diff --git a/.github/CODEOWNERS b/.github/CODEOWNERS index 4d8f3359b3..74e9332e34 100644 --- a/.github/CODEOWNERS +++ b/.github/CODEOWNERS @@ -1,5 +1,6 @@ -* @prowler-cloud/sdk @prowler-cloud/detection-and-remediation - -# To protect a repository fully against unauthorized changes, you also need to define an owner for the CODEOWNERS file itself. -# https://docs.github.com/en/repositories/managing-your-repositorys-settings-and-features/customizing-your-repository/about-code-owners#codeowners-and-branch-protection +/* @prowler-cloud/sdk /.github/ @prowler-cloud/sdk +prowler @prowler-cloud/sdk @prowler-cloud/detection-and-remediation +tests @prowler-cloud/sdk @prowler-cloud/detection-and-remediation +api @prowler-cloud/api +ui @prowler-cloud/ui \ No newline at end of file diff --git a/.github/codeql/api-codeql-config.yml b/.github/codeql/api-codeql-config.yml new file mode 100644 index 0000000000..65e09fea5b --- /dev/null +++ b/.github/codeql/api-codeql-config.yml @@ -0,0 +1,3 @@ +name: "Custom CodeQL Config for API" +paths: + - 'api/' diff --git a/.github/codeql/codeql-config.yml b/.github/codeql/codeql-config.yml new file mode 100644 index 0000000000..28af0d3846 --- /dev/null +++ b/.github/codeql/codeql-config.yml @@ -0,0 +1,5 @@ +name: "Custom CodeQL Config" +paths: + paths-ignore: + - 'api/' + - 'ui/' diff --git a/.github/labeler.yml b/.github/labeler.yml index cf0a47aaa1..794b7ab41f 100644 --- a/.github/labeler.yml +++ b/.github/labeler.yml @@ -80,9 +80,10 @@ output/csv: - any-glob-to-any-file: "prowler/lib/outputs/csv/**" - any-glob-to-any-file: "tests/lib/outputs/csv/**" -compliance: +component/api: - changed-files: - - any-glob-to-any-file: "prowler/lib/outputs/compliance/**" - - any-glob-to-any-file: "tests/lib/outputs/compliance/**" - - any-glob-to-any-file: "prowler/compliance/**" + - any-glob-to-any-file: "api/**" +component/ui: + - changed-files: + - any-glob-to-any-file: "ui/**" diff --git a/.github/pull_request_template.md b/.github/pull_request_template.md index 19a908abea..1c82e697a2 100644 --- a/.github/pull_request_template.md +++ b/.github/pull_request_template.md @@ -2,19 +2,11 @@ Please include relevant motivation and context for this PR. -If fixes an issue please add it with `Fix #XXXX` ### Description Please include a summary of the change and which issue is fixed. List any dependencies that are required for this change. -### Checklist - -- Are there new checks included in this PR? Yes / No - - If so, do we need to update permissions for the provider? Please review this carefully. -- [ ] Review if the code is being covered by tests. -- [ ] Review if code is being documented following this specification https://github.com/google/styleguide/blob/gh-pages/pyguide.md#38-comments-and-docstrings -- [ ] Review if backport is needed. ### License diff --git a/api/.github/workflows/codeql.yml b/.github/workflows/api-codeql.yml similarity index 64% rename from api/.github/workflows/codeql.yml rename to .github/workflows/api-codeql.yml index dc454058ee..ed9e0c3fd4 100644 --- a/api/.github/workflows/codeql.yml +++ b/.github/workflows/api-codeql.yml @@ -9,14 +9,25 @@ # the `language` matrix defined below to confirm you have the correct set of # supported CodeQL languages. # -name: "CodeQL" +name: "API - CodeQL" on: push: - branches: [ "main"] + branches: + - "master" + - "v3" + - "v4.*" + - "v5.*" + paths: + - "api/**" pull_request: - # The branches below must be a subset of the branches above - branches: [ "main" ] + branches: + - "master" + - "v3" + - "v4.*" + - "v5.