Repository: bridgecrewio/checkov

Issue:
only caputring the first line https://github.com/bridgecrewio/checkov/blob/2.0.1131/checkov/dockerfile/checks/WorkdirIsAbsolute.py
def scan_entity_conf(self, conf):
        for mydir in conf:
            mypath = mydir["value"]
            if re.match(PATH, mypath):
                return CheckResult.FAILED, mydir
        return CheckResult.PASSED, None


Discussion:
hi @spark1825 what exactly is the issue, can you give an example Dockerfile, which fails, but should actually pass?

Resolving patch:
diff --git a/checkov/dockerfile/checks/WorkdirIsAbsolute.py b/checkov/dockerfile/checks/WorkdirIsAbsolute.py
--- a/checkov/dockerfile/checks/WorkdirIsAbsolute.py
+++ b/checkov/dockerfile/checks/WorkdirIsAbsolute.py
@@ -1,3 +1,5 @@
+from __future__ import annotations
+
 import re
 
 from checkov.common.models.enums import CheckCategories, CheckResult
@@ -7,21 +9,26 @@
 
 
 class WorkdirIsAbsolute(BaseDockerfileCheck):
-    def __init__(self):
+    def __init__(self) -> None:
         """
         For clarity and reliability, you should always use absolute paths for your WORKDIR.
         """
         name = "Ensure that WORKDIR values are absolute paths"
         id = "CKV_DOCKER_10"
-        supported_instructions = ["WORKDIR"]
-        categories = [CheckCategories.CONVENTION]
+        supported_instructions = ("WORKDIR",)
+        categories = (CheckCategories.CONVENTION,)
         super().__init__(name=name, id=id, categories=categories, supported_instructions=supported_instructions)
 
-    def scan_entity_conf(self, conf):
-        for mydir in conf:
-            mypath = mydir["value"]
-            if not re.match(ISABSOLUTE, mypath):
-                return CheckResult.FAILED, mydir
+    def scan_entity_conf(self, conf: list[dict[str, int | str]]) -> tuple[CheckResult, list[dict[str, int | str]] | None]:
+        workdirs = []
+        for workdir in conf:
+            path = workdir["value"]
+            if not re.match(ISABSOLUTE, path):
+                workdirs.append(workdir)
+
+        if workdirs:
+            return CheckResult.FAILED, workdirs
+
         return CheckResult.PASSED, None
 
 


Test patch:
diff --git a/tests/dockerfile/checks/example_WorkdirIsAbsolute/failure/Dockerfile b/tests/dockerfile/checks/example_WorkdirIsAbsolute/failure/Dockerfile
--- a/tests/dockerfile/checks/example_WorkdirIsAbsolute/failure/Dockerfile
+++ b/tests/dockerfile/checks/example_WorkdirIsAbsolute/failure/Dockerfile
@@ -5,6 +5,7 @@ WORKDIR /path/to/workdir
 WORKDIR workdir
 COPY requirements.txt /usr/src/app/
 RUN pip install --no-cache-dir -r /usr/src/app/requirements.txt
+WORKDIR workdir2
 COPY app.py /usr/src/app/
 COPY templates/index.html /usr/src/app/templates/
 EXPOSE 5000
diff --git a/tests/dockerfile/checks/example_WorkdirIsAbsolute/failure/Dockerfile.simple b/tests/dockerfile/checks/example_WorkdirIsAbsolute/failure/Dockerfile.simple
new file mode 100644
--- /dev/null
+++ b/tests/dockerfile/checks/example_WorkdirIsAbsolute/failure/Dockerfile.simple
@@ -0,0 +1,3 @@
+FROM alpine:3.14
+
+WORKDIR workdir
diff --git a/tests/dockerfile/checks/test_WorkdirIsAbsolute.py b/tests/dockerfile/checks/test_WorkdirIsAbsolute.py
--- a/tests/dockerfile/checks/test_WorkdirIsAbsolute.py
+++ b/tests/dockerfile/checks/test_WorkdirIsAbsolute.py
@@ -1,5 +1,5 @@
-import os
 import unittest
+from pathlib import Path
 
 from checkov.dockerfile.checks.WorkdirIsAbsolute import check
 from checkov.dockerfile.runner import Runner
@@ -8,26 +8,32 @@
 
 class TestWorkdirIsAbsolute(unittest.TestCase):
     def test(self):
-        runner = Runner()
-        current_dir = os.path.dirname(os.path.realpath(__file__))
+        # given
+        test_files_dir = Path(__file__).parent / "example_WorkdirIsAbsolute"
 
-        test_files_dir = current_dir + "/example_WorkdirIsAbsolute"
-        report = runner.run(root_folder=test_files_dir, runner_filter=RunnerFilter(checks=[check.id]))
+        # when
+        report = Runner().run(root_folder=str(test_files_dir), runner_filter=RunnerFilter(checks=[check.id]))
+
+        # then
         summary = report.get_summary()
 
         passing_resources = {"/success/Dockerfile."}
-        failing_resources = {"/failure/Dockerfile.WORKDIR"}
+        failing_resources = [
+            "/failure/Dockerfile.WORKDIR",  # needs to be twice
+            "/failure/Dockerfile.WORKDIR",
+            "/failure/Dockerfile.simple.WORKDIR",
+        ]
 
-        passed_check_resources = set([c.resource for c in report.passed_checks])
-        failed_check_resources = set([c.resource for c in report.failed_checks])
+        passed_check_resources = {c.resource for c in report.passed_checks}
+        failed_check_resources = [c.resource for c in report.failed_checks]
 
-        self.assertEqual(summary["passed"], 1)
-        self.assertEqual(summary["failed"], 1)
+        self.assertEqual(summary["passed"], len(passing_resources))
+        self.assertEqual(summary["failed"], len(failing_resources))
         self.assertEqual(summary["skipped"], 0)
         self.assertEqual(summary["parsing_errors"], 0)
 
         self.assertEqual(passing_resources, passed_check_resources)
-        self.assertEqual(failing_resources, failed_check_resources)
+        self.assertCountEqual(failing_resources, failed_check_resources)
 
 
 if __name__ == "__main__":