chore: revert files ignore action removal (#9071)

Co-authored-by: César Arroba <19954079+cesararroba@users.noreply.github.com>

.github/workflows/api-pull-request.yml

@@ -6,21 +6,15 @@ on:
       - 'master'
       - 'v5.*'
     paths:
-      - '.github/workflows/api-pull-request.yml'
       - 'api/**'
-      - '!api/docs/**'
-      - '!api/README.md'
-      - '!api/CHANGELOG.md'
+      - '.github/workflows/api-pull-request.yml'
   pull_request:
     branches:
       - 'master'
       - 'v5.*'
     paths:
-      - '.github/workflows/api-pull-request.yml'
       - 'api/**'
-      - '!api/docs/**'
-      - '!api/README.md'
-      - '!api/CHANGELOG.md'
+      - '.github/workflows/api-pull-request.yml'
 
 concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}
@@ -41,9 +35,38 @@ env:
   IMAGE_NAME: prowler-api
 
 jobs:
-  code-quality:
+  check-changes:
     if: github.repository == 'prowler-cloud/prowler'
     runs-on: ubuntu-latest
+    timeout-minutes: 5
+    outputs:
+      api-changed: ${{ steps.filter.outputs.api }}
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
+
+      - name: Check for API changes
+        id: filter
+        uses: tj-actions/changed-files@24d32ffd492484c1d75e0c0b894501ddb9d30d62 # v47.0.0
+        with:
+          files_ignore: |
+            api/docs/**
+            api/README.md
+            api/CHANGELOG.md
+
+      - name: Set output
+        id: set-output
+        run: |
+          if [[ "${{ steps.filter.outputs.any_changed }}" == "true" ]]; then
+            echo "api=true" >> $GITHUB_OUTPUT
+          else
+            echo "api=false" >> $GITHUB_OUTPUT
+          fi
+
+  code-quality:
+    needs: check-changes
+    if: github.repository == 'prowler-cloud/prowler' && needs.check-changes.outputs.api-changed == 'true'
+    runs-on: ubuntu-latest
     timeout-minutes: 30
     permissions:
       contents: read
@@ -78,7 +101,8 @@ jobs:
         run: poetry run pylint --disable=W,C,R,E -j 0 -rn -sn src/
 
   security-scans:
-    if: github.repository == 'prowler-cloud/prowler'
+    needs: check-changes
+    if: github.repository == 'prowler-cloud/prowler' && needs.check-changes.outputs.api-changed == 'true'
     runs-on: ubuntu-latest
     timeout-minutes: 15
     permissions:
@@ -113,7 +137,8 @@ jobs:
         run: poetry run vulture --exclude "contrib,tests,conftest.py" --min-confidence 100 .
 
   tests:
-    if: github.repository == 'prowler-cloud/prowler'
+    needs: check-changes
+    if: github.repository == 'prowler-cloud/prowler' && needs.check-changes.outputs.api-changed == 'true'
     runs-on: ubuntu-latest
     timeout-minutes: 30
     permissions:
@@ -177,7 +202,8 @@ jobs:
           flags: api
 
   dockerfile-lint:
-    if: github.repository == 'prowler-cloud/prowler'
+    needs: check-changes
+    if: github.repository == 'prowler-cloud/prowler' && needs.check-changes.outputs.api-changed == 'true'
     runs-on: ubuntu-latest
     timeout-minutes: 15
     permissions:
@@ -194,7 +220,8 @@ jobs:
           ignore: DL3013
 
   container-build-and-scan:
-    if: github.repository == 'prowler-cloud/prowler'
+    needs: check-changes
+    if: github.repository == 'prowler-cloud/prowler' && needs.check-changes.outputs.api-changed == 'true'
     runs-on: ubuntu-latest
     timeout-minutes: 30
     permissions:

