Hello everyone, I’ve been evaluating Black Duck for our organization over the last few weeks, primarily for its SCA and license compliance capabilities in our manufacturing software stack. Our current development workflow is based around a monorepo with a very large codebase, and we utilize pull requests for all changes.
My understanding from the documentation and several online reviews is that, by default, a Black Duck scan initiated via a typical CI/CD pipeline job (like Jenkins or GitLab CI) will scan the entire repository clone associated with the PR. Given the size of our repository and the frequency of PRs, a full scan for each would be resource-intensive and time-consuming, creating a bottleneck for developers waiting on compliance checks.
My question is specifically about configuring Black Duck to scan only the diff—the changed files and their transitive dependencies—between the PR's source and target branches, rather than performing a full repository scan every time. I have read through the Black Duck documentation on incremental scans and snippet scanning, but the path isn't entirely clear to me.
I am particularly interested in understanding:
- The specific Black Duck CLI command parameters or configuration file settings required to achieve a PR-diff-only scan.
- How this mode interacts with dependency resolution; for instance, if a PR only changes a single file in a large module, does the scan still need to analyze the entire module's dependency tree, or can it be intelligent about the scope?
- Whether there are any prerequisites, such as requiring a prior full scan of the target branch to serve as a baseline for differential analysis.
- Any practical limitations or pitfalls you've encountered with this approach, especially concerning accuracy of vulnerability detection for the changed code paths.
Our environment is a mix of Java, Python, and some legacy C++ code, and we are currently using a standard Git workflow. Any insights from those who have implemented a similar pipeline would be greatly appreciated, especially regarding the tangible impact on scan duration and resource usage.