We are currently solving the following issue within our repository. Here is the issue text:
--- BEGIN ISSUE ---
CKV_ARGO_1 / CKV_ARGO_2 - false positives for kinds Application / ApplicationSet / AppProject
**Describe the issue**
CKV_ARGO_1 / CKV_ARGO_2 checks trigger false positives for argocd kinds Application / ApplicationSet / AppProject

**Examples**
```yaml
# AppProject
---
apiVersion: argoproj.io/v1alpha1
kind: AppProject
metadata:
  name: default
spec:
  clusterResourceWhitelist:
    - group: "*"
      kind: "*"
  destinations:
    - namespace: "*"
      server: "*"
  sourceRepos:
    - "*"
```
```yaml
# Application
---
apiVersion: argoproj.io/v1alpha1
kind: Application
metadata:
  name: cert-manager
spec:
  destination:
    namespace: cert-manager
    server: https://kubernetes.default.svc
  project: default
  source:
    chart: cert-manager
    helm:
      values: |
        installCRDs: true

        prometheus:
          enabled: false

    repoURL: https://charts.jetstack.io
    targetRevision: v1.9.0
  syncPolicy:
    automated:
      prune: true
      selfHeal: true
    syncOptions:
      - CreateNamespace=true
```
```yaml
# ApplicationSet
---
apiVersion: argoproj.io/v1alpha1
kind: ApplicationSet
metadata:
  name: cert-manager
spec:
  generators:
    - matrix:
        generators:
          - list:
              elements:
                - env: dev
                - env: qa
                - env: preprod
                - env: demo
                - env: training
  template:
    metadata:
      name: "cert-manager-{{env}}"
    spec:
      project: "{{env}}"
      source:
        chart: cert-manager
        helm:
          values: |
            installCRDs: true

            prometheus:
              enabled: false

        repoURL: https://charts.jetstack.io
        targetRevision: v1.9.0
      destination:
        namespace: "cert-manager-{{env}}"
        server: https://kubernetes.default.svc
```

