docs(skills): add UI motion guidance

- Document visible microinteraction rules for shadcn primitives
- Register the skill for motion and transition work
- Link skeleton guidance for loading handoff cases

.env

@@ -6,20 +6,14 @@
 PROWLER_UI_VERSION="stable"
 AUTH_URL=http://localhost:3000
 API_BASE_URL=http://prowler-api:8080/api/v1
-# deprecated, use UI_API_BASE_URL
 NEXT_PUBLIC_API_BASE_URL=${API_BASE_URL}
-UI_API_BASE_URL=${API_BASE_URL}
-# deprecated, use UI_API_DOCS_URL
 NEXT_PUBLIC_API_DOCS_URL=http://prowler-api:8080/api/v1/docs
-UI_API_DOCS_URL=http://prowler-api:8080/api/v1/docs
 AUTH_TRUST_HOST=true
 UI_PORT=3000
 # openssl rand -base64 32
 AUTH_SECRET="N/c6mnaS5+SWq81+819OrzQZlmx1Vxtp/orjttJSmw8="
-# Google Tag Manager ID (empty/unset ⇒ GTM not loaded, zero egress)
-# deprecated, use UI_GOOGLE_TAG_MANAGER_ID
+# Google Tag Manager ID
 NEXT_PUBLIC_GOOGLE_TAG_MANAGER_ID=""
-UI_GOOGLE_TAG_MANAGER_ID=""
 
 #### MCP Server ####
 PROWLER_MCP_VERSION=stable
@@ -72,8 +66,8 @@ NEO4J_APOC_IMPORT_FILE_ENABLED=false
 NEO4J_APOC_IMPORT_FILE_USE_NEO4J_CONFIG=true
 NEO4J_APOC_TRIGGER_ENABLED=false
 NEO4J_DBMS_CONNECTOR_BOLT_LISTEN_ADDRESS=0.0.0.0:7687
-# Attack Paths graph settings
-ATTACK_PATHS_GRAPH_MUTATION_BATCH_SIZE=1000
+# Neo4j Prowler settings
+ATTACK_PATHS_BATCH_SIZE=1000
 ATTACK_PATHS_SERVICE_UNAVAILABLE_MAX_RETRIES=3
 ATTACK_PATHS_READ_QUERY_TIMEOUT_SECONDS=30
 ATTACK_PATHS_MAX_CUSTOM_QUERY_NODES=250
@@ -145,20 +139,13 @@ DJANGO_BROKER_VISIBILITY_TIMEOUT=86400
 DJANGO_SENTRY_DSN=
 DJANGO_THROTTLE_TOKEN_OBTAIN=50/minute
 
-# Sentry for the web app (server + browser). The UI_SENTRY_* values load only
-# when UI_SENTRY_ENABLED="true"; without it they are ignored (default off, zero
-# egress). The deprecated NEXT_PUBLIC_SENTRY_DSN still activates Sentry without
-# the flag. SENTRY_RELEASE (unprefixed) feeds the web app's server/edge SDKs.
-UI_SENTRY_DSN=
-UI_SENTRY_ENVIRONMENT=local
+# Sentry settings
+SENTRY_ENVIRONMENT=local
 SENTRY_RELEASE=local
-# Reserved runtime public config (registered now; no UI consumer yet)
-# UI_POSTHOG_KEY=
-# UI_POSTHOG_HOST=
-# REO_DEV_CLIENT_ID=
+NEXT_PUBLIC_SENTRY_ENVIRONMENT=${SENTRY_ENVIRONMENT}
 
 #### Prowler release version ####
-NEXT_PUBLIC_PROWLER_RELEASE_VERSION=v5.39.2
+NEXT_PUBLIC_PROWLER_RELEASE_VERSION=v5.29.0
 
 # Social login credentials
 SOCIAL_GOOGLE_OAUTH_CALLBACK_URL="${AUTH_URL}/api/auth/callback/google"

.github/CODEOWNERS

@@ -1,6 +1,7 @@
 # SDK
 /* @prowler-cloud/detection-remediation
 /prowler/ @prowler-cloud/detection-remediation
+/prowler/compliance/ @prowler-cloud/compliance
 /tests/ @prowler-cloud/detection-remediation
 /dashboard/ @prowler-cloud/detection-remediation
 /docs/ @prowler-cloud/detection-remediation

.github/actionlint.yaml

@@ -1,6 +0,0 @@
-# Generated by gh-aw and marked DO NOT EDIT. It uses concurrency options newer than
-# actionlint knows, so the findings are about actionlint's schema, not our workflows.
-paths:
-  .github/workflows/**/*.lock.yml:
-    ignore:
-      - '.*'

.github/actions/grype-scan/action.yml

@@ -1,179 +0,0 @@
-name: 'Container Security Scan with Grype'
-description: 'Scans container images for vulnerabilities using Grype and reports results'
-author: 'Prowler'
-
-inputs:
-  image-name:
-    description: 'Container image name to scan'
-    required: true
-  image-tag:
-    description: 'Container image tag to scan'
-    required: true
-    default: ${{ github.sha }}
-  fail-on-severity:
-    description: 'Fail the build on findings at this severity or above: critical, high, or none'
-    required: false
-    default: 'high'
-  upload-sarif:
-    description: 'Upload results to GitHub Security tab'
-    required: false
-    default: 'true'
-  create-pr-comment:
-    description: 'Create a comment on the PR with scan results'
-    required: false
-    default: 'true'
-  artifact-retention-days:
-    description: 'Days to retain the Grype report artifact'
-    required: false
-    default: '2'
-
-outputs:
-  critical-count:
-    description: 'Number of critical vulnerabilities found'
-    value: ${{ steps.security-check.outputs.critical }}
-  high-count:
-    description: 'Number of high vulnerabilities found'
-    value: ${{ steps.security-check.outputs.high }}
-  total-count:
-    description: 'Total number of vulnerabilities found'
-    value: ${{ steps.security-check.outputs.total }}
-
-runs:
-  using: 'composite'
-  steps:
-    - name: Run Grype vulnerability scan (JSON)
-      uses: anchore/scan-action@e1165082ffb1fe366ebaf02d8526e7c4989ea9d2 # v7.4.0
-      with:
-        image: ${{ inputs.image-name }}:${{ inputs.image-tag }}
-        output-format: 'json'
-        output-file: 'grype-report.json'
-        fail-build: 'false'
-        by-cve: 'true' # Report CVE ids rather than GHSA, so findings line up with Trivy's
-        only-fixed: 'true' # A finding with no available fix is not actionable, so it must not gate
-        cache-db: 'true'
-        grype-version: 'v0.116.1'
-
-    - name: Run Grype vulnerability scan (SARIF)
-      if: inputs.upload-sarif == 'true' && github.event_name == 'push'
-      uses: anchore/scan-action@e1165082ffb1fe366ebaf02d8526e7c4989ea9d2 # v7.4.0
-      with:
-        image: ${{ inputs.image-name }}:${{ inputs.image-tag }}
-        output-format: 'sarif'
-        output-file: 'grype-results.sarif'
-        fail-build: 'false'
-        severity-cutoff: 'high'
-        by-cve: 'true'
-        only-fixed: 'true' # A finding with no available fix is not actionable, so it must not gate
-        cache-db: 'true'
-        grype-version: 'v0.116.1'
-
-    - name: Upload Grype results to GitHub Security tab
-      if: inputs.upload-sarif == 'true' && github.event_name == 'push'
-      uses: github/codeql-action/upload-sarif@3599b3baa15b485a2e49ef411a7a4bb2452e7f93 # v3.30.5
-      with:
-        sarif_file: 'grype-results.sarif'
-        category: 'grype-container'
-
-    - name: Upload Grype report artifact
-      uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
-      if: always()
-      with:
-        name: grype-scan-report-${{ inputs.image-name }}-${{ inputs.image-tag }}
-        path: grype-report.json
-        retention-days: ${{ inputs.artifact-retention-days }}
-
-    - name: Generate security summary
-      id: security-check
-      shell: bash
-      run: |
-        CRITICAL=$(jq '[.matches[]? | select(.vulnerability.severity=="Critical")] | length' grype-report.json)
-        HIGH=$(jq '[.matches[]? | select(.vulnerability.severity=="High")] | length' grype-report.json)
-        TOTAL=$(jq '[.matches[]?] | length' grype-report.json)
-
-        echo "critical=$CRITICAL" >> $GITHUB_OUTPUT
-        echo "high=$HIGH" >> $GITHUB_OUTPUT
-        echo "total=$TOTAL" >> $GITHUB_OUTPUT
-
-        echo "### 🔎 Container Security Scan (Grype)" >> $GITHUB_STEP_SUMMARY
-        echo "" >> $GITHUB_STEP_SUMMARY
-        echo "**Image:** \`${INPUTS_IMAGE_NAME}:${INPUTS_IMAGE_TAG}\`" >> $GITHUB_STEP_SUMMARY
-        echo "" >> $GITHUB_STEP_SUMMARY
-        echo "- 🔴 Critical: $CRITICAL" >> $GITHUB_STEP_SUMMARY
-        echo "- 🟠 High: $HIGH" >> $GITHUB_STEP_SUMMARY
-        echo "- **Total**: $TOTAL" >> $GITHUB_STEP_SUMMARY
-        echo "" >> $GITHUB_STEP_SUMMARY
-        echo "Reported alongside Trivy, not instead of it. Counts differ by design." >> $GITHUB_STEP_SUMMARY
-      env:
-        INPUTS_IMAGE_NAME: ${{ inputs.image-name }}
-        INPUTS_IMAGE_TAG: ${{ inputs.image-tag }}
-
-    # Before the gate, so the comment is there to explain a failure rather than absent because of it
-    - name: Comment scan results on PR
-      if: >-
-        inputs.create-pr-comment == 'true'
-        && github.event_name == 'pull_request'
-        && github.event.pull_request.head.repo.full_name == github.repository
-      uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0
-      env:
-        IMAGE_NAME: ${{ inputs.image-name }}
-        GITHUB_SHA: ${{ inputs.image-tag }}
-        CUTOFF: ${{ inputs.fail-on-severity }}
-      with:
-        script: |
-          const comment = require('./.github/scripts/grype-pr-comment.js');
-
-          // Unique identifier to find our comment
-          const marker = `<!-- grype-scan-comment:${process.env.IMAGE_NAME} -->`;
-          const body = marker + '\n' + comment;
-
-          const { data: comments } = await github.rest.issues.listComments({
-            owner: context.repo.owner,
-            repo: context.repo.repo,
-            issue_number: context.issue.number,
-          });
-
-          const existingComment = comments.find(c => c.body?.includes(marker));
-
-          if (existingComment) {
-            await github.rest.issues.updateComment({
-              owner: context.repo.owner,
-              repo: context.repo.repo,
-              comment_id: existingComment.id,
-              body: body
-            });
-            console.log('✅ Updated existing Grype scan comment');
-          } else {
-            await github.rest.issues.createComment({
-              owner: context.repo.owner,
-              repo: context.repo.repo,
-              issue_number: context.issue.number,
-              body: body
-            });
-            console.log('✅ Created new Grype scan comment');
-          }
-
-    - name: Check for blocking vulnerabilities
-      if: inputs.fail-on-severity != 'none'
-      shell: bash
-      run: |
-        if [ "$CUTOFF" = "critical" ]; then
-          BLOCKING=$CRITICAL
-          SEVERITIES='["Critical"]'
-        else
-          BLOCKING=$((CRITICAL + HIGH))
-          SEVERITIES='["Critical","High"]'
-        fi
-
-        if [ "$BLOCKING" -gt 0 ]; then
-          echo "::error::Found $BLOCKING vulnerabilities at severity ${CUTOFF} or above ($CRITICAL critical, $HIGH high)"
-          echo "::warning::Update the package, or add it to .grype.yaml with a reason if nothing can be done"
-          jq -r --argjson severities "$SEVERITIES" \
-            '.matches[] | select(.vulnerability.severity | IN($severities[]))
-             | "  \(.vulnerability.severity)\t\(.vulnerability.id)\t\(.artifact.name) \(.artifact.version)"' \
-            grype-report.json | sort -u
-          exit 1
-        fi
-      env:
-        CUTOFF: ${{ inputs.fail-on-severity }}
-        CRITICAL: ${{ steps.security-check.outputs.critical }}
-        HIGH: ${{ steps.security-check.outputs.high }}

.github/actions/osv-scanner/action.yml

@@ -1,5 +1,5 @@
 name: 'OSV-Scanner'
-description: 'Install osv-scanner and scan a lockfile, failing on CRITICAL severity findings. Posts/updates a PR comment with findings on pull_request events (requires pull-requests: write).'
+description: 'Install osv-scanner and scan a lockfile, failing on HIGH/CRITICAL/UNKNOWN severity findings. Posts/updates a PR comment with findings on pull_request events (requires pull-requests: write).'
 author: 'Prowler'
 
 inputs:
@@ -7,9 +7,9 @@ inputs:
     description: 'Path to the lockfile to scan, relative to the repository root (e.g. uv.lock, api/uv.lock, ui/pnpm-lock.yaml).'
     required: true
   severity-levels:
-    description: 'Comma-separated severity levels that fail the scan. Default: CRITICAL.'
+    description: 'Comma-separated severity levels that fail the scan. Default: HIGH,CRITICAL,UNKNOWN.'
     required: false
-    default: 'CRITICAL'
+    default: 'HIGH,CRITICAL,UNKNOWN'
   version:
     description: 'osv-scanner release tag to install. When overriding, you MUST also override binary-sha256.'
     required: false

.github/actions/setup-python-uv/action.yml

@@ -43,17 +43,8 @@ runs:
       if: github.repository_owner == 'prowler-cloud' && github.repository != 'prowler-cloud/prowler'
       shell: bash
       working-directory: ${{ inputs.working-directory }}
-      env:
-        GITHUB_TOKEN: ${{ github.token }}
       run: |
-        LATEST_COMMIT=$(curl -sf --retry 3 --retry-all-errors --retry-delay 2 --retry-max-time 60 \
-          -H "Authorization: Bearer ${GITHUB_TOKEN}" \
-          -H "Accept: application/vnd.github+json" \
-          "https://api.github.com/repos/prowler-cloud/prowler/commits/master" \
-          | jq -er '.sha') || {
-          echo "::error::Failed to fetch latest prowler/master commit from the GitHub API (HTTP error or missing .sha). Check the GITHUB_TOKEN and API rate limits."
-          exit 1
-        }
+        LATEST_COMMIT=$(curl -s "https://api.github.com/repos/prowler-cloud/prowler/commits/master" | jq -r '.sha')
         echo "Latest commit hash: $LATEST_COMMIT"
         sed -i "s|\(git = \"https://github\.com/prowler-cloud/prowler\.git?rev=master\)#[a-f0-9]\{40\}\"|\1#${LATEST_COMMIT}\"|g" uv.lock
         echo "Updated uv.lock entry:"
@@ -63,17 +54,8 @@ runs:
       if: github.event_name == 'push' && github.ref == 'refs/heads/master' && github.repository == 'prowler-cloud/prowler'
       shell: bash
       working-directory: ${{ inputs.working-directory }}
-      env:
-        GITHUB_TOKEN: ${{ github.token }}
       run: |
-        LATEST_COMMIT=$(curl -sf --retry 3 --retry-all-errors --retry-delay 2 --retry-max-time 60 \
-          -H "Authorization: Bearer ${GITHUB_TOKEN}" \
-          -H "Accept: application/vnd.github+json" \
-          "https://api.github.com/repos/prowler-cloud/prowler/commits/master" \
-          | jq -er '.sha') || {
-          echo "::error::Failed to fetch latest prowler/master commit from the GitHub API (HTTP error or missing .sha). Check the GITHUB_TOKEN and API rate limits."
-          exit 1
-        }
+        LATEST_COMMIT=$(curl -s "https://api.github.com/repos/prowler-cloud/prowler/commits/master" | jq -r '.sha')
         echo "Latest commit hash: $LATEST_COMMIT"
         sed -i "s|\(git = \"https://github\.com/prowler-cloud/prowler\.git?rev=master\)#[a-f0-9]\{40\}\"|\1#${LATEST_COMMIT}\"|g" uv.lock
         echo "Updated uv.lock entry:"

.github/actions/trivy-scan/action.yml

@@ -14,10 +14,10 @@ inputs:
     description: 'Severities to scan for (comma-separated)'
     required: false
     default: 'CRITICAL,HIGH,MEDIUM,LOW'
-  fail-on-severity:
-    description: 'Fail the build on findings at this severity or above: critical, high, or none'
+  fail-on-critical:
+    description: 'Fail the build if critical vulnerabilities are found'
     required: false
-    default: 'high'
+    default: 'false'
   upload-sarif:
     description: 'Upload results to GitHub Security tab'
     required: false
@@ -54,7 +54,7 @@ runs:
           trivy-db-${{ runner.os }}-
 
     - name: Run Trivy vulnerability scan (JSON)
-      uses: aquasecurity/trivy-action@ed142fd0673e97e23eac54620cfb913e5ce36c25 # v0.36.0
+      uses: aquasecurity/trivy-action@e368e328979b113139d6f9068e03accaed98a518 # 0.34.1
       with:
         image-ref: ${{ inputs.image-name }}:${{ inputs.image-tag }}
         format: 'json'
@@ -62,16 +62,12 @@ runs:
         severity: ${{ inputs.severity }}
         exit-code: '0'
         scanners: 'vuln'
-        ignore-unfixed: 'true' # A finding with no available fix is not actionable, so it must not gate
         timeout: '5m'
-        version: 'v0.74.0'
-      # Not trivyignores: that input drops the .yaml extension Trivy parses by.
-      env:
-        TRIVY_IGNOREFILE: '.trivyignore.yaml'
+        version: 'v0.69.2'
 
     - name: Run Trivy vulnerability scan (SARIF)
       if: inputs.upload-sarif == 'true' && github.event_name == 'push'
-      uses: aquasecurity/trivy-action@ed142fd0673e97e23eac54620cfb913e5ce36c25 # v0.36.0
+      uses: aquasecurity/trivy-action@e368e328979b113139d6f9068e03accaed98a518 # 0.34.1
       with:
         image-ref: ${{ inputs.image-name }}:${{ inputs.image-tag }}
         format: 'sarif'
@@ -79,12 +75,8 @@ runs:
         severity: 'CRITICAL,HIGH'
         exit-code: '0'
         scanners: 'vuln'
-        ignore-unfixed: 'true' # A finding with no available fix is not actionable, so it must not gate
         timeout: '5m'
-        version: 'v0.74.0'
-      # Not trivyignores: that input drops the .yaml extension Trivy parses by.
-      env:
-        TRIVY_IGNOREFILE: '.trivyignore.yaml'
+        version: 'v0.69.2'
 
     - name: Upload Trivy results to GitHub Security tab
       if: inputs.upload-sarif == 'true' && github.event_name == 'push'
@@ -171,28 +163,13 @@ runs:
             console.log('✅ Created new Trivy scan comment');
           }
 
-    - name: Check for blocking vulnerabilities
-      if: inputs.fail-on-severity != 'none'
+    - name: Check for critical vulnerabilities
+      if: inputs.fail-on-critical == 'true' && steps.security-check.outputs.critical != '0'
       shell: bash
       run: |
-        if [ "$CUTOFF" = "critical" ]; then
-          BLOCKING=$CRITICAL
-          SEVERITIES='["CRITICAL"]'
-        else
-          BLOCKING=$((CRITICAL + HIGH))
-          SEVERITIES='["CRITICAL","HIGH"]'
-        fi
+        echo "::error::Found ${STEPS_SECURITY_CHECK_OUTPUTS_CRITICAL} critical vulnerabilities"
+        echo "::warning::Please update packages or use a different base image"
+        exit 1
 
-        if [ "$BLOCKING" -gt 0 ]; then
-          echo "::error::Found $BLOCKING vulnerabilities at severity ${CUTOFF} or above ($CRITICAL critical, $HIGH high)"
-          echo "::warning::Update the package, or add it to .trivyignore.yaml with a reason if nothing can be done"
-          jq -r --argjson severities "$SEVERITIES" \
-            '.Results[]?.Vulnerabilities[]? | select(.Severity | IN($severities[]))
-             | "  \(.Severity)\t\(.VulnerabilityID)\t\(.PkgName) \(.InstalledVersion)"' \
-            trivy-report.json | sort -u
-          exit 1
-        fi
       env:
-        CUTOFF: ${{ inputs.fail-on-severity }}
-        CRITICAL: ${{ steps.security-check.outputs.critical }}
-        HIGH: ${{ steps.security-check.outputs.high }}
+        STEPS_SECURITY_CHECK_OUTPUTS_CRITICAL: ${{ steps.security-check.outputs.critical }}

.github/aw/actions-lock.json

@@ -5,20 +5,10 @@
       "version": "v8",
       "sha": "ed597411d8f924073f98dfc5c65a23a2325f34cd"
     },
-    "github/gh-aw-actions/setup@v0.81.6": {
-      "repo": "github/gh-aw-actions/setup",
-      "version": "v0.81.6",
-      "sha": "ba6380cc6e5be5d21677bebe04d52fb48e3abec7"
-    },
     "github/gh-aw/actions/setup@v0.43.23": {
       "repo": "github/gh-aw/actions/setup",
       "version": "v0.43.23",
       "sha": "9382be3ca9ac18917e111a99d4e6bbff58d0dccc"
-    },
-    "step-security/harden-runner@v2.20.0": {
-      "repo": "step-security/harden-runner",
-      "version": "v2.20.0",
-      "sha": "bf7454d06d71f1098171f2acdf0cd4708d7b5920"
     }
   }
 }

.github/dependabot.yml

@@ -0,0 +1,138 @@
+# To get started with Dependabot version updates, you'll need to specify which
+# package ecosystems to update and where the package manifests are located.
+# Please see the documentation for all configuration options:
+# https://docs.github.com/github/administering-a-repository/configuration-options-for-dependency-updates
+
+version: 2
+updates:
+  # v5
+  # - package-ecosystem: "pip"
+  #   directory: "/"
+  #   schedule:
+  #     interval: "monthly"
+  #   open-pull-requests-limit: 25
+  #   target-branch: master
+  #   labels:
+  #     - "dependencies"
+  #     - "pip"
+  #   cooldown:
+  #     default-days: 7
+
+  # Dependabot Updates are temporary disabled - 2025/03/19
+  # - package-ecosystem: "pip"
+  #   directory: "/api"
+  #   schedule:
+  #     interval: "daily"
+  #   open-pull-requests-limit: 10
+  #   target-branch: master
+  #   labels:
+  #     - "dependencies"
+  #     - "pip"
+  #     - "component/api"
+
+  - package-ecosystem: "github-actions"
+    directory: "/"
+    schedule:
+      interval: "monthly"
+    open-pull-requests-limit: 25
+    target-branch: master
+    labels:
+      - "dependencies"
+      - "github_actions"
+    cooldown:
+      default-days: 7
+
+  # Dependabot Updates are temporary disabled - 2025/03/19
+  # - package-ecosystem: "npm"
+  #   directory: "/ui"
+  #   schedule:
+  #     interval: "daily"
+  #   open-pull-requests-limit: 10
+  #   target-branch: master
+  #   labels:
+  #     - "dependencies"
+  #     - "npm"
+  #     - "component/ui"
+
+  - package-ecosystem: "docker"
+    directory: "/"
+    schedule:
+      interval: "monthly"
+    open-pull-requests-limit: 25
+    target-branch: master
+    labels:
+      - "dependencies"
+      - "docker"
+    cooldown:
+      default-days: 7
+
+  # - package-ecosystem: "pre-commit"
+  #   directory: "/"
+  #   schedule:
+  #     interval: "monthly"
+  #   open-pull-requests-limit: 25
+  #   target-branch: master
+  #   labels:
+  #     - "dependencies"
+  #     - "pre-commit"
+  #   cooldown:
+  #     default-days: 7
+
+  # Dependabot Updates are temporary disabled - 2025/04/15
+  # v4.6
+  # - package-ecosystem: "pip"
+  #   directory: "/"
+  #   schedule:
+  #     interval: "weekly"
+  #   open-pull-requests-limit: 10
+  #   target-branch: v4.6
+  #   labels:
+  #     - "dependencies"
+  #     - "pip"
+  #     - "v4"
+
+  # - package-ecosystem: "github-actions"
+  #   directory: "/"
+  #   schedule:
+  #     interval: "weekly"
+  #   open-pull-requests-limit: 10
+  #   target-branch: v4.6
+  #   labels:
+  #     - "dependencies"
+  #     - "github_actions"
+  #     - "v4"
+
+  # - package-ecosystem: "docker"
+  #   directory: "/"
+  #   schedule:
+  #     interval: "weekly"
+  #   open-pull-requests-limit: 10
+  #   target-branch: v4.6
+  #   labels:
+  #     - "dependencies"
+  #     - "docker"
+  #     - "v4"
+
+  # Dependabot Updates are temporary disabled - 2025/03/19
+  # v3
+  # - package-ecosystem: "pip"
+  #   directory: "/"
+  #   schedule:
+  #     interval: "monthly"
+  #   open-pull-requests-limit: 10
+  #   target-branch: v3
+  #   labels:
+  #     - "dependencies"
+  #     - "pip"
+  #     - "v3"
+
+  # - package-ecosystem: "github-actions"
+  #   directory: "/"
+  #   schedule:
+  #     interval: "monthly"
+  #   open-pull-requests-limit: 10
+  #   target-branch: v3
+  #   labels:
+  #     - "dependencies"
+  #     - "github_actions"
+  #     - "v3"

.github/labeler.yml

@@ -77,11 +77,6 @@ provider/okta:
       - any-glob-to-any-file: "prowler/providers/okta/**"
       - any-glob-to-any-file: "tests/providers/okta/**"
 
-provider/linode:
-  - changed-files:
-      - any-glob-to-any-file: "prowler/providers/linode/**"
-      - any-glob-to-any-file: "tests/providers/linode/**"
-
 github_actions:
   - changed-files:
       - any-glob-to-any-file: ".github/workflows/*"

.github/pull_request_template.md

@@ -18,9 +18,8 @@ Please add a detailed description of how to review this PR.
 
 <summary><b>Community Checklist</b></summary>
 
-- [ ] This feature/issue is listed in the [open issues](https://github.com/prowler-cloud/prowler/issues?q=sort%3Aupdated-desc+is%3Aissue+is%3Aopen) or roadmap.prowler.com
-- [ ] Is it assigned to me, if not, request it via the [open issues](https://github.com/prowler-cloud/prowler/issues?q=sort%3Aupdated-desc+is%3Aissue+is%3Aopen) or [Prowler Community Slack](https://goto.prowler.com/slack)
-- [ ] I have reviewed the [open pull requests](https://github.com/prowler-cloud/prowler/pulls?q=sort%3Aupdated-desc+is%3Apr+is%3Aopen) and confirmed there is no existing PR that implements the same outcome
+- [ ] This feature/issue is listed in [here](https://github.com/prowler-cloud/prowler/issues?q=sort%3Aupdated-desc+is%3Aissue+is%3Aopen) or roadmap.prowler.com
+- [ ] Is it assigned to me, if not, request it via the issue/feature in [here](https://github.com/prowler-cloud/prowler/issues?q=sort%3Aupdated-desc+is%3Aissue+is%3Aopen) or [Prowler Community Slack](goto.prowler.com/slack)
 
 </details>
 
@@ -28,8 +27,8 @@ Please add a detailed description of how to review this PR.
 - [ ] Review if the code is being covered by tests.
 - [ ] Review if code is being documented following this specification https://github.com/google/styleguide/blob/gh-pages/pyguide.md#38-comments-and-docstrings
 - [ ] Review if backport is needed.
-- [ ] Review if is needed to change the [README.md](https://github.com/prowler-cloud/prowler/blob/master/README.md)
-- [ ] Ensure a changelog fragment is added under [prowler/changelog.d/](https://github.com/prowler-cloud/prowler/tree/master/prowler/changelog.d), if applicable.
+- [ ] Review if is needed to change the [Readme.md](https://github.com/prowler-cloud/prowler/blob/master/README.md)
+- [ ] Ensure new entries are added to [CHANGELOG.md](https://github.com/prowler-cloud/prowler/blob/master/prowler/CHANGELOG.md), if applicable.
 
 #### SDK/CLI
 - Are there new checks included in this PR? Yes / No
@@ -41,7 +40,7 @@ Please add a detailed description of how to review this PR.
 - [ ] Screenshots/Video of the functionality flow (if applicable) - Mobile (X < 640px)
 - [ ] Screenshots/Video of the functionality flow (if applicable) - Table (640px > X < 1024px)
 - [ ] Screenshots/Video of the functionality flow (if applicable) - Desktop (X > 1024px)
-- [ ] Ensure a changelog fragment is added under [ui/changelog.d/](https://github.com/prowler-cloud/prowler/tree/master/ui/changelog.d), if applicable.
+- [ ] Ensure new entries are added to [CHANGELOG.md](https://github.com/prowler-cloud/prowler/blob/master/ui/CHANGELOG.md), if applicable.
 
 #### API
 - [ ] All issue/task requirements work as expected on the API
@@ -51,11 +50,7 @@ Please add a detailed description of how to review this PR.
 - [ ] Any other relevant evidence of the implementation (if applicable)
 - [ ] Verify if API specs need to be regenerated.
 - [ ] Check if version updates are required (e.g., specs, uv, etc.).
-- [ ] Ensure a changelog fragment is added under [api/changelog.d/](https://github.com/prowler-cloud/prowler/tree/master/api/changelog.d), if applicable.
-
-#### MCP Server
-- [ ] All issue/task requirements work as expected on the MCP Server
-- [ ] Ensure a changelog fragment is added under [mcp_server/changelog.d/](https://github.com/prowler-cloud/prowler/tree/master/mcp_server/changelog.d), if applicable.
+- [ ] Ensure new entries are added to [CHANGELOG.md](https://github.com/prowler-cloud/prowler/blob/master/api/CHANGELOG.md), if applicable.
 
 ### License
 

.github/renovate.json

@@ -23,10 +23,6 @@
   "prConcurrentLimit": 20,
   "prHourlyLimit": 10,
   "vulnerabilityAlerts": {
-    "labels": [
-      "dependencies",
-      "security"
-    ],
     "prHourlyLimit": 0,
     "prConcurrentLimit": 0
   },
@@ -42,7 +38,7 @@
       "schedule": [
         "* 22-23,0-5 1 * *"
       ],
-      "enabled": true
+      "enabled": false
     },
     {
       "description": "Minors: 8th of every 3 months, Madrid overnight window (22:00-06:00)",
@@ -52,7 +48,7 @@
       "schedule": [
         "* 22-23,0-5 8 */3 *"
       ],
-      "enabled": true
+      "enabled": false
     },
     {
       "description": "Majors: 15th of every 3 months, Madrid overnight window",
@@ -62,13 +58,6 @@
       "schedule": [
         "* 22-23,0-5 15 */3 *"
       ],
-      "enabled": true
-    },
-    {
-      "description": "gh-aw compiled lock files - generated by 'gh aw compile', action pins must match the compiler version, never bump directly",
-      "matchFileNames": [
-        ".github/workflows/*.lock.yml"
-      ],
       "enabled": false
     },
     {

.github/scripts/changelog_attribution.py

@@ -1,154 +0,0 @@
-#!/usr/bin/env python3
-"""Rename changelog fragments to their PR number before running towncrier.
-
-For every <slug>.<type>.md in <component_dir>/changelog.d/, find the commit that
-added it, resolve its PR via the GitHub API (falling back to the squash-commit
-subject), and `git mv` it to <PR>.<type>.md so towncrier renders the PR link.
-Unresolvable fragments become +<slug>.<type>.md orphans (rendered without link).
-"""
-
-import argparse
-import json
-import os
-import re
-import subprocess
-import sys
-import urllib.error
-import urllib.request
-
-FRAGMENT_RE = re.compile(
-    r"^(?P<slug>[A-Za-z0-9][A-Za-z0-9._-]*?)"
-    r"\.(?P<type>added|changed|deprecated|removed|fixed|security)"
-    r"(?:\.(?P<counter>[0-9]+))?\.md$"
-)
-SUBJECT_PR_RE = re.compile(r" \(#([0-9]+)\)$")
-IGNORED_FILES = {".gitkeep", "README.md"}
-API_TIMEOUT_SECONDS = 10
-
-
-def git(*args: str) -> str:
-    result = subprocess.run(["git", *args], check=True, capture_output=True, text=True)
-    return result.stdout.strip()
-
-
-def find_adding_commit(path: str) -> str | None:
-    """Find the commit that added a file, following renames.
-
-    Falls back to a plain (no --follow) lookup: rename detection can lose the
-    add event for degenerate content (e.g. files identical to many others).
-    """
-    sha = git("log", "--follow", "--diff-filter=A", "--format=%H", "-1", "--", path)
-    if not sha:
-        sha = git("log", "--diff-filter=A", "--format=%H", "-1", "--", path)
-    return sha or None
-
-
-def pr_from_api(repo: str, sha: str) -> int | None:
-    """Resolve the PR associated with a commit via the GitHub API.
-
-    Returns None on any network/API failure so the caller can fall back to
-    parsing the squash-commit subject.
-    """
-    url = f"https://api.github.com/repos/{repo}/commits/{sha}/pulls"
-    headers = {
-        "Accept": "application/vnd.github+json",
-        "X-GitHub-Api-Version": "2022-11-28",
-        "User-Agent": "prowler-changelog-attribution",
-    }
-    token = os.environ.get("GITHUB_TOKEN")
-    if token:
-        headers["Authorization"] = f"Bearer {token}"
-    request = urllib.request.Request(url, headers=headers)
-    try:
-        with urllib.request.urlopen(request, timeout=API_TIMEOUT_SECONDS) as response:
-            pulls = json.load(response)
-    except (urllib.error.URLError, TimeoutError, json.JSONDecodeError):
-        return None
-    if isinstance(pulls, list) and pulls:
-        return pulls[0].get("number")
-    return None
-
-
-def pr_from_subject(sha: str) -> int | None:
-    subject = git("log", "-1", "--format=%s", sha)
-    match = SUBJECT_PR_RE.search(subject)
-    return int(match.group(1)) if match else None
-
-
-def unique_destination(directory: str, base_name: str, fragment_type: str) -> str:
-    """Return a non-colliding fragment path, appending a numeric counter if needed."""
-    candidate = os.path.join(directory, f"{base_name}.{fragment_type}.md")
-    counter = 0
-    while os.path.exists(candidate):
-        counter += 1
-        candidate = os.path.join(directory, f"{base_name}.{fragment_type}.{counter}.md")
-    return candidate
-
-
-def main() -> int:
-    parser = argparse.ArgumentParser(description=__doc__)
-    parser.add_argument("component_dir", help="Component directory, e.g. prowler")
-    parser.add_argument("--repo", default="prowler-cloud/prowler")
-    parser.add_argument(
-        "--no-api",
-        action="store_true",
-        help="Skip the GitHub API and resolve PRs from commit subjects only",
-    )
-    args = parser.parse_args()
-
-    fragments_dir = os.path.join(args.component_dir, "changelog.d")
-    if not os.path.isdir(fragments_dir):
-        print(f"::error::Fragments directory not found: {fragments_dir}")
-        return 1
-
-    malformed = []
-    to_process = []
-    for name in sorted(os.listdir(fragments_dir)):
-        if name in IGNORED_FILES or name.startswith("+"):
-            continue
-        match = FRAGMENT_RE.match(name)
-        if not match:
-            malformed.append(name)
-            continue
-        if match.group("slug").isdigit():
-            continue
-        to_process.append((name, match))
-
-    if malformed:
-        for name in malformed:
-            print(
-                f"::error::Malformed fragment filename in {fragments_dir}: {name} "
-                "(expected <slug>.<type>.md with type one of added|changed|"
-                "deprecated|removed|fixed|security)"
-            )
-        return 1
-
-    for name, match in to_process:
-        slug, fragment_type = match.group("slug"), match.group("type")
-
-        path = os.path.join(fragments_dir, name)
-        sha = find_adding_commit(path)
-        pr_number = None
-        if sha:
-            if not args.no_api:
-                pr_number = pr_from_api(args.repo, sha)
-            if pr_number is None:
-                pr_number = pr_from_subject(sha)
-
-        if pr_number is not None:
-            destination = unique_destination(
-                fragments_dir, str(pr_number), fragment_type
-            )
-        else:
-            destination = unique_destination(fragments_dir, f"+{slug}", fragment_type)
-            print(
-                f"::warning::Could not resolve a PR for {path}; renamed to "
-                f"{os.path.basename(destination)} (entry will render without a PR link)"
-            )
-        git("mv", path, destination)
-        print(f"{path} -> {destination}")
-    return 0
-
-
-if __name__ == "__main__":
-    sys.exit(main())

.github/scripts/grype-pr-comment.js

@@ -1,100 +0,0 @@
-const fs = require('fs');
-
-// Configuration from environment variables
-const REPORT_FILE = process.env.GRYPE_REPORT_FILE || 'grype-report.json';
-const IMAGE_NAME = process.env.IMAGE_NAME || 'container-image';
-const GITHUB_SHA = process.env.GITHUB_SHA || 'unknown';
-const GITHUB_REPOSITORY = process.env.GITHUB_REPOSITORY || '';
-const GITHUB_RUN_ID = process.env.GITHUB_RUN_ID || '';
-const CUTOFF = process.env.CUTOFF || 'high';
-
-// A cutoff of 'critical' blocks only on critical; anything else blocks on high and above
-const blocking = CUTOFF === 'critical' ? ['Critical'] : ['Critical', 'High'];
-
-const report = JSON.parse(fs.readFileSync(REPORT_FILE, 'utf-8'));
-const matches = Array.isArray(report.matches) ? report.matches : [];
-const ignored = Array.isArray(report.ignoredMatches) ? report.ignoredMatches : [];
-
-const counts = { Critical: 0, High: 0, Medium: 0, Low: 0, Negligible: 0, Unknown: 0 };
-const blockers = new Map();
-
-for (const match of matches) {
-    const severity = match.vulnerability.severity;
-    if (counts[severity] !== undefined) {
-        counts[severity]++;
-    }
-    if (blocking.includes(severity)) {
-        const artifact = match.artifact;
-        const fixedIn = (match.vulnerability.fix && match.vulnerability.fix.versions || []).join(', ');
-        // Same CVE can match several install paths of one package; collapse them
-        blockers.set(`${match.vulnerability.id}|${artifact.name}`, {
-            id: match.vulnerability.id,
-            severity,
-            name: artifact.name,
-            version: artifact.version,
-            fixedIn
-        });
-    }
-}
-
-const ignoredBlocking = ignored.filter(m => blocking.includes(m.vulnerability.severity)).length;
-const shortSha = GITHUB_SHA.substring(0, 7);
-const timestamp = new Date().toISOString().replace('T', ' ').substring(0, 19) + ' UTC';
-
-const severityConfig = {
-    Critical: { icon: '🔴', label: 'Critical' },
-    High: { icon: '🟠', label: 'High' },
-    Medium: { icon: '🟡', label: 'Medium' },
-    Low: { icon: '🔵', label: 'Low' }
-};
-
-let comment = '## 🔎 Container Security Scan (Grype)\n\n';
-comment += `**Image:** \`${IMAGE_NAME}:${shortSha}\`\n`;
-comment += `**Last scan:** ${timestamp}\n\n`;
-
-if (blockers.size === 0) {
-    comment += '### ✅ Nothing Blocking\n\n';
-    comment += `No findings at **${blocking.join(' or ').toLowerCase()}** severity.\n`;
-} else {
-    comment += `### ⚠️ ${blockers.size} Finding(s) Blocking This PR\n\n`;
-    comment += '| Severity | CVE | Package | Installed | Fixed in |\n';
-    comment += '|---|---|---|---|---|\n';
-
-    const order = { Critical: 0, High: 1 };
-    const rows = [...blockers.values()].sort((a, b) =>
-        (order[a.severity] - order[b.severity]) || a.name.localeCompare(b.name));
-
-    for (const row of rows) {
-        const config = severityConfig[row.severity];
-        comment += `| ${config.icon} ${config.label} | \`${row.id}\` | \`${row.name}\` | ${row.version} | ${row.fixedIn || '—'} |\n`;
-    }
-
-    comment += '\n**What to do:**\n';
-    comment += '- Upgrade the package to the version in the "Fixed in" column.\n';
-    comment += '- If it is pinned by another dependency, or the fix is otherwise out of reach, add it to `.grype.yaml` **with the reason**.\n';
-    comment += '- Findings with no published fix never appear here: the scan runs with `only-fixed`, so it reports only what can actually be acted on.\n';
-}
-
-const otherCounts = Object.entries(counts)
-    .filter(([severity, count]) => !blocking.includes(severity) && count > 0)
-    .map(([severity, count]) => `${severity.toLowerCase()}: ${count}`);
-
-if (otherCounts.length > 0) {
-    comment += `\nNot blocking at this cutoff — ${otherCounts.join(', ')}.\n`;
-}
-
-if (ignoredBlocking > 0) {
-    comment += `\n${ignoredBlocking} finding(s) excluded by \`.grype.yaml\`, each with a documented reason.\n`;
-}
-
-comment += '\n---\n';
-comment += '📋 **Resources:**\n';
-
-if (GITHUB_REPOSITORY && GITHUB_RUN_ID) {
-    comment += `- [Download full report](https://github.com/${GITHUB_REPOSITORY}/actions/runs/${GITHUB_RUN_ID}) (see artifacts)\n`;
-}
-
-comment += '- [View in Security tab](https://github.com/' + (GITHUB_REPOSITORY || 'repository') + '/security/code-scanning)\n';
-comment += '- Scanned with [Grype](https://github.com/anchore/grype), alongside Trivy\n';
-
-module.exports = comment;

.github/scripts/osv-scan.sh

@@ -6,7 +6,8 @@
 #   - .github/workflows/api-security.yml, sdk-security.yml, ui-security.yml
 #
 # Severity levels (comma-separated) are read from OSV_SEVERITY_LEVELS.
-# Default: CRITICAL — only CVSS >= 9.0 findings fail the scan.
+# Default: HIGH,CRITICAL,UNKNOWN — preserves prior .safety-policy.yml policy
+#   (ignore-cvss-severity-below: 7 + ignore-cvss-unknown-severity: False).
 # osv-scanner has no native CVSS threshold (google/osv-scanner#1400, closed
 # not-planned). Severity is derived from $group.max_severity (numeric CVSS
 # score string) which osv-scanner emits per group.
@@ -32,7 +33,7 @@ set -euo pipefail
 
 ROOT="$(git rev-parse --show-toplevel)"
 CONFIG="${ROOT}/osv-scanner.toml"
-SEVERITY_LEVELS="${OSV_SEVERITY_LEVELS:-CRITICAL}"
+SEVERITY_LEVELS="${OSV_SEVERITY_LEVELS:-HIGH,CRITICAL,UNKNOWN}"
 
 for bin in osv-scanner jq; do
   if ! command -v "${bin}" >/dev/null 2>&1; then
@@ -51,8 +52,7 @@ STDERR="$(mktemp)"
 trap 'rm -f "${STDERR}"' EXIT
 
 set +e
-# ${a[@]+...} guard: an empty array trips `set -u` on bash before 4.4.
-OUTPUT="$(osv-scanner scan source ${SCAN_ARGS[@]+"${SCAN_ARGS[@]}"} --format=json "$@" 2>"${STDERR}")"
+OUTPUT="$(osv-scanner scan source "${SCAN_ARGS[@]}" --format=json "$@" 2>"${STDERR}")"
 RC=$?
 set -e
 
@@ -101,8 +101,6 @@ FINDINGS="$(printf '%s' "${OUTPUT}" | jq --argjson sevs "${SEVERITY_JSON}" '
   ]
 ')"
 
-# jq exits 0 with no output on empty stdin, but non-zero on malformed JSON.
-# Let the failure abort under set -e rather than reporting zero findings.
 COUNT="$(printf '%s' "${FINDINGS}" | jq 'length')"
 
 # Write the findings JSON to OSV_REPORT_FILE so callers (e.g. the composite
@@ -111,7 +109,7 @@ if [ -n "${OSV_REPORT_FILE:-}" ]; then
   printf '%s' "${FINDINGS}" > "${OSV_REPORT_FILE}"
 fi
 
-if [ "${COUNT:-0}" -gt 0 ]; then
+if [ "${COUNT}" -gt 0 ]; then
   echo "osv-scanner: ${COUNT} finding(s) at severity ${SEVERITY_LEVELS}"
   printf '%s' "${FINDINGS}" | jq -r '
     .[] | "  [\(.severity)\(if .score then " \(.score)" else "" end)] \(.id) \(.ecosystem)/\(.package)@\(.version) — \(.summary // "(no summary)")"

.github/test-impact.yml

@@ -249,7 +249,6 @@ modules:
       - ui/tests/profile/**
       - ui/tests/lighthouse/**
       - ui/tests/home/**
-      - ui/tests/navigation/**
       - ui/tests/attack-paths/**
 
   - name: api-serializers
@@ -276,7 +275,6 @@ modules:
       - ui/tests/profile/**
       - ui/tests/lighthouse/**
       - ui/tests/home/**
-      - ui/tests/navigation/**
       - ui/tests/attack-paths/**
 
   - name: api-filters
@@ -434,14 +432,6 @@ modules:
     e2e:
       - ui/tests/lighthouse/**
 
-  - name: ui-navigation
-    match:
-      - ui/components/layout/**
-      - ui/tests/navigation/**
-    tests: []
-    e2e:
-      - ui/tests/navigation/**
-
   - name: ui-overview
     match:
       - ui/components/overview/**
@@ -474,7 +464,6 @@ modules:
       - ui/tests/profile/**
       - ui/tests/lighthouse/**
       - ui/tests/home/**
-      - ui/tests/navigation/**
       - ui/tests/attack-paths/**
 
   - name: ui-attack-paths

.github/towncrier/template.md.jinja

@@ -1,13 +0,0 @@
-{% set category_order = definitions.keys() %}
-{% for section, _ in sections.items() %}
-{% for category in category_order if category in sections[section] %}
-### {{ definitions[category]['name'] }}
-
-{% for text, values in sections[section][category].items() -%}
-- {{ text }}{% if values %} {{ values|join(', ') }}{% endif %}{{ "\n" }}
-{%- endfor %}
-
-{% endfor %}
-{% endfor %}
----
-{{ "\n" }}

.github/workflows/api-code-quality.yml

@@ -35,7 +35,7 @@ jobs:
 
     steps:
       - name: Harden Runner
-        uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0
+        uses: step-security/harden-runner@ab7a9404c0f3da075243ca237b5fac12c98deaa5 # v2.19.3
         with:
           egress-policy: block
           allowed-endpoints: >
@@ -62,7 +62,6 @@ jobs:
             api/docs/**
             api/README.md
             api/CHANGELOG.md
-            api/changelog.d/**
             api/AGENTS.md
 
       - name: Setup Python with uv

.github/workflows/api-codeql.yml

@@ -9,7 +9,6 @@ on:
       - 'api/**'
       - '.github/workflows/api-codeql.yml'
       - '.github/codeql/api-codeql-config.yml'
-      - '!api/CHANGELOG.md'
   pull_request:
     branches:
       - 'master'
@@ -18,7 +17,6 @@ on:
       - 'api/**'
       - '.github/workflows/api-codeql.yml'
       - '.github/codeql/api-codeql-config.yml'
-      - '!api/CHANGELOG.md'
   schedule:
     - cron: '00 12 * * *'
 
@@ -46,7 +44,7 @@ jobs:
 
     steps:
       - name: Harden Runner
-        uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0
+        uses: step-security/harden-runner@ab7a9404c0f3da075243ca237b5fac12c98deaa5 # v2.19.3
         with:
           egress-policy: block
           allowed-endpoints: >

.github/workflows/api-container-build-push.yml

@@ -42,20 +42,17 @@ jobs:
     timeout-minutes: 5
     outputs:
       short-sha: ${{ steps.set-short-sha.outputs.short-sha }}
-      created: ${{ steps.set-short-sha.outputs.created }}
     permissions:
       contents: read
     steps:
       - name: Harden Runner
-        uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0
+        uses: step-security/harden-runner@ab7a9404c0f3da075243ca237b5fac12c98deaa5 # v2.19.3
         with:
           egress-policy: block
 
       - name: Calculate short SHA
         id: set-short-sha
-        run: |
-          echo "short-sha=${GITHUB_SHA::7}" >> "${GITHUB_OUTPUT}"
-          echo "created=$(date -u +%Y-%m-%dT%H:%M:%SZ)" >> "${GITHUB_OUTPUT}"
+        run: echo "short-sha=${GITHUB_SHA::7}" >> $GITHUB_OUTPUT
 
   notify-release-started:
     if: github.repository == 'prowler-cloud/prowler' && (github.event_name == 'release' || github.event_name == 'workflow_dispatch')
@@ -68,7 +65,7 @@ jobs:
       contents: read
     steps:
       - name: Harden the runner (Audit all outbound calls)
-        uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0
+        uses: step-security/harden-runner@ab7a9404c0f3da075243ca237b5fac12c98deaa5 # v2.19.3
         with:
           egress-policy: audit
 
@@ -111,7 +108,7 @@ jobs:
 
     steps:
       - name: Harden Runner
-        uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0
+        uses: step-security/harden-runner@ab7a9404c0f3da075243ca237b5fac12c98deaa5 # v2.19.3
         with:
           egress-policy: block
           allowed-endpoints: >
@@ -162,20 +159,9 @@ jobs:
         with:
           context: ${{ env.WORKING_DIRECTORY }}
           push: true
-          sbom: true
-          # max, not the default min: min records little beyond the build ref.
-          provenance: mode=max
           platforms: ${{ matrix.platform }}
           tags: |
             ${{ env.PROWLERCLOUD_DOCKERHUB_REPOSITORY }}/${{ env.PROWLERCLOUD_DOCKERHUB_IMAGE }}:${{ needs.setup.outputs.short-sha }}-${{ matrix.arch }}
-          labels: |
-            org.opencontainers.image.title=Prowler Local Server API
-            org.opencontainers.image.description=API for Prowler Local Server (Django/DRF)
-            org.opencontainers.image.vendor=ProwlerPro, Inc.
-            org.opencontainers.image.source=https://github.com/${{ github.repository }}
-            org.opencontainers.image.revision=${{ github.sha }}
-            org.opencontainers.image.created=${{ needs.setup.outputs.created }}
-            ${{ (github.event_name == 'release' || github.event_name == 'workflow_dispatch') && format('org.opencontainers.image.version={0}', env.RELEASE_TAG) || '' }}
           cache-from: type=gha,scope=${{ matrix.arch }}
           cache-to: type=gha,mode=${{ github.event_name == 'pull_request' && 'min' || 'max' }},scope=${{ matrix.arch }}
 
