{
  "repository": "prowler-cloud/prowler",
  "ref": "2efbfff22ab1433e3b870e253d50896f87ac9c63",
  "methods": [
    {
      "slug": "formal",
      "title": "Formal verification and model checking"
    },
    {
      "slug": "static_analysis",
      "title": "Static analysis"
    },
    {
      "slug": "testing",
      "title": "Testing"
    },
    {
      "slug": "formatting",
      "title": "Formatting and hygiene"
    },
    {
      "slug": "supply_chain",
      "title": "Supply chain"
    },
    {
      "slug": "unclassified",
      "title": "Unclassified"
    }
  ],
  "verifications": [
    {
      "tool": "actionlint",
      "method": "static_analysis",
      "commands": [
        "pre-commit hook actionlint"
      ],
      "triggers": [
        "pre_commit"
      ],
      "evidence": [
        {
          "path": ".pre-commit-config.yaml",
          "locator": "hooks.actionlint"
        }
      ],
      "upstream": "https://github.com/rhysd/actionlint",
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": "bandit",
      "method": "static_analysis",
      "commands": [
        "bandit -q -lll -x *_test.py,./contrib/,./.venv/ -r .",
        "bandit -q -lll -x *_test.py,./.venv/,./contrib/,./api/,./ui -r .",
        "bandit -q -lll"
      ],
      "triggers": [
        "pre_commit",
        "ci"
      ],
      "evidence": [
        {
          "path": ".github/workflows/api-security.yml",
          "locator": "jobs.api-security-scans.steps[4] (Bandit)"
        },
        {
          "path": ".github/workflows/sdk-security.yml",
          "locator": "jobs.sdk-security-scans.steps[4] (Security scan with Bandit)"
        },
        {
          "path": ".pre-commit-config.yaml",
          "locator": "hooks.bandit"
        },
        {
          "path": "api/pyproject.toml",
          "locator": "[dependency-groups] dev: bandit"
        },
        {
          "path": "mcp_server/pyproject.toml",
          "locator": "[dependency-groups] dev: bandit"
        },
        {
          "path": "pyproject.toml",
          "locator": "[dependency-groups] dev: bandit"
        }
      ],
      "upstream": "https://github.com/PyCQA/bandit",
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": "codeql",
      "method": "static_analysis",
      "commands": [
        "uses github/codeql-action/analyze"
      ],
      "triggers": [
        "ci"
      ],
      "evidence": [
        {
          "path": ".github/workflows/api-codeql.yml",
          "locator": "jobs.api-analyze.steps[3] (Perform CodeQL Analysis)"
        },
        {
          "path": ".github/workflows/sdk-codeql.yml",
          "locator": "jobs.sdk-analyze.steps[3] (Perform CodeQL Analysis)"
        },
        {
          "path": ".github/workflows/ui-codeql.yml",
          "locator": "jobs.ui-analyze.steps[3] (Perform CodeQL Analysis)"
        }
      ],
      "upstream": "https://github.com/github/codeql",
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": "eslint",
      "method": "static_analysis",
      "commands": [
        "eslint . --max-warnings 40",
        "eslint . --fix --max-warnings 40"
      ],
      "triggers": [
        "local"
      ],
      "evidence": [
        {
          "path": "ui/package.json",
          "locator": "scripts.healthcheck"
        },
        {
          "path": "ui/package.json",
          "locator": "scripts.lint:check"
        },
        {
          "path": "ui/package.json",
          "locator": "scripts.lint:fix"
        },
        {
          "path": "ui/package.json",
          "locator": "devDependencies: eslint"
        },
        {
          "path": "ui/eslint.config.ts",
          "locator": "config file"
        }
      ],
      "upstream": "https://github.com/eslint/eslint",
      "docs": "https://eslint.org/docs/latest/use/command-line-interface#exit-codes",
      "exit_codes": {
        "0": "no errors",
        "1": "linting errors found",
        "2": "configuration problem or internal error"
      },
      "autofix": true,
      "declared_only": false
    },
    {
      "tool": "flake8",
      "method": "static_analysis",
      "commands": [
        "flake8 . --ignore=E266,W503,E203,E501,W605,E128 --exclude .venv,contrib,ui,api,skills,mcp_server",
        "pre-commit hook flake8"
      ],
      "triggers": [
        "pre_commit",
        "ci",
        "local"
      ],
      "evidence": [
        {
          "path": ".github/workflows/sdk-code-quality.yml",
          "locator": "jobs.sdk-code-quality.steps[5] (Lint with flake8)"
        },
        {
          "path": ".pre-commit-config.yaml",
          "locator": "hooks.flake8"
        },
        {
          "path": "Makefile",
          "locator": "target lint-sdk (line 60)"
        },
        {
          "path": "pyproject.toml",
          "locator": "[dependency-groups] dev: flake8"
        }
      ],
      "upstream": "https://github.com/PyCQA/flake8",
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": "pylint",
      "method": "static_analysis",
      "commands": [
        "pylint --disable=W,C,R,E -j 0 -rn -sn src/",
        "pylint --disable=W,C,R,E -j 0 -rn -sn prowler/",
        "pylint --disable=W,C,R,E -j 0 -rn -sn"
      ],
      "triggers": [
        "pre_commit",
        "ci",
        "local"
      ],
      "evidence": [
        {
          "path": ".github/workflows/api-code-quality.yml",
          "locator": "jobs.api-code-quality.steps[7] (Pylint)"
        },
        {
          "path": ".github/workflows/sdk-code-quality.yml",
          "locator": "jobs.sdk-code-quality.steps[7] (Lint with pylint)"
        },
        {
          "path": ".pre-commit-config.yaml",
          "locator": "hooks.pylint"
        },
        {
          "path": "Makefile",
          "locator": "target lint-sdk (line 60)"
        },
        {
          "path": "api/pyproject.toml",
          "locator": "[dependency-groups] dev: pylint"
        },
        {
          "path": "pyproject.toml",
          "locator": "[dependency-groups] dev: pylint"
        }
      ],
      "upstream": "https://github.com/pylint-dev/pylint",
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": "ruff-check",
      "method": "static_analysis",
      "commands": [
        "ruff check . --exclude contrib",
        "ruff check --fix",
        "ruff check . --exclude contrib --fix",
        "ruff check . --fix",
        "ruff check ."
