After this PR, the tool-wrapper else branch in __main__.py covers iac,
image, and any external tool-wrapper provider registered via entry
points (anything Provider.is_tool_wrapper_provider returns True for and
that is not llm). The existing `except ImageBaseException` was specific
to the Image provider but lived in a branch that was no longer
Image-only — its name no longer matched its scope, misleading plug-in
authors reading the file.
Move the catch inside an explicit `if provider == "image":` branch so
the name matches what it catches. iac and external tool-wrapper
providers fall through to the outer `except Exception` backstop for
unexpected failures, which was already the effective behavior in
practice (they do not raise ImageBaseException).
No behavior change — pure refactor for legibility, flagged by reviewer
on the PR #10700 review of 2026-05-06.
Repeated lookups for unknown provider names (built-ins, typos, names
with no registered entry point) re-iterated entry_points() on every
call because only hits were cached. importlib.metadata.entry_points()
walks the metadata of every installed Python package, so the cost is
proportional to the size of the venv, not just to Prowler.
Caches None on miss so subsequent lookups hit the existing
`if name in Provider._ep_providers` short-circuit and return
immediately. Aligns Provider._ep_providers with the symmetric cache
in tool_wrapper._ep_class_cache, which already had this behavior.
Includes a regression test that mocks importlib.metadata.entry_points,
calls _load_ep_provider("nonexistent") twice, and asserts entry_points
is invoked exactly once.
Also underscore-prefix the remaining unused parameters on the abstract
Provider stubs (get_output_options, get_stdout_detail,
generate_compliance_output, display_compliance_table) so vulture stops
flagging them now that the file is in the diff. Same pattern applied
in bbe3a7dbf for the previous batch.
The entry-point loop in get_available_compliance_frameworks appended
framework names without checking whether the same name was already
provided by a built-in. The loader (Compliance.get_bulk) already
respects "built-in wins" via an explicit guard, but the listing
function did not, causing --list-compliance and
--list-compliance-requirements to print the same name twice on
collision with a built-in.
Adds the same dedup guard already used by the universal frameworks
loop a few lines above, restoring symmetry across the three
compliance discovery layers.
Includes a regression test that registers a fake entry point with
a name colliding with a known built-in (cis_2.0_aws) and asserts
the framework appears exactly once in the resulting list.
Stack @classmethod under @validator for the five validators that take
cls as the first parameter. Pydantic v1 was already treating them as
classmethods via signature introspection, so runtime behavior is
unchanged. The explicit decorator resolves CodeQL alerts #6240-#6244.
Adds the existing # noqa: F841 marker (already used for cls in the
older validators of this file) so vulture does not flag cls as unused.
Affected validators in prowler/lib/check/models.py:
- validate_check_title
- validate_related_url
- validate_recommendation_url
- validate_description
- validate_risk