**Version (please complete the following information):**
 - 2.1.207
 


--- END ISSUE ---

Below are some code segments, each from a relevant file. One or more of these files may contain bugs.
--- BEGIN FILES ---
Path: `checkov/argo_workflows/runner.py`
Content:
```
1 from __future__ import annotations
2 
3 import re
4 from pathlib import Path
5 from typing import TYPE_CHECKING, Any
6 
7 from checkov.common.images.image_referencer import ImageReferencer, Image
8 from checkov.common.output.report import CheckType
9 from checkov.yaml_doc.runner import Runner as YamlRunner
10 
11 # Import of the checks registry for a specific resource type
12 from checkov.argo_workflows.checks.registry import registry as template_registry
13 
14 if TYPE_CHECKING:
15     from checkov.common.checks.base_check_registry import BaseCheckRegistry
16 
17 API_VERSION_PATTERN = re.compile(r"^apiVersion:\s*argoproj.io/", re.MULTILINE)
18 
19 
20 class Runner(YamlRunner, ImageReferencer):
21     check_type = CheckType.ARGO_WORKFLOWS  # noqa: CCE003  # a static attribute
22 
23     block_type_registries = {  # noqa: CCE003  # a static attribute
24         "template": template_registry,
25     }
26 
27     def require_external_checks(self) -> bool:
28         return False
29 
30     def import_registry(self) -> BaseCheckRegistry:
31         return self.block_type_registries["template"]
32 
33     def _parse_file(
34         self, f: str, file_content: str | None = None
35     ) -> tuple[dict[str, Any] | list[dict[str, Any]], list[tuple[int, str]]] | None:
36         content = self._get_workflow_file_content(file_path=f)
37         if content:
38             return super()._parse_file(f=f, file_content=content)
39 
40         return None
41 
42     def _get_workflow_file_content(self, file_path: str) -> str | None:
43         if not file_path.endswith((".yaml", ",yml")):
44             return None
45 
46         content = Path(file_path).read_text()
47         match = re.search(API_VERSION_PATTERN, content)
48         if match:
49             return content
50 
51         return None
52 
53     def is_workflow_file(self, file_path: str) -> bool:
54         return self._get_workflow_file_content(file_path=file_path) is not None
55 
56     def get_images(self, file_path: str) -> set[Image]:
57         """Get container images mentioned in a file
58 
59         Argo Workflows file can have a job and services run within a container.
60 
61         in the following sample file we can see a node:14.16 image:
62 
63         apiVersion: argoproj.io/v1alpha1
64         kind: Workflow
65         metadata:
66           generateName: template-defaults-
67         spec:
68           entrypoint: main
69           templates:
70             - name: main
71               steps:
72                 - - name: retry-backoff
73                     template: retry-backoff
74                 - - name: whalesay
75                     template: whalesay
76 
77             - name: whalesay
78               container:
79                 image: argoproj/argosay:v2
80                 command: [cowsay]
81                 args: ["hello world"]
82 
83             - name: retry-backoff
84               container:
85                 image: python:alpine3.6
86                 command: ["python", -c]
87                 # fail with a 66% probability
88                 args: ["import random; import sys; exit_code = random.choice([0, 1, 1]); sys.exit(exit_code)"]
89 
90         Source: https://github.com/argoproj/argo-workflows/blob/master/examples/template-defaults.yaml
91 
92         :return: List of container image short ids mentioned in the file.
93         Example return value for a file with node:14.16 image: ['sha256:6a353e22ce']
94         """
95 
96         images: set[Image] = set()
97         parsed_file = self._parse_file(file_path)
98 
99         if not parsed_file:
100             return images
101 
102         workflow, workflow_line_numbers = parsed_file
103 
104         if not isinstance(workflow, dict):
105             # make type checking happy
106             return images
107 
108         spec = workflow.get("spec")
109         if spec:
110             templates = spec.get("templates")
111             if isinstance(templates, list):
112                 for template in templates:
113                     container = template.get("container")
114                     if container:
115                         image = self.extract_image(file_path=file_path, container=container)
116                         if image:
117                             images.add(image)
118                     script = template.get("script")
119                     if script:
120                         image = self.extract_image(file_path=file_path, container=script)
121                         if image:
122                             images.add(image)
123 
124         return images
125 
126     def extract_image(self, file_path: str, container: dict[str, Any]) -> Image | None:
127         image_name = container.get("image")
128         if image_name and isinstance(image_name, str):
129             start_line = container.get("__startline__", 0)
130             end_line = container.get("__endline__", 0)
131             return Image(
132                 file_path=file_path,
133                 name=image_name,
134                 start_line=start_line,
135                 end_line=end_line,
136             )
137 
138         return None
139
```
--- END FILES ---

Please first localize the bug based on the issue statement, and then generate a patch according to the `git diff` format fenced by three backticks.

Here is an example:

```diff
diff --git a/examples/server_async.py b/examples/server_async.py
--- a/examples/server_async.py
+++ b/examples/server_async.py
@@ -313,4 +313,4 @@
 
 
 if __name__ == "__main__":
-    asyncio.run(run_async_server("."), debug=True)
+    asyncio.run(run_async_server(), debug=True)
diff --git a/examples/server_sync.py b/examples/server_sync.py
--- a/examples/server_sync.py
+++ b/examples/server_sync.py
@@ -313,5 +313,5 @@
 
 
 if __name__ == "__main__":
-    server = run_sync_server(".")
+    server = run_sync_server()
     server.shutdown()

```

diff --git a/checkov/argo_workflows/runner.py b/checkov/argo_workflows/runner.py
--- a/checkov/argo_workflows/runner.py
+++ b/checkov/argo_workflows/runner.py
@@ -15,6 +15,7 @@
     from checkov.common.checks.base_check_registry import BaseCheckRegistry
 
 API_VERSION_PATTERN = re.compile(r"^apiVersion:\s*argoproj.io/", re.MULTILINE)
+KIND_PATTERN = re.compile(r"^kind:\s*Workflow", re.MULTILINE)
 
 
 class Runner(YamlRunner, ImageReferencer):
@@ -44,9 +45,12 @@
             return None
 
         content = Path(file_path).read_text()
-        match = re.search(API_VERSION_PATTERN, content)
-        if match:
-            return content
+        match_api = re.search(API_VERSION_PATTERN, content)
+        if match_api:
+            match_kind = re.search(KIND_PATTERN, content)
+            if match_kind:
+                # only scan Argo Workflows
+                return content
 