      ],
      "triggers": [
        "pre_commit",
        "ci",
        "local"
      ],
      "evidence": [
        {
          "path": ".github/workflows/api-code-quality.yml",
          "locator": "jobs.api-code-quality.steps[5] (Ruff lint)"
        },
        {
          "path": ".pre-commit-config.yaml",
          "locator": "hooks.ruff-check-api"
        },
        {
          "path": ".pre-commit-config.yaml",
          "locator": "hooks.ruff-check-mcp"
        },
        {
          "path": "Makefile",
          "locator": "target format-api (line 65)"
        },
        {
          "path": "Makefile",
          "locator": "target lint-api (line 69)"
        },
        {
          "path": "Makefile",
          "locator": "target format-mcp (line 73)"
        },
        {
          "path": "Makefile",
          "locator": "target lint-mcp (line 77)"
        },
        {
          "path": "api/pyproject.toml",
          "locator": "[tool.ruff]"
        },
        {
          "path": "api/pyproject.toml",
          "locator": "[dependency-groups] dev: ruff"
        },
        {
          "path": "mcp_server/pyproject.toml",
          "locator": "[tool.ruff]"
        },
        {
          "path": "mcp_server/pyproject.toml",
          "locator": "[dependency-groups] dev: ruff"
        }
      ],
      "upstream": "https://github.com/astral-sh/ruff",
      "docs": "https://docs.astral.sh/ruff/linter/#exit-codes",
      "exit_codes": {
        "0": "no violations",
        "1": "violations found",
        "2": "invalid configuration, CLI options or internal error"
      },
      "autofix": true,
      "declared_only": false
    },
    {
      "tool": "shellcheck",
      "method": "static_analysis",
      "commands": [
        "pre-commit hook shellcheck"
      ],
      "triggers": [
        "pre_commit"
      ],
      "evidence": [
        {
          "path": ".pre-commit-config.yaml",
          "locator": "hooks.shellcheck"
        }
      ],
      "upstream": "https://github.com/koalaman/shellcheck",
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": "tsc",
      "method": "static_analysis",
      "commands": [
        "tsc"
      ],
      "triggers": [
        "local"
      ],
      "evidence": [
        {
          "path": "ui/package.json",
          "locator": "scripts.healthcheck"
        },
        {
          "path": "ui/package.json",
          "locator": "scripts.typecheck"
        },
        {
          "path": "ui/package.json",
          "locator": "devDependencies: typescript"
        }
      ],
      "upstream": "https://github.com/microsoft/TypeScript",
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": "zizmor",
      "method": "static_analysis",
      "commands": [
        "uses zizmorcore/zizmor-action",
        "pre-commit hook zizmor"
      ],
      "triggers": [
        "pre_commit",
        "ci"
      ],
      "evidence": [
        {
          "path": ".github/workflows/ci-zizmor.yml",
          "locator": "jobs.zizmor.steps[2] (Run zizmor)"
        },
        {
          "path": ".pre-commit-config.yaml",
          "locator": "hooks.zizmor"
        }
      ],
      "upstream": "https://github.com/zizmorcore/zizmor",
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": "mypy",
      "method": "static_analysis",
      "commands": [],
      "triggers": [],
      "evidence": [
        {
          "path": "api/pyproject.toml",
          "locator": "[dependency-groups] dev: mypy"
        }
      ],
      "upstream": "https://github.com/python/mypy",
      "docs": "https://mypy.readthedocs.io/en/stable/command_line.html",
      "exit_codes": {
        "0": "no type errors",
        "1": "type errors found",
        "2": "crash or invalid invocation"
      },
      "autofix": false,
      "declared_only": true
    },
    {
      "tool": "ci-matrix",
      "method": "testing",
      "commands": [
        "api-code-quality (python-version: 1)",
        "api-analyze (language: 1)",
        "api-security-scans (python-version: 1)",
        "api-tests (python-version: 1)",
        "mcp-tests (python-version: 2)"
      ],
      "triggers": [
        "ci"
      ],
      "evidence": [
        {
          "path": ".github/workflows/api-code-quality.yml",
          "locator": "jobs.api-code-quality.strategy.matrix"
        },
        {
          "path": ".github/workflows/api-codeql.yml",
          "locator": "jobs.api-analyze.strategy.matrix"
        },
        {
          "path": ".github/workflows/api-security.yml",
          "locator": "jobs.api-security-scans.strategy.matrix"
        },
        {
          "path": ".github/workflows/api-tests.yml",
          "locator": "jobs.api-tests.strategy.matrix"
        },
        {
          "path": ".github/workflows/mcp-tests.yml",
          "locator": "jobs.mcp-tests.strategy.matrix"
