Overview

Aqua Supply Chain Security scans code repositories based on events, not on a fixed schedule. Understanding when pull scans, push scans, and manual scans are triggered helps teams plan CI/CD integration and interpret scan timestamps in the Aqua console.

This article explains how auto-scan timing works for SCM-based integrations in Aqua SaaS Supply Chain Security.

Understanding Scan Triggers

Code repository scans in Supply Chain Security are event-driven. There is no configurable cron-style schedule for automatic repository scans in the Aqua console.

Pull Scan

A pull scan is triggered when new code changes are introduced through a pull request (or merge request). It scans only the modified code in that pull request.

Trigger: Opening or updating a pull request with code changes

Push Scan

A push scan is triggered when new code is pushed to the repository. It performs a full repository scan of the codebase.

Trigger: Git push to a tracked branch

Manual Scan

A manual scan can be initiated at any time from the Aqua console, independent of pull or push events.

Trigger: User-initiated action in the Supply Chain Security console

Viewing Scan History

The Aqua console displays when the last scan occurred for each repository:

1. 1. Navigate to Supply Chain Security → Code Repositories
2. 2. Select the repository
3. 3. Open the Repository Scan Detailed View to see scan history and timestamps

For more information, see the Repository Scan Detailed View documentation.

What Is Not Configurable

The following are not available as portal settings for SCM-based integrations:

• Fixed daily or weekly scan schedules
• Time-of-day scan windows
• Custom interval timers for auto-scans

If a repository has not had recent pull requests or pushes, no new auto-scan will occur until the next qualifying event or a manual scan is triggered.

Best Practices

1. 1. Use pull scans for incremental review — Enable CI integration so pull requests trigger scans before merge
2. 2. Rely on push scans for full coverage — Pushes to main or release branches trigger complete repository scans
3. 3. Run manual scans after onboarding — Initiate a manual scan when first connecting a repository to establish a baseline
4. 4. Monitor last-scan timestamps — Use the console detailed view to confirm scans are running as expected after integration events

Verification and Monitoring

To confirm scanning is working correctly:

1. 1. Open a pull request with code changes and verify a pull scan appears in the repository scan history
2. 2. Push a commit to a tracked branch and verify a full push scan is recorded
3. 3. Check the last scan timestamp in the repository detailed view
4. 4. Review findings in Supply Chain Security → Code Repositories after each scan completes

Platform Coverage

• Component: Supply Chain Security
• Platform: Aqua SaaS
• Integration types: GitHub, GitLab, Bitbucket, Azure DevOps, and other supported SCM integrations

Summary

Related Resources

• Supply Chain Security Onboarding Guide
• CI Pipeline Integrations
• Review Findings in Code Repositories