         return None

{"golden_diff": "diff --git a/checkov/argo_workflows/runner.py b/checkov/argo_workflows/runner.py\n--- a/checkov/argo_workflows/runner.py\n+++ b/checkov/argo_workflows/runner.py\n@@ -15,6 +15,7 @@\n     from checkov.common.checks.base_check_registry import BaseCheckRegistry\n \n API_VERSION_PATTERN = re.compile(r\"^apiVersion:\\s*argoproj.io/\", re.MULTILINE)\n+KIND_PATTERN = re.compile(r\"^kind:\\s*Workflow\", re.MULTILINE)\n \n \n class Runner(YamlRunner, ImageReferencer):\n@@ -44,9 +45,12 @@\n             return None\n \n         content = Path(file_path).read_text()\n-        match = re.search(API_VERSION_PATTERN, content)\n-        if match:\n-            return content\n+        match_api = re.search(API_VERSION_PATTERN, content)\n+        if match_api:\n+            match_kind = re.search(KIND_PATTERN, content)\n+            if match_kind:\n+                # only scan Argo Workflows\n+                return content\n \n         return None\n", "issue": "CKV_ARGO_1 / CKV_ARGO_2 - false positives for kinds Application / ApplicationSet / AppProject\n**Describe the issue**\r\nCKV_ARGO_1 / CKV_ARGO_2 checks trigger false positives for argocd kinds Application / ApplicationSet / AppProject\r\n\r\n**Examples**\r\n```yaml\r\n# AppProject\r\n---\r\napiVersion: argoproj.io/v1alpha1\r\nkind: AppProject\r\nmetadata:\r\n  name: default\r\nspec:\r\n  clusterResourceWhitelist:\r\n    - group: \"*\"\r\n      kind: \"*\"\r\n  destinations:\r\n    - namespace: \"*\"\r\n      server: \"*\"\r\n  sourceRepos:\r\n    - \"*\"\r\n```\r\n```yaml\r\n# Application\r\n---\r\napiVersion: argoproj.io/v1alpha1\r\nkind: Application\r\nmetadata:\r\n  name: cert-manager\r\nspec:\r\n  destination:\r\n    namespace: cert-manager\r\n    server: https://kubernetes.default.svc\r\n  project: default\r\n  source:\r\n    chart: cert-manager\r\n    helm:\r\n      values: |\r\n        installCRDs: true\r\n\r\n        prometheus:\r\n          enabled: false\r\n\r\n    repoURL: https://charts.jetstack.io\r\n    targetRevision: v1.9.0\r\n  syncPolicy:\r\n    automated:\r\n      prune: true\r\n      selfHeal: true\r\n    syncOptions:\r\n      - CreateNamespace=true\r\n```\r\n```yaml\r\n# ApplicationSet\r\n---\r\napiVersion: argoproj.io/v1alpha1\r\nkind: ApplicationSet\r\nmetadata:\r\n  name: cert-manager\r\nspec:\r\n  generators:\r\n    - matrix:\r\n        generators:\r\n          - list:\r\n              elements:\r\n                - env: dev\r\n                - env: qa\r\n                - env: preprod\r\n                - env: demo\r\n                - env: training\r\n  template:\r\n    metadata:\r\n      name: \"cert-manager-{{env}}\"\r\n    spec:\r\n      project: \"{{env}}\"\r\n      source:\r\n        chart: cert-manager\r\n        helm:\r\n          values: |\r\n            installCRDs: true\r\n\r\n            prometheus:\r\n              enabled: false\r\n\r\n        repoURL: https://charts.jetstack.io\r\n        targetRevision: v1.9.0\r\n      destination:\r\n        namespace: \"cert-manager-{{env}}\"\r\n        server: https://kubernetes.default.svc\r\n```\r\n\r\n**Version (please complete the following information):**\r\n - 2.1.207\r\n \r\n\n", "before_files": [{"content": "from __future__ import annotations\n\nimport re\nfrom pathlib import Path\nfrom typing import TYPE_CHECKING, Any\n\nfrom checkov.common.images.image_referencer import ImageReferencer, Image\nfrom checkov.common.output.report import CheckType\nfrom checkov.yaml_doc.runner import Runner as YamlRunner\n\n# Import of the checks registry for a specific resource type\nfrom checkov.argo_workflows.checks.registry import registry as template_registry\n\nif TYPE_CHECKING:\n    from checkov.common.checks.base_check_registry import BaseCheckRegistry\n\nAPI_VERSION_PATTERN = re.compile(r\"^apiVersion:\\s*argoproj.io/\", re.MULTILINE)\n\n\nclass Runner(YamlRunner, ImageReferencer):\n    check_type = CheckType.ARGO_WORKFLOWS  # noqa: CCE003  # a static attribute\n\n    block_type_registries = {  # noqa: CCE003  # a static attribute\n        \"template\": template_registry,\n    }\n\n    def require_external_checks(self) -> bool:\n        return False\n\n    def import_registry(self) -> BaseCheckRegistry:\n        return self.block_type_registries[\"template\"]\n\n    def _parse_file(\n        self, f: str, file_content: str | None = None\n    ) -> tuple[dict[str, Any] | list[dict[str, Any]], list[tuple[int, str]]] | None:\n        