/prowler-registry-artifact

name: prowler-registry-artifact
description: >
  Packages Prowler checks, compliance frameworks (legacy and universal) and providers as external
  plug-in Python wheels discovered through entry points, and publishes them on the Prowler Registry.
  Trigger: When creating a pyproject.toml with prowler.checks.*, prowler.providers, prowler.compliance or
  prowler.compliance.universal entry points, building or testing a plug-in wheel, or uploading/installing
  artifacts with registry.prowler.com.
license: Apache-2.0
metadata:
  author: prowler-cloud
  version: "1.0"
  scope: [root, sdk]
  auto_invoke:
    - "Packaging checks, compliance frameworks or providers as external packages"
    - "Publishing artifacts to Prowler Registry"
allowed-tools: Read, Edit, Write, Glob, Grep, Bash, WebFetch, WebSearch, Task

When to Use

• Shipping checks, compliance JSON or a whole provider OUTSIDE the Prowler repo, installable with `pip`/`uv`
• Publishing those wheels (public or private) on the Prowler Registry
• Debugging "my plug-in check/framework/provider does not show up"

Writing the check, provider or framework itself: use `prowler-sdk-check`, `prowler-provider`, `prowler-compliance`. This skill covers only packaging, discovery and publishing.

---

Entry-Point Groups (source of truth: the loaders)

| Group | Entry-point name | Entry-point value | Loader | |---|---|---|---| | `prowler.checks.{provider}` | CheckID | Check module path `{pkg}.services.{service}.{check_id}.{check_id}` | `prowler/lib/check/utils.py` (`_recover_ep_checks`), `prowler/lib/check/check.py` (`_resolve_check_module`) | | `prowler.providers` | Provider name used on the CLI | `module:Class` of a `Provider` subclass (`ep.load()`) | `prowler/providers/common/provider.py`, `prowler/lib/check/tool_wrapper.py` | | `prowler.compliance` | Provider the JSON files belong to (`aws`, `azure`, ...) | Package whose directory holds the JSON files | `prowler/config/config.py` (`_get_ep_compliance_dirs`), `prowler/lib/check/compliance_models.py` | | `prowler.compliance.universal` | Free-form (only the value is used) | Package whose directory holds universal JSON files | `prowler/lib/check/compliance_models.py` (`get_universal_compliance_entry_point_dirs`) |

---

Critical Rules

| Rule | Why (code) | |---|---| | Check value MUST contain `.services.{service}.` | `_recover_ep_checks` skips entry points without it when `--services` is used | | Class name == CheckID == module file name | Execution does `getattr(lib, check_name)` | | CheckID prefix (before first `_`) == service | `service = check_name.split("_")[0]` in `check.py` | | `{check_id}.metadata.json` ships in the wheel next to the module | `CheckMetadata.get_bulk()` reads `{check_path}/{check_name}.metadata.json` | | Keep package `__init__.py` files empty | Discovery uses `find_spec` (no import) to avoid initializing service clients | | IDs must be unique vs built-ins | Built-in ALWAYS wins: check metadata, provider name and framework name collisions are ignored (checks/providers log "is being IGNORED") | | Compliance framework key = JSON file name without `.json` | `framework_version_provider` naming, e.g. `acme_baseline_1.0_aws.json` | | External legacy compliance JSON that fails to parse is skipped with a warning | Loaded with `fatal=False`; always confirm with `--list-compliance` | | Universal JSON is offered to every provider present in a requirement's `checks` keys | `supports_provider()` | | Quote dotted group names in TOML | `[project.entry-points."prowler.checks.aws"]` | | Require `prowler>=5.37.1` for checks on built-in providers | Before 5.37.1 (#12312) such checks were listed but silently produced no findings |

Provider Plug-in Contract

Subclass `prowler.providers.common.provider.Provider`. Minimal working example: `FakeExternalProvider` in `tests/providers/external/test_dynamic_provider_loading.py`.

| Member | Purpose | |---|---| | `init_parser(cls, parser)` classmethod | Adds the `prowler {provider}` subcommand | | `from_cli_args(cls, arguments, fixer_config)` | Builds the provider for any non-built-in name | | `_cli_help_text` | Text in `prowler --help` | | `sdk_only` (default `True`) | Set `False` so the API/UI list it (`get_app_providers()`) | | `get_scan_arguments`, `get_connection_arguments`, `get_credentials_schema` | Build/validate from stored uid + secret dict | | `is_external_tool_provider` (default `False`) | `True` for tool wrappers: check loading is bypassed |

---

Package Layouts

Templates with full `pyproject.toml`: [assets/](assets/). Hatchling (Prowler's own backend) includes every file under the listed package, so the JSON files are packaged automatically.

# Checks-only (assets/pyproject-checks.toml)
src/{pkg}/__init__.py
src/{pkg}/services/__init__.py
src/{pkg}/services/{service}/__init__.py
src/{pkg}/services/{service}/{check_id}/__init__.py
src/{pkg}/services/{service}/{check_id}/{check_id}.py
src/{pkg}/services/{service}/{check_id}/{check_id}.metadata.json

# Compliance (assets/pyproject-compliance.toml)
src/{pkg}/{provider}/__init__.py + {framework}_{version}_{provider}.json
src/{pkg}/universal/__init__.py  + {framework}_{version}.json

# Provider (assets/pyproject-provider.toml)
src/{pkg}/provider.py            # class {Name}Provider(Provider)
src/{pkg}/services/{service}/{service}_service.py, {service}_client.py, {check_id}/...
src/{pkg}/compliance/__init__.py + {framework}_{version}_{provider}.json

Minimal entry points:

[project.optional-dependencies]
runtime = ["prowler>=5.48.0"]   # Registry installs use "<package-name>[runtime]"

[project.entry-points."prowler.checks.aws"]
s3_bucket_owner_tag_present = "acme_prowler_checks.services.s3.s3_bucket_owner_tag_present.s3_bucket_owner_tag_present"

[project.entry-points."prowler.providers"]
acme = "prowler_acme.provider:AcmeProvider"

[project.entry-points."prowler.compliance"]
aws = "acme_prowler_compliance.aws"

[project.entry-points."prowler.compliance.u