How scans are triggered

Last updated: October 9, 2026

Use this article when you need to understand why a scan ran, why a scan did not run after a repository event, or how to start another scan.

Scan triggers

  • Repository onboarded: Cysmiq runs a full scan.

  • Push to branch: Cysmiq runs an incremental or branch scan.

  • Push to tag: Cysmiq runs a tag scan.

  • Repository reset: Cysmiq runs a full scan.

  • Manual branch scan: select Scan branch to scan the current branch head, including a head that has already been scanned.

  • Failed scan retry: select Rescan to retry an eligible failed scan for the current ref head.

Pull request and merge request edits

  • Metadata-only edits do not start a new assessment when the compared source and target commits are unchanged.

  • Changes to the compared commits continue to trigger the applicable scan and assessment workflow.

  • A push that adds a new commit remains a scan trigger even when the pull request or merge request already exists.

Start or retry a scan

  • Open a repository's Branches tab and use the row action menu to scan the current branch head or retry an eligible failed scan.

  • Open the Scans view and select Rescan from an eligible failed scan's action menu.

  • Cysmiq only shows these actions when the repository, ref, and existing scans are eligible for another scan.

  • Archived repositories stay disabled, and scanning remains unavailable until Cysmiq confirms that the repository is active.

Scan types

  • Full scan: analyzes the entire repository and commonly runs during onboarding or after a reset.

  • Incremental scan: analyzes changes since the last scan.

  • Branch scan: analyzes a specific branch ref.

  • Tag scan: analyzes a specific tag ref.

Choose which analyses run

Availability depends on your Cysmiq plan.

  • Open the repository's Settings tab and use Scan jobs to control SCA, Provider checks, Context assessments, Secret History, code analysis, and call-chain analysis.

  • Call chains requires Code analysis. It can run on all branches or only selected branch names and patterns.

  • Use Reset overrides to return the repository to its inherited scan-job settings.

  • For monorepos, Cysmiq automatically disables code analysis, call chains, and Secret History.

What scans detect

  • Secrets: leaked credentials, API keys, and tokens.

  • Code vulnerabilities: security issues in source code.

  • Dependencies: vulnerable packages in dependency manifests.

Canonical docs

For the maintained reference, see Scans, Repository scan jobs, Repository branch scan actions, and Scan drill-down actions.

Contact support if

  • A repository event should have triggered a scan but no scan appears.

  • A metadata-only pull request or merge request edit starts repeated assessments even though the compared commits are unchanged.

  • You expect Scan branch or Rescan to be available after confirming the repository and ref are current.

  • An active repository remains unavailable for scanning after its archive status has synchronized from the VCS provider.

  • An expected analysis is missing after checking the repository's scan-job settings and monorepo behavior.

  • The scan type does not match the repository event you expected.