We've been running OpenClaw for SAST in our CI pipeline for about six months, and while the findings are valuable, the scan time has become a problem. Our pipeline duration increased by ~8 minutes, which is pushing our 15-minute merge target out of reach. I know we're not alone in this.
Our current setup is naive—we just run a full `openclaw scan --all` on every PR against the main branch. It's scanning the entire codebase each time, which feels wasteful. I'm looking for battle-tested patterns to integrate it intelligently. The goals are:
- Maintain security coverage.
- Drastically reduce scan time for typical PRs.
- Keep the feedback loop fast for developers.
I'm considering a few directions and would love to hear what's worked for others:
**Incremental/Diff Scanning:** This seems like the biggest win. I've seen some scripts that use `git diff` to identify changed files and run OpenClaw only on those, plus their dependencies. Has anyone built a robust script for this, especially handling transitive dependencies in the AST?
**Staged Scanning:** A lighter, ruleset-limited scan on PRs (check for critical/severe only), with a full nightly scan on the main branch. This requires confidence that the nightly scan will catch issues the PR scan missed.
**Caching:** OpenClaw's `--cache` flag helps, but we're not seeing huge gains. Are we configuring it wrong? Should the cache be persisted across pipeline runs (e.g., to S3)?
Here's our current basic job step. The obvious next step is to replace the `--all` with something smarter.
```yaml
- name: SAST Scan with OpenClaw
run: |
docker run --rm -v "${{ github.workspace }}:/src" openclaw/cli:latest
scan --all --format sarif --output results.sarif /src
```
What specific configurations or wrapper scripts have you used to make OpenClaw fast and effective? Particularly interested in:
1. Real-world `git diff` integration examples.
2. How you handle dependency scanning for incremental changes.
3. Any orchestration with the `--cache` directory across CI runners.