Running a scan

cf scan queues a scan of the resolved repository and, by default, follows it until it settles.

Basic usage

cf scan

--progress is for a caller that wants to show something happening during a long scan. It reports the status, the stage, how many files have been taken in, and the finding count so far, and because it is on stderr it never gets in the way of a piped or JSON stdout.

--wait is the one to use in a script: it returns only once the scan reached a terminal state, and exits 4 if the scan failed. --no-watch is the one to use when you only want the scan queued.

Watching progress

$cf scanScanning   acme/api  queued  running  completed        27 findings  3 critical  8 high  12 watch  4 infocf reproduced --repo acme/api

Which branch gets scanned

The repository's default branch, as the provider has it, unless you pass --branch. To scan work in progress, push it to a branch first: Cefense analyses what has been committed, not your working tree.

cf branches
cf scan --branch release/2.4 --wait
cf reproduced --branch release/2.4

Scans you did not start

A repository can also scan on every push to its default branch, or on a schedule. That is a per repository setting, changed with cf settings, and both of them are plan entitlements: Free scans only when you ask. See Scan settings and Scan triggers.

Branches and history

cf branches
cf commits
cf commits --limit 50

cf branches lists every branch and the last scan of each. cf commits lists the scanned commit history, newest first, with what each commit introduced, resolved, and suppressed, and takes --branch <name> to read a branch other than the default. Take a branch name from one and a scan id from the other, then pass it to cf scan --branch or cf reproduced --scan. See Branches and commits.