@@ -189,16 +175,16 @@ jobs:
 
     steps:
       - name: Harden Runner
-        uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0
+        uses: step-security/harden-runner@ab7a9404c0f3da075243ca237b5fac12c98deaa5 # v2.19.3
         with:
           egress-policy: block
           allowed-endpoints: >
-            auth.docker.io:443
             github.com:443
+            release-assets.githubusercontent.com:443
+            registry-1.docker.io:443
+            auth.docker.io:443
             production.cloudflare.docker.com:443
             production.cloudfront.docker.com:443
-            registry-1.docker.io:443
-            release-assets.githubusercontent.com:443
       - name: Login to DockerHub
         uses: docker/login-action@4907a6ddec9925e35a0a9e82d7399ccc52663121 # v4.1.0
         with:
@@ -210,9 +196,9 @@ jobs:
         run: |
           docker buildx imagetools create \
             -t ${{ env.PROWLERCLOUD_DOCKERHUB_REPOSITORY }}/${{ env.PROWLERCLOUD_DOCKERHUB_IMAGE }}:${{ env.LATEST_TAG }} \
-            -t "${{ env.PROWLERCLOUD_DOCKERHUB_REPOSITORY }}/${{ env.PROWLERCLOUD_DOCKERHUB_IMAGE }}:${NEEDS_SETUP_OUTPUTS_SHORT_SHA}" \
-            "${{ env.PROWLERCLOUD_DOCKERHUB_REPOSITORY }}/${{ env.PROWLERCLOUD_DOCKERHUB_IMAGE }}:${NEEDS_SETUP_OUTPUTS_SHORT_SHA}-amd64" \
-            "${{ env.PROWLERCLOUD_DOCKERHUB_REPOSITORY }}/${{ env.PROWLERCLOUD_DOCKERHUB_IMAGE }}:${NEEDS_SETUP_OUTPUTS_SHORT_SHA}-arm64"
+            -t ${{ env.PROWLERCLOUD_DOCKERHUB_REPOSITORY }}/${{ env.PROWLERCLOUD_DOCKERHUB_IMAGE }}:${NEEDS_SETUP_OUTPUTS_SHORT_SHA} \
+            ${{ env.PROWLERCLOUD_DOCKERHUB_REPOSITORY }}/${{ env.PROWLERCLOUD_DOCKERHUB_IMAGE }}:${NEEDS_SETUP_OUTPUTS_SHORT_SHA}-amd64 \
+            ${{ env.PROWLERCLOUD_DOCKERHUB_REPOSITORY }}/${{ env.PROWLERCLOUD_DOCKERHUB_IMAGE }}:${NEEDS_SETUP_OUTPUTS_SHORT_SHA}-arm64
         env:
           NEEDS_SETUP_OUTPUTS_SHORT_SHA: ${{ needs.setup.outputs.short-sha }}
 
@@ -220,16 +206,16 @@ jobs:
         if: github.event_name == 'release' || github.event_name == 'workflow_dispatch'
         run: |
           docker buildx imagetools create \
-            -t "${{ env.PROWLERCLOUD_DOCKERHUB_REPOSITORY }}/${{ env.PROWLERCLOUD_DOCKERHUB_IMAGE }}:${RELEASE_TAG}" \
+            -t ${{ env.PROWLERCLOUD_DOCKERHUB_REPOSITORY }}/${{ env.PROWLERCLOUD_DOCKERHUB_IMAGE }}:${RELEASE_TAG} \
             -t ${{ env.PROWLERCLOUD_DOCKERHUB_REPOSITORY }}/${{ env.PROWLERCLOUD_DOCKERHUB_IMAGE }}:${{ env.STABLE_TAG }} \
-            "${{ env.PROWLERCLOUD_DOCKERHUB_REPOSITORY }}/${{ env.PROWLERCLOUD_DOCKERHUB_IMAGE }}:${NEEDS_SETUP_OUTPUTS_SHORT_SHA}-amd64" \
-            "${{ env.PROWLERCLOUD_DOCKERHUB_REPOSITORY }}/${{ env.PROWLERCLOUD_DOCKERHUB_IMAGE }}:${NEEDS_SETUP_OUTPUTS_SHORT_SHA}-arm64"
+            ${{ env.PROWLERCLOUD_DOCKERHUB_REPOSITORY }}/${{ env.PROWLERCLOUD_DOCKERHUB_IMAGE }}:${NEEDS_SETUP_OUTPUTS_SHORT_SHA}-amd64 \
+            ${{ env.PROWLERCLOUD_DOCKERHUB_REPOSITORY }}/${{ env.PROWLERCLOUD_DOCKERHUB_IMAGE }}:${NEEDS_SETUP_OUTPUTS_SHORT_SHA}-arm64
         env:
           NEEDS_SETUP_OUTPUTS_SHORT_SHA: ${{ needs.setup.outputs.short-sha }}
 
       - name: Install regctl
         if: always()
-        uses: regclient/actions/regctl-installer@9a2d4216180dbb3e2dccfa60d2dd4afd98e42ec5 # main
+        uses: regclient/actions/regctl-installer@da9319db8e44e8b062b3a147e1dfb2f574d41a03 # main
 
       - name: Cleanup intermediate architecture tags
         if: always()
@@ -250,7 +236,7 @@ jobs:
       contents: read
     steps:
       - name: Harden the runner (Audit all outbound calls)
-        uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0
+        uses: step-security/harden-runner@ab7a9404c0f3da075243ca237b5fac12c98deaa5 # v2.19.3
         with:
           egress-policy: audit
 
@@ -263,9 +249,9 @@ jobs:
         id: outcome
         run: |
           if [[ "${NEEDS_CONTAINER_BUILD_PUSH_RESULT}" == "success" && "${NEEDS_CREATE_MANIFEST_RESULT}" == "success" ]]; then
-            echo "outcome=success" >> "$GITHUB_OUTPUT"
+            echo "outcome=success" >> $GITHUB_OUTPUT
           else
-            echo "outcome=failure" >> "$GITHUB_OUTPUT"
+            echo "outcome=failure" >> $GITHUB_OUTPUT
           fi
         env:
           NEEDS_CONTAINER_BUILD_PUSH_RESULT: ${{ needs.container-build-push.result }}
@@ -286,3 +272,27 @@ jobs:
           payload-file-path: "./.github/scripts/slack-messages/container-release-completed.json"
           step-outcome: ${{ steps.outcome.outputs.outcome }}
           update-ts: ${{ needs.notify-release-started.outputs.message-ts }}
+
+  trigger-deployment:
+    needs: [setup, container-build-push]
+    if: always() && github.event_name == 'push' && needs.setup.result == 'success' && needs.container-build-push.result == 'success'
+    runs-on: ubuntu-latest
+    timeout-minutes: 5
+    permissions:
+      contents: read
+
+    steps:
+      - name: Harden Runner
+        uses: step-security/harden-runner@ab7a9404c0f3da075243ca237b5fac12c98deaa5 # v2.19.3
+        with:
+          egress-policy: block
+          allowed-endpoints: >
+            api.github.com:443
+
+      - name: Trigger API deployment
+        uses: peter-evans/repository-dispatch@28959ce8df70de7be546dd1250a005dd32156697 # v4.0.1
+        with:
+          token: ${{ secrets.PROWLER_BOT_ACCESS_TOKEN }}
+          repository: ${{ secrets.CLOUD_DISPATCH }}
+          event-type: api-prowler-deployment
+          client-payload: '{"sha": "${{ github.sha }}", "short_sha": "${{ needs.setup.outputs.short-sha }}"}'

.github/workflows/api-container-checks.yml

@@ -12,6 +12,9 @@ on:
     branches:
       - 'master'
       - 'v5.*'
+    paths:
+      - 'api/**'
+      - '.github/workflows/api-container-checks.yml'
 
 concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}
@@ -33,7 +36,7 @@ jobs:
 
     steps:
       - name: Harden Runner
-        uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0
+        uses: step-security/harden-runner@ab7a9404c0f3da075243ca237b5fac12c98deaa5 # v2.19.3
         with:
           egress-policy: block
           allowed-endpoints: >
@@ -69,7 +72,7 @@ jobs:
 
     steps:
       - name: Harden Runner
-        uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0
+        uses: step-security/harden-runner@ab7a9404c0f3da075243ca237b5fac12c98deaa5 # v2.19.3
         with:
           egress-policy: block
           allowed-endpoints: >
@@ -81,10 +84,6 @@ jobs:
             auth.docker.io:443
             production.cloudflare.docker.com:443
             production.cloudfront.docker.com:443
-            raw.githubusercontent.com:443
-            objects.githubusercontent.com:443
-            grype.anchore.io:443
-            get.anchore.io:443
             debian.map.fastlydns.net:80
             release-assets.githubusercontent.com:443
             objects.githubusercontent.com:443
@@ -96,8 +95,6 @@ jobs:
             _http._tcp.deb.debian.org:443
             powershellinfraartifacts-gkhedzdeaghdezhr.z01.azurefd.net:443
             get.trivy.dev:443
-            raw.githubusercontent.com:443
-            releases.astral.sh:443
 
       - name: Checkout repository
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
@@ -109,29 +106,13 @@ jobs:
         id: check-changes
         uses: tj-actions/changed-files@9426d40962ed5378910ee2e21d5f8c6fcbf2dd96 # v47.0.6
         with:
-          files: |
-            api/**
-            .trivyignore.yaml
-            .github/actions/trivy-scan/**
-            .github/actions/grype-scan/**
-            .grype.yaml
-            .github/scripts/grype-pr-comment.js
+          files: api/**
           files_ignore: |
             api/docs/**
             api/README.md
             api/CHANGELOG.md
-            api/changelog.d/**
             api/AGENTS.md
 
-      # api-container-build-push.yml resolves the SDK pin to the branch tip
-      # before building, so match it here and scan what ships. Push only: PRs
-      # stay deterministic against the committed lock.
-      - name: Refresh prowler SDK pin to current branch tip
-        if: steps.check-changes.outputs.any_changed == 'true' && github.event_name == 'push'
-        run: |
-          pip install --no-cache-dir "uv==0.11.14"
-          (cd api && uv lock --upgrade-package prowler)
-
       - name: Set up Docker Buildx
         if: steps.check-changes.outputs.any_changed == 'true'
         uses: docker/setup-buildx-action@4d04d5d9486b7bd6fa91e7baf45bbb4f8b9deedd # v4.0.0
@@ -153,13 +134,5 @@ jobs:
         with:
           image-name: ${{ env.IMAGE_NAME }}
           image-tag: ${{ github.sha }}
-          fail-on-severity: 'high'
-          severity: 'CRITICAL,HIGH'
-
-      - name: Scan container with Grype
-        if: steps.check-changes.outputs.any_changed == 'true'
-        uses: ./.github/actions/grype-scan
-        with:
-          image-name: ${{ env.IMAGE_NAME }}
-          image-tag: ${{ github.sha }}
-          fail-on-severity: 'high'
+          fail-on-critical: 'false'
+          severity: 'CRITICAL'

.github/workflows/api-security.yml

@@ -16,6 +16,13 @@ on:
     branches:
       - "master"
       - "v5.*"
+    paths:
+      - 'api/**'
+      - '.github/workflows/api-tests.yml'
+      - '.github/workflows/api-security.yml'
+      - '.github/actions/setup-python-uv/**'
+      - '.github/actions/osv-scanner/**'
+      - '.github/scripts/osv-scan.sh'
 
 concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}
@@ -43,7 +50,7 @@ jobs:
 
     steps:
       - name: Harden Runner
-        uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0
+        uses: step-security/harden-runner@ab7a9404c0f3da075243ca237b5fac12c98deaa5 # v2.19.3
         with:
           egress-policy: block
           allowed-endpoints: >
@@ -77,7 +84,6 @@ jobs:
             api/docs/**
             api/README.md
             api/CHANGELOG.md
-            api/changelog.d/**
             api/AGENTS.md
 
       - name: Setup Python with uv

.github/workflows/api-tests.yml

@@ -48,7 +48,7 @@ jobs:
 
     services:
       postgres:
-        image: postgres:17@sha256:5c855ad7b85e68e48a62f34662853f38b57c1c1d80f3a927ab58034fd6d31c5e
+        image: postgres:17@sha256:2cd82735a36356842d5eb1ef80db3ae8f1154172f0f653db48fde079b2a0b7f7
         env:
           POSTGRES_HOST: ${{ env.POSTGRES_HOST }}
           POSTGRES_PORT: ${{ env.POSTGRES_PORT }}
@@ -63,7 +63,7 @@ jobs:
           --health-timeout 5s
           --health-retries 5
       valkey:
-        image: valkey/valkey:7-alpine3.19@sha256:4054fe7fc607b9326ac7c4691ed26e9670d2ff17a9fb28c2577adecf928acbcc
+        image: valkey/valkey:7-alpine3.19
         env:
           VALKEY_HOST: ${{ env.VALKEY_HOST }}
           VALKEY_PORT: ${{ env.VALKEY_PORT }}
@@ -78,7 +78,7 @@ jobs:
 
     steps:
       - name: Harden Runner
-        uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0
+        uses: step-security/harden-runner@ab7a9404c0f3da075243ca237b5fac12c98deaa5 # v2.19.3
         with:
           egress-policy: block
           allowed-endpoints: >
@@ -107,12 +107,10 @@ jobs:
           files: |
             api/**
             .github/workflows/api-tests.yml
-            codecov.yml
           files_ignore: |
             api/docs/**
             api/README.md
             api/CHANGELOG.md
-            api/changelog.d/**
             api/AGENTS.md
 
       - name: Setup Python with uv

.github/workflows/backport.yml

@@ -30,7 +30,7 @@ jobs:
 
     steps:
       - name: Harden Runner
-        uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0
+        uses: step-security/harden-runner@ab7a9404c0f3da075243ca237b5fac12c98deaa5 # v2.19.3
         with:
           egress-policy: block
           allowed-endpoints: >

.github/workflows/bump-version.yml

@@ -29,7 +29,7 @@ jobs:
       patch_version: ${{ steps.detect.outputs.patch_version }}
     steps:
       - name: Harden the runner (Audit all outbound calls)
-        uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0
+        uses: step-security/harden-runner@ab7a9404c0f3da075243ca237b5fac12c98deaa5 # v2.19.3
         with:
           egress-policy: audit
 
@@ -75,7 +75,7 @@ jobs:
       pull-requests: write
     steps:
       - name: Harden the runner (Audit all outbound calls)
-        uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0
+        uses: step-security/harden-runner@ab7a9404c0f3da075243ca237b5fac12c98deaa5 # v2.19.3
         with:
           egress-policy: audit
 
@@ -202,7 +202,7 @@ jobs:
       pull-requests: write
     steps:
       - name: Harden the runner (Audit all outbound calls)
-        uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0
+        uses: step-security/harden-runner@ab7a9404c0f3da075243ca237b5fac12c98deaa5 # v2.19.3
         with:
           egress-policy: audit
 
@@ -307,7 +307,7 @@ jobs:
       pull-requests: write
     steps:
       - name: Harden the runner (Audit all outbound calls)
-        uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0
+        uses: step-security/harden-runner@ab7a9404c0f3da075243ca237b5fac12c98deaa5 # v2.19.3
         with:
           egress-policy: audit
 

.github/workflows/check-test-init-files.yml

@@ -1,35 +0,0 @@
-name: 'Tools: Check Test Init Files'
-
-on:
-  pull_request:
-    branches:
-      - 'master'
-      - 'v5.*'
-
-concurrency:
-  group: ${{ github.workflow }}-${{ github.ref }}
-  cancel-in-progress: true
-
-permissions: {}
-
-jobs:
-  check-test-init-files:
-    if: github.repository == 'prowler-cloud/prowler'
-    runs-on: ubuntu-latest
-    timeout-minutes: 10
-    permissions:
-      contents: read
-
-    steps:
-      - name: Harden the runner (Audit all outbound calls)
-        uses: step-security/harden-runner@fa2e9d605c4eeb9fcad4c99c224cee0c6c7f3594 # v2.16.0
-        with:
-          egress-policy: audit
-
-      - name: Checkout repository
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
-        with:
-          persist-credentials: false
-
-      - name: Check for __init__.py files in test directories
-        run: python3 scripts/check_test_init_files.py .

.github/workflows/ci-actionlint.yml

@@ -1,63 +0,0 @@
-name: 'CI: Actionlint'
-
-on:
-  push:
-    branches:
-      - 'master'
-  pull_request:
-    branches:
-      - 'master'
-  schedule:
-    - cron: '45 06 * * *'
-  workflow_dispatch:
-
-concurrency:
-  group: ${{ github.workflow }}-${{ github.ref }}
-  cancel-in-progress: true
-
-permissions: {}
-
-jobs:
-  actionlint:
-    if: github.repository == 'prowler-cloud/prowler'
-    name: GitHub Actions Schema Check
-    runs-on: ubuntu-latest
-    timeout-minutes: 10
-    permissions:
-      contents: read
-
-    steps:
-      - name: Harden Runner
-        uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0
-        with:
-          egress-policy: block
-          allowed-endpoints: >
-            github.com:443
-            api.github.com:443
-            auth.docker.io:443
-            registry-1.docker.io:443
-            production.cloudflare.docker.com:443
-            production.cloudfront.docker.com:443
-
-      - name: Checkout repository
-        uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
-        with:
-          # zizmor: ignore[artipacked]
-          persist-credentials: true # Required by tj-actions/changed-files to fetch PR branch
-
-      # Always runs so it always reports; the lint is skipped when nothing changed.
-      - name: Check for workflow changes
-        id: check-changes
-        uses: tj-actions/changed-files@9426d40962ed5378910ee2e21d5f8c6fcbf2dd96 # v47.0.6
-        with:
-          files: .github/**
-
-      # SC2129 is style only: it suggests grouping consecutive redirects.
-      - name: Run actionlint
-        if: steps.check-changes.outputs.any_changed == 'true'
-        env:
-          SHELLCHECK_OPTS: '-e SC2129'
-        run: |
-          docker run --rm -v "$PWD:/repo" --workdir /repo -e SHELLCHECK_OPTS \
-            rhysd/actionlint:1.7.12@sha256:b1934ee5f1c509618f2508e6eb47ee0d3520686341fec936f3b79331f9315667 \
-            -color

.github/workflows/ci-zizmor.yml

@@ -36,7 +36,7 @@ jobs:
 
     steps:
       - name: Harden Runner
-        uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0
+        uses: step-security/harden-runner@ab7a9404c0f3da075243ca237b5fac12c98deaa5 # v2.19.3
         with:
           egress-policy: block
           allowed-endpoints: >

.github/workflows/comment-label-update.yml

@@ -22,7 +22,7 @@ jobs:
 
     steps:
       - name: Harden the runner (Audit all outbound calls)
-        uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0
+        uses: step-security/harden-runner@ab7a9404c0f3da075243ca237b5fac12c98deaa5 # v2.19.3
         with:
           egress-policy: audit
 
@@ -32,7 +32,7 @@ jobs:
           ISSUE_NUMBER: ${{ github.event.issue.number }}
         run: |
           echo "Removing 'status/awaiting-response' label from #$ISSUE_NUMBER"
-          gh api "/repos/${{ github.repository }}/issues/$ISSUE_NUMBER/labels/status%2Fawaiting-response" \
+          gh api /repos/${{ github.repository }}/issues/$ISSUE_NUMBER/labels/status%2Fawaiting-response \
             -X DELETE
 
       - name: Add 'status/waiting-for-revision' label
@@ -41,6 +41,6 @@ jobs:
           ISSUE_NUMBER: ${{ github.event.issue.number }}
         run: |
           echo "Adding 'status/waiting-for-revision' label to #$ISSUE_NUMBER"
-          gh api "/repos/${{ github.repository }}/issues/$ISSUE_NUMBER/labels" \
+          gh api /repos/${{ github.repository }}/issues/$ISSUE_NUMBER/labels \
             -X POST \
             -f labels[]='status/waiting-for-revision'

.github/workflows/compile-changelogs.yml

@@ -1,527 +0,0 @@
-name: 'Tools: Compile Changelogs'
-
-run-name: 'Compile changelogs for Prowler ${{ inputs.prowler_version }}'
-
-on:
-  workflow_dispatch:
-    inputs:
-      prowler_version:
-        description: 'Prowler version being released (e.g., 5.31.0)'
-        required: true
-        type: string
-      target_branch:
-        description: 'Branch to compile on (master for minor releases, v5.X for patches)'
-        required: true
-        type: string
-      sdk_version:
-        description: 'SDK version override (empty = mirrors prowler_version; "skip" = hold this component back)'
-        required: false
-        type: string
-      api_version:
-        description: 'API version override (empty = auto-derive 1.<prowler_minor + 1>.<prowler_patch>; "skip" = hold back)'
-        required: false
-        type: string
-      ui_version:
-        description: 'UI version override (empty = auto-derive 1.<prowler_minor>.<prowler_patch>; "skip" = hold back)'
-        required: false
-        type: string
-      mcp_version:
-        description: 'MCP Server version override (empty = auto-derive from pending fragment types; "skip" = hold back)'
-        required: false
-        type: string
-
-concurrency:
-  group: ${{ github.workflow }}-${{ inputs.prowler_version }}
-  cancel-in-progress: false
-
-env:
-  PROWLER_VERSION: ${{ inputs.prowler_version }}
-  TARGET_BRANCH: ${{ inputs.target_branch }}
-  SDK_VERSION: ${{ inputs.sdk_version }}
-  API_VERSION: ${{ inputs.api_version }}
-  UI_VERSION: ${{ inputs.ui_version }}
-  MCP_VERSION: ${{ inputs.mcp_version }}
-
-permissions: {}
-
-jobs:
-  compile-changelogs:
-    if: github.event_name == 'workflow_dispatch' && github.repository == 'prowler-cloud/prowler'
-    runs-on: ubuntu-latest
-    timeout-minutes: 30
-    permissions:
-      contents: write
-      pull-requests: write
-    steps:
-      - name: Harden the runner (Block outbound calls)
-        uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0
-        with:
-          egress-policy: block
-          allowed-endpoints: >
-            api.github.com:443
-            github.com:443
-            objects.githubusercontent.com:443
-            pypi.org:443
-            files.pythonhosted.org:443
-
-      - name: Checkout repository
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
-        with:
-          ref: ${{ inputs.target_branch }}
-          fetch-depth: 0 # PR attribution resolves each fragment's adding commit from history
-          token: ${{ secrets.PROWLER_BOT_ACCESS_TOKEN }}
-          persist-credentials: false
-
-      - name: Set up Python
-        uses: actions/setup-python@e797f83bcb11b83ae66e0230d6156d7c80228e7c # v6.0.0
-        with:
-          python-version: '3.12'
-
-      - name: Install towncrier
-        run: pip install --no-cache-dir towncrier==25.8.0
-
-      - name: Configure Git
-        run: |
-          git config --global user.name 'prowler-bot'
-          git config --global user.email '179230569+prowler-bot@users.noreply.github.com'
-
-      - name: Validate version inputs
-        run: |
-          if [[ ! "$PROWLER_VERSION" =~ ^[0-9]+\.[0-9]+\.[0-9]+$ ]]; then
-            echo "::error::Invalid prowler_version syntax: '$PROWLER_VERSION' (must be N.N.N)"
-            exit 1
-          fi
-          if [ "$TARGET_BRANCH" != "master" ] && [[ ! "$TARGET_BRANCH" =~ ^v[0-9]+\.[0-9]+$ ]]; then
-            echo "::error::Invalid target_branch syntax: '$TARGET_BRANCH' (must be 'master' or vN.N, e.g. v5.31)"
-            exit 1
-          fi
-          IFS=. read -r prowler_major prowler_minor prowler_patch <<< "$PROWLER_VERSION"
-          prowler_major=$((10#$prowler_major))
-          prowler_minor=$((10#$prowler_minor))
-          prowler_patch=$((10#$prowler_patch))
-          if [ "$prowler_patch" -eq 0 ]; then
-            if [ "$TARGET_BRANCH" != "master" ]; then
-              echo "::error::target_branch must be 'master' for Prowler ${PROWLER_VERSION}; got '${TARGET_BRANCH}'"
-              exit 1
-            fi
-          else
-            expected_target_branch="v${prowler_major}.${prowler_minor}"
-            if [ "$TARGET_BRANCH" != "$expected_target_branch" ]; then
-              echo "::error::target_branch must be '${expected_target_branch}' for Prowler ${PROWLER_VERSION}; got '${TARGET_BRANCH}'"
-              exit 1
-            fi
-          fi
-          for pair in "sdk_version:$SDK_VERSION" "api_version:$API_VERSION" "ui_version:$UI_VERSION" "mcp_version:$MCP_VERSION"; do
-            input_name="${pair%%:*}"
-            input_value="${pair#*:}"
-            if [ -n "$input_value" ] && [ "$input_value" != "skip" ] && [[ ! "$input_value" =~ ^[0-9]+\.[0-9]+\.[0-9]+$ ]]; then
-              echo "::error::Invalid $input_name syntax: '$input_value' (must be N.N.N, empty for auto-derivation, or 'skip')"
-              exit 1
-            fi
-          done
-
-      - name: Compile changelogs
-        env:
-          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-        run: |
-          set -euo pipefail
-
-          component_input() {
-            case "$1" in
-              prowler) echo "$SDK_VERSION" ;;
-              api) echo "$API_VERSION" ;;
-              ui) echo "$UI_VERSION" ;;
-              mcp_server) echo "$MCP_VERSION" ;;
-            esac
-          }
-
-          version_key() {
-            local version="$1"
-            local major minor patch
-            IFS=. read -r major minor patch <<< "$version"
-            printf '%06d.%06d.%06d' "$((10#$major))" "$((10#$minor))" "$((10#$patch))"
-          }
-
-          pending_fragments() {
-            find "$1/changelog.d" -maxdepth 1 -type f ! -name '.gitkeep' ! -name 'README.md' | sort
-          }
-
-          # The component's last released version is the first stamped heading
-          # of its CHANGELOG.md, the same source prepare-release.yml greps.
-          latest_released_version() {
-            grep -m1 -E '^## \[v?[0-9]+\.[0-9]+\.[0-9]+\]' "$1/CHANGELOG.md" | sed -E 's/^## \[v?([0-9]+\.[0-9]+\.[0-9]+)\].*/\1/'
-          }
-
-          has_removed_fragments() {
-            echo "$1" | grep -qE '\.removed(\.[0-9]+)?\.md$'
-          }
-
-          # Resolve every component's effective version before compiling
-          # anything, so a wrong input cannot leave the tree half-compiled.
-          # Empty input = auto-derive (latest released version + semver bump
-          # from the pending fragment types). 'skip' = hold the component back.
-          errors=0
-          compiling=""
-          for component in prowler api ui mcp_server; do
-            input=$(component_input "$component")
-            fragments=$(pending_fragments "$component")
-
-            if [ "$input" = "skip" ]; then
-              if [ -n "$fragments" ]; then
-                echo "::warning::${component}: held back by request; these pending fragments stay for a future release:"
-                echo "$fragments"
-              fi
-              continue
-            fi
-            if [ -n "$input" ] && [ -z "$fragments" ]; then
-              echo "::error::${component}: version input '$input' provided but ${component}/changelog.d/ has no pending fragments (wrong input?)"
-              errors=1
-              continue
-            fi
-            if [ -z "$fragments" ]; then
-              continue
-            fi
-
-            removed_fragments=false
-            if has_removed_fragments "$fragments"; then
-              removed_fragments=true
-            fi
-            current=$(latest_released_version "$component")
-            if [ -z "$current" ]; then
-              echo "::error::${component}: could not read the latest released version from ${component}/CHANGELOG.md; restore the released heading before compiling"
-              errors=1
-              continue
-            fi
-
-            if [ -n "$input" ]; then
-              effective="$input"
-              mode="explicit"
-              current_key=$(version_key "$current")
-              effective_key=$(version_key "$effective")
-              if [[ "$effective_key" < "$current_key" || "$effective_key" == "$current_key" ]]; then
-                echo "::error::${component}: explicit version '${effective}' must be greater than the latest released version (${current})"
-                errors=1
-                continue
-              fi
-            else
-              if [ "$removed_fragments" = "true" ]; then
-                echo "::error::${component}: pending 'removed' fragments imply a major bump (breaking change); provide its version input explicitly"
-                errors=1
-                continue
-              fi
-              # SDK, UI, and API versions are deterministic mirrors of the
-              # Prowler version (the scheme bump-version.yml codifies): the SDK
-              # mirrors it directly, the UI tracks 1.<minor>.<patch>, and the
-              # API is the independent 1.<minor + 1>.<patch> stream. Only the
-              # MCP Server has its own cadence, derived from fragment types.
-              IFS=. read -r _ prowler_minor prowler_patch <<< "$PROWLER_VERSION"
-              prowler_minor=$((10#$prowler_minor))
-              prowler_patch=$((10#$prowler_patch))
-              case "$component" in
-                prowler) effective="$PROWLER_VERSION" ;;
-                ui) effective="1.${prowler_minor}.${prowler_patch}" ;;
-                api) effective="1.$((prowler_minor + 1)).${prowler_patch}" ;;
-                mcp_server)
-                  IFS=. read -r major minor patch <<< "$current"
-                  major=$((10#$major))
-                  minor=$((10#$minor))
-                  patch=$((10#$patch))
-                  # Prowler patch releases (vN.N target) are maintenance
-                  # releases, so the MCP Server bumps patch regardless of
-                  # fragment types; a deliberate exception needs the explicit
-                  # version input.
-                  if [ "$TARGET_BRANCH" != "master" ]; then
-                    effective="${major}.${minor}.$((patch + 1))"
-                    if echo "$fragments" | grep -qE '\.(added|deprecated)(\.[0-9]+)?\.md$'; then
-                      echo "::warning::${component}: 'added'/'deprecated' fragments are shipping in a Prowler patch; auto-derived a patch bump (${current} -> ${effective}), pass the version input to override"
-                    fi
-                  elif echo "$fragments" | grep -qE '\.(added|changed|deprecated)(\.[0-9]+)?\.md$'; then
-                    effective="${major}.$((minor + 1)).0"
-                  else
-                    effective="${major}.${minor}.$((patch + 1))"
-                  fi
-                  ;;
-              esac
-              current_key=$(version_key "$current")
-              effective_key=$(version_key "$effective")
-              if [[ "$effective_key" < "$current_key" || "$effective_key" == "$current_key" ]]; then
-                echo "::error::${component}: auto-derived version '${effective}' is not greater than the latest released version (${current}); check prowler_version or pass the version input explicitly"
-                errors=1
-                continue
-              fi
-              mode="auto"
-              echo "::notice::${component}: version auto-derived ${current} -> ${effective}"
-            fi
-
-            if [ "$removed_fragments" = "true" ]; then
-              IFS=. read -r current_major _ <<< "$current"
-              current_major=$((10#$current_major))
-              IFS=. read -r effective_major effective_minor effective_patch <<< "$effective"
-              effective_major=$((10#$effective_major))
-              effective_minor=$((10#$effective_minor))
-              effective_patch=$((10#$effective_patch))
-              if [ "$effective_major" -le "$current_major" ] || [ "$effective_minor" -ne 0 ] || [ "$effective_patch" -ne 0 ]; then
-                echo "::error::${component}: removed fragments require a major component release (${current} -> X.0.0 with X > ${current_major}); got ${effective}"
-                errors=1
-                continue
-              fi
-            fi
-
-            # Without the marker the build would insert the new block above the
-            # file header instead of below it.
-            if ! grep -q '^<!-- changelog: release notes start -->$' "$component/CHANGELOG.md"; then
-              echo "::error::${component}/CHANGELOG.md is missing the '<!-- changelog: release notes start -->' marker; restore it after the intro line before compiling"
-              errors=1
-              continue
-            fi
-            # A hand-written UNRELEASED block means someone followed the old
-            # convention; its entries would be left out of the compiled block
-            # and out of the release notes extraction.
-            if grep -q '(Prowler UNRELEASED)' "$component/CHANGELOG.md"; then
-              echo "::error::${component}/CHANGELOG.md contains a hand-written '(Prowler UNRELEASED)' block; convert its entries to fragments in ${component}/changelog.d/ and delete the block before compiling"
-              errors=1
-              continue
-            fi
-
-            echo "${effective} ${mode}" > "${RUNNER_TEMP}/version-${component}.txt"
-            compiling="${compiling}${component} "
-          done
-          if [ "$errors" -ne 0 ]; then
-            exit 1
-          fi
-          if [ -z "$compiling" ]; then
-            echo "::error::Nothing to compile: no component has pending fragments to release"
-            exit 1
-          fi
-
-          body_file="${RUNNER_TEMP}/compile-changelogs-pr-body.md"
-          {
-            echo "### Description"
-            echo ""
-            echo "Compiles the pending changelog fragments into the per-component \`CHANGELOG.md\` files for Prowler v${PROWLER_VERSION}, replacing the manual stamping PR."
-            echo ""
-            echo "| Component | Version | Fragments consumed |"
-            echo "|---|---|---|"
-          } > "$body_file"
-
-          compiled_components=""
-          for component in prowler api ui mcp_server; do
-            if [ ! -f "${RUNNER_TEMP}/version-${component}.txt" ]; then
-              echo "Skipping ${component} (no pending fragments or held back)"
-              echo "| \`${component}\` | - | 0 |" >> "$body_file"
-              continue
-            fi
-            read -r version mode < "${RUNNER_TEMP}/version-${component}.txt"
-            version_label="$version"
-            if [ "$mode" = "auto" ]; then
-              version_label="${version} (auto)"
-            fi
-
-            count=$(pending_fragments "$component" | wc -l | tr -d ' ')
-            echo "Compiling ${component} ${version} (${count} fragments, ${mode} version)..."
-
-            # Captured before attribution renames them: these original paths are
-            # what the forward-sync deletes on master (backports copy fragments
-            # verbatim, so filenames match across branches).
-            pending_fragments "$component" > "${RUNNER_TEMP}/consumed-${component}.txt"
-            pre_lines=$(wc -l < "$component/CHANGELOG.md")
-
-            # Attribution must run before the build: towncrier renders the
-            # first dotted segment of each filename as the PR number.
-            python .github/scripts/changelog_attribution.py "$component"
-            towncrier build --config "$component/towncrier.toml" --version "$version" --name "Prowler v${PROWLER_VERSION}" --yes
-
-            # The build only inserts lines right after the marker, so the new
-            # stamped block is exactly the added lines following it. Captured
-            # for the forward-sync to master.
-            post_lines=$(wc -l < "$component/CHANGELOG.md")
-            delta=$((post_lines - pre_lines))
-            marker_line=$(grep -n -m1 '^<!-- changelog: release notes start -->$' "$component/CHANGELOG.md" | cut -d: -f1)
-            sed -n "$((marker_line + 1)),$((marker_line + delta))p" "$component/CHANGELOG.md" > "${RUNNER_TEMP}/block-${component}.md"
-
-            compiled_components="${compiled_components}${component} "
-            echo "| \`${component}\` | ${version_label} | ${count} |" >> "$body_file"
-          done
-          echo "COMPILED_COMPONENTS=${compiled_components}" >> "$GITHUB_ENV"
-
-          {
-            echo ""
-            echo "Review that no pending fragment was dropped (the diff must delete every consumed fragment) and that each new version block is correct, then squash-merge."
-            echo ""
-            echo "### License"
-            echo ""
-            echo "By submitting this pull request, I confirm that my contribution is made under the terms of the Apache 2.0 license."
-          } >> "$body_file"
-
-          echo "PR_BODY_FILE=${body_file}" >> "$GITHUB_ENV"
-
-      - name: Create compile PR
-        uses: peter-evans/create-pull-request@5f6978faf089d4d20b00c7766989d076bb2fc7f1 # v8.1.1
-        with:
-          token: ${{ secrets.PROWLER_BOT_ACCESS_TOKEN }}
-          commit-message: 'chore(changelog): v${{ env.PROWLER_VERSION }}'
-          branch: compile-changelogs-${{ env.PROWLER_VERSION }}
-          base: ${{ env.TARGET_BRANCH }}
-          title: 'chore(changelog): v${{ env.PROWLER_VERSION }}'
-          body-path: ${{ env.PR_BODY_FILE }}
-          author: prowler-bot <179230569+prowler-bot@users.noreply.github.com>
-          labels: |
-            no-changelog
-            skip-sync
-
-      # Patch compiles (target_branch = v5.X) leave master holding the consumed
-      # fragments and missing the new version block. This applies the equivalent
-      # change to master: insert the same stamped blocks under the marker and
-      # delete the consumed fragments, so the next minor compile cannot
-      # re-release entries that already shipped in the patch.
-      - name: Apply forward-sync to master
-        if: env.TARGET_BRANCH != 'master'
-        run: |
-          set -euo pipefail
-
-          git checkout -B master origin/master
-
-          version_key() {
-            local version="$1"
-            local major minor patch
-            IFS=. read -r major minor patch <<< "$version"
-            printf '%06d.%06d.%06d' "$((10#$major))" "$((10#$minor))" "$((10#$patch))"
-          }
-
-          release_from_heading() {
-            local heading="$1"
-            echo "$heading" | sed -E 's/^## \[[^]]+\] \(Prowler v?([0-9]+\.[0-9]+\.[0-9]+)\).*/\1/'
-          }
-
-          insert_changelog_block_ordered() {
-            local component="$1"
-            local block_file="$2"
-            local changelog="${component}/CHANGELOG.md"
-            local incoming_heading incoming_release incoming_key
-            local marker_line insertion_line duplicate_line total_lines
-            local line heading existing_release existing_key
-
-            marker_line=$(grep -n -m1 '^<!-- changelog: release notes start -->$' "$changelog" | cut -d: -f1)
-            incoming_heading=$(grep -m1 -E '^## \[[^]]+\] \(Prowler v?[0-9]+\.[0-9]+\.[0-9]+\)' "$block_file" || true)
-            if [ -z "$incoming_heading" ]; then
-              echo "::error::${block_file} does not contain a stamped Prowler release heading"
-              exit 1
-            fi
-
-            incoming_release=$(release_from_heading "$incoming_heading")
-            incoming_key=$(version_key "$incoming_release")
-            insertion_line=""
-            duplicate_line=""
-
-            while IFS=: read -r line heading; do
-              existing_release=$(release_from_heading "$heading")
-              existing_key=$(version_key "$existing_release")
-              if [[ "$incoming_key" == "$existing_key" ]]; then
-                duplicate_line="$line"
-                break
-              fi
-              if [[ "$incoming_key" > "$existing_key" ]]; then
-                insertion_line="$line"
-                break
-              fi
-            done < <(grep -n -E '^## \[[^]]+\] \(Prowler v?[0-9]+\.[0-9]+\.[0-9]+\)' "$changelog" || true)
-
-            if [ -n "$duplicate_line" ]; then
-              echo "::error::${changelog} already contains a block for Prowler v${incoming_release} at line ${duplicate_line}; refusing to insert a duplicate"
-              exit 1
-            fi
-            if [ -z "$insertion_line" ]; then
-              insertion_line=$(($(wc -l < "$changelog") + 1))
-            fi
-            if [ "$insertion_line" -le "$marker_line" ]; then
-              insertion_line=$((marker_line + 1))
-            fi
-
-            # The captured block window can be off by one blank line on either
-            # end (towncrier re-emits the blank after the marker), so strip the
-            # outer blank lines and pad exactly one on each side: the block
-            # must never glue to the marker above or the next heading below.
-            awk '
-              /[^[:space:]]/ { for (i = 0; i < pending; i++) print ""; pending = 0; print; started = 1; next }
-              started { pending++ }
-            ' "$block_file" > "${RUNNER_TEMP}/block-normalized.md"
-
-            total_lines=$(wc -l < "$changelog")
-            {
-              head -n "$((insertion_line - 1))" "$changelog"
-              if [ "$insertion_line" -gt 1 ] && [ -n "$(sed -n "$((insertion_line - 1))p" "$changelog")" ]; then
-                echo ""
-              fi
-              cat "${RUNNER_TEMP}/block-normalized.md"
-              if [ "$insertion_line" -le "$total_lines" ]; then
-                echo ""
-              fi
-              tail -n +"$insertion_line" "$changelog"
-            } > "${RUNNER_TEMP}/changelog.tmp"
-            mv "${RUNNER_TEMP}/changelog.tmp" "$changelog"
-
-            echo "::notice::Inserted ${component} changelog block for Prowler v${incoming_release} at line ${insertion_line}"
-          }
-
-          sync_body="${RUNNER_TEMP}/forward-sync-pr-body.md"
-          {
-            echo "### Description"
-            echo ""
-            echo "Forward-syncs the v${PROWLER_VERSION} compiled changelogs from \`${TARGET_BRANCH}\` to \`master\`: inserts the same stamped version blocks under the insertion marker and deletes the consumed fragments, so the next minor compile cannot re-release entries that already shipped in this patch. Opened automatically by the same run that opened the compile PR; review and squash-merge after it."
-            echo ""
-            echo "| Component | Fragments deleted on master | Skipped (only on ${TARGET_BRANCH}) |"
-            echo "|---|---|---|"
-          } > "$sync_body"
-
-          for component in $COMPILED_COMPONENTS; do
-            block_file="${RUNNER_TEMP}/block-${component}.md"
-            consumed_file="${RUNNER_TEMP}/consumed-${component}.txt"
-
-            if ! grep -qm1 '^<!-- changelog: release notes start -->$' "$component/CHANGELOG.md"; then
-              echo "::error::${component}/CHANGELOG.md on master is missing the insertion marker; cannot forward-sync"
-              exit 1
-            fi
-
-            deleted=0
-            skipped=0
-            while IFS= read -r fragment; do
-              if [ -z "$fragment" ]; then
-                continue
-              fi
-              if [ -f "$fragment" ]; then
-                git rm -q "$fragment"
-                deleted=$((deleted + 1))
-              else
-                echo "::notice::${fragment} does not exist on master (change landed only on ${TARGET_BRANCH}); skipping its deletion"
-                skipped=$((skipped + 1))
-              fi
-            done < "$consumed_file"
-
-            insert_changelog_block_ordered "$component" "$block_file"
-
-            echo "| \`${component}\` | ${deleted} | ${skipped} |" >> "$sync_body"
-          done
-
-          {
-            echo ""
-            echo "### License"
-            echo ""
-            echo "By submitting this pull request, I confirm that my contribution is made under the terms of the Apache 2.0 license."
-          } >> "$sync_body"
-
-          echo "SYNC_BODY_FILE=${sync_body}" >> "$GITHUB_ENV"
-
-      - name: Create forward-sync PR
-        if: env.TARGET_BRANCH != 'master'
-        uses: peter-evans/create-pull-request@5f6978faf089d4d20b00c7766989d076bb2fc7f1 # v8.1.1
-        with:
-          token: ${{ secrets.PROWLER_BOT_ACCESS_TOKEN }}
-          commit-message: 'chore(changelog): v${{ env.PROWLER_VERSION }} forward-sync to master'
-          branch: forward-sync-changelogs-${{ env.PROWLER_VERSION }}
-          base: master
-          title: 'chore(changelog): v${{ env.PROWLER_VERSION }} forward-sync to master'
-          body-path: ${{ env.SYNC_BODY_FILE }}
-          author: prowler-bot <179230569+prowler-bot@users.noreply.github.com>
-          labels: |
-            no-changelog
-            skip-sync

.github/workflows/conventional-commit.yml

@@ -26,7 +26,7 @@ jobs:
 
     steps:
       - name: Harden the runner (Audit all outbound calls)
-        uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0
+        uses: step-security/harden-runner@ab7a9404c0f3da075243ca237b5fac12c98deaa5 # v2.19.3
         with:
           egress-policy: audit
 

.github/workflows/create-backport-label.yml

@@ -25,7 +25,7 @@ jobs:
 
     steps:
       - name: Harden the runner (Audit all outbound calls)
-        uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0
+        uses: step-security/harden-runner@ab7a9404c0f3da075243ca237b5fac12c98deaa5 # v2.19.3
         with:
           egress-policy: audit
 

.github/workflows/dockerhub-descriptions.yml

@@ -1,92 +0,0 @@
-name: 'Tools: Sync Docker Hub Descriptions'
-
-on:
-  push:
-    branches:
-      - 'master'
-    paths:
-      - 'docs/dockerhub/README.md'
-      - '.github/workflows/dockerhub-descriptions.yml'
-  workflow_dispatch:
-
-concurrency:
-  group: ${{ github.workflow }}-${{ github.ref }}
-  cancel-in-progress: false
-
-env:
-  OVERVIEW_FILE: docs/dockerhub/README.md
-
-permissions: {}
-
-jobs:
-  prowlercloud:
-    if: github.repository == 'prowler-cloud/prowler' && github.ref == 'refs/heads/master'
-    runs-on: ubuntu-latest
-    timeout-minutes: 10
-    permissions:
-      contents: read
-    strategy:
-      fail-fast: false
-      matrix:
-        include:
-          - repository: prowlercloud/prowler
-            short_description: 'Prowler CLI: the Open Cloud Security tool for AWS, Azure, Google Cloud, Kubernetes, M365 and GitHub'
-          - repository: prowlercloud/prowler-api
-            short_description: 'Prowler Local Server - API: the JSON API and Task Runner components of Prowler'
-          - repository: prowlercloud/prowler-ui
-            short_description: 'Prowler Local Server - UI: the web interface to run Prowler scans and explore findings'
-          - repository: prowlercloud/prowler-mcp
-            short_description: 'Prowler MCP: the interface for agents, including IDE plugins and agent integrations'
-
-    steps:
-      - name: Harden Runner
-        uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0
-        with:
-          egress-policy: block
-          allowed-endpoints: >
-            github.com:443
-            hub.docker.com:443
-
-      - name: Checkout repository
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
-        with:
-          persist-credentials: false
-
-      - name: Update Docker Hub description for ${{ matrix.repository }}
-        uses: peter-evans/dockerhub-description@1b9a80c056b620d92cedb9d9b5a223409c68ddfa # v5.0.0
-        with:
-          username: ${{ secrets.DOCKERHUB_USERNAME }}
-          password: ${{ secrets.DOCKERHUB_TOKEN }}
-          repository: ${{ matrix.repository }}
-          short-description: ${{ matrix.short_description }}
-          readme-filepath: ${{ env.OVERVIEW_FILE }}
-
-  toniblyx:
-    if: github.repository == 'prowler-cloud/prowler' && github.ref == 'refs/heads/master'
-    runs-on: ubuntu-latest
-    timeout-minutes: 10
-    permissions:
-      contents: read
-
-    steps:
-      - name: Harden Runner
-        uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0
-        with:
-          egress-policy: block
-          allowed-endpoints: >
-            github.com:443
-            hub.docker.com:443
-
-      - name: Checkout repository
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
-        with:
-          persist-credentials: false
-
-      - name: Update Docker Hub description for toniblyx/prowler
-        uses: peter-evans/dockerhub-description@1b9a80c056b620d92cedb9d9b5a223409c68ddfa # v5.0.0
-        with:
-          username: ${{ secrets.TONIBLYX_DOCKERHUB_USERNAME }}
-          password: ${{ secrets.TONIBLYX_DOCKERHUB_PASSWORD }}
-          repository: toniblyx/prowler
-          short-description: 'Prowler CLI (legacy repository, mirrors prowlercloud/prowler)'
-          readme-filepath: ${{ env.OVERVIEW_FILE }}

.github/workflows/docs-check-provider-cards.yml

@@ -1,50 +0,0 @@
-name: 'Docs: Check Provider Cards Snippet'
-
-on:
-  pull_request:
-    branches:
-      - 'master'
-      - 'v5.*'
-    paths:
-      - 'docs/user-guide/providers/**/getting-started-*.mdx'
-      - 'docs/scripts/generate_provider_cards.py'
-      - 'docs/snippets/provider-cards.mdx'
-      - 'api/src/backend/api/models.py'
-      - '.github/workflows/docs-check-provider-cards.yml'
-
-concurrency:
-  group: ${{ github.workflow }}-${{ github.ref }}
-  cancel-in-progress: true
-
-permissions: {}
-
-jobs:
-  check-provider-cards:
-    if: github.repository == 'prowler-cloud/prowler'
-    runs-on: ubuntu-latest
-    timeout-minutes: 5
-    permissions:
-      contents: read
-
-    steps:
-      - name: Harden Runner
-        uses: step-security/harden-runner@ab7a9404c0f3da075243ca237b5fac12c98deaa5 # v2.19.3
-        with:
-          egress-policy: block
-          allowed-endpoints: >
-            github.com:443
-
-      - name: Checkout repository
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
-        with:
-          persist-credentials: false
-
-      - name: Verify provider cards snippet is up to date
-        run: |
-          if ! python3 docs/scripts/generate_provider_cards.py; then
-            echo "::error::docs/snippets/provider-cards.mdx is out of sync with the provider getting-started pages or the API ProviderChoices enum."
-            echo "Run 'python3 docs/scripts/generate_provider_cards.py' locally and commit the regenerated snippet."
-            echo "--- diff ---"
-            git diff docs/snippets/provider-cards.mdx
-            exit 1
-          fi

.github/workflows/find-secrets.yml

@@ -25,15 +25,14 @@ jobs:
 
     steps:
       - name: Harden Runner
-        uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0
+        uses: step-security/harden-runner@ab7a9404c0f3da075243ca237b5fac12c98deaa5 # v2.19.3
         with:
           # We can't block as Trufflehog needs to verify secrets against vendors
           egress-policy: audit
-          allowed-endpoints: >
-            github.com:443
-            ghcr.io:443
-            pkg-containers.githubusercontent.com:443
-            www.formbucket.com:443
+          # allowed-endpoints: >
+          #   github.com:443
+          #   ghcr.io:443
+          #   pkg-containers.githubusercontent.com:443
 
       - name: Checkout repository
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2

.github/workflows/helm-chart-checks.yml

@@ -33,7 +33,7 @@ jobs:
 
     steps:
       - name: Harden the runner (Audit all outbound calls)
-        uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0
+        uses: step-security/harden-runner@ab7a9404c0f3da075243ca237b5fac12c98deaa5 # v2.19.3
         with:
           egress-policy: audit
 

.github/workflows/helm-chart-release.yml

@@ -26,7 +26,7 @@ jobs:
 
     steps:
       - name: Harden the runner (Audit all outbound calls)
-        uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0
+        uses: step-security/harden-runner@ab7a9404c0f3da075243ca237b5fac12c98deaa5 # v2.19.3
         with:
           egress-policy: audit
 
@@ -38,19 +38,16 @@ jobs:
       - name: Set up Helm
         uses: azure/setup-helm@dda3372f752e03dde6b3237bc9431cdc2f7a02a2 # v5.0.0
 
-      - name: Set chart version and appVersion from release tag
+      - name: Set appVersion from release tag
         run: |
-          # Strip any leading "v" so the chart version is valid SemVer 2.
-          RELEASE_TAG="${GITHUB_EVENT_RELEASE_TAG_NAME#v}"
-          echo "Setting chart version and appVersion to ${RELEASE_TAG}"
-          # Publish an immutable chart version per release instead of the static
-          # 0.0.1 in source, so every release is a distinct, addressable artifact.
-          yq -i ".version = \"${RELEASE_TAG}\" | .appVersion = \"${RELEASE_TAG}\"" ${{ env.CHART_PATH }}/Chart.yaml
+          RELEASE_TAG="${GITHUB_EVENT_RELEASE_TAG_NAME}"
+          echo "Setting appVersion to ${RELEASE_TAG}"
+          sed -i "s/^appVersion:.*/appVersion: \"${RELEASE_TAG}\"/" ${{ env.CHART_PATH }}/Chart.yaml
         env:
           GITHUB_EVENT_RELEASE_TAG_NAME: ${{ github.event.release.tag_name }}
 
       - name: Login to GHCR
-        run: echo "${{ secrets.GITHUB_TOKEN }}" | helm registry login ghcr.io -u "${GITHUB_ACTOR}" --password-stdin
+        run: echo "${{ secrets.GITHUB_TOKEN }}" | helm registry login ghcr.io -u ${GITHUB_ACTOR} --password-stdin
 
       - name: Update chart dependencies
         run: helm dependency update ${{ env.CHART_PATH }}

.github/workflows/issue-lock-on-close.yml

@@ -22,7 +22,7 @@ jobs:
       issues: write
     steps:
       - name: Harden Runner
-        uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0
+        uses: step-security/harden-runner@ab7a9404c0f3da075243ca237b5fac12c98deaa5 # v2.19.3
         with:
           egress-policy: block
           allowed-endpoints: >

.github/workflows/issue-triage.md

@@ -12,8 +12,8 @@ if: contains(toJson(github.event.issue.labels), 'status/needs-triage')
 
 timeout-minutes: 12
 
-user-rate-limit:
-  max-runs-per-window: 5
+rate-limit:
+  max: 5
   window: 60
 
 concurrency:
@@ -30,12 +30,6 @@ permissions:
 engine: copilot
 strict: false
 
-pre-steps:
-  - name: Harden the runner
-    uses: step-security/harden-runner@v2.20.0
-    with:
-      egress-policy: audit
-
 imports:
   - ../agents/issue-triage.md
 
@@ -114,7 +108,7 @@ Triage the following GitHub issue using the Prowler Issue Triage Agent persona.
 
 ## Sanitized Issue Content
 
-${{ steps.sanitized.outputs.text }}
+${{ needs.activation.outputs.text }}
 
 ## Instructions
 

.github/workflows/labeler.yml

@@ -27,7 +27,7 @@ jobs:
 
     steps:
       - name: Harden the runner (Audit all outbound calls)
-        uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0
+        uses: step-security/harden-runner@ab7a9404c0f3da075243ca237b5fac12c98deaa5 # v2.19.3
         with:
           egress-policy: audit
 
@@ -46,7 +46,7 @@ jobs:
 
     steps:
       - name: Harden the runner (Audit all outbound calls)
-        uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0
+        uses: step-security/harden-runner@ab7a9404c0f3da075243ca237b5fac12c98deaa5 # v2.19.3
         with:
           egress-policy: audit
 
@@ -85,15 +85,15 @@ jobs:
 
           # Check if author is in the org members list
           if printf '%s\n' "${ORG_MEMBERS[@]}" | grep -q "^${AUTHOR}$"; then
-            echo "is_member=true" >> "$GITHUB_OUTPUT"
+            echo "is_member=true" >> $GITHUB_OUTPUT
             echo "$AUTHOR is an organization member"
           else
-            echo "is_member=false" >> "$GITHUB_OUTPUT"
+            echo "is_member=false" >> $GITHUB_OUTPUT
             echo "$AUTHOR is not an organization member"
           fi
 
       - name: Add community label
-        if: steps.check_membership.outputs.is_member == 'false' && github.event.pull_request.user.type != 'Bot'
+        if: steps.check_membership.outputs.is_member == 'false'
         env:
           PR_NUMBER: ${{ github.event.pull_request.number }}
           GH_TOKEN: ${{ github.token }}

.github/workflows/markdown-lint.yml

@@ -26,7 +26,7 @@ jobs:
 
     steps:
       - name: Harden Runner
-        uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0
+        uses: step-security/harden-runner@fa2e9d605c4eeb9fcad4c99c224cee0c6c7f3594 # v2.16.0
         with:
           egress-policy: block
           allowed-endpoints: >

.github/workflows/mcp-container-build-push.yml

@@ -41,20 +41,17 @@ jobs:
     timeout-minutes: 5
     outputs:
       short-sha: ${{ steps.set-short-sha.outputs.short-sha }}
-      created: ${{ steps.set-short-sha.outputs.created }}
     permissions:
       contents: read
     steps:
       - name: Harden Runner
-        uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0
+        uses: step-security/harden-runner@ab7a9404c0f3da075243ca237b5fac12c98deaa5 # v2.19.3
         with:
           egress-policy: block
 
       - name: Calculate short SHA
         id: set-short-sha
-        run: |
-          echo "short-sha=${GITHUB_SHA::7}" >> "${GITHUB_OUTPUT}"
-          echo "created=$(date -u +%Y-%m-%dT%H:%M:%SZ)" >> "${GITHUB_OUTPUT}"
+        run: echo "short-sha=${GITHUB_SHA::7}" >> $GITHUB_OUTPUT
 
   notify-release-started:
     if: github.repository == 'prowler-cloud/prowler' && (github.event_name == 'release' || github.event_name == 'workflow_dispatch')
@@ -67,7 +64,7 @@ jobs:
       contents: read
     steps:
       - name: Harden the runner (Audit all outbound calls)
-        uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0
+        uses: step-security/harden-runner@ab7a9404c0f3da075243ca237b5fac12c98deaa5 # v2.19.3
         with:
           egress-policy: audit
 
@@ -109,19 +106,19 @@ jobs:
       packages: write
     steps:
       - name: Harden Runner
-        uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0
+        uses: step-security/harden-runner@ab7a9404c0f3da075243ca237b5fac12c98deaa5 # v2.19.3
         with:
           egress-policy: block
           allowed-endpoints: >
-            auth.docker.io:443
-            files.pythonhosted.org:443
-            ghcr.io:443
             github.com:443
-            pkg-containers.githubusercontent.com:443
+            registry-1.docker.io:443
+            auth.docker.io:443
             production.cloudflare.docker.com:443
             production.cloudfront.docker.com:443
+            ghcr.io:443
+            pkg-containers.githubusercontent.com:443
+            files.pythonhosted.org:443
             pypi.org:443
-            registry-1.docker.io:443
 
       - name: Checkout repository
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
@@ -144,20 +141,17 @@ jobs:
         with:
           context: ${{ env.WORKING_DIRECTORY }}
           push: true
-          sbom: true
-          # max, not the default min: min records little beyond the build ref.
-          provenance: mode=max
           platforms: ${{ matrix.platform }}
           tags: |
             ${{ env.PROWLERCLOUD_DOCKERHUB_REPOSITORY }}/${{ env.PROWLERCLOUD_DOCKERHUB_IMAGE }}:${{ needs.setup.outputs.short-sha }}-${{ matrix.arch }}
           labels: |
-            org.opencontainers.image.title=Prowler MCP
+            org.opencontainers.image.title=Prowler MCP Server
             org.opencontainers.image.description=Model Context Protocol server for Prowler
             org.opencontainers.image.vendor=ProwlerPro, Inc.
             org.opencontainers.image.source=https://github.com/${{ github.repository }}
             org.opencontainers.image.revision=${{ github.sha }}
-            org.opencontainers.image.created=${{ needs.setup.outputs.created }}
-            ${{ (github.event_name == 'release' || github.event_name == 'workflow_dispatch') && format('org.opencontainers.image.version={0}', env.RELEASE_TAG) || '' }}
+            org.opencontainers.image.created=${{ github.event_name == 'release' && github.event.release.published_at || github.event.head_commit.timestamp }}
+            ${{ github.event_name == 'release' && format('org.opencontainers.image.version={0}', env.RELEASE_TAG) || '' }}
           cache-from: type=gha,scope=${{ matrix.arch }}
           cache-to: type=gha,mode=${{ github.event_name == 'pull_request' && 'min' || 'max' }},scope=${{ matrix.arch }}
 
@@ -171,15 +165,15 @@ jobs:
 
     steps:
       - name: Harden Runner
-        uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0
+        uses: step-security/harden-runner@ab7a9404c0f3da075243ca237b5fac12c98deaa5 # v2.19.3
         with:
           egress-policy: block
           allowed-endpoints: >
+            registry-1.docker.io:443
             auth.docker.io:443
-            github.com:443
             production.cloudflare.docker.com:443
             production.cloudfront.docker.com:443
-            registry-1.docker.io:443
+            github.com:443
             release-assets.githubusercontent.com:443
 
       - name: Login to DockerHub
@@ -193,9 +187,9 @@ jobs:
         run: |
           docker buildx imagetools create \
             -t ${{ env.PROWLERCLOUD_DOCKERHUB_REPOSITORY }}/${{ env.PROWLERCLOUD_DOCKERHUB_IMAGE }}:${{ env.LATEST_TAG }} \
-            -t "${{ env.PROWLERCLOUD_DOCKERHUB_REPOSITORY }}/${{ env.PROWLERCLOUD_DOCKERHUB_IMAGE }}:${NEEDS_SETUP_OUTPUTS_SHORT_SHA}" \
-            "${{ env.PROWLERCLOUD_DOCKERHUB_REPOSITORY }}/${{ env.PROWLERCLOUD_DOCKERHUB_IMAGE }}:${NEEDS_SETUP_OUTPUTS_SHORT_SHA}-amd64" \
-            "${{ env.PROWLERCLOUD_DOCKERHUB_REPOSITORY }}/${{ env.PROWLERCLOUD_DOCKERHUB_IMAGE }}:${NEEDS_SETUP_OUTPUTS_SHORT_SHA}-arm64"
+            -t ${{ env.PROWLERCLOUD_DOCKERHUB_REPOSITORY }}/${{ env.PROWLERCLOUD_DOCKERHUB_IMAGE }}:${NEEDS_SETUP_OUTPUTS_SHORT_SHA} \
+            ${{ env.PROWLERCLOUD_DOCKERHUB_REPOSITORY }}/${{ env.PROWLERCLOUD_DOCKERHUB_IMAGE }}:${NEEDS_SETUP_OUTPUTS_SHORT_SHA}-amd64 \
+            ${{ env.PROWLERCLOUD_DOCKERHUB_REPOSITORY }}/${{ env.PROWLERCLOUD_DOCKERHUB_IMAGE }}:${NEEDS_SETUP_OUTPUTS_SHORT_SHA}-arm64
         env:
           NEEDS_SETUP_OUTPUTS_SHORT_SHA: ${{ needs.setup.outputs.short-sha }}
 
@@ -203,16 +197,16 @@ jobs:
         if: github.event_name == 'release' || github.event_name == 'workflow_dispatch'
         run: |
           docker buildx imagetools create \
-            -t "${{ env.PROWLERCLOUD_DOCKERHUB_REPOSITORY }}/${{ env.PROWLERCLOUD_DOCKERHUB_IMAGE }}:${RELEASE_TAG}" \
+            -t ${{ env.PROWLERCLOUD_DOCKERHUB_REPOSITORY }}/${{ env.PROWLERCLOUD_DOCKERHUB_IMAGE }}:${RELEASE_TAG} \
             -t ${{ env.PROWLERCLOUD_DOCKERHUB_REPOSITORY }}/${{ env.PROWLERCLOUD_DOCKERHUB_IMAGE }}:${{ env.STABLE_TAG }} \
-            "${{ env.PROWLERCLOUD_DOCKERHUB_REPOSITORY }}/${{ env.PROWLERCLOUD_DOCKERHUB_IMAGE }}:${NEEDS_SETUP_OUTPUTS_SHORT_SHA}-amd64" \
-            "${{ env.PROWLERCLOUD_DOCKERHUB_REPOSITORY }}/${{ env.PROWLERCLOUD_DOCKERHUB_IMAGE }}:${NEEDS_SETUP_OUTPUTS_SHORT_SHA}-arm64"
+            ${{ env.PROWLERCLOUD_DOCKERHUB_REPOSITORY }}/${{ env.PROWLERCLOUD_DOCKERHUB_IMAGE }}:${NEEDS_SETUP_OUTPUTS_SHORT_SHA}-amd64 \
+            ${{ env.PROWLERCLOUD_DOCKERHUB_REPOSITORY }}/${{ env.PROWLERCLOUD_DOCKERHUB_IMAGE }}:${NEEDS_SETUP_OUTPUTS_SHORT_SHA}-arm64
         env:
           NEEDS_SETUP_OUTPUTS_SHORT_SHA: ${{ needs.setup.outputs.short-sha }}
 
       - name: Install regctl
         if: always()
-        uses: regclient/actions/regctl-installer@9a2d4216180dbb3e2dccfa60d2dd4afd98e42ec5 # main
+        uses: regclient/actions/regctl-installer@da9319db8e44e8b062b3a147e1dfb2f574d41a03 # main
 
       - name: Cleanup intermediate architecture tags
         if: always()
@@ -233,7 +227,7 @@ jobs:
       contents: read
     steps:
       - name: Harden the runner (Audit all outbound calls)
-        uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0
+        uses: step-security/harden-runner@ab7a9404c0f3da075243ca237b5fac12c98deaa5 # v2.19.3
         with:
           egress-policy: audit
 
@@ -246,9 +240,9 @@ jobs:
         id: outcome
         run: |
           if [[ "${NEEDS_CONTAINER_BUILD_PUSH_RESULT}" == "success" && "${NEEDS_CREATE_MANIFEST_RESULT}" == "success" ]]; then
-            echo "outcome=success" >> "$GITHUB_OUTPUT"
+            echo "outcome=success" >> $GITHUB_OUTPUT
           else
-            echo "outcome=failure" >> "$GITHUB_OUTPUT"
+            echo "outcome=failure" >> $GITHUB_OUTPUT
           fi
         env:
           NEEDS_CONTAINER_BUILD_PUSH_RESULT: ${{ needs.container-build-push.result }}
@@ -269,3 +263,27 @@ jobs:
           payload-file-path: "./.github/scripts/slack-messages/container-release-completed.json"
           step-outcome: ${{ steps.outcome.outputs.outcome }}
           update-ts: ${{ needs.notify-release-started.outputs.message-ts }}
+
+  trigger-deployment:
+    needs: [setup, container-build-push]
+    if: always() && github.event_name == 'push' && needs.setup.result == 'success' && needs.container-build-push.result == 'success'
+    runs-on: ubuntu-latest
+    timeout-minutes: 5
+    permissions:
+      contents: read
+
+    steps:
+      - name: Harden Runner
+        uses: step-security/harden-runner@ab7a9404c0f3da075243ca237b5fac12c98deaa5 # v2.19.3
+        with:
+          egress-policy: block
+          allowed-endpoints: >
+            api.github.com:443
+
+      - name: Trigger MCP deployment
+        uses: peter-evans/repository-dispatch@28959ce8df70de7be546dd1250a005dd32156697 # v4.0.1
+        with:
+          token: ${{ secrets.PROWLER_BOT_ACCESS_TOKEN }}
+          repository: ${{ secrets.CLOUD_DISPATCH }}
+          event-type: mcp-prowler-deployment
+          client-payload: '{"sha": "${{ github.sha }}", "short_sha": "${{ needs.setup.outputs.short-sha }}"}'

.github/workflows/mcp-container-checks.yml

@@ -12,6 +12,9 @@ on:
     branches:
       - 'master'
       - 'v5.*'
+    paths:
+      - 'mcp_server/**'
+      - '.github/workflows/mcp-container-checks.yml'
 
 concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}
@@ -33,7 +36,7 @@ jobs:
 
     steps:
       - name: Harden Runner
-        uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0
+        uses: step-security/harden-runner@ab7a9404c0f3da075243ca237b5fac12c98deaa5 # v2.19.3
         with:
           egress-policy: block
           allowed-endpoints: >
@@ -68,7 +71,7 @@ jobs:
 
     steps:
       - name: Harden Runner
-        uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0
+        uses: step-security/harden-runner@ab7a9404c0f3da075243ca237b5fac12c98deaa5 # v2.19.3
         with:
           egress-policy: block
           allowed-endpoints: >
@@ -87,9 +90,6 @@ jobs:
             get.trivy.dev:443
             release-assets.githubusercontent.com:443
             objects.githubusercontent.com:443
-            raw.githubusercontent.com:443
-            grype.anchore.io:443
-            get.anchore.io:443
 
       - name: Checkout repository
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
@@ -101,17 +101,10 @@ jobs:
         id: check-changes
         uses: tj-actions/changed-files@9426d40962ed5378910ee2e21d5f8c6fcbf2dd96 # v47.0.6
         with:
-          files: |
-            mcp_server/**
-            .trivyignore.yaml
-            .github/actions/trivy-scan/**
-            .github/actions/grype-scan/**
-            .grype.yaml
-            .github/scripts/grype-pr-comment.js
+          files: mcp_server/**
           files_ignore: |
             mcp_server/README.md
             mcp_server/CHANGELOG.md
-            mcp_server/changelog.d/**
 
       - name: Set up Docker Buildx
         if: steps.check-changes.outputs.any_changed == 'true'
@@ -134,13 +127,5 @@ jobs:
         with:
           image-name: ${{ env.IMAGE_NAME }}
           image-tag: ${{ github.sha }}
-          fail-on-severity: 'high'
-          severity: 'CRITICAL,HIGH'
-
-      - name: Scan MCP container with Grype
-        if: steps.check-changes.outputs.any_changed == 'true'
-        uses: ./.github/actions/grype-scan
-        with:
-          image-name: ${{ env.IMAGE_NAME }}
-          image-tag: ${{ github.sha }}
-          fail-on-severity: 'high'
+          fail-on-critical: 'false'
+          severity: 'CRITICAL'

.github/workflows/mcp-pypi-release.yml

@@ -29,7 +29,7 @@ jobs:
 
     steps:
       - name: Harden the runner (Audit all outbound calls)
-        uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0
+        uses: step-security/harden-runner@ab7a9404c0f3da075243ca237b5fac12c98deaa5 # v2.19.3
         with:
           egress-policy: audit
 
@@ -67,7 +67,7 @@ jobs:
 
     steps:
       - name: Harden the runner (Audit all outbound calls)
-        uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0
+        uses: step-security/harden-runner@ab7a9404c0f3da075243ca237b5fac12c98deaa5 # v2.19.3
         with:
           egress-policy: audit
 
@@ -113,7 +113,7 @@ jobs:
 
       - name: Publish prowler-mcp package to PyPI
         if: steps.pypi-check.outputs.skip != 'true'
-        uses: pypa/gh-action-pypi-publish@dc37677b2e1c63e2034f94d8a5b11f265b73ba33 # v1.14.2
+        uses: pypa/gh-action-pypi-publish@cef221092ed1bacb1cc03d23a2d87d1d172e277b # v1.14.0
         with:
           packages-dir: ${{ env.WORKING_DIRECTORY }}/dist/
           print-hash: true

.github/workflows/mcp-security.yml

@@ -15,6 +15,12 @@ on:
     branches:
       - 'master'
       - 'v5.*'
+    paths:
+      - 'mcp_server/pyproject.toml'
+      - 'mcp_server/uv.lock'
+      - '.github/workflows/mcp-security.yml'
+      - '.github/actions/osv-scanner/**'
+      - '.github/scripts/osv-scan.sh'
 
 concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}
@@ -24,6 +30,7 @@ permissions: {}
 
 jobs:
   mcp-security-scans:
+    if: github.repository == 'prowler-cloud/prowler'
     runs-on: ubuntu-latest
     timeout-minutes: 15
     permissions:
@@ -32,7 +39,7 @@ jobs:
 
     steps:
       - name: Harden Runner
-        uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0
+        uses: step-security/harden-runner@a5ad31d6a139d249332a2605b85202e8c0b78450 # v2.19.1
         with:
           egress-policy: block
           allowed-endpoints: >

.github/workflows/mcp-tests.yml

@@ -1,99 +0,0 @@
-name: 'MCP: Tests'
-
-on:
-  push:
-    branches:
-      - 'master'
-      - 'v5.*'
-  pull_request:
-    branches:
-      - 'master'
-      - 'v5.*'
-
-concurrency:
-  group: ${{ github.workflow }}-${{ github.ref }}
-  cancel-in-progress: true
-
-env:
-  MCP_WORKING_DIR: ./mcp_server
-
-permissions: {}
-
-jobs:
-  mcp-tests:
-    runs-on: ubuntu-latest
-    timeout-minutes: 15
-    permissions:
-      contents: read
-    strategy:
-      matrix:
-        # requires-python is >=3.12 while the shipped image is 3.13; testing both
-        # is what keeps that floor honest.
-        python-version:
-          - '3.12'
-          - '3.13'
-    defaults:
-      run:
-        working-directory: ./mcp_server
-
-    steps:
-      - name: Harden Runner
-        uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0
-        with:
-          egress-policy: block
-          # hub.prowler.com and raw.githubusercontent.com are deliberately absent:
-          # the suite mocks every outbound call, so a real one must fail the job.
-          # The sentry.io entry is not the test suite: the Codecov uploader sends
-          # its own telemetry there, so api-tests.yml and sdk-tests.yml allow it too.
-          allowed-endpoints: >
-            github.com:443
-            pypi.org:443
-            files.pythonhosted.org:443
-            cli.codecov.io:443
-            keybase.io:443
-            ingest.codecov.io:443
-            o26192.ingest.us.sentry.io:443
-            storage.googleapis.com:443
-            api.github.com:443
-
-      - name: Checkout repository
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
-        with:
-          # zizmor: ignore[artipacked]
-          persist-credentials: true # Required by tj-actions/changed-files to fetch PR branch
-
-      - name: Check for MCP server changes
-        id: check-changes
-        uses: tj-actions/changed-files@9426d40962ed5378910ee2e21d5f8c6fcbf2dd96 # v47.0.6
-        with:
-          files: |
-            mcp_server/**
-            .github/workflows/mcp-tests.yml
-            codecov.yml
-          files_ignore: |
-            mcp_server/README.md
-            mcp_server/CHANGELOG.md
-            mcp_server/changelog.d/**
-            mcp_server/AGENTS.md
-            mcp_server/Dockerfile
-            mcp_server/.dockerignore
-            mcp_server/entrypoint.sh
-
-      - name: Setup Python with uv
-        if: steps.check-changes.outputs.any_changed == 'true'
-        uses: ./.github/actions/setup-python-uv
-        with:
-          python-version: ${{ matrix.python-version }}
-          working-directory: ./mcp_server
-
-      - name: Run tests with pytest
-        if: steps.check-changes.outputs.any_changed == 'true'
-        run: uv run pytest --cov=./prowler_mcp_server --cov-report=xml tests
-
-      - name: Upload coverage reports to Codecov
-        if: steps.check-changes.outputs.any_changed == 'true'
-        uses: codecov/codecov-action@671740ac38dd9b0130fbe1cec585b89eea48d3de # v5.5.2
-        env:
-          CODECOV_TOKEN: ${{ secrets.CODECOV_TOKEN }}
-        with:
-          flags: mcp

.github/workflows/nightly-arm64-container-builds.yml

@@ -48,7 +48,7 @@ jobs:
 
     steps:
       - name: Harden the runner (Audit all outbound calls)
-        uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0
+        uses: step-security/harden-runner@ab7a9404c0f3da075243ca237b5fac12c98deaa5 # v2.19.3
         with:
           egress-policy: audit
 
@@ -83,7 +83,7 @@ jobs:
       contents: read
     steps:
       - name: Harden the runner (Audit all outbound calls)
-        uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0
+        uses: step-security/harden-runner@ab7a9404c0f3da075243ca237b5fac12c98deaa5 # v2.19.3
         with:
           egress-policy: audit
 

.github/workflows/pr-check-changelog.yml

@@ -19,60 +19,6 @@ concurrency:
 permissions: {}
 
 jobs:
-  test-changelog-attribution:
-    if: github.repository == 'prowler-cloud/prowler'
-    runs-on: ubuntu-latest
-    timeout-minutes: 10
-    permissions:
-      contents: read
-
-    steps:
-      - name: Harden Runner
-        uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0
-        with:
-          egress-policy: block
-          allowed-endpoints: >
-            api.github.com:443
-            github.com:443
-            objects.githubusercontent.com:443
-            pypi.org:443
-            files.pythonhosted.org:443
-
-      - name: Checkout repository
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
-        with:
-          fetch-depth: 1
-          persist-credentials: false
-
-      - name: Fetch PR base ref for tj-actions/changed-files
-        env:
-          BASE_REF: ${{ github.event.pull_request.base.ref }}
-        run: git fetch --depth=1 origin "${BASE_REF}"
-
-      - name: Get changed files
-        id: changed-files
-        uses: tj-actions/changed-files@9426d40962ed5378910ee2e21d5f8c6fcbf2dd96 # v47.0.6
-        with:
-          files: |
-            .github/scripts/changelog_attribution.py
-            .github/workflows/pr-check-changelog.yml
-            .github/workflows/compile-changelogs.yml
-            .github/towncrier/template.md.jinja
-            */towncrier.toml
-            tests/github/**
-
-      - name: Set up Python
-        if: steps.changed-files.outputs.any_changed == 'true'
-        uses: actions/setup-python@e797f83bcb11b83ae66e0230d6156d7c80228e7c # v6.0.0
-        with:
-          python-version: '3.12'
-
-      - name: Test changelog attribution
-        if: steps.changed-files.outputs.any_changed == 'true'
-        run: |
-          python3 -m pip install --user --disable-pip-version-check pytest==9.0.3 towncrier==25.8.0
-          python3 -m pytest tests/github
-
   check-changelog:
     if: contains(github.event.pull_request.labels.*.name, 'no-changelog') == false
     runs-on: ubuntu-latest
@@ -85,7 +31,7 @@ jobs:
 
     steps:
       - name: Harden Runner
-        uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0
+        uses: step-security/harden-runner@ab7a9404c0f3da075243ca237b5fac12c98deaa5 # v2.19.3
         with:
           egress-policy: block
           allowed-endpoints: >
@@ -116,159 +62,53 @@ jobs:
             uv.lock
             pyproject.toml
 
-      - name: Check for folder changes and changelog fragment presence
+      - name: Check for folder changes and changelog presence
         id: check-folders
         run: |
-          fragment_name_re='^[A-Za-z0-9][A-Za-z0-9._-]*\.(added|changed|deprecated|removed|fixed|security)(\.[0-9]+)?\.md$'
-          manual_pr_link_re='(\[\(#[0-9]+\)\]|\[#[0-9]+\]\(|\(#[0-9]+\)|github\.com/[^[:space:]/]+/[^[:space:]/]+/(pull|issues)/[0-9]+)'
-          folder_alt=$(echo "$MONITORED_FOLDERS" | tr ' ' '|')
-
-          missing_fragments=""
-          invalid_fragments=""
-          linked_fragments=""
-          handwritten_changelogs=""
-
-          all_changed=$(echo "${STEPS_CHANGED_FILES_OUTPUTS_ALL_CHANGED_FILES}" | tr ' ' '\n')
-          added_or_renamed=$(printf '%s\n%s' "${STEPS_CHANGED_FILES_OUTPUTS_ADDED_FILES}" "${STEPS_CHANGED_FILES_OUTPUTS_RENAMED_FILES}" | tr ' ' '\n')
-          added_modified_or_renamed=$(printf '%s\n%s\n%s' "${STEPS_CHANGED_FILES_OUTPUTS_ADDED_FILES}" "${STEPS_CHANGED_FILES_OUTPUTS_MODIFIED_FILES}" "${STEPS_CHANGED_FILES_OUTPUTS_RENAMED_FILES}" | tr ' ' '\n')
-
-          # Returns success if the folder has a valid fragment added, modified, or renamed.
-          has_changelog_update() {
-            local folder="$1"
-            if echo "$added_modified_or_renamed" | grep "^${folder}/changelog.d/" | sed "s|^${folder}/changelog.d/||" | grep -qE "$fragment_name_re"; then
-              return 0
-            fi
-            return 1
-          }
+          missing_changelogs=""
 
           if [[ "${STEPS_CHANGED_FILES_OUTPUTS_ANY_CHANGED}" == "true" ]]; then
             # Check monitored folders
             for folder in $MONITORED_FOLDERS; do
-              if echo "$all_changed" | grep -q "^${folder}/CHANGELOG.md$"; then
-                echo "Direct CHANGELOG.md edits are not allowed for ${folder}/"
-                handwritten_changelogs="${handwritten_changelogs}- \`${folder}/CHANGELOG.md\`"$'\n'
-              fi
-
-              changed_in_folder=$(echo "$all_changed" | grep "^${folder}/" | grep -v "^${folder}/CHANGELOG.md$" || true)
+              # Get files changed in this folder
+              changed_in_folder=$(echo "${STEPS_CHANGED_FILES_OUTPUTS_ALL_CHANGED_FILES}" | tr ' ' '\n' | grep "^${folder}/" || true)
 
               if [ -n "$changed_in_folder" ]; then
                 echo "Detected changes in ${folder}/"
 
-                if ! has_changelog_update "$folder"; then
-                  echo "No changelog fragment found for ${folder}/"
-                  missing_fragments="${missing_fragments}- \`${folder}\`"$'\n'
+                # Check if CHANGELOG.md was updated
+                if ! echo "$changed_in_folder" | grep -q "^${folder}/CHANGELOG.md$"; then
+                  echo "No changelog update found for ${folder}/"
+                  missing_changelogs="${missing_changelogs}- \`${folder}\`"$'\n'
                 fi
               fi
             done
 
             # Check root-level dependency files (uv.lock, pyproject.toml)
             # These are associated with the prowler folder changelog
-            root_deps_changed=$(echo "$all_changed" | grep -E "^(uv\.lock|pyproject\.toml)$" || true)
+            root_deps_changed=$(echo "${STEPS_CHANGED_FILES_OUTPUTS_ALL_CHANGED_FILES}" | tr ' ' '\n' | grep -E "^(uv\.lock|pyproject\.toml)$" || true)
             if [ -n "$root_deps_changed" ]; then
               echo "Detected changes in root dependency files: $root_deps_changed"
-              if ! has_changelog_update "prowler"; then
+              # Check if prowler/CHANGELOG.md was already updated (might have been caught above)
+              prowler_changelog_updated=$(echo "${STEPS_CHANGED_FILES_OUTPUTS_ALL_CHANGED_FILES}" | tr ' ' '\n' | grep "^prowler/CHANGELOG.md$" || true)
+              if [ -z "$prowler_changelog_updated" ]; then
                 # Only add if prowler wasn't already flagged
-                if ! echo "$missing_fragments" | grep -q "prowler"; then
-                  echo "No changelog fragment found for root dependency changes"
-                  missing_fragments="${missing_fragments}- \`prowler\` (root dependency files changed)"$'\n'
+                if ! echo "$missing_changelogs" | grep -q "prowler"; then
+                  echo "No changelog update found for root dependency changes"
+                  missing_changelogs="${missing_changelogs}- \`prowler\` (root dependency files changed)"$'\n'
                 fi
               fi
             fi
-
-            # Validate the filename of every fragment added by this PR
-            added_fragments=$(echo "$added_or_renamed" | grep -E "^(${folder_alt})/changelog\.d/" || true)
-            for fragment in $added_fragments; do
-              name=$(basename "$fragment")
-              if [ "$name" = ".gitkeep" ] || [ "$name" = "README.md" ]; then
-                continue
-              fi
-              if ! echo "$name" | grep -qE "$fragment_name_re"; then
-                echo "Invalid fragment filename: $fragment"
-                invalid_fragments="${invalid_fragments}- \`${fragment}\`"$'\n'
-              fi
-            done
-
-            # Lint fragment content: the PR link is attached automatically at
-            # compile time, so a hand-written PR or issue link would be wrong
-            touched_fragments=$(echo "$added_modified_or_renamed" | grep -E "^(${folder_alt})/changelog\.d/" || true)
-            for fragment in $touched_fragments; do
-              name=$(basename "$fragment")
-              if [ "$name" = ".gitkeep" ] || [ "$name" = "README.md" ] || [ ! -f "$fragment" ]; then
-                continue
-              fi
-              if grep -qE "$manual_pr_link_re" "$fragment"; then
-                echo "Fragment contains a hand-written PR or issue link: $fragment"
-                linked_fragments="${linked_fragments}- \`${fragment}\`"$'\n'
-              fi
-            done
           fi
 
-          # Suggest a slug derived from the branch name for the bot comment
-          suggested_slug=$(echo "$HEAD_REF" | tr '[:upper:]' '[:lower:]' | sed 's|.*/||; s/[^a-z0-9._-]/-/g; s/^[^a-z0-9]*//')
-          if [ -z "$suggested_slug" ]; then
-            suggested_slug="my-change"
-          fi
-
-          fragment_help="A changelog fragment is a small Markdown file named \`<slug>.<type>.md\` under \`<component>/changelog.d/\`, where \`<type>\` is one of \`added\`, \`changed\`, \`deprecated\`, \`removed\`, \`fixed\` or \`security\`. Its content is the changelog entry text, without the PR link (added automatically at release time) and without a trailing period. For example:
-
-          \`\`\`
-          echo 'Entry text describing the change' > <component>/changelog.d/${suggested_slug}.fixed.md
-          \`\`\`
-
-          If this PR does not need a changelog entry, add the \`no-changelog\` label instead."
-
-          if [ -n "$missing_fragments" ] || [ -n "$invalid_fragments" ] || [ -n "$linked_fragments" ] || [ -n "$handwritten_changelogs" ]; then
-            comment_body=""
-            if [ -n "$missing_fragments" ]; then
-              comment_body="⚠️ **Changes detected in the following folders without a changelog fragment:**"$'\n\n'"${missing_fragments}"$'\n'
-            fi
-            if [ -n "$invalid_fragments" ]; then
-              comment_body="${comment_body}⚠️ **Changelog fragment filenames that do not follow the naming convention:**"$'\n\n'"${invalid_fragments}"$'\n'
-            fi
-            if [ -n "$linked_fragments" ]; then
-              comment_body="${comment_body}⚠️ **Changelog fragments containing a hand-written PR or issue link (remove it; the PR link is attached automatically at release time):**"$'\n\n'"${linked_fragments}"$'\n'
-            fi
-            if [ -n "$handwritten_changelogs" ]; then
-              comment_body="${comment_body}⚠️ **Direct \`CHANGELOG.md\` edits are not allowed in regular PRs:**"$'\n\n'"${handwritten_changelogs}"$'\n'
-            fi
-            comment_body="${comment_body}${fragment_help}"
-          else
-            comment_body="✅ All required changelog fragments are present."
-          fi
-
-          write_multiline_output() {
-            local name="$1"
-            local value="$2"
-            local delimiter
-
-            while true; do
-              delimiter="EOF_$(openssl rand -hex 16)"
-              if ! grep -qxF "$delimiter" <<< "$value"; then
-                break
-              fi
-            done
-
-            {
-              echo "${name}<<${delimiter}"
-              if [ -n "$value" ]; then
-                printf '%s\n' "$value"
-              fi
-              echo "${delimiter}"
-            } >> "$GITHUB_OUTPUT"
-          }
-
-          write_multiline_output "missing_fragments" "$missing_fragments"
-          write_multiline_output "invalid_fragments" "$invalid_fragments"
-          write_multiline_output "linked_fragments" "$linked_fragments"
-          write_multiline_output "handwritten_changelogs" "$handwritten_changelogs"
-          write_multiline_output "comment_body" "$comment_body"
+          {
+            echo "missing_changelogs<<EOF"
+            echo -e "${missing_changelogs}"
+            echo "EOF"
+          } >> $GITHUB_OUTPUT
         env:
           STEPS_CHANGED_FILES_OUTPUTS_ANY_CHANGED: ${{ steps.changed-files.outputs.any_changed }}
           STEPS_CHANGED_FILES_OUTPUTS_ALL_CHANGED_FILES: ${{ steps.changed-files.outputs.all_changed_files }}
-          STEPS_CHANGED_FILES_OUTPUTS_ADDED_FILES: ${{ steps.changed-files.outputs.added_files }}
-          STEPS_CHANGED_FILES_OUTPUTS_MODIFIED_FILES: ${{ steps.changed-files.outputs.modified_files }}
-          STEPS_CHANGED_FILES_OUTPUTS_RENAMED_FILES: ${{ steps.changed-files.outputs.renamed_files }}
-          HEAD_REF: ${{ github.event.pull_request.head.ref }}
 
       - name: Find existing changelog comment
         if: github.event.pull_request.head.repo.full_name == github.repository
@@ -288,10 +128,14 @@ jobs:
           edit-mode: replace
           body: |
             <!-- changelog-check -->
-            ${{ steps.check-folders.outputs.comment_body }}
+            ${{ steps.check-folders.outputs.missing_changelogs != '' && format('⚠️ **Changes detected in the following folders without a corresponding update to the `CHANGELOG.md`:**
 
-      - name: Fail if changelog fragment is missing or invalid
-        if: steps.check-folders.outputs.missing_fragments != '' || steps.check-folders.outputs.invalid_fragments != '' || steps.check-folders.outputs.linked_fragments != '' || steps.check-folders.outputs.handwritten_changelogs != ''
+            {0}
+
+            Please add an entry to the corresponding `CHANGELOG.md` file to maintain a clear history of changes.', steps.check-folders.outputs.missing_changelogs) || '✅ All necessary `CHANGELOG.md` files have been updated.' }}
+
+      - name: Fail if changelog is missing
+        if: steps.check-folders.outputs.missing_changelogs != ''
         run: |
-          echo "::error::Missing, invalid, or disallowed changelog updates"
+          echo "::error::Missing changelog updates in some folders"
           exit 1

.github/workflows/pr-check-compliance-mapping.yml

@@ -35,7 +35,7 @@ jobs:
 
     steps:
       - name: Harden Runner
-        uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0
+        uses: step-security/harden-runner@ab7a9404c0f3da075243ca237b5fac12c98deaa5 # v2.19.3
         with:
           egress-policy: block
           allowed-endpoints: >
@@ -111,7 +111,7 @@ jobs:
             done
 
             if [ -n "$found_in" ]; then
-              found_in="${found_in%, }"
+              found_in=$(echo "$found_in" | sed 's/, $//')
               MAPPED="${MAPPED}- \`${check_id}\` (\`${provider}\`): ${found_in}"$'\n'
             else
               UNMAPPED="${UNMAPPED}- \`${check_id}\` (\`${provider}\`)"$'\n'

.github/workflows/pr-conflict-checker.yml

@@ -28,7 +28,7 @@ jobs:
 
     steps:
       - name: Harden the runner (Audit all outbound calls)
-        uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0
+        uses: step-security/harden-runner@ab7a9404c0f3da075243ca237b5fac12c98deaa5 # v2.19.3
         with:
           egress-policy: audit
 
@@ -37,7 +37,8 @@ jobs:
         with:
           ref: ${{ github.event.pull_request.head.sha }}
           fetch-depth: 1
-          persist-credentials: false # No write token in the untrusted PR-head tree; public repo so base fetch/changed-files work unauthenticated
+          # zizmor: ignore[artipacked]
+          persist-credentials: true # Required by tj-actions/changed-files to fetch PR branch
 
       - name: Fetch PR base ref for tj-actions/changed-files
         env:
@@ -49,8 +50,6 @@ jobs:
         uses: tj-actions/changed-files@9426d40962ed5378910ee2e21d5f8c6fcbf2dd96 # v47.0.6
         with:
           files: '**'
-          safe_output: false # Raw paths (list read via env var, injection-safe); default escaping backslash-quotes chars like () and breaks the -f test
-          separator: "\n" # Newline-delimited so the reader tolerates spaces and glob chars in paths
 
       - name: Check for conflict markers
         id: conflict-check
@@ -60,77 +59,47 @@ jobs:
           CONFLICT_FILES=""
           HAS_CONFLICTS=false
 
-          # Read newline-delimited paths so spaces/globs neither word-split nor glob-expand
-          while IFS= read -r file; do
-            [ -n "$file" ] || continue
-            [ -f "$file" ] || continue
-            echo "Checking file: $file"
+          # Check each changed file for conflict markers
+          for file in ${STEPS_CHANGED_FILES_OUTPUTS_ALL_CHANGED_FILES}; do
+            if [ -f "$file" ]; then
+              echo "Checking file: $file"
 
-            if grep -qE '^(<<<<<<<|=======|>>>>>>>)' "$file" 2>/dev/null; then
-              echo "Conflict markers found in: $file"
-              CONFLICT_FILES="${CONFLICT_FILES}- \`${file}\`"$'\n'
-              HAS_CONFLICTS=true
+              # Look for conflict markers (more precise regex)
+              if grep -qE '^(<<<<<<<|=======|>>>>>>>)' "$file" 2>/dev/null; then
+                echo "Conflict markers found in: $file"
+                CONFLICT_FILES="${CONFLICT_FILES}- \`${file}\`"$'\n'
+                HAS_CONFLICTS=true
+              fi
             fi
-          done <<< "$STEPS_CHANGED_FILES_OUTPUTS_ALL_CHANGED_FILES"
+          done
 
           if [ "$HAS_CONFLICTS" = true ]; then
-            echo "has_conflicts=true" >> "$GITHUB_OUTPUT"
+            echo "has_conflicts=true" >> $GITHUB_OUTPUT
             {
               echo "conflict_files<<EOF"
               echo "$CONFLICT_FILES"
               echo "EOF"
-            } >> "$GITHUB_OUTPUT"
+            } >> $GITHUB_OUTPUT
             echo "Conflict markers detected"
           else
-            echo "has_conflicts=false" >> "$GITHUB_OUTPUT"
+            echo "has_conflicts=false" >> $GITHUB_OUTPUT
             echo "No conflict markers found in changed files"
           fi
         env:
           STEPS_CHANGED_FILES_OUTPUTS_ALL_CHANGED_FILES: ${{ steps.changed-files.outputs.all_changed_files }}
 
-      - name: Check base-branch mergeability
-        id: merge-check
-        env:
-          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-          PR_NUMBER: ${{ github.event.pull_request.number }}
-          REPO: ${{ github.repository }}
-        run: |
-          MERGEABLE=null
-
-          # GitHub computes mergeability async, so .mergeable is null until ready; poll until resolved
-          for attempt in 1 2 3 4 5; do
-            MERGEABLE=$(gh api "repos/${REPO}/pulls/${PR_NUMBER}" --jq '.mergeable')
-            if [ "$MERGEABLE" != "null" ]; then
-              break
-            fi
-            echo "Attempt ${attempt}: mergeability not computed yet, retrying..."
-            sleep 3
-          done
-
-          # Keep 'unknown' distinct from 'clean' so we never assert a clean merge we could not confirm
-          case "$MERGEABLE" in
-            false) STATUS=conflict; echo "PR branch cannot be merged cleanly into its base branch" ;;
-            true)  STATUS=clean;    echo "PR branch merges cleanly into its base branch" ;;
-            *)     STATUS=unknown;  echo "::warning::Mergeability did not resolve after retries; leaving it undetermined" ;;
-          esac
-
-          echo "merge_status=${STATUS}" >> "$GITHUB_OUTPUT"
-
       - name: Manage conflict label
         env:
           GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
           PR_NUMBER: ${{ github.event.pull_request.number }}
           HAS_CONFLICTS: ${{ steps.conflict-check.outputs.has_conflicts }}
-          MERGE_STATUS: ${{ steps.merge-check.outputs.merge_status }}
         run: |
           LABEL_NAME="has-conflicts"
 
-          if [ "$HAS_CONFLICTS" = "true" ] || [ "$MERGE_STATUS" = "conflict" ]; then
+          # Add or remove label based on conflict status
+          if [ "$HAS_CONFLICTS" = "true" ]; then
             echo "Adding conflict label to PR #${PR_NUMBER}..."
             gh pr edit "$PR_NUMBER" --add-label "$LABEL_NAME" --repo ${{ github.repository }} || true
-          elif [ "$MERGE_STATUS" = "unknown" ]; then
-            # Don't drop the label on an undetermined merge state; a later run will settle it
-            echo "Mergeability undetermined; leaving label unchanged"
           else
             echo "Removing conflict label from PR #${PR_NUMBER}..."
             gh pr edit "$PR_NUMBER" --remove-label "$LABEL_NAME" --repo ${{ github.repository }} || true
@@ -152,25 +121,20 @@ jobs:
           edit-mode: replace
           body: |
             <!-- conflict-checker-comment -->
-            ${{ (steps.conflict-check.outputs.has_conflicts == 'true' || steps.merge-check.outputs.merge_status == 'conflict') && '⚠️ **Conflicts Detected**' || (steps.merge-check.outputs.merge_status == 'unknown' && 'ℹ️ **Conflict Check Incomplete**' || '✅ **No Conflicts**') }}
-            ${{ steps.conflict-check.outputs.has_conflicts == 'true' && format('
-            **Conflict markers** are present in the following files:
+            ${{ steps.conflict-check.outputs.has_conflicts == 'true' && '⚠️ **Conflict Markers Detected**' || '✅ **Conflict Markers Resolved**' }}
+
+            ${{ steps.conflict-check.outputs.has_conflicts == 'true' && format('This pull request contains unresolved conflict markers in the following files:
 
             {0}
-            Resolve them by removing every `<<<<<<<`, `=======`, and `>>>>>>>` marker, then commit and push.', steps.conflict-check.outputs.conflict_files) || '' }}
-            ${{ steps.merge-check.outputs.merge_status == 'conflict' && '
-            **Merge conflict with the base branch.** This PR cannot be merged cleanly. Update your branch with the latest base (rebase or merge) and resolve the conflicts.' || '' }}
-            ${{ steps.merge-check.outputs.merge_status == 'unknown' && '
-            GitHub had not finished computing mergeability, so base-branch conflict status could not be verified on this run.' || '' }}
-            ${{ (steps.conflict-check.outputs.has_conflicts != 'true' && steps.merge-check.outputs.merge_status == 'clean') && '
-            No conflict markers, and the branch merges cleanly into its base.' || '' }}
+
+            Please resolve these conflicts by:
+            1. Locating the conflict markers: `<<<<<<<`, `=======`, and `>>>>>>>`
+            2. Manually editing the files to resolve the conflicts
+            3. Removing all conflict markers
+            4. Committing and pushing the changes', steps.conflict-check.outputs.conflict_files) || 'All conflict markers have been successfully resolved in this pull request.' }}
 
       - name: Fail workflow if conflicts detected
-        if: steps.conflict-check.outputs.has_conflicts == 'true' || steps.merge-check.outputs.merge_status == 'conflict'
-        env:
-          HAS_CONFLICTS: ${{ steps.conflict-check.outputs.has_conflicts }}
-          MERGE_STATUS: ${{ steps.merge-check.outputs.merge_status }}
+        if: steps.conflict-check.outputs.has_conflicts == 'true'
         run: |
-          [ "$HAS_CONFLICTS" = "true" ] && echo "::error::Conflict markers detected in changed files"
-          [ "$MERGE_STATUS" = "conflict" ] && echo "::error::PR branch has merge conflicts with the base branch"
+          echo "::error::Workflow failed due to conflict markers detected in the PR"
           exit 1

.github/workflows/pr-merged.yml

@@ -26,7 +26,7 @@ jobs:
       contents: read
     steps:
       - name: Harden Runner
-        uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0
+        uses: step-security/harden-runner@ab7a9404c0f3da075243ca237b5fac12c98deaa5 # v2.19.3
         with:
           egress-policy: block
           allowed-endpoints: >
@@ -36,7 +36,7 @@ jobs:
         id: vars
         run: |
           SHORT_SHA="${GITHUB_EVENT_PULL_REQUEST_MERGE_COMMIT_SHA}"
-          echo "short_sha=${SHORT_SHA::7}" >> "$GITHUB_OUTPUT"
+          echo "short_sha=${SHORT_SHA::7}" >> $GITHUB_OUTPUT
         env:
           GITHUB_EVENT_PULL_REQUEST_MERGE_COMMIT_SHA: ${{ github.event.pull_request.merge_commit_sha }}
 
@@ -46,7 +46,6 @@ jobs:
           token: ${{ secrets.PROWLER_BOT_ACCESS_TOKEN }}
           repository: ${{ secrets.CLOUD_DISPATCH }}
           event-type: prowler-pull-request-merged
-          # repository_dispatch caps client_payload at 10 properties; this is exactly at the cap.
           client-payload: |
             {
               "PROWLER_COMMIT_SHA": "${{ github.event.pull_request.merge_commit_sha }}",
@@ -55,8 +54,8 @@ jobs:
               "PROWLER_PR_TITLE": ${{ toJson(github.event.pull_request.title) }},
               "PROWLER_PR_LABELS": ${{ toJson(github.event.pull_request.labels.*.name) }},
               "PROWLER_PR_BODY": ${{ toJson(github.event.pull_request.body) }},
+              "PROWLER_PR_URL": ${{ toJson(github.event.pull_request.html_url) }},
               "PROWLER_PR_MERGED_BY": "${{ github.event.pull_request.merged_by.login }}",
-              "PROWLER_PR_STACK_NUMBER": "${{ github.event.pull_request.stack.number }}",
-              "PROWLER_PR_STACK_POSITION": "${{ github.event.pull_request.stack.position }}",
-              "PROWLER_PR_STACK_SIZE": "${{ github.event.pull_request.stack.size }}"
+              "PROWLER_PR_BASE_BRANCH": "${{ github.event.pull_request.base.ref }}",
+              "PROWLER_PR_HEAD_BRANCH": "${{ github.event.pull_request.head.ref }}"
             }

.github/workflows/prepare-release.yml

@@ -25,21 +25,14 @@ jobs:
     runs-on: ubuntu-latest
     timeout-minutes: 30
     permissions:
-      actions: write
       contents: write
       pull-requests: write
     steps:
     - name: Harden the runner (Audit all outbound calls)
-      uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0
+      uses: step-security/harden-runner@ab7a9404c0f3da075243ca237b5fac12c98deaa5 # v2.19.3
       with:
         egress-policy: audit
 
-    - name: Enable release freeze
-      env:
-        GH_TOKEN: ${{ secrets.PROWLER_BOT_ACCESS_TOKEN }}
-      run: |
-        gh variable set RELEASE_FREEZE --body true --repo "${GITHUB_REPOSITORY}"
-
     - name: Checkout repository
       uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
       with:
@@ -77,7 +70,7 @@ jobs:
 
           echo "Prowler version: $PROWLER_VERSION"
           echo "Branch name: $BRANCH_NAME"
-          echo "Is minor release: $([ "$PATCH_VERSION" -eq 0 ] && echo 'true' || echo 'false')"
+          echo "Is minor release: $([ $PATCH_VERSION -eq 0 ] && echo 'true' || echo 'false')"
         else
           echo "Invalid version syntax: '$PROWLER_VERSION' (must be N.N.N)" >&2
           exit 1
@@ -107,8 +100,7 @@ jobs:
           if [ -f "$changelog_file" ]; then
             # Extract version that matches this Prowler release
             # Format: ## [version] (Prowler X.Y.Z) or ## [vversion] (Prowler vX.Y.Z)
-            local version
-            version=$(grep '^## \[' "$changelog_file" | grep "(Prowler v\?${prowler_version})" | head -1 | sed 's/^## \[\(.*\)\].*/\1/' | sed 's/^v//' | tr -d '[:space:]')
+            local version=$(grep '^## \[' "$changelog_file" | grep "(Prowler v\?${prowler_version})" | head -1 | sed 's/^## \[\(.*\)\].*/\1/' | sed 's/^v//' | tr -d '[:space:]')
             echo "$version"
           else
             echo ""
@@ -179,55 +171,55 @@ jobs:
 
         # Determine if components have changes for this specific release
         if [ -n "$SDK_VERSION" ]; then
-          echo "HAS_SDK_CHANGES=true" >> "$GITHUB_ENV"
+          echo "HAS_SDK_CHANGES=true" >> $GITHUB_ENV
           HAS_SDK_CHANGES="true"
           echo "✓ SDK changes detected - version: $SDK_VERSION"
           extract_changelog "prowler/CHANGELOG.md" "$SDK_VERSION" "prowler_changelog.md"
         else
-          echo "HAS_SDK_CHANGES=false" >> "$GITHUB_ENV"
+          echo "HAS_SDK_CHANGES=false" >> $GITHUB_ENV
           HAS_SDK_CHANGES="false"
           echo "ℹ No SDK changes for this release"
           touch "prowler_changelog.md"
         fi
 
         if [ -n "$API_VERSION" ]; then
-          echo "HAS_API_CHANGES=true" >> "$GITHUB_ENV"
+          echo "HAS_API_CHANGES=true" >> $GITHUB_ENV
           HAS_API_CHANGES="true"
           echo "✓ API changes detected - version: $API_VERSION"
           extract_changelog "api/CHANGELOG.md" "$API_VERSION" "api_changelog.md"
         else
-          echo "HAS_API_CHANGES=false" >> "$GITHUB_ENV"
+          echo "HAS_API_CHANGES=false" >> $GITHUB_ENV
           HAS_API_CHANGES="false"
           echo "ℹ No API changes for this release"
           touch "api_changelog.md"
         fi
 
         if [ -n "$UI_VERSION" ]; then
-          echo "HAS_UI_CHANGES=true" >> "$GITHUB_ENV"
+          echo "HAS_UI_CHANGES=true" >> $GITHUB_ENV
           HAS_UI_CHANGES="true"
           echo "✓ UI changes detected - version: $UI_VERSION"
           extract_changelog "ui/CHANGELOG.md" "$UI_VERSION" "ui_changelog.md"
         else
-          echo "HAS_UI_CHANGES=false" >> "$GITHUB_ENV"
+          echo "HAS_UI_CHANGES=false" >> $GITHUB_ENV
           HAS_UI_CHANGES="false"
           echo "ℹ No UI changes for this release"
           touch "ui_changelog.md"
         fi
 
         if [ -n "$MCP_VERSION" ]; then
-          echo "HAS_MCP_CHANGES=true" >> "$GITHUB_ENV"
+          echo "HAS_MCP_CHANGES=true" >> $GITHUB_ENV
           HAS_MCP_CHANGES="true"
           echo "✓ MCP changes detected - version: $MCP_VERSION"
           extract_changelog "mcp_server/CHANGELOG.md" "$MCP_VERSION" "mcp_changelog.md"
         else
-          echo "HAS_MCP_CHANGES=false" >> "$GITHUB_ENV"
+          echo "HAS_MCP_CHANGES=false" >> $GITHUB_ENV
           HAS_MCP_CHANGES="false"
           echo "ℹ No MCP changes for this release"
           touch "mcp_changelog.md"
         fi
 
         # Combine changelogs in order: UI, API, SDK, MCP
-        : > combined_changelog.md
+        > combined_changelog.md
 
         if [ "$HAS_UI_CHANGES" = "true" ] && [ -s "ui_changelog.md" ]; then
           echo "## UI" >> combined_changelog.md
@@ -390,4 +382,3 @@ jobs:
       if: always()
       run: |
         rm -f prowler_changelog.md api_changelog.md ui_changelog.md mcp_changelog.md combined_changelog.md
-

.github/workflows/release-freeze-gate.yml

@@ -1,45 +0,0 @@
-name: 'Tools: Release Freeze Gate'
-
-on:
-  pull_request:
-    branches:
-      - 'master'
-    types:
-      - opened
-      - synchronize
-      - reopened
-      - ready_for_review
-  merge_group:
-    branches:
-      - 'master'
-    types:
-      - checks_requested
-  workflow_dispatch:
-
-permissions: {}
-
-jobs:
-  release-freeze-gate:
-    name: release-freeze-gate
-    runs-on: ubuntu-latest
-    timeout-minutes: 5
-    steps:
-      - name: Harden the runner (Audit all outbound calls)
-        uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0
-        with:
-          egress-policy: audit
-
-      - name: Check release freeze status
-        env:
-          RELEASE_FREEZE: ${{ vars.RELEASE_FREEZE }}
-        run: |
-          case "${RELEASE_FREEZE}" in
-            true|TRUE|True)
-              echo "::error::Release freeze is active. Merges to master are temporarily blocked."
-              echo "Set the RELEASE_FREEZE repository variable to false when the release is complete."
-              exit 1
-              ;;
-            *)
-              echo "Release freeze is not active."
-              ;;
-          esac

.github/workflows/renovate-config-validate.yml

@@ -28,13 +28,12 @@ jobs:
 
     steps:
       - name: Harden Runner
-        uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0
+        uses: step-security/harden-runner@ab7a9404c0f3da075243ca237b5fac12c98deaa5 # v2.19.3
         with:
           egress-policy: block
           allowed-endpoints: >
             api.github.com:443
             github.com:443
-            raw.githubusercontent.com:443
             objects.githubusercontent.com:443
             codeload.github.com:443
             release-assets.githubusercontent.com:443
@@ -42,7 +41,6 @@ jobs:
             files.pythonhosted.org:443
             registry.npmjs.org:443
             nodejs.org:443
-            releases.astral.sh:443
 
       - name: Checkout repository
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2

.github/workflows/sdk-check-duplicate-test-names.yml

@@ -25,7 +25,7 @@ jobs:
 
     steps:
       - name: Harden Runner
-        uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0
+        uses: step-security/harden-runner@ab7a9404c0f3da075243ca237b5fac12c98deaa5 # v2.19.3
         with:
           egress-policy: block
           allowed-endpoints: >

.github/workflows/sdk-code-quality.yml

@@ -29,11 +29,10 @@ jobs:
           - '3.10'
           - '3.11'
           - '3.12'
-          - '3.13'
 
     steps:
       - name: Harden Runner
-        uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0
+        uses: step-security/harden-runner@ab7a9404c0f3da075243ca237b5fac12c98deaa5 # v2.19.3
         with:
           egress-policy: block
           allowed-endpoints: >
@@ -55,7 +54,6 @@ jobs:
           files_ignore: |
             .github/**
             prowler/CHANGELOG.md
-            prowler/changelog.d/**
             docs/**
             permissions/**
             api/**

.github/workflows/sdk-codeql.yml

@@ -12,7 +12,6 @@ on:
       - '.github/workflows/sdk-codeql.yml'
       - '.github/codeql/sdk-codeql-config.yml'
       - '!prowler/CHANGELOG.md'
-      - '!prowler/changelog.d/**'
   pull_request:
     branches:
       - 'master'
@@ -24,7 +23,6 @@ on:
       - '.github/workflows/sdk-codeql.yml'
       - '.github/codeql/sdk-codeql-config.yml'
       - '!prowler/CHANGELOG.md'
-      - '!prowler/changelog.d/**'
   schedule:
     - cron: '00 12 * * *'
 
@@ -53,7 +51,7 @@ jobs:
 
     steps:
       - name: Harden Runner
-        uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0
+        uses: step-security/harden-runner@ab7a9404c0f3da075243ca237b5fac12c98deaa5 # v2.19.3
         with:
           egress-policy: block
           allowed-endpoints: >

.github/workflows/sdk-container-build-push.yml

@@ -54,20 +54,19 @@ jobs:
     timeout-minutes: 5
     outputs:
       prowler_version: ${{ steps.get-prowler-version.outputs.prowler_version }}
-      created: ${{ steps.get-prowler-version.outputs.created }}
       latest_tag: ${{ steps.get-prowler-version.outputs.latest_tag }}
       stable_tag: ${{ steps.get-prowler-version.outputs.stable_tag }}
     permissions:
       contents: read
     steps:
       - name: Harden Runner
-        uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0
+        uses: step-security/harden-runner@ab7a9404c0f3da075243ca237b5fac12c98deaa5 # v2.19.3
         with:
           egress-policy: block
           allowed-endpoints: >
-            files.pythonhosted.org:443
             github.com:443
             pypi.org:443
+            files.pythonhosted.org:443
 
       - name: Checkout repository
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
@@ -87,7 +86,6 @@ jobs:
           fi
           echo "latest_tag=latest" >> "${GITHUB_OUTPUT}"
           echo "stable_tag=stable" >> "${GITHUB_OUTPUT}"
-          echo "created=$(date -u +%Y-%m-%dT%H:%M:%SZ)" >> "${GITHUB_OUTPUT}"
 
   notify-release-started:
     if: github.repository == 'prowler-cloud/prowler' && (github.event_name == 'release' || github.event_name == 'workflow_dispatch')
@@ -100,7 +98,7 @@ jobs:
       contents: read
     steps:
       - name: Harden the runner (Audit all outbound calls)
-        uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0
+        uses: step-security/harden-runner@ab7a9404c0f3da075243ca237b5fac12c98deaa5 # v2.19.3
         with:
           egress-policy: audit
 
@@ -140,32 +138,29 @@ jobs:
     permissions:
       contents: read
       packages: write
-      id-token: write
 
     steps:
       - name: Harden Runner
-        uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0
+        uses: step-security/harden-runner@ab7a9404c0f3da075243ca237b5fac12c98deaa5 # v2.19.3
         with:
           egress-policy: block
           allowed-endpoints: >
-            _http._tcp.deb.debian.org:443
-            aka.ms:443
             api.ecr-public.us-east-1.amazonaws.com:443
-            auth.docker.io:443
-            cdn.powershellgallery.com:443
-            debian.map.fastlydns.net:80
-            files.pythonhosted.org:443
-            github.com:443
-            powershellinfraartifacts-gkhedzdeaghdezhr.z01.azurefd.net:443
+            public.ecr.aws:443
+            registry-1.docker.io:443
             production.cloudflare.docker.com:443
             production.cloudfront.docker.com:443
-            public.ecr.aws:443
-            pypi.org:443
-            registry-1.docker.io:443
+            auth.docker.io:443
+            debian.map.fastlydns.net:80
+            github.com:443
             release-assets.githubusercontent.com:443
-            sts.amazonaws.com:443
-            sts.us-east-1.amazonaws.com:443
+            pypi.org:443
+            files.pythonhosted.org:443
             www.powershellgallery.com:443
+            aka.ms:443
+            cdn.powershellgallery.com:443
+            _http._tcp.deb.debian.org:443
+            powershellinfraartifacts-gkhedzdeaghdezhr.z01.azurefd.net:443
 
       - name: Checkout repository
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
@@ -178,16 +173,14 @@ jobs:
           username: ${{ secrets.DOCKERHUB_USERNAME }}
           password: ${{ secrets.DOCKERHUB_TOKEN }}
 
-      - name: Configure AWS credentials (OIDC)
-        uses: aws-actions/configure-aws-credentials@d979d5b3a71173a29b74b5b88418bfda9437d885 # v6.1.1
-        with:
-          aws-region: us-east-1
-          role-to-assume: ${{ secrets.PUBLIC_ECR_PUSH_ROLE_ARN }}
-
       - name: Login to Public ECR
-        uses: aws-actions/amazon-ecr-login@d539f0932e70871a027e9d5a9d8fc38589180a64 # v2.1.6
+        uses: docker/login-action@4907a6ddec9925e35a0a9e82d7399ccc52663121 # v4.1.0
         with:
-          registry-type: public
+          registry: public.ecr.aws
+          username: ${{ secrets.PUBLIC_ECR_AWS_ACCESS_KEY_ID }}
+          password: ${{ secrets.PUBLIC_ECR_AWS_SECRET_ACCESS_KEY }}
+        env:
+          AWS_REGION: ${{ env.AWS_REGION }}
 
       - name: Set up Docker Buildx
         uses: docker/setup-buildx-action@4d04d5d9486b7bd6fa91e7baf45bbb4f8b9deedd # v4.0.0
@@ -200,20 +193,9 @@ jobs:
           context: .
           file: ${{ env.DOCKERFILE_PATH }}
           push: true
-          sbom: true
-          # max, not the default min: min records little beyond the build ref.
-          provenance: mode=max
           platforms: ${{ matrix.platform }}
           tags: |
             ${{ env.PROWLERCLOUD_DOCKERHUB_REPOSITORY }}/${{ env.PROWLERCLOUD_DOCKERHUB_IMAGE }}:${{ needs.setup.outputs.latest_tag }}-${{ matrix.arch }}
-          labels: |
-            org.opencontainers.image.title=Prowler CLI
-            org.opencontainers.image.description=Open Source security tool for cloud security assessments, audits, incident response, continuous monitoring, hardening and forensics readiness
-            org.opencontainers.image.vendor=ProwlerPro, Inc.
-            org.opencontainers.image.source=https://github.com/${{ github.repository }}
-            org.opencontainers.image.revision=${{ github.sha }}
-            org.opencontainers.image.created=${{ needs.setup.outputs.created }}
-            org.opencontainers.image.version=${{ needs.setup.outputs.prowler_version }}
           cache-from: type=gha,scope=${{ matrix.arch }}
           cache-to: type=gha,mode=${{ github.event_name == 'pull_request' && 'min' || 'max' }},scope=${{ matrix.arch }}
 
@@ -224,24 +206,21 @@ jobs:
     runs-on: ubuntu-latest
     permissions:
       contents: read
-      id-token: write
 
     steps:
       - name: Harden Runner
-        uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0
+        uses: step-security/harden-runner@ab7a9404c0f3da075243ca237b5fac12c98deaa5 # v2.19.3
         with:
           egress-policy: block
           allowed-endpoints: >
-            api.ecr-public.us-east-1.amazonaws.com:443
+            registry-1.docker.io:443
             auth.docker.io:443
-            github.com:443
+            public.ecr.aws:443
             production.cloudflare.docker.com:443
             production.cloudfront.docker.com:443
-            public.ecr.aws:443
-            registry-1.docker.io:443
+            github.com:443
             release-assets.githubusercontent.com:443
-            sts.amazonaws.com:443
-            sts.us-east-1.amazonaws.com:443
+            api.ecr-public.us-east-1.amazonaws.com:443
 
 
       - name: Login to DockerHub
@@ -250,25 +229,23 @@ jobs:
           username: ${{ secrets.DOCKERHUB_USERNAME }}
           password: ${{ secrets.DOCKERHUB_TOKEN }}
 
-      - name: Configure AWS credentials (OIDC)
-        uses: aws-actions/configure-aws-credentials@d979d5b3a71173a29b74b5b88418bfda9437d885 # v6.1.1
-        with:
-          aws-region: us-east-1
-          role-to-assume: ${{ secrets.PUBLIC_ECR_PUSH_ROLE_ARN }}
-
       - name: Login to Public ECR
-        uses: aws-actions/amazon-ecr-login@d539f0932e70871a027e9d5a9d8fc38589180a64 # v2.1.6
+        uses: docker/login-action@4907a6ddec9925e35a0a9e82d7399ccc52663121 # v4.1.0
         with:
-          registry-type: public
+          registry: public.ecr.aws
+          username: ${{ secrets.PUBLIC_ECR_AWS_ACCESS_KEY_ID }}
+          password: ${{ secrets.PUBLIC_ECR_AWS_SECRET_ACCESS_KEY }}
+        env:
+          AWS_REGION: ${{ env.AWS_REGION }}
 
       - name: Create and push manifests for push event
         if: github.event_name == 'push'
         run: |
           docker buildx imagetools create \
-            -t "${{ env.PROWLERCLOUD_DOCKERHUB_REPOSITORY }}/${{ env.PROWLERCLOUD_DOCKERHUB_IMAGE }}:${NEEDS_SETUP_OUTPUTS_LATEST_TAG}" \
-            -t "${{ secrets.PUBLIC_ECR_REPOSITORY }}/${{ env.PROWLERCLOUD_DOCKERHUB_IMAGE }}:${NEEDS_SETUP_OUTPUTS_LATEST_TAG}" \
-            "${{ env.PROWLERCLOUD_DOCKERHUB_REPOSITORY }}/${{ env.PROWLERCLOUD_DOCKERHUB_IMAGE }}:${NEEDS_SETUP_OUTPUTS_LATEST_TAG}-amd64" \
-            "${{ env.PROWLERCLOUD_DOCKERHUB_REPOSITORY }}/${{ env.PROWLERCLOUD_DOCKERHUB_IMAGE }}:${NEEDS_SETUP_OUTPUTS_LATEST_TAG}-arm64"
+            -t ${{ env.PROWLERCLOUD_DOCKERHUB_REPOSITORY }}/${{ env.PROWLERCLOUD_DOCKERHUB_IMAGE }}:${NEEDS_SETUP_OUTPUTS_LATEST_TAG} \
+            -t ${{ secrets.PUBLIC_ECR_REPOSITORY }}/${{ env.PROWLERCLOUD_DOCKERHUB_IMAGE }}:${NEEDS_SETUP_OUTPUTS_LATEST_TAG} \
+            ${{ env.PROWLERCLOUD_DOCKERHUB_REPOSITORY }}/${{ env.PROWLERCLOUD_DOCKERHUB_IMAGE }}:${NEEDS_SETUP_OUTPUTS_LATEST_TAG}-amd64 \
+            ${{ env.PROWLERCLOUD_DOCKERHUB_REPOSITORY }}/${{ env.PROWLERCLOUD_DOCKERHUB_IMAGE }}:${NEEDS_SETUP_OUTPUTS_LATEST_TAG}-arm64
         env:
           NEEDS_SETUP_OUTPUTS_LATEST_TAG: ${{ needs.setup.outputs.latest_tag }}
 
@@ -276,12 +253,12 @@ jobs:
         if: github.event_name == 'release' || github.event_name == 'workflow_dispatch'
         run: |
           docker buildx imagetools create \
-            -t "${{ env.PROWLERCLOUD_DOCKERHUB_REPOSITORY }}/${{ env.PROWLERCLOUD_DOCKERHUB_IMAGE }}:${NEEDS_SETUP_OUTPUTS_PROWLER_VERSION}" \
-            -t "${{ env.PROWLERCLOUD_DOCKERHUB_REPOSITORY }}/${{ env.PROWLERCLOUD_DOCKERHUB_IMAGE }}:${NEEDS_SETUP_OUTPUTS_STABLE_TAG}" \
-            -t "${{ secrets.PUBLIC_ECR_REPOSITORY }}/${{ env.IMAGE_NAME }}:${NEEDS_SETUP_OUTPUTS_PROWLER_VERSION}" \
-            -t "${{ secrets.PUBLIC_ECR_REPOSITORY }}/${{ env.IMAGE_NAME }}:${NEEDS_SETUP_OUTPUTS_STABLE_TAG}" \
-            "${{ env.PROWLERCLOUD_DOCKERHUB_REPOSITORY }}/${{ env.PROWLERCLOUD_DOCKERHUB_IMAGE }}:${NEEDS_SETUP_OUTPUTS_LATEST_TAG}-amd64" \
-            "${{ env.PROWLERCLOUD_DOCKERHUB_REPOSITORY }}/${{ env.PROWLERCLOUD_DOCKERHUB_IMAGE }}:${NEEDS_SETUP_OUTPUTS_LATEST_TAG}-arm64"
+            -t ${{ env.PROWLERCLOUD_DOCKERHUB_REPOSITORY }}/${{ env.PROWLERCLOUD_DOCKERHUB_IMAGE }}:${NEEDS_SETUP_OUTPUTS_PROWLER_VERSION} \
+            -t ${{ env.PROWLERCLOUD_DOCKERHUB_REPOSITORY }}/${{ env.PROWLERCLOUD_DOCKERHUB_IMAGE }}:${NEEDS_SETUP_OUTPUTS_STABLE_TAG} \
+            -t ${{ secrets.PUBLIC_ECR_REPOSITORY }}/${{ env.IMAGE_NAME }}:${NEEDS_SETUP_OUTPUTS_PROWLER_VERSION} \
+            -t ${{ secrets.PUBLIC_ECR_REPOSITORY }}/${{ env.IMAGE_NAME }}:${NEEDS_SETUP_OUTPUTS_STABLE_TAG} \
+            ${{ env.PROWLERCLOUD_DOCKERHUB_REPOSITORY }}/${{ env.PROWLERCLOUD_DOCKERHUB_IMAGE }}:${NEEDS_SETUP_OUTPUTS_LATEST_TAG}-amd64 \
+            ${{ env.PROWLERCLOUD_DOCKERHUB_REPOSITORY }}/${{ env.PROWLERCLOUD_DOCKERHUB_IMAGE }}:${NEEDS_SETUP_OUTPUTS_LATEST_TAG}-arm64
         env:
           NEEDS_SETUP_OUTPUTS_PROWLER_VERSION: ${{ needs.setup.outputs.prowler_version }}
           NEEDS_SETUP_OUTPUTS_STABLE_TAG: ${{ needs.setup.outputs.stable_tag }}
@@ -306,7 +283,7 @@ jobs:
         if: needs.setup.outputs.latest_tag == 'latest' && (github.event_name == 'release' || github.event_name == 'workflow_dispatch')
         run: |
           docker buildx imagetools create \
-            -t "${{ env.TONIBLYX_DOCKERHUB_REPOSITORY }}/${{ env.PROWLERCLOUD_DOCKERHUB_IMAGE }}:${NEEDS_SETUP_OUTPUTS_PROWLER_VERSION}" \
+            -t ${{ env.TONIBLYX_DOCKERHUB_REPOSITORY }}/${{ env.PROWLERCLOUD_DOCKERHUB_IMAGE }}:${NEEDS_SETUP_OUTPUTS_PROWLER_VERSION} \
             -t ${{ env.TONIBLYX_DOCKERHUB_REPOSITORY }}/${{ env.PROWLERCLOUD_DOCKERHUB_IMAGE }}:stable \
             ${{ env.PROWLERCLOUD_DOCKERHUB_REPOSITORY }}/${{ env.PROWLERCLOUD_DOCKERHUB_IMAGE }}:stable
         env:
@@ -322,7 +299,7 @@ jobs:
 
       - name: Install regctl
         if: always()
-        uses: regclient/actions/regctl-installer@9a2d4216180dbb3e2dccfa60d2dd4afd98e42ec5 # main
+        uses: regclient/actions/regctl-installer@da9319db8e44e8b062b3a147e1dfb2f574d41a03 # main
 
       - name: Cleanup intermediate architecture tags
         if: always()
@@ -343,7 +320,7 @@ jobs:
       contents: read
     steps:
       - name: Harden the runner (Audit all outbound calls)
-        uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0
+        uses: step-security/harden-runner@ab7a9404c0f3da075243ca237b5fac12c98deaa5 # v2.19.3
         with:
           egress-policy: audit
 
@@ -356,9 +333,9 @@ jobs:
         id: outcome
         run: |
           if [[ "${NEEDS_CONTAINER_BUILD_PUSH_RESULT}" == "success" && "${NEEDS_CREATE_MANIFEST_RESULT}" == "success" ]]; then
-            echo "outcome=success" >> "$GITHUB_OUTPUT"
+            echo "outcome=success" >> $GITHUB_OUTPUT
           else
-            echo "outcome=failure" >> "$GITHUB_OUTPUT"
+            echo "outcome=failure" >> $GITHUB_OUTPUT
           fi
         env:
           NEEDS_CONTAINER_BUILD_PUSH_RESULT: ${{ needs.container-build-push.result }}

.github/workflows/sdk-container-checks.yml

@@ -10,12 +10,17 @@ on:
       - 'Dockerfile*'
       - 'pyproject.toml'
       - 'uv.lock'
-      - '.trivyignore.yaml'
       - '.github/workflows/sdk-container-checks.yml'
   pull_request:
     branches:
       - 'master'
       - 'v5.*'
+    paths:
+      - 'prowler/**'
+      - 'Dockerfile*'
+      - 'pyproject.toml'
+      - 'uv.lock'
+      - '.github/workflows/sdk-container-checks.yml'
 
 concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}
@@ -36,7 +41,7 @@ jobs:
 
     steps:
       - name: Harden Runner
-        uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0
+        uses: step-security/harden-runner@ab7a9404c0f3da075243ca237b5fac12c98deaa5 # v2.19.3
         with:
           egress-policy: block
           allowed-endpoints: >
@@ -72,7 +77,7 @@ jobs:
 
     steps:
       - name: Harden Runner
-        uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0
+        uses: step-security/harden-runner@ab7a9404c0f3da075243ca237b5fac12c98deaa5 # v2.19.3
         with:
           egress-policy: block
           allowed-endpoints: >
@@ -84,10 +89,6 @@ jobs:
             api.github.com:443
             mirror.gcr.io:443
             check.trivy.dev:443
-            raw.githubusercontent.com:443
-            objects.githubusercontent.com:443
-            grype.anchore.io:443
-            get.anchore.io:443
             debian.map.fastlydns.net:80
             release-assets.githubusercontent.com:443
             objects.githubusercontent.com:443
@@ -99,8 +100,6 @@ jobs:
             _http._tcp.deb.debian.org:443
             powershellinfraartifacts-gkhedzdeaghdezhr.z01.azurefd.net:443
             get.trivy.dev:443
-            raw.githubusercontent.com:443
-            releases.astral.sh:443
 
       - name: Checkout repository
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
@@ -112,20 +111,25 @@ jobs:
         id: check-changes
         uses: tj-actions/changed-files@9426d40962ed5378910ee2e21d5f8c6fcbf2dd96 # v47.0.6
         with:
-          files: |
-            prowler/**
-            Dockerfile*
-            pyproject.toml
-            uv.lock
-            .trivyignore.yaml
-            .github/workflows/sdk-container-checks.yml
-            .github/actions/trivy-scan/**
-            .github/actions/grype-scan/**
-            .grype.yaml
-            .github/scripts/grype-pr-comment.js
+          files: ./**
           files_ignore: |
+            .github/**
             prowler/CHANGELOG.md
-            prowler/changelog.d/**
+            docs/**
+            permissions/**
+            api/**
+            ui/**
+            dashboard/**
+            mcp_server/**
+            skills/**
+            README.md
+            mkdocs.yml
+            .backportrc.json
+            .env
+            docker-compose*
+            examples/**
+            .gitignore
+            contrib/**
             **/AGENTS.md
 
       - name: Set up Docker Buildx
@@ -149,13 +153,5 @@ jobs:
         with:
           image-name: ${{ env.IMAGE_NAME }}
           image-tag: ${{ github.sha }}
-          fail-on-severity: 'high'
-          severity: 'CRITICAL,HIGH'
-
-      - name: Scan SDK container with Grype
-        if: steps.check-changes.outputs.any_changed == 'true'
-        uses: ./.github/actions/grype-scan
-        with:
-          image-name: ${{ env.IMAGE_NAME }}
-          image-tag: ${{ github.sha }}
-          fail-on-severity: 'high'
+          fail-on-critical: 'false'
+          severity: 'CRITICAL'

.github/workflows/sdk-package-checks.yml

@@ -1,196 +0,0 @@
-name: 'SDK: Package Checks'
-
-# Rehearses the PyPI release on every packaging change and once a week, from the
-# consumer's side. Two incidents this guards against:
-#
-# - 5.38.0 shipped an unsatisfiable Requires-Dist (cryptography==50.0.0 while
-#   alibabacloud-tea-openapi and pyopenssl cap it below 49). A [tool.uv] override hid
-#   the conflict inside the repo; pip could not install the wheel and silently
-#   resolved `pip install prowler` to 5.37.1 for a week.
-# - 5.39.0 never published: an unpinned build backend started emitting core metadata
-#   2.5 and the twine bundled in the publish action rejected it.
-#
-# Both were only detectable at release time because nothing built and installed the
-# artifact earlier. The weekly run also catches releases yanked from PyPI after we
-# pinned them (zstd 1.5.7.3, "buggy - not thread safe", sat in uv.lock for months).
-
-on:
-  push:
-    branches:
-      - 'master'
-      - 'v5.*'
-  pull_request:
-    branches:
-      - 'master'
-      - 'v5.*'
-  schedule:
-    # Monday 06:00 UTC. Yanks and upstream releases happen without a commit here.
-    - cron: '0 6 * * 1'
-  workflow_dispatch:
-
-concurrency:
-  group: ${{ github.workflow }}-${{ github.ref }}
-  cancel-in-progress: true
-
-permissions: {}
-
-env:
-  # Must equal the twine bundled in the pypa/gh-action-pypi-publish pin used by
-  # sdk-pypi-release.yml (requirements/runtime.txt in that repo at the pinned tag).
-  # A metadata check that passes here must pass there.
-  TWINE_VERSION: '7.0.0'
-
-jobs:
-  changes:
-    if: github.repository == 'prowler-cloud/prowler'
-    runs-on: ubuntu-latest
-    timeout-minutes: 5
-    permissions:
-      contents: read
-    outputs:
-      # Scheduled and manual runs always execute; pushes and PRs only when a packaging
-      # input changed. Jobs skipped this way still report success to branch protection.
-      run: ${{ github.event_name == 'schedule' || github.event_name == 'workflow_dispatch' || steps.filter.outputs.any_changed == 'true' }}
-
-    steps:
-      - name: Harden the runner (Audit all outbound calls)
-        uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0
-        with:
-          egress-policy: block
-          allowed-endpoints: >
-            github.com:443
-            api.github.com:443
-
-      - name: Checkout repository
-        if: github.event_name == 'push' || github.event_name == 'pull_request'
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
-        with:
-          # zizmor: ignore[artipacked]
-          persist-credentials: true # Required by tj-actions/changed-files to fetch PR branch
-
-      - name: Detect packaging changes
-        if: github.event_name == 'push' || github.event_name == 'pull_request'
-        id: filter
-        uses: tj-actions/changed-files@9426d40962ed5378910ee2e21d5f8c6fcbf2dd96 # v47.0.6
-        with:
-          files: |
-            pyproject.toml
-            uv.lock
-            README.md
-            util/replicate_pypi_package.py
-            util/check_yanked_pins.py
-            api/pyproject.toml
-            api/uv.lock
-            mcp_server/pyproject.toml
-            mcp_server/uv.lock
-            .github/workflows/sdk-package-checks.yml
-            .github/workflows/sdk-pypi-release.yml
-            .github/actions/setup-python-uv/**
-
-  install-from-wheel:
-    needs: changes
-    if: needs.changes.outputs.run == 'true'
-    runs-on: ubuntu-latest
-    timeout-minutes: 20
-    permissions:
-      contents: read
-    strategy:
-      fail-fast: false
-      matrix:
-        python-version:
-          - '3.10'
-          - '3.11'
-          - '3.12'
-          - '3.13'
-        package:
-          - 'prowler'
-        include:
-          # prowler-cloud is the same tree renamed by util/replicate_pypi_package.py;
-          # one Python is enough to prove the rename and its build still work.
-          - python-version: '3.12'
-            package: 'prowler-cloud'
-
-    steps:
-      - name: Harden the runner (Audit all outbound calls)
-        uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0
-        with:
-          egress-policy: block
-          allowed-endpoints: >
-            github.com:443
-            api.github.com:443
-            release-assets.githubusercontent.com:443
-            pypi.org:443
-            files.pythonhosted.org:443
-
-      - name: Checkout repository
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
-        with:
-          persist-credentials: false
-
-      - name: Setup Python with uv
-        uses: ./.github/actions/setup-python-uv
-        with:
-          python-version: ${{ matrix.python-version }}
-          install-dependencies: 'false'
-
-      - name: Rename package to prowler-cloud
-        if: matrix.package == 'prowler-cloud'
-        run: |
-          pip install --no-cache-dir toml
-          python util/replicate_pypi_package.py
-
-      - name: Build sdist and wheel
-        run: uv build
-
-      - name: Check metadata with the release workflow's twine
-        run: uvx --from "twine==${TWINE_VERSION}" twine check --strict dist/*
-
-      - name: Install the wheel with pip into a clean virtualenv
-        # Plain pip, --isolated, from outside the repo: consumers never see [tool.uv]
-        # override-dependencies or constraint-dependencies, so neither does this step.
-        run: |
-          python -m venv "${RUNNER_TEMP}/consumer"
-          "${RUNNER_TEMP}/consumer/bin/python" -m pip install --quiet --upgrade pip
-          cd "${RUNNER_TEMP}"
-          "${RUNNER_TEMP}/consumer/bin/python" -m pip install --isolated --no-cache-dir "${GITHUB_WORKSPACE}"/dist/*.whl
-
-      - name: Smoke test the installed CLI
-        run: |
-          cd "${RUNNER_TEMP}"
-          "${RUNNER_TEMP}/consumer/bin/prowler" --version
-          # Loads every AWS check module from the installed wheel: catches files missing
-          # from the package. grep fails the step if the summary line never appears.
-          "${RUNNER_TEMP}/consumer/bin/prowler" aws --list-checks | grep 'available checks'
-
-  pinned-releases-not-yanked:
-    needs: changes
-    if: needs.changes.outputs.run == 'true'
-    runs-on: ubuntu-latest
-    timeout-minutes: 10
-    permissions:
-      contents: read
-
-    steps:
-      - name: Harden the runner (Audit all outbound calls)
-        uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0
-        with:
-          egress-policy: block
-          allowed-endpoints: >
-            github.com:443
-            api.github.com:443
-            release-assets.githubusercontent.com:443
-            pypi.org:443
-            files.pythonhosted.org:443
-
-      - name: Checkout repository
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
-        with:
-          persist-credentials: false
-
-      - name: Set up Python
-        uses: actions/setup-python@e797f83bcb11b83ae66e0230d6156d7c80228e7c # v6.0.0
-        with:
-          python-version: '3.12'
-
-      - name: Check every pinned and locked release against PyPI
-        run: python util/check_yanked_pins.py . api mcp_server

.github/workflows/sdk-pypi-release.yml

@@ -28,7 +28,7 @@ jobs:
 
     steps:
       - name: Harden the runner (Audit all outbound calls)
-        uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0
+        uses: step-security/harden-runner@ab7a9404c0f3da075243ca237b5fac12c98deaa5 # v2.19.3
         with:
           egress-policy: audit
 
@@ -66,7 +66,7 @@ jobs:
 
     steps:
       - name: Harden the runner (Audit all outbound calls)
-        uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0
+        uses: step-security/harden-runner@ab7a9404c0f3da075243ca237b5fac12c98deaa5 # v2.19.3
         with:
           egress-policy: audit
 
@@ -84,18 +84,8 @@ jobs:
       - name: Build Prowler package
         run: uv build
 
-      - name: Verify the wheel installs with pip
-        # Same check as "SDK: Package Checks", repeated on the exact artifact about to be
-        # published. Plain pip, --isolated, from outside the repo: an unsatisfiable
-        # Requires-Dist fails here instead of on users' machines (5.38.0 shipped one).
-        run: |
-          python -m venv "${RUNNER_TEMP}/consumer"
-          "${RUNNER_TEMP}/consumer/bin/python" -m pip install --quiet --upgrade pip
-          cd "${RUNNER_TEMP}"
-          "${RUNNER_TEMP}/consumer/bin/python" -m pip install --isolated --no-cache-dir --dry-run "${GITHUB_WORKSPACE}"/dist/*.whl
-
       - name: Publish Prowler package to PyPI
-        uses: pypa/gh-action-pypi-publish@dc37677b2e1c63e2034f94d8a5b11f265b73ba33 # v1.14.2
+        uses: pypa/gh-action-pypi-publish@cef221092ed1bacb1cc03d23a2d87d1d172e277b # v1.14.0
         with:
           print-hash: true
 
@@ -112,7 +102,7 @@ jobs:
 
     steps:
       - name: Harden the runner (Audit all outbound calls)
-        uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0
+        uses: step-security/harden-runner@ab7a9404c0f3da075243ca237b5fac12c98deaa5 # v2.19.3
         with:
           egress-policy: audit
 
@@ -138,17 +128,7 @@ jobs:
       - name: Build prowler-cloud package
         run: uv build
 
-      - name: Verify the wheel installs with pip
-        # Same check as "SDK: Package Checks", repeated on the exact artifact about to be
-        # published. Plain pip, --isolated, from outside the repo: an unsatisfiable
-        # Requires-Dist fails here instead of on users' machines (5.38.0 shipped one).
-        run: |
-          python -m venv "${RUNNER_TEMP}/consumer"
-          "${RUNNER_TEMP}/consumer/bin/python" -m pip install --quiet --upgrade pip
-          cd "${RUNNER_TEMP}"
-          "${RUNNER_TEMP}/consumer/bin/python" -m pip install --isolated --no-cache-dir --dry-run "${GITHUB_WORKSPACE}"/dist/*.whl
-
       - name: Publish prowler-cloud package to PyPI
-        uses: pypa/gh-action-pypi-publish@dc37677b2e1c63e2034f94d8a5b11f265b73ba33 # v1.14.2
+        uses: pypa/gh-action-pypi-publish@cef221092ed1bacb1cc03d23a2d87d1d172e277b # v1.14.0
         with:
           print-hash: true

.github/workflows/sdk-refresh-aws-services-regions.yml

@@ -27,7 +27,7 @@ jobs:
 
     steps:
       - name: Harden the runner (Audit all outbound calls)
-        uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0
+        uses: step-security/harden-runner@ab7a9404c0f3da075243ca237b5fac12c98deaa5 # v2.19.3
         with:
           egress-policy: audit
 

.github/workflows/sdk-refresh-oci-regions.yml

@@ -25,7 +25,7 @@ jobs:
 
     steps:
       - name: Harden the runner (Audit all outbound calls)
-        uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0
+        uses: step-security/harden-runner@ab7a9404c0f3da075243ca237b5fac12c98deaa5 # v2.19.3
         with:
           egress-policy: audit
 

.github/workflows/sdk-security.yml

@@ -19,6 +19,16 @@ on:
     branches:
       - 'master'
       - 'v5.*'
+    paths:
+      - 'prowler/**'
+      - 'tests/**'
+      - 'pyproject.toml'
+      - 'uv.lock'
+      - '.github/workflows/sdk-tests.yml'
+      - '.github/workflows/sdk-security.yml'
+      - '.github/actions/setup-python-uv/**'
+      - '.github/actions/osv-scanner/**'
+      - '.github/scripts/osv-scan.sh'
 
 concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}
@@ -37,7 +47,7 @@ jobs:
 
     steps:
       - name: Harden Runner
-        uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0
+        uses: step-security/harden-runner@ab7a9404c0f3da075243ca237b5fac12c98deaa5 # v2.19.3
         with:
           egress-policy: block
           allowed-endpoints: >
@@ -61,19 +71,27 @@ jobs:
         id: check-changes
         uses: tj-actions/changed-files@9426d40962ed5378910ee2e21d5f8c6fcbf2dd96 # v47.0.6
         with:
-          files: |
-            prowler/**
-            tests/**
-            pyproject.toml
-            uv.lock
-            .github/workflows/sdk-tests.yml
+          files:
+            ./**
             .github/workflows/sdk-security.yml
-            .github/actions/setup-python-uv/**
-            .github/actions/osv-scanner/**
-            .github/scripts/osv-scan.sh
           files_ignore: |
+            .github/**
             prowler/CHANGELOG.md
-            prowler/changelog.d/**
+            docs/**
+            permissions/**
+            api/**
+            ui/**
+            dashboard/**
+            mcp_server/**
+            skills/**
+            README.md
+            mkdocs.yml
+            .backportrc.json
+            .env
+            docker-compose*
+            examples/**
+            .gitignore
+            contrib/**
             **/AGENTS.md
 
       - name: Setup Python with uv

.github/workflows/sdk-tests.yml

@@ -29,11 +29,10 @@ jobs:
           - '3.10'
           - '3.11'
           - '3.12'
-          - '3.13'
 
     steps:
       - name: Harden Runner
-        uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0
+        uses: step-security/harden-runner@ab7a9404c0f3da075243ca237b5fac12c98deaa5 # v2.19.3
         with:
           egress-policy: block
           allowed-endpoints: >
@@ -77,7 +76,6 @@ jobs:
           files_ignore: |
             .github/**
             prowler/CHANGELOG.md
-            prowler/changelog.d/**
             docs/**
             permissions/**
             api/**
@@ -216,8 +214,7 @@ jobs:
           elif [ -z "${STEPS_AWS_SERVICES_OUTPUTS_SERVICE_PATHS}" ]; then
             echo "No AWS service paths detected; skipping AWS tests."
           else
-            read -ra service_paths <<< "${STEPS_AWS_SERVICES_OUTPUTS_SERVICE_PATHS}"
-            uv run pytest -n auto --cov=./prowler/providers/aws --cov-report=xml:aws_coverage.xml "${service_paths[@]}"
+            uv run pytest -n auto --cov=./prowler/providers/aws --cov-report=xml:aws_coverage.xml ${STEPS_AWS_SERVICES_OUTPUTS_SERVICE_PATHS}
           fi
         env:
           STEPS_AWS_SERVICES_OUTPUTS_RUN_ALL: ${{ steps.aws-services.outputs.run_all }}
@@ -592,81 +589,6 @@ jobs:
           flags: prowler-py${{ matrix.python-version }}-stackit
           files: ./stackit_coverage.xml
 
-      # Linode Provider
-      - name: Check if Linode files changed
-        if: steps.check-changes.outputs.any_changed == 'true'
-        id: changed-linode
-        uses: tj-actions/changed-files@9426d40962ed5378910ee2e21d5f8c6fcbf2dd96 # v47.0.6
-        with:
-          files: |
-            ./prowler/**/linode/**
-            ./tests/**/linode/**
-            ./uv.lock
-
-      - name: Run Linode tests
-        if: steps.changed-linode.outputs.any_changed == 'true'
-        run: uv run pytest -n auto --cov=./prowler/providers/linode --cov-report=xml:linode_coverage.xml tests/providers/linode
-
-      - name: Upload Linode coverage to Codecov
-        if: steps.changed-linode.outputs.any_changed == 'true'
-        uses: codecov/codecov-action@671740ac38dd9b0130fbe1cec585b89eea48d3de # v5.5.2
-        env:
-          CODECOV_TOKEN: ${{ secrets.CODECOV_TOKEN }}
-        with:
-          flags: prowler-py${{ matrix.python-version }}-linode
-          files: ./linode_coverage.xml
-
-      # E2E Networks Provider
-      - name: Check if E2E Networks files changed
-        if: steps.check-changes.outputs.any_changed == 'true'
-        id: changed-e2enetworks
-        uses: tj-actions/changed-files@9426d40962ed5378910ee2e21d5f8c6fcbf2dd96 # v47.0.6
-        with:
-          files: |
-            ./prowler/**/e2enetworks/**
-            ./tests/**/e2enetworks/**
-            ./uv.lock
-
-      - name: Run E2E Networks tests
-        if: steps.changed-e2enetworks.outputs.any_changed == 'true'
-        run: uv run pytest -n auto --cov=./prowler/providers/e2enetworks --cov-report=xml:e2enetworks_coverage.xml tests/providers/e2enetworks
-
-      - name: Upload E2E Networks coverage to Codecov
-        if: steps.changed-e2enetworks.outputs.any_changed == 'true'
-        uses: codecov/codecov-action@671740ac38dd9b0130fbe1cec585b89eea48d3de # v5.5.2
-        env:
-          CODECOV_TOKEN: ${{ secrets.CODECOV_TOKEN }}
-        with:
-          flags: prowler-py${{ matrix.python-version }}-e2enetworks
-          files: ./e2enetworks_coverage.xml
-
-      # External Provider (dynamic loading)
-      - name: Check if External Provider files changed
-        if: steps.check-changes.outputs.any_changed == 'true'
-        id: changed-external
-        uses: tj-actions/changed-files@22103cc46bda19c2b464ffe86db46df6922fd323 # v47.0.5
-        with:
-          files: |
-            ./prowler/providers/common/**
-            ./prowler/config/**
-            ./prowler/lib/**
-            ./tests/providers/external/**
-            ./uv.lock
-
-      - name: Run External Provider tests
-        if: steps.changed-external.outputs.any_changed == 'true'
-        run: uv run pytest -n auto --cov=./prowler/providers/common --cov=./prowler/config --cov=./prowler/lib --cov-report=xml:external_coverage.xml tests/providers/external
-
-      - name: Upload External Provider coverage to Codecov
-        if: steps.changed-external.outputs.any_changed == 'true'
-
-        uses: codecov/codecov-action@671740ac38dd9b0130fbe1cec585b89eea48d3de # v5.5.2
-        env:
-          CODECOV_TOKEN: ${{ secrets.CODECOV_TOKEN }}
-        with:
-          flags: prowler-py${{ matrix.python-version }}-external
-          files: ./external_coverage.xml
-
       # Lib
       - name: Check if Lib files changed
         if: steps.check-changes.outputs.any_changed == 'true'

.github/workflows/test-impact-analysis.yml

@@ -52,7 +52,7 @@ jobs:
 
     steps:
       - name: Harden Runner
-        uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0
+        uses: step-security/harden-runner@ab7a9404c0f3da075243ca237b5fac12c98deaa5 # v2.19.3
         with:
           egress-policy: block
           allowed-endpoints: >
@@ -73,7 +73,7 @@ jobs:
       - name: Setup Python
         uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
         with:
-          python-version: '3.12.13'
+          python-version: '3.12'
 
       - name: Install PyYAML
         run: pip install pyyaml
@@ -84,8 +84,7 @@ jobs:
           echo "Changed files:"
           echo "${STEPS_CHANGED_FILES_OUTPUTS_ALL_CHANGED_FILES}" | tr ' ' '\n'
           echo ""
-          read -ra changed <<< "${STEPS_CHANGED_FILES_OUTPUTS_ALL_CHANGED_FILES}"
-          python .github/scripts/test-impact.py "${changed[@]}"
+          python .github/scripts/test-impact.py ${STEPS_CHANGED_FILES_OUTPUTS_ALL_CHANGED_FILES}
         env:
           STEPS_CHANGED_FILES_OUTPUTS_ALL_CHANGED_FILES: ${{ steps.changed-files.outputs.all_changed_files }}
 
@@ -93,21 +92,21 @@ jobs:
         id: set-flags
         run: |
           if [[ -n "${STEPS_IMPACT_OUTPUTS_SDK_TESTS}" ]]; then
-            echo "has-sdk-tests=true" >> "$GITHUB_OUTPUT"
+            echo "has-sdk-tests=true" >> $GITHUB_OUTPUT
           else
-            echo "has-sdk-tests=false" >> "$GITHUB_OUTPUT"
+            echo "has-sdk-tests=false" >> $GITHUB_OUTPUT
           fi
 
           if [[ -n "${STEPS_IMPACT_OUTPUTS_API_TESTS}" ]]; then
-            echo "has-api-tests=true" >> "$GITHUB_OUTPUT"
+            echo "has-api-tests=true" >> $GITHUB_OUTPUT
           else
-            echo "has-api-tests=false" >> "$GITHUB_OUTPUT"
+            echo "has-api-tests=false" >> $GITHUB_OUTPUT
           fi
 
           if [[ -n "${STEPS_IMPACT_OUTPUTS_UI_E2E}" ]]; then
-            echo "has-ui-e2e=true" >> "$GITHUB_OUTPUT"
+            echo "has-ui-e2e=true" >> $GITHUB_OUTPUT
           else
-            echo "has-ui-e2e=false" >> "$GITHUB_OUTPUT"
+            echo "has-ui-e2e=false" >> $GITHUB_OUTPUT
           fi
         env:
           STEPS_IMPACT_OUTPUTS_SDK_TESTS: ${{ steps.impact.outputs.sdk-tests }}
@@ -116,22 +115,22 @@ jobs:
 
       - name: Summary
         run: |
-          echo "## Test Impact Analysis" >> "$GITHUB_STEP_SUMMARY"
-          echo "" >> "$GITHUB_STEP_SUMMARY"
+          echo "## Test Impact Analysis" >> $GITHUB_STEP_SUMMARY
+          echo "" >> $GITHUB_STEP_SUMMARY
 
           if [[ "${STEPS_IMPACT_OUTPUTS_RUN_ALL}" == "true" ]]; then
-            echo "🚨 **Critical path changed - running ALL tests**" >> "$GITHUB_STEP_SUMMARY"
+            echo "🚨 **Critical path changed - running ALL tests**" >> $GITHUB_STEP_SUMMARY
           else
-            echo "### Affected Modules" >> "$GITHUB_STEP_SUMMARY"
-            echo "\`${STEPS_IMPACT_OUTPUTS_MODULES}\`" >> "$GITHUB_STEP_SUMMARY"
-            echo "" >> "$GITHUB_STEP_SUMMARY"
+            echo "### Affected Modules" >> $GITHUB_STEP_SUMMARY
+            echo "\`${STEPS_IMPACT_OUTPUTS_MODULES}\`" >> $GITHUB_STEP_SUMMARY
+            echo "" >> $GITHUB_STEP_SUMMARY
 
-            echo "### Tests to Run" >> "$GITHUB_STEP_SUMMARY"
-            echo "| Category | Paths |" >> "$GITHUB_STEP_SUMMARY"
-            echo "|----------|-------|" >> "$GITHUB_STEP_SUMMARY"
-            echo "| SDK Tests | \`${STEPS_IMPACT_OUTPUTS_SDK_TESTS:-none}\` |" >> "$GITHUB_STEP_SUMMARY"
-            echo "| API Tests | \`${STEPS_IMPACT_OUTPUTS_API_TESTS:-none}\` |" >> "$GITHUB_STEP_SUMMARY"
-            echo "| UI E2E | \`${STEPS_IMPACT_OUTPUTS_UI_E2E:-none}\` |" >> "$GITHUB_STEP_SUMMARY"
+            echo "### Tests to Run" >> $GITHUB_STEP_SUMMARY
+            echo "| Category | Paths |" >> $GITHUB_STEP_SUMMARY
+            echo "|----------|-------|" >> $GITHUB_STEP_SUMMARY
+            echo "| SDK Tests | \`${STEPS_IMPACT_OUTPUTS_SDK_TESTS:-none}\` |" >> $GITHUB_STEP_SUMMARY
+            echo "| API Tests | \`${STEPS_IMPACT_OUTPUTS_API_TESTS:-none}\` |" >> $GITHUB_STEP_SUMMARY
+            echo "| UI E2E | \`${STEPS_IMPACT_OUTPUTS_UI_E2E:-none}\` |" >> $GITHUB_STEP_SUMMARY
           fi
 
         env:

.github/workflows/ui-codeql.yml

@@ -10,7 +10,6 @@ on:
       - '.github/workflows/ui-codeql.yml'
       - '.github/codeql/ui-codeql-config.yml'
       - '!ui/CHANGELOG.md'
-      - '!ui/changelog.d/**'
   pull_request:
     branches:
       - 'master'
@@ -20,7 +19,6 @@ on:
       - '.github/workflows/ui-codeql.yml'
       - '.github/codeql/ui-codeql-config.yml'
       - '!ui/CHANGELOG.md'
-      - '!ui/changelog.d/**'
   schedule:
     - cron: '00 12 * * *'
 
@@ -49,7 +47,7 @@ jobs:
 
     steps:
       - name: Harden Runner
-        uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0
+        uses: step-security/harden-runner@ab7a9404c0f3da075243ca237b5fac12c98deaa5 # v2.19.3
         with:
           egress-policy: block
           allowed-endpoints: >

.github/workflows/ui-container-build-push.yml

@@ -32,6 +32,9 @@ env:
   PROWLERCLOUD_DOCKERHUB_REPOSITORY: prowlercloud
   PROWLERCLOUD_DOCKERHUB_IMAGE: prowler-ui
 
