fix(misconf): handle heredocs in dockerfile instructions

[nikpivkin]

Description

Heredocs allow redirection of subsequent Dockerfile lines to the input of RUN or COPY commands. Right now, Trivy does not handle heredocs in instructions and only exports the first line as an instruction value:

TRACE | | | Unify {"Cmd": "run", "EndLine": 4, "Flags": [], "JSON": false, "Original": "RUN <<EOF", "Path": "Dockerfile", "Stage": 0, "StartLine": 2, "SubCmd": "", "Value": ["<<EOF"]} = instruction

The following scenarios are taken into account:

1. If the first line in the heredoc is a shebang, the value of the command is the file containing the contents of the heredoc for execution.
2. In the case of a simple heredoc, its contents are converted into commands.
3. In other cases, the heredoc is exported as is.

Example Dockerfile:

FROM alpine:3.21
RUN <<EOF
apk add curl
EOF

Output:

./trivy conf --cache-dir cache --checks-bundle-repository localhost:5111/trivy-checks:latest Dockerfile --trace
2025-01-23T18:24:42+06:00       INFO    [misconfig] Misconfiguration scanning is enabled
2025-01-23T18:24:43+06:00       INFO    Detected config files   num=1
...
AVD-DS-0025 (HIGH): '--no-cache' is missed: apk add curl
═══════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════════
You should use 'apk add' with '--no-cache' to clean package cached data and reduce image size.

See https://avd.aquasec.com/misconfig/ds025
───────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────
 Dockerfile:2-4
───────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────
   2 ┌ RUN <<EOF
   3 │ apk add curl
   4 └ EOF
───────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────

Trace:

TRACE | | | Unify {"Cmd": "run", "EndLine": 4, "Flags": [], "JSON": false, "Original": "RUN <<EOF\napk add curl\nEOF", "Path": "Dockerfile", "Stage": 0, "StartLine": 2, "SubCmd": "", "Value": ["apk add curl"]} = instruction

Related issues

• Close fix(checks): AVD-DS-0025 does not trigger with heredocs #8283

Checklist

• I've read the guidelines for contributing to this repository.
• I've followed the conventions in the PR title.
• I've added tests that prove my fix is effective or that my feature works.
• I've updated the documentation with the relevant information (if needed).
• I've added usage information (if the PR introduces new options)
• I've included a "before" and "after" example to the description (if the PR is a user interface change).

[simar7]

I read your description for the case when it starts with a shebang, but I don't understand this test case. Why is the expected value the one it is?

[simar7]

I understand the test case expectation now but what's the reasoning behind this logic? I'm a little paranoid about processing shebangs, should we just leave them out for our implementation?