Hey everyone! 👋 First post here, but I've been lurking and learning a ton. I'm a big fan of trying to squeeze every bit of efficiency out of my tools, so I dove into Checkmarx recently for our CI pipeline.
I'm running into something that's really puzzling me with the SAST scans. From the docs and the UI, I understood that hitting the **'rescan'** button on a project (after a previous scan is complete) should trigger a *diff scan*—you know, only analyzing the new/changed code since the last run. That's a huge time-saver.
But in my testing, it doesn't seem to be working that way. Here's what I did:
* **Initial Scan:** I ran a full scan on a medium-sized repo. It took ~25 minutes. All good.
* **Made a Change:** I updated a single JavaScript file—just added a comment.
* **Clicked 'Rescan':** I waited for the last scan to finish, then hit the rescan button from the project's scan history.
* **Result:** The new scan still took ~22 minutes, and the console output showed it processing a huge number of files, not just the diff.
My expectation was a scan of a few seconds/minutes for one file. Has anyone else experienced this? I'm wondering:
* Is there a specific configuration (maybe in the `CxScanConfig`?) needed to *enable* diff scans on a rescan?
* Does the rescan button only work as a diff if the previous scan's source code is still "available" in some specific way?
* Or is the "rescan" label just misleading, and it's always a full re-scan unless you set up something custom with triggers/branches?
I love the idea of fast, incremental feedback for devs, but this feels like I'm missing a step. Any pointers from the community would be amazing!