Manages changelog entries for Prowler components following keepachangelog.com format. Trigger: When creating PRs, adding changelog entries, or working with any CHANGELOG.md file in ui/, api/, mcp_server/, or prowler/.
npxskills add prowler-cloud/prowler--skill prowler-changelogLoading…
A PR never edits unreleased CHANGELOG.md content directly; use fragments instead. Released-block typo/correction fixes are the only direct-edit exception and are described below. For regular entries, add one small fragment file per entry under the component's changelog.d/ directory. Fragments are compiled into the component's CHANGELOG.md at release time (deleting the consumed fragments), so concurrent PRs never conflict on the changelog.
| Component | Fragments directory | Compiled file |
|---|---|---|
| UI | ui/changelog.d/ | ui/CHANGELOG.md |
| API | api/changelog.d/ |
api/CHANGELOG.md| MCP Server | mcp_server/changelog.d/ | mcp_server/CHANGELOG.md |
| SDK | prowler/changelog.d/ | prowler/CHANGELOG.md |
"What's unreleased" = "what's in changelog.d/". The compiled CHANGELOG.md files contain only released versions.
<slug>.<type>.md
<slug> is free-form ([A-Za-z0-9][A-Za-z0-9._-]*), chosen by the author, ideally descriptive of the change (e.g. securityhub-delegated-admin). The PR number is also a valid slug (e.g. 11259) when it is already known; it is never required.<type> maps 1:1 to the keepachangelog sections:<type> | Section | Usage |
|---|---|---|
added | ### 🚀 Added | New features, checks, endpoints |
changed | ### 🔄 Changed | Modifications to existing functionality |
deprecated | ### ⚠️ Deprecated | Features marked for removal |
removed | ### ❌ Removed | Deleted features |
fixed | ### 🐞 Fixed | Bug fixes |
security | ### 🔐 Security | Security patches, CVE fixes |
kms-rotation-check.added.md + kms-metadata-cache.changed.md + kms-disabled-keys.fixed.md, and all compile with the same PR link into their own sections.kms-rotation-check.added.md, kms-rotation-docs.added.md).The file contains ONLY the entry text, exactly as it should appear in the changelog, on a single line ending with a trailing newline:
echo '`securityhub_delegated_admin_enabled_all_regions` check for AWS provider, verifying that Security Hub has a delegated administrator, is active in all opted-in regions, and has organization auto-enable on' > prowler/changelog.d/securityhub-delegated-admin.added.md
Rules (same prose conventions as always):
[(#NNNN)](...) in a fragment produces a duplicated link.# ui/changelog.d/provider-search-bar.added.md
Search bar when adding a provider
# api/changelog.d/scan-dispatch-race.fixed.md
`POST /api/v1/scans` no longer intermittently fails with `Scan matching query does not exist`; scan dispatch now publishes the `scan-perform` Celery task after the transaction commits
# ui/changelog.d/node-24-bump.security.md
Node.js from 20.x to 24.13.0 LTS, patching 8 CVEs
Fixed bug. # Too vague, has period, redundant verb
Add search bar # Redundant verb (the section already says "Added")
Search bar [(#9634)](https://github.com/prowler-cloud/prowler/pull/9634) # NEVER include the PR link; it is added at compile time
Prowler follows semver.org:
| Change Type | Version Bump | Example |
|---|---|---|
| Bug fixes, patches | PATCH (x.y.Z) | 1.16.1 → 1.16.2 |
| New features (backwards compatible) | MINOR (x.Y.0) | 1.16.2 → 1.17.0 |
| Breaking changes, removals | MAJOR (X.0.0) | 1.17.0 → 2.0.0 |
CRITICAL: removed fragments MUST only ship in MAJOR version releases. Removing features is a breaking change.
Before creating or editing any changelog fragment or CHANGELOG.md file, the agent MUST stop and get explicit user confirmation. This applies even when the changelog gate is failing, the required file seems obvious, or the user asked to "fix the changelog".