+  # Build args
+  NEXT_PUBLIC_API_BASE_URL: http://prowler-api:8080/api/v1
+
 permissions: {}
 
 jobs:
@@ -41,20 +44,17 @@ jobs:
     timeout-minutes: 5
     outputs:
       short-sha: ${{ steps.set-short-sha.outputs.short-sha }}
-      created: ${{ steps.set-short-sha.outputs.created }}
     permissions:
       contents: read
     steps:
-      - name: Harden Runner
-        uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0
+      - name: Harden the runner (Audit all outbound calls)
+        uses: step-security/harden-runner@ab7a9404c0f3da075243ca237b5fac12c98deaa5 # v2.19.3
         with:
-          egress-policy: block
+          egress-policy: audit
 
       - name: Calculate short SHA
         id: set-short-sha
-        run: |
-          echo "short-sha=${GITHUB_SHA::7}" >> "${GITHUB_OUTPUT}"
-          echo "created=$(date -u +%Y-%m-%dT%H:%M:%SZ)" >> "${GITHUB_OUTPUT}"
+        run: echo "short-sha=${GITHUB_SHA::7}" >> $GITHUB_OUTPUT
 
   notify-release-started:
     if: github.repository == 'prowler-cloud/prowler' && (github.event_name == 'release' || github.event_name == 'workflow_dispatch')
@@ -67,7 +67,7 @@ jobs:
       contents: read
     steps:
       - name: Harden the runner (Audit all outbound calls)
-        uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0
+        uses: step-security/harden-runner@ab7a9404c0f3da075243ca237b5fac12c98deaa5 # v2.19.3
         with:
           egress-policy: audit
 
@@ -110,19 +110,19 @@ jobs:
 
     steps:
       - name: Harden Runner
-        uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0
+        uses: step-security/harden-runner@ab7a9404c0f3da075243ca237b5fac12c98deaa5 # v2.19.3
         with:
           egress-policy: block
           allowed-endpoints: >
+            registry-1.docker.io:443
+            production.cloudflare.docker.com:443
+            production.cloudfront.docker.com:443
             auth.docker.io:443
+            registry.npmjs.org:443
             dl-cdn.alpinelinux.org:443
             fonts.googleapis.com:443
             fonts.gstatic.com:443
             github.com:443
-            production.cloudflare.docker.com:443
-            production.cloudfront.docker.com:443
-            registry-1.docker.io:443
-            registry.npmjs.org:443
 
       - name: Checkout repository
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
@@ -146,21 +146,11 @@ jobs:
           context: ${{ env.WORKING_DIRECTORY }}
           build-args: |
             NEXT_PUBLIC_PROWLER_RELEASE_VERSION=${{ (github.event_name == 'release' || github.event_name == 'workflow_dispatch') && format('v{0}', env.RELEASE_TAG) || needs.setup.outputs.short-sha }}
+            NEXT_PUBLIC_API_BASE_URL=${{ env.NEXT_PUBLIC_API_BASE_URL }}
           push: true
-          sbom: true
-          # max, not the default min: min records little beyond the build ref.
-          provenance: mode=max
           platforms: ${{ matrix.platform }}
           tags: |
             ${{ env.PROWLERCLOUD_DOCKERHUB_REPOSITORY }}/${{ env.PROWLERCLOUD_DOCKERHUB_IMAGE }}:${{ needs.setup.outputs.short-sha }}-${{ matrix.arch }}
-          labels: |
-            org.opencontainers.image.title=Prowler Local Server UI
-            org.opencontainers.image.description=Web UI for Prowler Local Server (Next.js)
-            org.opencontainers.image.vendor=ProwlerPro, Inc.
-            org.opencontainers.image.source=https://github.com/${{ github.repository }}
-            org.opencontainers.image.revision=${{ github.sha }}
-            org.opencontainers.image.created=${{ needs.setup.outputs.created }}
-            ${{ (github.event_name == 'release' || github.event_name == 'workflow_dispatch') && format('org.opencontainers.image.version={0}', env.RELEASE_TAG) || '' }}
           cache-from: type=gha,scope=${{ matrix.arch }}
           cache-to: type=gha,mode=${{ github.event_name == 'pull_request' && 'min' || 'max' }},scope=${{ matrix.arch }}
 
@@ -174,16 +164,16 @@ jobs:
 
     steps:
       - name: Harden Runner
-        uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0
+        uses: step-security/harden-runner@ab7a9404c0f3da075243ca237b5fac12c98deaa5 # v2.19.3
         with:
           egress-policy: block
           allowed-endpoints: >
-            auth.docker.io:443
             github.com:443
+            release-assets.githubusercontent.com:443
+            registry-1.docker.io:443
+            auth.docker.io:443
             production.cloudflare.docker.com:443
             production.cloudfront.docker.com:443
-            registry-1.docker.io:443
-            release-assets.githubusercontent.com:443
 
       - name: Login to DockerHub
         uses: docker/login-action@4907a6ddec9925e35a0a9e82d7399ccc52663121 # v4.1.0
@@ -196,9 +186,9 @@ jobs:
         run: |
           docker buildx imagetools create \
             -t ${{ env.PROWLERCLOUD_DOCKERHUB_REPOSITORY }}/${{ env.PROWLERCLOUD_DOCKERHUB_IMAGE }}:${{ env.LATEST_TAG }} \
-            -t "${{ env.PROWLERCLOUD_DOCKERHUB_REPOSITORY }}/${{ env.PROWLERCLOUD_DOCKERHUB_IMAGE }}:${NEEDS_SETUP_OUTPUTS_SHORT_SHA}" \
-            "${{ env.PROWLERCLOUD_DOCKERHUB_REPOSITORY }}/${{ env.PROWLERCLOUD_DOCKERHUB_IMAGE }}:${NEEDS_SETUP_OUTPUTS_SHORT_SHA}-amd64" \
-            "${{ env.PROWLERCLOUD_DOCKERHUB_REPOSITORY }}/${{ env.PROWLERCLOUD_DOCKERHUB_IMAGE }}:${NEEDS_SETUP_OUTPUTS_SHORT_SHA}-arm64"
+            -t ${{ env.PROWLERCLOUD_DOCKERHUB_REPOSITORY }}/${{ env.PROWLERCLOUD_DOCKERHUB_IMAGE }}:${NEEDS_SETUP_OUTPUTS_SHORT_SHA} \
+            ${{ env.PROWLERCLOUD_DOCKERHUB_REPOSITORY }}/${{ env.PROWLERCLOUD_DOCKERHUB_IMAGE }}:${NEEDS_SETUP_OUTPUTS_SHORT_SHA}-amd64 \
+            ${{ env.PROWLERCLOUD_DOCKERHUB_REPOSITORY }}/${{ env.PROWLERCLOUD_DOCKERHUB_IMAGE }}:${NEEDS_SETUP_OUTPUTS_SHORT_SHA}-arm64
         env:
           NEEDS_SETUP_OUTPUTS_SHORT_SHA: ${{ needs.setup.outputs.short-sha }}
 
@@ -206,16 +196,16 @@ jobs:
         if: github.event_name == 'release' || github.event_name == 'workflow_dispatch'
         run: |
           docker buildx imagetools create \
-            -t "${{ env.PROWLERCLOUD_DOCKERHUB_REPOSITORY }}/${{ env.PROWLERCLOUD_DOCKERHUB_IMAGE }}:${RELEASE_TAG}" \
+            -t ${{ env.PROWLERCLOUD_DOCKERHUB_REPOSITORY }}/${{ env.PROWLERCLOUD_DOCKERHUB_IMAGE }}:${RELEASE_TAG} \
             -t ${{ env.PROWLERCLOUD_DOCKERHUB_REPOSITORY }}/${{ env.PROWLERCLOUD_DOCKERHUB_IMAGE }}:${{ env.STABLE_TAG }} \
-            "${{ env.PROWLERCLOUD_DOCKERHUB_REPOSITORY }}/${{ env.PROWLERCLOUD_DOCKERHUB_IMAGE }}:${NEEDS_SETUP_OUTPUTS_SHORT_SHA}-amd64" \
-            "${{ env.PROWLERCLOUD_DOCKERHUB_REPOSITORY }}/${{ env.PROWLERCLOUD_DOCKERHUB_IMAGE }}:${NEEDS_SETUP_OUTPUTS_SHORT_SHA}-arm64"
+            ${{ env.PROWLERCLOUD_DOCKERHUB_REPOSITORY }}/${{ env.PROWLERCLOUD_DOCKERHUB_IMAGE }}:${NEEDS_SETUP_OUTPUTS_SHORT_SHA}-amd64 \
+            ${{ env.PROWLERCLOUD_DOCKERHUB_REPOSITORY }}/${{ env.PROWLERCLOUD_DOCKERHUB_IMAGE }}:${NEEDS_SETUP_OUTPUTS_SHORT_SHA}-arm64
         env:
           NEEDS_SETUP_OUTPUTS_SHORT_SHA: ${{ needs.setup.outputs.short-sha }}
 
       - name: Install regctl
         if: always()
-        uses: regclient/actions/regctl-installer@9a2d4216180dbb3e2dccfa60d2dd4afd98e42ec5 # main
+        uses: regclient/actions/regctl-installer@da9319db8e44e8b062b3a147e1dfb2f574d41a03 # main
 
       - name: Cleanup intermediate architecture tags
         if: always()
@@ -236,7 +226,7 @@ jobs:
       contents: read
     steps:
       - name: Harden the runner (Audit all outbound calls)
-        uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0
+        uses: step-security/harden-runner@ab7a9404c0f3da075243ca237b5fac12c98deaa5 # v2.19.3
         with:
           egress-policy: audit
 
@@ -249,9 +239,9 @@ jobs:
         id: outcome
         run: |
           if [[ "${NEEDS_CONTAINER_BUILD_PUSH_RESULT}" == "success" && "${NEEDS_CREATE_MANIFEST_RESULT}" == "success" ]]; then
-            echo "outcome=success" >> "$GITHUB_OUTPUT"
+            echo "outcome=success" >> $GITHUB_OUTPUT
           else
-            echo "outcome=failure" >> "$GITHUB_OUTPUT"
+            echo "outcome=failure" >> $GITHUB_OUTPUT
           fi
         env:
           NEEDS_CONTAINER_BUILD_PUSH_RESULT: ${{ needs.container-build-push.result }}
@@ -272,3 +262,27 @@ jobs:
           payload-file-path: "./.github/scripts/slack-messages/container-release-completed.json"
           step-outcome: ${{ steps.outcome.outputs.outcome }}
           update-ts: ${{ needs.notify-release-started.outputs.message-ts }}
+
+  trigger-deployment:
+    needs: [setup, container-build-push]
+    if: always() && github.event_name == 'push' && needs.setup.result == 'success' && needs.container-build-push.result == 'success'
+    runs-on: ubuntu-latest
+    timeout-minutes: 5
+    permissions:
+      contents: read
+
+    steps:
+      - name: Harden Runner
+        uses: step-security/harden-runner@ab7a9404c0f3da075243ca237b5fac12c98deaa5 # v2.19.3
+        with:
+          egress-policy: block
+          allowed-endpoints: >
+            api.github.com:443
+
+      - name: Trigger UI deployment
+        uses: peter-evans/repository-dispatch@28959ce8df70de7be546dd1250a005dd32156697 # v4.0.1
+        with:
+          token: ${{ secrets.PROWLER_BOT_ACCESS_TOKEN }}
+          repository: ${{ secrets.CLOUD_DISPATCH }}
+          event-type: ui-prowler-deployment
+          client-payload: '{"sha": "${{ github.sha }}", "short_sha": "${{ needs.setup.outputs.short-sha }}"}'

.github/workflows/ui-container-checks.yml

@@ -12,6 +12,9 @@ on:
     branches:
       - 'master'
       - 'v5.*'
+    paths:
+      - 'ui/**'
+      - '.github/workflows/ui-container-checks.yml'
 
 concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}
@@ -33,7 +36,7 @@ jobs:
 
     steps:
       - name: Harden Runner
-        uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0
+        uses: step-security/harden-runner@ab7a9404c0f3da075243ca237b5fac12c98deaa5 # v2.19.3
         with:
           egress-policy: block
           allowed-endpoints: >
@@ -69,7 +72,7 @@ jobs:
 
     steps:
       - name: Harden Runner
-        uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0
+        uses: step-security/harden-runner@ab7a9404c0f3da075243ca237b5fac12c98deaa5 # v2.19.3
         with:
           egress-policy: block
           allowed-endpoints: >
@@ -88,9 +91,6 @@ jobs:
             get.trivy.dev:443
             release-assets.githubusercontent.com:443
             objects.githubusercontent.com:443
-            raw.githubusercontent.com:443
-            grype.anchore.io:443
-            get.anchore.io:443
 
       - name: Checkout repository
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
@@ -102,16 +102,9 @@ jobs:
         id: check-changes
         uses: tj-actions/changed-files@9426d40962ed5378910ee2e21d5f8c6fcbf2dd96 # v47.0.6
         with:
-          files: |
-            ui/**
-            .trivyignore.yaml
-            .github/actions/trivy-scan/**
-            .github/actions/grype-scan/**
-            .grype.yaml
-            .github/scripts/grype-pr-comment.js
+          files: ui/**
           files_ignore: |
             ui/CHANGELOG.md
-            ui/changelog.d/**
             ui/README.md
             ui/AGENTS.md
 
@@ -139,13 +132,5 @@ jobs:
         with:
           image-name: ${{ env.IMAGE_NAME }}
           image-tag: ${{ github.sha }}
-          fail-on-severity: 'high'
-          severity: 'CRITICAL,HIGH'
-
-      - name: Scan UI container with Grype
-        if: steps.check-changes.outputs.any_changed == 'true'
-        uses: ./.github/actions/grype-scan
-        with:
-          image-name: ${{ env.IMAGE_NAME }}
-          image-tag: ${{ github.sha }}
-          fail-on-severity: 'high'
+          fail-on-critical: 'false'
+          severity: 'CRITICAL'

.github/workflows/ui-e2e-tests-v2.yml

@@ -14,8 +14,6 @@ on:
       - '.github/test-impact.yml'
       - 'ui/**'
       - 'api/**'  # API changes can affect UI E2E
-      - '!ui/CHANGELOG.md'
-      - '!api/CHANGELOG.md'
 
 concurrency:
   group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
@@ -36,15 +34,13 @@ jobs:
     needs: impact-analysis
     if: |
       github.repository == 'prowler-cloud/prowler' &&
-      (github.event_name != 'pull_request' || github.event.pull_request.head.repo.fork == false) &&
       (needs.impact-analysis.outputs.has-ui-e2e == 'true' || needs.impact-analysis.outputs.run-all == 'true')
     runs-on: ubuntu-latest
     env:
       AUTH_SECRET: 'fallback-ci-secret-for-testing'
       AUTH_TRUST_HOST: true
       NEXTAUTH_URL: 'http://localhost:3000'
-      AUTH_URL: 'http://localhost:3000'
-      UI_API_BASE_URL: 'http://localhost:8080/api/v1'
+      NEXT_PUBLIC_API_BASE_URL: 'http://localhost:8080/api/v1'
       E2E_ADMIN_USER: ${{ secrets.E2E_ADMIN_USER }}
       E2E_ADMIN_PASSWORD: ${{ secrets.E2E_ADMIN_PASSWORD }}
       E2E_AWS_PROVIDER_ACCOUNT_ID: ${{ secrets.E2E_AWS_PROVIDER_ACCOUNT_ID }}
@@ -81,14 +77,6 @@ jobs:
       E2E_ALIBABACLOUD_ACCESS_KEY_ID: ${{ secrets.E2E_ALIBABACLOUD_ACCESS_KEY_ID }}
       E2E_ALIBABACLOUD_ACCESS_KEY_SECRET: ${{ secrets.E2E_ALIBABACLOUD_ACCESS_KEY_SECRET }}
       E2E_ALIBABACLOUD_ROLE_ARN: ${{ secrets.E2E_ALIBABACLOUD_ROLE_ARN }}
-      E2E_OKTA_DOMAIN: ${{ secrets.E2E_OKTA_DOMAIN }}
-      E2E_OKTA_CLIENT_ID: ${{ secrets.E2E_OKTA_CLIENT_ID }}
-      E2E_OKTA_BASE64_PRIVATE_KEY: ${{ secrets.E2E_OKTA_BASE64_PRIVATE_KEY }}
-      E2E_GOOGLEWORKSPACE_CUSTOMER_ID: ${{ secrets.E2E_GOOGLEWORKSPACE_CUSTOMER_ID }}
-      E2E_GOOGLEWORKSPACE_SERVICE_ACCOUNT_JSON: ${{ secrets.E2E_GOOGLEWORKSPACE_SERVICE_ACCOUNT_JSON }}
-      E2E_GOOGLEWORKSPACE_DELEGATED_USER: ${{ secrets.E2E_GOOGLEWORKSPACE_DELEGATED_USER }}
-      E2E_VERCEL_TEAM_ID: ${{ secrets.E2E_VERCEL_TEAM_ID }}
-      E2E_VERCEL_API_TOKEN: ${{ secrets.E2E_VERCEL_API_TOKEN }}
       # Pass E2E paths from impact analysis
       E2E_TEST_PATHS: ${{ needs.impact-analysis.outputs.ui-e2e }}
       RUN_ALL_TESTS: ${{ needs.impact-analysis.outputs.run-all }}
@@ -97,7 +85,7 @@ jobs:
 
     steps:
       - name: Harden the runner (Audit all outbound calls)
-        uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0
+        uses: step-security/harden-runner@ab7a9404c0f3da075243ca237b5fac12c98deaa5 # v2.19.3
         with:
           egress-policy: audit
 
@@ -108,115 +96,17 @@ jobs:
 
       - name: Show test scope
         run: |
-          echo "## E2E Test Scope" >> "$GITHUB_STEP_SUMMARY"
+          echo "## E2E Test Scope" >> $GITHUB_STEP_SUMMARY
           if [[ "${RUN_ALL_TESTS}" == "true" ]]; then
-            echo "Running **ALL** E2E tests (critical path changed)" >> "$GITHUB_STEP_SUMMARY"
+            echo "Running **ALL** E2E tests (critical path changed)" >> $GITHUB_STEP_SUMMARY
           else
-            echo "Running tests matching: \`${E2E_TEST_PATHS}\`" >> "$GITHUB_STEP_SUMMARY"
+            echo "Running tests matching: \`${E2E_TEST_PATHS}\`" >> $GITHUB_STEP_SUMMARY
           fi
           echo ""
-          echo "Affected modules: \`${NEEDS_IMPACT_ANALYSIS_OUTPUTS_MODULES}\`" >> "$GITHUB_STEP_SUMMARY"
+          echo "Affected modules: \`${NEEDS_IMPACT_ANALYSIS_OUTPUTS_MODULES}\`" >> $GITHUB_STEP_SUMMARY
         env:
           NEEDS_IMPACT_ANALYSIS_OUTPUTS_MODULES: ${{ needs.impact-analysis.outputs.modules }}
 
-      - name: Validate E2E prerequisites
-        shell: bash
-        run: |
-          declare -A required=()
-
-          suite_selected() {
-            [[ "${RUN_ALL_TESTS}" == "true" ]] ||
-              [[ " ${E2E_TEST_PATHS} " == *"ui/tests/$1/"* ]]
-          }
-
-          require_vars() {
-            local variable
-            for variable in "$@"; do
-              required["${variable}"]=1
-            done
-          }
-
-          if suite_selected auth || suite_selected providers ||
-            suite_selected invitations || suite_selected scans ||
-            suite_selected navigation; then
-            require_vars E2E_ADMIN_USER E2E_ADMIN_PASSWORD
-          fi
-
-          if suite_selected sign-up; then
-            require_vars E2E_NEW_USER_PASSWORD
-          fi
-
-          if suite_selected invitations; then
-            require_vars E2E_NEW_USER_PASSWORD E2E_ORGANIZATION_ID
-          fi
-
-          if suite_selected scans; then
-            require_vars \
-              E2E_AWS_PROVIDER_ACCOUNT_ID \
-              E2E_AWS_PROVIDER_ACCESS_KEY \
-              E2E_AWS_PROVIDER_SECRET_KEY
-          fi
-
-          if suite_selected providers; then
-            require_vars \
-              E2E_AWS_PROVIDER_ACCOUNT_ID \
-              E2E_AWS_PROVIDER_ACCESS_KEY \
-              E2E_AWS_PROVIDER_SECRET_KEY \
-              E2E_AWS_PROVIDER_ROLE_ARN \
-              E2E_AZURE_SUBSCRIPTION_ID \
-              E2E_AZURE_CLIENT_ID \
-              E2E_AZURE_SECRET_ID \
-              E2E_AZURE_TENANT_ID \
-              E2E_M365_DOMAIN_ID \
-              E2E_M365_CLIENT_ID \
-              E2E_M365_SECRET_ID \
-              E2E_M365_TENANT_ID \
-              E2E_M365_CERTIFICATE_CONTENT \
-              E2E_GCP_BASE64_SERVICE_ACCOUNT_KEY \
-              E2E_GCP_PROJECT_ID \
-              E2E_GITHUB_APP_ID \
-              E2E_GITHUB_BASE64_APP_PRIVATE_KEY \
-              E2E_GITHUB_USERNAME \
-              E2E_GITHUB_PERSONAL_ACCESS_TOKEN \
-              E2E_GITHUB_ORGANIZATION \
-              E2E_GITHUB_ORGANIZATION_ACCESS_TOKEN \
-              E2E_OCI_TENANCY_ID \
-              E2E_OCI_USER_ID \
-              E2E_OCI_FINGERPRINT \
-              E2E_OCI_KEY_CONTENT \
-              E2E_ALIBABACLOUD_ACCOUNT_ID \
-              E2E_ALIBABACLOUD_ACCESS_KEY_ID \
-              E2E_ALIBABACLOUD_ACCESS_KEY_SECRET \
-              E2E_ALIBABACLOUD_ROLE_ARN \
-              E2E_OKTA_DOMAIN \
-              E2E_OKTA_CLIENT_ID \
-              E2E_OKTA_BASE64_PRIVATE_KEY \
-              E2E_GOOGLEWORKSPACE_CUSTOMER_ID \
-              E2E_GOOGLEWORKSPACE_SERVICE_ACCOUNT_JSON \
-              E2E_GOOGLEWORKSPACE_DELEGATED_USER \
-              E2E_VERCEL_TEAM_ID \
-              E2E_VERCEL_API_TOKEN
-          fi
-
-          missing=()
-          if (( ${#required[@]} > 0 )); then
-            while IFS= read -r variable; do
-              [[ -z "${!variable:-}" ]] && missing+=("${variable}")
-            done < <(printf '%s\n' "${!required[@]}" | sort)
-          fi
-
-          if (( ${#missing[@]} > 0 )); then
-            echo "Missing required E2E variables:"
-            printf ' - %s\n' "${missing[@]}"
-            {
-              echo "## Missing E2E prerequisites"
-              printf -- "- \`%s\`\n" "${missing[@]}"
-            } >> "${GITHUB_STEP_SUMMARY}"
-            exit 1
-          fi
-
-          echo "E2E prerequisite preflight passed."
-
       - name: Create k8s Kind Cluster
         uses: helm/kind-action@ef37e7f390d99f746eb8b610417061a60e82a6cc # v1
         with:
@@ -233,7 +123,7 @@ jobs:
           yq -i '.services.worker.networks = ["kind","default"]' docker-compose.yml
 
       - name: Fix API data directory permissions
-        run: docker run --rm -v "$(pwd)/_data/api:/data" alpine chown -R 1000:1000 /data
+        run: docker run --rm -v $(pwd)/_data/api:/data alpine chown -R 1000:1000 /data
 
       - name: Add AWS credentials for testing
         run: |
@@ -244,17 +134,7 @@ jobs:
         # docker-compose.yml references prowlercloud/prowler-api:latest from the registry,
         # which lags behind PR changes; build locally so E2E exercises the API image
         # produced by this PR.
-        #
-        # The image installs the SDK from git@master (api/uv.lock), so a PR changing BOTH the SDK
-        # and the API would run against the OLD SDK and crash on startup. Overlay the checkout's
-        # SDK source so both run together. New SDK dependencies still need an api/uv.lock bump.
-        run: |
-          docker build -t prowlercloud/prowler-api:pr-base ./api
-          docker build -t prowlercloud/prowler-api:latest -f - prowler <<'DOCKERFILE'
-          FROM prowlercloud/prowler-api:pr-base
-          RUN rm -rf /home/prowler/.venv/lib/python3.12/site-packages/prowler
-          COPY --chown=prowler:prowler . /home/prowler/.venv/lib/python3.12/site-packages/prowler
-          DOCKERFILE
+        run: docker build -t prowlercloud/prowler-api:latest ./api
 
       - name: Start API services
         run: |
@@ -267,7 +147,7 @@ jobs:
           timeout=150
           elapsed=0
           while [ $elapsed -lt $timeout ]; do
-            if curl -s "${UI_API_BASE_URL}/docs" >/dev/null 2>&1; then
+            if curl -s ${NEXT_PUBLIC_API_BASE_URL}/docs >/dev/null 2>&1; then
               echo "Prowler API is ready!"
               exit 0
             fi
@@ -301,7 +181,7 @@ jobs:
           run_install: false
 
       - name: Get pnpm store directory
-        run: echo "STORE_PATH=$(pnpm store path --silent)" >> "$GITHUB_ENV"
+        run: echo "STORE_PATH=$(pnpm store path --silent)" >> $GITHUB_ENV
 
       - name: Setup pnpm and Next.js cache
         uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.5
@@ -387,8 +267,7 @@ jobs:
             fi
             TEST_PATHS=$(echo "$VALID_PATHS" | tr '\n' ' ')
             echo "Resolved test paths: $TEST_PATHS"
-            read -ra test_paths <<< "$TEST_PATHS"
-            pnpm exec playwright test "${test_paths[@]}"
+            pnpm exec playwright test $TEST_PATHS
           fi
 
       - name: Upload test reports
@@ -404,29 +283,6 @@ jobs:
         run: |
           docker compose down -v || true
 
-  # Fork pull requests cannot access the secrets required by the E2E suites.
-  fork-e2e-unavailable:
-    needs: impact-analysis
-    if: |
-      github.repository == 'prowler-cloud/prowler' &&
-      github.event_name == 'pull_request' &&
-      github.event.pull_request.head.repo.fork == true &&
-      (needs.impact-analysis.outputs.has-ui-e2e == 'true' || needs.impact-analysis.outputs.run-all == 'true')
-    runs-on: ubuntu-latest
-    permissions:
-      contents: read
-    steps:
-      - name: Harden the runner (Audit all outbound calls)
-        uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0
-        with:
-          egress-policy: audit
-
-      - name: Report unavailable E2E tests
-        run: |
-          echo "## E2E Tests Skipped" >> "$GITHUB_STEP_SUMMARY"
-          echo "" >> "$GITHUB_STEP_SUMMARY"
-          echo "UI E2E tests require repository secrets and cannot run for fork pull requests." >> "$GITHUB_STEP_SUMMARY"
-
   # Skip job - provides clear feedback when no E2E tests needed
   skip-e2e:
     needs: impact-analysis
@@ -439,18 +295,18 @@ jobs:
       contents: read
     steps:
       - name: Harden the runner (Audit all outbound calls)
-        uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0
+        uses: step-security/harden-runner@ab7a9404c0f3da075243ca237b5fac12c98deaa5 # v2.19.3
         with:
           egress-policy: audit
 
       - name: No E2E tests needed
         run: |
-          echo "## E2E Tests Skipped" >> "$GITHUB_STEP_SUMMARY"
-          echo "" >> "$GITHUB_STEP_SUMMARY"
-          echo "No UI E2E tests needed for this change." >> "$GITHUB_STEP_SUMMARY"
-          echo "" >> "$GITHUB_STEP_SUMMARY"
-          echo "Affected modules: \`${NEEDS_IMPACT_ANALYSIS_OUTPUTS_MODULES}\`" >> "$GITHUB_STEP_SUMMARY"
-          echo "" >> "$GITHUB_STEP_SUMMARY"
-          echo "To run all tests, modify a file in a critical path (e.g., \`ui/lib/**\`)." >> "$GITHUB_STEP_SUMMARY"
+          echo "## E2E Tests Skipped" >> $GITHUB_STEP_SUMMARY
+          echo "" >> $GITHUB_STEP_SUMMARY
+          echo "No UI E2E tests needed for this change." >> $GITHUB_STEP_SUMMARY
+          echo "" >> $GITHUB_STEP_SUMMARY
+          echo "Affected modules: \`${NEEDS_IMPACT_ANALYSIS_OUTPUTS_MODULES}\`" >> $GITHUB_STEP_SUMMARY
+          echo "" >> $GITHUB_STEP_SUMMARY
+          echo "To run all tests, modify a file in a critical path (e.g., \`ui/lib/**\`)." >> $GITHUB_STEP_SUMMARY
         env:
           NEEDS_IMPACT_ANALYSIS_OUTPUTS_MODULES: ${{ needs.impact-analysis.outputs.modules }}

.github/workflows/ui-security.yml

@@ -15,6 +15,12 @@ on:
     branches:
       - 'master'
       - 'v5.*'
+    paths:
+      - 'ui/package.json'
+      - 'ui/pnpm-lock.yaml'
+      - '.github/workflows/ui-security.yml'
+      - '.github/actions/osv-scanner/**'
+      - '.github/scripts/osv-scan.sh'
 
 concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}
@@ -24,6 +30,7 @@ permissions: {}
 
 jobs:
   ui-security-scans:
+    if: github.repository == 'prowler-cloud/prowler'
     runs-on: ubuntu-latest
     timeout-minutes: 15
     permissions:
@@ -32,7 +39,7 @@ jobs:
 
     steps:
       - name: Harden Runner
-        uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0
+        uses: step-security/harden-runner@ab7a9404c0f3da075243ca237b5fac12c98deaa5 # v2.19.3
         with:
           egress-policy: block
           allowed-endpoints: >

.github/workflows/ui-tests.yml

@@ -31,18 +31,14 @@ jobs:
 
     steps:
       - name: Harden Runner
-        uses: step-security/harden-runner@bf7454d06d71f1098171f2acdf0cd4708d7b5920 # v2.20.0
+        uses: step-security/harden-runner@ab7a9404c0f3da075243ca237b5fac12c98deaa5 # v2.19.3
         with:
           egress-policy: block
           allowed-endpoints: >
             github.com:443
             registry.npmjs.org:443
-            nodejs.org:443
             fonts.googleapis.com:443
             fonts.gstatic.com:443
-            api.iconify.design:443
-            api.simplesvg.com:443
-            api.unisvg.com:443
             api.github.com:443
             release-assets.githubusercontent.com:443
             cdn.playwright.dev:443
@@ -64,7 +60,6 @@ jobs:
             .github/workflows/ui-tests.yml
           files_ignore: |
             ui/CHANGELOG.md
-            ui/changelog.d/**
             ui/README.md
             ui/AGENTS.md
 
@@ -113,7 +108,7 @@ jobs:
       - name: Get pnpm store directory
         if: steps.check-changes.outputs.any_changed == 'true'
         shell: bash
-        run: echo "STORE_PATH=$(pnpm store path --silent)" >> "$GITHUB_ENV"
+        run: echo "STORE_PATH=$(pnpm store path --silent)" >> $GITHUB_ENV
 
       - name: Setup pnpm and Next.js cache
         if: steps.check-changes.outputs.any_changed == 'true'
@@ -136,10 +131,6 @@ jobs:
         if: steps.check-changes.outputs.any_changed == 'true'
         run: pnpm run healthcheck
 
-      - name: Check product-tour alignment
-        if: steps.check-changes.outputs.any_changed == 'true'
-        run: pnpm run tour:check
-
       - name: Run pnpm audit
         if: steps.check-changes.outputs.any_changed == 'true'
         run: pnpm run audit
@@ -157,8 +148,7 @@ jobs:
           echo "${STEPS_CHANGED_SOURCE_OUTPUTS_ALL_CHANGED_FILES}"
           # Convert space-separated to vitest related format (remove ui/ prefix for relative paths)
           CHANGED_FILES=$(echo "${STEPS_CHANGED_SOURCE_OUTPUTS_ALL_CHANGED_FILES}" | tr ' ' '\n' | sed 's|^ui/||' | tr '\n' ' ')
-          read -ra changed <<< "$CHANGED_FILES"
-          pnpm exec vitest related "${changed[@]}" --run --project unit
+          pnpm exec vitest related $CHANGED_FILES --run --project unit
         env:
           STEPS_CHANGED_SOURCE_OUTPUTS_ALL_CHANGED_FILES: ${{ steps.changed-source.outputs.all_changed_files }}
 
@@ -182,9 +172,9 @@ jobs:
         if: steps.check-changes.outputs.any_changed == 'true' && steps.playwright-cache.outputs.cache-hit != 'true'
         run: pnpm exec playwright install chromium
 
-      - name: Run integration tests
+      - name: Run browser tests
         if: steps.check-changes.outputs.any_changed == 'true'
-        run: pnpm run test:integration
+        run: pnpm run test:browser
 
       - name: Build application
         if: steps.check-changes.outputs.any_changed == 'true'

.gitignore

@@ -169,9 +169,3 @@ GEMINI.md
 
 # Claude Code
 .claude/*
-
-# Docker
-docker-compose.override.yml
-docker-compose-dev.override.yml
-# Local Pi runtime state
-.atl/

.grype.yaml

@@ -1,83 +0,0 @@
-# Findings excluded from the Grype gate, each with a reason.
-# Anything not listed here blocks the pull request at critical or high severity.
-# Pairs are explicit: a new CVE against an already-listed package still blocks.
-#
-# Every entry below has a published fix we cannot take. Findings with no fix at all are
-# not listed: the scan runs with only-fixed, so they never reach the gate.
-
-ignore:
-
-  # Modules compiled into the Trivy binary we ship.
-  # Only a Trivy rebuild by its vendor can change these; the version is pinned in our Dockerfile.
-  # CVE-2026-71556 is the same temporary exception documented in .trivyignore.yaml:
-  # Trivy 0.73.0 still embeds go-git 5.19.1, while the 5.19.2 fix is merged only on
-  # Trivy main. Remove this entry with the Trivy exception by 2026-09-15.
-  # https://github.com/aquasecurity/trivy/blob/v0.73.0/go.mod#L46
-  # https://github.com/aquasecurity/trivy/commit/a2edba9a03987ba0d2ebc8212c1a9a1e6979497b
-  - vulnerability: CVE-2026-71556
-    package:
-      name: github.com/go-git/go-git/v5
-  - vulnerability: CVE-2026-56852
-    package:
-      name: golang.org/x/text
-  - vulnerability: GHSA-hrxh-6v49-42gf
-    package:
-      name: google.golang.org/grpc
-  - vulnerability: CVE-2026-50151
-    package:
-      name: oras.land/oras-go/v2
-
-  # Shipped inside the PowerShell tarball, in its bundled MicrosoftTeams module.
-  # Not a dependency we declare, and not one we can upgrade independently.
-  - vulnerability: CVE-2026-26127
-    package:
-      name: Microsoft.Bcl.Memory
-
-  # The .NET runtime bundled inside the PowerShell tarball the Dockerfile pins.
-  # CVE-2026-62901 is the same temporary exception documented in .trivyignore.yaml:
-  # fixed in .NET 9.0.19 / 10.0.11 (2026-08-11), but no published PowerShell release
-  # ships a patched runtime yet (7.5.9 bundles 9.0.18; 7.6.4 bundles 10.0.x < 10.0.11).
-  # pwsh runs only local M365 module cmdlets; nothing listens for inbound WebSocket
-  # connections. Remove with the Trivy exception by 2026-09-15.
-  - vulnerability: CVE-2026-62901
-    package:
-      name: Microsoft.NETCore.App.Runtime.linux-x64
-  - vulnerability: CVE-2026-62901
-    package:
-      name: Microsoft.NETCore.App.Runtime.linux-arm64
-
-
-  # The CPython interpreter, compiled into the official base image.
-  # TEMPORARY, unlike the entries above: moving to Python 3.13 clears seven of these, and
-  # that is a runtime upgrade pending its own evaluation. The remaining three need 3.15 and
-  # are unfixable either way -- the MCP image already runs 3.13.14 and still reports them.
-  - vulnerability: CVE-2026-11940
-    package:
-      name: python
-  - vulnerability: CVE-2026-11972
-    package:
-      name: python
-  - vulnerability: CVE-2026-15308
-    package:
-      name: python
-  - vulnerability: CVE-2026-3298
-    package:
-      name: python
-  - vulnerability: CVE-2026-3644
-    package:
-      name: python
-  - vulnerability: CVE-2026-4224
-    package:
-      name: python
-  - vulnerability: CVE-2026-4786
-    package:
-      name: python
-  - vulnerability: CVE-2026-6100
-    package:
-      name: python
-  - vulnerability: CVE-2026-7210
-    package:
-      name: python
-  - vulnerability: CVE-2026-9669
-    package:
-      name: python

.pre-commit-config.yaml

@@ -7,10 +7,6 @@
 #   P50 — dependency validation
 
 default_install_hook_types: [pre-commit]
-# Hooks run on commit only by default;
-# NOTE: default_stages does NOT override a hook's manifest stages, so fixers shipping pre-push in their
-# manifest need an explicit stages: ["pre-commit"] below to stay off push.
-default_stages: [pre-commit]
 
 repos:
   ## GENERAL (prek built-in — no external repo needed)
@@ -25,16 +21,13 @@ repos:
       - id: check-json
         priority: 10
       - id: end-of-file-fixer
-        stages: ["pre-commit"]
         priority: 0
       - id: trailing-whitespace
-        stages: ["pre-commit"]
         priority: 0
       - id: no-commit-to-branch
         priority: 10
       - id: pretty-format-json
         args: ["--autofix", --no-sort-keys, --no-ensure-ascii]
-        stages: ["pre-commit"]
         priority: 10
 
   ## TOML
@@ -47,14 +40,6 @@ repos:
         priority: 20
 
   ## GITHUB ACTIONS
-  - repo: https://github.com/rhysd/actionlint
-    rev: v1.7.12
-    hooks:
-      - id: actionlint
-        # SC2129 only suggests grouping consecutive redirects; not worth restructuring for.
-        args: ['-shellcheck=-e SC2129']
-        priority: 30
-
   - repo: https://github.com/zizmorcore/zizmor-pre-commit
     rev: v1.24.1
     hooks:
@@ -80,13 +65,13 @@ repos:
         exclude: contrib
         priority: 30
 
-  ## PYTHON — SDK (prowler/, tests/, dashboard/, util/, scripts/, docs/scripts/)
+  ## PYTHON — SDK (prowler/, tests/, dashboard/, util/, scripts/)
   - repo: https://github.com/myint/autoflake
     rev: v2.3.3
     hooks:
       - id: autoflake
         name: "SDK - autoflake"
-        files: { glob: ["{prowler,tests,dashboard,util,scripts,docs/scripts}/**/*.py"] }
+        files: { glob: ["{prowler,tests,dashboard,util,scripts}/**/*.py"] }
         args: ["--in-place", "--remove-all-unused-imports", "--remove-unused-variable"]
         priority: 20
 
@@ -95,9 +80,8 @@ repos:
     hooks:
       - id: isort
         name: "SDK - isort"
-        files: { glob: ["{prowler,tests,dashboard,util,scripts,docs/scripts}/**/*.py"] }
+        files: { glob: ["{prowler,tests,dashboard,util,scripts}/**/*.py"] }
         args: ["--profile", "black"]
-        stages: ["pre-commit"]
         priority: 20
 
   - repo: https://github.com/psf/black
@@ -105,7 +89,7 @@ repos:
     hooks:
       - id: black
         name: "SDK - black"
-        files: { glob: ["{prowler,tests,dashboard,util,scripts,docs/scripts}/**/*.py"] }
+        files: { glob: ["{prowler,tests,dashboard,util,scripts}/**/*.py"] }
         priority: 20
 
   - repo: https://github.com/pycqa/flake8
@@ -113,49 +97,22 @@ repos:
     hooks:
       - id: flake8
         name: "SDK - flake8"
-        files: { glob: ["{prowler,tests,dashboard,util,scripts,docs/scripts}/**/*.py"] }
+        files: { glob: ["{prowler,tests,dashboard,util,scripts}/**/*.py"] }
         args: ["--ignore=E266,W503,E203,E501,W605"]
         priority: 30
 
   ## PYTHON — API + MCP Server (ruff)
-  # Run ruff through `uv run` against each project so prek uses the exact ruff
-  # version pinned in that project's uv.lock — the same version GitHub Actions
-  # runs via `uv run ruff`. This removes the drift between the local hooks and
-  # CI. api/ and mcp_server/ are separate uv projects, so they need separate
-  # hooks (each `uv run --project` resolves its own pinned ruff + config).
-  - repo: local
+  - repo: https://github.com/astral-sh/ruff-pre-commit
+    rev: v0.15.11
     hooks:
-      - id: ruff-check-api
-        name: "API - ruff check"
-        entry: uv run --project ./api ruff check --fix
-        language: system
-        files: { glob: ["api/**/*.py"] }
+      - id: ruff
+        name: "API + MCP - ruff check"
+        files: { glob: ["{api,mcp_server}/**/*.py"] }
+        args: ["--fix"]
         priority: 30
-      - id: ruff-format-api
-        name: "API - ruff format"
-        entry: uv run --project ./api ruff format
-        language: system
-        files: { glob: ["api/**/*.py"] }
-        priority: 20
-      - id: ruff-check-mcp
-        name: "MCP - ruff check"
-        entry: uv run --project ./mcp_server ruff check --fix
-        language: system
-        files: { glob: ["mcp_server/**/*.py"] }
-        priority: 30
-      - id: ruff-format-mcp
-        name: "MCP - ruff format"
-        entry: uv run --project ./mcp_server ruff format
-        language: system
-        files: { glob: ["mcp_server/**/*.py"] }
-        priority: 20
-
-      - id: generate-provider-cards
-        name: "Docs - regenerate provider cards snippet"
-        entry: python3 docs/scripts/generate_provider_cards.py
-        language: system
-        files: { glob: ["docs/user-guide/providers/**/getting-started-*.mdx", "docs/scripts/generate_provider_cards.py", "docs/snippets/provider-cards.mdx", "api/src/backend/api/models.py"] }
-        pass_filenames: false
+      - id: ruff-format
+        name: "API + MCP - ruff format"
+        files: { glob: ["{api,mcp_server}/**/*.py"] }
         priority: 20
 
   ## PYTHON — uv (API + SDK)
@@ -199,7 +156,7 @@ repos:
         entry: pylint --disable=W,C,R,E -j 0 -rn -sn
         language: system
         types: [python]
-        files: { glob: ["{prowler,tests,dashboard,util,scripts,docs/scripts}/**/*.py"] }
+        files: { glob: ["{prowler,tests,dashboard,util,scripts}/**/*.py"] }
         priority: 30
 
       - id: trufflehog

.trivyignore.yaml

@@ -1,166 +0,0 @@
-# Trivy suppressions for the prowlercloud/prowler SDK and API container images.
-#
-# This file replaces the classic .trivyignore, which parsed only the CVE id: the
-# `pkg:` selector written on each line was documentation and the entry suppressed
-# its CVE across every package in the image. The `purls` field below is honoured,
-# so each entry is scoped to the package it names. Verified against Trivy 0.71.2:
-# an entry given the wrong purl leaves the finding reported, where the classic
-# format suppressed it.
-#
-# `expired_at` forces re-review. Keep the dates staggered.
-#
-# The four entries below are currently redundant: the scan runs with ignore-unfixed,
-# and none of them has a published fix, so they never reach the gate either way. They
-# are kept because the reasoning is what justifies accepting them, and because they
-# apply again the moment any of them gains a fix we do not take.
-#
-# perl-base is Debian "Essential: yes". Trivy spreads src:perl CVEs across every
-# binary package built from that source, so perl-base is flagged for modules only
-# perl-modules-* ships. Neither image installs those, and nothing in either
-# invokes perl.
-#
-# Why these four are accepted rather than fixed (reviewed 2026-07-31):
-#
-#   1. No fix exists. All four report no fixed version on perl-base 5.40.1-6.
-#      Debian marks CVE-2026-42496 "fix_deferred" and the other three "affected".
-#      A newer base image, apt upgrade, or a newer Debian release changes nothing.
-#   2. The package cannot be removed. "Essential: yes" means removal needs
-#      dpkg --force-remove-essential, which breaks apt for anything built
-#      downstream from these images.
-#   3. Changing base distribution was evaluated and rejected. Alpine drops perl
-#      entirely, but PowerShell publishes no linux-musl-arm64 build in any
-#      release, so M365 scanning would break on arm64 -- which is what we run in
-#      production. Wolfi keeps glibc and drops perl, but pinnable versioned tags
-#      are a paid tier, so builds would not be reproducibly pinnable.
-#
-# Not-invoked claim verified by sweeping both images for files with a perl
-# shebang, shell/python callers of perl, ELF binaries containing "perl", and
-# .pl/.pm files or perl subprocess calls anywhere in site-packages. The only
-# consumers found are dpkg/debconf/adduser/pam tooling, none of which runs at
-# runtime, plus one build-time script inside the ExchangeOnlineManagement
-# PowerShell module that is never invoked.
-
-vulnerabilities:
-  # Archive::Tar path traversal. Not installed: `perl -MArchive::Tar -e1` cannot locate it.
-  - id: CVE-2026-42496
-    purls:
-      - "pkg:deb/debian/perl-base"
-    expired_at: 2027-01-31
-
-  # Storable integer overflow. Not installed: `perl -MStorable -e1` cannot locate it.
-  - id: CVE-2026-57433
-    purls:
-      - "pkg:deb/debian/perl-base"
-    expired_at: 2027-01-31
-
-  # Regex heap overflow on 32-bit builds only; both published arches are 64-bit.
-  - id: CVE-2026-8376
-    purls:
-      - "pkg:deb/debian/perl-base"
-    expired_at: 2027-01-31
-
-  # Regex trie bug giving silently wrong matches above 65535 alternation branches.
-  # perl 5.40.1 is in range, so this rests on nothing invoking perl. Short expiry
-  # to force a re-look. Ref: https://github.com/Perl/perl5/issues/23388
-  - id: CVE-2026-13221
-    purls:
-      - "pkg:deb/debian/perl-base"
-    expired_at: 2026-11-30
-
-  # Declared in the SPDX manifest that ships inside PowerShell's MicrosoftTeams module
-  # (Modules/MicrosoftTeams/7.9.0/_manifest/spdx_2.2/manifest.spdx.json). Trivy reads that
-  # SBOM and reports what it declares, which is not the same as what the image contains:
-  # there is no Node runtime and no node_modules anywhere in the image, and the .NET
-  # assemblies target net472, a Windows-only framework. Nothing here is reachable, and none
-  # of it is a dependency we declare -- only Microsoft can change the module's contents.
-  - id: CVE-2020-0606
-    purls:
-      - "pkg:nuget/Microsoft.WindowsDesktop.App.Ref"
-    expired_at: 2027-01-31
-  - id: CVE-2019-0820
-    purls:
-      - "pkg:nuget/System.Text.RegularExpressions"
-    expired_at: 2027-01-31
-  - id: CVE-2026-47302
-    purls:
-      - "pkg:nuget/System.Security.Cryptography.Xml"
-    expired_at: 2027-01-31
-  - id: CVE-2026-47304
-    purls:
-      - "pkg:nuget/System.Security.Cryptography.Xml"
-    expired_at: 2027-01-31
-  - id: CVE-2026-50525
-    purls:
-      - "pkg:nuget/System.Security.Cryptography.Xml"
-    expired_at: 2027-01-31
-  - id: CVE-2026-50527
-    purls:
-      - "pkg:nuget/System.Security.Cryptography.Xml"
-    expired_at: 2027-01-31
-  - id: CVE-2026-50648
-    purls:
-      - "pkg:nuget/System.Security.Cryptography.Xml"
-    expired_at: 2027-01-31
-  - id: CVE-2026-13676
-    purls:
-      - "pkg:npm/fast-uri"
-    expired_at: 2027-01-31
-  - id: CVE-2026-16221
-    purls:
-      - "pkg:npm/fast-uri"
-    expired_at: 2027-01-31
-  - id: CVE-2026-18446
-    purls:
-      - "pkg:npm/fast-uri"
-    expired_at: 2027-01-31
-  - id: CVE-2026-69192
-    purls:
-      - "pkg:npm/ip-address"
-    expired_at: 2027-01-31
-
-  # CVE-2026-62901 is a DoS in System.Net.WebSockets (unchecked input for loop condition,
-  # CWE-606), fixed in .NET 9.0.19 / 10.0.11 (published 2026-08-11). The vulnerable runtime
-  # ships inside the PowerShell tarball the Dockerfile pins: 7.5.9 is the latest 7.5.x and
-  # bundles .NET 9.0.18; 7.6.4 bundles .NET 10.0.x < 10.0.11, so no published PowerShell
-  # release contains the fix yet. Prowler only invokes pwsh locally to run M365 module
-  # cmdlets; the image does not accept inbound WebSocket connections, so the DoS path is
-  # not reachable from the network. Remove this temporary suppression as soon as a
-  # PowerShell release shipping .NET 9.0.19+ is available.
-  - id: CVE-2026-62901
-    purls:
-      - "pkg:nuget/Microsoft.NETCore.App.Runtime.linux-x64"
-      - "pkg:nuget/Microsoft.NETCore.App.Runtime.linux-arm64"
-    expired_at: 2026-09-15
-
-  # Modules compiled into the Trivy binary the images ship. The binary is pinned by version
-  # and verified by checksum in the Dockerfile; only a rebuild by its vendor moves these.
-  # CVE-2026-71556 affects go-git worktree operations that can follow symlinks outside a
-  # cloned repository. Trivy 0.73.0, the latest published release and the version the
-  # images ship, still pins that vulnerable version:
-  # https://github.com/aquasecurity/trivy/blob/v0.73.0/go.mod#L46
-  # Trivy main already contains the 5.19.2 fix, but no published release includes it yet:
-  # https://github.com/aquasecurity/trivy/commit/a2edba9a03987ba0d2ebc8212c1a9a1e6979497b
-  # Prowler invokes Trivy only with `fs` on an existing local path or with `image`; it does
-  # not ask Trivy to clone or mutate a Git worktree, so the affected path is not reachable.
-  # Remove this temporary suppression as soon as a fixed Trivy release is available.
-  - id: CVE-2026-71556
-    purls:
-      - "pkg:golang/github.com/go-git/go-git/v5"
-    expired_at: 2026-09-15
-
-  - id: CVE-2026-56852
-    purls:
-      - "pkg:golang/golang.org/x/text"
-    expired_at: 2026-12-31
-  - id: GHSA-hrxh-6v49-42gf
-    purls:
-      - "pkg:golang/google.golang.org/grpc"
-    expired_at: 2026-12-31
-  - id: CVE-2026-50151
-    purls:
-      - "pkg:golang/oras.land/oras-go/v2"
-    expired_at: 2026-12-31
-  - id: CVE-2026-50163
-    purls:
-      - "pkg:golang/oras.land/oras-go/v2"
-    expired_at: 2026-12-31

AGENTS.md

@@ -12,144 +12,139 @@ Use these skills for detailed patterns on-demand:
 
