fix(sdk): absolute ENTRYPOINT to work with uv

[jfagoagas]

Context

Fix #11275

Timeline

• 2026-04-23 — PR feat(ci): add official Prowler GitHub Action #10872 (ffb1bb8) adds the GitHub Action with -w /home/prowler/workspace. At this point ENTRYPOINT is ["poetry", "run", "prowler"] — poetry resolves via PATH, not a relative file lookup.
• 2026-05-14 — PR chore(sdk): migrate from poetry to uv #11162 (7d3ed62) "chore(sdk): migrate from poetry to uv". Changes ENTRYPOINT to [".venv/bin/prowler"]. This is the regression. Relative path now resolved against the runtime workdir.
• First broken release: 5.27.0 (also affects 5.27.1).

Description

Container image now uses an absolute ENTRYPOINT (/home/prowler/.venv/bin/prowler) so it works under any runtime --workdir. The relative entrypoint was breaking the official GitHub Action (prowler-cloud/prowler@v5.27.0) and any docker run with a custom -w

Checklist

Community Checklist

• This feature/issue is listed in here or roadmap.prowler.com
• Is it assigned to me, if not, request it via the issue/feature in here or Prowler Community Slack

• Review if the code is being covered by tests.
• Review if code is being documented following this specification https://github.com/google/styleguide/blob/gh-pages/pyguide.md#38-comments-and-docstrings
• Review if backport is needed.
• Review if is needed to change the Readme.md
• Ensure new entries are added to CHANGELOG.md, if applicable.

SDK/CLI

• Are there new checks included in this PR? Yes / No
  • If so, do we need to update permissions for the provider? Please review this carefully.

UI

• All issue/task requirements work as expected on the UI
• If this PR adds or updates npm dependencies, include package-health evidence (maintenance, popularity, known vulnerabilities, license, release age) and explain why existing/native alternatives are insufficient.
• Screenshots/Video of the functionality flow (if applicable) - Mobile (X < 640px)
• Screenshots/Video of the functionality flow (if applicable) - Table (640px > X < 1024px)
• Screenshots/Video of the functionality flow (if applicable) - Desktop (X > 1024px)
• Ensure new entries are added to CHANGELOG.md, if applicable.

API

• All issue/task requirements work as expected on the API
• Endpoint response output (if applicable)
• EXPLAIN ANALYZE output for new/modified queries or indexes (if applicable)
• Performance test results (if applicable)
• Any other relevant evidence of the implementation (if applicable)
• Verify if API specs need to be regenerated.
• Check if version updates are required (e.g., specs, uv, etc.).
• Ensure new entries are added to CHANGELOG.md, if applicable.

License

By submitting this pull request, I confirm that my contribution is made under the terms of the Apache 2.0 license.

[github-actions]

✅ Conflict Markers Resolved

All conflict markers have been successfully resolved in this pull request.

[github-actions]

✅ All necessary CHANGELOG.md files have been updated.

[Copilot]

Pull request overview

Fixes a regression introduced by the Poetry→uv migration where the container ENTRYPOINT became a relative path and broke runs that override the container workdir (notably the official GitHub Action).

Changes:

• Switch Docker image ENTRYPOINT from relative .venv/bin/prowler to absolute /home/prowler/.venv/bin/prowler.
• Add a changelog entry describing the fix and the affected versions/action usage.

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated 1 comment.

File	Description
Dockerfile	Makes the container entrypoint absolute so it works regardless of runtime --workdir.
prowler/CHANGELOG.md	Documents the regression and the fix under the upcoming release.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[github-actions]

🔒 Container Security Scan

Image: prowler:75342b7
Last scan: 2026-05-21 14:22:59 UTC

📊 Vulnerability Summary

Severity	Count
🔴 Critical	6
Total	6

5 package(s) affected

⚠️ Action Required

Critical severity vulnerabilities detected. These should be addressed before merging:

• Review the detailed scan results
• Update affected packages to patched versions
• Consider using a different base image if updates are unavailable

---

📋 Resources:

• Download full report (see artifacts)
• View in Security tab
• Scanned with Trivy