From 64efd0991861d259819d7560bba59a4a5db5732a Mon Sep 17 00:00:00 2001 From: Prowler Bot Date: Wed, 29 Oct 2025 15:28:01 +0100 Subject: [PATCH] chore: revert files ignore action removal (#9071) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Co-authored-by: César Arroba <19954079+cesararroba@users.noreply.github.com> --- .github/workflows/api-pull-request.yml | 53 ++++++++++--- .github/workflows/mcp-pull-request.yml | 105 +++++++++++++++++++++++++ .github/workflows/sdk-pull-request.yml | 85 +++++++++++--------- .github/workflows/ui-pull-request.yml | 40 ++++++++-- 4 files changed, 228 insertions(+), 55 deletions(-) create mode 100644 .github/workflows/mcp-pull-request.yml diff --git a/.github/workflows/api-pull-request.yml b/.github/workflows/api-pull-request.yml index 1266ce78c9..d838fd489a 100644 --- a/.github/workflows/api-pull-request.yml +++ b/.github/workflows/api-pull-request.yml @@ -6,21 +6,15 @@ on: - 'master' - 'v5.*' paths: - - '.github/workflows/api-pull-request.yml' - 'api/**' - - '!api/docs/**' - - '!api/README.md' - - '!api/CHANGELOG.md' + - '.github/workflows/api-pull-request.yml' pull_request: branches: - 'master' - 'v5.*' paths: - - '.github/workflows/api-pull-request.yml' - 'api/**' - - '!api/docs/**' - - '!api/README.md' - - '!api/CHANGELOG.md' + - '.github/workflows/api-pull-request.yml' concurrency: group: ${{ github.workflow }}-${{ github.ref }} @@ -41,9 +35,38 @@ env: IMAGE_NAME: prowler-api jobs: - code-quality: + check-changes: if: github.repository == 'prowler-cloud/prowler' runs-on: ubuntu-latest + timeout-minutes: 5 + outputs: + api-changed: ${{ steps.filter.outputs.api }} + steps: + - name: Checkout repository + uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0 + + - name: Check for API changes + id: filter + uses: tj-actions/changed-files@24d32ffd492484c1d75e0c0b894501ddb9d30d62 # v47.0.0 + with: + files_ignore: | + api/docs/** + api/README.md + api/CHANGELOG.md + + - name: Set output + id: set-output + run: | + if [[ "${{ steps.filter.outputs.any_changed }}" == "true" ]]; then + echo "api=true" >> $GITHUB_OUTPUT + else + echo "api=false" >> $GITHUB_OUTPUT + fi + + code-quality: + needs: check-changes + if: github.repository == 'prowler-cloud/prowler' && needs.check-changes.outputs.api-changed == 'true' + runs-on: ubuntu-latest timeout-minutes: 30 permissions: contents: read @@ -78,7 +101,8 @@ jobs: run: poetry run pylint --disable=W,C,R,E -j 0 -rn -sn src/ security-scans: - if: github.repository == 'prowler-cloud/prowler' + needs: check-changes + if: github.repository == 'prowler-cloud/prowler' && needs.check-changes.outputs.api-changed == 'true' runs-on: ubuntu-latest timeout-minutes: 15 permissions: @@ -113,7 +137,8 @@ jobs: run: poetry run vulture --exclude "contrib,tests,conftest.py" --min-confidence 100 . tests: - if: github.repository == 'prowler-cloud/prowler' + needs: check-changes + if: github.repository == 'prowler-cloud/prowler' && needs.check-changes.outputs.api-changed == 'true' runs-on: ubuntu-latest timeout-minutes: 30 permissions: @@ -177,7 +202,8 @@ jobs: flags: api dockerfile-lint: - if: github.repository == 'prowler-cloud/prowler' + needs: check-changes + if: github.repository == 'prowler-cloud/prowler' && needs.check-changes.outputs.api-changed == 'true' runs-on: ubuntu-latest timeout-minutes: 15 permissions: @@ -194,7 +220,8 @@ jobs: ignore: DL3013 container-build-and-scan: - if: github.repository == 'prowler-cloud/prowler' + needs: check-changes + if: github.repository == 'prowler-cloud/prowler' && needs.check-changes.outputs.api-changed == 'true' runs-on: ubuntu-latest timeout-minutes: 30 permissions: diff --git a/.github/workflows/mcp-pull-request.yml b/.github/workflows/mcp-pull-request.yml new file mode 100644 index 0000000000..1d1faedc1d --- /dev/null +++ b/.github/workflows/mcp-pull-request.yml @@ -0,0 +1,105 @@ +name: 'MCP: Pull Request' + +on: + push: + branches: + - 'master' + - 'v5.*' + paths: + - '.github/workflows/mcp-pull-request.yml' + - 'mcp_server/**' + pull_request: + branches: + - 'master' + - 'v5.