 ### Generic Skills (Any Project)
 
-| Skill | Description | URL |
-|-------|-------------|-----|
-| `typescript` | Const types, flat interfaces, utility types | [SKILL.md](skills/typescript/SKILL.md) |
-| `react-19` | No useMemo/useCallback, React Compiler | [SKILL.md](skills/react-19/SKILL.md) |
-| `nextjs-16` | App Router, Server Actions, proxy.ts, streaming | [SKILL.md](skills/nextjs-16/SKILL.md) |
-| `tailwind-4` | cn() utility, no var() in className | [SKILL.md](skills/tailwind-4/SKILL.md) |
-| `playwright` | Page Object Model, MCP workflow, selectors | [SKILL.md](skills/playwright/SKILL.md) |
-| `pytest` | Fixtures, mocking, markers, parametrize | [SKILL.md](skills/pytest/SKILL.md) |
-| `django-drf` | ViewSets, Serializers, Filters | [SKILL.md](skills/django-drf/SKILL.md) |
-| `jsonapi` | Strict JSON:API v1.1 spec compliance | [SKILL.md](skills/jsonapi/SKILL.md) |
-| `zod-4` | New API (z.email(), z.uuid()) | [SKILL.md](skills/zod-4/SKILL.md) |
-| `zustand-5` | Persist, selectors, slices | [SKILL.md](skills/zustand-5/SKILL.md) |
-| `ai-sdk-5` | UIMessage, streaming, LangChain | [SKILL.md](skills/ai-sdk-5/SKILL.md) |
-| `vitest` | Unit testing, React Testing Library | [SKILL.md](skills/vitest/SKILL.md) |
-| `tdd` | Test-Driven Development workflow | [SKILL.md](skills/tdd/SKILL.md) |
+| Skill        | Description                                     | URL                                    |
+| ------------ | ----------------------------------------------- | -------------------------------------- |
+| `typescript` | Const types, flat interfaces, utility types     | [SKILL.md](skills/typescript/SKILL.md) |
+| `react-19`   | No useMemo/useCallback, React Compiler          | [SKILL.md](skills/react-19/SKILL.md)   |
+| `nextjs-16`  | App Router, Server Actions, proxy.ts, streaming | [SKILL.md](skills/nextjs-16/SKILL.md)  |
+| `tailwind-4` | cn() utility, no var() in className             | [SKILL.md](skills/tailwind-4/SKILL.md) |
+| `playwright` | Page Object Model, MCP workflow, selectors      | [SKILL.md](skills/playwright/SKILL.md) |
+| `pytest`     | Fixtures, mocking, markers, parametrize         | [SKILL.md](skills/pytest/SKILL.md)     |
+| `django-drf` | ViewSets, Serializers, Filters                  | [SKILL.md](skills/django-drf/SKILL.md) |
+| `jsonapi`    | Strict JSON:API v1.1 spec compliance            | [SKILL.md](skills/jsonapi/SKILL.md)    |
+| `zod-4`      | New API (z.email(), z.uuid())                   | [SKILL.md](skills/zod-4/SKILL.md)      |
+| `zustand-5`  | Persist, selectors, slices                      | [SKILL.md](skills/zustand-5/SKILL.md)  |
+| `ai-sdk-5`   | UIMessage, streaming, LangChain                 | [SKILL.md](skills/ai-sdk-5/SKILL.md)   |
+| `vitest`     | Unit testing, React Testing Library             | [SKILL.md](skills/vitest/SKILL.md)     |
+| `tdd`        | Test-Driven Development workflow                | [SKILL.md](skills/tdd/SKILL.md)        |
 
 ### Prowler-Specific Skills
 
-| Skill | Description | URL |
-|-------|-------------|-----|
-| `prowler` | Project overview, component navigation | [SKILL.md](skills/prowler/SKILL.md) |
-| `prowler-api` | Django + RLS + JSON:API patterns | [SKILL.md](skills/prowler-api/SKILL.md) |
-| `prowler-ui` | Next.js + shadcn conventions | [SKILL.md](skills/prowler-ui/SKILL.md) |
-| `prowler-sdk-check` | Create new security checks | [SKILL.md](skills/prowler-sdk-check/SKILL.md) |
-| `prowler-mcp` | MCP server tools and models | [SKILL.md](skills/prowler-mcp/SKILL.md) |
-| `prowler-test-sdk` | SDK testing (pytest + moto) | [SKILL.md](skills/prowler-test-sdk/SKILL.md) |
-| `prowler-test-api` | API testing (pytest-django + RLS) | [SKILL.md](skills/prowler-test-api/SKILL.md) |
-| `prowler-test-ui` | E2E testing (Playwright) | [SKILL.md](skills/prowler-test-ui/SKILL.md) |
-| `prowler-compliance` | Compliance framework structure | [SKILL.md](skills/prowler-compliance/SKILL.md) |
-| `prowler-compliance-review` | Review compliance framework PRs | [SKILL.md](skills/prowler-compliance-review/SKILL.md) |
-| `prowler-provider` | Add new cloud providers | [SKILL.md](skills/prowler-provider/SKILL.md) |
-| `prowler-changelog` | Changelog entries (keepachangelog.com) | [SKILL.md](skills/prowler-changelog/SKILL.md) |
-| `prowler-ci` | CI checks and PR gates (GitHub Actions) | [SKILL.md](skills/prowler-ci/SKILL.md) |
-| `prowler-commit` | Professional commits (conventional-commits) | [SKILL.md](skills/prowler-commit/SKILL.md) |
-| `prowler-pr` | Pull request conventions | [SKILL.md](skills/prowler-pr/SKILL.md) |
-| `prowler-docs` | Documentation style guide | [SKILL.md](skills/prowler-docs/SKILL.md) |
-| `django-migration-psql` | Django migration best practices for PostgreSQL | [SKILL.md](skills/django-migration-psql/SKILL.md) |
-| `postgresql-indexing` | PostgreSQL indexing, EXPLAIN, monitoring, maintenance | [SKILL.md](skills/postgresql-indexing/SKILL.md) |
-| `prowler-attack-paths-query` | Create Attack Paths openCypher queries | [SKILL.md](skills/prowler-attack-paths-query/SKILL.md) |
-| `prowler-tour` | Keep product-tour definitions aligned with the UI | [SKILL.md](skills/prowler-tour/SKILL.md) |
-| `gh-aw` | GitHub Agentic Workflows (gh-aw) | [SKILL.md](skills/gh-aw/SKILL.md) |
-| `skill-creator` | Create new AI agent skills | [SKILL.md](skills/skill-creator/SKILL.md) |
+| Skill                        | Description                                            | URL                                                    |
+| ---------------------------- | ------------------------------------------------------ | ------------------------------------------------------ |
+| `prowler`                    | Project overview, component navigation                 | [SKILL.md](skills/prowler/SKILL.md)                    |
+| `prowler-api`                | Django + RLS + JSON:API patterns                       | [SKILL.md](skills/prowler-api/SKILL.md)                |
+| `prowler-ui`                 | Next.js + shadcn conventions                           | [SKILL.md](skills/prowler-ui/SKILL.md)                 |
+| `prowler-ui-motion`          | shadcn/Radix visible microinteraction conventions      | [SKILL.md](skills/prowler-ui-motion/SKILL.md)          |
+| `prowler-ui-skeletons`       | shadcn skeleton loading and content reveal conventions | [SKILL.md](skills/prowler-ui-skeletons/SKILL.md)       |
+| `prowler-sdk-check`          | Create new security checks                             | [SKILL.md](skills/prowler-sdk-check/SKILL.md)          |
+| `prowler-mcp`                | MCP server tools and models                            | [SKILL.md](skills/prowler-mcp/SKILL.md)                |
+| `prowler-test-sdk`           | SDK testing (pytest + moto)                            | [SKILL.md](skills/prowler-test-sdk/SKILL.md)           |
+| `prowler-test-api`           | API testing (pytest-django + RLS)                      | [SKILL.md](skills/prowler-test-api/SKILL.md)           |
+| `prowler-test-ui`            | E2E testing (Playwright)                               | [SKILL.md](skills/prowler-test-ui/SKILL.md)            |
+| `prowler-compliance`         | Compliance framework structure                         | [SKILL.md](skills/prowler-compliance/SKILL.md)         |
+| `prowler-compliance-review`  | Review compliance framework PRs                        | [SKILL.md](skills/prowler-compliance-review/SKILL.md)  |
+| `prowler-provider`           | Add new cloud providers                                | [SKILL.md](skills/prowler-provider/SKILL.md)           |
+| `prowler-changelog`          | Changelog entries (keepachangelog.com)                 | [SKILL.md](skills/prowler-changelog/SKILL.md)          |
+| `prowler-ci`                 | CI checks and PR gates (GitHub Actions)                | [SKILL.md](skills/prowler-ci/SKILL.md)                 |
+| `prowler-commit`             | Professional commits (conventional-commits)            | [SKILL.md](skills/prowler-commit/SKILL.md)             |
+| `prowler-pr`                 | Pull request conventions                               | [SKILL.md](skills/prowler-pr/SKILL.md)                 |
+| `prowler-docs`               | Documentation style guide                              | [SKILL.md](skills/prowler-docs/SKILL.md)               |
+| `django-migration-psql`      | Django migration best practices for PostgreSQL         | [SKILL.md](skills/django-migration-psql/SKILL.md)      |
+| `postgresql-indexing`        | PostgreSQL indexing, EXPLAIN, monitoring, maintenance  | [SKILL.md](skills/postgresql-indexing/SKILL.md)        |
+| `prowler-attack-paths-query` | Create Attack Paths openCypher queries                 | [SKILL.md](skills/prowler-attack-paths-query/SKILL.md) |
+| `gh-aw`                      | GitHub Agentic Workflows (gh-aw)                       | [SKILL.md](skills/gh-aw/SKILL.md)                      |
+| `skill-creator`              | Create new AI agent skills                             | [SKILL.md](skills/skill-creator/SKILL.md)              |
 
 ### Auto-invoke Skills
 
 When performing these actions, ALWAYS invoke the corresponding skill FIRST:
 
-| Action | Skill |
-|--------|-------|
-| Add changelog entry for a PR or feature | `prowler-changelog` |
-| Adding ConfigRequirements guardrails to compliance requirements | `prowler-compliance` |
-| Adding DRF pagination or permissions | `django-drf` |
-| Adding a compliance output formatter (per-provider class + table dispatcher) | `prowler-compliance` |
-| Adding indexes or constraints to database tables | `django-migration-psql` |
-| Adding new providers | `prowler-provider` |
-| Adding privilege escalation detection queries | `prowler-attack-paths-query` |
-| Adding services to existing providers | `prowler-provider` |
-| Adding, updating, or removing a tour definition (*.tour.ts) | `prowler-tour` |
-| After creating/modifying a skill | `skill-sync` |
-| App Router / Server Actions | `nextjs-16` |
-| Auditing check-to-requirement mappings as a cloud auditor | `prowler-compliance` |
-| Building AI chat features | `ai-sdk-5` |
-| Changing button labels or section headings on a tour-covered page | `prowler-tour` |
-| Committing changes | `prowler-commit` |
-| Configuring MCP servers in agentic workflows | `gh-aw` |
-| Create PR that requires changelog entry | `prowler-changelog` |
-| Create a PR with gh pr create | `prowler-pr` |
-| Creating API endpoints | `jsonapi` |
-| Creating Attack Paths queries | `prowler-attack-paths-query` |
-| Creating GitHub Agentic Workflows | `gh-aw` |
-| Creating ViewSets, serializers, or filters in api/ | `django-drf` |
-| Creating Zod schemas | `zod-4` |
-| Creating a git commit | `prowler-commit` |
-| Creating a universal (multi-provider) compliance framework | `prowler-compliance` |
-| Creating new checks | `prowler-sdk-check` |
-| Creating new skills | `skill-creator` |
-| Creating or reviewing Django migrations | `django-migration-psql` |
-| Creating/modifying Prowler UI components | `prowler-ui` |
-| Creating/modifying models, views, serializers | `prowler-api` |
-| Creating/updating compliance frameworks | `prowler-compliance` |
-| Debug why a GitHub Actions job is failing | `prowler-ci` |
-| Debugging gh-aw compilation errors | `gh-aw` |
-| Editing a UI file containing data-tour-id attributes | `prowler-tour` |
-| Fill .github/pull_request_template.md (Context/Description/Steps to review/Checklist) | `prowler-pr` |
-| Fixing bug | `tdd` |
-| Fixing compliance JSON bugs (duplicate IDs, empty Section, stale refs) | `prowler-compliance` |
-| General Prowler development questions | `prowler` |
-| Implementing JSON:API endpoints | `django-drf` |
-| Implementing feature | `tdd` |
-| Importing Copilot Custom Agents into workflows | `gh-aw` |
-| Inspect PR CI checks and gates (.github/workflows/*) | `prowler-ci` |
-| Inspect PR CI workflows (.github/workflows/*): conventional-commit, pr-check-changelog, pr-conflict-checker, labeler | `prowler-pr` |
-| Mapping checks to compliance controls | `prowler-compliance` |
-| Mocking AWS with moto in tests | `prowler-test-sdk` |
-| Modifying API responses | `jsonapi` |
-| Modifying component | `tdd` |
-| Modifying gh-aw workflow frontmatter or safe-outputs | `gh-aw` |
-| Refactoring code | `tdd` |
-| Regenerate AGENTS.md Auto-invoke tables (sync.sh) | `skill-sync` |
-| Renaming or removing a data-tour-id attribute value | `prowler-tour` |
-| Restructuring routes or layouts covered by a tour | `prowler-tour` |
-| Review PR requirements: template, title conventions, changelog gate | `prowler-pr` |
-| Review changelog format and conventions | `prowler-changelog` |
-| Reviewing JSON:API compliance | `jsonapi` |
-| Reviewing Prowler UI components | `prowler-ui` |
-| Reviewing compliance framework PRs | `prowler-compliance-review` |
-| Running makemigrations or pgmakemigrations | `django-migration-psql` |
-| Syncing compliance framework with upstream catalog | `prowler-compliance` |
-| Testing RLS tenant isolation | `prowler-test-api` |
-| Testing hooks or utilities | `vitest` |
-| Troubleshoot why a skill is missing from AGENTS.md auto-invoke | `skill-sync` |
-| Understand CODEOWNERS/labeler-based automation | `prowler-ci` |
-| Understand PR title conventional-commit validation | `prowler-ci` |
-| Understand changelog gate and no-changelog label behavior | `prowler-ci` |
-| Understand review ownership with CODEOWNERS | `prowler-pr` |
-| Update CHANGELOG.md in any component | `prowler-changelog` |
-| Updating README.md provider statistics table | `prowler-readme-table` |
-| Updating checks, services, compliance, or categories count in README.md | `prowler-readme-table` |
-| Updating existing Attack Paths queries | `prowler-attack-paths-query` |
-| Updating existing checks and metadata | `prowler-sdk-check` |
-| Using Zustand stores | `zustand-5` |
-| Working on MCP server tools | `prowler-mcp` |
-| Working on Prowler UI structure (actions/adapters/types/hooks) | `prowler-ui` |
-| Working on task | `tdd` |
-| Working with Prowler UI test helpers/pages | `prowler-test-ui` |
-| Working with Tailwind classes | `tailwind-4` |
-| Writing Playwright E2E tests | `playwright` |
-| Writing Prowler API tests | `prowler-test-api` |
-| Writing Prowler SDK tests | `prowler-test-sdk` |
-| Writing Prowler UI E2E tests | `prowler-test-ui` |
-| Writing Python tests with pytest | `pytest` |
-| Writing React component tests | `vitest` |
-| Writing React components | `react-19` |
-| Writing TypeScript types/interfaces | `typescript` |
-| Writing Vitest tests | `vitest` |
-| Writing data backfill or data migration | `django-migration-psql` |
-| Writing documentation | `prowler-docs` |
-| Writing unit tests for UI | `vitest` |
+| Action                                                                                                                | Skill                        |
+| --------------------------------------------------------------------------------------------------------------------- | ---------------------------- |
+| Add changelog entry for a PR or feature                                                                               | `prowler-changelog`          |
+| Adding DRF pagination or permissions                                                                                  | `django-drf`                 |
+| Adding a compliance output formatter (per-provider class + table dispatcher)                                          | `prowler-compliance`         |
+| Adding indexes or constraints to database tables                                                                      | `django-migration-psql`      |
+| Adding new providers                                                                                                  | `prowler-provider`           |
+| Adding privilege escalation detection queries                                                                         | `prowler-attack-paths-query` |
+| Adding services to existing providers                                                                                 | `prowler-provider`           |
+| After creating/modifying a skill                                                                                      | `skill-sync`                 |
+| App Router / Server Actions                                                                                           | `nextjs-16`                  |
+| Auditing check-to-requirement mappings as a cloud auditor                                                             | `prowler-compliance`         |
+| Building AI chat features                                                                                             | `ai-sdk-5`                   |
+| Committing changes                                                                                                    | `prowler-commit`             |
+| Configuring MCP servers in agentic workflows                                                                          | `gh-aw`                      |
+| Create PR that requires changelog entry                                                                               | `prowler-changelog`          |
+| Create a PR with gh pr create                                                                                         | `prowler-pr`                 |
+| Creating API endpoints                                                                                                | `jsonapi`                    |
+| Creating Attack Paths queries                                                                                         | `prowler-attack-paths-query` |
+| Creating GitHub Agentic Workflows                                                                                     | `gh-aw`                      |
+| Creating ViewSets, serializers, or filters in api/                                                                    | `django-drf`                 |
+| Creating Zod schemas                                                                                                  | `zod-4`                      |
+| Creating a git commit                                                                                                 | `prowler-commit`             |
+| Creating new checks                                                                                                   | `prowler-sdk-check`          |
+| Creating new skills                                                                                                   | `skill-creator`              |
+| Creating or reviewing Django migrations                                                                               | `django-migration-psql`      |
+| Creating/modifying Prowler UI components                                                                              | `prowler-ui`                 |
+| Creating/modifying UI motion, transitions, or microinteractions                                                       | `prowler-ui-motion`          |
+| Creating/modifying skeletons, loading states, or Suspense fallbacks                                                   | `prowler-ui-skeletons`       |
+| Creating/modifying models, views, serializers                                                                         | `prowler-api`                |
+| Creating/updating compliance frameworks                                                                               | `prowler-compliance`         |
+| Debug why a GitHub Actions job is failing                                                                             | `prowler-ci`                 |
+| Debugging gh-aw compilation errors                                                                                    | `gh-aw`                      |
+| Fill .github/pull_request_template.md (Context/Description/Steps to review/Checklist)                                 | `prowler-pr`                 |
+| Fixing bug                                                                                                            | `tdd`                        |
+| Fixing compliance JSON bugs (duplicate IDs, empty Section, stale refs)                                                | `prowler-compliance`         |
+| General Prowler development questions                                                                                 | `prowler`                    |
+| Implementing JSON:API endpoints                                                                                       | `django-drf`                 |
+| Implementing feature                                                                                                  | `tdd`                        |
+| Importing Copilot Custom Agents into workflows                                                                        | `gh-aw`                      |
+| Inspect PR CI checks and gates (.github/workflows/\*)                                                                 | `prowler-ci`                 |
+| Inspect PR CI workflows (.github/workflows/\*): conventional-commit, pr-check-changelog, pr-conflict-checker, labeler | `prowler-pr`                 |
+| Mapping checks to compliance controls                                                                                 | `prowler-compliance`         |
+| Mocking AWS with moto in tests                                                                                        | `prowler-test-sdk`           |
+| Modifying API responses                                                                                               | `jsonapi`                    |
+| Modifying component                                                                                                   | `tdd`                        |
+| Modifying gh-aw workflow frontmatter or safe-outputs                                                                  | `gh-aw`                      |
+| Refactoring code                                                                                                      | `tdd`                        |
+| Regenerate AGENTS.md Auto-invoke tables (sync.sh)                                                                     | `skill-sync`                 |
+| Review PR requirements: template, title conventions, changelog gate                                                   | `prowler-pr`                 |
+| Review changelog format and conventions                                                                               | `prowler-changelog`          |
+| Reviewing JSON:API compliance                                                                                         | `jsonapi`                    |
+| Reviewing compliance framework PRs                                                                                    | `prowler-compliance-review`  |
+| Running makemigrations or pgmakemigrations                                                                            | `django-migration-psql`      |
+| Syncing compliance framework with upstream catalog                                                                    | `prowler-compliance`         |
+| Testing RLS tenant isolation                                                                                          | `prowler-test-api`           |
+| Testing hooks or utilities                                                                                            | `vitest`                     |
+| Troubleshoot why a skill is missing from AGENTS.md auto-invoke                                                        | `skill-sync`                 |
+| Understand CODEOWNERS/labeler-based automation                                                                        | `prowler-ci`                 |
+| Understand PR title conventional-commit validation                                                                    | `prowler-ci`                 |
+| Understand changelog gate and no-changelog label behavior                                                             | `prowler-ci`                 |
+| Understand review ownership with CODEOWNERS                                                                           | `prowler-pr`                 |
+| Update CHANGELOG.md in any component                                                                                  | `prowler-changelog`          |
+| Updating README.md provider statistics table                                                                          | `prowler-readme-table`       |
+| Updating checks, services, compliance, or categories count in README.md                                               | `prowler-readme-table`       |
+| Updating existing Attack Paths queries                                                                                | `prowler-attack-paths-query` |
+| Updating existing checks and metadata                                                                                 | `prowler-sdk-check`          |
+| Using Zustand stores                                                                                                  | `zustand-5`                  |
+| Working on MCP server tools                                                                                           | `prowler-mcp`                |
+| Working on Prowler UI structure (actions/adapters/types/hooks)                                                        | `prowler-ui`                 |
+| Working on task                                                                                                       | `tdd`                        |
+| Working with Prowler UI test helpers/pages                                                                            | `prowler-test-ui`            |
+| Working with Tailwind classes                                                                                         | `tailwind-4`                 |
+| Writing Playwright E2E tests                                                                                          | `playwright`                 |
+| Writing Prowler API tests                                                                                             | `prowler-test-api`           |
+| Writing Prowler SDK tests                                                                                             | `prowler-test-sdk`           |
+| Writing Prowler UI E2E tests                                                                                          | `prowler-test-ui`            |
+| Writing Python tests with pytest                                                                                      | `pytest`                     |
+| Writing React component tests                                                                                         | `vitest`                     |
+| Writing React components                                                                                              | `react-19`                   |
+| Writing TypeScript types/interfaces                                                                                   | `typescript`                 |
+| Writing Vitest tests                                                                                                  | `vitest`                     |
+| Writing data backfill or data migration                                                                               | `django-migration-psql`      |
+| Writing documentation                                                                                                 | `prowler-docs`               |
+| Writing unit tests for UI                                                                                             | `vitest`                     |
 
 ---
 
@@ -157,13 +152,13 @@ When performing these actions, ALWAYS invoke the corresponding skill FIRST:
 
 Prowler is an open-source cloud security assessment tool supporting AWS, Azure, GCP, Kubernetes, GitHub, M365, and more.
 
-| Component | Location | Tech Stack |
-|-----------|----------|------------|
-| SDK | `prowler/` | Python 3.10+, uv |
-| API | `api/` | Django 5.1, DRF, Celery |
-| UI | `ui/` | Next.js 16, React 19, Tailwind 4 |
-| MCP Server | `mcp_server/` | FastMCP, Python 3.12+ |
-| Dashboard | `dashboard/` | Dash, Plotly |
+| Component  | Location      | Tech Stack                       |
+| ---------- | ------------- | -------------------------------- |
+| SDK        | `prowler/`    | Python 3.10+, uv                 |
+| API        | `api/`        | Django 5.1, DRF, Celery          |
+| UI         | `ui/`         | Next.js 16, React 19, Tailwind 4 |
+| MCP Server | `mcp_server/` | FastMCP, Python 3.12+            |
+| Dashboard  | `dashboard/`  | Dash, Plotly                     |
 
 ---
 
@@ -189,6 +184,7 @@ Follow conventional-commit style: `<type>[scope]: <description>`
 **Types:** `feat`, `fix`, `docs`, `chore`, `perf`, `refactor`, `style`, `test`
 
 Before creating a PR:
+
 1. Complete checklist in `.github/pull_request_template.md`
 2. Run all relevant tests and linters
 3. Link screenshots for UI changes

Dockerfile

@@ -1,32 +1,21 @@
-FROM python:3.12.13-slim-trixie@sha256:57cd7c3a7a273101a6485ba99423ee568157882804b1124b4dd04266317710de AS build
+FROM python:3.12.11-slim-bookworm@sha256:519591d6871b7bc437060736b9f7456b8731f1499a57e22e6c285135ae657bf7 AS build
 
 LABEL maintainer="https://github.com/prowler-cloud/prowler"
 LABEL org.opencontainers.image.source="https://github.com/prowler-cloud/prowler"
 
-ARG POWERSHELL_VERSION=7.5.9
+ARG POWERSHELL_VERSION=7.5.0
 ENV POWERSHELL_VERSION=${POWERSHELL_VERSION}
-# Opt out of PowerShell telemetry (Application Insights -> dc.services.visualstudio.com)
-ENV POWERSHELL_TELEMETRY_OPTOUT=1
 
-ARG TRIVY_VERSION=0.74.0
+ARG TRIVY_VERSION=0.70.0
 ENV TRIVY_VERSION=${TRIVY_VERSION}
 
 ARG ZIZMOR_VERSION=1.24.1
 ENV ZIZMOR_VERSION=${ZIZMOR_VERSION}
 
-# Pinned here, not fetched with the artefact: a compromised release ships its own checksum.
-ARG TRIVY_SHA256_AMD64=2ae6fe3ee734b7fdf11335663e18c75ea12dccc76062f09f164a3b0f8be4371a
-ARG TRIVY_SHA256_ARM64=b94ce1976bbf3c15b514b605ee88be7c6d94a29be2302847ff01cb794d47aad5
-ARG POWERSHELL_SHA256_AMD64=492ff26bb958336bf61e597ce19e07648b4003bd2a08659e02f0e3e0446ebfe0
-ARG POWERSHELL_SHA256_ARM64=2503b71da3e83635592b092df59a0aca4c3606b4d9b068217bb00be989cb0d56
-ARG ZIZMOR_SHA256_AMD64=a8000f3c683319a523d3b20df0e75457ba591f049cfcbfa98966631b56733c03
-ARG ZIZMOR_SHA256_ARM64=d66e37ef8a375fb07939c630ebf9709a6e0f20242bdc3faf672a7ed97e0b768d
-
 # hadolint ignore=DL3008
 RUN apt-get update && apt-get install -y --no-install-recommends \
-    wget libicu76 libunwind8 libssl3 libcurl4 ca-certificates apt-transport-https gnupg \
+    wget libicu72 libunwind8 libssl3 libcurl4 ca-certificates apt-transport-https gnupg \
     build-essential pkg-config libzstd-dev zlib1g-dev \
-    && apt-get install -y --no-install-recommends --only-upgrade util-linux \
     && rm -rf /var/lib/apt/lists/*
 
 # Install PowerShell
@@ -38,9 +27,6 @@ RUN ARCH=$(uname -m) && \
     else \
         echo "Unsupported architecture: $ARCH" && exit 1 ; \
     fi && \
-    if [ "$ARCH" = "x86_64" ]; then EXPECT="$POWERSHELL_SHA256_AMD64" ; else EXPECT="$POWERSHELL_SHA256_ARM64" ; fi && \
-    echo "$EXPECT  /tmp/powershell.tar.gz" > /tmp/powershell.sha256 && \
-    sha256sum -c /tmp/powershell.sha256 && rm /tmp/powershell.sha256 && \
     mkdir -p /opt/microsoft/powershell/7 && \
     tar zxf /tmp/powershell.tar.gz -C /opt/microsoft/powershell/7 && \
     chmod +x /opt/microsoft/powershell/7/pwsh && \
@@ -57,9 +43,6 @@ RUN ARCH=$(uname -m) && \
         echo "Unsupported architecture for Trivy: $ARCH" && exit 1 ; \
     fi && \
     wget --progress=dot:giga "https://github.com/aquasecurity/trivy/releases/download/v${TRIVY_VERSION}/trivy_${TRIVY_VERSION}_${TRIVY_ARCH}.tar.gz" -O /tmp/trivy.tar.gz && \
-    if [ "$ARCH" = "x86_64" ]; then EXPECT="$TRIVY_SHA256_AMD64" ; else EXPECT="$TRIVY_SHA256_ARM64" ; fi && \
-    echo "$EXPECT  /tmp/trivy.tar.gz" > /tmp/trivy.sha256 && \
-    sha256sum -c /tmp/trivy.sha256 && rm /tmp/trivy.sha256 && \
     tar zxf /tmp/trivy.tar.gz -C /tmp && \
     mv /tmp/trivy /usr/local/bin/trivy && \
     chmod +x /usr/local/bin/trivy && \
@@ -78,9 +61,6 @@ RUN ARCH=$(uname -m) && \
         echo "Unsupported architecture for zizmor: $ARCH" && exit 1 ; \
     fi && \
     wget --progress=dot:giga "https://github.com/zizmorcore/zizmor/releases/download/v${ZIZMOR_VERSION}/zizmor-${ZIZMOR_ARCH}.tar.gz" -O /tmp/zizmor.tar.gz && \
-    if [ "$ARCH" = "x86_64" ]; then EXPECT="$ZIZMOR_SHA256_AMD64" ; else EXPECT="$ZIZMOR_SHA256_ARM64" ; fi && \
-    echo "$EXPECT  /tmp/zizmor.tar.gz" > /tmp/zizmor.sha256 && \
-    sha256sum -c /tmp/zizmor.sha256 && rm /tmp/zizmor.sha256 && \
     mkdir -p /tmp/zizmor-extract && \
     tar zxf /tmp/zizmor.tar.gz -C /tmp/zizmor-extract && \
     mv /tmp/zizmor-extract/zizmor /usr/local/bin/zizmor && \
@@ -107,7 +87,7 @@ ENV HOME='/home/prowler'
 ENV PATH="${HOME}/.local/bin:${PATH}"
 #hadolint ignore=DL3013
 RUN pip install --no-cache-dir --upgrade pip && \
-    pip install --no-cache-dir uv==0.12.0
+    pip install --no-cache-dir uv==0.11.14
 
 RUN uv sync --locked --compile-bytecode && \
     rm -rf ~/.cache/uv
@@ -115,34 +95,9 @@ RUN uv sync --locked --compile-bytecode && \
 # Install PowerShell modules
 RUN .venv/bin/python prowler/providers/m365/lib/powershell/m365_powershell.py
 
-USER root
-
-# Remove build-only packages from the final image after Python dependencies are installed.
-RUN apt-get purge -y --auto-remove \
-    build-essential \
-    pkg-config \
-    libzstd-dev \
-    zlib1g-dev \
-    wget \
-    gnupg \
-    apt-transport-https \
-    && rm -rf /var/lib/apt/lists/*
-
-USER prowler
-
 # Remove deprecated dash dependencies
 RUN pip uninstall dash-html-components -y && \
     pip uninstall dash-core-components -y
 
-USER root
-
-# pip is build-only; the entrypoint runs the venv directly.
-RUN rm -rf /usr/local/lib/python3.12/site-packages/pip \
-    /usr/local/lib/python3.12/site-packages/pip-*.dist-info \
-    /home/prowler/.local/lib/python3.12/site-packages/pip \
-    /home/prowler/.local/lib/python3.12/site-packages/pip-*.dist-info \
-    /usr/local/bin/pip /usr/local/bin/pip3 /usr/local/bin/pip3.12 \
-    /home/prowler/.local/bin/pip /home/prowler/.local/bin/pip3 /home/prowler/.local/bin/pip3.12
-
 USER prowler
 ENTRYPOINT ["/home/prowler/.venv/bin/prowler"]

Makefile

@@ -1,42 +1,10 @@
 .DEFAULT_GOAL:=help
 
-DEV_LOCAL := ./scripts/development/dev-local.sh
-
-.PHONY: dev dev-setup dev-attach dev-launch dev-stop dev-clean dev-wipe dev-status
-
-##@ Local Development
-dev: ## Start local API, worker, and database logs
-	$(DEV_LOCAL) all
-
-dev-setup: ## Bootstrap local dependencies, migrations, and fixtures
-	$(DEV_LOCAL) setup
-
-dev-attach: ## Attach to the local tmux development session
-	$(DEV_LOCAL) attach
-
-dev-launch: ## Start the local stack on fixed ports and attach
-	$(DEV_LOCAL) launch
-
-dev-stop: ## Stop the local tmux session and containers
-	$(DEV_LOCAL) kill
-
-dev-clean: ## Remove stopped local development containers
-	$(DEV_LOCAL) clean
-
-dev-wipe: ## Stop everything and delete local development data
-	$(DEV_LOCAL) wipe
-
-dev-status: ## Show local development container status
-	$(DEV_LOCAL) status
-
 ##@ Testing
 test:   ## Test with pytest
 	rm -rf .coverage && \
 	pytest -n auto -vvv -s --cov=./prowler --cov-report=xml tests
 
-test-mcp: ## Test MCP server with pytest (mirrors CI)
-	cd mcp_server && uv run pytest --cov=./prowler_mcp_server --cov-report=term-missing tests
-
 coverage: ## Show Test Coverage
 	coverage run --skip-covered -m pytest -v && \
 	coverage report -m && \
@@ -48,41 +16,18 @@ coverage-html: ## Show Test Coverage
 	coverage html && \
 	open htmlcov/index.html
 
-##@ Code Quality
-# `make` is the single entrypoint and mirrors CI exactly (uv run + same flags):
-#   SDK (prowler/, util/) -> flake8 + black + pylint
-#   API & MCP server      -> ruff (rules live in each project's pyproject.toml)
-# `format` applies fixes (incl. ruff's import/upgrade autofixes); `lint` only
-# verifies and is what CI gates on.
-.PHONY: format format-sdk format-api format-mcp lint lint-sdk lint-api lint-mcp
+##@ Linting
+format: ## Format Code
+	@echo "Running black..."
+	black .
 
-format: format-sdk format-api format-mcp ## Format & autofix all components (SDK, API, MCP)
-
-lint: lint-sdk lint-api lint-mcp ## Lint all components (SDK, API, MCP) — mirrors CI
-
-format-sdk: ## Format SDK code (black)
-	uv run black --exclude "\.venv|api|ui|skills|mcp_server" .
-
-lint-sdk: ## Lint SDK code (flake8, black --check, pylint)
-	uv run flake8 . --ignore=E266,W503,E203,E501,W605,E128 --exclude .venv,contrib,ui,api,skills,mcp_server
-	uv run black --exclude "\.venv|api|ui|skills|mcp_server" --check .
-	uv run pylint --disable=W,C,R,E -j 0 -rn -sn prowler/
-
-format-api: ## Format & autofix API code (ruff)
-	cd api && uv run ruff check . --exclude contrib --fix
-	cd api && uv run ruff format . --exclude contrib
-
-lint-api: ## Lint API code (ruff check + format --check)
-	cd api && uv run ruff check . --exclude contrib
-	cd api && uv run ruff format --check . --exclude contrib
-
-format-mcp: ## Format & autofix MCP server code (ruff)
-	cd mcp_server && uv run ruff check . --fix
-	cd mcp_server && uv run ruff format .
-
-lint-mcp: ## Lint MCP server code (ruff check + format --check)
-	cd mcp_server && uv run ruff check .
-	cd mcp_server && uv run ruff format --check .
+lint: ## Lint Code
+	@echo "Running flake8..."
+	flake8 . --ignore=E266,W503,E203,E501,W605,E128 --exclude .venv,contrib
+	@echo "Running black... "
+	black --check .
+	@echo "Running pylint..."
+	pylint --disable=W,C,R,E -j 0 prowler util
 
 ##@ PyPI
 pypi-clean: ## Delete the distribution files

README.md

@@ -3,13 +3,10 @@
   <img align="center" alt="Prowler logo" src="https://github.com/prowler-cloud/prowler/blob/master/docs/img/prowler-logo-white.png#gh-dark-mode-only" width="50%" height="50%">
 </p>
 <p align="center">
-  <b><i>Prowler</b> is the Open Cloud Security Platform trusted by thousands to automate security and compliance in any cloud environment. With thousands of ready-to-use checks and compliance frameworks, Prowler delivers real-time, customizable monitoring and seamless integrations, making cloud security simple, scalable, and cost-effective for organizations of any size.
+  <b><i>Prowler</b> is the Open Cloud Security Platform trusted by thousands to automate security and compliance in any cloud environment. With hundreds of ready-to-use checks and compliance frameworks, Prowler delivers real-time, customizable monitoring and seamless integrations, making cloud security simple, scalable, and cost-effective for organizations of any size.
 </p>
 <p align="center">
-<b>The Agentic Cloud Defender</i></b>
-</p>
-<p align="center">
-<a href="https://cloud.prowler.com/sign-up">Try Prowler Cloud</a>
+<b>Secure ANY cloud at AI Speed at <a href="https://prowler.com">prowler.com</i></b>
 </p>
 
 <p align="center">
@@ -24,7 +21,7 @@
   <a href="https://pypi.python.org/pypi/prowler/"><img alt="Python Version" src="https://img.shields.io/pypi/pyversions/prowler.svg"></a>
   <a href="https://pypistats.org/packages/prowler"><img alt="PyPI Downloads" src="https://img.shields.io/pypi/dw/prowler.svg?label=downloads"></a>
   <a href="https://hub.docker.com/r/toniblyx/prowler"><img alt="Docker Pulls" src="https://img.shields.io/docker/pulls/toniblyx/prowler"></a>
-  <a href="https://gallery.ecr.aws/prowler-cloud/prowler"><img width="120" height="19" alt="AWS ECR Gallery" src="https://user-images.githubusercontent.com/3985464/151531396-b6535a68-c907-44eb-95a1-a09508178616.png"></a>
+  <a href="https://gallery.ecr.aws/prowler-cloud/prowler"><img width="120" height=19" alt="AWS ECR Gallery" src="https://user-images.githubusercontent.com/3985464/151531396-b6535a68-c907-44eb-95a1-a09508178616.png"></a>
   <a href="https://codecov.io/gh/prowler-cloud/prowler"><img alt="Codecov coverage" src="https://codecov.io/gh/prowler-cloud/prowler/graph/badge.svg?token=OflBGsdpDl"/></a>
   <a href="https://insights.linuxfoundation.org/project/prowler-cloud-prowler"><img alt="Linux Foundation insights health score" src="https://insights.linuxfoundation.org/api/badge/health-score?project=prowler-cloud-prowler"/></a>
 </p>
@@ -44,7 +41,7 @@
 
 # Description
 
-**Prowler** is the world’s most widely used _Open-Source Cloud Security Platform_ that automates security and compliance across **any cloud environment**. With thousands of ready-to-use security checks, remediation guidance, and compliance frameworks, Prowler is built to _“Secure ANY Cloud at AI Speed”_. Prowler delivers **AI-driven**, **customizable**, and **easy-to-use** assessments, dashboards, reports, and integrations, making cloud security **simple**, **scalable**, and **cost-effective** for organizations of any size.
+**Prowler** is the world’s most widely used _Open-Source Cloud Security Platform_ that automates security and compliance across **any cloud environment**. With hundreds of ready-to-use security checks, remediation guidance, and compliance frameworks, Prowler is built to _“Secure ANY Cloud at AI Speed”_. Prowler delivers **AI-driven**, **customizable**, and **easy-to-use** assessments, dashboards, reports, and integrations, making cloud security **simple**, **scalable**, and **cost-effective** for organizations of any size.
 
 Prowler includes hundreds of built-in controls to ensure compliance with standards and frameworks, including:
 
@@ -57,16 +54,16 @@ Prowler includes hundreds of built-in controls to ensure compliance with standar
 - **National Security Standards:** ENS (Spanish National Security Scheme) and KISA ISMS-P (Korean)
 - **Custom Security Frameworks:** Tailored to your needs
 
-## Prowler Cloud & Prowler Local Server
+## Prowler App / Prowler Cloud
 
-[Prowler Cloud](https://cloud.prowler.com/sign-up) and Prowler Local Server, its self-hosted open-source version, are web applications that simplify running Prowler across your cloud provider accounts. They provide a user-friendly interface to visualize the results and streamline your security assessments.
+Prowler App / [Prowler Cloud](https://cloud.prowler.com/) is a web-based application that simplifies running Prowler across your cloud provider accounts. It provides a user-friendly interface to visualize the results and streamline your security assessments.
 
-![Prowler Cloud](docs/images/products/overview.png)
+![Prowler App](docs/images/products/overview.png)
 ![Risk Pipeline](docs/images/products/risk-pipeline.png)
 ![Threat Map](docs/images/products/threat-map.png)
 
 
->For more details, refer to the [Prowler Local Server documentation](https://docs.prowler.com/getting-started/installation/prowler-app)
+>For more details, refer to the [Prowler App Documentation](https://docs.prowler.com/projects/prowler-open-source/en/latest/#prowler-app-installation)
 
 ## Prowler CLI
 
@@ -76,45 +73,26 @@ prowler <provider>
 ![Prowler CLI Execution](docs/img/short-display.png)
 
 
-## Prowler Local Dashboard
+## Prowler Dashboard
 
 ```console
 prowler dashboard
 ```
-![Prowler Local Dashboard](docs/images/products/dashboard.png)
+![Prowler Dashboard](docs/images/products/dashboard.png)
 
 
 ## Attack Paths
 
-Attack Paths automatically extends every completed AWS scan with a graph that combines Cartography's cloud inventory with Prowler findings. The feature runs in the API worker after each scan.
+Attack Paths automatically extends every completed AWS scan with a Neo4j graph that combines Cartography's cloud inventory with Prowler findings. The feature runs in the API worker after each scan and therefore requires:
 
-Two graph backends are supported as the long-lived sink:
+- An accessible Neo4j instance (the Docker Compose files already ships a `neo4j` service).
+- The following environment variables so Django and Celery can connect:
 
-- **Neo4j** (default; the Docker Compose files already ship a `neo4j` service).
-- **Amazon Neptune** (cloud-managed; opt-in).
-
-Select the sink with `ATTACK_PATHS_SINK_DATABASE` (`neo4j` or `neptune`; default `neo4j`).
-
-> Note: Cartography ingestion always uses a temporary Neo4j database, regardless of the configured sink. The `NEO4J_*` variables below must remain set even when `ATTACK_PATHS_SINK_DATABASE=neptune`.
-
-### Neo4j sink
-
-| Variable | Description | Default |
-| --- | --- | --- |
-| `NEO4J_HOST` | Hostname used by the API containers. | `neo4j` |
-| `NEO4J_PORT` | Bolt port exposed by Neo4j. | `7687` |
-| `NEO4J_USER` / `NEO4J_PASSWORD` | Credentials with rights to create per-tenant databases. | `neo4j` / `neo4j_password` |
-
-### Neptune sink
-
-| Variable | Description | Default |
-| --- | --- | --- |
-| `NEPTUNE_WRITER_ENDPOINT` | Bolt host for the Neptune writer instance. Required when sink is `neptune`. | _empty_ |
-| `NEPTUNE_READER_ENDPOINT` | Optional reader endpoint for read-only queries. Falls back to the writer when unset. | _empty_ |
-| `NEPTUNE_PORT` | Bolt port exposed by Neptune. | `8182` |
-| `AWS_REGION` | Region the Neptune cluster lives in. Required when sink is `neptune`. | _empty_ |
-
-Neptune authenticates with SigV4 using the standard boto3 credential chain. The worker's IAM role (or `AWS_ACCESS_KEY_ID` / `AWS_SECRET_ACCESS_KEY`) supplies the credentials. There is no Neptune password variable.
+  | Variable | Description | Default |
+  | --- | --- | --- |
+  | `NEO4J_HOST` | Hostname used by the API containers. | `neo4j` |
+  | `NEO4J_PORT` | Bolt port exposed by Neo4j. | `7687` |
+  | `NEO4J_USER` / `NEO4J_PASSWORD` | Credentials with rights to create per-tenant databases. | `neo4j` / `neo4j_password` |
 
 Every AWS provider scan will enqueue an Attack Paths ingestion job automatically. Other cloud providers will be added in future iterations.
 
@@ -124,31 +102,28 @@ Every AWS provider scan will enqueue an Attack Paths ingestion job automatically
 > For the most accurate and up-to-date information about checks, services, frameworks, and categories, visit [**Prowler Hub**](https://hub.prowler.com).
 
 
-| Provider | Checks | Services | [Compliance Frameworks](https://docs.prowler.com/user-guide/compliance/tutorials/compliance) | [Categories](https://docs.prowler.com/user-guide/cli/tutorials/misc#categories) | Support | Interface |
+| Provider | Checks | Services | [Compliance Frameworks](https://docs.prowler.com/projects/prowler-open-source/en/latest/tutorials/compliance/) | [Categories](https://docs.prowler.com/projects/prowler-open-source/en/latest/tutorials/misc/#categories) | Support | Interface |
 |---|---|---|---|---|---|---|
-| AWS | 639 | 86 | 47 | 19 | Official | UI, API, CLI |
-| Azure | 191 | 22 | 21 | 16 | Official | UI, API, CLI |
-| GCP | 109 | 20 | 19 | 12 | Official | UI, API, CLI |
-| Kubernetes | 92 | 7 | 8 | 11 | Official | UI, API, CLI |
-| GitHub | 24 | 3 | 2 | 5 | Official | UI, API, CLI |
-| M365 | 143 | 10 | 6 | 10 | Official | UI, API, CLI |
-| OCI | 52 | 14 | 5 | 10 | Official | UI, API, CLI |
-| Alibaba Cloud | 63 | 9 | 6 | 9 | Official | UI, API, CLI |
-| Cloudflare | 29 | 3 | 2 | 5 | Official | UI, API, CLI |
+| AWS | 600 | 84 | 44 | 18 | Official | UI, API, CLI |
+| Azure | 167 | 22 | 19 | 16 | Official | UI, API, CLI |
+| GCP | 102 | 18 | 17 | 12 | Official | UI, API, CLI |
+| Kubernetes | 83 | 7 | 7 | 11 | Official | UI, API, CLI |
+| GitHub | 24 | 3 | 1 | 5 | Official | UI, API, CLI |
+| M365 | 102 | 10 | 4 | 10 | Official | UI, API, CLI |
+| OCI | 51 | 14 | 4 | 10 | Official | UI, API, CLI |
+| Alibaba Cloud | 63 | 9 | 4 | 9 | Official | UI, API, CLI |
+| Cloudflare | 29 | 3 | 0 | 5 | Official | UI, API, CLI |
 | IaC | [See `trivy` docs.](https://trivy.dev/latest/docs/coverage/iac/) | N/A | N/A | N/A | Official | UI, API, CLI |
-| MongoDB Atlas | 10 | 3 | 1 | 8 | Official | UI, API, CLI |
+| MongoDB Atlas | 10 | 3 | 0 | 8 | Official | UI, API, CLI |
 | LLM | [See `promptfoo` docs.](https://www.promptfoo.dev/docs/red-team/plugins/) | N/A | N/A | N/A | Official | CLI |
-| Image | N/A | N/A | N/A | N/A | Official | UI, API, CLI |
-| Google Workspace | 65 | 11 | 3 | 6 | Official | UI, API, CLI |
-| OpenStack | 34 | 5 | 1 | 9 | Official | UI, API, CLI |
-| Vercel | 26 | 6 | 1 | 8 | Official | UI, API, CLI |
-| Okta | 29 | 8 | 2 | 2 | Official | UI, API, CLI |
-| Linode [Contact us](https://prowler.com/contact) | 10 | 3 | 1 | 4 | Unofficial | CLI |
-| Huawei Cloud [Contact us](https://prowler.com/contact) | 25 | 10 | 1 | 6 | Unofficial | CLI |
-| E2E Networks [Contact us](https://prowler.com/contact) | 27 | 6 | 0 | 2 | Unofficial | CLI |
-| Scaleway [Contact us](https://prowler.com/contact) | 1 | 1 | 1 | 1 | Unofficial | CLI |
-| StackIT [Contact us](https://prowler.com/contact) | 8 | 2 | 1 | 3 | Unofficial | CLI |
-| NHN | 6 | 2 | 2 | 0 | Unofficial | CLI |
+| Image | N/A | N/A | N/A | N/A | Official | CLI, API |
+| Google Workspace | 39 | 5 | 2 | 5 | Official | UI, API, CLI |
+| OpenStack | 34 | 5 | 0 | 9 | Official | UI, API, CLI |
+| Vercel | 26 | 6 | 0 | 8 | Official | UI, API, CLI |
+| Okta | 1 | 1 | 0 | 1 | Official | CLI |
+| Scaleway [Contact us](https://prowler.com/contact) | 1 | 1 | 0 | 1 | Unofficial | CLI |
+| StackIT [Contact us](https://prowler.com/contact) | 4 | 1 | 0 | 1 | Unofficial | CLI |
+| NHN | 6 | 2 | 1 | 0 | Unofficial | CLI |
 
 > [!Note]
 > The numbers in the table are updated periodically.
@@ -164,11 +139,11 @@ Every AWS provider scan will enqueue an Attack Paths ingestion job automatically
 
 # 💻 Installation
 
-## Prowler Local Server
+## Prowler App
 
-Prowler Local Server offers flexible installation methods tailored to various environments:
+Prowler App offers flexible installation methods tailored to various environments:
 
-> For detailed instructions on using Prowler Local Server, refer to the [usage guide](https://docs.prowler.com/user-guide/tutorials/prowler-app).
+> For detailed instructions on using Prowler App, refer to the [Prowler App Usage Guide](https://docs.prowler.com/projects/prowler-open-source/en/latest/tutorials/prowler-app/).
 
 ### Docker Compose
 
@@ -178,8 +153,6 @@ Prowler Local Server offers flexible installation methods tailored to various en
 
 #### Commands
 
-_macOS/Linux:_
-
 ``` console
 VERSION=$(curl -s https://api.github.com/repos/prowler-cloud/prowler/releases/latest | jq -r .tag_name)
 curl -sLO "https://raw.githubusercontent.com/prowler-cloud/prowler/refs/tags/${VERSION}/docker-compose.yml"
@@ -188,20 +161,10 @@ curl -sLO "https://raw.githubusercontent.com/prowler-cloud/prowler/refs/tags/${V
 docker compose up -d
 ```
 
-_Windows PowerShell:_
-
-``` powershell
-$VERSION = (Invoke-RestMethod -Uri "https://api.github.com/repos/prowler-cloud/prowler/releases/latest").tag_name
-Invoke-WebRequest -Uri "https://raw.githubusercontent.com/prowler-cloud/prowler/refs/tags/$VERSION/docker-compose.yml" -OutFile "docker-compose.yml"
-# Environment variables can be customized in the .env file. Using default values in production environments is not recommended.
-Invoke-WebRequest -Uri "https://raw.githubusercontent.com/prowler-cloud/prowler/refs/tags/$VERSION/.env" -OutFile ".env"
-docker compose up -d
-```
-
 > [!WARNING]
 > 🔒 For a secure setup, the API auto-generates a unique key pair, `DJANGO_TOKEN_SIGNING_KEY` and `DJANGO_TOKEN_VERIFYING_KEY`, and stores it in `~/.config/prowler-api` (non-container) or the bound Docker volume in `_data/api` (container). Never commit or reuse static/default keys. To rotate keys, delete the stored key files and restart the API.
 
-Once configured, access Prowler Local Server at http://localhost:3000. Sign up using your email and password to get started.
+Once configured, access the Prowler App at http://localhost:3000. Sign up using your email and password to get started.
 
 ### Common Issues with Docker Pull Installation
 
@@ -273,7 +236,7 @@ pnpm run build
 pnpm start
 ```
 
-> Once configured, access Prowler Local Server at http://localhost:3000. Sign up using your email and password to get started.
+> Once configured, access the Prowler App at http://localhost:3000. Sign up using your email and password to get started.
 
 #### Pre-commit Hooks Setup
 
@@ -291,7 +254,7 @@ Prowler CLI is available as a project in [PyPI](https://pypi.org/project/prowler
 pip install prowler
 prowler -v
 ```
->For further guidance, refer to [https://docs.prowler.com](https://docs.prowler.com/getting-started/installation/prowler-cli)
+>For further guidance, refer to [https://docs.prowler.com](https://docs.prowler.com/projects/prowler-open-source/en/latest/#prowler-cli-installation)
 
 ### Containers
 
@@ -311,7 +274,7 @@ The container images are available here:
 - Prowler CLI:
     - [DockerHub](https://hub.docker.com/r/prowlercloud/prowler/tags)
     - [AWS Public ECR](https://gallery.ecr.aws/prowler-cloud/prowler)
-- Prowler Local Server:
+- Prowler App:
     - [DockerHub - Prowler UI](https://hub.docker.com/r/prowlercloud/prowler-ui/tags)
     - [DockerHub - Prowler API](https://hub.docker.com/r/prowlercloud/prowler-api/tags)
 
@@ -361,55 +324,17 @@ Full configuration, per-provider authentication, and SARIF examples: [Prowler Gi
 
 # ✏️ High level architecture
 
-## Prowler Local Server
-**Prowler Local Server** is composed of four key components:
+## Prowler App
+**Prowler App** is composed of four key components:
 
 - **Prowler UI**: A web-based interface, built with Next.js, providing a user-friendly experience for executing Prowler scans and visualizing results.
 - **Prowler API**: A backend service, developed with Django REST Framework, responsible for running Prowler scans and storing the generated results.
 - **Prowler SDK**: A Python SDK designed to extend the functionality of the Prowler CLI for advanced capabilities.
 - **Prowler MCP Server**: A Model Context Protocol server that provides AI tools for Lighthouse, the AI-powered security assistant. This is a critical dependency for Lighthouse functionality.
 
-```mermaid
-flowchart TB
-    user([User / Security Team])
-    cli([Prowler CLI])
+![Prowler App Architecture](docs/images/products/prowler-app-architecture.png)
 
-    subgraph APP["Prowler Local Server"]
-        ui["Prowler UI<br/>(Next.js)"]
-        api["Prowler API<br/>(Django REST Framework)"]
-        worker["API Worker<br/>(Celery)"]
-        beat["API Scheduler<br/>(Celery Beat)"]
-        mcp["Prowler MCP Server<br/>(Lighthouse AI tools)"]
-    end
-
-    sdk["Prowler SDK<br/>(Python)"]
-
-    subgraph DATA["Data Layer"]
-        pg[("PostgreSQL")]
-        valkey[("Valkey / Redis")]
-        neo4j[("Neo4j")]
-    end
-
-    providers["Providers"]
-
-    user --> ui
-    user --> cli
-    ui -->|REST| api
-    ui -->|MCP HTTP| mcp
-    mcp -->|REST| api
-    api --> pg
-    api --> valkey
-    beat -->|enqueue jobs| valkey
-    valkey -->|dispatch| worker
-    worker --> pg
-    worker -->|Attack Paths| neo4j
-    worker -->|invokes| sdk
-    cli --> sdk
-
-    sdk --> providers
-```
-
-<!-- Diagram source: docs/images/products/prowler-app-architecture.mmd — keep this inline block, the docs page getting-started/products/prowler-app.mdx, and the .mmd file in sync. -->
+<!-- Diagram source: docs/images/products/prowler-app-architecture.mmd — edit there, re-render at https://mermaid.live, and replace the PNG. -->
 
 
 ## Prowler CLI

api/.env.example

@@ -24,9 +24,6 @@ DJANGO_THROTTLE_TOKEN_OBTAIN=50/minute
 # Decide whether to allow Django manage database table partitions
 DJANGO_MANAGE_DB_PARTITIONS=[True|False]
 DJANGO_CELERY_DEADLOCK_ATTEMPTS=5
-# Optional: bound Celery's prefork pool size. Unset → Celery uses os.cpu_count().
-# Useful on Kubernetes nodes with many CPUs where unbounded prefork balloons memory.
-# DJANGO_CELERY_WORKER_CONCURRENCY=4
 DJANGO_BROKER_VISIBILITY_TIMEOUT=86400
 DJANGO_SENTRY_DSN=
 

api/CHANGELOG.md

@@ -2,337 +2,11 @@
 
 All notable changes to the **Prowler API** are documented in this file.
 
-<!-- changelog: release notes start -->
-
-## [1.40.1] (Prowler v5.39.1)
-
-### 🔄 Changed
-
-- Bump alibabacloud-tea-openapi to 0.4.6, oci to 2.184.1 and pyopenssl to 26.4.0 to match the SDK; the cryptography override now names its actual blockers (azure-cli-core pins msal below 1.37, workos 8.3.0 requires cryptography 48) [(#12477)](https://github.com/prowler-cloud/prowler/pull/12477)
-
-### 🐞 Fixed
-
-- Pin zstd to 1.5.7.2; 1.5.7.3 was yanked from PyPI as not thread safe [(#12477)](https://github.com/prowler-cloud/prowler/pull/12477)
-
-### 🔐 Security
-
-- Trivy from v0.72.0 to v0.73.0 in the container image, fixing HIGH CVE-2026-46600 in the bundled `golang.org/x/net` [(#12445)](https://github.com/prowler-cloud/prowler/pull/12445)
-- Trivy v0.74.0 and Debian util-linux 2.41.5-0+deb13u1 in the API container image, patching Go standard library vulnerabilities and CVE-2026-53615 [(#12470)](https://github.com/prowler-cloud/prowler/pull/12470)
-
----
-
-## [1.40.0] (Prowler v5.39.0)
-
-### 🔄 Changed
-
-- `GET /api/v1/users/me` membership relationships identify the active tenant with `meta.active` for JWT and API key authentication [(#12388)](https://github.com/prowler-cloud/prowler/pull/12388)
-
-### 🐞 Fixed
-
-- Tenant deletion no longer leaves memberships partially removed when exclusive-user cleanup fails [(#12379)](https://github.com/prowler-cloud/prowler/pull/12379)
-- `/api/v1/accounts/saml/{organization_slug}/acs/` rejects non-POST requests before SAML response processing [(#12393)](https://github.com/prowler-cloud/prowler/pull/12393)
-- Social login derives a valid user name when identity providers omit the profile name [(#12413)](https://github.com/prowler-cloud/prowler/pull/12413)
-
----
-
-## [1.39.0] (Prowler v5.38.0)
-
-### 🚀 Added
-
-- Attack Paths adds 20 AWS privilege-escalation detection queries from pathfinding.cloud, covering service PassRole escalations (Batch, Braket, Cognito Identity, ECS, EMR, EMR Serverless, GameLift, Glue, EC2 Image Builder, Kinesis Analytics, HealthOmics, EventBridge Scheduler, SSM, Step Functions), CodeDeploy and Step Functions existing-resource abuse, role permissions-boundary removal with role assumption, and IAM Identity Center permission-set policy injection [(#12237)](https://github.com/prowler-cloud/prowler/pull/12237)
-- Attack Paths query metadata now carries an outcome (Code execution, Privilege escalation, Public exposure, or Resource inventory), exposed on the queries endpoint so the graph can show a terminal outcome node [(#12344)](https://github.com/prowler-cloud/prowler/pull/12344)
-- Container images now ship an SBOM and build provenance as OCI attestations [(#12352)](https://github.com/prowler-cloud/prowler/pull/12352)
-
-### 🔄 Changed
-
-- Pin the container vulnerability scanner to Trivy v0.72.0, matching prowler-registry and partner-portal [(#12346)](https://github.com/prowler-cloud/prowler/pull/12346)
-
-### 🐞 Fixed
-
-- Compliance report output directory failures are now logged with the exception attached and fingerprinted by `errno` in Sentry, so `ENOSPC`, `ENOENT` and `EACCES` no longer share a single issue [(#12142)](https://github.com/prowler-cloud/prowler/pull/12142)
-- Restored the SDK dependency to `@master` now that the dependency bumps have landed there, and regenerated the lock. The API image no longer builds against a temporary integration branch [(#12309)](https://github.com/prowler-cloud/prowler/pull/12309)
-
-### 🔐 Security
-
-- The API container image now verifies the checksum of every third-party binary it downloads (PowerShell, Trivy, zizmor) before installing it [(#12334)](https://github.com/prowler-cloud/prowler/pull/12334)
-- Upgrade aiohttp to 3.14.3 to pick up the fix for CVE-2026-69244 [(#12340)](https://github.com/prowler-cloud/prowler/pull/12340)
-- Upgrade cryptography to 50.0.0, closing CVE-2026-69247 and CVE-2026-69249 [(#12356)](https://github.com/prowler-cloud/prowler/pull/12356)
-
----
-
-## [1.38.1] (Prowler v5.37.1)
-
-### 🐞 Fixed
-
-- Entra Conditional Access guest-user checks no longer report false FAILs in M365 scans: microsoft-kiota packages overridden to 1.9.10 so `guestOrExternalUserTypes` (a flags enum Graph serializes as a comma-separated string) deserializes correctly instead of returning an empty list [(#12315)](https://github.com/prowler-cloud/prowler/pull/12315)
-
-### 🔐 Security
-
-- The API container image now builds on Debian 13 (trixie), taking its critical CVE count from 18 to 4 [(#12311)](https://github.com/prowler-cloud/prowler/pull/12311)
-- Bumped PowerShell, Trivy and uv in the API container image, clearing 14 high-severity CVEs [(#12311)](https://github.com/prowler-cloud/prowler/pull/12311)
-- Bumped `workos` and `pyopenssl` so the API can move to `cryptography` 48.0.1 [(#12311)](https://github.com/prowler-cloud/prowler/pull/12311)
-- Removed `gnupg` and `apt-transport-https` from the API container image [(#12311)](https://github.com/prowler-cloud/prowler/pull/12311)
-- The API container image no longer ships `git`; removing it also dropped `perl`, `perl-modules`, `libperl` and `liberror-perl`, clearing 12 critical CVEs. Only `perl-base` remains, which Debian marks Essential and cannot be removed [(#12311)](https://github.com/prowler-cloud/prowler/pull/12311)
-- Removed `pip` from the API container image, clearing two high-severity CVEs in the vendored copies of `setuptools` and `msgpack` [(#12311)](https://github.com/prowler-cloud/prowler/pull/12311)
-- Bumped `pillow` to 12.3.0, `httplib2` to 0.32.0 and `pyasn1` to 0.6.4 to resolve known CVEs [(#12311)](https://github.com/prowler-cloud/prowler/pull/12311)
-
----
-
-## [1.38.0] (Prowler v5.37.0)
-
-### 🚀 Added
-
-- Attack Paths: four AWS privilege-escalation detection queries from pathfinding.cloud: cross-account role trust (STS-002), wildcard role trust (STS-003), user permissions-boundary removal (IAM-022), and IAM Identity Center permission-set escalation (SSO-001) [(#11460)](https://github.com/prowler-cloud/prowler/pull/11460)
-
-### 🐞 Fixed
-
-- Attack Paths IAM privilege-escalation queries no longer build an all-nodes × all-resource-items cartesian product, fixing runtime errors and timeouts on accounts with many IAM roles, users, or groups [(#12136)](https://github.com/prowler-cloud/prowler/pull/12136)
-- `task_args` serialization no longer returns HTTP 500 errors when Celery truncates stored task keyword arguments [(#12165)](https://github.com/prowler-cloud/prowler/pull/12165)
-- Attack Paths predefined queries on migrated graphs are now scoped with the provider label, letting the graph database seed from its label index instead of a global label scan and preventing query timeouts on Neptune [(#12167)](https://github.com/prowler-cloud/prowler/pull/12167)
-- Authentication with an API key whose owning user was deleted now returns `401` instead of an unhandled `AttributeError`, and user deletion now revokes the user's API keys across all their tenants [(#12210)](https://github.com/prowler-cloud/prowler/pull/12210)
-- AWS Security Hub integrations now persist successful connection checks during finding delivery so their connection status and last checked timestamp stay current [(#12212)](https://github.com/prowler-cloud/prowler/pull/12212)
-- SAML users without a `userType` attribute and without an existing role in the SAML tenant now receive a least-privilege `read_only` fallback role; a numeric suffix is used when that name belongs to a role with different permissions [(#12223)](https://github.com/prowler-cloud/prowler/pull/12223)
-- Social signups create users and authentication records in one database transaction, preventing incomplete accounts when provisioning fails [(#12245)](https://github.com/prowler-cloud/prowler/pull/12245)
-- Requesting integrations with a sparse fieldset that leaves out `configuration` no longer returns HTTP 500 errors when the tenant has a Jira integration [(#12261)](https://github.com/prowler-cloud/prowler/pull/12261)
-
-### 🔐 Security
-
-- Provider deletion and connection checks, scan creation, provider secrets, provider groups, and daily schedules now respect role provider-group visibility [(#12216)](https://github.com/prowler-cloud/prowler/pull/12216)
-
----
-
-## [1.37.0] (Prowler v5.36.0)
-
-### 🔄 Changed
-
-- OCI provider secrets no longer require `region`; legacy `region` input is accepted for backwards compatibility but ignored before storing or scanning [(#11741)](https://github.com/prowler-cloud/prowler/pull/11741)
-- Compliance overview ingest now runs in a single transaction per scan with a configurable `COPY` batch size (`DJANGO_COMPLIANCE_COPY_BATCH_SIZE`, default 2000), reducing write pressure on the database [(#11875)](https://github.com/prowler-cloud/prowler/pull/11875)
-
-### 🐞 Fixed
-
-- Scan findings now recover resources missing from the in-memory cache after resource pre-resolution, preventing valid findings from being skipped [(#12002)](https://github.com/prowler-cloud/prowler/pull/12002)
-- Tenant-wide integrations that are not attached to any provider, such as Jira, are now visible and manageable by roles with `manage_integrations` and without unlimited visibility [(#12060)](https://github.com/prowler-cloud/prowler/pull/12060)
-- Output generation now removes the scan's temporary output directory before writing, so a re-run of the task for the same scan (e.g. broker redelivery after a worker is killed mid-run) no longer appends to the previous run's files and duplicates finding rows in the exported CSV and other outputs [(#12097)](https://github.com/prowler-cloud/prowler/pull/12097)
-
-### 🔐 Security
-
-- Integration responses no longer disclose providers outside the visibility of the role, including the resources sideloaded through `?include=providers` [(#12060)](https://github.com/prowler-cloud/prowler/pull/12060)
-- Integration connection checks, Jira issue type lookups and Jira dispatches now resolve the integration through the provider visibility of the role instead of the whole tenant [(#12060)](https://github.com/prowler-cloud/prowler/pull/12060)
-- Roles without unlimited visibility can no longer attach an integration to providers they cannot see, nor edit or delete an integration bound to them [(#12060)](https://github.com/prowler-cloud/prowler/pull/12060)
-- Kubernetes kubeconfig validation now rejects legacy `auth-provider.config.cmd-path` command authentication in Prowler Cloud/API [(#12091)](https://github.com/prowler-cloud/prowler/pull/12091)
-
----
-
-## [1.36.0] (Prowler v5.35.0)
-
-### 🐞 Fixed
-
-- `attack-paths-scan-perform` Celery tasks now use the configurable long-task time limits instead of the six-hour defaults [(#12009)](https://github.com/prowler-cloud/prowler/pull/12009)
-- Attack Paths scans handle provider deletion races cleanly, detect stale tasks after 16 hours, use backend-specific graph synchronization batches, and report exhausted Neptune write retries with the original database error [(#12019)](https://github.com/prowler-cloud/prowler/pull/12019)
-
-### 🔐 Security
-
-- Jira integration credentials only accept bare Atlassian site names containing letters, numbers, and hyphens [(#12012)](https://github.com/prowler-cloud/prowler/pull/12012)
-- Social account linking requires a verified matching email from both the identity provider and the existing user account without sending account connection notifications [(#12013)](https://github.com/prowler-cloud/prowler/pull/12013)
-
----
-
-## [1.35.0] (Prowler v5.34.0)
-
-### 🐞 Fixed
-
-- `rls_transaction` now falls back directly to the primary DB for connection-level mid-query read replica failures via `execute_wrapper`, reducing non-streaming read crashes during replica recovery [(#10379)](https://github.com/prowler-cloud/prowler/pull/10379)
-- RBAC permission gates now combine permissions from every role assigned to a user in the active tenant [(#11979)](https://github.com/prowler-cloud/prowler/pull/11979)
-- `attack-paths-cleanup-stale-scans` now retries worker pings and checks recent scan activity before failing scans and removing temporary databases [(#11986)](https://github.com/prowler-cloud/prowler/pull/11986)
-
-### 🔐 Security
-
-- User role relationship updates are limited to the active tenant to preserve role assignments in other tenants [(#11903)](https://github.com/prowler-cloud/prowler/pull/11903)
-- `api` container image removes the unused Debian `libxml2` runtime package and scopes the `CVE-2026-13221` Trivy exception to unaffected Perl 5.36 packages [(#11991)](https://github.com/prowler-cloud/prowler/pull/11991)
-
----
-
-## [1.34.2] (Prowler v5.33.2)
-
-### 🐞 Fixed
-
-- Attack Paths graph mutations now retry transient Neptune concurrency and deadline failures, while Neo4j mutations use managed transaction retries [(#11968)](https://github.com/prowler-cloud/prowler/pull/11968)
-- Attack Paths scans now use bounded child node identifiers for normalized list values in Neo4j and Neptune, preventing Neo4j RANGE index key size failures [(#11969)](https://github.com/prowler-cloud/prowler/pull/11969)
-- `scan-summary` aggregation now upserts summaries in deterministic conflict-key order, preventing PostgreSQL deadlocks during concurrent reaggregation [(#11971)](https://github.com/prowler-cloud/prowler/pull/11971)
-
----
-
-## [1.34.1] (Prowler v5.33.1)
-
-### 🐞 Fixed
-
-- Session tokens are rejected after account password updates [(#11914)](https://github.com/prowler-cloud/prowler/pull/11914)
-- Jira dispatch task results now surface user-facing Jira failure messages [(#11925)](https://github.com/prowler-cloud/prowler/pull/11925)
-- AWS Attack Paths privilege escalation queries no longer fail on Neo4j with `Aggregation column contains implicit grouping expressions` [(#11939)](https://github.com/prowler-cloud/prowler/pull/11939)
-
-### 🔐 Security
-
-- OpenAI-compatible Lighthouse provider base URLs are restricted before connection checks [(#11940)](https://github.com/prowler-cloud/prowler/pull/11940)
-- `LIGHTHOUSE_AI_OPENAI_COMPATIBLE_ALLOWED_HOSTS` environment variable to allow internal hosts as OpenAI-compatible Lighthouse AI base URLs [(#11942)](https://github.com/prowler-cloud/prowler/pull/11942)
-
----
-
-## [1.34.0] (Prowler v5.33.0)
-
-### 🚀 Added
-
-- Compliance PDF reports no longer require provider credentials: findings are enriched from the provider metadata stored in the database, so reports generate even after the provider secret is deleted or its credentials become invalid [(#11845)](https://github.com/prowler-cloud/prowler/pull/11845)
-
-### 🐞 Fixed
-
-- Provider scans now queue behind active provider scans instead of dispatching concurrently, and resource failed-finding counters retry database conflicts with stable row locking [(#11848)](https://github.com/prowler-cloud/prowler/pull/11848)
-
----
-
-## [1.33.1] (Prowler v5.32.1)
-
-### 🐞 Fixed
-
-- Attack Paths: Scan rows now have database defaults for `is_migrated` and `sink_backend` so `scan-perform-scheduled` inserts survive deploy skew [(#11826)](https://github.com/prowler-cloud/prowler/pull/11826)
-- Invited users now keep their invitation context when completing authentication with Google, GitHub, or SAML, so the invitation is accepted during login [(#11752)](https://github.com/prowler-cloud/prowler/pull/11752)
-
-### 🔐 Security
-
-- User profile updates now allow users to update their own account while requiring user-management permissions to update other users in the same tenant [(#11792)](https://github.com/prowler-cloud/prowler/pull/11792)
-- Kubernetes provider credentials now reject kubeconfigs using `exec` authentication in Prowler Cloud, preventing user-supplied commands from running on Cloud workers [(#11753)](https://github.com/prowler-cloud/prowler/pull/11753)
-
----
-
-## [1.33.0] (Prowler v5.32.0)
-
-### 🚀 Added
-
-- Timestamp precision support for `/api/v1/findings` `inserted_at` and `updated_at` filters [(#11754)](https://github.com/prowler-cloud/prowler/pull/11754)
-
-### 🔄 Changed
-
-- Attack Paths: AWS Neptune is now supported as a persistent sink database, selectable via `ATTACK_PATHS_SINK_DATABASE=neptune` (default `neo4j`), Cartography's (bumped to 0.138.1) per-scan ingest database stays on Neo4j [(#11524)](https://github.com/prowler-cloud/prowler/pull/11524)
-- Attack Paths: Scan task now checks the ingest Neo4j database and configured graph sink before starting graph ingestion [(#11743)](https://github.com/prowler-cloud/prowler/pull/11743)
-- Disable PowerShell telemetry in the API container image [(#11746)](https://github.com/prowler-cloud/prowler/pull/11746)
-
-### 🐞 Fixed
-
-- Attack Paths: Provider graph cleanup now deletes Neo4j and Neptune relationships in directed batches before deleting nodes [(#11755)](https://github.com/prowler-cloud/prowler/pull/11755)
-- `scan-perform` no longer reports an error when a provider is deleted during a running scan [(#11696)](https://github.com/prowler-cloud/prowler/pull/11696)
-
----
-
-## [1.32.1] (Prowler v5.31.1)
-
-### 🐞 Fixed
-
-- API key auth no longer mutates `TenantAPIKey.objects` during admin DB lookups [(#11686)](https://github.com/prowler-cloud/prowler/pull/11686)
-
----
-
-## [1.32.0] (Prowler v5.31.0)
-
-### 🚀 Added
-
-- Provider group filters for API endpoints that support cloud provider filtering, including exact and `__in` variants [(#11573)](https://github.com/prowler-cloud/prowler/pull/11573)
-- Provider filters for `GET /api/v1/compliance-overviews`, `/metadata`, and `/requirements`, using latest completed scans per matching provider [(#11587)](https://github.com/prowler-cloud/prowler/pull/11587)
-- Server-Sent Events (SSE) infrastructure for the API: a base viewset, a tenant-aware channel manager, and channel-name helpers backed by `django-eventstream` over Valkey Pub/Sub and served through the Gunicorn ASGI worker, so feature endpoints can stream events to clients over a single long-lived connection [(#11556)](https://github.com/prowler-cloud/prowler/pull/11556)
-- `DJANGO_CELERY_WORKER_CONCURRENCY` to configure Celery workers concurrency. Unset for default behaviour [(#11075)](https://github.com/prowler-cloud/prowler/pull/11075)
-
-### 🔄 Changed
-
-- Gunicorn worker timeout raised from the 30s default to 120s, so long-running requests are no longer killed prematurely [(#11631)](https://github.com/prowler-cloud/prowler/pull/11631)
-- Sentry now drops ASGI's `RequestAborted` errors from health-check probe disconnects on `/health/live` [(#11632)](https://github.com/prowler-cloud/prowler/pull/11632)
-- Gunicorn keep-alive timeout now exceeds the load balancer idle timeout, stopping 502s from reused connections [(#11647)](https://github.com/prowler-cloud/prowler/pull/11647)
-- API runs under the Uvicorn worker so keep-alive outlives the load balancer idle timeout, fixing Gunicorn's intermittent 502s [(#11663)](https://github.com/prowler-cloud/prowler/pull/11663)
-- SAML logins no longer wipe a user's roles when the IdP does not send the `userType` attribute; existing roles are kept, and when `userType` names a role that does not exist it is now created with read-only access (visibility over all providers, no management permissions) instead of no permissions at all [(#11520)](https://github.com/prowler-cloud/prowler/pull/11520)
-
-### 🐞 Fixed
-
-- Database connections no longer leak under the ASGI worker, which previously exhausted the read replica's connection slots and caused 500s on read endpoints [(#11640)](https://github.com/prowler-cloud/prowler/pull/11640)
-
-### 🔐 Security
-
-- `aiohttp` to 3.14.0 and `idna` to 3.15, patching known CVEs [(#11596)](https://github.com/prowler-cloud/prowler/pull/11596)
-- Container base image to `python:3.12.13-slim-bookworm` and `trivy` to 0.71.0, patching OS and Go module CVEs [(#11596)](https://github.com/prowler-cloud/prowler/pull/11596)
-- `trivy` binary bumped to 0.71.0 patching embedded `golang.org/x/crypto`, `golang.org/x/net`, and Go `stdlib` CVEs [(#11592)](https://github.com/prowler-cloud/prowler/pull/11592)
-
----
-
-## [1.31.3] (Prowler v5.30.3)
-
-### 🔐 Security
-
-- SAML logins now link to an existing account only when the asserted email domain matches the ACS endpoint and the user is already a member of that domain's tenant, fixing a cross-tenant account takeover [(GHSA-h8m9-jgf8-vwvp)](https://github.com/prowler-cloud/prowler/security/advisories/GHSA-h8m9-jgf8-vwvp)
-
----
-
-## [1.31.2] (Prowler v5.30.2)
-
-### 🔄 Changed
-
-- `scan-compliance-overviews` task now streams the findings aggregation and the requirement-row writes so it runs faster and its peak memory no longer grows with the number of regions and frameworks [(#11591)](https://github.com/prowler-cloud/prowler/pull/11591)
-
----
-
-## [1.31.1] (Prowler v5.30.1)
-
-### 🐞 Fixed
-
-- `compliance-overviews/attributes` now resolves the provider from the scan, so multi-provider universal frameworks (e.g. CSA CCM) return the check IDs of the scan's provider and Azure/GCP requirement details show their findings instead of appearing empty [(#11546)](https://github.com/prowler-cloud/prowler/pull/11546)
-- Attack Paths: `drop_subgraph` now deletes relationships first and then nodes in batches, using less memory on Neo4j when clearing a dense provider graph [(#11557)](https://github.com/prowler-cloud/prowler/pull/11557)
-- OCI scans now use API key credentials with the configured region instead of falling back to `/home/prowler/.oci/config` [(#11558)](https://github.com/prowler-cloud/prowler/pull/11558)
-
----
-
-## [1.31.0] (Prowler v5.30.0)
-
-### 🚀 Added
-
-- Opt-in automatic recovery of allowlisted idempotent background tasks whose worker died during a deploy or crash: when enabled via `DJANGO_TASK_RECOVERY_ENABLED` (off by default), stuck summary and deletion tasks are detected and re-run instead of staying pending forever (scan and Jira tasks are excluded), with a `reconcile_orphan_tasks` management command for on-demand recovery [(#11416)](https://github.com/prowler-cloud/prowler/pull/11416)
-- DORA compliance framework support [(#11131)](https://github.com/prowler-cloud/prowler/pull/11131)
-- Label Postgres connections with `application_name="<component>:<alias>"` (component injected per process via `DJANGO_APP_COMPONENT`) so connections are attributable by component in `pg_stat_activity` [(#11494)](https://github.com/prowler-cloud/prowler/pull/11494)
-- DISA Okta IDaaS STIG V1R2 compliance framework export support for the Okta provider [(#11428)](https://github.com/prowler-cloud/prowler/pull/11428)
-
-### 🔄 Changed
-
-- Allowlisted idempotent background tasks are no longer lost when a worker is stopped or crashes mid-task; tasks with external side effects are marked terminal instead of blindly re-running [(#11416)](https://github.com/prowler-cloud/prowler/pull/11416)
-
-### 🐞 Fixed
-
-- Workers now shut down gracefully on deploy or restart, finishing or re-queueing in-flight tasks instead of being force-killed and leaving them stuck [(#11416)](https://github.com/prowler-cloud/prowler/pull/11416)
-- Resource `name` is now stored and refreshed on every scan, so resources no longer keep an empty name [(#11476)](https://github.com/prowler-cloud/prowler/pull/11476)
-- Compliance catalog now warms in background during startup. `compliance-overviews/attributes` returns `503` while warming, so the first request after a deploy no longer trips the API timeout [(#11530)](https://github.com/prowler-cloud/prowler/pull/11530)
-
-### 🔐 Security
-
-- `dulwich` from 0.23.0 to 1.2.5 and `pyjwt` from 2.12.1 to 2.13.0, patching `GHSA-897w-fcg9-f6xj` (arbitrary file write) and `PYSEC-2026-179` (HMAC/JWK key confusion) [(#11499)](https://github.com/prowler-cloud/prowler/pull/11499)
-
----
-
-## [1.30.3] (Prowler v5.29.3)
-
-### 🐞 Fixed
-
-- API startup no longer crashes when Neo4j is unreachable, as the Neo4j driver now connects lazily on first use rather than during app initialization [(#11491)](https://github.com/prowler-cloud/prowler/pull/11491)
-
----
-
-## [1.30.1] (Prowler v5.29.1)
-
-### 🐞 Fixed
-
-- `GET /api/v1/findings` N+1 query loading `resources__tags` when listing findings [(#11420)](https://github.com/prowler-cloud/prowler/pull/11420)
-- Clean up the scan tmp output directory when `scan-report` fails so partial files do not accumulate and fill the worker disk (`No space left on device`) [(#11421)](https://github.com/prowler-cloud/prowler/pull/11421)
-
----
-
-## [1.30.0] (Prowler v5.29.0)
+## [1.30.0] (Prowler UNRELEASED)
 
 ### 🔄 Changed
 
 - Scan finding ingestion: bulk-resolve `Resource`/`ResourceTag` rows, replace per-mapping `SELECT FOR UPDATE` with deferred `ResourceTagMapping.bulk_create(ignore_conflicts=True)`, wrap each micro-batch in a single `rls_transaction`, and raise `SCAN_DB_BATCH_SIZE` to 1000 [(#11249)](https://github.com/prowler-cloud/prowler/pull/11249)
-- Faster `GET /api/v1/finding-groups/latest` aggregation on tenants where one recent scan holds most findings [(#11380)](https://github.com/prowler-cloud/prowler/pull/11380)
 
 ---
 

api/Dockerfile

@@ -1,31 +1,21 @@
-FROM python:3.12.13-slim-trixie@sha256:57cd7c3a7a273101a6485ba99423ee568157882804b1124b4dd04266317710de AS build
+FROM python:3.12.10-slim-bookworm@sha256:fd95fa221297a88e1cf49c55ec1828edd7c5a428187e67b5d1805692d11588db AS build
 
 LABEL maintainer="https://github.com/prowler-cloud/api"
 
-ARG POWERSHELL_VERSION=7.5.9
+ARG POWERSHELL_VERSION=7.5.0
 ENV POWERSHELL_VERSION=${POWERSHELL_VERSION}
-# Opt out of PowerShell telemetry (Application Insights -> dc.services.visualstudio.com)
-ENV POWERSHELL_TELEMETRY_OPTOUT=1
 
-ARG TRIVY_VERSION=0.74.0
+ARG TRIVY_VERSION=0.70.0
 ENV TRIVY_VERSION=${TRIVY_VERSION}
 
 ARG ZIZMOR_VERSION=1.24.1
 ENV ZIZMOR_VERSION=${ZIZMOR_VERSION}
 
-# Pinned here, not fetched with the artefact: a compromised release ships its own checksum.
-ARG TRIVY_SHA256_AMD64=2ae6fe3ee734b7fdf11335663e18c75ea12dccc76062f09f164a3b0f8be4371a
-ARG TRIVY_SHA256_ARM64=b94ce1976bbf3c15b514b605ee88be7c6d94a29be2302847ff01cb794d47aad5
-ARG POWERSHELL_SHA256_AMD64=492ff26bb958336bf61e597ce19e07648b4003bd2a08659e02f0e3e0446ebfe0
-ARG POWERSHELL_SHA256_ARM64=2503b71da3e83635592b092df59a0aca4c3606b4d9b068217bb00be989cb0d56
-ARG ZIZMOR_SHA256_AMD64=a8000f3c683319a523d3b20df0e75457ba591f049cfcbfa98966631b56733c03
-ARG ZIZMOR_SHA256_ARM64=d66e37ef8a375fb07939c630ebf9709a6e0f20242bdc3faf672a7ed97e0b768d
-
 # hadolint ignore=DL3008
 RUN apt-get update && apt-get install -y --no-install-recommends \
     wget \
     git \
-    libicu76 \
+    libicu72 \
     gcc \
     g++ \
     make \
@@ -36,7 +26,7 @@ RUN apt-get update && apt-get install -y --no-install-recommends \
     libtool \
     libxslt1-dev \
     python3-dev \
-    && apt-get install -y --no-install-recommends --only-upgrade util-linux \
+    git \
     && rm -rf /var/lib/apt/lists/*
 
 # Install PowerShell
@@ -48,9 +38,6 @@ RUN ARCH=$(uname -m) && \
     else \
         echo "Unsupported architecture: $ARCH" && exit 1 ; \
     fi && \
-    if [ "$ARCH" = "x86_64" ]; then EXPECT="$POWERSHELL_SHA256_AMD64" ; else EXPECT="$POWERSHELL_SHA256_ARM64" ; fi && \
-    echo "$EXPECT  /tmp/powershell.tar.gz" > /tmp/powershell.sha256 && \
-    sha256sum -c /tmp/powershell.sha256 && rm /tmp/powershell.sha256 && \
     mkdir -p /opt/microsoft/powershell/7 && \
     tar zxf /tmp/powershell.tar.gz -C /opt/microsoft/powershell/7 && \
     chmod +x /opt/microsoft/powershell/7/pwsh && \
@@ -67,9 +54,6 @@ RUN ARCH=$(uname -m) && \
         echo "Unsupported architecture for Trivy: $ARCH" && exit 1 ; \
     fi && \
     wget --progress=dot:giga "https://github.com/aquasecurity/trivy/releases/download/v${TRIVY_VERSION}/trivy_${TRIVY_VERSION}_${TRIVY_ARCH}.tar.gz" -O /tmp/trivy.tar.gz && \
-    if [ "$ARCH" = "x86_64" ]; then EXPECT="$TRIVY_SHA256_AMD64" ; else EXPECT="$TRIVY_SHA256_ARM64" ; fi && \
-    echo "$EXPECT  /tmp/trivy.tar.gz" > /tmp/trivy.sha256 && \
-    sha256sum -c /tmp/trivy.sha256 && rm /tmp/trivy.sha256 && \
     tar zxf /tmp/trivy.tar.gz -C /tmp && \
     mv /tmp/trivy /usr/local/bin/trivy && \
     chmod +x /usr/local/bin/trivy && \
@@ -88,9 +72,6 @@ RUN ARCH=$(uname -m) && \
         echo "Unsupported architecture for zizmor: $ARCH" && exit 1 ; \
     fi && \
     wget --progress=dot:giga "https://github.com/zizmorcore/zizmor/releases/download/v${ZIZMOR_VERSION}/zizmor-${ZIZMOR_ARCH}.tar.gz" -O /tmp/zizmor.tar.gz && \
-    if [ "$ARCH" = "x86_64" ]; then EXPECT="$ZIZMOR_SHA256_AMD64" ; else EXPECT="$ZIZMOR_SHA256_ARM64" ; fi && \
-    echo "$EXPECT  /tmp/zizmor.tar.gz" > /tmp/zizmor.sha256 && \
-    sha256sum -c /tmp/zizmor.sha256 && rm /tmp/zizmor.sha256 && \
     mkdir -p /tmp/zizmor-extract && \
     tar zxf /tmp/zizmor.tar.gz -C /tmp/zizmor-extract && \
     mv /tmp/zizmor-extract/zizmor /usr/local/bin/zizmor && \
@@ -111,7 +92,7 @@ RUN mkdir -p /tmp/prowler_api_output
 COPY --chown=prowler:prowler pyproject.toml uv.lock ./
 
 RUN pip install --no-cache-dir --upgrade pip && \
-    pip install --no-cache-dir uv==0.12.0
+    pip install --no-cache-dir uv==0.11.14
 
 ENV PATH="/home/prowler/.local/bin:$PATH"
 
@@ -119,42 +100,7 @@ ENV PATH="/home/prowler/.local/bin:$PATH"
 RUN uv sync --locked --no-install-project && \
     rm -rf ~/.cache/uv
 
-# Invoked as a module so the base image's Python minor version is not baked
-# into a site-packages path.
-RUN .venv/bin/python -m prowler.providers.m365.lib.powershell.m365_powershell
-
-USER root
-
-# Remove build-only packages from the final image after Python dependencies are installed.
-# git is only needed by uv sync for the `prowler @ git+...` dependency; purging it drops perl too.
-# wget stays: the compose healthcheck shells out to it.
-RUN apt-get purge -y --auto-remove \
-    gcc \
-    g++ \
-    git \
-    make \
-    libxml2-dev \
-    libxmlsec1-dev \
-    libxmlsec1-openssl \
-    libxmlsec1t64 \
-    libxmlsec1t64-openssl \
-    pkg-config \
-    libtool \
-    libxslt1-dev \
-    python3-dev \
-    gnupg \
-    apt-transport-https \
-    && rm -rf /var/lib/apt/lists/*
-
-# pip is build-only; the entrypoint runs uv against the prepared venv. uv stays.
-RUN rm -rf /usr/local/lib/python3.12/site-packages/pip \
-    /usr/local/lib/python3.12/site-packages/pip-*.dist-info \
-    /home/prowler/.local/lib/python3.12/site-packages/pip \
-    /home/prowler/.local/lib/python3.12/site-packages/pip-*.dist-info \
-    /usr/local/bin/pip /usr/local/bin/pip3 /usr/local/bin/pip3.12 \
-    /home/prowler/.local/bin/pip /home/prowler/.local/bin/pip3 /home/prowler/.local/bin/pip3.12
-
-USER prowler
+RUN .venv/bin/python .venv/lib/python3.12/site-packages/prowler/providers/m365/lib/powershell/m365_powershell.py
 
 COPY --chown=prowler:prowler src/backend/ ./backend/
 COPY --chown=prowler:prowler docker-entrypoint.sh ./docker-entrypoint.sh

api/README.md

@@ -196,42 +196,6 @@ python -m celery -A config.celery worker -l info -E
 
 The Celery worker does not detect and reload changes in the code, so you need to restart it manually when you make changes.
 
-### Makefile-Assisted Local Deployment
-
-This method is an additional local development workflow. It does not replace the manual local deployment or the Docker deployment described in this guide.
-
-PostgreSQL, Valkey, and Neo4j run with Docker Compose, while Django and the Celery worker run natively through `uv`. Additionally, this workflow creates a `tmux` session with panes for the API, worker, and PostgreSQL logs.
-
-Before using this method, ensure `docker compose`, `tmux`, and `uv` are installed.
-
-This workflow is designed for macOS and should also work on Linux when Docker, `tmux`, and `uv` are available. Windows requires script changes before it can be supported.
-
-From the repository root, run:
-
-```console
-make dev
-```
-
-The API will be available at:
-
-```console
-http://localhost:8080/api/v1
-```
-
-Use these commands to manage the local stack:
-
-```console
-make dev-setup   # Bootstrap dependencies, migrations, and fixtures
-make dev-attach  # Attach to the tmux session
-make dev-launch  # Start the stack on fixed ports and attach
-make dev-stop    # Stop the tmux session and containers
-make dev-clean   # Remove stopped development containers
-make dev-wipe    # Stop everything and delete local development data
-make dev-status  # Show development container status
-```
-
-This workflow does not start the UI. Start it separately from the `ui/` directory when needed.
-
 ### Docker deployment
 
 This method requires `docker` and `docker compose`.

api/changelog.d/README.md

@@ -1,10 +0,0 @@
-# Changelog fragments
-
-Each PR adds one small file here instead of editing `CHANGELOG.md` directly, so concurrent PRs never conflict.
-
-- Filename: `<slug>.<type>.md`, e.g. `my-new-check.added.md` (slug is free-form: letters, digits, `.`, `_`, `-`)
-- `<type>` is one of: `added`, `changed`, `deprecated`, `removed`, `fixed`, `security`
-- Content: one line with the changelog entry text, without the PR link and without a trailing period (the PR link is attached automatically at release time)
-- A PR adds as many fragment files as entries it needs, freely mixing types (one file per entry); same-type entries just use different slugs
-
-Fragments are compiled into `CHANGELOG.md` when a release is prepared. Full conventions: `skills/prowler-changelog/SKILL.md`.

api/docker-entrypoint.sh

@@ -21,19 +21,13 @@ apply_fixtures() {
 }
 
 start_dev_server() {
-  echo "Starting the development server (Gunicorn ASGI, debug + reload)..."
-  # Same server/worker as prod (config.asgi via the native `asgi` worker), so
-  # SSE streams run on the event loop exactly as they do in production. DEBUG is
-  # on so guniconf's `reload = DEBUG` hot-reloads edited code (and flips
-  # `preload_app` off so reload actually takes).
-  export DJANGO_DEBUG="${DJANGO_DEBUG:-True}"
-  export DJANGO_BIND_ADDRESS="${DJANGO_BIND_ADDRESS:-0.0.0.0}"
-  exec uv run gunicorn -c config/guniconf.py config.asgi:application
+  echo "Starting the development server..."
+  uv run python manage.py runserver 0.0.0.0:"${DJANGO_PORT:-8080}"
 }
 
 start_prod_server() {
   echo "Starting the Gunicorn server..."
-  exec uv run gunicorn -c config/guniconf.py config.asgi:application
+  uv run gunicorn -c config/guniconf.py config.wsgi:application
 }
 
 resolve_worker_hostname() {
@@ -53,7 +47,7 @@ resolve_worker_hostname() {
 
 start_worker() {
   echo "Starting the worker..."
-  exec uv run python -m celery -A config.celery worker \
+  uv run python -m celery -A config.celery worker \
     -n "$(resolve_worker_hostname)" \
     -l "${DJANGO_LOGGING_LEVEL:-info}" \
     -Q celery,scans,scan-reports,deletion,backfill,overview,integrations,compliance,attack-paths-scans \
@@ -62,7 +56,7 @@ start_worker() {
 
 start_worker_beat() {
   echo "Starting the worker-beat..."
-  exec uv run python -m celery -A config.celery beat -l "${DJANGO_LOGGING_LEVEL:-info}" --scheduler django_celery_beat.schedulers:DatabaseScheduler
+  uv run python -m celery -A config.celery beat -l "${DJANGO_LOGGING_LEVEL:-info}" --scheduler django_celery_beat.schedulers:DatabaseScheduler
 }
 
 manage_db_partitions() {
@@ -74,15 +68,6 @@ manage_db_partitions() {
   fi
 }
 
-# Identify this process to Postgres (application_name=<component>:<alias>) so
-# connections are attributable by component in pg_stat_activity. Web tiers
-# report "api"; everything else uses the launch subcommand.
-case "$1" in
-  prod|dev) DJANGO_APP_COMPONENT="api" ;;
-  *)        DJANGO_APP_COMPONENT="$1" ;;
-esac
-export DJANGO_APP_COMPONENT
-
 case "$1" in
   dev)
     apply_migrations

api/docs/orphan-task-recovery.md

@@ -1,106 +0,0 @@
-# Orphan Celery task recovery
-
-When a worker is terminated mid-task (a deploy, an OOM kill, a node eviction), the
-task it was running can be left non-terminal forever: the `TaskResult` stays
-`STARTED` and nothing re-runs it. This page describes the mechanisms that detect and
-recover allowlisted idempotent orphans so pending-task alerts do not fire. Scan tasks
-are not auto-recovered (re-running a scan is not safe to do automatically); the
-watchdog covers the summary/aggregation and deletion tasks.
-
-## How recovery works
-
-1. **Durable delivery.** The broker is configured so a task message is acknowledged
-   only after the task finishes (`task_acks_late`), one task is reserved at a time
-   (`worker_prefetch_multiplier = 1`), and an abruptly-lost worker re-queues its task
-   (`task_reject_on_worker_lost`). On `SIGTERM` the worker is given a soft-shutdown
-   window (`worker_soft_shutdown_timeout`) to finish or re-queue in-flight work
-   before it is force-killed. `scan-perform`, `scan-perform-scheduled` and
-   `integration-jira` opt out of redelivery with `acks_late=False`, so a crash drops
-   them rather than re-running and duplicating findings or Jira issues. Other
-   non-recovered side-effect tasks keep `acks_late=True`, so the broker can still
-   re-deliver them after a worker loss: the S3 upload rebuilds from worker-local files
-   that did not survive the crash and so no-ops, but Security Hub re-reads findings from
-   the DB and re-sends them to AWS.
-
-2. **Periodic watchdog.** A Beat task, `reconcile-orphan-tasks`, runs every couple of
-   minutes (a `django_celery_beat` periodic task created by migration). For each
-   in-flight task result with an allowlisted idempotent task name, it pings the
-   worker recorded on the task's `TaskResult`:
-   - worker responds -> the task is still running, leave it alone;
-   - worker is gone (and the task started before a short grace window) -> it is a
-     real orphan: the stale task is revoked and marked terminal (clearing the
-     pending/started alert), and the task is re-enqueued from its stored name and
-     kwargs.
-
-   The re-run is safe because only tasks with proven idempotency are allowlisted: the
-   summary/aggregation tasks clear and re-write their own rows, and deletions are
-   idempotent. Scan tasks and external side effects are excluded: re-running a scan is
-   not safe to do automatically, Jira sends would create duplicate issues, the S3
-   upload rebuilds from worker-local files that do not survive a crash, and
-   report/Security Hub recovery is out of scope.
-
-3. **Recovery cap.** A per-task Valkey counter limits how often the same task is
-   re-enqueued. After `--max-attempts` recoveries (default 3) the orphan is marked
-   terminal instead of re-enqueued, so a task that repeatedly kills its worker cannot
-   loop forever.
-
-A Postgres advisory lock ensures that, even with multiple API/worker replicas, only
-one reconciliation runs at a time; the others no-op.
-
-## On-demand command
-
-The same logic is available as a management command, useful right after a deploy or
-for manual intervention:
-
-```bash
-python manage.py reconcile_orphan_tasks            # recover now
-python manage.py reconcile_orphan_tasks --dry-run  # report orphans, change nothing
-python manage.py reconcile_orphan_tasks --grace-minutes 5 --max-attempts 3
-```
-
-## Configuration
-
-All settings have safe defaults; override via environment variables.
-
-| Env var | Default | Purpose |
-| --- | --- | --- |
-| `DJANGO_CELERY_WORKER_PREFETCH_MULTIPLIER` | `1` | Tasks reserved per worker process. |
-| `DJANGO_CELERY_WORKER_CONCURRENCY` | unset | Optional Celery prefork pool size. When unset, Celery uses its CPU-based default. Set this on worker containers to bound idle memory on hosts with many CPUs. |
-| `DJANGO_CELERY_WORKER_SOFT_SHUTDOWN_TIMEOUT` | `60` | Seconds the worker drains/re-queues on `SIGTERM` before force-kill. |
-| `DJANGO_CELERY_TASK_TIME_LIMIT` | `21600` (6h) | Hard limit for most tasks; connection checks are capped at 120s. |
-| `DJANGO_CELERY_TASK_SOFT_TIME_LIMIT` | hard - 600 | Soft limit; raises `SoftTimeLimitExceeded` for cleanup. |
-| `DJANGO_CELERY_LONG_TASK_TIME_LIMIT` | `172800` (48h) | Hard limit for scans and provider/tenant deletions, which can legitimately run for more than a day. |
-| `DJANGO_CELERY_LONG_TASK_SOFT_TIME_LIMIT` | long hard - 600 | Soft limit for the long-running tasks above. |
-| `DJANGO_TASK_RECOVERY_ENABLED` | `false` | Master switch for orphan-task recovery, disabled by default (opt-in); set to `true` to enable. When off, no orphan is detected, marked terminal, or re-enqueued (attack-paths stale cleanup still runs). |
-| `DJANGO_TASK_RECOVERY_SUMMARIES_ENABLED` | `true` | Auto re-enqueue orphaned scan summary/aggregation tasks. |
-| `DJANGO_TASK_RECOVERY_DELETIONS_ENABLED` | `true` | Auto re-enqueue orphaned provider/tenant deletion tasks. |
-
-Recovery is opt-in: with the master flag off (the default) the sweep does nothing.
-Once enabled, the per-group flags default to on, so every group recovers unless you
-turn one off; a task whose group flag is off is marked terminal instead of
-re-enqueued.
-
-Turning recovery off only disables this watchdog sweep; it does not change Celery's
-broker-level redelivery (`task_acks_late`/`task_reject_on_worker_lost`), which still
-re-delivers tasks that keep `acks_late=True` on worker loss, independently of this flag.
-
-`task_acks_late` and `task_reject_on_worker_lost` are enabled in `config/celery.py`.
-
-## Deployment requirement
-
-Two conditions must both hold for the soft shutdown to actually drain work:
-
-1. **The worker must receive `SIGTERM`.** The container entrypoint `exec`s the
-   Celery process so it runs as PID 1; otherwise `SIGTERM` from `docker stop`/ECS
-   hits the entrypoint shell, never reaches Celery, and the worker is hard-killed
-   (SIGKILL) at the grace deadline without draining. Custom entrypoints must
-   preserve the `exec`.
-2. **The orchestrator must give the worker enough time** before force-killing it.
-   Set the stop grace period to exceed `DJANGO_CELERY_WORKER_SOFT_SHUTDOWN_TIMEOUT`
-   plus a margin:
-   - **docker-compose:** `stop_grace_period` on the worker services (set to `120s`).
-   - **AWS ECS:** the worker container `stopTimeout` (configured in the deployment
-     repository).
-
-If either condition is missing, long tasks are still recovered by the watchdog,
-but they are cut mid-run on every deploy instead of draining.

