prowler-ci
prowler-ci guides you through Prowler's CI and PR gate system, helping diagnose why GitHub Actions workflows fail. It covers PR title validation, changelog requirements, conflict marker detection, and secret scanning—with a quick reference map to key workflow files and a practical debug checklist.
prowler-ci helps you debug and resolve failing GitHub Actions CI checks, including PR title validation, changelog gates, and secret scanning.
AI-generated summary based on this skill's SKILL.md
Install
prowler-cloud/prowler/prowler-ci · repository language: Python
git clone https://github.com/prowler-cloud/prowler
cp -r prowler/skills/prowler-ci ~/.claude/skills/prowler-cinpx skillfed install prowler-cloud/prowler/prowler-ciFrequently asked questions
AI-generated answers based on this skill's SKILL.md and metadata
Why is my PR check failing in prowler-ci?
prowler-ci helps you diagnose GitHub Actions workflow failures on pull requests. Common causes include: PR title not following conventional commit format, missing changelog fragment, unresolved conflict markers in code, or TruffleHog detecting secrets. Use the debug checklist to verify each gate: check your commit message format, confirm changelog files are in `.changelog/` with proper naming, scan for `<<<<<<<` markers, and review TruffleHog logs for false positives that may need allowlisting.
How do I fix TruffleHog secret scanning false positives?
prowler-ci integrates TruffleHog for secret detection in workflows. False positives often occur with test AWS keys or API key examples. Review the TruffleHog job output to identify the flagged content and file. If it's a legitimate test value or placeholder, you can add an allowlist entry in your repository's TruffleHog configuration to exclude that pattern. For OpenAI API keys in test files, verify the key is non-production before allowlisting.
What are the PR validation rules and gates in prowler-ci?
prowler-ci enforces multiple PR gates: (1) Conventional Commit validation on PR titles, (2) Changelog requirement—add a fragment to `.changelog/` unless labeled `no-changelog`, (3) Conflict marker detection to catch unresolved merges, (4) TruffleHog secret scanning, and (5) CODEOWNERS and labeler automation. Each gate must pass before merge. The system also validates path filtering in GitHub Actions workflows to ensure jobs run only when relevant files change.
How do I resolve conflict markers in my PR?
prowler-ci detects unresolved conflict markers (`<<<<<<<`, `=======`, `>>>>>>>`) that Git leaves when merges fail. To fix: open the flagged files, locate the conflict sections, manually choose which code to keep or merge both versions, then remove all marker lines. After resolving, stage and commit the changes. Re-push to trigger CI again. The conflict marker gate will pass once all markers are removed from the repository.
Where should I place changelog fragments in prowler-ci?
prowler-ci requires changelog fragments in the `.changelog/` directory at your repository root. Name files using the pattern `<PR-number>.<type>.md` (e.g., `123.feature.md`). Each fragment should contain a brief description of your change. If your PR has no user-facing changes, apply the `no-changelog` label to skip this gate. The changelog gate validates both file location and naming convention before allowing merge.
How does CODEOWNERS and labeler automation work in prowler-ci?
prowler-ci automates PR labeling and code owner assignment through GitHub Actions workflows. The labeler workflow applies labels based on file paths modified in your PR, while CODEOWNERS automation ensures relevant maintainers are notified. These automations run on PR open and update events. Review your repository's `.github/CODEOWNERS` file to see ownership rules and `.github/labeler.yml` to understand label-to-path mappings that trigger automatic labeling.
SKILL.md
rendered from the published skill — quoted content, verbatim
What this skill covers
Use this skill whenever you are:
- Reading or changing GitHub Actions workflows under
.github/workflows/ - Explaining why a PR fails checks (title, changelog, conflict markers, secret scanning)
- Figuring out which workflows run for UI/API/SDK changes and why
- Diagnosing path-filtering behavior (why a workflow did/didn't run)
Quick map (where to look)
- PR template:
(truncated - see the full file via the links below)
Read as markdown · JSON record · Browse the source repository
File tree — 1 file
skills/prowler-ci/SKILL.md