How scans are triggered

Use this article when you need to understand why a scan ran, why a scan did not run after a repository event, or how to start another scan.

Scan triggers

• Repository onboarded: Cysmiq runs a full scan.
• Push to branch: Cysmiq runs an incremental or branch scan.
• Push to tag: Cysmiq runs a tag scan.
• Repository reset: Cysmiq runs a full scan.
• Manual branch scan: select Scan branch for an unscanned current branch head.
• Failed scan retry: select Rescan to retry an eligible failed scan for the current ref head.

Pull request and merge request edits

• Metadata-only edits do not start a new assessment when the compared source and target commits are unchanged.
• Changes to the compared commits continue to trigger the applicable scan and assessment workflow.
• A push that adds a new commit remains a scan trigger even when the pull request or merge request already exists.

Start or retry a scan

• Open a repository's Branches tab and use the row action menu to scan an unscanned branch or retry an eligible failed scan.
• Open the Scans view and select Rescan from an eligible failed scan's action menu.
• Cysmiq only shows these actions when the repository, ref, and existing scans are eligible for another scan.
• Archived repositories stay disabled, and scanning remains unavailable until Cysmiq confirms that the repository is active.

Scan types

• Full scan: analyzes the entire repository and commonly runs during onboarding or after a reset.
• Incremental scan: analyzes changes since the last scan.
• Branch scan: analyzes a specific branch ref.
• Tag scan: analyzes a specific tag ref.

Choose which analyses run

Availability depends on your Cysmiq plan.

• Open the repository's Settings tab and use Scan jobs to control SCA, Provider checks, Context assessments, Secret History, code analysis, and call-chain analysis.
• Call chains requires Code analysis. It can run on all branches or only selected branch names and patterns.
• Use Reset overrides to return the repository to its inherited scan-job settings.
• For monorepos, Cysmiq automatically disables code analysis, call chains, and Secret History.

What scans detect

• Secrets: leaked credentials, API keys, and tokens.
• Code vulnerabilities: security issues in source code.
• Dependencies: vulnerable packages in dependency manifests.

Canonical docs

For the maintained reference, see Scans, Repository scan jobs, Repository branch scan actions, and Scan drill-down actions.

Contact support if

• A repository event should have triggered a scan but no scan appears.
• A metadata-only pull request or merge request edit starts repeated assessments even though the compared commits are unchanged.
• You expect Scan branch or Rescan to be available after confirming the repository and ref are current.
• An active repository remains unavailable for scanning after its archive status has synchronized from the VCS provider.
• An expected analysis is missing after checking the repository's scan-job settings and monorepo behavior.
• The scan type does not match the repository event you expected.