OpenParable
Skip to content
← Back to skills

Prowler CI

DevOps & Security
prowler-ci

Prowler CI is an Agent Skill for devops & security published in the prowler-cloud/prowler repository on GitHub: a SKILL.md instruction file an AI agent can load to do this task.

Helps with Prowler repository CI and PR gates (GitHub Actions workflows). Trigger: When investigating CI checks failing on a PR, PR title validation, changelog gate/no-changelog label, conflict marker checks, secret scanning, CODEOWNERS/labeler automation, or anything under .github/workflows.

View on GitHub ↗
QUICK START

How to use this skill

Bring this guide into your coding agent with a prompt tailored to the tool you use.

  1. Open your project in Codex.
  2. Copy and paste the prompt below.
  3. Review files and risks before approving any action.
Prompt to paste
Inspect the Agent Skill at https://github.com/prowler-cloud/prowler/blob/HEAD/skills/prowler-ci/SKILL.md and all supporting files. Report provenance, permissions, scripts, dependencies, and security risks. Propose an exact installation into .agents/skills/prowler-ci, but wait for my approval before writing files or running scripts.

Copying this prompt does not install or run the skill. Review third-party files before use.

What this skill covers

Use this skill whenever you are:

  • Reading or changing GitHub Actions workflows under .github/workflows/
  • Explaining why a PR fails checks (title, changelog, conflict markers, secret scanning)
  • Figuring out which workflows run for UI/API/SDK changes and why
  • Diagnosing path-filtering behavior (why a workflow did/didn't run)

Quick map (where to look)

  • PR template: .github/pull_request_template.md
  • PR title validation: .github/workflows/conventional-commit.yml
  • Changelog gate: .github/workflows/pr-check-changelog.yml (requires a fragment under <component>/changelog.d/)
  • Changelog compile (release time): .github/workflows/compile-changelogs.yml
  • Conflict markers check: .github/workflows/pr-conflict-checker.yml
  • Secret scanning: .github/workflows/find-secrets.yml
  • Auto labels: .github/workflows/labeler.yml and .github/labeler.yml
  • Review ownership: .github/CODEOWNERS

Debug checklist (PR failing checks)

  1. Identify which workflow/job is failing (name + file under .github/workflows/).
  2. Check path filters: is the workflow supposed to run for your changed files?
  3. If it's a title check: verify PR title matches Conventional Commits.
  4. If it's changelog: verify a valid fragment exists under the right <component>/changelog.d/ OR apply no-changelog label.
  5. If it's conflict checker: remove <<<<<<<, =======, >>>>>>> markers.
  6. If it's secrets (TruffleHog): see section below.

TruffleHog Secret Scanning

TruffleHog scans for leaked secrets. Common false positives in test files:

Patterns that trigger TruffleHog:

  • sk-*T3BlbkFJ* - OpenAI API keys
  • AKIA[A-Z0-9]{16} - AWS Access Keys
  • ghp_* / gho_* - GitHub tokens
  • Base64-encoded strings that look like credentials

Fix for test files:

# BAD - looks like real OpenAI key
api_key = "sk-test1234567890T3BlbkFJtest1234567890"

# GOOD - obviously fake
api_key = "sk-fake-test-key-for-unit-testing-only"

If TruffleHog flags a real secret:

  1. Remove the secret from the code immediately
  2. Rotate the credential (it's now in git history)
  3. Consider using .trufflehog-ignore for known false positives (rarely needed)

Notes

  • Keep prowler-pr focused on creating PRs and filling the template.
  • Use prowler-ci for CI policies and gates that apply to PRs.