the parser rule names, hence FLAG_END : ( WS_CHAR+ | LINE_CONT ) -> popMode. Retyping the mode's tokens back to UNQUOTED_TEXT would erase the boundary the mode created.

ImageReferences.split(List, Space) is deleted. DockerCopyFrom reads the parts off the separators the mode left in the flag value's contents, the same convention --mount=type=bind already uses for its =; the value prints as before, and a colon in a registry port, a quoted name or a variable reference never becomes a content of its own. split(String, Space) stays for the reference a recipe supplies as text (withImageReference), and shrinks to a single loop now that it has one caller shape.

One fix came out of FLAG_IMAGE_REF being modelled on IMAGE_REF: ESCAPED_CHAR ('\\' .) swallowed the newline of a line continuation, so FROM nginx:1.25\ + newline parsed the tag as 1.25\␊. Both modes now use '\\' ~[\r\n], which also keeps COPY --from=nginx:1.25\ + newline from regressing against the old FLAG token.

Verification

:rewrite-docker:test is green (539 tests). Four LST-shape cases in CopyTest (separators split out, only --from splits, a following flag is not part of the value, a line continuation ends the value) and two in DockerCopyFromTest (a variable tag split from a variable image name, a recipe-written reference read back as its parts) — the corpus holds no flag value containing a $VAR, so it can only prove "no regression", never "the fix works".

The corpus diff: 713 Dockerfiles from 29 docker-library repos, LST parts + round-trip result + syntax errors (via ExecutionContext.getOnError()) dumped at origin/main and with this change. Every one of the 144 changed lines is a --from value splitting as intended; no other LST changed, no round-trip mismatch appeared or disappeared, and the syntax-error set is identical.

-  FLAG from prefix=' ' value=[L(eclipse-temurin:11-jre) ]
+  FLAG from prefix=' ' value=[L(eclipse-temurin) L(:) L(11-jre) ]