Present the proposed action before writing:
Only proceed after an explicit approval such as "confirm", "approved", "sí", or equivalent. If the user rejects or does not answer, do not create or edit anything. Offer alternatives such as adding no-changelog when appropriate.
git diff master...HEAD --name-only | grep -E '^(ui|api|mcp_server|prowler)/' | cut -d/ -f1 | sort -u
| Path Pattern | Component |
|---|---|
ui/** | UI |
api/** | API |
mcp_server/** | MCP Server |
prowler/** | SDK |
Root uv.lock / pyproject.toml | SDK (the gate requires a prowler/changelog.d/ fragment) |
| Multiple | One fragment per affected component |
echo 'Entry text describing the change' > <component>/changelog.d/<slug>.<type>.md
ls prowler/changelog.d/ api/changelog.d/ ui/changelog.d/ mcp_server/changelog.d/
The pr-check-changelog.yml workflow enforces fragments:
ui/, api/, mcp_server/, or prowler/ MUST add (or fix) a fragment under the corresponding changelog.d/<slug>.<type>.md with a valid type[(#N)](...)); the gate fails if one is found because the link is attached automatically at compile timeno-changelog label to bypass (use sparingly for docs-only, CI-only changes)compile-changelogs workflow (manual dispatch: prowler_version + target_branch; per-component versions are auto-derived by mirroring the Prowler version — SDK mirrors it directly, UI is 1.<minor>.<patch>, API is 1.<minor + 1>.<patch>, and only the MCP Server derives from its pending fragment types — with optional explicit overrides or skip) resolves each fragment's PR from git history, runs the compiler per component, and opens a chore(changelog): vX.Y.Z PR (labeled no-changelog and skip-sync) that inserts the stamped ## [X.Y.Z] (Prowler vX.Y.Z) block into each CHANGELOG.md and deletes the consumed fragments. A human reviews and squash-merges it. prepare-release.yml then extracts the stamped sections exactly as before.master and merge the compile PR BEFORE cutting the v5.X branch.v5.X with their fragment files (conflict-free); compile on v5.X and merge its PR there. The same workflow run automatically opens a second forward-sync PR against master (labeled no-changelog and skip-sync) that inserts the same stamped block under master's marker and deletes the consumed fragments, so the next minor cannot re-release them; merge it right after. Fragments that only existed on v5.X are skipped with a notice. No manual git is involved.Released version blocks in CHANGELOG.md are otherwise immutable, but typo/correction fixes to already-released entries are the one case where a PR edits CHANGELOG.md directly: make the edit and add the no-changelog label.
If a PR's entry shipped in the wrong released block (e.g. the PR merged after its release was cut), move the entry back to a fragment: delete it from the released block and recreate it as <component>/changelog.d/<PR>.<type>.md (label the PR no-changelog since it edits CHANGELOG.md).
The compiler renders, per release, into each CHANGELOG.md right under the <!-- changelog: release notes start --> marker (never remove that marker):
## [X.Y.Z] (Prowler vA.B.C)
### 🚀 Added
- Entry text [(#NNNN)](https://github.com/prowler-cloud/prowler/pull/NNNN)
### 🐞 Fixed
- Fix entry [(#NNNN)](https://github.com/prowler-cloud/prowler/pull/NNNN)
---
Section order is always: Added → Changed → Deprecated → Removed → Fixed → Security. X.Y.Z is the COMPONENT version; A.B.C is the Prowler release version. Every entry ends with its PR link; linking to /issues/N is forbidden (the issue↔PR mapping belongs in the PR body via Fixes #N).
Create or update AgentSkills. Use when designing, structuring, or packaging skills with scripts, references, and assets.
Create or update AgentSkills. Use when designing, structuring, or packaging skills with scripts, references, and assets.
Set up and use 1Password CLI (op). Use when installing the CLI, enabling desktop app integration, signing in (single or multi-account), or reading/injecting/running secrets via op.
CLI to manage emails via IMAP/SMTP. Use `himalaya` to list, read, write, reply, forward, search, and organize emails from the terminal. Supports multiple accounts and message composition with MML (MIME Meta Language).
Create or update AgentSkills. Use when designing, structuring, or packaging skills with scripts, references, and assets.
Create or update AgentSkills. Use when designing, structuring, or packaging skills with scripts, references, and assets.
Set up and use 1Password CLI (op). Use when installing the CLI, enabling desktop app integration, signing in (single or multi-account), or reading/injecting/running secrets via op.
CLI to manage emails via IMAP/SMTP. Use `himalaya` to list, read, write, reply, forward, search, and organize emails from the terminal. Supports multiple accounts and message composition with MML (MIME Meta Language).