*" + paths: + - "api/**" schedule: - cron: '00 12 * * *' @@ -44,12 +55,7 @@ jobs: uses: github/codeql-action/init@v3 with: languages: ${{ matrix.language }} - # If you wish to specify custom queries, you can do so here or in a config file. - # By default, queries listed here will override any specified in a config file. - # Prefix the list here with "+" to use these queries and those in the config file. - - # Details on CodeQL's query packs refer to : https://docs.github.com/en/code-security/code-scanning/automatically-scanning-your-code-for-vulnerabilities-and-errors/configuring-code-scanning#using-queries-in-ql-packs - # queries: security-extended,security-and-quality + config-file: ./.github/codeql/api-codeql-config.yml - name: Perform CodeQL Analysis uses: github/codeql-action/analyze@v3 diff --git a/api/.github/workflows/pull-request.yml b/.github/workflows/api-pull-request.yml similarity index 87% rename from api/.github/workflows/pull-request.yml rename to .github/workflows/api-pull-request.yml index d842de06e8..4ccf0a0db4 100644 --- a/api/.github/workflows/pull-request.yml +++ b/.github/workflows/api-pull-request.yml @@ -1,12 +1,16 @@ -name: pr-lint-test +name: "API - Pull Request" on: push: branches: - - "main" + - "master" + paths: + - "api/**" pull_request: branches: - - "main" + - "master" + paths: + - "api/**" env: @@ -67,14 +71,15 @@ jobs: id: are-non-ignored-files-changed uses: tj-actions/changed-files@v42 with: - files: ./** + files: api/** files_ignore: | - .github/** - README.md - docs/** - permissions/** - mkdocs.yml + api/.github/** + api/docs/** + api/permissions/** + api/README.md + api/mkdocs.yml - name: Install poetry + working-directory: ./api if: steps.are-non-ignored-files-changed.outputs.any_changed == 'true' run: | python -m pip install --upgrade pip @@ -86,6 +91,7 @@ jobs: python-version: ${{ matrix.python-version }} cache: "poetry" - name: Install dependencies + working-directory: ./api if: steps.are-non-ignored-files-changed.outputs.any_changed == 'true' run: | poetry install @@ -97,38 +103,47 @@ jobs: && chmod +x /tmp/hadolint - name: Poetry check + working-directory: ./api if: steps.are-non-ignored-files-changed.outputs.any_changed == 'true' run: | poetry lock --check - name: Lint with ruff + working-directory: ./api if: steps.are-non-ignored-files-changed.outputs.any_changed == 'true' run: | poetry run ruff check . --exclude contrib - name: Check Format with ruff + working-directory: ./api if: steps.are-non-ignored-files-changed.outputs.any_changed == 'true' run: | poetry run ruff format --check . --exclude contrib - name: Lint with pylint + working-directory: ./api if: steps.are-non-ignored-files-changed.outputs.any_changed == 'true' run: | poetry run pylint --disable=W,C,R,E -j 0 -rn -sn src/ - name: Bandit + working-directory: ./api if: steps.are-non-ignored-files-changed.outputs.any_changed == 'true' run: | poetry run bandit -q -lll -x '*_test.py,./contrib/' -r . - name: Safety + working-directory: ./api if: steps.are-non-ignored-files-changed.outputs.any_changed == 'true' run: | poetry run safety check --ignore 70612,66963 - name: Vulture + working-directory: ./api if: steps.are-non-ignored-files-changed.outputs.any_changed == 'true' run: | poetry run vulture --exclude "contrib,tests,conftest.py" --min-confidence 100 . - name: Hadolint + working-directory: ./api if: steps.are-non-ignored-files-changed.outputs.any_changed == 'true' run: | /tmp/hadolint Dockerfile --ignore=DL3013 - name: Test with pytest + working-directory: ./api if: steps.are-non-ignored-files-changed.outputs.any_changed == 'true' run: | poetry run pytest -n auto --cov=./src/backend --cov-report=xml src/backend diff --git a/.github/workflows/build-lint-push-containers.yml b/.github/workflows/build-lint-push-containers.yml index 6961617f68..005f005a8a 100644 --- a/.github/workflows/build-lint-push-containers.yml +++ b/.github/workflows/build-lint-push-containers.yml @@ -9,6 +9,8 @@ on: - ".github/**" - "README.md" - "docs/**" + - "ui/**" + - "api/**" release: types: [published] diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml index 66a09042e9..c0e319e07e 100644 --- a/.github/workflows/codeql.yml +++ b/.github/workflows/codeql.yml @@ -13,10 +13,21 @@ name: "CodeQL" on: push: - branches: [ "master", "v3", "v4.*" ] + branches: + - "master" + - "v3" + - "v4.