*' + paths: + - '.github/workflows/mcp-pull-request.yml' + - 'mcp_server/**' + +concurrency: + group: ${{ github.workflow }}-${{ github.ref }} + cancel-in-progress: true + +env: + MCP_WORKING_DIR: ./mcp_server + IMAGE_NAME: prowler-mcp + +jobs: + check-changes: + if: github.repository == 'prowler-cloud/prowler' + runs-on: ubuntu-latest + timeout-minutes: 5 + outputs: + mcp-changed: ${{ steps.filter.outputs.mcp }} + steps: + - name: Checkout repository + uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0 + + - name: Check for MCP changes + id: filter + uses: tj-actions/changed-files@24d32ffd492484c1d75e0c0b894501ddb9d30d62 # v47.0.0 + with: + files_ignore: | + mcp_server/README.md + mcp_server/CHANGELOG.md + + - name: Set output + id: set-output + run: | + if [[ "${{ steps.filter.outputs.any_changed }}" == "true" ]]; then + echo "mcp=true" >> $GITHUB_OUTPUT + else + echo "mcp=false" >> $GITHUB_OUTPUT + fi + + dockerfile-lint: + needs: check-changes + if: github.repository == 'prowler-cloud/prowler' && needs.check-changes.outputs.mcp-changed == 'true' + runs-on: ubuntu-latest + timeout-minutes: 15 + permissions: + contents: read + + steps: + - name: Checkout repository + uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0 + + - name: Lint Dockerfile with Hadolint + uses: hadolint/hadolint-action@2332a7b74a6de0dda2e2221d575162eba76ba5e5 # v3.3.0 + with: + dockerfile: mcp_server/Dockerfile + + container-build-and-scan: + needs: check-changes + if: github.repository == 'prowler-cloud/prowler' && needs.check-changes.outputs.mcp-changed == 'true' + runs-on: ubuntu-latest + timeout-minutes: 30 + permissions: + contents: read + security-events: write + pull-requests: write + + steps: + - name: Checkout repository + uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0 + + - name: Set up Docker Buildx + uses: docker/setup-buildx-action@e468171a9de216ec08956ac3ada2f0791b6bd435 # v3.11.1 + + - name: Build MCP container + uses: docker/build-push-action@263435318d21b8e681c14492fe198d362a7d2c83 # v6.18.0 + with: + context: ${{ env.MCP_WORKING_DIR }} + push: false + load: true + tags: ${{ env.IMAGE_NAME }}:${{ github.sha }} + cache-from: type=gha + cache-to: type=gha,mode=max + + - name: Scan MCP container with Trivy + uses: ./.github/actions/trivy-scan + with: + image-name: ${{ env.IMAGE_NAME }} + image-tag: ${{ github.sha }} + fail-on-critical: 'false' + severity: 'CRITICAL' diff --git a/.github/workflows/sdk-pull-request.yml b/.github/workflows/sdk-pull-request.yml index 586a0d83ed..c63520b6b7 100644 --- a/.github/workflows/sdk-pull-request.yml +++ b/.github/workflows/sdk-pull-request.yml @@ -12,21 +12,6 @@ on: - 'poetry.lock' - 'Dockerfile' - '.github/workflows/sdk-pull-request.yml' - - '!prowler/CHANGELOG.md' - - '!docs/**' - - '!permissions/**' - - '!api/**' - - '!ui/**' - - '!dashboard/**' - - '!mcp_server/**' - - '!README.md' - - '!mkdocs.yml' - - '!.backportrc.json' - - '!.env' - - '!docker-compose*' - - '!examples/**' - - '!.gitignore' - - '!contrib/**' pull_request: branches: - 'master' @@ -38,21 +23,6 @@ on: - 'poetry.lock' - 'Dockerfile' - '.github/workflows/sdk-pull-request.yml' - - '!prowler/CHANGELOG.md' - - '!docs/**' - - '!permissions/**' - - '!api/**' - - '!ui/**' - - '!dashboard/**' - - '!mcp_server/**' - - '!README.md' - - '!mkdocs.yml' - - '!.backportrc.json' - - '!.env' - - '!docker-compose*' - - '!examples/**' - - '!.gitignore' - - '!contrib/**' concurrency: group: ${{ github.workflow }}-${{ github.ref }} @@ -62,9 +32,50 @@ env: IMAGE_NAME: prowler jobs: - code-quality: + check-changes: if: github.repository == 'prowler-cloud/prowler' runs-on: ubuntu-latest + timeout-minutes: 5 + outputs: + sdk-changed: ${{ steps.filter.outputs.sdk }} + steps: + - name: Checkout repository + uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0 + + - name: Check for SDK changes + id: filter + uses: tj-actions/changed-files@24d32ffd492484c1d75e0c0b894501ddb9d30d62 # v47.0.0 + with: + files_ignore: | + prowler/CHANGELOG.md + docs/** + permissions/** + api/** + ui/** + dashboard/** + mcp_server/** + README.md + mkdocs.yml + .backportrc.json + .env + docker-compose* + examples/** + .gitignore + contrib/** + + - name: Set output + id: set-output + run: | + if [[ "${{ steps.filter.outputs.any_changed }}" == "true" ]]; then + echo "sdk=true" >> $GITHUB_OUTPUT + else + echo "sdk=false" >> $GITHUB_OUTPUT + fi + + code-quality: + needs: check-changes + if: github.repository == 'prowler-cloud/prowler' && needs.check-changes.outputs.sdk-changed == 'true' + runs-on: ubuntu-latest timeout-minutes: 20 permissions: contents: read @@ -107,7 +118,8 @@ jobs: run: poetry run pylint --disable=W,C,R,E -j 0 -rn -sn prowler/ security-scans: - if: github.repository == 'prowler-cloud/prowler' + needs: check-changes + if: github.repository == 'prowler-cloud/prowler' && needs.check-changes.outputs.sdk-changed == 'true' runs-on: ubuntu-latest timeout-minutes: 15 permissions: @@ -139,7 +151,8 @@ jobs: run: poetry run vulture --exclude "contrib,api,ui" --min-confidence 100 . tests: - if: github.repository == 'prowler-cloud/prowler' + needs: check-changes + if: github.repository == 'prowler-cloud/prowler' && needs.check-changes.outputs.sdk-changed == 'true' runs-on: ubuntu-latest timeout-minutes: 60 permissions: @@ -445,7 +458,8 @@ jobs: files: ./config_coverage.xml dockerfile-lint: - if: github.repository == 'prowler-cloud/prowler' + needs: check-changes + if: github.repository == 'prowler-cloud/prowler' && needs.check-changes.outputs.sdk-changed == 'true' runs-on: ubuntu-latest timeout-minutes: 10 permissions: @@ -469,7 +483,8 @@ jobs: ignore: DL3013 container-build-and-scan: - if: github.repository == 'prowler-cloud/prowler' + needs: check-changes + if: github.repository == 'prowler-cloud/prowler' && needs.check-changes.outputs.sdk-changed == 'true' runs-on: ubuntu-latest timeout-minutes: 30 permissions: diff --git a/.github/workflows/ui-pull-request.yml b/.github/workflows/ui-pull-request.yml index a4ac803516..94554e1b1a 100644 --- a/.github/workflows/ui-pull-request.yml +++ b/.github/workflows/ui-pull-request.yml @@ -8,8 +8,6 @@ on: paths: - 'ui/**' - '.github/workflows/ui-pull-request.yml' - - '!ui/CHANGELOG.md' - - '!ui/README.md' pull_request: branches: - 'master' @@ -17,8 +15,6 @@ on: paths: - 'ui/**' - '.github/workflows/ui-pull-request.yml' - - '!ui/CHANGELOG.md' - - '!ui/README.md' concurrency: group: ${{ github.workflow }}-${{ github.ref }} @@ -30,9 +26,37 @@ env: NODE_VERSION: '20.x' jobs: - code-quality-and-build: + check-changes: if: github.repository == 'prowler-cloud/prowler' runs-on: ubuntu-latest + timeout-minutes: 5 + outputs: + ui-changed: ${{ steps.filter.outputs.ui }} + steps: + - name: Checkout repository + uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0 + + - name: Check for UI changes + id: filter + uses: tj-actions/changed-files@24d32ffd492484c1d75e0c0b894501ddb9d30d62 # v47.0.0 + with: + files_ignore: | + ui/CHANGELOG.md + ui/README.md + + - name: Set output + id: set-output + run: | + if [[ "${{ steps.filter.outputs.any_changed }}" == "true" ]]; then + echo "ui=true" >> $GITHUB_OUTPUT + else + echo "ui=false" >> $GITHUB_OUTPUT + fi + + code-quality-and-build: + needs: check-changes + if: github.repository == 'prowler-cloud/prowler' && needs.check-changes.outputs.ui-changed == 'true' + runs-on: ubuntu-latest timeout-minutes: 20 permissions: contents: read @@ -61,7 +85,8 @@ jobs: run: npm run build dockerfile-lint: - if: github.repository == 'prowler-cloud/prowler' + needs: check-changes + if: github.repository == 'prowler-cloud/prowler' && needs.check-changes.outputs.ui-changed == 'true' runs-on: ubuntu-latest timeout-minutes: 10 permissions: @@ -78,7 +103,8 @@ jobs: ignore: DL3018 container-build-and-scan: - if: github.repository == 'prowler-cloud/prowler' + needs: check-changes + if: github.repository == 'prowler-cloud/prowler' && needs.check-changes.outputs.ui-changed == 'true' runs-on: ubuntu-latest timeout-minutes: 30 permissions: