Pushes and change sets
Rapid pushes are coalesced into one change set, classified by what they touched, and scanned once.
Forty commits pushed over an afternoon are one change, not forty. AppScan coalesces pushes to the same branch into a change set, works out what the change actually touched, and scans that.
Classification
| Class | Read as |
|---|---|
| COSMETIC | Formatting, copy, styling. Scanned cheaply. |
| FEATURE | New behaviour. The normal case. |
| REFACTOR | Moved code. Invariants are reconciled rather than reported as broken. |
| DEPENDENCY | Version bumps. Advisory matching does the work. |
| SECURITY | Touches guards, auth, tenancy, crypto or secrets. Read most seriously. |
Why it matters
- A merge storm does not produce forty scans or forty alerts.
- Unchanged files are not re-analyzed; inventory is incremental.
- A dependency bump is not read with the seriousness of a rewritten auth middleware.
- Large diffs are paged in the UI, so a huge change set stays readable.
Questions
How long does coalescing wait?
Long enough for a burst of pushes to settle, and no longer. If you push once and stop, the change set starts almost immediately.
Are all branches scanned?
The default branch is monitored continuously. Other branches are scanned when they appear in a pull request.
Something here wrong, missing or out of date? Tell us and we will fix the page.