StylusFrost
4fb14bbb21
perf(sdk): cache misses in Provider._load_ep_provider
...
Repeated lookups for unknown provider names (built-ins, typos, names
with no registered entry point) re-iterated entry_points() on every
call because only hits were cached. importlib.metadata.entry_points()
walks the metadata of every installed Python package, so the cost is
proportional to the size of the venv, not just to Prowler.
Caches None on miss so subsequent lookups hit the existing
`if name in Provider._ep_providers` short-circuit and return
immediately. Aligns Provider._ep_providers with the symmetric cache
in tool_wrapper._ep_class_cache, which already had this behavior.
Includes a regression test that mocks importlib.metadata.entry_points,
calls _load_ep_provider("nonexistent") twice, and asserts entry_points
is invoked exactly once.
Also underscore-prefix the remaining unused parameters on the abstract
Provider stubs (get_output_options, get_stdout_detail,
generate_compliance_output, display_compliance_table) so vulture stops
flagging them now that the file is in the diff. Same pattern applied
in bbe3a7dbf
2026-05-07 10:00:07 +02:00
StylusFrost
cf99e02ceb
Merge branch 'master' into PROWLER-1391-provider-contract-dynamic-discovery
2026-05-05 08:57:11 +02:00
Pepe Fagoaga and Andoni A.
7c6d658154
fix(k8s): match RBAC rules by apiGroup, not just core ( #10969 )
...
Co-authored-by: Andoni A. <14891798+andoniaf@users.noreply.github.com >
2026-05-04 19:54:03 +02:00
Pepe Fagoaga
21d7d08b4b
fix(timeline): Return a compact actor name from CloudTrail events ( #10986 )
2026-05-04 19:39:17 +02:00
Daniel Barranquero
921f49a0de
feat(aws): add bedrock_prompt_management_exists security check ( #10878 )
2026-05-04 12:38:15 +02:00
Daniel Barranquero
86449fb99d
chore(vercel): add disclaimer for checks depending on billing plan ( #10663 )
2026-05-04 08:56:50 +02:00
Andoni Alonso
40dd0e640b
fix(sdk): strip http(s):// scheme from image registry URLs ( #10950 )
2026-05-04 08:37:46 +02:00
StylusFrost
9681901174
style(sdk): satisfy black and vulture in test_dynamic_provider_loading
...
Two unrelated lint blockers that CI surfaced once the file was in scope
of `black --check .` and `vulture` on the changed-file path:
- Reformat one if/and conditional that black wanted on a single line.
- Underscore-prefix unused parameter names on FakeProvider stub methods
(from_cli_args, get_output_options, display_compliance_table,
generate_compliance_output, FakePureContractProvider.from_cli_args)
and the throwaway **kw in a MagicMock side_effect lambda. These are
test fixtures whose method bodies don't reference those args; the
signatures must match the abstract contract on Provider, so we keep
positions/types and just rename to indicate intentional non-use.
No logic change.
2026-05-03 22:55:24 +02:00
StylusFrost
92d7ea2170
Merge remote-tracking branch 'origin/master' into PROWLER-1391-provider-contract-dynamic-discovery
...
# Conflicts:
# prowler/config/config.py
2026-05-03 19:41:25 +02:00
StylusFrost
c7aa536896
fix(sdk): built-in wins on plug-in collision for providers and checks
2026-04-30 19:50:19 +02:00
Danny Lyubenov and Daniel Barranquero
c802dc8a36
feat(codebuild): use batched API calls to prevent throttling and false positives ( #10639 )
...
Co-authored-by: Daniel Barranquero <danielbo2001@gmail.com >
2026-04-30 17:19:21 +02:00
Pepe Fagoaga
36b8aa1b79
fix(boto3): pass config to clients ( #10944 )
2026-04-30 14:11:29 +02:00
StylusFrost
e7f23bb13f
fix(sdk): propagate provider argument from report to stdout_report
2026-04-30 14:06:17 +02:00
StylusFrost
82132a9341
fix(sdk): use find_spec to distinguish missing vs broken built-ins
2026-04-30 13:53:06 +02:00
Andoni Alonso
4608e45c8a
fix(image): block parser-mismatch SSRF in registry auth ( #10945 )
2026-04-30 12:56:35 +02:00
Josema Camacho
9297453b8a
fix(sdk): add autouse mock_aws fixture and leak detector to prevent AWS test leaks ( #10605 )
2026-04-29 17:49:40 +02:00
Hugo Pereira Brito
380b89cfb6
fix(sdk): cover CNAME → dangling S3 in route53 takeover check ( #10920 )
2026-04-29 11:14:33 +01:00
Davlet Dzhakishev and Daniel Barranquero
1de01bcb78
fix(azure): tighten flow log workspace checks ( #10645 )
...
