- Add image_sha field to CheckReportImage from Trivy Metadata.ImageID
- Build resource_uid as "{image_name}:{short_sha}" in both CLI and API paths
- Set ServiceName to "container-image" for all image findings
- Pass clean image name as resource_name, Trivy target as resource_details
- Remove dead docker login/pull/logout code and exceptions
- Fix finding metadata: empty RelatedUrl, Categories per finding type
- Replace SystemExit(0) with _listing_only flag in registry listing
- Use dynamic prowler_version in User-Agent header
- Normalize image UID by stripping protocol prefix on save
- Skip compliance and attack surface tasks for Image and IaC providers
- Add tests for scan_per_image and IMAGE scan path
Cloudflare bot management on Docker Hub blocks the default
python-requests User-Agent from container IPs, returning HTTP 500.
Add a Prowler/1.0 User-Agent header to all registry requests and
include truncated response body in 5xx retry logs for diagnostics.
- Add scan_per_image() generator to ImageProvider for per-image yields
- Replace single-shot IMAGE execution in Scan.scan() with per-image progress
- Extend checks_loader bypass to include IMAGE provider
- Add server error retry with exponential backoff in _request_with_retry
- Include truncated response body in Docker Hub login errors
- Add debug logging for login attempts
- Pass TRIVY_USERNAME/TRIVY_PASSWORD env vars for registry auth
- Remove docker login, docker pull, and docker logout dependencies
- Eliminates need for Docker binary inside the worker container
- Add image provider handling in Scan class alongside IaC (skip check loading, run Trivy directly)
- Add image provider API models, serializers, and connection check logic
- Point API SDK dependency to this feature branch
- Add test notebook for image provider API workflow
Add early return in _resolve_basic_credentials when password is None
to prevent TypeError on base64.b64decode. Move DockerHubAdapter import
from local scope to top-level in image_provider.py per PEP 8. Add
one-time 401 retry with token refresh in _authed_request to handle
per-repository-scoped bearer tokens on strict OCI registries.
Remove unused detect_registry_type() function and _ECR_PATTERN constant
from factory.py, along with their corresponding tests. Move requests
import behind TYPE_CHECKING guard in oci_adapter.py and
dockerhub_adapter.py since it is only used for type annotations.
- Fix shared dict mutation in ImageBaseException (thread-safety)
- Handle unexpected status codes in OCI adapter auth flow
- Force TLS verification for Docker Hub endpoints
- Add credential-safe __repr__ to RegistryAdapter
- Rename _next_page_url override to _next_tag_page_url in DockerHubAdapter
- Distinguish rate-limit from connection errors in retry logic
- Add type hints to all public adapter methods
- Remove unused imports in test files (flake8)
Update test patches from adapter-level to base-level module paths since
requests and time are now imported in base.py. Consolidate separate
requests.post/requests.get patches into requests.request since all HTTP
calls now go through _request_with_retry.
- Add test_registry_list_without_registry_fails: validates that
--registry-list without --registry returns an error
- Add test_registry_list_with_registry_passes: validates the happy path
- Add clarifying comment in factory.py about ECR using OCI adapter
- Move _request_with_retry, _next_page_url, _MAX_RETRIES, _BACKOFF_BASE
from OciRegistryAdapter and DockerHubAdapter into RegistryAdapter base
- Add context_label parameter to _request_with_retry for contextual
error/warning messages (defaults to self.registry_url)
- Route _hub_login and _get_registry_token through retry logic
- Change 404 exception in _check_hub_response from ImageRegistryAuthError
to ImageRegistryCatalogError (missing namespace is not an auth failure)
- Remove redundant time, requests imports from leaf adapters
- Use public /v2/repositories/{ns}/ endpoint when unauthenticated
- Fall back to namespace API when JWT is available for private repos
- Add test for unauthenticated public namespace listing
Add Registry Scan Mode section covering --registry, --image-filter,
--tag-filter, --max-images, --registry-insecure, and the new
--registry-list flag for image discovery.
Add --registry-list flag that enumerates registry repositories and tags,
then prints a structured listing and exits without scanning. This helps
users discover available images before building --image-filter or
--tag-filter regexes.
Add pluggable registry adapter pattern for enumerating and scanning all
container images in a private registry. Supports:
- Generic OCI registries (Harbor, GitLab, JFrog) via /v2/_catalog
- Docker Hub via Hub REST API with namespace-based enumeration
- AWS ECR via standard OCI endpoints with ECR auth token
New CLI flags: --registry, --image-filter, --tag-filter, --max-images,
--registry-insecure
Andoni A.