        },
        {
          "path": ".github/workflows/sdk-code-quality.yml",
          "locator": "jobs.sdk-code-quality.strategy.matrix"
        },
        {
          "path": ".github/workflows/sdk-codeql.yml",
          "locator": "jobs.sdk-analyze.strategy.matrix"
        },
        {
          "path": ".github/workflows/sdk-tests.yml",
          "locator": "jobs.sdk-tests.strategy.matrix"
        },
        {
          "path": ".github/workflows/ui-codeql.yml",
          "locator": "jobs.ui-analyze.strategy.matrix"
        }
      ],
      "upstream": "https://docs.github.com/en/actions/how-tos/write-workflows/choose-what-workflows-do/run-job-variations",
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": "playwright",
      "method": "testing",
      "commands": [
        "playwright test ${test_paths[@]}",
        "playwright test --project=auth --project=sign-up --project=providers --project=invitations --project=scans --project=runtime-config --project=navigation",
        "playwright test --project=auth --project=sign-up --project=providers --project=invitations --project=scans --project=runtime-config --project=navigation --debug",
        "playwright test --project=auth --project=sign-up --project=providers --project=invitations --project=scans --project=runtime-config --project=navigation --headed",
        "playwright test --config=playwright.registry.config.ts --project=registry --project=registry-flag-off --project=registry-local --project=registry-mobile"
      ],
      "triggers": [
        "ci",
        "local"
      ],
      "evidence": [
        {
          "path": ".github/workflows/ui-e2e-tests-v2.yml",
          "locator": "jobs.e2e-tests.steps[21] (Run standard E2E tests)"
        },
        {
          "path": "ui/package.json",
          "locator": "scripts.test:e2e"
        },
        {
          "path": "ui/package.json",
          "locator": "scripts.test:e2e:debug"
        },
        {
          "path": "ui/package.json",
          "locator": "scripts.test:e2e:headed"
        },
        {
          "path": "ui/package.json",
          "locator": "scripts.test:e2e:registry"
        },
        {
          "path": "ui/package.json",
          "locator": "scripts.test:e2e:ui"
        },
        {
          "path": "ui/package.json",
          "locator": "devDependencies: @playwright/test"
        },
        {
          "path": "ui/playwright.config.ts",
          "locator": "config file"
        }
      ],
      "upstream": "https://github.com/microsoft/playwright",
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": "pytest",
      "method": "testing",
      "commands": [
        "pytest --cov=./src/backend --cov-report=xml src/backend",
        "pytest --cov=./prowler_mcp_server --cov-report=xml tests",
        "pytest tests/github",
        "pytest -n auto --cov=./prowler/providers/aws --cov-report=xml:aws_coverage.xml tests/providers/aws",
        "pytest -n auto --cov=./prowler/providers/aws --cov-report=xml:aws_coverage.xml ${service_paths[@]}"
      ],
      "triggers": [
        "ci",
        "local"
      ],
      "evidence": [
        {
          "path": ".github/workflows/api-tests.yml",
          "locator": "jobs.api-tests.steps[4] (Run tests with pytest)"
        },
        {
          "path": ".github/workflows/mcp-tests.yml",
          "locator": "jobs.mcp-tests.steps[4] (Run tests with pytest)"
        },
        {
          "path": ".github/workflows/pr-check-changelog.yml",
          "locator": "jobs.test-changelog-attribution.steps[5] (Test changelog attribution)"
        },
        {
          "path": ".github/workflows/sdk-tests.yml",
          "locator": "jobs.sdk-tests.steps[6] (Run AWS tests)"
        },
        {
          "path": ".github/workflows/sdk-tests.yml",
          "locator": "jobs.sdk-tests.steps[9] (Run Azure tests)"
        },
        {
          "path": ".github/workflows/sdk-tests.yml",
          "locator": "jobs.sdk-tests.steps[12] (Run GCP tests)"
        },
        {
          "path": ".github/workflows/sdk-tests.yml",
          "locator": "jobs.sdk-tests.steps[15] (Run Kubernetes tests)"
        },
        {
          "path": ".github/workflows/sdk-tests.yml",
          "locator": "jobs.sdk-tests.steps[18] (Run GitHub tests)"
        },
        {
          "path": ".github/workflows/sdk-tests.yml",
          "locator": "jobs.sdk-tests.steps[21] (Run Okta tests)"
        },
        {
          "path": ".github/workflows/sdk-tests.yml",
          "locator": "jobs.sdk-tests.steps[24] (Run NHN tests)"
        },
        {
          "path": ".github/workflows/sdk-tests.yml",
          "locator": "jobs.sdk-tests.steps[27] (Run M365 tests)"
        },
        {
          "path": ".github/workflows/sdk-tests.yml",
          "locator": "jobs.sdk-tests.steps[30] (Run IaC tests)"
        }
      ],
      "upstream": "https://github.com/pytest-dev/pytest",
      "docs": "https://docs.pytest.org/en/stable/reference/exit-codes.html",
      "exit_codes": {
        "0": "all tests passed",
        "1": "some tests failed",
        "2": "interrupted by the user",
        "3": "internal error",
        "4": "command line usage error",
        "5": "no tests were collected"
      },
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": "vitest",
      "method": "testing",
      "commands": [
        "vitest related ${changed[@]} --run --project unit",
        "vitest run",
        "vitest run --coverage",
        "vitest run --project integration",
        "vitest --project integration"
      ],
      "triggers": [
        "ci",
        "local"
      ],
      "evidence": [
        {
          "path": ".github/workflows/ui-tests.yml",
          "locator": "jobs.ui-tests.steps[13] (Run unit tests (related to changes only))"
        },
        {
          "path": "ui/package.json",
          "locator": "scripts.test"
        },
        {
          "path": "ui/package.json",
          "locator": "scripts.test:coverage"
        },
        {
          "path": "ui/package.json",
          "locator": "scripts.test:integration"
        },
        {
          "path": "ui/package.json",
          "locator": "scripts.test:integration:watch"
        },
        {
          "path": "ui/package.json",
          "locator": "scripts.test:unit"
        },
        {
          "path": "ui/package.json",
          "locator": "scripts.test:watch"
        },
        {
          "path": "ui/package.json",
          "locator": "devDependencies: vitest"
        },
        {
          "path": "ui/vitest.config.ts",
          "locator": "config file"
        }
      ],
      "upstream": "https://github.com/vitest-dev/vitest",
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": "black",
      "method": "formatting",
      "commands": [
        "black --exclude \"\\.venv",
        "pre-commit hook black"
      ],
      "triggers": [
        "pre_commit",
        "ci",
        "local"
      ],
      "evidence": [
        {
          "path": ".github/workflows/sdk-code-quality.yml",
          "locator": "jobs.sdk-code-quality.steps[6] (Check format with black)"
        },
        {
          "path": ".pre-commit-config.yaml",
          "locator": "hooks.black"
        },
        {
          "path": "Makefile",
          "locator": "target format-sdk (line 57)"
        },
        {
          "path": "Makefile",
          "locator": "target lint-sdk (line 60)"
        },
        {
          "path": "pyproject.toml",
          "locator": "[dependency-groups] dev: black"
        }
      ],
      "upstream": "https://github.com/psf/black",
      "docs": null,
      "exit_codes": {
        "0": "nothing to change",
        "1": "files would be reformatted (--check)",
        "123": "internal error"
      },
      "autofix": true,
      "declared_only": false
    },
    {
      "tool": "isort",
      "method": "formatting",
      "commands": [
        "pre-commit hook isort"
      ],
      "triggers": [
        "pre_commit"
      ],
      "evidence": [
        {
          "path": ".pre-commit-config.yaml",
          "locator": "hooks.isort"
        }
      ],
      "upstream": "https://github.com/PyCQA/isort",
      "docs": null,
      "exit_codes": {},
      "autofix": true,
      "declared_only": false
    },
    {
      "tool": "pre-commit-hooks",
      "method": "formatting",
      "commands": [
        "pre-commit hook check-merge-conflict",
        "pre-commit hook check-yaml",
        "pre-commit hook check-json",
        "pre-commit hook end-of-file-fixer",
        "pre-commit hook trailing-whitespace"
      ],
      "triggers": [
        "pre_commit"
      ],
      "evidence": [
        {
          "path": ".pre-commit-config.yaml",
          "locator": "hooks.check-merge-conflict"
        },
        {
          "path": ".pre-commit-config.yaml",
          "locator": "hooks.check-yaml"
        },
        {
          "path": ".pre-commit-config.yaml",
          "locator": "hooks.check-json"
        },
        {
          "path": ".pre-commit-config.yaml",
          "locator": "hooks.end-of-file-fixer"
        },
        {
          "path": ".pre-commit-config.yaml",
          "locator": "hooks.trailing-whitespace"
        }
      ],
      "upstream": "https://github.com/pre-commit/pre-commit-hooks",
      "docs": null,
      "exit_codes": {},
      "autofix": true,
      "declared_only": false
    },
    {
      "tool": "ruff-format",
      "method": "formatting",
      "commands": [
        "ruff format --check . --exclude contrib",
        "ruff format",
        "ruff format . --exclude contrib",
        "ruff format .",
        "ruff format --check ."
