fix(hardening-ratchet): a Dockerfile with no FROM is a finding, not a pass

[POWERFULMOVES]

Follow-up to #2604, closing the gap that let it happen silently.

The gap

#2285's hardening pass truncated 9 tracked Dockerfiles down to their USER tails — no FROM, so docker build fails with "no build stage in current context" and make overlay-up-agents died on notebooklm-agent. main could not build those images.

hardening-validation stayed green through all of it. That is my gate, and this is the same failure shape it was written to fix.

#2592 replaced a grep 'USER' that scored USER root as compliant, with a rule that judges the last USER directive. But a file whose only line is USER pmoves also passes that rule — the last USER is non-root, so the gate reports compliant about a file that cannot build. It was asserting a property nobody had asked about.

The change

• NO_FROM is checked first and short-circuits, so a fragment is reported as a fragment rather than scored on a USER directive with no image to apply to.
• It is deliberately not baselineable. The output says "Restore the file content. Do NOT baseline it." — a truncated Dockerfile is damage, not a recorded exception.
• Summary line renamed from Root-running: N to Findings: N. NO_FROM is not a root-privilege problem, and a gate that mislabels what it counted is how it ends up trusted for something it never checked.

Verification — both directions

main after #2604              exit 0   Findings: 12 (12 baselined, 0 new)
owner-presence re-truncated   exit 1   NO_FROM  pmoves/services/owner-presence/Dockerfile

Run against main before #2604, it flags exactly the 9 files that PR restored — 9 for 9, which independently confirms #2604's list was complete.

No baseline change: _known_gaps.yaml stays at 12.

[coderabbitai]

Important

• 🔍 Trigger review

This repository does not receive automatic reviews because it has fewer than 10 stars.

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro Plus

Run ID: 561c4897-064d-4509-8dc7-0dc653eca6a0

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}