[attiasas]

Jira: XRAY-164011

What changed

• A nested secrets, IaC, SAST, or services scan is skipped when an outer target already walks that directory.
• The outer scan still reports the files inside the nested directory.
• Applicability still runs on every target.
• Two scans of the same directory both still run.

Heads-up

• A file that was reported from both the root and a nested target is now reported once, from the outer scan, so an existing fingerprint can change once after upgrade.
• Two package managers at the same directory can still report the same file twice. That stays a follow-up.

Made with Cursor

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on base/target branches other than the default branch.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

Run configuration

• Source mode: Auto
• Repository: Unavailable
• Branch: Unavailable
• File: No configuration file from this repository applied
• Commit: Unavailable
• Layers: Organization UI; Enforced overrides: Organization, Workspace
• Review profile: CHILL
• Plan: Enterprise
• Run ID: 2111df12-55e6-415e-8f31-9de798395dfc

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• Trigger review

CodeRabbit Verify

• Run CodeRabbit Verify to test the changes in this pull request.

[attiasas]

What this change does

When a repository is split into a root target and a nested target, the inner secrets, IaC, SAST, and services scans are skipped when an outer target will run that scan, one of that scan's real roots contains the inner directory, and the outer scan does not already exclude that path. The outer scan keeps walking those files, so each file is reported once. Applicability still runs on every target, because it uses that target's own vulnerabilities.

Coverage uses the directories the scanner actually walks. A SAST working directory of src does not skip a nested project outside it. A parent exclude of the nested path, including a default exclude such as node_modules, leaves the inner scan in place. A repository whose own name matches an exclude still covers its children.

Later

• Two technologies at the same directory, such as npm and pip, still both scan. Skipping one of them needs a stable owner, because diff comparison looks results up by path and technology. It also must not skip when file excludes, SAST excluded rules, or secret validation differ, because one scan cannot stand in for the other.
• Source-scan fingerprints are computed in Analyzer Manager, not in this repository. After this change the surviving fingerprint is the outer scan's. Findings already tracked under the nested relative path can look new once.
• PR 934 (XRAY-163145) stops a project from being excluded because its own name matches an exclude. This change uses the existing path check and does not depend on that PR.