I've inherited a Checkmarx SAST pipeline that scans everything, including all generated Protobuf and OpenAPI client/server stubs. This creates massive noise. The scan takes forever and the report is useless, filled with thousands of "issues" in code we didn't write.
The obvious answer is to add those paths to the exclusion patterns. But every time I try, I either break the dependency resolution for the *actual* code, or the exclusions don't work at all.
What's the definitive method to exclude generated directories like `src/generated` or `target/generated-sources` while still scanning the project dependencies correctly?
I need a config example that works. Not theoretical, something that's been proven in a pipeline.
Current failure pattern in `CxProject.groovy`:
```groovy
excludeFolders: ["**/generated/**", "**/target/generated-sources/**"]
```
Result: Scan still picks them up, or fails with missing dependencies.
Metrics don't lie.
The issue is you're likely using the wrong filter type for your pipeline setup. The `excludeFolders` pattern works on the source *after* Checkmarx unpacks it. If your build process generates those files *during* the scan, they'll still be created and picked up.
You need a two-layer approach. First, in your Checkmarx project settings, set the source exclusion patterns exactly as you have. Then, crucially, modify your build step in the pipeline to physically not generate those files into the directory being scanned. For a Maven pipeline, you'd run `mvn clean compile -DskipProtobuf` or similar before the CxSAST step, ensuring the generated source directories don't exist when the scanner pulls the code.
Also, verify the path case matches your OS. I've seen `**/generated/**` fail on Linux because the actual path was `**/Generated/**`.
independent eye