.github/workflows/mcp-pull-request.yml

@@ -0,0 +1,105 @@
+name: 'MCP: Pull Request'
+
+on:
+  push:
+    branches:
+      - 'master'
+      - 'v5.*'
+    paths:
+      - '.github/workflows/mcp-pull-request.yml'
+      - 'mcp_server/**'
+  pull_request:
+    branches:
+      - 'master'
+      - 'v5.*'
+    paths:
+      - '.github/workflows/mcp-pull-request.yml'
+      - 'mcp_server/**'
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
+env:
+  MCP_WORKING_DIR: ./mcp_server
+  IMAGE_NAME: prowler-mcp
+
+jobs:
+  check-changes:
+    if: github.repository == 'prowler-cloud/prowler'
+    runs-on: ubuntu-latest
+    timeout-minutes: 5
+    outputs:
+      mcp-changed: ${{ steps.filter.outputs.mcp }}
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
+
+      - name: Check for MCP changes
+        id: filter
+        uses: tj-actions/changed-files@24d32ffd492484c1d75e0c0b894501ddb9d30d62 # v47.0.0
+        with:
+          files_ignore: |
+            mcp_server/README.md
+            mcp_server/CHANGELOG.md
+
+      - name: Set output
+        id: set-output
+        run: |
+          if [[ "${{ steps.filter.outputs.any_changed }}" == "true" ]]; then
+            echo "mcp=true" >> $GITHUB_OUTPUT
+          else
+            echo "mcp=false" >> $GITHUB_OUTPUT
+          fi
+
+  dockerfile-lint:
+    needs: check-changes
+    if: github.repository == 'prowler-cloud/prowler' && needs.check-changes.outputs.mcp-changed == 'true'
+    runs-on: ubuntu-latest
+    timeout-minutes: 15
+    permissions:
+      contents: read
+
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
+
+      - name: Lint Dockerfile with Hadolint
+        uses: hadolint/hadolint-action@2332a7b74a6de0dda2e2221d575162eba76ba5e5 # v3.3.0
+        with:
+          dockerfile: mcp_server/Dockerfile
+
+  container-build-and-scan:
+    needs: check-changes
+    if: github.repository == 'prowler-cloud/prowler' && needs.check-changes.outputs.mcp-changed == 'true'
+    runs-on: ubuntu-latest
+    timeout-minutes: 30
+    permissions:
+      contents: read
+      security-events: write
+      pull-requests: write
+
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
+
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@e468171a9de216ec08956ac3ada2f0791b6bd435 # v3.11.1
+
+      - name: Build MCP container
+        uses: docker/build-push-action@263435318d21b8e681c14492fe198d362a7d2c83 # v6.18.0
+        with:
+          context: ${{ env.MCP_WORKING_DIR }}
+          push: false
+          load: true
+          tags: ${{ env.IMAGE_NAME }}:${{ github.sha }}
+          cache-from: type=gha
+          cache-to: type=gha,mode=max
+
+      - name: Scan MCP container with Trivy
+        uses: ./.github/actions/trivy-scan
+        with:
+          image-name: ${{ env.IMAGE_NAME }}
+          image-tag: ${{ github.sha }}
+          fail-on-critical: 'false'
+          severity: 'CRITICAL'

.github/workflows/sdk-pull-request.yml

@@ -12,21 +12,6 @@ on:
       - 'poetry.lock'
       - 'Dockerfile'
       - '.github/workflows/sdk-pull-request.yml'
-      - '!prowler/CHANGELOG.md'
-      - '!docs/**'
-      - '!permissions/**'
-      - '!api/**'
-      - '!ui/**'
-      - '!dashboard/**'
-      - '!mcp_server/**'
-      - '!README.md'
-      - '!mkdocs.yml'
-      - '!.backportrc.json'
-      - '!.env'
-      - '!docker-compose*'
-      - '!examples/**'
-      - '!.gitignore'
-      - '!contrib/**'
   pull_request:
     branches:
       - 'master'
@@ -38,21 +23,6 @@ on:
       - 'poetry.lock'
       - 'Dockerfile'
       - '.github/workflows/sdk-pull-request.yml'
-      - '!prowler/CHANGELOG.md'
-      - '!docs/**'
-      - '!permissions/**'
-      - '!api/**'
-      - '!ui/**'
-      - '!dashboard/**'
-      - '!mcp_server/**'
-      - '!README.md'
-      - '!mkdocs.yml'
-      - '!.backportrc.json'
-      - '!.env'
-      - '!docker-compose*'
-      - '!examples/**'
-      - '!.gitignore'
-      - '!contrib/**'
 
 concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}
@@ -62,9 +32,50 @@ env:
   IMAGE_NAME: prowler
 
 jobs:
-  code-quality:
+  check-changes:
     if: github.repository == 'prowler-cloud/prowler'
     runs-on: ubuntu-latest
+    timeout-minutes: 5
+    outputs:
+      sdk-changed: ${{ steps.filter.outputs.sdk }}
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
+
+      - name: Check for SDK changes
+        id: filter
+        uses: tj-actions/changed-files@24d32ffd492484c1d75e0c0b894501ddb9d30d62 # v47.0.0
+        with:
+          files_ignore: |
+            prowler/CHANGELOG.md
+            docs/**
+            permissions/**
+            api/**
+            ui/**
+            dashboard/**
+            mcp_server/**
+            README.md
+            mkdocs.yml
+            .backportrc.json
+            .env
+            docker-compose*
+            examples/**
+            .gitignore
+            contrib/**
+
+      - name: Set output
+        id: set-output
+        run: |
+          if [[ "${{ steps.filter.outputs.any_changed }}" == "true" ]]; then
+            echo "sdk=true" >> $GITHUB_OUTPUT
+          else
+            echo "sdk=false" >> $GITHUB_OUTPUT
+          fi
+
+  code-quality:
+    needs: check-changes
+    if: github.repository == 'prowler-cloud/prowler' && needs.check-changes.outputs.sdk-changed == 'true'
+    runs-on: ubuntu-latest
     timeout-minutes: 20
     permissions:
       contents: read
@@ -107,7 +118,8 @@ jobs:
         run: poetry run pylint --disable=W,C,R,E -j 0 -rn -sn prowler/
 