*" + paths-ignore: + - 'ui/**' + - 'api/**' pull_request: - # The branches below must be a subset of the branches above - branches: [ "master", "v3", "v4.*" ] + branches: + - "master" + - "v3" + - "v4.*" + paths-ignore: + - 'ui/**' + - 'api/**' schedule: - cron: '00 12 * * *' @@ -44,12 +55,7 @@ jobs: uses: github/codeql-action/init@v3 with: languages: ${{ matrix.language }} - # If you wish to specify custom queries, you can do so here or in a config file. - # By default, queries listed here will override any specified in a config file. - # Prefix the list here with "+" to use these queries and those in the config file. - - # Details on CodeQL's query packs refer to : https://docs.github.com/en/code-security/code-scanning/automatically-scanning-your-code-for-vulnerabilities-and-errors/configuring-code-scanning#using-queries-in-ql-packs - # queries: security-extended,security-and-quality + config-file: ./.github/codeql/codeql-config.yml - name: Perform CodeQL Analysis uses: github/codeql-action/analyze@v3 diff --git a/.github/workflows/pull-request.yml b/.github/workflows/pull-request.yml index f0683c7eb0..0b6811a0a4 100644 --- a/.github/workflows/pull-request.yml +++ b/.github/workflows/pull-request.yml @@ -1,4 +1,4 @@ -name: pr-lint-test +name: "Pull Request" on: push: @@ -6,11 +6,13 @@ on: - "master" - "v3" - "v4.*" + - "v5.*" pull_request: branches: - "master" - "v3" - "v4.*" + - "v5.*" jobs: build: runs-on: ubuntu-latest @@ -27,9 +29,11 @@ jobs: files: ./** files_ignore: | .github/** - README.md docs/** permissions/** + api/** + ui/** + README.md mkdocs.yml .backportrc.json - name: Install poetry @@ -60,11 +64,11 @@ jobs: - name: Lint with flake8 if: steps.are-non-ignored-files-changed.outputs.any_changed == 'true' run: | - poetry run flake8 . --ignore=E266,W503,E203,E501,W605,E128 --exclude contrib + poetry run flake8 . --ignore=E266,W503,E203,E501,W605,E128 --exclude contrib,ui,api - name: Checking format with black if: steps.are-non-ignored-files-changed.outputs.any_changed == 'true' run: | - poetry run black --check . + poetry run black --exclude api ui --check . - name: Lint with pylint if: steps.are-non-ignored-files-changed.outputs.any_changed == 'true' run: | @@ -72,15 +76,15 @@ jobs: - name: Bandit if: steps.are-non-ignored-files-changed.outputs.any_changed == 'true' run: | - poetry run bandit -q -lll -x '*_test.py,./contrib/' -r . + poetry run bandit -q -lll -x '*_test.py,./contrib/,./api/,./ui' -r . - name: Safety if: steps.are-non-ignored-files-changed.outputs.any_changed == 'true' run: | - poetry run safety check --ignore 70612 + poetry run safety check --ignore 70612 -r pyproject.toml - name: Vulture if: steps.are-non-ignored-files-changed.outputs.any_changed == 'true' run: | - poetry run vulture --exclude "contrib" --min-confidence 100 . + poetry run vulture --exclude "contrib,api,ui" --min-confidence 100 . - name: Hadolint if: steps.are-non-ignored-files-changed.outputs.any_changed == 'true' run: | @@ -91,6 +95,6 @@ jobs: poetry run pytest -n auto --cov=./prowler --cov-report=xml tests - name: Upload coverage reports to Codecov if: steps.are-non-ignored-files-changed.outputs.any_changed == 'true' - uses: codecov/codecov-action@v5 + uses: codecov/codecov-action@v4 env: CODECOV_TOKEN: ${{ secrets.CODECOV_TOKEN }} diff --git a/ui/.github/workflows/checks.yml b/.github/workflows/ui-checks.yml similarity index 74% rename from ui/.github/workflows/checks.yml rename to .github/workflows/ui-checks.yml index e58e18c793..ca7e266a07 100644 --- a/ui/.github/workflows/checks.yml +++ b/.github/workflows/ui-checks.yml @@ -1,9 +1,11 @@ -name: CI - Code Quality and Health Check +name: "UI/CI - Code Quality and Health Check" on: pull_request: branches: - - main + - master + paths: + - 'ui/**' jobs: test-and-coverage: @@ -22,8 +24,11 @@ jobs: with: node-version: ${{ matrix.node-version }} - name: Install dependencies + working-directory: ./ui run: npm install - name: Run Healthcheck + working-directory: ./ui run: npm run healthcheck - name: Build the application - run: npm run build + working-directory: ./ui + run: npm run build \ No newline at end of file diff --git a/api/.github/CODEOWNERS b/api/.github/CODEOWNERS deleted file mode 100644 index 087ce7daa0..0000000000 --- a/api/.github/CODEOWNERS +++ /dev/null @@ -1,5 +0,0 @@ -* @prowler-cloud/api - -# To protect a repository fully against unauthorized changes, you also need to define an owner for the CODEOWNERS file itself. -# https://docs.github.com/en/repositories/managing-your-repositorys-settings-and-features/customizing-your-repository/about-code-owners#codeowners-and-branch-protection -/.github/ @prowler-cloud/api diff --git a/api/.github/ISSUE_TEMPLATE/bug_report.yml b/api/.github/ISSUE_TEMPLATE/bug_report.yml deleted file mode 100644 index 6ee76d25ea..0000000000 --- a/api/.github/ISSUE_TEMPLATE/bug_report.yml +++ /dev/null @@ -1,97 +0,0 @@ -name: 🐞 Bug Report -description: Create a report to help us improve -title: "[Bug]: " -labels: ["bug", "status/needs-triage"] - -body: - - type: textarea - id: reproduce - attributes: - label: Steps to Reproduce - description: Steps to reproduce the behavior - placeholder: |- - 1. What command are you running? - 2. Cloud provider you are launching - 3. Environment you have, like single account, multi-account, organizations, multi or single subscription, etc. - 4. See error - validations: - required: true - - type: textarea - id: expected - attributes: - label: Expected behavior - description: A clear and concise description of what you expected to happen. - validations: - required: true - - type: textarea - id: actual - attributes: - label: Actual Result with Screenshots or Logs - description: If applicable, add screenshots to help explain your problem. Also, you can add logs (anonymize them first!). Here a command that may help to share a log `prowler --log-level DEBUG --log-file $(date +%F)_debug.log` then attach here the log file. - validations: - required: true - - type: dropdown - id: type - attributes: - label: How did you install Prowler? - options: - - Cloning the repository from github.com (git clone) - - From pip package (pip install prowler) - - From brew (brew install prowler) - - Docker (docker pull toniblyx/prowler) - validations: - required: true - - type: textarea - id: environment - attributes: - label: Environment Resource - description: From where are you running Prowler? - placeholder: |- - 1. EC2 instance - 2. Fargate task - 3. Docker container locally - 4. EKS - 5. Cloud9 - 6. CodeBuild - 7. Workstation - 8. Other(please specify) - validations: - required: true - - type: textarea - id: os - attributes: - label: OS used - description: Which OS are you using? - placeholder: |- - 1. Amazon Linux 2 - 2. MacOS - 3. Alpine Linux - 4. Windows - 5. Other(please specify) - validations: - required: true - - type: input - id: prowler-version - attributes: - label: Prowler version - description: Which Prowler version are you using? - placeholder: |- - prowler --version - validations: - required: true - - type: input - id: pip-version - attributes: - label: Pip version - description: Which pip version are you using? - placeholder: |- - pip --version - validations: - required: true - - type: textarea - id: additional - attributes: - description: Additional context - label: Context - validations: - required: false diff --git a/api/.github/ISSUE_TEMPLATE/config.yml b/api/.github/ISSUE_TEMPLATE/config.yml deleted file mode 100644 index 3ba13e0cec..0000000000 --- a/api/.github/ISSUE_TEMPLATE/config.yml +++ /dev/null @@ -1 +0,0 @@ -blank_issues_enabled: false diff --git a/api/.github/ISSUE_TEMPLATE/feature-request.yml b/api/.github/ISSUE_TEMPLATE/feature-request.yml deleted file mode 100644 index e72e26a490..0000000000 --- a/api/.github/ISSUE_TEMPLATE/feature-request.yml +++ /dev/null @@ -1,36 +0,0 @@ -name: 