content = self._get_workflow_file_content(file_path=f)\n        if content:\n            return super()._parse_file(f=f, file_content=content)\n\n        return None\n\n    def _get_workflow_file_content(self, file_path: str) -> str | None:\n        if not file_path.endswith((\".yaml\", \",yml\")):\n            return None\n\n        content = Path(file_path).read_text()\n        match = re.search(API_VERSION_PATTERN, content)\n        if match:\n            return content\n\n        return None\n\n    def is_workflow_file(self, file_path: str) -> bool:\n        return self._get_workflow_file_content(file_path=file_path) is not None\n\n    def get_images(self, file_path: str) -> set[Image]:\n        \"\"\"Get container images mentioned in a file\n\n        Argo Workflows file can have a job and services run within a container.\n\n        in the following sample file we can see a node:14.16 image:\n\n        apiVersion: argoproj.io/v1alpha1\n        kind: Workflow\n        metadata:\n          generateName: template-defaults-\n        spec:\n          entrypoint: main\n          templates:\n            - name: main\n              steps:\n                - - name: retry-backoff\n                    template: retry-backoff\n                - - name: whalesay\n                    template: whalesay\n\n            - name: whalesay\n              container:\n                image: argoproj/argosay:v2\n                command: [cowsay]\n                args: [\"hello world\"]\n\n            - name: retry-backoff\n              container:\n                image: python:alpine3.6\n                command: [\"python\", -c]\n                # fail with a 66% probability\n                args: [\"import random; import sys; exit_code = random.choice([0, 1, 1]); sys.exit(exit_code)\"]\n\n        Source: https://github.com/argoproj/argo-workflows/blob/master/examples/template-defaults.yaml\n\n        :return: List of container image short ids mentioned in the file.\n        Example return value for a file with node:14.16 image: ['sha256:6a353e22ce']\n        \"\"\"\n\n        images: set[Image] = set()\n        parsed_file = self._parse_file(file_path)\n\n        if not parsed_file:\n            return images\n\n        workflow, workflow_line_numbers = parsed_file\n\n        if not isinstance(workflow, dict):\n            # make type checking happy\n            return images\n\n        spec = workflow.get(\"spec\")\n        if spec:\n            templates = spec.get(\"templates\")\n            if isinstance(templates, list):\n                for template in templates:\n                    container = template.get(\"container\")\n                    if container:\n                        image = self.extract_image(file_path=file_path, container=container)\n                        if image:\n                            images.add(image)\n                    script = template.get(\"script\")\n                    if script:\n                        image = self.extract_image(file_path=file_path, container=script)\n                        if image:\n                            images.add(image)\n\n        return images\n\n    def extract_image(self, file_path: str, container: dict[str, Any]) -> Image | None:\n        image_name = container.get(\"image\")\n        if image_name and isinstance(image_name, str):\n            start_line = container.get(\"__startline__\", 0)\n            end_line = container.get(\"__endline__\", 0)\n            return Image(\n                file_path=file_path,\n                name=image_name,\n                start_line=start_line,\n                end_line=end_line,\n            )\n\n        return None\n", "path": "checkov/argo_workflows/runner.py"}], "after_files": [{"content": "from __future__ import annotations\n\nimport re\nfrom pathlib import Path\nfrom typing import TYPE_CHECKING, Any\n\nfrom checkov.common.images.image_referencer import ImageReferencer, Image\nfrom checkov.common.output.report import CheckType\nfrom checkov.yaml_doc.runner import Runner as YamlRunner\n\n# Import of the checks registry for a specific resource type\nfrom checkov.argo_workflows.checks.registry import registry as template_registry\n\nif TYPE_CHECKING:\n    from checkov.common.checks.base_check_registry import BaseCheckRegistry\n\nAPI_VERSION_PATTERN = re.compile(r\"^apiVersion:\\s*argoproj.io/\", re.MULTILINE)\nKIND_PATTERN = re.compile(r\"^kind:\\s*Workflow\", re.MULTILINE)\n\n\nclass