From 98015dafef26fcbab19364e1df6ea4634a7c636f Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?C=C3=A9sar=20Arroba?=
 <19954079+cesararroba@users.noreply.github.com>
Date: Wed, 22 Jul 2026 12:08:40 +0200
Subject: [PATCH] ci(api): scan the SDK pin that ships, not the committed lock
 (#12084)

---
 .github/workflows/api-container-checks.yml | 9 +++++++++
 1 file changed, 9 insertions(+)

diff --git a/.github/workflows/api-container-checks.yml b/.github/workflows/api-container-checks.yml
index f8d5df5417..0e6609286f 100644
--- a/.github/workflows/api-container-checks.yml
+++ b/.github/workflows/api-container-checks.yml
@@ -113,6 +113,15 @@ jobs:
             api/changelog.d/**
             api/AGENTS.md
 
+      # api-container-build-push.yml resolves the SDK pin to the branch tip
+      # before building, so match it here and scan what ships. Push only: PRs
+      # stay deterministic against the committed lock.
+      - name: Refresh prowler SDK pin to current branch tip
+        if: steps.check-changes.outputs.any_changed == 'true' && github.event_name == 'push'
+        run: |
+          pip install --no-cache-dir "uv==0.11.14"
+          (cd api && uv lock --upgrade-package prowler)
+
       - name: Set up Docker Buildx
         if: steps.check-changes.outputs.any_changed == 'true'
         uses: docker/setup-buildx-action@4d04d5d9486b7bd6fa91e7baf45bbb4f8b9deedd # v4.0.0