[Popie52]

Pull Request

Description

Fixes an issue where Trivy findings from nested Dockerfiles with the same basename could be incorrectly attributed to the root Dockerfile.

Previously, run_trivy_config() scanned the Dockerfile's parent directory and used --file-patterns with the Dockerfile basename. This allowed nested Dockerfiles with the same basename to be included in the Trivy results. The parser then filtered results by basename, which could still cause findings from a nested Dockerfile to be associated with the requested Dockerfile.

This change makes run_trivy_config() pass the exact Dockerfile path to Trivy instead of scanning the parent directory. The basename-based filtering workaround was removed from parse_trivy_config_json().

A regression test was added to verify that Trivy receives the exact Dockerfile path, along with coverage for offline mode.

Closes #195

Type of Change

• Bug fix
• New feature
• Breaking change
• Documentation update
• Code style update (formatting, renaming)
• Code refactoring (no functional changes)
• Performance improvement
• Test update
• Build / CI configuration
• Security fix

How Has This Been Tested?

Describe the tests run to verify the changes:

• Unit tests
• Manual testing

Test Configuration:

• Python version: 3.14.4
• Operating System: Ubuntu Linux
• DockSec version: a859ce2

Tests run:

• pytest tests/test_findings.py — 22 passed

• pytest tests/ — 544 passed, 3 skipped

• git diff --cached --check — passed

• Manually verified Trivy behavior with nested Dockerfiles using Trivy 0.74.0:

  • Scanning the exact Dockerfile path returns findings only for that Dockerfile.
  • Scanning the parent directory demonstrates the basename collision that caused the original issue.

Manual reproduction

The issue was reproduced with a directory containing:

Dockerfile
nested/
└── Dockerfile

The nested Dockerfile contained a misconfiguration that Trivy reported as DS-0013.

Scanning the directory caused both Dockerfiles to appear in Trivy's results, while scanning the exact Dockerfile path returned only the requested Dockerfile.

Checklist

• Code follows the style guidelines of this project
• Self-review completed
• Hard-to-understand areas are commented
• Documentation updated where needed
• No new warnings or errors introduced
• Tests added that prove the fix or feature works
• All existing tests pass
• Dependent changes have been merged and published
• Spelling checked

Screenshots (if applicable)

Not applicable.

Related Issues / PRs

• Relates to Nested Dockerfile findings mislabeled as belonging to the root Dockerfile #195
• Depends on #

---

By submitting this pull request, I confirm that my contribution is made under the terms of the MIT license.

[Popie52]

@advaitpatel ptal