Scan a repository

Configure SAST, SCA, or both to scan source code from a GitHub, GitLab, Bitbucket Cloud, or Azure DevOps repository. Each technology runs as a separate scan.

Ensure that you have read access to the repository. To scan a private GitHub repository, see Scanning private GitHub repositories. For providers that use an AppScan Presence, configure the Presence before starting the scan. See Scan a repository using an AppScan Presence.

AppScan on Cloud supports one repository per scan. When triaging findings, you can view the relevant source code in the repository and filter findings by filename or path.

  1. Open the application, select Create scan, and then select Scan a repository under Scan from source control.
  2. In Repository setup, select the source control provider: GitHub, GitLab, Bitbucket, or Azure DevOps. For GitHub, select GitHub.com or GitHub Enterprise.
  3. Connect to the provider:
    • For GitHub.com, select Connect and complete authorization in the browser window.
    • For other providers, including GitHub Enterprise, select an enabled AppScan Presence for that provider, select Authorize Presence, and complete authorization.

    If no Presence is available, configure one for the provider before continuing. If the connection fails, check access to the repository and try authorization again.

  4. In the Repository section, select Repository list to choose a repository, or Repository URL to enter its full URL. Then select the Branch to scan.

    If a repository is not listed, verify that the connected account or app has read access to it. For GitLab token permissions, see Setting up an AppScan Presence to scan a GitLab repository.

  5. Under Scan technology, select SAST, SCA, or both, according to your subscription. If your subscription provides only one technology, that technology is shown without a choice.

    When both are selected, SAST and SCA run as separate scans of the same repository and branch.

  6. In Schedule, select one of the following:
    • Scan now: Run the scan after selecting Scan. If the concurrent scan limit is reached, the scan is queued until it can run.
    • Save for later: Save the configuration on the Scans and sessions page with the status Configuration saved. Saved configurations cannot be edited.
    • Schedule: Set the start date and time. For recurring scans, set the frequency and when rescans should stop.
  7. In Scan options, enter the scan name and review the preferences. If both technologies are selected, enter a name for each scan.
    • Choose whether to run a personal scan. Its issues are not added to the application's issues.
    • Review your email notification settings.
    • Choose whether to allow intervention by the scan enablement team.
  8. In Summary, review the repository, branch, scan names, and options. Go back to the relevant step to make changes.
  9. Select Scan.