💡 Feature Request -description: Suggest an idea for this project -labels: ["enhancement", "status/needs-triage"] - - -body: - - type: textarea - id: Problem - attributes: - label: New feature motivation - description: Is your feature request related to a problem? Please describe - placeholder: |- - 1. A clear and concise description of what the problem is. Ex. I'm always frustrated when - validations: - required: true - - type: textarea - id: Solution - attributes: - label: Solution Proposed - description: A clear and concise description of what you want to happen. - validations: - required: true - - type: textarea - id: Alternatives - attributes: - label: Describe alternatives you've considered - description: A clear and concise description of any alternative solutions or features you've considered. - validations: - required: true - - type: textarea - id: Context - attributes: - label: Additional context - description: Add any other context or screenshots about the feature request here. - validations: - required: false diff --git a/api/.github/labeler.yml b/api/.github/labeler.yml deleted file mode 100644 index b6b5c279b2..0000000000 --- a/api/.github/labeler.yml +++ /dev/null @@ -1,15 +0,0 @@ -documentation: - - changed-files: - - any-glob-to-any-file: "docs/**" - -backend/api: - - changed-files: - - any-glob-to-any-file: "src/backend/api/**" - -backend/backend: - - changed-files: - - any-glob-to-any-file: "src/backend/backend/**" - -github_actions: - - changed-files: - - any-glob-to-any-file: ".github/workflows/*" diff --git a/api/.github/pull_request_template.md b/api/.github/pull_request_template.md deleted file mode 100644 index 8ffd4db041..0000000000 --- a/api/.github/pull_request_template.md +++ /dev/null @@ -1,13 +0,0 @@ -### Context - -Please include relevant motivation and context for this PR. - - -### Description - -Please include a summary of the change and which issue is fixed. List any dependencies that are required for this change. - - -### License - -By submitting this pull request, I confirm that my contribution is made under the terms of the AGPL-3.0 license. diff --git a/api/.github/workflows/find-secrets.yml b/api/.github/workflows/find-secrets.yml deleted file mode 100644 index 6428ee0a0a..0000000000 --- a/api/.github/workflows/find-secrets.yml +++ /dev/null @@ -1,18 +0,0 @@ -name: find-secrets - -on: pull_request - -jobs: - trufflehog: - runs-on: ubuntu-latest - steps: - - name: Checkout - uses: actions/checkout@v4 - with: - fetch-depth: 0 - - name: TruffleHog OSS - uses: trufflesecurity/trufflehog@v3.68.2 - with: - path: ./ - base: ${{ github.event.repository.default_branch }} - head: HEAD diff --git a/api/.github/workflows/labeler.yml b/api/.github/workflows/labeler.yml deleted file mode 100644 index 7bbe961110..0000000000 --- a/api/.github/workflows/labeler.yml +++ /dev/null @@ -1,15 +0,0 @@ -name: "Pull Request Labeler" - -on: - pull_request_target: - branches: - - "main" - -jobs: - labeler: - permissions: - contents: read - pull-requests: write - runs-on: ubuntu-latest - steps: - - uses: actions/labeler@v5 diff --git a/ui/.github/CODEOWNERS b/ui/.github/CODEOWNERS deleted file mode 100644 index 2ad99bd49a..0000000000 --- a/ui/.github/CODEOWNERS +++ /dev/null @@ -1,5 +0,0 @@ -* @prowler-cloud/ui - -# To protect a repository fully against unauthorized changes, you also need to define an owner for the CODEOWNERS file itself. -# https://docs.github.com/en/repositories/managing-your-repositorys-settings-and-features/customizing-your-repository/about-code-owners#codeowners-and-branch-protection -/.github/ @prowler-cloud/ui diff --git a/ui/.github/pull_request_template.md b/ui/.github/pull_request_template.md deleted file mode 100644 index 4bf3030402..0000000000 --- a/ui/.github/pull_request_template.md +++ /dev/null @@ -1,7 +0,0 @@ -### Description - -What was done in this PR - -### How to Review - -The reviewer should verify all these steps: