Static analysis
11 tools
| Tool | Kind | Command | Runs in | Found in |
|---|---|---|---|---|
actionlint |
CI workflow linting | pre-commit hook actionlint |
pre-commit | .pre-commit-config.yaml |
bandit |
Security scanning | bandit -q -lll -x *_test.py,./contrib/,./.venv/ -r .bandit -q -lll -x *_test.py,./.venv/,./contrib/,./api/,./ui -r .bandit -q -lll |
pre-commit, ci | .github/workflows/api-security.yml .github/workflows/sdk-security.yml .pre-commit-config.yaml api/pyproject.toml |
codeql |
Security scanning | uses github/codeql-action/analyze |
ci | .github/workflows/api-codeql.yml .github/workflows/sdk-codeql.yml .github/workflows/ui-codeql.yml |
eslint |
Linting | eslint . --max-warnings 40eslint . --fix --max-warnings 40 |
local | ui/package.json ui/eslint.config.ts |
flake8 |
Linting | flake8 . --ignore=E266,W503,E203,E501,W605,E128 --exclude .venv,contrib,ui,ap...pre-commit hook flake8 |
pre-commit, ci, local | .github/workflows/sdk-code-quality.yml .pre-commit-config.yaml Makefile pyproject.toml |
pylint |
Linting | pylint --disable=W,C,R,E -j 0 -rn -sn src/pylint --disable=W,C,R,E -j 0 -rn -sn prowler/pylint --disable=W,C,R,E -j 0 -rn -sn |
pre-commit, ci, local | .github/workflows/api-code-quality.yml .github/workflows/sdk-code-quality.yml .pre-commit-config.yaml Makefile |
ruff-check |
Linting | ruff check . --exclude contribruff check --fixruff check . --exclude contrib --fix |
pre-commit, ci, local | .github/workflows/api-code-quality.yml .pre-commit-config.yaml Makefile api/pyproject.toml |
shellcheck |
Linting | pre-commit hook shellcheck |
pre-commit | .pre-commit-config.yaml |
tsc |
Type checking | tsc |
local | ui/package.json |
zizmor |
CI workflow linting | uses zizmorcore/zizmor-actionpre-commit hook zizmor |
pre-commit, ci | .github/workflows/ci-zizmor.yml .pre-commit-config.yaml |
mypyconfigured, not run |
Type checking | api/pyproject.toml |
Testing
4 tools
| Tool | Kind | Command | Runs in | Found in |
|---|---|---|---|---|
ci-matrix |
Version and platform matrix | api-code-quality (python-version: 1)api-analyze (language: 1)api-security-scans (python-version: 1) |
ci | .github/workflows/api-code-quality.yml .github/workflows/api-codeql.yml .github/workflows/api-security.yml .github/workflows/api-tests.yml |
playwright |
End-to-end browser tests | playwright test ${test_paths[@]}playwright test --project=auth --project=sign-up --project=providers --projec...playwright test --project=auth --project=sign-up --project=providers --projec... |
ci, local | .github/workflows/ui-e2e-tests-v2.yml ui/package.json ui/playwright.config.ts |
pytest |
Unit and integration tests | pytest --cov=./src/backend --cov-report=xml src/backendpytest --cov=./prowler_mcp_server --cov-report=xml testspytest tests/github |
ci, local | .github/workflows/api-tests.yml .github/workflows/mcp-tests.yml .github/workflows/pr-check-changelog.yml .github/workflows/sdk-tests.yml |
vitest |
Unit and integration tests | vitest related ${changed[@]} --run --project unitvitest runvitest run --coverage |
ci, local | .github/workflows/ui-tests.yml ui/package.json ui/vitest.config.ts |
Formatting and hygiene
5 tools
| Tool | Kind | Command | Runs in | Found in |
|---|---|---|---|---|
black |
Formatting | black --exclude "\.venvpre-commit hook black |
pre-commit, ci, local | .github/workflows/sdk-code-quality.yml .pre-commit-config.yaml Makefile pyproject.toml |
isort |
Formatting | pre-commit hook isort |
pre-commit | .pre-commit-config.yaml |
pre-commit-hooks |
File hygiene | pre-commit hook check-merge-conflictpre-commit hook check-yamlpre-commit hook check-json |
pre-commit | .pre-commit-config.yaml |
ruff-format |
Formatting | ruff format --check . --exclude contribruff formatruff format . --exclude contrib |
pre-commit, ci, local | .github/workflows/api-code-quality.yml .pre-commit-config.yaml Makefile |
prettierconfigured, not run |
Formatting | ui/package.json ui/.prettierrc.json |
Supply chain
1 tool
| Tool | Kind | Command | Runs in | Found in |
|---|---|---|---|---|
uv-lock |
Lockfile consistency | uv lock --checkpre-commit hook uv-lock |
pre-commit, ci | .github/workflows/api-code-quality.yml .github/workflows/sdk-code-quality.yml .pre-commit-config.yaml |
49 other commands the scanner could not classify
Commands from CI steps and task runners that look like checks but match no known tool. Some are checks, some are not.
API TestsSDK TestsUI E2Eapibash ${RUNNER_TEMP}/gh-aw/actions/audit_pre_agent_workspace.shbash ${RUNNER_TEMP}/gh-aw/actions/validate_multi_secret.sh COPILOT_GITHUB_TOKEN GitHub Copilot CLI https://github.git...check prowler_version or pass the version input explicitly"coverage htmlcoverage report -mcoverage run --skip-covered -m pytest -vdef find_duplicate_test_names():done <<< $TEST_PATHSelif path_str.startswith(tests/providers/aws/services/):filename = test_file.namefor test_file in tests_dir.rglob(*_test.py):helm lint $EXPRknip --fix --max-issues 494knip --max-issues 494open htmlcov/index.htmlplaywright show-reportpre-commit hook autoflakepre-commit hook hadolintpre-commit hook markdownlintpre-commit hook no-commit-to-branchpre-commit hook pretty-format-jsonpre-commit hook pretty-format-tomlpre-commit hook renovate-config-validatorprowler_docs_get_documentpython .github/scripts/test-impact.py ${changed[@]}python docs/scripts/generate_provider_cards.pypython scripts/check_test_init_files.py .python util/check_yanked_pins.py . api mcp_serverquery-docsread -ra test_paths <<< $TEST_PATHSrelative_path = test_file.relative_to(tests_dir)require_vars E2E_ADMIN_USER E2E_ADMIN_PASSWORDrequire_vars E2E_AWS_PROVIDER_ACCOUNT_ID E2E_AWS_PROVIDER_ACCESS_KEY E2E_AWS_PROVIDER_SECRET_KEYrequire_vars E2E_AWS_PROVIDER_ACCOUNT_ID E2E_AWS_PROVIDER_ACCESS_KEY E2E_AWS_PROVIDER_SECRET_KEY E2E_AWS_PROVIDER_ROL...require_vars E2E_NEW_USER_PASSWORDrequire_vars E2E_NEW_USER_PASSWORD E2E_ORGANIZATION_ID
Review prompts
most discussed first