ben.carrasco/prowler
1
0
Fork 0
mirror of https://github.com/prowler-cloud/prowler.git synced 2026-04-14 16:50:04 +00:00
Code Issues Packages Projects Releases Wiki Activity

docs(sdk): remove GitHub Code Scanning workflow examples from SARIF docs

Browse Source
This commit is contained in:
Andoni A.
2026-04-10 10:55:42 +02:00
parent fad845669b
commit ffd114f10c
3 changed files with 3 additions and 58 deletions
Download Patch File Download Diff File Expand all files Collapse all files

16
docs/user-guide/cli/tutorials/reporting.mdx
View File

@@ -392,22 +392,6 @@ The SARIF output includes:
* **Results:** Only failed (non-muted) findings are included, with file paths and line numbers for precise annotation.
* **Severity mapping:** Prowler severities map to SARIF levels (`critical`/`high` → `error`, `medium` → `warning`, `low`/`informational` → `note`).
#### GitHub Code Scanning Integration
To upload SARIF results to GitHub Code Scanning, use the `github/codeql-action/upload-sarif` action in a GitHub Actions workflow:
```yaml
- name: Run Prowler IaC Scan
run: prowler iac --scan-repository-url ${{ github.server_url }}/${{ github.repository }} -M sarif
- name: Upload SARIF to GitHub Security
uses: github/codeql-action/upload-sarif@v3
with:
sarif_file: output/
```
Findings appear natively in the repository's Security tab as code scanning alerts, with annotations pointing to the exact file and line.
## V4 Deprecations
Some deprecations have been made to unify formats and improve outputs.

39
docs/user-guide/cookbooks/cicd-pipeline.mdx
View File

@@ -231,45 +231,6 @@ prowler aws --push-to-cloud -M csv,html -o /tmp/prowler-reports
This produces CSV and HTML files locally while also pushing OCSF findings to Prowler Cloud. The local files can be stored as CI/CD artifacts for archival purposes.
### IaC Scanning with GitHub Code Scanning
To scan Infrastructure as Code and upload findings to GitHub's Security tab as code scanning alerts:
```yaml
name: Prowler IaC Scan
on:
push:
branches: [main]
pull_request:
branches: [main]
permissions:
contents: read
security-events: write
jobs:
prowler-iac:
runs-on: ubuntu-latest
steps:
- name: Install Prowler
run: pip install prowler
- name: Run Prowler IaC Scan
run: |
prowler iac --scan-repository-url ${{ github.server_url }}/${{ github.repository }} -M sarif
- name: Upload SARIF to GitHub Security
uses: github/codeql-action/upload-sarif@v3
if: always()
with:
sarif_file: output/
```
<Note>
The `security-events: write` permission is required to upload SARIF results. The `if: always()` condition ensures findings are uploaded even when Prowler exits with a non-zero code due to failing checks.
</Note>
### Scanning Multiple AWS Accounts
To scan multiple accounts sequentially in a single job, use [role assumption](/user-guide/providers/aws/role-assumption):

6
docs/user-guide/providers/iac/getting-started-iac.mdx
View File

@@ -146,14 +146,14 @@ Use the standard Prowler output options. The IaC provider also supports [SARIF](
prowler iac --scan-path ./iac --output-formats csv json-ocsf html
```
#### SARIF Output for GitHub Code Scanning
#### SARIF Output
<VersionBadge version="5.23.0" />
To generate SARIF output compatible with GitHub Code Scanning:
To generate SARIF output for integration with SARIF-compatible tools:
```sh
prowler iac --scan-repository-url https://github.com/user/repo -M sarif
```
The SARIF file can be uploaded to GitHub's Security tab using the `github/codeql-action/upload-sarif` action. Findings appear as code scanning alerts with file and line annotations. See the [SARIF reporting documentation](/user-guide/cli/tutorials/reporting#sarif-iac-only) for details.
See the [SARIF reporting documentation](/user-guide/cli/tutorials/reporting#sarif-iac-only) for details on the format and severity mapping.