api/pyproject.toml

@@ -14,7 +14,7 @@ dev = [
   "pytest-env==1.1.3",
   "pytest-randomly==3.15.0",
   "pytest-xdist==3.6.1",
-  "ruff==0.15.11",
+  "ruff==0.5.0",
   "tqdm==4.67.1",
   "vulture==2.14",
   "prek==0.3.9"
@@ -41,11 +41,9 @@ dependencies = [
   "drf-spectacular==0.27.2",
   "drf-spectacular-jsonapi==0.5.1",
   "defusedxml==0.7.1",
-  "django-eventstream==5.3.3",
-  "gunicorn==26.0.0",
-  "uvloop==0.22.1",
+  "gunicorn==23.0.0",
   "lxml==6.1.0",
-  "prowler @ git+https://github.com/prowler-cloud/prowler.git@v5.39",
+  "prowler @ git+https://github.com/prowler-cloud/prowler.git@master",
   "psycopg2-binary==2.9.9",
   "pytest-celery[redis] (==1.3.0)",
   "sentry-sdk[django] (==2.56.0)",
@@ -58,12 +56,11 @@ dependencies = [
   "matplotlib (==3.10.8)",
   "reportlab (==4.4.10)",
   "neo4j (==6.1.0)",
-  "cartography (==0.138.1)",
+  "cartography (==0.135.0)",
   "gevent (==25.9.1)",
   "werkzeug (==3.1.7)",
   "sqlparse (==0.5.5)",
-  "fonttools (==4.62.1)",
-  "uvicorn-worker (==0.4.0)"
+  "fonttools (==4.62.1)"
 ]
 description = "Prowler's API (Django/DRF)"
 license = "Apache-2.0"
@@ -71,28 +68,10 @@ name = "prowler-api"
 package-mode = false
 # Needed for the SDK compatibility
 requires-python = ">=3.11,<3.13"
-version = "1.40.2"
-
-# Shared ruff baseline (kept in sync with mcp_server/pyproject.toml).
-# target-version tracks this project's lowest supported Python.
-[tool.ruff]
-src = ["src"]
-target-version = "py311"
-
-[tool.ruff.lint]
-# Defaults (E4/E7/E9, F) plus import sorting, modern-syntax upgrades, and
-# comprehension lints — all mechanically auto-fixable. flake8-bugbear (B) is a
-# good next step but needs manual cleanup (e.g. B904 raise-from), so it is left
-# out of the shared baseline for now.
-extend-select = [
-  "I",  # isort — import ordering (prek's isort hook covers only the SDK)
-  "UP",  # pyupgrade — modern syntax for the min supported Python
-  "C4"  # flake8-comprehensions
-]
+version = "1.30.0"
 
 [tool.uv]
 # Transitive pins matching master to avoid silent drift; bump deliberately.
-# workos is api-only; pyopenssl matches master (PROWLER-2310).
 constraint-dependencies = [
   "about-time==4.2.1",
   "adal==1.2.7",
@@ -100,7 +79,7 @@ constraint-dependencies = [
   "aiobotocore==2.25.1",
   "aiofiles==24.1.0",
   "aiohappyeyeballs==2.6.1",
-  "aiohttp==3.14.3",
+  "aiohttp==3.13.5",
   "aioitertools==0.13.0",
   "aiosignal==1.4.0",
   "alibabacloud-actiontrail20200706==2.4.1",
@@ -129,7 +108,7 @@ constraint-dependencies = [
   "alibabacloud-sls20201230==5.9.0",
   "alibabacloud-sts20150401==1.1.6",
   "alibabacloud-tea==0.4.3",
-  "alibabacloud-tea-openapi==0.4.6",
+  "alibabacloud-tea-openapi==0.4.4",
   "alibabacloud-tea-util==0.3.14",
   "alibabacloud-tea-xml==0.0.3",
   "alibabacloud-vpc20160428==6.13.0",
@@ -145,8 +124,9 @@ constraint-dependencies = [
   "astroid==3.2.4",
   "async-timeout==5.0.1",
   "attrs==25.4.0",
-  "authlib==1.6.12",
+  "authlib==1.6.9",
   "autopep8==2.3.2",
+  "awsipranges==0.3.3",
   "azure-cli-core==2.83.0",
   "azure-cli-telemetry==1.1.0",
   "azure-common==1.1.28",
@@ -194,7 +174,7 @@ constraint-dependencies = [
   "blinker==1.9.0",
   "boto3==1.40.61",
   "botocore==1.40.61",
-  "cartography==0.138.1",
+  "cartography==0.135.0",
   "celery==5.6.2",
   "certifi==2026.1.4",
   "cffi==2.0.0",
@@ -211,14 +191,15 @@ constraint-dependencies = [
   "coverage==7.5.4",
   "cron-descriptor==1.4.5",
   "crowdstrike-falconpy==1.6.0",
-  "cryptography==50.0.0",
+  "cryptography==46.0.7",
   "cycler==0.12.1",
-  "darabonba-core==1.0.8",
+  "darabonba-core==1.0.5",
   "dash==3.1.1",
   "dash-bootstrap-components==2.0.3",
   "debugpy==1.8.20",
   "decorator==5.2.1",
   "defusedxml==0.7.1",
+  "detect-secrets==1.5.0",
   "dill==0.4.1",
   "distro==1.9.0",
   "dj-rest-auth==7.0.1",
@@ -228,7 +209,6 @@ constraint-dependencies = [
   "django-celery-results==2.6.0",
   "django-cors-headers==4.4.0",
   "django-environ==0.11.2",
-  "django-eventstream==5.3.3",
   "django-filter==24.3",
   "django-guid==3.5.0",
   "django-postgres-extra==2.0.9",
@@ -246,7 +226,7 @@ constraint-dependencies = [
   "drf-simple-apikey==2.2.1",
   "drf-spectacular==0.27.2",
   "drf-spectacular-jsonapi==0.5.1",
-  "dulwich==1.2.5",
+  "dulwich==0.23.0",
   "duo-client==5.5.0",
   "durationpy==0.10",
   "email-validator==2.2.0",
@@ -273,17 +253,17 @@ constraint-dependencies = [
   "grpc-google-iam-v1==0.14.3",
   "grpcio==1.76.0",
   "grpcio-status==1.76.0",
-  "gunicorn==26.0.0",
+  "gunicorn==23.0.0",
   "h11==0.16.0",
   "h2==4.3.0",
   "hpack==4.1.0",
   "httpcore==1.0.9",
-  "httplib2==0.32.0",
+  "httplib2==0.31.2",
   "httpx==0.28.1",
   "humanfriendly==10.0",
   "hyperframe==6.1.0",
-  "iamdata==0.1.202605131",
-  "idna==3.15",
+  "iamdata==0.1.202602021",
+  "idna==3.11",
   "importlib-metadata==8.7.1",
   "inflection==0.5.1",
   "iniconfig==2.3.0",
@@ -301,7 +281,6 @@ constraint-dependencies = [
   "jsonschema==4.23.0",
   "jsonschema-specifications==2025.9.1",
   "keystoneauth1==5.13.0",
-  "kingfisher-bin==1.104.0",
   "kiwisolver==1.4.9",
   "knack==0.11.0",
   "kombu==5.6.2",
@@ -315,13 +294,13 @@ constraint-dependencies = [
   "matplotlib==3.10.8",
   "mccabe==0.7.0",
   "mdurl==0.1.2",
-  "microsoft-kiota-abstractions==1.9.10",
-  "microsoft-kiota-authentication-azure==1.9.10",
-  "microsoft-kiota-http==1.9.10",
-  "microsoft-kiota-serialization-form==1.9.10",
-  "microsoft-kiota-serialization-json==1.9.10",
-  "microsoft-kiota-serialization-multipart==1.9.10",
-  "microsoft-kiota-serialization-text==1.9.10",
+  "microsoft-kiota-abstractions==1.9.9",
+  "microsoft-kiota-authentication-azure==1.9.9",
+  "microsoft-kiota-http==1.9.9",
+  "microsoft-kiota-serialization-form==1.9.9",
+  "microsoft-kiota-serialization-json==1.9.9",
+  "microsoft-kiota-serialization-multipart==1.9.9",
+  "microsoft-kiota-serialization-text==1.9.9",
   "microsoft-security-utilities-secret-masker==1.0.0b4",
   "msal==1.35.0b1",
   "msal-extensions==1.2.0",
@@ -336,9 +315,9 @@ constraint-dependencies = [
   "neo4j==6.1.0",
   "nest-asyncio==1.6.0",
   "nltk==3.9.4",
-  "numpy==2.2.6",
+  "numpy==2.0.2",
   "oauthlib==3.3.1",
-  "oci==2.184.1",
+  "oci==2.169.0",
   "openai==1.109.1",
   "openstacksdk==4.2.0",
   "opentelemetry-api==1.39.1",
@@ -350,7 +329,7 @@ constraint-dependencies = [
   "pagerduty==6.1.0",
   "pandas==2.2.3",
   "pbr==7.0.3",
-  "pillow==12.3.0",
+  "pillow==12.2.0",
   "pkginfo==1.12.1.2",
   "platformdirs==4.5.1",
   "plotly==6.5.2",
@@ -365,9 +344,9 @@ constraint-dependencies = [
   "psutil==7.2.2",
   "psycopg2-binary==2.9.9",
   "py-deviceid==0.1.1",
-  "py-iam-expand==0.3.0",
-  "py-ocsf-models==0.10.0",
-  "pyasn1==0.6.4",
+  "py-iam-expand==0.1.0",
+  "py-ocsf-models==0.8.1",
+  "pyasn1==0.6.3",
   "pyasn1-modules==0.4.2",
   "pycodestyle==2.14.0",
   "pycparser==3.0",
@@ -375,11 +354,11 @@ constraint-dependencies = [
   "pydantic-core==2.41.5",
   "pygithub==2.8.0",
   "pygments==2.20.0",
-  "pyjwt==2.13.0",
+  "pyjwt==2.12.1",
   "pylint==3.2.5",
   "pymsalruntime==0.18.1",
   "pynacl==1.6.2",
-  "pyopenssl==26.4.0",
+  "pyopenssl==26.0.0",
   "pyparsing==3.3.2",
   "pyreadline3==3.5.4",
   "pysocks==1.7.1",
@@ -411,7 +390,7 @@ constraint-dependencies = [
   "rpds-py==0.30.0",
   "rsa==4.9.1",
   "ruamel-yaml==0.19.1",
-  "ruff==0.15.11",
+  "ruff==0.5.0",
   "s3transfer==0.14.0",
   "scaleway==2.10.3",
   "scaleway-core==2.10.3",
@@ -441,14 +420,12 @@ constraint-dependencies = [
   "uritemplate==4.2.0",
   "urllib3==2.7.0",
   "uuid6==2024.7.10",
-  "uvicorn==0.49.0",
-  "uvloop==0.22.1",
   "vine==5.1.0",
   "vulture==2.14",
   "wcwidth==0.5.3",
   "websocket-client==1.9.0",
   "werkzeug==3.1.7",
-  "workos==8.3.0",
+  "workos==6.0.4",
   "wrapt==1.17.3",
   "xlsxwriter==3.2.9",
   "xmlsec==1.3.17",
@@ -457,54 +434,16 @@ constraint-dependencies = [
   "zipp==3.23.0",
   "zope-event==6.1",
   "zope-interface==8.2",
-  "zstd==1.5.7.2"
+  "zstd==1.5.7.3"
 ]
-# prowler@master needs okta==3.4.2, but cartography 0.138.1 requires okta<1.0.0.
-# Attack Paths does not ingest Okta today, so override the Cartography
-# dependency to the Prowler pin.
+# prowler@master needs okta==3.4.2; cartography 0.135.0 declares okta<1.0.0 for an
+# integration prowler does not import.
 #
-# prowler@master needs azure-mgmt-containerservice==34.1.0, but cartography
-# 0.138.1 requires azure-mgmt-containerservice>=41.0.0. Attack Paths does not
-# ingest Azure today, so override the Cartography dependency to the Prowler pin.
-#
-# prowler@master hard-pins the microsoft-kiota packages in [project.dependencies].
-# microsoft-kiota-serialization-json 1.9.10 fixes get_collection_of_enum_values
-# returning [] for flags enums serialized as CSV strings (microsoft/kiota-python#515),
-# which broke the Entra Conditional Access guest-user checks; the kiota packages
-# release in lockstep and 1.9.10 requires microsoft-kiota-abstractions>=1.9.10, which
-# a constraint cannot satisfy against the SDK's hard pins, so override the whole set
-# to 1.9.10 until the SDK bump propagates to the pinned master rev.
-#
-# prowler@master hard-pins dulwich==0.23.0 and pyjwt==2.12.1 in [project.dependencies].
-# dulwich 1.2.5 patches GHSA-897w-fcg9-f6xj (arbitrary file write) and pyjwt 2.13.0
-# patches PYSEC-2026-179 (HMAC/JWK key-confusion); a constraint cannot satisfy these
-# against the SDK's hard pins, so override them to the patched versions until the SDK
-# bump propagates to the pinned master rev. pyjwt keeps the [crypto] extra because an
-# override replaces the whole requirement; bare pyjwt would drop it from the consumers
-# that request pyjwt[crypto] and leave cryptography (needed for RS256) only transitive.
+# prowler@master hard-pins microsoft-kiota-abstractions==1.9.2 in [project.dependencies].
+# The microsoft-kiota-http security bump to 1.9.9 (GHSA-7j59-v9qr-6fq9) requires
+# microsoft-kiota-abstractions>=1.9.9, which a constraint cannot satisfy against the
+# SDK's hard pin; override it to the patched, kiota-aligned version.
 override-dependencies = [
   "okta==3.4.2",
-  # prowler requires cryptography==50.0.0. Two api-only dependencies still cap it below
-  # 49 and cannot move yet: msal, pinned exactly by azure-cli-core (2.83.0 -> 1.35.0b1,
-  # 2.89.1 -> 1.36.0, both <49; cartography needs azure-cli-core), and workos 8.3.0
-  # (~=48.0; workos 10.1.1+ needs ~=50.0 and is a separate SDK upgrade). This api is
-  # deployed from this lock with `uv sync --locked`, so the override applies to what runs.
-  # Remove when azure-cli-core pins msal>=1.37.0 and workos is on 10.x.
-  "cryptography==50.0.0",
-  # prowler@master hard-pins alibabacloud-tea-openapi and oci in [project.dependencies];
-  # the SDK bumped both to lift their cryptography caps. A constraint cannot satisfy the
-  # new pins against the older master rev locked here, so override until the SDK bump
-  # propagates to the pinned master rev, then drop these two.
-  "alibabacloud-tea-openapi==0.4.6",
-  "oci==2.184.1",
-  "azure-mgmt-containerservice==34.1.0",
-  "microsoft-kiota-abstractions==1.9.10",
-  "microsoft-kiota-authentication-azure==1.9.10",
-  "microsoft-kiota-http==1.9.10",
-  "microsoft-kiota-serialization-form==1.9.10",
-  "microsoft-kiota-serialization-json==1.9.10",
-  "microsoft-kiota-serialization-multipart==1.9.10",
-  "microsoft-kiota-serialization-text==1.9.10",
-  "dulwich==1.2.5",
-  "pyjwt[crypto]==2.13.0"
+  "microsoft-kiota-abstractions==1.9.9"
 ]

api/src/backend/api/adapters.py

@@ -1,48 +1,12 @@
-from allauth.account.models import EmailAddress
-from allauth.core.exceptions import ImmediateHttpResponse
 from allauth.socialaccount.adapter import DefaultSocialAccountAdapter
-from api.db_router import MainRouter, write_db_alias
-from api.db_utils import rls_transaction
-from api.models import (
-    Membership,
-    Role,
-    SAMLConfiguration,
-    Tenant,
-    User,
-    UserRoleRelationship,
-)
-from api.utils import accept_invitation_for_user
-from django.core.exceptions import ValidationError
 from django.db import transaction
-from django.http import HttpResponseForbidden
+
+from api.db_router import MainRouter
+from api.db_utils import rls_transaction
+from api.models import Membership, Role, Tenant, User, UserRoleRelationship
 
 
 class ProwlerSocialAccountAdapter(DefaultSocialAccountAdapter):
-    @staticmethod
-    def _get_social_account_name(extra_data: dict, email: str) -> str:
-        name_field = User._meta.get_field("name")
-        for value in (
-            extra_data.get("name"),
-            extra_data.get("login"),
-            extra_data.get("username"),
-            email,
-        ):
-            if not isinstance(value, str):
-                continue
-
-            candidate = value.strip()[: name_field.max_length].rstrip()
-            if not candidate:
-                continue
-
-            try:
-                name_field.run_validators(candidate)
-            except ValidationError:
-                continue
-
-            return candidate
-
-        raise ValueError("Social account does not provide a valid user identity.")
-
     @staticmethod
     def get_user_by_email(email: str):
         try:
@@ -50,81 +14,14 @@ class ProwlerSocialAccountAdapter(DefaultSocialAccountAdapter):
         except User.DoesNotExist:
             return None
 
-    @staticmethod
-    def _get_invitation_token(request):
-        for source_name in ("data", "POST"):
-            data = getattr(request, source_name, None) or {}
-            if not hasattr(data, "get"):
-                continue
-            invitation_token = data.get("invitation_token")
-            if invitation_token:
-                return invitation_token
-
-        wrapped_request = getattr(request, "_request", None)
-        if wrapped_request and wrapped_request is not request:
-            return ProwlerSocialAccountAdapter._get_invitation_token(wrapped_request)
-
-        return None
-
     def pre_social_login(self, request, sociallogin):
-        # The provider account is already bound, so no email-based linking is needed.
-        if sociallogin.account.pk:
-            return
-
-        # Prefer the normalized email populated by allauth. GitHub can return the
-        # primary email separately from the profile stored in extra_data.
-        email = sociallogin.user.email or sociallogin.account.extra_data.get("email")
+        # Link existing accounts with the same email address
+        email = sociallogin.account.extra_data.get("email")
         if sociallogin.provider.id == "saml":
-            # For SAML, the asserted NameID email cannot be trusted on its own:
-            # any tenant can claim any email domain in its SAML configuration. To
-            # prevent cross-tenant account takeover (GHSA-h8m9-jgf8-vwvp), only link
-            # the incoming SAML session to an existing account when (1) the email
-            # domain matches the tenant whose ACS endpoint is being used and (2) the
-            # existing user is already a member of that tenant.
             email = sociallogin.user.email
-            if not email:
-                return
-
-            domain = email.rsplit("@", 1)[-1].lower()
-            resolver_match = getattr(request, "resolver_match", None)
-            organization_slug = (
-                (resolver_match.kwargs or {}).get("organization_slug", "")
-                if resolver_match
-                else ""
-            ).lower()
-            # The ACS endpoint is scoped per email domain; reject mismatches so an
-            # attacker cannot replay an assertion through another tenant's endpoint.
-            if organization_slug != domain:
-                return
-
-            try:
-                saml_config = SAMLConfiguration.objects.using(MainRouter.admin_db).get(
-                    email_domain=domain
-                )
-            except SAMLConfiguration.DoesNotExist:
-                return
-
-            existing_user = self.get_user_by_email(email)
-            if existing_user and existing_user.is_member_of_tenant(
-                str(saml_config.tenant_id)
-            ):
-                sociallogin.connect(request, existing_user)
-            return
-
         if email:
             existing_user = self.get_user_by_email(email)
             if existing_user:
-                email_is_verified = EmailAddress.objects.filter(
-                    user=existing_user,
-                    email__iexact=email,
-                    verified=True,
-                ).exists()
-                provider_verified_email = any(
-                    address.verified and address.email.casefold() == email.casefold()
-                    for address in sociallogin.email_addresses
-                )
-                if not email_is_verified or not provider_verified_email:
-                    raise ImmediateHttpResponse(HttpResponseForbidden())
                 sociallogin.connect(request, existing_user)
 
     def save_user(self, request, sociallogin, form=None):
@@ -133,50 +30,41 @@ class ProwlerSocialAccountAdapter(DefaultSocialAccountAdapter):
         and is about to be saved to the DB for the first time.
         """
         with transaction.atomic(using=MainRouter.admin_db):
-            # Allauth saves the user without an explicit alias. Route that save
-            # through admin so every signup record shares this transaction.
-            with write_db_alias(MainRouter.admin_db):
-                user = super().save_user(request, sociallogin, form)
+            user = super().save_user(request, sociallogin, form)
             provider = sociallogin.provider.id
             extra = sociallogin.account.extra_data
 
             if provider != "saml":
                 # Handle other providers (e.g., GitHub, Google)
-                user.name = self._get_social_account_name(extra, user.email)
                 user.save(using=MainRouter.admin_db)
+                social_account_name = extra.get("name")
+                if social_account_name:
+                    user.name = social_account_name
+                    user.save(using=MainRouter.admin_db)
 
-                invitation_token = self._get_invitation_token(request)
-                if invitation_token:
-                    invitation, _ = accept_invitation_for_user(
+                tenant = Tenant.objects.using(MainRouter.admin_db).create(
+                    name=f"{user.email.split('@')[0]} default tenant"
+                )
+                with rls_transaction(str(tenant.id)):
+                    Membership.objects.using(MainRouter.admin_db).create(
+                        user=user, tenant=tenant, role=Membership.RoleChoices.OWNER
+                    )
+                    role = Role.objects.using(MainRouter.admin_db).create(
+                        name="admin",
+                        tenant_id=tenant.id,
+                        manage_users=True,
+                        manage_account=True,
+                        manage_billing=True,
+                        manage_providers=True,
+                        manage_integrations=True,
+                        manage_scans=True,
+                        unlimited_visibility=True,
+                    )
+                    UserRoleRelationship.objects.using(MainRouter.admin_db).create(
                         user=user,
-                        invitation_token=invitation_token,
+                        role=role,
+                        tenant_id=tenant.id,
                     )
-                    request.prowler_invitation_token = invitation_token
-                    request.prowler_invitation_tenant_id = str(invitation.tenant_id)
-                else:
-                    tenant = Tenant.objects.using(MainRouter.admin_db).create(
-                        name=f"{user.email.split('@')[0]} default tenant"
-                    )
-                    with rls_transaction(str(tenant.id)):
-                        Membership.objects.using(MainRouter.admin_db).create(
-                            user=user, tenant=tenant, role=Membership.RoleChoices.OWNER
-                        )
-                        role = Role.objects.using(MainRouter.admin_db).create(
-                            name="admin",
-                            tenant_id=tenant.id,
-                            manage_users=True,
-                            manage_account=True,
-                            manage_billing=True,
-                            manage_providers=True,
-                            manage_integrations=True,
-                            manage_scans=True,
-                            unlimited_visibility=True,
-                        )
-                        UserRoleRelationship.objects.using(MainRouter.admin_db).create(
-                            user=user,
-                            role=role,
-                            tenant_id=tenant.id,
-                        )
             else:
                 request.session["saml_user_created"] = str(user.id)
 

api/src/backend/api/apps.py

@@ -28,10 +28,9 @@ class ApiConfig(AppConfig):
     name = "api"
 
     def ready(self):
-        from api import (
-            schema_extensions,  # noqa: F401
-            signals,  # noqa: F401
-        )
+        from api import schema_extensions  # noqa: F401
+        from api import signals  # noqa: F401
+        from api.attack_paths import database as graph_database
 
         # Generate required cryptographic keys if not present, but only if:
         #   `"manage.py" not in sys.argv[0]`: If an external server (e.g., Gunicorn) is running the app
@@ -42,6 +41,38 @@ class ApiConfig(AppConfig):
         ):
             self._ensure_crypto_keys()
 
+        # Commands that don't need Neo4j
+        SKIP_NEO4J_DJANGO_COMMANDS = [
+            "makemigrations",
+            "migrate",
+            "pgpartition",
+            "check",
+            "help",
+            "showmigrations",
+            "check_and_fix_socialaccount_sites_migration",
+        ]
+
+        # Skip eager Neo4j init for tests, some Django commands, and Celery (prefork pool: driver must stay lazy, no post_fork hook)
+        if getattr(settings, "TESTING", False) or (
+            len(sys.argv) > 1
+            and (
+                (
+                    "manage.py" in sys.argv[0]
+                    and sys.argv[1] in SKIP_NEO4J_DJANGO_COMMANDS
+                )
+                or "celery" in sys.argv[0]
+            )
+        ):
+            logger.info(
+                "Skipping eager Neo4j init: tests, some Django commands, or Celery prefork pool (driver stays lazy)"
+            )
+
+        else:
+            graph_database.init_driver()
+
+        # Neo4j driver is initialized at API startup (see api.attack_paths.database)
+        # It remains lazy for Celery workers and selected Django commands
+
     def _ensure_crypto_keys(self):
         """
         Orchestrator method that ensures all required cryptographic keys are present.

api/src/backend/api/attack_paths/__init__.py

@@ -1,14 +1,13 @@
 from api.attack_paths.queries import (
     AttackPathsQueryDefinition,
-    AttackPathsQueryOutcome,
     AttackPathsQueryParameterDefinition,
     get_queries_for_provider,
     get_query_by_id,
 )
 
+
 __all__ = [
     "AttackPathsQueryDefinition",
-    "AttackPathsQueryOutcome",
     "AttackPathsQueryParameterDefinition",
     "get_queries_for_provider",
     "get_query_by_id",

api/src/backend/api/attack_paths/cypher_sanitizer.py

@@ -4,10 +4,10 @@ Cypher sanitizer for custom (user-supplied) Attack Paths queries.
 Two responsibilities:
 
 1. **Validation** - reject queries containing SSRF or dangerous procedure
-   patterns (defense-in-depth; the primary control is `neo4j.READ_ACCESS`).
+   patterns (defense-in-depth; the primary control is ``neo4j.READ_ACCESS``).
 
 2. **Provider-scoped label injection** - inject a dynamic
-   `_Provider_{uuid}` label into every node pattern so the database can
+   ``_Provider_{uuid}`` label into every node pattern so the database can
    use its native label index for provider isolation.
 
 Label-injection pipeline:
@@ -22,16 +22,18 @@ Label-injection pipeline:
 import re
 
 from rest_framework.exceptions import ValidationError
+
 from tasks.jobs.attack_paths.config import get_provider_label
 
+
 # Step 1 - String / comment protection
-# Single combined regex: strings first, then line comments
+# Single combined regex: strings first, then line comments.
 # The regex engine finds the leftmost match, so a string like 'https://prowler.com'
-# is consumed as a string before the // inside it can match as a comment
+# is consumed as a string before the // inside it can match as a comment.
 _PROTECTED_RE = re.compile(r"'(?:[^'\\]|\\.)*'|\"(?:[^\"\\]|\\.)*\"|//[^\n]*")
 
 # Step 2 - Clause splitting
-# `OPTIONAL MATCH` must come before `MATCH` to avoid partial matching
+# OPTIONAL MATCH must come before MATCH to avoid partial matching.
 _CLAUSE_RE = re.compile(
     r"\b(OPTIONAL\s+MATCH|MATCH|WHERE|RETURN|WITH|ORDER\s+BY"
     r"|SKIP|LIMIT|UNION|UNWIND|CALL)\b",
@@ -39,10 +41,10 @@ _CLAUSE_RE = re.compile(
 )
 
 # Pass A - Labeled node patterns (all segments)
-# Matches node patterns that have at least one `:Label`
-# `(?<!\w)\(`  - open paren NOT preceded by a word char, excludes function calls
-# Group 1:  optional variable + one or more `:Label`
-# Group 2:  optional `{`properties`}` + closing paren
+# Matches node patterns that have at least one :Label.
+# (?<!\w)\(  - open paren NOT preceded by a word char (excludes function calls).
+# Group 1:  optional variable + one or more :Label
+# Group 2:  optional {properties} + closing paren
 _LABELED_NODE_RE = re.compile(
     r"(?<!\w)\("
     r"("
@@ -55,9 +57,9 @@ _LABELED_NODE_RE = re.compile(
     r")"
 )
 
-# Pass B - Bare node patterns (`MATCH` segments only)
-# Matches (identifier) or (identifier {properties}) without any `:Label`
-# Only applied in `MATCH` / `OPTIONAL MATCH` segments
+# Pass B - Bare node patterns (MATCH segments only)
+# Matches (identifier) or (identifier {properties}) without any :Label.
+# Only applied in MATCH/OPTIONAL MATCH segments.
 _BARE_NODE_RE = re.compile(
     r"(?<!\w)\(" r"(\s*[a-zA-Z_]\w*)" r"(\s*(?:\{[^}]*\})?)" r"\s*\)"
 )
@@ -96,11 +98,6 @@ def inject_provider_label(cypher: str, provider_id: str) -> str:
         node pattern.
     """
     label = get_provider_label(provider_id)
-    return inject_label(cypher, label)
-
-
-def inject_label(cypher: str, label: str) -> str:
-    """Rewrite a Cypher query to append a label to every node pattern."""
 
     # Step 1: Protect strings and comments (single pass, leftmost-first)
     protected: list[str] = []
@@ -139,7 +136,9 @@ def inject_label(cypher: str, label: str) -> str:
     return work
 
 
+# ---------------------------------------------------------------------------
 # Validation
+# ---------------------------------------------------------------------------
 
 # Patterns that indicate SSRF or dangerous procedure calls
 # Defense-in-depth layer - the primary control is `neo4j.READ_ACCESS`

api/src/backend/api/attack_paths/database.py

@@ -1,33 +1,233 @@
-"""Backwards-compatible facade over the ingest and sink modules.
-
-Historically this module owned a single Neo4j driver used for both the
-cartography temp database and the per-tenant sink database. The port to AWS
-Neptune split those roles: the cartography ingest (temp) database is always
-Neo4j and lives in `api.attack_paths.ingest`; the sink is configurable
-(Neo4j or Neptune) and lives in `api.attack_paths.sink`. This shim preserves
-the public API that `tasks/` and `api/v1/views.py` already depend on, and
-dispatches to the right module by database-name prefix.
-
-A database name starting with `db-tmp-scan-` is a cartography temp DB and
-routes to ingest. Everything else routes to the configured sink.
-"""
-
-from contextlib import AbstractContextManager
-from typing import Any
+import atexit
+import logging
+import threading
+from contextlib import contextmanager
+from typing import Any, Iterator
 from uuid import UUID
 
-import neo4j  # noqa: F401 - kept for tests that patch api.attack_paths.database.neo4j
-from api.attack_paths import ingest
-from api.attack_paths import sink as sink_module
+import neo4j
+import neo4j.exceptions
 from config.env import env
-from django.conf import (
-    settings,  # noqa: F401 - kept for tests that patch ...database.settings
+from django.conf import settings
+from tasks.jobs.attack_paths.config import (
+    BATCH_SIZE,
+    PROVIDER_RESOURCE_LABEL,
+    get_provider_label,
 )
 
-MAX_CUSTOM_QUERY_NODES = env.int("ATTACK_PATHS_MAX_CUSTOM_QUERY_NODES", default=250)
+from api.attack_paths.retryable_session import RetryableSession
 
-TEMP_DB_PREFIX = "db-tmp-scan-"
-DATABASE_NOT_FOUND_CODE = "Neo.ClientError.Database.DatabaseNotFound"
+# Without this Celery goes crazy with Neo4j logging
+logging.getLogger("neo4j").setLevel(logging.ERROR)
+logging.getLogger("neo4j").propagate = False
+
+SERVICE_UNAVAILABLE_MAX_RETRIES = env.int(
+    "ATTACK_PATHS_SERVICE_UNAVAILABLE_MAX_RETRIES", default=3
+)
+READ_QUERY_TIMEOUT_SECONDS = env.int(
+    "ATTACK_PATHS_READ_QUERY_TIMEOUT_SECONDS", default=30
+)
+MAX_CUSTOM_QUERY_NODES = env.int("ATTACK_PATHS_MAX_CUSTOM_QUERY_NODES", default=250)
+CONN_ACQUISITION_TIMEOUT = env.int("NEO4J_CONN_ACQUISITION_TIMEOUT", default=15)
+READ_EXCEPTION_CODES = [
+    "Neo.ClientError.Statement.AccessMode",
+    "Neo.ClientError.Procedure.ProcedureNotFound",
+]
+CLIENT_STATEMENT_EXCEPTION_PREFIX = "Neo.ClientError.Statement."
+
+# Module-level process-wide driver singleton
+_driver: neo4j.Driver | None = None
+_lock = threading.Lock()
+
+# Base Neo4j functions
+
+
+def get_uri() -> str:
+    host = settings.DATABASES["neo4j"]["HOST"]
+    port = settings.DATABASES["neo4j"]["PORT"]
+    return f"bolt://{host}:{port}"
+
+
+def init_driver() -> neo4j.Driver:
+    global _driver
+    if _driver is not None:
+        return _driver
+
+    with _lock:
+        if _driver is None:
+            uri = get_uri()
+            config = settings.DATABASES["neo4j"]
+
+            _driver = neo4j.GraphDatabase.driver(
+                uri,
+                auth=(config["USER"], config["PASSWORD"]),
+                keep_alive=True,
+                max_connection_lifetime=7200,
+                connection_acquisition_timeout=CONN_ACQUISITION_TIMEOUT,
+                max_connection_pool_size=50,
+            )
+            _driver.verify_connectivity()
+
+            # Register cleanup handler (only runs once since we're inside the _driver is None block)
+            atexit.register(close_driver)
+
+    return _driver
+
+
+def get_driver() -> neo4j.Driver:
+    return init_driver()
+
+
+def close_driver() -> None:  # TODO: Use it
+    global _driver
+    with _lock:
+        if _driver is not None:
+            try:
+                _driver.close()
+
+            finally:
+                _driver = None
+
+
+@contextmanager
+def get_session(
+    database: str | None = None, default_access_mode: str | None = None
+) -> Iterator[RetryableSession]:
+    session_wrapper: RetryableSession | None = None
+
+    try:
+        session_wrapper = RetryableSession(
+            session_factory=lambda: get_driver().session(
+                database=database, default_access_mode=default_access_mode
+            ),
+            max_retries=SERVICE_UNAVAILABLE_MAX_RETRIES,
+        )
+        yield session_wrapper
+
+    except neo4j.exceptions.Neo4jError as exc:
+        if (
+            default_access_mode == neo4j.READ_ACCESS
+            and exc.code
+            and exc.code in READ_EXCEPTION_CODES
+        ):
+            message = "Read query not allowed"
+            code = READ_EXCEPTION_CODES[0]
+            raise WriteQueryNotAllowedException(message=message, code=code)
+
+        message = exc.message if exc.message is not None else str(exc)
+
+        if exc.code and exc.code.startswith(CLIENT_STATEMENT_EXCEPTION_PREFIX):
+            raise ClientStatementException(message=message, code=exc.code)
+
+        raise GraphDatabaseQueryException(message=message, code=exc.code)
+
+    finally:
+        if session_wrapper is not None:
+            session_wrapper.close()
+
+
+def execute_read_query(
+    database: str,
+    cypher: str,
+    parameters: dict[str, Any] | None = None,
+) -> neo4j.graph.Graph:
+    with get_session(database, default_access_mode=neo4j.READ_ACCESS) as session:
+
+        def _run(tx: neo4j.ManagedTransaction) -> neo4j.graph.Graph:
+            result = tx.run(
+                cypher, parameters or {}, timeout=READ_QUERY_TIMEOUT_SECONDS
+            )
+            return result.graph()
+
+        return session.execute_read(_run)
+
+
+def create_database(database: str) -> None:
+    query = "CREATE DATABASE $database IF NOT EXISTS"
+    parameters = {"database": database}
+
+    with get_session() as session:
+        session.run(query, parameters)
+
+
+def drop_database(database: str) -> None:
+    query = f"DROP DATABASE `{database}` IF EXISTS DESTROY DATA"
+
+    with get_session() as session:
+        session.run(query)
+
+
+def drop_subgraph(database: str, provider_id: str) -> int:
+    """
+    Delete all nodes for a provider from the tenant database.
+
+    Uses batched deletion to avoid memory issues with large graphs.
+    Silently returns 0 if the database doesn't exist.
+    """
+    provider_label = get_provider_label(provider_id)
+    deleted_nodes = 0
+
+    try:
+        with get_session(database) as session:
+            deleted_count = 1
+            while deleted_count > 0:
+                result = session.run(
+                    f"""
+                    MATCH (n:{PROVIDER_RESOURCE_LABEL}:`{provider_label}`)
+                    WITH n LIMIT $batch_size
+                    DETACH DELETE n
+                    RETURN COUNT(n) AS deleted_nodes_count
+                    """,
+                    {"batch_size": BATCH_SIZE},
+                )
+                deleted_count = result.single().get("deleted_nodes_count", 0)
+                deleted_nodes += deleted_count
+
+    except GraphDatabaseQueryException as exc:
+        if exc.code == "Neo.ClientError.Database.DatabaseNotFound":
+            return 0
+        raise
+
+    return deleted_nodes
+
+
+def has_provider_data(database: str, provider_id: str) -> bool:
+    """
+    Check if any ProviderResource node exists for this provider.
+
+    Returns `False` if the database doesn't exist.
+    """
+    provider_label = get_provider_label(provider_id)
+    query = f"MATCH (n:{PROVIDER_RESOURCE_LABEL}:`{provider_label}`) RETURN 1 LIMIT 1"
+
+    try:
+        with get_session(database, default_access_mode=neo4j.READ_ACCESS) as session:
+            result = session.run(query)
+            return result.single() is not None
+
+    except GraphDatabaseQueryException as exc:
+        if exc.code == "Neo.ClientError.Database.DatabaseNotFound":
+            return False
+        raise
+
+
+def clear_cache(database: str) -> None:
+    query = "CALL db.clearQueryCaches()"
+
+    try:
+        with get_session(database) as session:
+            session.run(query)
+
+    except GraphDatabaseQueryException as exc:
+        logging.warning(f"Failed to clear query cache for database `{database}`: {exc}")
+
+
+# Neo4j functions related to Prowler + Cartography
+
+
+def get_database_name(entity_id: str | UUID, temporary: bool = False) -> str:
+    prefix = "tmp-scan" if temporary else "tenant"
+    return f"db-{prefix}-{str(entity_id).lower()}"
 
 
 # Exceptions
@@ -42,190 +242,13 @@ class GraphDatabaseQueryException(Exception):
     def __str__(self) -> str:
         if self.code:
             return f"{self.code}: {self.message}"
+
         return self.message
 
 
-class NeptuneWriteRetryExhaustedException(GraphDatabaseQueryException):
-    pass
-
-
 class WriteQueryNotAllowedException(GraphDatabaseQueryException):
     pass
 
 
 class ClientStatementException(GraphDatabaseQueryException):
     pass
-
-
-# Routing
-
-
-def _is_ingest_database(database: str | None) -> bool:
-    return bool(database) and database.startswith(TEMP_DB_PREFIX)
-
-
-# Driver lifecycle
-
-
-def init_driver() -> Any:
-    """Initialize the configured sink backend.
-
-    The ingest driver (Neo4j for cartography temp DBs) stays lazy: it is
-    only initialized when a temp-DB operation actually runs, which never
-    happens on API pods.
-    """
-    return sink_module.init()
-
-
-def close_driver() -> None:
-    """Close every driver held by this process."""
-    sink_module.close()
-    ingest.close_driver()
-
-
-def get_driver() -> neo4j.Driver:
-    """Return the sink backend's underlying driver.
-
-    Only meaningful for the Neo4j sink (where the backend has a single Neo4j
-    driver). On Neptune this returns the writer driver. Kept for tests and
-    legacy call-sites; prefer `get_session` for new code.
-    """
-    backend = sink_module.get_backend()
-
-    # Neo4jSink exposes get_driver(); NeptuneSink exposes get_writer()
-    if hasattr(backend, "get_driver"):
-        return backend.get_driver()
-
-    if hasattr(backend, "get_writer"):
-        return backend.get_writer()
-
-    raise RuntimeError("Active sink backend does not expose a driver handle")
-
-
-def verify_connectivity() -> None:
-    """Raise if the configured graph database is unreachable on the API read path.
-
-    Backend-agnostic entry point for the readiness probe: Neo4j verifies its
-    driver, Neptune verifies the reader endpoint.
-    """
-    sink_module.get_backend().verify_connectivity()
-
-
-def verify_scan_databases_available() -> None:
-    """Raise if either graph database needed by an Attack Paths scan is unavailable."""
-    errors: list[str] = []
-    first_error: Exception | None = None
-
-    try:
-        ingest.get_driver().verify_connectivity()
-    except Exception as exc:
-        errors.append(f"ingest Neo4j: {exc}")
-        first_error = exc
-
-    try:
-        get_driver().verify_connectivity()
-    except Exception as exc:
-        errors.append(f"sink {settings.ATTACK_PATHS_SINK_DATABASE}: {exc}")
-        if first_error is None:
-            first_error = exc
-
-    if errors:
-        raise RuntimeError(
-            "Attack Paths graph database unavailable before scan start: "
-            + "; ".join(errors)
-        ) from first_error
-
-
-def get_uri() -> str:
-    """Return the sink URI. Retained for backwards compatibility."""
-    if settings.ATTACK_PATHS_SINK_DATABASE == "neptune":
-        cfg = settings.DATABASES["neptune"]
-        return f"bolt+s://{cfg['WRITER_ENDPOINT']}:{cfg['PORT']}"
-
-    cfg = settings.DATABASES["neo4j"]
-    return f"bolt://{cfg['HOST']}:{cfg['PORT']}"
-
-
-def get_ingest_uri() -> str:
-    """Neo4j URI for the cartography temp (ingest) database, which is always
-    Neo4j regardless of the configured sink."""
-    return ingest.get_uri()
-
-
-# Session API
-
-
-def get_session(
-    database: str | None = None,
-    default_access_mode: str | None = None,
-) -> AbstractContextManager:
-    """Return a session against the right backend.
-
-    - `database` names starting with `db-tmp-scan-` always go to ingest.
-    - No database name → ingest (used for CREATE / DROP DATABASE admin ops).
-    - Any other name → sink.
-    """
-    if _is_ingest_database(database) or database is None:
-        return ingest.get_session(
-            database=database, default_access_mode=default_access_mode
-        )
-
-    return sink_module.get_backend().get_session(
-        database=database, default_access_mode=default_access_mode
-    )
-
-
-def execute_read_query(
-    database: str,
-    cypher: str,
-    parameters: dict[str, Any] | None = None,
-) -> neo4j.graph.Graph:
-    """Read-only query against the sink."""
-    return sink_module.get_backend().execute_read_query(database, cypher, parameters)
-
-
-def create_database(database: str) -> None:
-    """Create a database. Temp DBs always land on ingest (Neo4j).
-
-    On the Neo4j sink, tenant DBs also route to ingest because both drivers
-    connect to the same Neo4j cluster. On the Neptune sink, tenant DB creates
-    are no-ops.
-    """
-    if _is_ingest_database(database):
-        ingest.create_database(database)
-        return
-
-    sink_module.get_backend().create_database(database)
-
-
-def drop_database(database: str) -> None:
-    """Drop a database. Mirrors `create_database` routing."""
-    if _is_ingest_database(database):
-        ingest.drop_database(database)
-        return
-
-    sink_module.get_backend().drop_database(database)
-
-
-def drop_subgraph(database: str, provider_id: str) -> int:
-    return sink_module.get_backend().drop_subgraph(database, provider_id)
-
-
-def has_provider_data(database: str, provider_id: str) -> bool:
-    return sink_module.get_backend().has_provider_data(database, provider_id)
-
-
-def clear_cache(database: str) -> None:
-    if _is_ingest_database(database):
-        ingest.clear_cache(database)
-        return
-
-    sink_module.get_backend().clear_cache(database)
-
-
-# Name helper
-
-
-def get_database_name(entity_id: str | UUID, temporary: bool = False) -> str:
-    prefix = "tmp-scan" if temporary else "tenant"
-    return f"db-{prefix}-{str(entity_id).lower()}"

api/src/backend/api/attack_paths/ingest/__init__.py

@@ -1,29 +0,0 @@
-"""Cartography ingest layer.
-
-Public surface for the per-scan Neo4j temp database driver. Implementation
-lives in `api.attack_paths.ingest.driver`.
-"""
-
-from api.attack_paths.ingest.driver import (
-    clear_cache,
-    close_driver,
-    create_database,
-    drop_database,
-    get_driver,
-    get_session,
-    get_uri,
-    init_driver,
-    run_cypher,
-)
-
-__all__ = [
-    "clear_cache",
-    "close_driver",
-    "create_database",
-    "drop_database",
-    "get_driver",
-    "get_session",
-    "get_uri",
-    "init_driver",
-    "run_cypher",
-]

api/src/backend/api/attack_paths/ingest/driver.py

@@ -1,187 +0,0 @@
-"""Cartography ingest driver: per-scan throw-away Neo4j database.
-
-Cartography writes each scan's graph into a throw-away Neo4j database named
-`db-tmp-scan-{scan_uuid}`. This is always Neo4j, regardless of the configured
-sink: Neptune is single-database and cannot host per-scan throw-away
-databases. This module owns the Neo4j driver used for those temp DBs and the
-admin ops they need (CREATE / DROP DATABASE).
-"""
-
-import atexit
-import logging
-import threading
-from collections.abc import Iterator
-from contextlib import contextmanager
-from typing import Any
-
-import neo4j
-import neo4j.exceptions
-from api.attack_paths.retryable_session import RetryableSession
-from config.env import env
-from django.conf import settings
-
-logging.getLogger("neo4j").setLevel(logging.ERROR)
-logging.getLogger("neo4j").propagate = False
-
-SERVICE_UNAVAILABLE_MAX_RETRIES = env.int(
-    "ATTACK_PATHS_SERVICE_UNAVAILABLE_MAX_RETRIES", default=3
-)
-CONN_ACQUISITION_TIMEOUT = env.int("NEO4J_CONN_ACQUISITION_TIMEOUT", default=15)
-# TCP connect timeout, ordered below the acquisition timeout so an unreachable
-# host can't pin a worker on a temp-DB op longer than this.
-CONNECTION_TIMEOUT = env.int("NEO4J_CONNECTION_TIMEOUT", default=5)
-MAX_CONNECTION_LIFETIME = env.int("NEO4J_MAX_CONNECTION_LIFETIME", default=7200)
-MAX_CONNECTION_POOL_SIZE = env.int("NEO4J_MAX_CONNECTION_POOL_SIZE", default=50)
-
-_driver: neo4j.Driver | None = None
-_lock = threading.Lock()
-
-
-def _neo4j_config() -> dict:
-    return settings.DATABASES["neo4j"]
-
-
-def get_uri() -> str:
-    """Bolt URI for the Neo4j temp (ingest) database. Always Neo4j."""
-    config = _neo4j_config()
-    host = config["HOST"]
-    port = config["PORT"]
-    if not host or not port:
-        raise RuntimeError(
-            "NEO4J_HOST / NEO4J_PORT must be set to use the attack-paths "
-            "temp database. Workers require Neo4j env even when the sink is Neptune."
-        )
-
-    return f"bolt://{host}:{port}"
-
-
-def init_driver() -> neo4j.Driver:
-    """Initialize the temp-database Neo4j driver. Idempotent."""
-    global _driver
-    if _driver is not None:
-        return _driver
-
-    with _lock:
-        if _driver is None:
-            config = _neo4j_config()
-            _driver = neo4j.GraphDatabase.driver(
-                get_uri(),
-                auth=(config["USER"], config["PASSWORD"]),
-                keep_alive=True,
-                max_connection_lifetime=MAX_CONNECTION_LIFETIME,
-                connection_timeout=CONNECTION_TIMEOUT,
-                connection_acquisition_timeout=CONN_ACQUISITION_TIMEOUT,
-                max_connection_pool_size=MAX_CONNECTION_POOL_SIZE,
-            )
-            # Best-effort connectivity check: a Neo4j that is down at boot must
-            # not crash the worker. The driver reconnects lazily on first use.
-            try:
-                _driver.verify_connectivity()
-
-            except Exception:
-                logging.warning(
-                    "Neo4j temp-database unreachable at init; continuing with a "
-                    "lazily-reconnecting driver",
-                    exc_info=True,
-                )
-
-            atexit.register(close_driver)
-
-    return _driver
-
-
-def get_driver() -> neo4j.Driver:
-    return init_driver()
-
-
-def close_driver() -> None:
-    global _driver
-    with _lock:
-        if _driver is not None:
-            try:
-                _driver.close()
-            finally:
-                _driver = None
-
-
-@contextmanager
-def get_session(
-    database: str | None = None,
-    default_access_mode: str | None = None,
-) -> Iterator[RetryableSession]:
-    """Session against the Neo4j temp-database cluster. Used for temp DB sessions
-    and for admin operations (CREATE / DROP DATABASE) when `database` is None."""
-    from api.attack_paths.database import (
-        ClientStatementException,
-        GraphDatabaseQueryException,
-        WriteQueryNotAllowedException,
-    )
-
-    READ_EXCEPTION_CODES = [
-        "Neo.ClientError.Statement.AccessMode",
-        "Neo.ClientError.Procedure.ProcedureNotFound",
-    ]
-    CLIENT_STATEMENT_EXCEPTION_PREFIX = "Neo.ClientError.Statement."
-
-    session_wrapper: RetryableSession | None = None
-    try:
-        session_wrapper = RetryableSession(
-            session_factory=lambda: get_driver().session(
-                database=database, default_access_mode=default_access_mode
-            ),
-            max_retries=SERVICE_UNAVAILABLE_MAX_RETRIES,
-        )
-        yield session_wrapper
-
-    except neo4j.exceptions.Neo4jError as exc:
-        if (
-            default_access_mode == neo4j.READ_ACCESS
-            and exc.code
-            and exc.code in READ_EXCEPTION_CODES
-        ):
-            raise WriteQueryNotAllowedException(
-                message="Read query not allowed", code=READ_EXCEPTION_CODES[0]
-            )
-
-        message = exc.message if exc.message is not None else str(exc)
-        if exc.code and exc.code.startswith(CLIENT_STATEMENT_EXCEPTION_PREFIX):
-            raise ClientStatementException(message=message, code=exc.code)
-        raise GraphDatabaseQueryException(message=message, code=exc.code)
-
-    finally:
-        if session_wrapper is not None:
-            session_wrapper.close()
-
-
-def create_database(database: str) -> None:
-    """Create a database on the Neo4j cluster. Used for temp scan DBs."""
-    with get_session() as session:
-        session.run("CREATE DATABASE $database IF NOT EXISTS", {"database": database})
-
-
-def drop_database(database: str) -> None:
-    """Drop a database on the Neo4j cluster. Used for temp scan DBs."""
-    with get_session() as session:
-        session.run(f"DROP DATABASE `{database}` IF EXISTS DESTROY DATA")
-
-
-def clear_cache(database: str) -> None:
-    """Best-effort cache clear for a Neo4j database."""
-    from api.attack_paths.database import GraphDatabaseQueryException
-
-    try:
-        with get_session(database) as session:
-            session.run("CALL db.clearQueryCaches()")
-
-    except GraphDatabaseQueryException as exc:
-        logging.warning(f"Failed to clear query cache for database `{database}`: {exc}")
-
-
-def run_cypher(
-    database: str | None,
-    cypher: str,
-    parameters: dict[str, Any] | None = None,
-) -> Any:
-    """Execute Cypher directly without the context manager. Thin helper."""
-    with get_session(database) as session:
-        return session.run(cypher, parameters or {})

api/src/backend/api/attack_paths/queries/__init__.py

@@ -1,16 +1,15 @@
+from api.attack_paths.queries.types import (
+    AttackPathsQueryDefinition,
+    AttackPathsQueryParameterDefinition,
+)
 from api.attack_paths.queries.registry import (
     get_queries_for_provider,
     get_query_by_id,
 )
-from api.attack_paths.queries.types import (
-    AttackPathsQueryDefinition,
-    AttackPathsQueryOutcome,
-    AttackPathsQueryParameterDefinition,
-)
+
 
 __all__ = [
     "AttackPathsQueryDefinition",
-    "AttackPathsQueryOutcome",
     "AttackPathsQueryParameterDefinition",
     "get_queries_for_provider",
     "get_query_by_id",