      ],
      "triggers": [
        "pre_commit",
        "ci",
        "local"
      ],
      "evidence": [
        {
          "path": ".github/workflows/api-code-quality.yml",
          "locator": "jobs.api-code-quality.steps[6] (Ruff format)"
        },
        {
          "path": ".pre-commit-config.yaml",
          "locator": "hooks.ruff-format-api"
        },
        {
          "path": ".pre-commit-config.yaml",
          "locator": "hooks.ruff-format-mcp"
        },
        {
          "path": "Makefile",
          "locator": "target format-api (line 65)"
        },
        {
          "path": "Makefile",
          "locator": "target lint-api (line 69)"
        },
        {
          "path": "Makefile",
          "locator": "target format-mcp (line 73)"
        },
        {
          "path": "Makefile",
          "locator": "target lint-mcp (line 77)"
        }
      ],
      "upstream": "https://github.com/astral-sh/ruff",
      "docs": "https://docs.astral.sh/ruff/formatter/#exit-codes",
      "exit_codes": {
        "0": "already formatted",
        "1": "files would be reformatted (--check)",
        "2": "error"
      },
      "autofix": true,
      "declared_only": false
    },
    {
      "tool": "prettier",
      "method": "formatting",
      "commands": [],
      "triggers": [],
      "evidence": [
        {
          "path": "ui/package.json",
          "locator": "devDependencies: prettier"
        },
        {
          "path": "ui/.prettierrc.json",
          "locator": "config file"
        }
      ],
      "upstream": "https://github.com/prettier/prettier",
      "docs": "https://prettier.io/docs/cli#exit-codes",
      "exit_codes": {
        "0": "everything formatted",
        "1": "something was not formatted (--check)",
        "2": "prettier error"
      },
      "autofix": true,
      "declared_only": true
    },
    {
      "tool": "uv-lock",
      "method": "supply_chain",
      "commands": [
        "uv lock --check",
        "pre-commit hook uv-lock"
      ],
      "triggers": [
        "pre_commit",
        "ci"
      ],
      "evidence": [
        {
          "path": ".github/workflows/api-code-quality.yml",
          "locator": "jobs.api-code-quality.steps[4] (uv lock check)"
        },
        {
          "path": ".github/workflows/sdk-code-quality.yml",
          "locator": "jobs.sdk-code-quality.steps[4] (Check uv lock file)"
        },
        {
          "path": ".pre-commit-config.yaml",
          "locator": "hooks.uv-lock"
        }
      ],
      "upstream": "https://github.com/astral-sh/uv",
      "docs": null,
      "exit_codes": {},
      "autofix": true,
      "declared_only": false
    },
    {
      "tool": null,
      "method": "unclassified",
      "commands": [
        "API Tests"
      ],
      "triggers": [
        "ci"
      ],
      "evidence": [
        {
          "path": ".github/workflows/test-impact-analysis.yml",
          "locator": "jobs.analyze.steps[7] (Summary)"
        }
      ],
      "upstream": null,
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": null,
      "method": "unclassified",
      "commands": [
        "SDK Tests"
      ],
      "triggers": [
        "ci"
      ],
      "evidence": [
        {
          "path": ".github/workflows/test-impact-analysis.yml",
          "locator": "jobs.analyze.steps[7] (Summary)"
        }
      ],
      "upstream": null,
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": null,
      "method": "unclassified",
      "commands": [
        "UI E2E"
      ],
      "triggers": [
        "ci"
      ],
      "evidence": [
        {
          "path": ".github/workflows/test-impact-analysis.yml",
          "locator": "jobs.analyze.steps[7] (Summary)"
        }
      ],
      "upstream": null,
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": null,
      "method": "unclassified",
      "commands": [
        "api"
      ],
      "triggers": [
        "local"
      ],
      "evidence": [
        {
          "path": "Makefile",
          "locator": "target format-sdk (line 57)"
        },
        {
          "path": "Makefile",
          "locator": "target lint-sdk (line 60)"
        }
      ],
      "upstream": null,
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": null,
      "method": "unclassified",
      "commands": [
        "bash ${RUNNER_TEMP}/gh-aw/actions/audit_pre_agent_workspace.sh"
      ],
      "triggers": [
        "ci"
      ],
      "evidence": [
        {
          "path": ".github/workflows/issue-triage.lock.yml",
          "locator": "jobs.agent.steps[23] (Audit pre-agent workspace)"
        }
      ],
      "upstream": null,
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": null,
      "method": "unclassified",
      "commands": [
        "bash ${RUNNER_TEMP}/gh-aw/actions/validate_multi_secret.sh COPILOT_GITHUB_TOKEN GitHub Copilot CLI https://github.github.com/gh-aw/reference/engines/"
      ],
      "triggers": [
        "ci"
      ],
      "evidence": [
        {
          "path": ".github/workflows/issue-triage.lock.yml",
          "locator": "jobs.activation.steps[8] (Validate COPILOT_GITHUB_TOKEN secret)"
        }
      ],
      "upstream": null,
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": null,
      "method": "unclassified",
      "commands": [
        "check prowler_version or pass the version input explicitly\""
      ],
      "triggers": [
        "ci"
      ],
      "evidence": [
        {
          "path": ".github/workflows/compile-changelogs.yml",
          "locator": "jobs.compile-changelogs.steps[6] (Compile changelogs)"
        }
      ],
      "upstream": null,
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": null,
      "method": "unclassified",
      "commands": [
        "coverage html"
      ],
      "triggers": [
        "local"
      ],
      "evidence": [
        {
          "path": "Makefile",
          "locator": "target coverage-html (line 42)"
        }
      ],
      "upstream": null,
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": null,
      "method": "unclassified",
      "commands": [
        "coverage report -m"
      ],
      "triggers": [
        "local"
      ],
      "evidence": [
        {
          "path": "Makefile",
          "locator": "target coverage (line 39)"
        }
      ],
      "upstream": null,
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": null,
      "method": "unclassified",
      "commands": [
        "coverage run --skip-covered -m pytest -v"
      ],
      "triggers": [
        "local"
      ],
      "evidence": [
        {
          "path": "Makefile",
          "locator": "target coverage (line 39)"
        }
      ],
      "upstream": null,
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": null,
      "method": "unclassified",
      "commands": [
        "def find_duplicate_test_names():"
      ],
      "triggers": [
        "ci"
      ],
      "evidence": [
        {
          "path": ".github/workflows/sdk-check-duplicate-test-names.yml",
          "locator": "jobs.check-duplicate-test-names.steps[2] (Check for duplicate test names across providers)"
        }
      ],
      "upstream": null,
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": null,
      "method": "unclassified",
      "commands": [
        "done <<< $TEST_PATHS"
      ],
      "triggers": [
        "ci"
      ],
      "evidence": [
        {
          "path": ".github/workflows/ui-e2e-tests-v2.yml",
          "locator": "jobs.e2e-tests.steps[21] (Run standard E2E tests)"
        }
      ],
      "upstream": null,
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": null,
      "method": "unclassified",
      "commands": [
        "elif path_str.startswith(tests/providers/aws/services/):"
      ],
      "triggers": [
        "ci"
      ],
      "evidence": [
        {
          "path": ".github/workflows/sdk-tests.yml",
          "locator": "jobs.sdk-tests.steps[5] (Resolve AWS services under test)"
        }
      ],
      "upstream": null,
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": null,
      "method": "unclassified",
      "commands": [
        "filename = test_file.name"
      ],
      "triggers": [
        "ci"
      ],
      "evidence": [
        {
          "path": ".github/workflows/sdk-check-duplicate-test-names.yml",
          "locator": "jobs.check-duplicate-test-names.steps[2] (Check for duplicate test names across providers)"
        }
      ],
      "upstream": null,
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": null,
      "method": "unclassified",
      "commands": [
        "for test_file in tests_dir.rglob(*_test.py):"
      ],
      "triggers": [
        "ci"
      ],
      "evidence": [
        {
          "path": ".github/workflows/sdk-check-duplicate-test-names.yml",
          "locator": "jobs.check-duplicate-test-names.steps[2] (Check for duplicate test names across providers)"
        }
      ],
      "upstream": null,
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": null,
      "method": "unclassified",
      "commands": [
        "helm lint $EXPR"
      ],
      "triggers": [
        "ci"
      ],
      "evidence": [
        {
          "path": ".github/workflows/helm-chart-checks.yml",
          "locator": "jobs.helm-lint.steps[4] (Lint Helm chart)"
        }
      ],
      "upstream": null,
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": null,
      "method": "unclassified",
      "commands": [
        "knip --fix --max-issues 494"
      ],
      "triggers": [
        "local"
      ],
      "evidence": [
        {
          "path": "ui/package.json",
          "locator": "scripts.lint:knip:fix"
        }
      ],
      "upstream": null,
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": null,
      "method": "unclassified",
      "commands": [
        "knip --max-issues 494"
      ],
      "triggers": [
        "local"
      ],
      "evidence": [
        {
          "path": "ui/package.json",
          "locator": "scripts.lint:knip"
        }
      ],
      "upstream": null,
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": null,
      "method": "unclassified",
      "commands": [
        "open htmlcov/index.html"
      ],
      "triggers": [
        "local"
      ],
      "evidence": [
        {
          "path": "Makefile",
          "locator": "target coverage-html (line 42)"
        }
      ],
      "upstream": null,
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": null,
      "method": "unclassified",
      "commands": [
        "playwright show-report"
      ],
      "triggers": [
        "local"
      ],
      "evidence": [
        {
          "path": "ui/package.json",
          "locator": "scripts.test:e2e:report"
        }
      ],
      "upstream": null,
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": null,
      "method": "unclassified",
      "commands": [
        "pre-commit hook autoflake"
      ],
      "triggers": [
        "pre_commit"
      ],
      "evidence": [
        {
          "path": ".pre-commit-config.yaml",
          "locator": "hooks.autoflake"
        }
      ],
      "upstream": "https://github.com/myint/autoflake",
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": null,
      "method": "unclassified",
      "commands": [
        "pre-commit hook hadolint"
      ],
      "triggers": [
        "pre_commit"
      ],
      "evidence": [
        {
          "path": ".pre-commit-config.yaml",
          "locator": "hooks.hadolint"
        }
      ],
      "upstream": "https://github.com/hadolint/hadolint",
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": null,
      "method": "unclassified",
      "commands": [
        "pre-commit hook markdownlint"
      ],
      "triggers": [
        "pre_commit"
      ],
      "evidence": [
        {
          "path": ".pre-commit-config.yaml",
          "locator": "hooks.markdownlint"
        }
      ],
      "upstream": "https://github.com/igorshubovych/markdownlint-cli",
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": null,
      "method": "unclassified",
      "commands": [
        "pre-commit hook no-commit-to-branch"
      ],
      "triggers": [
        "pre_commit"
      ],
      "evidence": [
        {
          "path": ".pre-commit-config.yaml",
          "locator": "hooks.no-commit-to-branch"
        }
      ],
      "upstream": null,
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": null,
      "method": "unclassified",
      "commands": [
        "pre-commit hook pretty-format-json"
      ],
      "triggers": [
        "pre_commit"
      ],
      "evidence": [
        {
          "path": ".pre-commit-config.yaml",
          "locator": "hooks.pretty-format-json"
        }
      ],
      "upstream": null,
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": null,
      "method": "unclassified",
      "commands": [
        "pre-commit hook pretty-format-toml"
      ],
      "triggers": [
        "pre_commit"
      ],
      "evidence": [
        {
          "path": ".pre-commit-config.yaml",
          "locator": "hooks.pretty-format-toml"
        }
      ],
      "upstream": "https://github.com/macisamuele/language-formatters-pre-commit-hooks",
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": null,
      "method": "unclassified",
      "commands": [
        "pre-commit hook renovate-config-validator"
      ],
      "triggers": [
        "pre_commit",
        "ci"
      ],
      "evidence": [
        {
          "path": ".github/workflows/renovate-config-validate.yml",
          "locator": "jobs.validate.steps[4] (Validate Renovate config)"
        },
        {
          "path": ".pre-commit-config.yaml",
          "locator": "hooks.renovate-config-validator"
        }
      ],
      "upstream": "https://github.com/renovatebot/pre-commit-hooks",
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": null,
      "method": "unclassified",
      "commands": [
        "prowler_docs_get_document"
      ],
      "triggers": [
        "ci"
      ],
      "evidence": [
        {
          "path": ".github/workflows/issue-triage.lock.yml",
          "locator": "jobs.agent.steps[20] (Start MCP Gateway)"
        }
      ],
      "upstream": null,
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": null,
      "method": "unclassified",
      "commands": [
        "python .github/scripts/test-impact.py ${changed[@]}"
      ],
      "triggers": [
        "ci"
      ],
      "evidence": [
        {
          "path": ".github/workflows/test-impact-analysis.yml",
          "locator": "jobs.analyze.steps[5] (Analyze test impact)"
        }
      ],
      "upstream": null,
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": null,
      "method": "unclassified",
      "commands": [
        "python docs/scripts/generate_provider_cards.py"
      ],
      "triggers": [
        "pre_commit"
      ],
      "evidence": [
        {
          "path": ".pre-commit-config.yaml",
          "locator": "hooks.generate-provider-cards"
        }
      ],
      "upstream": null,
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": null,
      "method": "unclassified",
      "commands": [
        "python scripts/check_test_init_files.py ."
      ],
      "triggers": [
        "ci"
      ],
      "evidence": [
        {
          "path": ".github/workflows/check-test-init-files.yml",
          "locator": "jobs.check-test-init-files.steps[2] (Check for __init__.py files in test directories)"
        }
      ],
      "upstream": null,
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": null,
      "method": "unclassified",
      "commands": [
        "python util/check_yanked_pins.py . api mcp_server"
      ],
      "triggers": [
        "ci"
      ],
      "evidence": [
        {
          "path": ".github/workflows/sdk-package-checks.yml",
          "locator": "jobs.pinned-releases-not-yanked.steps[3] (Check every pinned and locked release against PyPI)"
        }
      ],
      "upstream": null,
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": null,
      "method": "unclassified",
      "commands": [
        "query-docs"
      ],
      "triggers": [
        "ci"
      ],
      "evidence": [
        {
          "path": ".github/workflows/issue-triage.lock.yml",
          "locator": "jobs.agent.steps[20] (Start MCP Gateway)"
        }
      ],
      "upstream": null,
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": null,
      "method": "unclassified",
      "commands": [
        "read -ra test_paths <<< $TEST_PATHS"
      ],
      "triggers": [
        "ci"
      ],
      "evidence": [
        {
          "path": ".github/workflows/ui-e2e-tests-v2.yml",
          "locator": "jobs.e2e-tests.steps[21] (Run standard E2E tests)"
        }
      ],
      "upstream": null,
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": null,
      "method": "unclassified",
      "commands": [
        "relative_path = test_file.relative_to(tests_dir)"
      ],
      "triggers": [
        "ci"
      ],
      "evidence": [
        {
          "path": ".github/workflows/sdk-check-duplicate-test-names.yml",
          "locator": "jobs.check-duplicate-test-names.steps[2] (Check for duplicate test names across providers)"
        }
      ],
      "upstream": null,
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": null,
      "method": "unclassified",
      "commands": [
        "require_vars E2E_ADMIN_USER E2E_ADMIN_PASSWORD"
      ],
      "triggers": [
        "ci"
      ],
      "evidence": [
        {
          "path": ".github/workflows/ui-e2e-tests-v2.yml",
          "locator": "jobs.e2e-tests.steps[3] (Validate E2E prerequisites)"
        }
      ],
      "upstream": null,
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": null,
      "method": "unclassified",
      "commands": [
        "require_vars E2E_AWS_PROVIDER_ACCOUNT_ID E2E_AWS_PROVIDER_ACCESS_KEY E2E_AWS_PROVIDER_SECRET_KEY"
      ],
      "triggers": [
        "ci"
      ],
      "evidence": [
        {
          "path": ".github/workflows/ui-e2e-tests-v2.yml",
          "locator": "jobs.e2e-tests.steps[3] (Validate E2E prerequisites)"
        }
      ],
      "upstream": null,
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": null,
      "method": "unclassified",
      "commands": [
        "require_vars E2E_AWS_PROVIDER_ACCOUNT_ID E2E_AWS_PROVIDER_ACCESS_KEY E2E_AWS_PROVIDER_SECRET_KEY E2E_AWS_PROVIDER_ROLE_ARN E2E_AZURE_SUBSCRIPTION_ID E2E_AZURE_CLIENT_ID E2E_AZURE_SECRET_ID E2E_AZURE_TENANT_ID E2E_M365_DOMAIN_ID E2E_M365_CLIENT_ID E2E_M365_SECRET_ID E2E_M365_TENANT_ID E2E_M365_CERTIFICATE_CONTENT E2E_GCP_BASE64_SERVICE_ACCOUNT_KEY E2E_GCP_PROJECT_ID E2E_GITHUB_APP_ID E2E_GITHUB_BASE64_APP_PRIVATE_KEY E2E_GITHUB_USERNAME E2E_GITHUB_PERSONAL_ACCESS_TOKEN E2E_GITHUB_ORGANIZATION E2E_GITHUB_ORGANIZATION_ACCESS_TOKEN E2E_OCI_TENANCY_ID E2E_OCI_USER_ID E2E_OCI_FINGERPRINT E2E_OCI_KEY_CONTENT E2E_ALIBABACLOUD_ACCOUNT_ID E2E_ALIBABACLOUD_ACCESS_KEY_ID E2E_ALIBABACLOUD_ACCESS_KEY_SECRET E2E_ALIBABACLOUD_ROLE_ARN E2E_OKTA_DOMAIN E2E_OKTA_CLIENT_ID E2E_OKTA_BASE64_PRIVATE_KEY E2E_GOOGLEWORKSPACE_CUSTOMER_ID E2E_GOOGLEWORKSPACE_SERVICE_ACCOUNT_JSON E2E_GOOGLEWORKSPACE_DELEGATED_USER E2E_VERCEL_TEAM_ID E2E_VERCEL_API_TOKEN"
      ],
      "triggers": [
        "ci"
      ],
      "evidence": [
        {
          "path": ".github/workflows/ui-e2e-tests-v2.yml",
          "locator": "jobs.e2e-tests.steps[3] (Validate E2E prerequisites)"
        }
      ],
      "upstream": null,
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": null,
      "method": "unclassified",
      "commands": [
        "require_vars E2E_NEW_USER_PASSWORD"
      ],
      "triggers": [
        "ci"
      ],
      "evidence": [
        {
          "path": ".github/workflows/ui-e2e-tests-v2.yml",
          "locator": "jobs.e2e-tests.steps[3] (Validate E2E prerequisites)"
        }
      ],
      "upstream": null,
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": null,
      "method": "unclassified",
      "commands": [
        "require_vars E2E_NEW_USER_PASSWORD E2E_ORGANIZATION_ID"
      ],
      "triggers": [
        "ci"
      ],
      "evidence": [
        {
          "path": ".github/workflows/ui-e2e-tests-v2.yml",
          "locator": "jobs.e2e-tests.steps[3] (Validate E2E prerequisites)"
        }
      ],
      "upstream": null,
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": null,
      "method": "unclassified",
      "commands": [
        "service_paths =  .join(sorted(ftests/providers/aws/services/{svc} for svc in services))"
      ],
      "triggers": [
        "ci"
      ],
      "evidence": [
        {
          "path": ".github/workflows/sdk-tests.yml",
          "locator": "jobs.sdk-tests.steps[5] (Resolve AWS services under test)"
        }
      ],
      "upstream": null,
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": null,
      "method": "unclassified",
      "commands": [
        "skills"
      ],
      "triggers": [
        "local"
      ],
      "evidence": [
        {
          "path": "Makefile",
          "locator": "target format-sdk (line 57)"
        },
        {
          "path": "Makefile",
          "locator": "target lint-sdk (line 60)"
        }
      ],
      "upstream": null,
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": null,
      "method": "unclassified",
      "commands": [
        "skipping AWS tests.\""
      ],
      "triggers": [
        "ci"
      ],
      "evidence": [
        {
          "path": ".github/workflows/sdk-tests.yml",
          "locator": "jobs.sdk-tests.steps[6] (Run AWS tests)"
        }
      ],
      "upstream": null,
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": null,
      "method": "unclassified",
      "commands": [
        "suite_selected scans"
      ],
      "triggers": [
        "ci"
      ],
      "evidence": [
        {
          "path": ".github/workflows/ui-e2e-tests-v2.yml",
          "locator": "jobs.e2e-tests.steps[3] (Validate E2E prerequisites)"
        }
      ],
      "upstream": null,
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": null,
      "method": "unclassified",
      "commands": [
        "test_files = defaultdict(list)"
      ],
      "triggers": [
        "ci"
      ],
      "evidence": [
        {
          "path": ".github/workflows/sdk-check-duplicate-test-names.yml",
          "locator": "jobs.check-duplicate-test-names.steps[2] (Check for duplicate test names across providers)"
        }
      ],
      "upstream": null,
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": null,
      "method": "unclassified",
      "commands": [
        "tests_dir = Path(tests/providers)"
      ],
      "triggers": [
        "ci"
      ],
      "evidence": [
        {
          "path": ".github/workflows/sdk-check-duplicate-test-names.yml",
          "locator": "jobs.check-duplicate-test-names.steps[2] (Check for duplicate test names across providers)"
        }
      ],
      "upstream": null,
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": null,
      "method": "unclassified",
      "commands": [
        "twine check --strict dist/*"
      ],
      "triggers": [
        "ci"
      ],
      "evidence": [
        {
          "path": ".github/workflows/sdk-package-checks.yml",
          "locator": "jobs.install-from-wheel.steps[5] (Check metadata with the release workflow's twine)"
        }
      ],
      "upstream": null,
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": null,
      "method": "unclassified",
      "commands": [
        "ui"
      ],
      "triggers": [
        "local"
      ],
      "evidence": [
        {
          "path": "Makefile",
          "locator": "target format-sdk (line 57)"
        },
        {
          "path": "Makefile",
          "locator": "target lint-sdk (line 60)"
        }
      ],
      "upstream": null,
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    },
    {
      "tool": null,
      "method": "unclassified",
      "commands": [
        "vulture --exclude contrib,tests,conftest.py,.venv --min-confidence 100 ."
      ],
      "triggers": [
        "ci"
      ],
      "evidence": [
        {
          "path": ".github/workflows/api-security.yml",
          "locator": "jobs.api-security-scans.steps[6] (Vulture)"
        }
      ],
      "upstream": null,
      "docs": null,
      "exit_codes": {},
      "autofix": false,
      "declared_only": false
    }
  ]
}