Skip to content
Snippets Groups Projects

Adding Incremental Scanning to our common library to tackle the standalone use-case for our analyzers

    • Closed Issue created by Julian Thome @julianthome

    This idea has already been discussed in the past in various issues including Support incremental scans for SAST.

    At the moment all the scanners as well as the back-end code is based on the assumption that we run complete scans (considering all relevant files in the repository). However, to narrow the focus, we can differentiate between (1) the general/integrated setup where vulnerabilities are managed by means of the Vulnerability Report and (2) cases where our scanners are used standalone. An example for a standalone use-case can be found here.

    Proposal

    Enhance our common library with two features that are disabled by default and that can be enabled by means of env variables.

    1. Git Pre-filter: filter the files that are impacted (source branch<>target branch) and run the analysis exclusively on the impacted files.
    2. Git Post-filter: generate two reports, the standard report that contains all findings, and a second report that only contains only the findings that are impacted in the context of an MR. The original report could then be forwarded to the backend and the filtered one could be used to inform other tools we run in the context of an MR.

    The advantage of tackling this problem on the analyzers first is that we can already use it for standalone use-cases like the one mentioned above and we make a first move towards integrating incremental analysis as a general feature to tackling the first general/integrated use-case.

    Edited by Mark Art

    Designs

      Child items 0

      2. No child items are currently assigned. Use child items to break down this issue into smaller parts.

      Activity

      Please register or sign in to reply