Monitored branches and incremental scans

Two Scanning Modes on the Static Analysis page re-analyse only what changed: Monitor Changes watches a branch and scans each change as it lands, and Incremental Scan scans the changes since the last scan once, when you ask. Both keep the cost of a re-scan proportional to the change rather than to the size of the codebase.

Daily, Weekly and Monthly schedules, and managing every schedule and monitor, are covered in Schedule the scan.

Before you start

Watch a branch

1. 01
   Open Static Code Analysis and the Git Repository tab

   Enter one repository in Repositories, and the branch in Branch Name (empty means the default branch).

2. 02
   Set Scanning Mode to Monitor Changes

   Under Watch the repository.

3. 03
   Choose the Product Assignment and the scanners
4. 04
   Click Start Analysis

   The branch is scanned now, then checked every hour.

Check it worked: the first scan opens its scan page, and the monitor is listed on the Schedules page. If the form says Schedules and repository watches clone with the team SSH key, and none is set, a team admin or operator sets the team key first.

zoom_inEnlarge

What a monitored run scans

• Every hour the branch is checked for new commits. If nothing changed, no scan is started.
• If the branch moved, only the added, modified or renamed files are analysed by AI Native SAST, Quick, Full, Custom Rules and IaCS Analysis.
• Secrets Detection, Dependency Check and the native language engine still scan the whole checkout. With All supported languages, no native language engine runs.
• When the change cannot be worked out (the earlier commit is gone, the history was rewritten, or the change only deletes files) the run scans everything.

Scan only what changed, once

1. 01
   Open Static Code Analysis and the Git Repository tab

   Enter one or more repositories.

2. 02
   Set Scanning Mode to Incremental Scan

   Under Run now.

3. 03
   Keep the product, Main Language and scanners of the scan you compare with

   See below.

4. 04
   Click Start Analysis

Check it worked: the scan page opens, or, when there are no new commits, the form says Nothing to scan and no scan is started. The first Incremental Scan of a branch scans everything.

What the change is measured against

An Incremental Scan or a new monitor compares the branch with the last successful Full scan or scheduled scan of the same repository, branch, product, Main Language and scanner settings. If there is none, it scans everything. Setting up monitoring on a repository you have already scanned therefore does not re-scan the whole tree. Custom Scope, Verify Fixes and archive scans never serve as the comparison point.

Managing monitors

Every monitor is listed on the Schedules page, where you run it now, pause, resume, rename or delete it; see Schedule the scan. To change what a monitor scans, choose it in Saved Scans on the Static Analysis page, change the form and click Start Analysis.