Zizmor doesn't support --exclude flag natively, so implemented
exclusion at Prowler level by filtering findings after scan completes.
The exclusion now supports both pattern types:
- Filename patterns: 'test-*.yml' matches any file named test-*.yml
- Full path patterns: '.github/workflows/test-*.yml' matches specific paths
- Subdirectory patterns: '**/experimental/*.yml' matches subdirs
Changes:
- Added fnmatch import for glob pattern matching
- Removed invalid --exclude flags from zizmor command
- Implemented _should_exclude_workflow() with dual matching logic
- Filter findings during processing based on exclusion patterns
- Added comprehensive test covering all pattern types
- Updated documentation with examples of both pattern types
Andoni A.