40da359804
feat(compliance): discover external universal frameworks via entry points
...
External plug-ins ship multi-provider (universal-schema) frameworks through a
dedicated prowler.compliance.universal entry point group, separate from the
per-provider prowler.compliance group. Both get_bulk_compliance_frameworks_universal
(loading) and get_available_compliance_frameworks (listing / --compliance
choices) scan the new group. Built-ins load first and win on a name collision;
multiple packages under the same provider are merged. load_compliance_framework
gains fatal=False so the legacy external path skips a non-legacy JSON with a
warning instead of aborting the run.
2026-06-07 13:56:59 +02:00
f729c5a9f0
Merge branch 'master' into PROWLER-1391-provider-contract-dynamic-discovery
2026-06-05 14:44:50 +02:00
f9682c1354
fix(compliance): make GenericCompliance tolerant of provider-specific schemas
...
GenericCompliance is the documented last-resort renderer, but it read the
universal attribute fields (Section, SubSection, SubGroup, Service, Type,
Comment) directly and raised AttributeError on frameworks whose schema does
not declare them (CIS, ENS, ISO27001), dropping the whole compliance CSV.
Read all six fields with getattr defaulting to None, and dedupe the finding
and manual rows into a single helper.
2026-06-05 14:38:42 +02:00
d4bbc8b5ad
fix(jira): avoid 400 INVALID_INPUT on findings with empty field ( #11474 )
2026-06-05 13:26:28 +02:00
38788b7922
Merge remote-tracking branch 'origin/master' into PROWLER-1391-provider-contract-dynamic-discovery
...
# Conflicts:
# prowler/CHANGELOG.md
2026-06-03 12:15:24 +02:00
f7f8747512
feat(compliance): add DORA framework for AWS ( #11131 )
2026-06-03 11:43:55 +02:00
a652e28b4a
fix(api): clean up scan tmp output failure to avoid disk fill ( #11421 )
...
Co-authored-by: Pepe Fagoaga <pepe@prowler.com >
2026-06-02 11:37:05 +02:00
9c7afd64c5
fix(sdk): match compliance provider segment exactly in get_bulk
...
- Compare the module's last dotted segment instead of substring
- Prevent a provider name from capturing overlapping built-ins
- Add parametrized regression test (cloud, git, work, open cases)
- Update get_bulk test mock to the real dotted module name
2026-06-01 19:51:27 +02:00
5070ce39c2
fix(sdk): guard built-in providers in is_tool_wrapper_provider
...
- Short-circuit on is_builtin_provider before loading entry points
- Prevent same-name plug-ins from flipping a built-in onto the tool-wrapper path
- Avoid executing plug-in code via ep.load() for built-in names
- Add regression test asserting ep.load is never called
2026-06-01 19:43:36 +02:00
e1ade761b5
Merge branch 'master' into PROWLER-1391-provider-contract-dynamic-discovery
2026-05-31 19:30:23 +02:00
a2824f7166
feat(stackit): add new provider with 4 checks ( #9237 )
...
Co-authored-by: Claude <noreply@anthropic.com >
Co-authored-by: Sergio Garcia <hello@mistercloudsec.com >
Co-authored-by: Hugo P.Brito <hugopbrit@gmail.com >
Co-authored-by: Hugo Pereira Brito <101209179+HugoPBrito@users.noreply.github.com >
2026-05-28 13:16:38 +02:00
ca72922dca
Merge branch 'master' into PROWLER-1391-provider-contract-dynamic-discovery
2026-05-27 17:12:54 +02:00
48c071297f
fix(sdk): align compliance CSV row emission with framework JSON ( #11370 )
2026-05-27 11:06:23 +02:00
bfcbe0a9c4
feat(scaleway): add new provider ( #11166 )
2026-05-18 16:42:10 +02:00
4dd5baadf6
feat(okta): add provider to the SDK with 1 security check ( #11079 )
2026-05-13 15:57:57 +02:00
2c5d47a8cd
chore: route vulnerability references to canonical URLs ( #10853 )
...