   security-scans:
-    if: github.repository == 'prowler-cloud/prowler'
+    needs: check-changes
+    if: github.repository == 'prowler-cloud/prowler' && needs.check-changes.outputs.sdk-changed == 'true'
     runs-on: ubuntu-latest
     timeout-minutes: 15
     permissions:
@@ -139,7 +151,8 @@ jobs:
         run: poetry run vulture --exclude "contrib,api,ui" --min-confidence 100 .
 
   tests:
-    if: github.repository == 'prowler-cloud/prowler'
+    needs: check-changes
+    if: github.repository == 'prowler-cloud/prowler' && needs.check-changes.outputs.sdk-changed == 'true'
     runs-on: ubuntu-latest
     timeout-minutes: 60
     permissions:
@@ -445,7 +458,8 @@ jobs:
           files: ./config_coverage.xml
 
   dockerfile-lint:
-    if: github.repository == 'prowler-cloud/prowler'
+    needs: check-changes
+    if: github.repository == 'prowler-cloud/prowler' && needs.check-changes.outputs.sdk-changed == 'true'
     runs-on: ubuntu-latest
     timeout-minutes: 10
     permissions:
@@ -469,7 +483,8 @@ jobs:
           ignore: DL3013
 
   container-build-and-scan:
-    if: github.repository == 'prowler-cloud/prowler'
+    needs: check-changes
+    if: github.repository == 'prowler-cloud/prowler' && needs.check-changes.outputs.sdk-changed == 'true'
     runs-on: ubuntu-latest
     timeout-minutes: 30
     permissions:

.github/workflows/ui-pull-request.yml

@@ -8,8 +8,6 @@ on:
     paths:
       - 'ui/**'
       - '.github/workflows/ui-pull-request.yml'
-      - '!ui/CHANGELOG.md'
-      - '!ui/README.md'
   pull_request:
     branches:
       - 'master'
@@ -17,8 +15,6 @@ on:
     paths:
       - 'ui/**'
       - '.github/workflows/ui-pull-request.yml'
-      - '!ui/CHANGELOG.md'
-      - '!ui/README.md'
 
 concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}
@@ -30,9 +26,37 @@ env:
   NODE_VERSION: '20.x'
 
 jobs:
-  code-quality-and-build:
+  check-changes:
     if: github.repository == 'prowler-cloud/prowler'
     runs-on: ubuntu-latest
+    timeout-minutes: 5
+    outputs:
+      ui-changed: ${{ steps.filter.outputs.ui }}
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
+
+      - name: Check for UI changes
+        id: filter
+        uses: tj-actions/changed-files@24d32ffd492484c1d75e0c0b894501ddb9d30d62 # v47.0.0
+        with:
+          files_ignore: |
+            ui/CHANGELOG.md
+            ui/README.md
+
+      - name: Set output
+        id: set-output
+        run: |
+          if [[ "${{ steps.filter.outputs.any_changed }}" == "true" ]]; then
+            echo "ui=true" >> $GITHUB_OUTPUT
+          else
+            echo "ui=false" >> $GITHUB_OUTPUT
+          fi
+
+  code-quality-and-build:
+    needs: check-changes
+    if: github.repository == 'prowler-cloud/prowler' && needs.check-changes.outputs.ui-changed == 'true'
+    runs-on: ubuntu-latest
     timeout-minutes: 20
     permissions:
       contents: read
@@ -61,7 +85,8 @@ jobs:
         run: npm run build
 
   dockerfile-lint:
-    if: github.repository == 'prowler-cloud/prowler'
+    needs: check-changes
+    if: github.repository == 'prowler-cloud/prowler' && needs.check-changes.outputs.ui-changed == 'true'
     runs-on: ubuntu-latest
     timeout-minutes: 10
     permissions:
@@ -78,7 +103,8 @@ jobs:
           ignore: DL3018
 
   container-build-and-scan:
-    if: github.repository == 'prowler-cloud/prowler'
+    needs: check-changes
+    if: github.repository == 'prowler-cloud/prowler' && needs.check-changes.outputs.ui-changed == 'true'
     runs-on: ubuntu-latest
     timeout-minutes: 30
     permissions: