Overview

Repository builds in Aqua Supply Chain Security can show Scanning for a long time when an offline or branch scan is queued, when the branch name does not match the repository, or when UI status reflects an older pipeline run. Azure DevOps pipeline scans that complete successfully may still take additional time before results appear in Aqua because results are published after the pipeline step finishes. This article explains how to distinguish queue or branch issues from normal publish latency and assurance-policy failures.


Symptoms

  • Last Build Status remains Scanning in the Aqua UI while Azure DevOps shows the job finished
  • Scanned On date is old even though status recently changed (for example Scan Failed)
  • Scan Branch / offline scan for master appears stuck while heads/master completed
  • Pipeline fails with assurance policy violation (error code 13) while Aqua still shows in-progress state intermittently

How Pipeline Scans Flow to Aqua

  • Azure DevOps runs the Aqua scanner step in the pipeline
  • On completion, scan results are sent to Aqua using integration environment variables configured in the pipeline
  • Aqua Builds view updates after publish—there is often short latency between ADO completion and UI refresh
  • Assurance policies can fail the pipeline while still recording a completed scan with failed policy outcome.


Diagnostic Steps

1. Compare branch names

Confirm the branch exists in the repository (master vs heads/master vs default branch rename). Offline Scan Branch actions use the exact branch string configured in Aqua.


2. Check whether the UI reflects a recent scan

If Scanned On is weeks old, the current status may refer to an older build, not today’s pipeline run.


3. Re-run from Azure DevOps

Trigger a new scan from the CI pipeline (not only offline branch scan) and collect the raw pipeline log for that run.


4. Review assurance policies

A failed build due to Assurance Policy Violation is expected when policies block on findings. Temporarily disabling or adjusting the policy is a valid test to confirm scans complete and publish; re-enable policies after testing.


Resolution Patterns


ObservationTypical causeAction
Offline scan queued for wrong branchBranch mismatchScan correct branch or use CI pipeline scan
ADO success, Aqua laggingPublish latencyWait and refresh; verify pipeline env vars for result upload
Status Scan Failed, old Scanned OnStale UI recordRun new pipeline scan; confirm new timestamp
Intermittent stuck ScanningQueue/transientRetry; if reproducible, open case with ADO + Aqua logs


Verification

  • New pipeline run completes in Azure DevOps
  • Aqua Builds shows updated Scanned On time
  • Status reflects policy outcome (pass/fail), not indefinite Scanning
  • Repeated runs behave consistently after policy or branch corrections


Important Considerations

  • Intermittent Scanning states may self-resolve; capture logs if the issue returns
  • Distinguish policy failure (security gate) from scanner hang (no completion in ADO)


Platform Coverage

  • Component: Supply Chain Security (Azure DevOps integration)
  • Platform: Aqua SaaS with ADO pipelines