Co-authored-by: Hugo P.Brito <hugopbrito@Mac.home >
2026-05-07 15:28:50 +01:00
bcaa6ac488
fix(sdk): scan every Azure subscription when display names collide ( #10718 )
...
Co-authored-by: Rubén De la Torre Vico <ruben@prowler.com >
Co-authored-by: Daniel Barranquero <danielbo2001@gmail.com >
2026-05-07 13:59:38 +02:00
e585ae45bd
feat(aws): rename Essential Eight to ASD Essential Eight ( #11054 )
...
Co-authored-by: César Arroba <cesar@prowler.com >
2026-05-06 13:11:29 +02:00
cf99e02ceb
Merge branch 'master' into PROWLER-1391-provider-contract-dynamic-discovery
2026-05-05 08:57:11 +02:00
86449fb99d
chore(vercel): add disclaimer for checks depending on billing plan ( #10663 )
2026-05-04 08:56:50 +02:00
0672c80563
fix(sdk): guard find_spec with is_builtin for external provider discovery
...
Calling importlib.util.find_spec on prowler.providers.{provider}.services
for an external provider propagates ModuleNotFoundError when the parent
package prowler.providers.{provider} does not exist, instead of returning
None. This caused recover_checks_from_provider, _resolve_check_module and
Scan.scan to fail with "No module named 'prowler.providers.{external}'"
even though the plug-in registered its checks via entry points correctly.
Gate the built-in branch on Provider.is_builtin (which already wraps the
find_spec in try/except) and reuse _resolve_check_module from Scan.scan
so external providers fall through to the entry-point lookup.
2026-05-03 22:31:31 +02:00
92d7ea2170
Merge remote-tracking branch 'origin/master' into PROWLER-1391-provider-contract-dynamic-discovery
...
# Conflicts:
# prowler/config/config.py
2026-05-03 19:41:25 +02:00
c7aa536896
fix(sdk): built-in wins on plug-in collision for providers and checks
2026-04-30 19:50:19 +02:00
228fe6d579
feat: add ASD Essential Eight compliance framework for AWS ( #10808 )
...
Co-authored-by: Boon <boon@security8.work >
Co-authored-by: pedrooot <pedromarting3@gmail.com >
2026-04-30 13:49:08 +02:00
578186aa40
feat(sdk): integrate universal compliance into CLI pipeline ( #10301 )
2026-04-30 13:49:00 +02:00
7076900fb1
fix(kubernetes): use cluster name as provider_uid in OCSF output ( #10483 )
...
Co-authored-by: Pepe Fagoaga <pepe@prowler.com >
2026-04-29 13:45:49 +02:00
15d8f1642e
test(sdk): unit tests for tool_wrapper leaf module
2026-04-28 14:45:07 +02:00
b668770480
feat(github): add zizmor GitHub Actions scanning as a service of the GitHub provider ( #10607 )
2026-04-27 08:55:07 +02:00
d4ece2b43e
feat(sdk): add multi-provider compliance framework JSONs ( #10300 )
...
Co-authored-by: Alan Buscaglia <gentlemanprogramming@gmail.com >
2026-04-24 13:27:31 +02:00
43bd1083e0
feat(sdk): add SARIF output format for IaC provider ( #10626 )
...
Co-authored-by: Pepe Fagoaga <pepe@prowler.com >
2026-04-22 09:32:20 +02:00
a24869fc26
feat(sdk): add universal compliance output modules (CSV, OCSF, table) ( #10299 )
2026-04-22 09:01:45 +02:00
ac6dd03fb8
feat(sdk): add universal compliance schema models and loaders ( #10298 )
2026-04-21 11:39:04 +02:00
4e508b69c9
fix(vercel): use canonical Hub URLs in check metadata ( #10636 )
2026-04-09 16:23:50 +02:00
56c370d3a4
chore(ccc): update with latest version and improve mapping ( #10625 )
2026-04-09 15:27:18 +02:00
9290d7e105
feat(sdk): warn when sensitive CLI flags receive explicit values ( #10532 )
2026-04-08 13:15:05 +02:00
5e1e4bd8e4
fix(oci): Mutelist support ( #10566 )
...