Co-authored-by: Daniel Barranquero <danielbo2001@gmail.com >
2026-04-28 16:57:04 +02:00
StylusFrost
be49fd8c4e
Merge branch 'master' into PROWLER-1391-provider-contract-dynamic-discovery
2026-04-28 14:48:21 +02:00
Daniel Barranquero
8b368e1343
feat(aws): add bedrock_guardrails_configured security check ( #10844 )
2026-04-28 14:16:19 +02:00
StylusFrost
45e946cd87
Merge branch 'master' into PROWLER-1391-provider-contract-dynamic-discovery
2026-04-28 12:42:18 +02:00
StylusFrost
52f6653ccf
fix(sdk): use equality not substring in provider dispatch chain
2026-04-28 11:54:23 +02:00
Hugo Pereira Brito
e252058af4
fix(m365): exclude guest users from entra_users_mfa_capable ( #10785 )
2026-04-28 08:58:16 +01:00
Pepe Fagoaga
7df2703db1
fix(aws): get organization's metadata with assumed role ( #10894 )
2026-04-27 22:15:11 +01:00
Kay Agahd
67234210ba
feat(aws): add check secretsmanager_has_restrictive_resource_policy ( #6985 )
2026-04-27 21:49:34 +01:00
Hugo Pereira Brito
3441ad7f70
fix(sdk): align googleworkspace finding resources ( #10901 )
2026-04-27 15:17:29 +01:00
lydiavilchez
013809919c
feat(googleworkspace): add Gmail service with first batch of checks ( #10683 )
2026-04-27 13:49:07 +02:00
Daniel Barranquero
368d9c1519
fix(admincenter): restrict admincenter group visibility check to Unified groups ( #10899 )
2026-04-27 13:23:03 +02:00
Andoni Alonso
b668770480
feat(github): add zizmor GitHub Actions scanning as a service of the GitHub provider ( #10607 )
2026-04-27 08:55:07 +02:00
StylusFrost
a31fe9b618
Merge branch 'master' into PROWLER-1391-provider-contract-dynamic-discovery
...
Conflict in prowler/config/config.py resolved by combining both branches:
- HEAD: external compliance discovery via entry points (PROWLER-1391)
- master: multi-provider framework JSONs scanned at top-level compliance/ (#10300 )
Order: built-in per-provider -> built-in multi-provider -> external entry points.
Built-ins first so they win on name collisions against external registrations.
Supporting external plug-ins to register multi-provider frameworks is tracked
in PROWLER-1444.
2026-04-24 20:54:22 +02:00
StylusFrost
907166d88a
fix(sdk): discriminate builtin vs external providers via find_spec for clearer import errors
2026-04-24 20:33:38 +02:00
StylusFrost
0883baad78
fix(sdk): external providers with --service and external checks for new services
2026-04-24 20:18:20 +02:00
StylusFrost
cf70d1f9f8
fix(sdk): honor from_cli_args return value in init_global_provider fallback
2026-04-24 18:51:57 +02:00
StylusFrost
60e7657081
feat(sdk): wire is_external_tool_provider property to execution and metadata validators
2026-04-24 18:23:42 +02:00
Daniel Barranquero
80d62f355f
fix(alibabacloud): fix CS service SDK compatibility and harden Alibaba provider ( #10871 )
2026-04-24 09:26:09 +02:00
Mathisdjango and Daniel Barranquero
927be17fb7
feat(github): add check for dismissing stale PR approvals on default branch (CIS 1.1.4) ( #10569 )
...
Co-authored-by: Daniel Barranquero <danielbo2001@gmail.com >
2026-04-22 16:14:10 +02:00
StylusFrost
9c056beed1
Merge branch 'master' into PROWLER-1391-provider-contract-dynamic-discovery
2026-04-22 09:39:10 +02:00
Andoni Alonso and Pepe Fagoaga
43bd1083e0
feat(sdk): add SARIF output format for IaC provider ( #10626 )
...
Co-authored-by: Pepe Fagoaga <pepe@prowler.com >
2026-04-22 09:32:20 +02:00
StylusFrost
f60f7c61c7
feat(provider): add display_compliance_table method for provider-specific compliance rendering
2026-04-21 19:40:38 +02:00
StylusFrost
3deb1359a5
Merge branch 'master' into PROWLER-1391-provider-contract-dynamic-discovery
2026-04-21 18:52:13 +02:00
StylusFrost
e2295bd086
feat(provider): implement get_mutelist_finding_args for external providers and add tests
2026-04-21 18:50:18 +02:00
Pepe Fagoaga
f2c5d2ec87
fix(aws): fallback lookup events to resource name ( #10828 )
2026-04-21 18:31:50 +02:00
39911e3ab7
feat(github): add --repo-list-file flag for GitHub scanning ( #10501 )
...
Co-authored-by: Raajhesh Kannaa Chidambaram <495042+raajheshkannaa@users.noreply.github.com >
Co-authored-by: Andoni A. <14891798+andoniaf@users.noreply.github.com >
2026-04-21 15:31:34 +02:00
StylusFrost
5f10e1c1b6
Merge branch 'master' into PROWLER-1391-provider-contract-dynamic-discovery
2026-04-21 14:19:52 +02:00
StylusFrost
484211b465
fix(sdk): align exception handlers to SDK convention and improve test coverage
2026-04-21 14:14:17 +02:00
Andoni Alonso
19c752c127
fix(cloudflare): guard validate_credentials against paginator infinite loops ( #10771 )
2026-04-17 11:23:31 +02:00
Erich Blume and Andoni A.
a2a1a73749
fix(image): --registry-list crashes with AttributeError on global_provider ( #10691 )
...
Co-authored-by: Andoni A. <14891798+andoniaf@users.noreply.github.com >
2026-04-16 13:02:25 +02:00
lydiavilchez
08fbe17e29
fix(googleworkspace): treat secure Google defaults as PASS for Drive checks ( #10727 )
2026-04-16 13:01:55 +02:00
lydiavilchez
d920f78059
fix(googleworkspace): treat secure Google defaults as PASS for Calendar checks ( #10726 )
2026-04-16 12:51:40 +02:00
Daniel Barranquero
43913b1592
feat(aws): support excluding regions from scans via CLI, env var, and config ( #10688 )
2026-04-15 17:59:46 +02:00
StylusFrost