chore: consolidate archive extraction (CN-941)

[ividalATSnyk]

• Ready for review
• Follows CONTRIBUTING rules
• Reviewed by Snyk internal team

What does this PR do?

• wrap docker and kaniko archive extraction under a generic archive extractor to reduce duplication

Where should the reviewer start?

You can take a look at the generic extractor here.

How should this be manually tested?

You can test by running a scan via cli for a Kaniko or Docker Archive.

What are the relevant tickets?

• CN-941

Questions?

There may be a better method for testing manually, open to ideas!

[snyk-pr-review-bot]

PR Reviewer Guide 🔍

🧪 PR contains tests

🔒 No security concerns identified

⚡ Recommended focus areas for review Regression in Archive Handling 🟠 [major] The new generic extractor uses gunzip() directly on the input stream. The original implementations in docker-archive/layer.ts and kaniko-archive/layer.ts used gunzip-maybe(). By switching to gunzip(), the code will now fail with a 'Z_DATA_ERROR' or 'header check' error if the provided archive is an uncompressed tarball, which is a common scenario for local development or certain CI exports. .pipe(tarExtractor); Oversized Error Mapping 🟡 [minor] The createGetImageIdFromManifest function catches all errors during ID extraction and throws a generic 'Failed to extract image ID' error. If config.extractImageId (which uses .split('.')[0]) is called on a null or undefined manifest.Config, the resulting TypeError is swallowed and replaced. While not a crash, it obscures the root cause (malformed manifest) during debugging. } catch (err) { throw new Error("Failed to extract image ID from archive manifest"); }

📚 Repository Context Analyzed This review considered 28 relevant code sections from 14 files (average relevance: 0.91) lib/extractor/oci-archive/layer.ts (2 segments, lines 1-204) lib/analyzer/image-inspector.ts (lines 1-284) lib/extractor/oci-archive/index.ts (lines 1-16) lib/dockerfile/index.ts (lines 1-61) lib/inputs/file-pattern/static.ts (lines 1-67) lib/index.ts (lines 1-49) lib/analyzer/static-analyzer.ts (lines 1-89) ... and 7 more file(s)