Co-authored-by: Ronan Chota <ronan.chota@saic.com >
Co-authored-by: Hugo P.Brito <hugopbrito@users.noreply.github.com >
2026-04-07 13:23:51 +01:00
c99ed991b7
fix: show all checks including threat-detection in --list-checks ( #10578 )
...
Co-authored-by: Claude <noreply@anthropic.com >
Co-authored-by: kaiisfree <kai@users.noreply.github.com >
Co-authored-by: Hugo Pereira Brito <101209179+HugoPBrito@users.noreply.github.com >
2026-04-06 16:55:15 +01:00
ab8e83da3f
fix(api,ui): dynamically fetch Jira issue types instead of hardcoding "Task" ( #10534 )
...
Co-authored-by: alejandrobailo <alejandrobailo94@gmail.com >
2026-04-01 14:37:49 +02:00
4f86667433
feat(sdk): add Vercel provider with 30 security checks ( #10189 )
...
Co-authored-by: Daniel Barranquero <danielbo2001@gmail.com >
Co-authored-by: Andoni A. <14891798+andoniaf@users.noreply.github.com >
2026-03-31 16:21:22 +02:00
4bb1e5cff7
fix(sdk): redact sensitive CLI flags in HTML output ( #10518 )
2026-03-31 15:01:09 +02:00
269d9dfe41
feat(cli): add --resource-group flag to filter checks by resource group ( #10479 )
...
Co-authored-by: Daniel Barranquero <danielbo2001@gmail.com >
2026-03-27 11:55:28 +01:00
65e745d779
fix(sdk): skip strict CheckMetadata validators for external tool providers ( #10363 )
2026-03-18 09:11:39 +01:00
c9284f8003
chore(models): add pydantic validators for CheckMetadata ( #8583 )
...
Co-authored-by: Rubén De la Torre Vico <ruben@prowler.com >
Co-authored-by: Daniel Barranquero <danielbo2001@gmail.com >
Co-authored-by: Andoni A. <14891798+andoniaf@users.noreply.github.com >
2026-03-16 10:36:08 +01:00
b08cb8ffb3
fix(csv): move OU columns to the end ( #10307 )
2026-03-12 08:28:52 +01:00
39385567fc
feat(organizations): add OU metadata to outputs ( #10283 )
...
Co-authored-by: Raajhesh Kannaa Chidambaram <495042+raajheshkannaa@users.noreply.github.com >
Co-authored-by: Daniel Barranquero <danielbo2001@gmail.com >
2026-03-11 16:41:44 +01:00
e8d2b4a189
fix(iac): include resource line range in finding UID to prevent duplicates ( #10241 )
...
Co-authored-by: Pepe Fagoaga <pepe@prowler.com >
2026-03-03 17:40:36 +01:00
b61b6cba53
feat(sdk): add provider identity fields to OCSF unmapped output ( #10240 )
...
Co-authored-by: Pepe Fagoaga <pepe@prowler.com >
2026-03-03 16:42:08 +01:00
dfca97633e
feat(sdk): add provider_uid to OCSF unmapped output ( #10231 )
...
Co-authored-by: Pepe Fagoaga <pepe@prowler.com >
2026-03-03 13:35:58 +01:00
012fd84cb0
chore: add provider-uid flag for iac provider ( #10233 )
...
Co-authored-by: Pepe Fagoaga <pepe@prowler.com >
2026-03-03 13:07:15 +01:00
dcf74113fc
chore: modify M365 and Github account UIDs ( #10226 )
2026-03-02 17:22:09 +01:00
StylusFrost