Runner(YamlRunner, ImageReferencer):\n    check_type = CheckType.ARGO_WORKFLOWS  # noqa: CCE003  # a static attribute\n\n    block_type_registries = {  # noqa: CCE003  # a static attribute\n        \"template\": template_registry,\n    }\n\n    def require_external_checks(self) -> bool:\n        return False\n\n    def import_registry(self) -> BaseCheckRegistry:\n        return self.block_type_registries[\"template\"]\n\n    def _parse_file(\n        self, f: str, file_content: str | None = None\n    ) -> tuple[dict[str, Any] | list[dict[str, Any]], list[tuple[int, str]]] | None:\n        content = self._get_workflow_file_content(file_path=f)\n        if content:\n            return super()._parse_file(f=f, file_content=content)\n\n        return None\n\n    def _get_workflow_file_content(self, file_path: str) -> str | None:\n        if not file_path.endswith((\".yaml\", \",yml\")):\n            return None\n\n        content = Path(file_path).read_text()\n        match_api = re.search(API_VERSION_PATTERN, content)\n        if match_api:\n            match_kind = re.search(KIND_PATTERN, content)\n            if match_kind:\n                # only scan Argo Workflows\n                return content\n\n        return None\n\n    def is_workflow_file(self, file_path: str) -> bool:\n        return self._get_workflow_file_content(file_path=file_path) is not None\n\n    def get_images(self, file_path: str) -> set[Image]:\n        \"\"\"Get container images mentioned in a file\n\n        Argo Workflows file can have a job and services run within a container.\n\n        in the following sample file we can see a node:14.16 image:\n\n        apiVersion: argoproj.io/v1alpha1\n        kind: Workflow\n        metadata:\n          generateName: template-defaults-\n        spec:\n          entrypoint: main\n          templates:\n            - name: main\n              steps:\n                - - name: retry-backoff\n                    template: retry-backoff\n                - - name: whalesay\n                    template: whalesay\n\n            - name: whalesay\n              container:\n                image: argoproj/argosay:v2\n                command: [cowsay]\n                args: [\"hello world\"]\n\n            - name: retry-backoff\n              container:\n                image: python:alpine3.6\n                command: [\"python\", -c]\n                # fail with a 66% probability\n                args: [\"import random; import sys; exit_code = random.choice([0, 1, 1]); sys.exit(exit_code)\"]\n\n        Source: https://github.com/argoproj/argo-workflows/blob/master/examples/template-defaults.yaml\n\n        :return: List of container image short ids mentioned in the file.\n        Example return value for a file with node:14.16 image: ['sha256:6a353e22ce']\n        \"\"\"\n\n        images: set[Image] = set()\n        parsed_file = self._parse_file(file_path)\n\n        if not parsed_file:\n            return images\n\n        workflow, workflow_line_numbers = parsed_file\n\n        if not isinstance(workflow, dict):\n            # make type checking happy\n            return images\n\n        spec = workflow.get(\"spec\")\n        if spec:\n            templates = spec.get(\"templates\")\n            if isinstance(templates, list):\n                for template in templates:\n                    container = template.get(\"container\")\n                    if container:\n                        image = self.extract_image(file_path=file_path, container=container)\n                        if image:\n                            images.add(image)\n                    script = template.get(\"script\")\n                    if script:\n                        image = self.extract_image(file_path=file_path, container=script)\n                        if image:\n                            images.add(image)\n\n        return images\n\n    def extract_image(self, file_path: str, container: dict[str, Any]) -> Image | None:\n        image_name = container.get(\"image\")\n        if image_name and isinstance(image_name, str):\n            start_line = container.get(\"__startline__\", 0)\n            end_line = container.get(\"__endline__\", 0)\n            return Image(\n                file_path=file_path,\n                name=image_name,\n                start_line=start_line,\n                end_line=end_line,\n            )\n\n        return None\n", "path": "checkov/argo_workflows/runner.py"}]}