k8s-manifest-scanner failure to detect all images in https://storage.googleapis.com/projectriff/release/0.5.0/kpack.yaml

kpack-extract.yaml

...
---
apiVersion: apps/v1
kind: Deployment
metadata:
    name: kpack-controller
    namespace: kpack
spec:
    replicas: 1
    selector:
        matchLabels:
            app: kpack-controller
    template:
        metadata:
            labels:
                app: kpack-controller
                version: 0.0.6-rc.45
        spec:
            serviceAccountName: controller
            containers:
              - name: controller
                image: gcr.io/cf-build-service-public/kpack/controller@sha256:febeb4b845a3d908c8a77dcbefb4bb30345a43d9b66ad63f7fa78eb54e584b5d
                env:
                  - name: BUILD_INIT_IMAGE
                    value: gcr.io/cf-build-service-public/kpack/build-init@sha256:5205844aefba7c91803198ef81da9134031f637d605d293dfe4531c622aa42b1
                  - name: REBASE_IMAGE
                    value: gcr.io/cf-build-service-public/kpack/rebase@sha256:fbc2a6bf5c535b44e6da45cd13de3b09880b0e8ccf7d5022f568065eccf5efee
                  - name: COMPLETION_IMAGE
                    value: gcr.io/cf-build-service-public/kpack/completion@sha256:35ea89f438450d6f322af0b24a1ca48031788c98e15c0d3c45aa26999bc1e34b
                  - name: LIFECYCLE_IMAGE
                    value: gcr.io/cf-build-service-public/kpack/lifecycle@sha256:31a73391d4bf8b919fc2a15455ba0844fed109f935c43cd3e97e0d1e16662d74
---
...

terminal.out

GO111MODULE=off go run github.com/projectriff/k8s-manifest-scanner/cmd/k8s-manifest-scanner scan https://storage.googleapis.com/projectriff/release/0.5.0/kpack.yaml
[
    "gcr.io/cf-build-service-public/kpack/controller@sha256:febeb4b845a3d908c8a77dcbefb4bb30345a43d9b66ad63f7fa78eb54e584b5d",
    "gcr.io/cf-build-service-public/kpack/webhook@sha256:ff46bf4da756bbc6344dd1a3ea37efaa206fe8564e5a05922268a1e887be28a2"
]

The images which are env var values are not detected.

kbld does no better:

kbld package -f https://storage.googleapis.com/projectriff/release/0.5.0/kpack.yaml -o kpack.tgz
package | exporting 2 images...
package | will export gcr.io/cf-build-service-public/kpack/controller@sha256:febeb4b845a3d908c8a77dcbefb4bb30345a43d9b66ad63f7fa78eb54e584b5d
package | will export gcr.io/cf-build-service-public/kpack/webhook@sha256:ff46bf4da756bbc6344dd1a3ea37efaa206fe8564e5a05922268a1e887be28a2
package | exported 2 images
Succeeded